PWR Operator Manual · Open the simulator

03 — Controls and Indications

Document: PWR-CI-01
Title: Control Station Inventory and Operating Instructions
Revision: 24

1.0 Purpose

Describe every operator control and major indication on the PWR board, with purpose, location, operating procedure, and cautions. Use this as the control station operating procedure companion to plant evolutions in 04–07.

Naming rule: Controls are named by on-screen label.

2.0 General control rules

3.0 Rod Control card

Location: Synoptic left margin — Rod Control
Highlight id: reactor-rods

3.1 Control Bank — Raise / Lower

Procedure — move rods

1. Select Rod Speed: Slow | Normal | Fast.
2. Click Raise or Lower for a single step, or hold either to drive continuously.
3. Watch Startup Rate (SUR) and power.
4. Release to stop (a hold stops as soon as you let go; a click is already a discrete step).

CAUTION: Target SUR ≤ 1 DPM and reactor period ≥ 30 s on approach to criticality. With the fine-step drive (one step ≈ 1.5 ¢ near the crossing), single-step nudges at Slow keep the crossing well inside 1 DPM — big held withdrawals are what push the rate up.

Interlock: There is no startup-rate rod stop — SUR HI at 1 DPM is an annunciator, not an interlock, and the rate is yours to control. What does block withdrawal on a startup is the intermediate range high flux rod stop at 20 % current equivalent power, until you block the intermediate range high flux trip at P-10 — one press takes the trip and the stop together (05 §PWR-T14). Three other rod stops exist; all four are in 09 §2.0. Insertion is never blocked by any of them, and pressing WITHDRAW into one is refused with the stop named.

3.2 Rod Speed

Slow and fast are the two ends of the real rod speed program (WTSM 8.1, ML11223A252 — a minimum of eight steps per minute, and a maximum of 72 that the source calls a physical limit of the drive mechanism); normal is this simulator's own middle setting. On the real plant the automatic controller runs continuously between those limits; the three-position selector here is the operator's switch. Full travel — 627 steps — is 8.7 minutes at Fast, 13 at Normal.

3.3 Shutdown Bank — Withdraw / Insert

CAUTION: Red if not fully withdrawn during power operation (abnormal) — parking it in at power gives up shutdown margin. Insert it deliberately only as part of a planned shutdown/cooldown, not as a substitute for control-bank trim.

3.4 Insertion Limit

• Power-dependent floor on control bank withdrawal position.
• Alarm ROD INS LIMIT when at/below limit.
• Do not park rods below the limit during power operation without a plan to restore.

3.4a Top of Travel

• Ceiling on control bank withdrawal: 627 of 627 steps, the full travel of the bank.
• Alarm ROD BANK FULL OUT when the control bank reaches it. The WITHDRAW button is also

crossed out in red on a press that cannot move the bank.

• At the top stop there is no rod authority left; boron is the only reactivity lever. Dilute.
• Control bank only. The shutdown bank sits fully withdrawn as its normal hot position and

carries no such alarm.

3.5 SCRAM

Procedure — manual SCRAM

1. Arm the SCRAM control.
2. Confirm SCRAM.
3. Verify REACTOR TRIP alarm, power falling, rods inserting.
4. Verify heat sink (SG level / AFW) and inventory.

3.5.1 RPS reset — clearing the trip latch

Once tripped, the control reads SCRAMMED and becomes the RPS reset. Resetting re-closes the reactor trip breakers; it does not withdraw rods and it does not restart the reactor. The rods stay where they are until you deliberately withdraw them, under the startup net.

While the trip is latched the rod drive has no power. The reactor trip breakers sit in the supply line from the rod drive motor-generator set to the control rod drive mechanisms, so opening them removes power from the mechanisms — which is what lets the rods fall in by gravity in the first place. Until you reset the RPS, **WITHDRAW and INSERT are both refused on both banks**, and the refusal names the breakers. Pressing STOP still works: it is the release of a button, not a demand for motion.

This is why the reset comes before any rod motion in every recovery procedure, and it is the reason a failure to scram cannot be walked back with the rod buttons — with the breakers open there is nothing to drive the mechanisms with. The response to rods that did not insert is emergency boration (§7.5, Borate), not the rod controls.

The reset is permissive-gated — it will not take until both conditions hold:

The caption under SCRAMMED tells you which one is holding, so you do not have to press the control to find out. When both are satisfied it reads PRESS TO RESET.

When both are holding, the caption names the trip signal — a breaker will not hold in against a live signal whatever the rods are doing, so that is the more fundamental refusal and it is reported first.

Pressing while blocked is refused and the reason is annunciated — it costs nothing, and it names the condition. A trip you have not actually fixed keeps the plant latched: after a loss of feedwater, for example, the reset stays blocked on low steam generator level until the heat sink is restored. Recovery is procedural, not a button.

A BLOCKED trip is not a standing one. The permissive reads each channel the way the protection system does, so a trip you have legitimately blocked no longer holds the reset — which matters on a cooldown, where blocking the low-pressure reactor trip inside P-11 is a required step (05 §4.0 step C1a). Without that, a cooldown would depressurize below the low-pressure setpoint and then be unable to reset the trip it caused. Blocking a trip you have not satisfied the permissive for is refused at the block control itself, not here.

Procedure — RPS reset

1. Diagnose and clear the condition that tripped the plant.
2. Verify rods at bottom.
3. Verify the caption reads PRESS TO RESET.
4. Press to reset; verify the REACTOR TRIP alarm clears.
5. Withdraw rods only under the startup net (04 §PWR-N03), and only if restart is

intended — see the xenon caution in 04 §7.0.

4.0 Power & Reactivity card

Location: Left margin
Highlight id: reactor-power

4.1 Indications

4.2 Subcooling margin bar zones

WARNING: Do not throttle HPI solely because PZR level is high if subcooling is eroding.

4.3 Source Range detector (NIS)

Handoff rules (P-6) — what the plant does, and what it does not:

1. P-6 — Intermediate Range ≥ 1e-10 A — permits the source-range block. Take SR HIGH FLUX on the TRIP BLOCKS panel: it blocks the source-range reactor trip and switches the detector off, so SOURCE RANGE reads a dash (no reading) and INTER RANGE carries the indication. One control does both here; a real plant uses two pushbuttons, one per channel. Real procedures want about one decade of overlap between the two ranges before blocking.
2. Unblocked, the source range trips the reactor at 1e5 cps (IR ≈ 3.2e-9 A). On this plant P-6 is met before criticality, at about 3,100 cps, and the count rate at criticality is already about 2e4 cps — at a startup rate of 0.5 DPM (decades per minute) that leaves about a minute. Block at P-6.
3. On the way down the block clears itself below 5e-11 A (the P-6 reset) and the detector comes back on. Between 5e-11 and 1e-10 A a block already taken holds.

4.4 Startup trip blocks

Blocks auto-reinstate when power falls below their permissive — the SR block below the P-6 reset (5e-11 A), the other two below P-10.

5.0 Pressurizer (PZR) controls

Location: PZR Pressurizer card — pressure & level sections
Highlight id: pzr-pressurizer

5.1 Primary pressure indication

• System reference pressure for the whole RCS (uniform model).
• Normal: 2235 psi (15.41 MPa).

5.1a Pressure setpoint (Press SP)

• The pressure-control setpoint (MPa) the AUTO heaters/spray drive toward, shown as a live

readout with a numeric Press SP box (15 – 2466 psi (0.1 – 17 MPa); engine clamps to the relief band).

• Raise it toward NOP (2235 psi (15.41 MPa)) during a heatup — the heaters pressurize to the new target;

lower it during a cooldown so spray/relief brings pressure down. Used by the Mode-transition missions. (The box itself is MPa-denominated regardless of the US/SI display toggle, like the load setpoint.)

5.2 PZR Heaters

Use to RAISE pressure (restore subcooling, recover after spray/overcooling).

**In BOTH cold modes — Mode 5, Cold Shutdown and Mode 4, Hot Shutdown — the heaters boot OFF, and that is the correct lineup.** It is where PWR-N12 leaves them on the way down: it turns them off at the depressurization step, before the RHR alignment that makes the plant Mode 4, so either plant you are handed matches the plant you would have cooled down yourself. Putting them back in AUTO is an operator action, and it is PWR-N01 step 5b, from either start. Until you take it, the Pressure SP does nothing: measured on this engine, dialling 1700 psig (11.72 MPa) with the heaters off moves the plant 0.05 psi in 10 plant-minutes, against +133 psi (0.92 MPa) once AUTO is selected. Basis: WTSM ch. 19, *"All groups of pressurizer heaters are energized to raise the pressurizer water temperature to saturation"* — an operator act during the heatup, not a standing lineup.

Neither cold plant bleeds off while they are off. Over 60 plant-minutes untouched: Mode 5 362.6 psi (2.500 MPa) → 362.9 psi (2.502 MPa), +0.3 psi/hr; Mode 4 364.0 psi (2.510 MPa) → 364.2 psi (2.511 MPa), +0.2 psi/hr. Pressurizer level moves 25.00 → 25.03 % in both.

Four different things put heater power at 0 %, and only one of them is a mode above. The selector stays exactly where you left it in all four, so the panel alone cannot tell them apart — read the annunciators:

The shed is the one that needs a deliberate decision: the heaters are healthy and the bus is alive, they have just been dropped off it to make room for safety loads, and **securing injection does not put them back**.

And there is a fifth case where the reading is NOT zero and the heat is. The bank sits low in the vessel — roughly 5 % to 15 % level — and heat only enters water it is actually immersed in. As the level falls through that band the delivered heat falls with it: at 10 % the bank is half covered and delivers half its rating, and below 5 % it delivers nothing at all.

The HTR PWR indication does not fall with it, because it reads electrical power and an uncovered element is still drawing full current. That is not a fault in the gauge — it is the only honest thing an ammeter can say. On a healthy plant you never meet this: the 17 % cutoff in the table above de-energizes the bank before it uncovers, which is exactly why that setpoint exists. You meet it when the level channel is lying to you — the same failed transmitter that fools you fools the cutoff, the heaters stay energized into steam, and the only symptom is that pressure will not come up no matter what you demand. Cross-check level against charging/letdown flow and subcooling margin before you conclude the heaters have failed.

5.3 PZR Spray

DECLARED DEPARTURE — spray keeps working with the Reactor Coolant Pumps (RCPs) stopped. On a real unit the spray line is driven by the pumps' own differential head, so a loss of offsite power takes normal spray away and the operator depressurizes with the Power Operated Relief Valve (PORV) instead. A real unit answers that with auxiliary spray from the charging pumps. This departure was declared because the board had no auxiliary spray control, so the one spray control was left working without the pumps, standing in for it.

The engine models auxiliary spray, but it has no board control — one was added 2026-08-30 and removed the next day by owner direction, so on the board this departure is once again the only pump-less way down in pressure. The capability remains in the model for scenarios and the instructor. Retiring the departure — making normal spray lose its head with the pumps off, which is what the real plant does — is filed and will be its own change.

The stand-in's old "conservative direction" note is withdrawn: it claimed about half the condensing duty of real auxiliary spray, and this plant measures the opposite. From Hot Standby at 2235 psi (15.41 MPa) with every RCP secured, 600 s at 100 %:

The stand-in is the stronger lever here, not the weaker one.

In both cold modes the spray boots in hand and SHUT, alongside the heaters (§5.2), and for the same two reasons: it is where PWR-N12 leaves it, and with every RCP secured — which they are at Mode 4 as well as Mode 5 — a real spray valve has no head behind it. On this board the departure above means the lever would still act — which is exactly why leaving it in AUTO on a cold plant was wrong, not harmless. It goes back to AUTO at PWR-N01 step 5b, after the pumps are started at step 2.

Use to LOWER pressure carefully. Return to AUTO when on target.

CAUTION: Spray stuck open (failure) depressurizes continuously — isolate cause, heat if needed, trip if required.

5.4 PZR Level

• Normal ≈ 61.5 % at HFP; 25 % at no load — the program rides the Tavg span (09 §11.0).
• Controlled primarily by CVCS charging/letdown.
• TMI trap: level can rise while total inventory falls (void surge).

6.0 Relief Valves card

Location: Top margin near PZR
Highlight id: pzr-relief

6.1 PORV — Open / Close

Procedure — if PORV should be shut but leak suspected

1. Command PORV Close.
2. Check subcooling, primary pressure trend, tailpipe temperature, inventory.
3. If leak continues → Isolate PORV Block Valve.

6.2 PORV Block Valve — Open / Isolate

NOTE: Spring safety valves are a separate path; block valve does not isolate safeties.

6.3 Safety valves (indication only)

• Mechanical spring safeties, inside the engine — not a control-layer actuation, and nothing

on the board arms, blocks or isolates them.

• Open at 2500 psi (17.24 MPa) — the 2485 psig nominal setpoint — and reseat 5 % below,

at 2375 psi (16.375 MPa). Unlike the PORV these do not follow Press SP: they are a fixed mechanical rating and they are the last line.

• No direct operator open/close command.

7.0 CVCS panel (Chemical & Volume Control)

Location: Embedded on CVCS equipment box
Highlight id: cvcs

7.1 Charging Pump — On / Off

• Required for boration/dilution and charging flow.
• Impeller / flow indication follows charging_flow instrument.

7.2 Charging flow setpoint

• Injects inventory into cold leg.
• Raises PZR level / inventory; carries boron concentration change when adjusting.

7.3 Letdown Orifices (A / B)

• Two fixed orifices, each independently in or out — four lineups: off / A / B / A+B.
• Removes coolant from the RCS (bleeds the cold leg to the letdown HX / VCT); lowers inventory / PZR level.
• Flow is pressure-driven (∝ √ΔP across the orifice, referenced to the 300 psi (2.07 MPa) letdown backpressure — the pressure-control valve downstream of the orifice, WTSM §4.1),

so it tails off as RCS pressure falls on a cooldown — it is not a throttled setpoint.

• Nominal at NOP: A ≈ 3 %, B ≈ 4 %, A+B ≈ 7 % of rated (A+B is max letdown — a net drain,

exceeding normal charging, for level reduction / depressurization).

• Rate feel: uncompensated (charging secured), orifice A walks PZR level down ≈ 2 %/min;

A+B ≈ 5 %/min; max charging with letdown isolated raises level ≈ 13 %/min. Minutes to act, not seconds — and the 17 % low-level letdown isolation (see 09 §3.0) backstops an unattended drain.

• The cold lineup arrives with both orifices OUT. Mode 5, Cold Shutdown and **Mode 4, Hot

Shutdown** both boot that way, because on shutdown cooling letdown does not run through these orifices at all: it runs out of the residual heat removal (RHR) system through the HCV-128 cross-connect, which is wide open in that regime, while the orifices pass almost nothing against the 363 psi (2.50 MPa) plant you start from (WTSM ch. 19, ML11223A342). Putting an orifice in service before you pressurize is therefore a real step, not a formality — the RHR suction autocloses at 585 psig (4.03 MPa) on the way up and takes the cross-connect with it (04 PWR-N01 step 5a).

• Isolate = both orifices out — and that is letdown zero only with RHR out of service.

With RHR in service the cross-connect is still letting down whatever the selector reads; the LETDOWN FLOW indication shows the flow the plant is actually passing, not the lineup you selected, so the two can legitimately disagree on a cold plant.

• The 17 % low-level isolation stops BOTH paths, and the card shows it. At 17 % indicated

pressurizer level the protective isolate shuts the orifice path and the cross-connect (annunciated PZR LTDN ISOL, 09 §3.0). While it stands, all four lineup lamps go dark — a lineup lamp reports where the valve is, and both orifices are shut whatever you last selected — CLOSED lights amber to say the plant did that rather than you, and the card's status word reads ISOLATED. There is no automatic restoration: past 20 % the latch clears, and letdown stays shut until you re-select an orifice by hand, which lights the lamp again — see 06 PWR-A13a.

• Status word (bottom of the card): NORMAL while letdown is delivering (including on the

RHR cross-connect with both orifices out), SHUT when it is not and nothing is holding it shut but your own lineup, ISOLATED on the 17 % cut.

7.4 CVCS Inventory Control AUTO / MANUAL

7.5 Borate / Dilute / Hold

How you know the concentration — chemistry, not a gauge. There is no online boron readout in this control room, because that is how the industry actually works: boron concentration is known from grab samples analyzed by the chemistry lab, plus the operator's own dose bookkeeping. (Online "boronometers" exist at some plants but are not relied upon.) Between samples you infer boron the way real crews do: from the dose you ordered, and from the plant's response — rod position, Tavg drift.

BORON CONTROL (target ppm) — batch dose. The board's BORON CONTROL ON/OFF + target works like a real makeup panel: entering a new target computes the change and **meters it as a batch**, stopped by the flow totalizer — a dose lands on the ppm asked without overshoot. The panel asks for 0.05 ppm/s and the plant delivers what the charging lineup and the boric-acid tank allow, which is about 0.043 ppm/s at normal reactor coolant boron: there is no rate constant to dial, only a mass balance. Any target change executes, however small (1 ppm nudges work). The dose pauses if the charging pump stops and resumes with it. Boron driven directly (a procedure walkthrough issuing a borate/dilute rate) takes the channel to MAN.

CHEM SAMPLE — the authoritative number. Chemistry confirms every completed dose automatically: an RCS grab sample is drawn and the lab posts the result (sample N ppm) after a 30-minute lab turnaround — real time, matching a real lab's 30–60 min. (Through Rev 16 this read “compressed ~60 s”, which was the retired engine's.) Take a manual sample (CHEM SAMPLE button) when the dose books may be stale: after ECCS/accumulator injection (which borates the core outside the makeup system) or after boron was driven directly in a procedure. A fresh result while no dose is running re-baselines the panel — the books and the displayed target snap to the lab number, so the next dose is computed from reality.

At full power, dilution moves Tavg, not power. With the turbine at rated load the reactor self-regulates back to ~100 % — the boron change appears as a Tavg change (~0.9 °F / 0.5 °C per ppm). Use dilution to manage rod position / Tavg; move POWER with the turbine load. Below rated load, dilution does raise power.

Procedure — dilute for power rise (slow)

1. Charging pump On; BORON CONTROL On.
2. Set a lower boron target (dilute) — the batch dose meters the change and stops at it.
3. Watch power / Tavg respond; track the dose you have ordered.
4. At the planned change, confirm with a CHEM SAMPLE; trim with rods.

Procedure — borate for power reduction / xenon prep

1. Charging pump On; BORON CONTROL On.
2. Set a higher boron target (borate).
3. Coordinate with rod insertion and load reduction as the dose delivers.
4. Confirm the new concentration with a CHEM SAMPLE.

8.0 Primary Flow / RCP card

Location: Bottom margin near cold leg
Highlight id: rcp / primary-inventory

8.1 RCP status and Start / Stop

CAUTION: At power, loss of flow is an immediate trip condition. Do not stop RCPs at power except as directed by emergency procedure / drill script.

8.2 Inventory / void (Physics Overlay)

• core_inventory_pct, primary_void_fraction — Learning + overlay.
• Infer inventory from PZR level + CVCS + subcooling when overlay off.

9.0 Steam Generator and feed controls

9.1 SG Level card

Highlight id: sg-level

Shrink and swell: On rapid load/power change, indicated level can move the wrong way briefly. Do not chase with large feed swings.

Imbalance annunciator: ▲ filling / ▼ draining when turbine load and reactor power are mismatched (> ~40 MWe class).

Level ladder (protection):

On a gauge, red at the two trip bands (≥90 %, ≤17 %), amber at the alarm bands, green through the normal ~30–75 % operating range. See §09 for the authoritative setpoint table. AFW also auto-starts on collapsed feed flow at power and on the post-trip handoff — see §12.

9.2 Steam & Flow card

Highlight id: sg-steam

STEAM FLOW / SG FEED RATE — the matched pair

Two indications, deliberately on the same gpm scale and stacked in the same column so they can be compared at a glance. Together with SG level they are the three elements the feedwater controller regulates on — and the same three you use when you take it manual.

STEAM FLOW is main-steam-line flow, not turbine flow. With the turbine tripped and the dump carrying the plant, the governor is shut but the generator is still boiling hard — this indication stays up, and feed must follow it. Watch the pair through a turbine trip: the governor goes to 0 % and the dump to ~98 %, and STEAM FLOW barely moves.

Reading the pair

• Feed = steam → level is steady, wherever it happens to be.
• Feed < steam → level is falling. It will keep falling until you fix the flow.
• Feed > steam → level is rising, likewise.

Level tells you what already happened; the flow mismatch tells you what is about to.

Feed Pump — Set gpm / ▲▼

WARNING: in MANUAL the pump does exactly what you asked and nothing else. Set it to match steam flow and level holds indefinitely; set it wrong and level ramps to a trip in whichever direction the error points — high-high (≥90 %, feed isolation and turbine trip) or low-low (≤17 %, reactor trip). There is no value that is safe at all powers: matching flow at 100 % power is ~1000 gpm, at 6 % power it is ~50 gpm.

Procedure — control SG level manually

1. Note controller status (three-element AUTO vs MANUAL).
2. Read STEAM FLOW. Set SG FEED RATE to match it — that stops the level moving.
3. Only then trim: a little above steam flow to raise level, a little below to lower it.
4. Return to the matched value as level approaches where you want it — level lags, so trim

back before you arrive, not after.

5. Re-engage AUTO (SG FEED RATE panel) when done; the channel regulates to the

programmed 65 % level, walking there gently from wherever level stands at engage. To hold a different level on purpose, stay in MANUAL.

RESTORE — main feedwater isolation

The isolation seals in: it holds until the actuating signal clears, and pressing RESTORE before then is refused with a message naming the reason. This is deliberate — an isolation is a protective action, and being able to switch one off while it is still legitimately demanded would make it no protection at all.

After a reactor trip, the usual blocker is the trip itself. The low-Tavg isolation is a coincidence — low Tavg and the trip latch — so resetting the RPS (§3.5.1) clears half of it and the restore is then accepted. That is the ordinary sequence: **confirm the trip → reset the RPS → restore main feed**, and only if you actually need main feed. In Mode 3, Hot Standby you do not: AFW carries decay heat indefinitely.

WARNING: restore only after you have set feed demand to something decay heat can absorb. Main feed returns at whatever the pump was last commanded, and the generator is already recovering on AFW — measured, restoring into a recovering generator with feed demand still up drives level from 36.6 % to 77 % in about two minutes and isolates you again at the 90 % high level. Set SG FEED RATE to match STEAM FLOW first (see the matched pair above); at decay heat that is a very small number.

MSIV — Open / Close

WARNING: Closing MSIV at power is a major transient. Expect turbine trip and rising SG pressure.

10.0 Auxiliary Feedwater (AFW) — Emergency Cooling card

Tab: AFW
Highlight id: emergency-cooling

Aux feed throttling cuts both ways, and on this board the CHANNEL does it, not you. Too little and the generator boils down toward the low-low level that started the pumps. Too much and you overcool the primary: aux feed arrives at about 70 °F (21.1 °C) against a secondary near 550 °F (287.8 °C), so an unthrottled pump drags reactor coolant temperature down with it. The symptom the procedures name is that all the steam dump valves shut — if the dumps are closed and temperature is still falling, there is too much aux feed. Left wide open long enough the generator fills past the top of the narrow range and starts carrying water into the steam lines; the high-high level turbine trip at 90 % narrow range exists to get the machine off the line before that happens.

What you watch, since you no longer hold the valve: the steam dumps and the level trend. If the dumps are shut and temperature keeps falling, the channel is overfeeding — secure the pumps with STOP and let level recover, then press AUTO, which restarts the motor-driven pump on the level hold and delivers nothing until level falls below 38 %. That is the whole of the operator's authority over aux feed on this plant.

Procedure — establish AFW (loss of main feed)

1. Confirm main feed lost / SG level falling.
2. SCRAM if not already tripped.
3. Verify the auto-start. The pumps start themselves on low-low SG level, a standing safety injection, loss of main feed above 5 % power, or loss of offsite power — there is no manual start to press.
4. Verify the level recovers toward 33 % narrow range and that the steam dumps are not all shut — the channel throttles, and shut dumps with falling temperature mean it is overfeeding.
5. When stable, secure the pumps with STOP if the procedure calls for it — the actuation is standing whether or not you touched the pumps. Pressing AUTO afterwards restarts the motor-driven pump on the level hold.

Securing note: an aux feed stop is refused while a safety injection is standing, because the SI signal is itself an aux feed start — secure the injection at its own panel first. Inside the actuation reset time delay the stop refuses and says so; after it, one click resets the function and secures the pumps even with the signal still present.

Failure note: afw_failure can show pumps “running” with zero delivery (shut valves) — verify level response, not just run lights.

11.0 Emergency injection (HPI/LPI)

Tab: HPI/LPI

Procedure — HPI on small-break LOCA / stuck PORV

1. Confirm subcooling eroding / pressure falling.
2. Ensure HPI On (or AUTO actuation).
3. Do not throttle solely on rising PZR level.
4. Isolate PORV path if stuck open.
5. Restore inventory and subcooling.

Securing note — two conditions, and the clock is the one that surprises people. Once safety injection has latched, Off is refused until both: the reset time-delay relay has run (60 s from the actuation), and the reactor is tripped — the P-4 permissive. The refusal message names whichever one you are waiting on and counts the seconds down. After both are satisfied, one click resets the function and secures the pumps, signal present or not — so securing injection on a live low-pressure signal is something the board will let you do, and owning that decision is the point of the delay. Aux feed cannot be secured underneath a standing injection at all (§10), because the SI signal is itself an aux feed start.

11.1 Accumulators (passive)

• Embedded panel — status + flow when discharging.
• Passive discharge: the check valve opens automatically when primary (cold-leg) pressure falls

below the arming setpoint; finite borated capacity depletes as they inject (volume % → 0).

• Discharge isolation valve (motor-operated, in series with the check valve): Open / Isolate.

Default aligned (open). Isolate before depressurizing below the check-valve setpoint on a normal cooldown so the accumulators do not spuriously dump into the depressurized RCS; also used to isolate a leaking/mispositioned tank. A shut valve blocks discharge at any pressure.

• Cold-water quench: accumulator/ECCS water injects cold, and the two sources are not the same temperature: the RWST is 70 °F (21.1 °C) — the usual Technical Specification floor, and what the injection pumps deliver — while the accumulators sit at 120 °F (48.9 °C), the midpoint of their sourced 100–150 °F operating band, so a large-break dump

cools T-avg as well as restoring inventory and boron.

11.2 RHR

12.0 Turbine-Generator card

Highlight id: turbine-generator

12.1 Latch, trip and offline

The generator card carries three buttons: LATCH / TRIP / OFF.

This card used to be a FOLLOW / MAN dispatch-mode selector, and it was replaced. This plant has one dispatch mode — you set a load target and the turbine holds it — so a mode selector had nothing to select, and worse: **nothing in the whole command set could un-latch the turbine**, so after any trip the generator was dead for the rest of the session and the two buttons that looked like the way back could only refuse. Latched and tripped are the real states of a turbine, and these are the two operator actions that move it between them.

What LATCH refuses on. It will not latch a machine into a plant that is still tripping it, and the refusal names which of these is standing:

The order after a scram is: reset the protection, LATCH, then set a load target. Latching does not by itself make power — the reactor has to be making steam, and after a scram it is subcritical.

A planned offline is NOT a turbine trip. Pressing OFF opens the generator breaker: load goes to zero, but the stop valves stay open, no trip latches, and **P-9 is never armed** — so it does not scram the reactor and it is fully reversible by setting a load target. A real turbine trip arrives by its own routes: low vacuum, the P-14 high-high SG level actuation, a reactor trip, MSIV closure at load, or the injected turbine_trip failure. Overspeed is configured as a sixth route but cannot occur here — this plant has no turbine roll model, so the rotor never exceeds the rated speed the grid holds it at (12 §12.14).

WARNING: a genuine turbine trip above 50 % power (P-9) scrams the reactor — see 09 §2.0 and PWR-E03. What this plant rides out is a load rejection, not a turbine trip.

NOTE — the load slider does not un-trip the machine. Typing a load target at a tripped turbine is accepted and reads back at the target you asked for while the governor sits at 0.0 % and the machine makes nothing. If the card looks unresponsive, that is what you are seeing — press LATCH, not the load slider.

The OFF lamp lights on either condition — breaker open or turbine tripped — so read TURB TRIP to tell a planned offline from a trip.

12.2 Turbine Load (MWe)

• Slider / setpoint 0 – rated (~100 MWe).
• Setting a target forces Manual mode.
• Raising load draws more steam → power follows (with feedback).

RAISING LOAD RAMPS; LOWERING IT DOES NOT. Two numbers, and the box shows the first one.

• What you type is the dialled target, and the box reads it back the instant you type it, so

ten clicks of the arrow get you to 100 MWe without waiting for anything.

• Raising: the effective target — what the turbine is actually being asked for — walks up

toward your dial at 5 % of rated per minute, i.e. 5 MWe/min on this plant, so 0 → 100 MWe is a 20-minute ramp. Read it on the MWe output indication (§12.4), which follows the machine and not your dial.

• Lowering: immediate. A target below where the machine is takes effect at once, whatever the

size of the cut.

• Why the raise is ramped. A load increase delivered in zero time shrinks the pressurizer

faster than charging can answer. Measured on this plant, from 10 MWe with the rods left alone: an instant dial to 30 MWe pulled Tavg down 15.3 °F (8.5 °C) and took indicated pressurizer level from 26.7 % to 16.1 % in 44 seconds, through the 17 % low-level isolation (09 §3.0), which shuts letdown and sheds the heaters. The same change on the 5 %/min ramp spreads the Tavg swing over four minutes — 12.9 °F (7.2 °C), level bottoming at 20.4 % — and is back on program inside 90 minutes.

• Why the reduction is not. Lowering load does the opposite to the pressurizer — the loop

warms, expands, and level swells, away from the low-level cut — so the direction that needs limiting is the raise. Ramping the cut as well would also make the operator's dial incapable of arming the C-7 loss-of-load steam dump, which arms on a decrease faster than 5 %/min: the same number as the ramp. Losing the graded ride-out from the dial is not a trade worth making (§12.3, and 09 §10.0).

• The rate is the plant's sourced load-following envelope: *"ramp increases of 5% of full power

per min"* (Ginna UFSAR chapter 10, section 10.1.2.1, ML20339A040). The same sentence adds that "similar step and ramp load reductions are possible" — a statement about what the machine can absorb, not a limit on the operator, and it is not modelled as one. The document allows a 10 % step as well; that allowance is not modelled here — a raise ramps, always.

• Also not ramped: the automatic OTΔT/OPΔT runback (200 %/min, its own protective path —

and it moves your dial down with it, so the load stays where the runback put it), a **turbine trip, and the UNLOAD** button on the turbine card, which opens the breaker rather than turning a dial.

Procedure — raise electrical load (with rods)

1. Withdraw rods slightly (or dilute) so reactor can support higher power.
2. Raise Turbine Load to new MWe.
3. Wait out the ramp — the machine takes one minute per 5 MWe. Trim rods against the ramp,

not against the number you typed.

4. Verify SG level stable; re-engage feed AUTO if needed.

Procedure — lower electrical load

1. Reduce Turbine Load first. A reduction is not ramped and lands at once.
2. Insert rods (or borate) to match.
3. Watch SG swell / level high.

12.3 Steam Dump / Bypass

12.4 Indications

13.0 Condenser card

Highlight id: condenser

Low vacuum → alarms → turbine trip at trip setpoint (~22 inHg (74.5 kPa) instrument path).

13.1 Circulating-water inlet temperature (CW INLET TEMP)

The condenser can only pull the exhaust down to saturation at whatever temperature the cooling water can hold, so circ-water temperature sets how much vacuum you get — and the penalty grows with load, because more heat is rejected across the tubes at high power.

MEASURED ACROSS THE BAND — hot full power, 600 s, and every figure re-taken on this plant:

What circulating-water temperature does on this plant:

• Warm circ water → the condenser can only pull down to a warmer saturation → less vacuum,

and the 22 inHg (74.5 kPa) turbine trip gets closer.

• Cold circ water → vacuum above the rated value.
• It does NOT move MWe here — measured 100.0 MWe at every step from 35 °F to 85 °F. This

turbine is dispatched to a load target, not floated on the backpressure, so warm water costs you vacuum and margin rather than output. On a real machine it costs both; that is a declared departure of this model, not a claim about plants.

• Nor does it move the RHR cooldown floor. Shutdown cooling on this plant rejects to its own

component-cooling water at a fixed 95 °F (35 °C), which does not read this box. The old coupling was the retired engine's.

⚠ CHANGED, AND IT IS A REAL ONE: lake temperature ALONE CAN NOW RING COND VAC LO. The alarm is at 25 inHg (84.7 kPa) and the band crosses it at about 76 °F — measured, 24.85 inHg at 77 °F and 23.68 inHg at the 85 °F ceiling, with the annunciator confirmed in through the full stack. The previous edition of this section said the opposite ("even the 85 °F ceiling leaves ~2 inHg of margin"); that was measured on the retired engine and is false here by about 1.3 inHg the wrong way. A hot summer day is now an alarm you have to answer.

The walk continues to COND VAC TRIP (22 inHg / 74.5 kPa), but not from lake temperature: the ceiling stops 1.7 inHg short. Reaching the trip — and the C-9 interlock removal that takes the steam dumps with it — needs an equipment casualty: the circulating-water pumps, condenser air removal, or tube fouling.

14.0 Automation channels (board AUTO procedures)

14.1 Engage a channel

1. Find the channel's AUTO control on its board card — STEAM GEN FEED → AUTO (three-element SG level), BORON → ON (target ppm), STEAM DUMP → AUTO, CHARGING → AUTO. (There is no rod AUTO control on this plant — see §14.3.)
2. Where the card carries a setpoint box (boron target ppm, dump setpoint), set/verify it; the other channels capture the current reading on engage.
3. Press AUTO — the button stays lit while the channel is engaged.

14.2 Return to manual

1. Operate the underlying control (rods, feed %, etc.), or select MAN.
2. Channel disengages; operator owns the parameter.

14.3 Rod control is MANUAL on this plant, and that is deliberate

There is no automatic rod controller here, and there is no button for one. This is a learning plant, and moving the rods yourself is how you learn what they do. A real plant hands the control bank to a controller that holds average coolant temperature (Tavg) on a reference (Tref) programmed from turbine load, and the operator supervises it. Here the operator IS that controller — and the ΔREF readout on the rod-control card (§3.1) is the error it would be acting on.

What that leaves you holding:

• The rods set temperature; the turbine sets power. At 80 MWe, inserting 60 steps lowers Tavg

about 6.6 °F (3.67 °C) — roughly 0.11 °F (0.061 °C) per step — while the generator stays at 80 MWe.

• The plant follows load without the rods, but it does not put Tavg back. Cut the generator

from 100 to 80 MWe and leave the rods alone: the generator is at 80 MWe within a minute, but reactor power only falls to about 93.5 %. Tavg settles about 10.4 °F (5.8 °C) above Tref — 583.9 °F (306.6 °C) against 573.4 °F (300.8 °C) — and the condenser steam dump stays between about 39 and 53 % open, carrying the difference; it is still open 40 plant-minutes later. Insert rods and Tavg comes down, power falls to the load and the dump closes: the 60 steps above take power from 93.5 % to 79.1 % and shut the dump. That trim is your job; a controller would have done it for you and you would not have seen the coupling work.

• Reactivity per step is not constant. One rod step is worth several times more mid-bank than

near either stop, so the same tap moves the plant differently depending on where the bank is. With no controller de-rating itself on your behalf, this is yours to feel.

NOTE: every rod stop in this plant still acts — see 09 §. The stops block withdrawal; insertion is always available.

15.0 Inject Failure tab (operator drill control)

Not a plant control — trainer control, and shown in Free Play only.

1. Open Inject Failure.
2. Select failure (e.g. PORV Stuck Open).
3. Set severity if offered.
4. Inject.
5. Execute the matching PWR-E## procedure.
6. Clear or Reset when drill complete.

16.0 Indication catalog (operator-facing)

Every board instrument, with its indicating range, typical lag, and the annunciators it drives (see 06_ALARM_RESPONSE.md for each alarm's response). A reading pegged at a range end may be over-range, not truth — the power range reads to 200 % precisely so a pegged meter can still cross the 115 % trip.

Trap — steam_flow vs sg_steam_flow. With the turbine off line or tripped, the steam dump carries the plant and steam_flow reads ~0 while the generator is still boiling. Feed regulation follows sg_steam_flow; load-following consumers (the Tavg program, the rod channel) follow steam_flow. Reading the wrong one during a ride-out is how an SG drains with the flow gauge apparently at zero.

| steam_dump_valve | % | 0 – 100 | 0.3 s | Dump/bypass position | — | | governor_valve | % | 0 – 100 | 0.3 s | Turbine admission | — | | mwe_output | MWe | 0 – 130 | 0.2 s | Grid | — | | turbine_rpm | RPM | 0 – 2000 | 0.5 s | Sync (overspeed unreachable — 12 §12.14) | — | | condenser_vacuum | inHg (kPa) | 0 – 30.1 (0 – 102) | 5 s | Turbine health | COND VAC LO / TRIP | | boron_sample (CHEM) | ppm | 0 – 2500 | 30 min lab | Chemistry grab sample — the boron reference | — | | charging_flow / letdown_flow | norm | 0 – 0.12 | 2 s | CVCS lineup | — | | hpi_flow | norm | 0 – 1.2 | 1 s | ECCS delivery | (HPI ACTIVE status) | | hpi_discharge_pressure | psi (MPa) | 0 – 2611 (0 – 18) | 0.5 s | Pump vs RCS head | — | | afw_flow | norm | 0 – 1.2 | 1 s | AFW delivery | — | | afw_discharge_pressure | psi (MPa) | 0 – 1740 (0 – 12) | 0.5 s | AFW pump health | — | | accumulator_flow | norm | 0 – 1.2 | 0.5 s | Passive injection | — | | primary_leak_flow | norm | 0 – 1 | 0.2 s | Identified leakage | — | | porv_indicator | open/closed | status | — | May lie (shows the command) | PORV OPEN | | porv_tailpipe_temp | °F (°C) | 32 – 482 (0 – 250) | 10 s | Stuck PORV clue | — |

17.0 Campaign-aligned skills (manuals supplement)

These topics appear as dedicated campaign missions; manuals cover them here so Free Play users have the same procedure-grade notes. Plant MODE: almost all are Mode 1, At Power unless noted.

17.1 1/M and NIS handoff (Mode 3 → Mode 2)

• Source Range counts show subcritical multiplication as rods withdraw (1/M idea: counts rise as you approach criticality).
• When Intermediate Range ≥ 1e-10 A (P-6), block SR HIGH FLUX on the TRIP BLOCKS panel — that also switches the source-range detector off, and the intermediate range becomes the instrument to read. Unblocked, the source range trips the reactor at 1e5 cps. See PWR-T13 / PWR-N03.
• Campaign mission pwr_startup / pwr_startup_challenge grade this path; manuals do not auto-grade.

17.2 Holding Tavg by hand (Mode 1)

There is no automatic rod control on this plant (§14.3), so this is the drill that replaces the old engage-the-controller one.

1. Read ΔREF on the rod-control card — Tavg minus Tref. Zero is on program; + means the

coolant is hotter than the program wants (insert), − colder (withdraw).

2. Tap the bank in the direction that closes the deviation and stop — rod worth per step

changes with bank position, so the same tap does not always move the plant the same amount.

3. Wait for the plant to answer before tapping again. The coupling is slow; chasing it is the

commonest mistake.

4. Change generator load and watch ΔREF jump as Tref slides with the load. To follow it over

time, plot Tref and Tavg − Tref from the Indications tab. **The turbine set the power; you set the temperature.**

See PWR-T10 / T11.

17.3 Feed specialist — three-element vs MANUAL (Mode 1)

Leaving feed MANUAL while reducing power floods the SG (campaign bonus pwr_sg_flood): the pump holds the speed you set while steam flow falls away beneath it, so the mismatch grows even though you touched nothing. STEAM FLOW is the indication that shows this happening — level will not admit it for several minutes. Re-engage AUTO when done — PWR-N12.

17.4 Getting an ESF actuation back — the reset permissive (Mode 1)

There is no ESF AUTO / MAN selector on this plant. A real plant gives the operator an arm switch per engineered-safeguard system, and pressing MAN takes that system out of automatic. Here the actuations live inside the protection logic and nothing on the board defeats them — the HPI AUTO button is dark, and the AFW AUTO button is a lamp that is already lit. What you get instead is a reset permissive, and it is a better thing to learn, because it is what a real operator is actually fighting on a trip.

What an actuation does. Safety injection and aux feed latch. While a latch stands the pumps are held running: the demand is re-asserted every step, so an Off click does not quietly lose to the plant a second later — it is refused up front, with the reason on the screen.

What clears it.

Once satisfied, one click both resets the function and secures the pumps — you do not reset and then stop as two actions. And it works with the actuating signal still present: the circuit blocks automatic re-actuation on that same standing signal, so securing injection while pressure is still low is a thing the board will let you do. That is the decision the delay exists to make you own.

The trap. The refusal counts down in seconds and reads like a malfunction the first time. It is not — it is the relay. Read the message: it names which permissive you are short of, and the only one you will meet from the board is the relay — every safety injection trips the reactor on the same step, so the P-4 condition is always already met.

*Sourced — the reset circuit's time-delay relay "produces an output (energizes) some time after it is started (usually 45–60 sec)", with SI reset additionally requiring the P-4 reactor-trip contact: Westinghouse Technical Systems Manual §12.3.2.3 (ADAMS ML11223A310). The top of the band is the installed value.*

PWR-T12. Campaign: pwr_esf.

17.5 MSIV — “bottle the boiler” (Mode 1)

1. MSIV Close (CONFIRM?) isolates main steam.
2. Turbine load rejects; SG pressure rises toward the SG safeties — a staggered bank, first

lift 1099 psi (7.58 MPa), the rest at 1155 psi (7.96 MPa) (09 §3.0).

3. With feed lost or reduced, SG level can fall toward LO-LO trip on a short clock.
4. Establish AFW / trip reactor as required.

Campaign: pwr_msiv. Alarms: PWR-A23, A24.

17.6 Checkpoints and exams

Campaign grades solo criticality (pwr_startup_challenge), shift dispatch (pwr_shift_exam), and senior stuck-PORV exam (pwr_qualify). Manuals provide the underlying procedures (N02, N07/N08, E07/X01) but not the grading scripts.

18.0 Engine command reference

Every on-screen control issues one of these engine commands (the same names appear in the Instructor's procedure steps, the board's automation channels, and diagnostic logs). Listed for cross-reference — normal operation never requires typing a command.

19.0 Related documents

• 04_NORMAL_OPERATIONS.md
• 05_MODE_TRANSITIONS.md
• 09_SETPOINTS_LIMITS.md
• 11_CAMPAIGN_CROSSWALK.md

These manuals are licensed CC BY 4.0 — see Legal. Training documents for an educational simulator, not licensing-basis documents for a real plant.