PWR Operator Manual · Open the simulator

06 — Alarm Response Procedures

Document: PWR-ARP-01
Title: Annunciator Response — PWR
Revision: 24

1.0 Purpose

Provide operator response for each modeled PWR annunciator. Alarms read instruments (or status booleans derived for the board). A failed sensor can suppress or falsely create alarms.

MODE note: Most at-power alarms apply in Mode 1, At Power (or Mode 2, Startup). REACTOR TRIP and post-trip recovery put the plant in Mode 3, Hot Standby.

2.0 Alarm philosophy

Priority	Meaning	Operator stance
Critical	Trip or imminent core/heat-sink threat	Immediate actions; verify automatic protection
Warning	Approaching trip or significant upset	Diagnose and correct promptly
Caution	Off-normal; may not need immediate action	Monitor; correct if trend worsens
Status	System state change (e.g. HPI running)	Verify expected vs unexpected

Status annunciators arrive already acknowledged. A Status tile reports a lineup, not a demand for action, so the board acknowledges it for you: it comes in lit and steady rather than flashing with an ACK outstanding, it is not counted in the Alarms header, and it does not drop fast-forward back to real time. It is still on the board, still shows its real reading, and still clears itself when the condition goes away. Only Critical, Warning and Caution require your acknowledgment.

If a Status tile's condition stops being the planned state of the plant — you heat up past Mode 4, or a pump you had secured actually trips — the annunciator escalates back to its normal priority and un-acknowledges itself, flashing as a new alarm. An acknowledgment you made is never taken back.

Mode- and lineup-dependent classification

Some conditions are a casualty at power and the planned lineup when shut down. A cold plant is cold, is depressurized, and its reactor coolant pumps are stopped — annunciating that as a depressurization with tripped pumps would bury a normal Mode 5 board under critical alarms and train the crew to ignore them.

The board therefore reclassifies these alarms rather than removing them. The annunciator still comes in and still shows the real reading; its priority drops to Status and its text changes to say why. A reclassified tile reads, e.g., status (normally critical). Because it is now Status-class, it also arrives acknowledged — a healthy Mode 5 spawn presents five standing annunciators and asks nothing of you.

Annunciator	Reclassified to Status when	Reads
PZR PRESS LO (A05)	Mode 4 or 5	Pressurizer Pressure Low — expected, plant depressurized
PZR PRESS LO LO (A06)	Mode 4 or 5	Pressurizer Pressure Very Low — expected, plant depressurized
LO TAVG / P-12 (A29)	Mode 4 or 5	Coolant Temperature Low — expected, plant is cold
TURB TRIP (A22)	Mode 4 or 5	Turbine Secured — no steam demand
RCP TRIP (A19)	pumps stopped by the RCP handswitch	Reactor Coolant Pumps Secured

What this does NOT do — read this before you rely on it.

Mode 3, Hot Standby is excluded. Post-trip and hot-standby operation keeps every alarm above at full severity. A depressurization or a loss of the pumps in Mode 3 reads exactly as it always did.
RCP TRIP is keyed to the handswitch, not to the mode. Securing the pumps at power reads Secured; a pump lost to a trip, a coastdown or a blackout reads RCP TRIP, critical in any mode, including Mode 5.
A real leak during a cooldown will read as Status on the pressure annunciators. The alarms that distinguish it — LO SUBCOOL / SUBCOOL LOST (A10/A11) and PZR LVL LO / LO LO (A13/A14) — are never reclassified. In Modes 4 and 5, treat those as your inventory alarms; pressure alone will not tell you.

Global immediate actions (any alarm flood)

Stop what is making it worse (stop rod withdrawal, stop load step).
Scan vital-few strip: Power, Pressure, Tavg, PZR level, SG level, Subcooling.
Acknowledge (A key) after you have read the first-out story.
Verify automatic SCRAM / ESF if setpoints exceeded.
Enter the matching PWR-A## and, if a failure is active, PWR-E##.

Panel layout

Panel	Systems
A	Reactor / primary / nuclear
B	Secondary / turbine / support systems

3.0 Alarm index

ID	Annunciator	Priority	Panel
PWR-A01	REACTOR TRIP	critical	A
PWR-A02	HI FLUX	critical	A
PWR-A03	HI TAVG	warning	A
PWR-A04	PZR PRESS HI	warning	A
PWR-A05	PZR PRESS LO	warning	A
PWR-A06	PZR PRESS LO LO	critical	A
PWR-A07	PORV OPEN	warning	A
PWR-A08	SUR HI	caution	A
PWR-A09	SR HI FLUX	caution	A
PWR-A10	LO SUBCOOL	warning	A
PWR-A11	SUBCOOL LOST	critical	A
PWR-A12	PZR LVL HI	caution	A
PWR-A13	PZR LVL LO	warning	A
PWR-A13a	PZR LTDN ISOL	warning	A
PWR-A14	PZR LVL LO LO	critical	A
PWR-A15	ROD INS LIMIT	warning	A
PWR-A15a	ROD BANK FULL OUT	warning	A
PWR-A16	SG LVL HI	caution	B
PWR-A16b	SG LVL HI HI	critical	B
PWR-A17	SG LVL LO	warning	B
PWR-A18	SG LVL LO LO	critical	B
PWR-A19	RCP TRIP	critical	B
PWR-A20	SAFETY INJECTION	critical	B
PWR-A21	SBO	critical	B
PWR-A22	TURB TRIP	warning	B
PWR-A23	MSIV SHUT	warning	B
PWR-A24	SG PRESS HI	caution	B
PWR-A25	COND VAC LO	caution	B
PWR-A26	COND VAC TRIP	warning	B
PWR-A27	RCP CAVITATION	warning	B
PWR-A28	LOAD IMBAL	caution	B
PWR-A29	LO TAVG (P-12)	warning	A
PWR-A30	CHG FLOW HI	caution	A
PWR-A31	PZR LVL DEV LO	caution	A
PWR-A32	SI ACCUM ALIGNED < 1000 PSI	caution	B
PWR-A33	RHR NOT IN SERVICE	warning	B
PWR-A34	RCS COOLDOWN RATE HI	warning	A
PWR-A35	RCS HEATUP RATE HI	warning	A
PWR-A36	CTMT PRESS HI	warning	B
PWR-A37	CTMT PRESS HI HI	critical	B
PWR-A38	CTMT SPRAY ON	status	B
PWR-A39	CTMT FANS SI	status	B
PWR-A40	CTMT H2 HI	warning	B
PWR-A41	CTMT H2 BURN	critical	B
PWR-A42	H2 RECOMB ON	status	B
PWR-A43	PZR HTRS SHED	caution	B
PWR-A44	PZR LVL DEV HI	caution	A

PWR-A01 — Reactor Trip (REACTOR TRIP)

Field	Content
Setpoint / logic	`rps_scrammed` true
Means	Reactor Protection System has shut the reactor down (or manual SCRAM completed).
Automatic actions	Rods drive in; load → Disconnected
Immediate operator actions	1) Verify power falling and rods inserting. 2) Verify turbine load rejected. 3) Ensure heat sink (SG level / AFW). 4) Check pressure, inventory, subcooling. 5) Diagnose cause (first-out / failures).
If not expected	Manual SCRAM if power not falling; treat as ATWS path (PWR-E13).
Recovery	Stabilize Hot Shutdown (PWR-T06). Clear the tripping condition, then reset the RPS at the SCRAM control (03 §3.5.1) — the reset is permissive-gated and its caption names whatever is holding it. Do not hasty restart.

PWR-A02 — High Neutron Flux (HI FLUX)

Field	Content
Setpoint	Power range ≥ 108 % (alarm); trip at 115 %
Means	Neutron power high.
Actions	1) Stop withdrawal. 2) Insert rods. 3) Reduce turbine load if overcooling/power mismatch. 4) If rising through trip, expect/verify SCRAM.
Related	Continuous rod withdrawal failure PWR-E17

PWR-A03 — High Coolant Temperature (HI TAVG)

Field	Content
Setpoint	Tavg ≥ 594 °F (312.2 °C) (alarm). There is no high-Tavg reactor trip on this plant — see `09` §2.0; the overtemperature ΔT trip covers this ground instead
Means	Average coolant temperature high — often load rejection, loss of heat sink, or power high vs steam demand.
Actions	1) Check power vs MWe / steam flow. 2) Check SG level and feed. 3) Insert rods / reduce power. 4) Restore heat sink (AFW if needed). 5) Verify pressure not also high.

PWR-A04 — Pressurizer Pressure High (PZR PRESS HI)

Field	Content
Setpoint	≥ 2300 psi (15.86 MPa)
Means	Primary pressure high — toward PORV.
Actions	1) Verify spray AUTO/manual available (RCP running). 2) Reduce heat input (rods in / power). 3) Check load rejection / loss of steam demand. 4) Expect PORV auto-open near 2350 psi (16.20 MPa).

PWR-A05 — Pressurizer Pressure Low (PZR PRESS LO)

Field	Content
Setpoint	≤ 2149 psi (14.82 MPa)
Means	Primary pressure low — subcooling at risk.
Actions	1) Energize heaters — and check PZR HTRS SHED (A43) first: after a safety injection or a loss of offsite power they are off the bus and must be reloaded before they will answer. 2) Secure excessive spray. 3) Check PORV/safety path and block valve. 4) Check leak / HPI need. 5) Watch subcooling.

PWR-A06 — Pressurizer Pressure Very Low (PZR PRESS LO LO)

Field	Content
Setpoint	≤ 1800 psi (12.41 MPa) alarm; the low-pressure reactor trip is lower, at 1775 psi (12.24 MPa)
Means	Dangerously low RCS pressure.
Actions	1) Verify SCRAM. 2) Verify HPI actuation (~1715 psi (11.824 MPa) AUTO if armed). 3) Isolate stuck PORV with block valve if indicated. 4) Stop spray. 5) Do not throttle HPI on PZR level alone. → PWR-E07, E09

PWR-A07 — Pressure Relief Valve Open (PORV OPEN)

Field	Content
Logic	`porv_indicator` shows open
Means	PORV is indicated open. Indicator can lie closed when actually open.
Actions	1) If pressure still high, opening may be proper — wait for reseat ~2300 psi (15.86 MPa). 2) If should be shut: command PORV Close. 3) Cross-check subcooling, pressure trend, tailpipe temperature. 4) If leak continues → Isolate block valve (PWR-E07).

PWR-A08 — Startup Rate High (SUR HI)

Field	Content
Setpoint	SUR ≥ 1 DPM
Means	Power rising quickly.
Actions	1) Stop withdrawal. 2) Insert if needed. 3) Do not expect an interlock to stop you — there is no rate block; this alarm is the whole rate cue. 4) Resume when the rate is back under control. The interlock you will meet is the 20 % intermediate range flux rod stop, and it is about power, not rate.

PWR-A09 — Source Range Count Rate High (SR HI FLUX)

Field	Content
Setpoint	Alarm 5e4 cps. The source-range reactor trip is at 1e5 cps unless it has been blocked at P-6
Means	SR counts high — the P-6 block is due, and the trip is half a decade away.
Actions	1) Check INTER RANGE is on scale (P-6, IR ≥ 1e-10 A). If it is, block SR HIGH FLUX on the Trip Blocks panel now. 2) If it is not on scale, stop the power rise — insert rods — and diagnose: the block is refused below P-6 and the trip is close.

PWR-A10 — Low Subcooling Margin (LO SUBCOOL)

Field	Content
Setpoint	Subcooling ≤ 20 °F (11.1 °C)
Means	Approaching boiling in primary.
Actions	1) Raise pressure (heaters) and/or lower temperature (power/load) — if injection has already actuated, the heaters are shed (A43) and reloading them is step one. 2) Check for leak / open relief. 3) Prepare HPI, knowing that actuating it sheds the heaters and gives that pressure tool away until you take it back. 4) Trust this over a single PORV light.

PWR-A11 — Subcooling Lost (SUBCOOL LOST)

Field	Content
Setpoint	Subcooling ≤ 0 °F (0 °C)
Means	Coolant at/above saturation — boiling / voiding.
Actions	1) Verify SCRAM if not already. 2) HPI On — do not throttle on high PZR level. 3) Isolate stuck PORV path. 4) Restore heat sink. 5) Treat as LOCA-class event. → PWR-E07, E09, X01

PWR-A12 — Pressurizer Level High (PZR LVL HI)

Field	Content
Setpoint	≥ 75 %
Means	PZR level high — could be charging excess, heatup, or void surge (TMI trap).
Actions	1) Check subcooling and pressure. 2) If subcooling OK: reduce charging / increase letdown. 3) If subcooling bad: suspect LOCA/void — do not secure HPI for level alone.
This is the ABSOLUTE rung	75 % is a fixed elevation, so it is the right alarm for approaching solid and the wrong one for level has left its program. The deviation rung A44 would need a programmed level above 65 % to arrive after this one, and the program tops out at 61.5 %, so on this plant A44 always comes in first — it is the one that catches a heatup excursion, and this tile guards the 97 % going-solid trip.

PWR-A13 — Pressurizer Level Far Below Program (PZR LVL LO)

Field	Content
Setpoint	Indicated level ≥ 20 % below its programmed value
Means	Make-up has lost it. The deeper rung of the same ladder as A31 — see that card for why level is measured against its program rather than as an absolute number.
Why it is not an absolute level any more	It was ≤ 25 % through Rev 16, and 25 % is this plant's own programmed no-load level: at Mode 3, Hot Standby a perfectly healthy plant sat on the setpoint and the alarm stood in. Measured, hot zero power settles at 23.6–26.4 % for an hour on end. A fixed number on a programmed level collides the moment the program reaches it. The 20-point band is measured too: the worst healthy excursion on any initial condition is 2.8 points, and a 100 → 90 MWe load change spans 5.9 — so the alarm sits about seven times clear of normal wander, and every leak the plant can host crosses it inside half an hour.
Where the old 17 %/25 % protection went	Nowhere — it was never this alarm's job. The heaters cut out and letdown isolates at 17 % actual level, a fixed elevation in the vessel, and that annunciates on its own as PZR HTRS SHED (A43) and PZR LTDN ISOL (A13a). There is no reactor trip at 12 % on this plant. A real plant trips the reactor on low pressurizer level; this one does not (09 §2.0) — A14 at 12 % is a critical alarm, not a trip. See that card for what actually protects this plant below 17 %.
Actions	1) Increase charging; isolate letdown if needed. 2) Check for leak. 3) Watch for A43 — heaters lost means pressure control is next. 4) Watch for A14 (PZR LVL LO LO) at 12 % — a critical alarm, not a trip; see that card.

PWR-A13a — Letdown Isolated on Low Level (PZR LTDN ISOL)

Field	Content
Setpoint	Indicated pressurizer level ≤ 17 %
Means	The plant has just isolated every letdown path — both orifices and the RHR-to-CVCS cross-connect, if you were on shutdown cooling — and cut the pressurizer heaters. Both are automatic and both are latched: the fire latch re-arms only above 20 %, and there is no automatic restoration — letdown stays shut until you re-open an orifice by hand. The card shows it: all four lineup lamps go dark, CLOSED lights amber to say the plant shut the valves rather than you, and the status word reads ISOLATED (03 §7.3). Your selection is remembered but not lit — a lamp reports where the valve is.
Why it exists	The actions were always there; the lamp was not. An automatic action the operator cannot see is one they cannot undo, and this one takes away a flow path they then have to restore deliberately. It is also the last annunciation before PZR LVL LO LO (A14) at 12 % — but not before a reactor trip or a safety injection: this plant trips on neither low pressurizer level nor starts injection on it (09 §2.0, §3.0). The alarm that used to sit above this one was a fixed 25 %, which collided with this plant's own programmed no-load level and became program-relative at Rev 17.
Actions	1) Charging to maximum; letdown is already isolated for you. 2) Check for a leak — A31/A13 will have come in first if make-up has lost it. 3) Expect PZR HTRS SHED (A43) with it: pressure control is gone until you reload the heaters. 4) Watch for PZR LVL LO LO (A14) at 12 % — a critical alarm, not a trip or an SI start; primary pressure, not level, is what protects this plant (09 §2.0, §3.0; see A14). 5) On recovery, level past 20 % re-arms the latch — then re-open an orifice yourself; the lamp lights again when you do, which is how you know the isolate has cleared.
Not the same as A43	A43 says the heaters are off the bus; this says letdown is shut. Different actions, different recoveries — a button versus an orifice.

PWR-A14 — Pressurizer Level Very Low (PZR LVL LO LO)

Field	Content
Setpoint	≤ 12 % indicated
Means	Critical inventory indication — and, on this plant, level alone trips nothing and starts nothing. A real plant carries a reactor trip and a safety-injection path on low pressurizer level; this one does not (09 §2.0, §3.0). This plant's engineered-safeguards list has exactly three entries, all primary- or steam-side: the reactor trips on low primary pressure (1775 psi / 12.24 MPa) and injection starts on low primary pressure (1715 psi / 11.824 MPa), low steam pressure (328 psi / 2.26 MPa), or high-high steam flow — never on pressurizer level by itself. A slow leak can carry level well past 12 % before pressure catches up and does either.
Actions	1) Do not wait for an automatic trip or safety injection on this alarm — none is coming. 2) Watch primary pressure and subcooling margin, not level, for the protection that actually applies (A05/A06, A10/A11). 3) Maximize charging; letdown is already isolated (A13a fired at 17 %). 4) Find and isolate the inventory loss. 5) If pressure keeps falling with it, expect the low-pressure reactor trip and safety injection to follow — on their own setpoints, not this one.
Why it exists	Kept as a real, live alarm — the instrument and the 12 % setpoint are both real (`pzr_level`, critical priority) — with its consequence corrected. Level and pressure are not the same signal, and knowing which one this plant actually watches is the point (09 §3.0).

PWR-A15 — Control Rods — Insertion Limit (ROD INS LIMIT)

Field	Content
Logic	Control bank at/below insertion limit
Means	Rods too deep for current power — inadequate rod worth margin concept.
Actions	1) Borate or reduce power. 2) Withdraw only within procedures. 3) Do not ignore during power ops.

PWR-A15a — Control Rods Fully Withdrawn (ROD BANK FULL OUT)

Field	Content
Logic	Control bank at its top stop — 627 of 627 steps
Means	No rod authority left in the withdraw direction. WITHDRAW will not move the bank, and the only reactivity lever remaining is boron. This plant has ONE control bank and no overlap group, so the top stop is the end of rod control rather than a hand-off to the next bank.
Actions	1) Dilute — reduce boron concentration to bring Tavg back to programme. 2) Expect the bank to come off the stop as the dilution takes effect; the alarm clears on the first step of inward travel. 3) Check what drove the bank out: a xenon build-in after a power ascension is the usual cause. 4) Do NOT dilute in one large step — the plant heats faster than xenon can absorb it and trips on overtemperature ΔT.

Shutdown bank: this alarm is on the CONTROL bank only. The shutdown bank is parked fully withdrawn whenever the plant is hot — that is its normal position, not a fault — so it has no equivalent annunciator.

PWR-A16 — Steam Generator Level High (SG LVL HI)

Field	Content
Setpoint	≥ 75 %
Means	SG overfeed or load cut with feed high.
Actions	1) Reduce feed pump / verify three-element. 2) Match turbine load to power. 3) Avoid turbine water-induction risk mindset (even if not fully modeled).

PWR-A16b — Steam Generator Level High-High (SG LVL HI HI) — P-14

Field	Content
Setpoint	≥ 88 % (alarm); P-14 protection at 90 %
Means	Overfeed / level swell approaching the moisture-carryover limit.
P-14 actuation (90 %)	Automatic turbine trip + main-feedwater isolation (AFW keeps feeding), and a reactor trip if ≥50 % power (P-9).
Actions	1) Expect turbine trip + feed isolation + SCRAM. 2) Verify feed isolated and AFW carrying the heat sink. 3) Restore main feed only after level is controlled. → PWR-E03 / PWR-E01

PWR-A17 — Steam Generator Level Low (SG LVL LO)

Field	Content
Setpoint	≤ 30 %
Means	Heat sink degrading.
Actions	1) Raise feed. 2) Check main feed failures. 3) Prepare AFW. 4) Expect AFW AUTO at 17 % lo-lo (same signal as the SCRAM) if armed — a total feed loss starts it earlier, on collapsed feed flow.

PWR-A18 — Steam Generator Level Critical Low (SG LVL LO LO)

Field	Content
Setpoint	≤ 17 % (SCRAM)
Means	Heat sink critical.
Actions	1) Verify SCRAM. 2) Verify AFW started — it auto-starts on this same signal if armed; start it manually if not. 3) Turbine load off. → PWR-E01

PWR-A19 — Reactor Coolant Pump Trip (RCP TRIP)

Field	Content
Logic	`rcp_running` false
Means	Loss of forced primary flow.
Actions	1) Verify automatic low-flow SCRAM. 2) Manual SCRAM if not tripped. 3) Load off. 4) Natural circulation / AFW for decay heat. → PWR-E02

PWR-A20 — Safety Injection Actuated (SAFETY INJECTION)

Field	Content
Logic	`hpi_active` true — the SAFETY INJECTION SIGNAL, not delivered flow. The signal latches when any of the three actuation channels asserts: low pressurizer pressure (1715 psi), low steam-line pressure (327.7 psi), or high-high steam flow. It stays latched until you reset it.
Means	The plant has fired its emergency core cooling. Both injection pumps are running. You may see no flow: above the pump shutoff heads — 1389 psi (9.58 MPa) high-head, 215 psi (1.48 MPa) low-head — the pumps run against shut check valves and deliver nothing. Zero flow is not "it did not happen". Read the ECCS mode: ARMED is actuated-and-not-delivering; HHSI / LHSI / BOTH is actuated and injecting.
Actions	1) Establish WHY — check pressurizer pressure, steam-line pressure and steam flow against the three setpoints above. 2) If expected (low pressure / LOCA): leave running; monitor subcooling and inventory. 3) If SPURIOUS — the commonest cause on this plant is crossing the P-11 permissive during a heatup with the steam generator still cold, which re-arms the blocked low-steam-pressure channel onto a standing condition — stabilise, then secure injection per PWR-E14. 4) The pressurizer heaters shed on this signal (PWR-A43) and will not come back on their own. 5) Do not secure early on rising PZR level alone during a LOCA.
Note	Prevention for the heatup case: stage the pressurization. Hold the Pressure SP at its 1700 psig floor until the secondary is bottled up at the no-load anchor, then complete to 2235 psi — the P-11 crossing then happens onto a clear plant. Measured on this plant: staged, the steam generator is at 1040 psi when P-11 is crossed against a 327.7 psi setpoint; dialled straight to 2235 it is at 78 psi and safety injection actuates.

PWR-A21 — Station Blackout (SBO)

Field	Content
Logic	`station_blackout` true
Means	AC power lost (as modeled).
Actions	1) Verify SCRAM / trip state. 2) Establish AFW — turbine-driven, so it runs with no ac. 3) Verify natural circulation: loop ΔT steady, subcooling positive. 4) Expect no charging, letdown or SI (all ac) — watch inventory. See PWR-E05.

PWR-A22 — Turbine Trip / Low Steam Demand (TURB TRIP)

Field	Content
Logic	`steam_demand_low` true
Means	Turbine not accepting load / tripped.
Actions	1) Above 50 % power (P-9), expect an automatic REACTOR TRIP with the turbine trip — confirm it and go to the post-trip response. 2) Below P-9, expect reactor power/Tavg response and match or scram as conditions require. 3) Steam dump for pressure. 4) Control SG level. → PWR-E03
NOTE	A planned offline (generator OFF) is not a turbine trip and does not arm P-9.

PWR-A23 — Main Steam Isolated (MSIV SHUT)

Field	Content
Logic	`msiv_open` false
Means	MSIV closed — SG bottled.
Actions	1) Expect turbine trip and SG pressure rise toward safeties. 2) Reactor trip if heat sink lost. 3) AFW for inventory. → MSIV transient PWR-E19 related

PWR-A24 — Steam Generator Pressure High (SG PRESS HI)

Field	Content
Setpoint	≥ 1063 psi (7.33 MPa) (alarm). The main steam safeties are a STAGGERED bank: first lift 1099 psi (7.58 MPa), three more at 1155 psi (7.96 MPa) — so the alarm arrives just under the first valve, which is the point of it
Means	Secondary pressure high — often MSIV shut or loss of steam path.
Actions	1) Steam dump if available. 2) Reduce reactor power / verify trip. 3) Do not overfeed dry SG without procedure.

PWR-A25 — Condenser Vacuum Low (COND VAC LO)

Field	Content
Setpoint	≤ 25 inHg (84.7 kPa)
Means	Vacuum degrading.
Actions	1) Reduce load. 2) Check vacuum failure injection. 3) Prepare for turbine trip.

PWR-A26 — Condenser Vacuum Trip Level (COND VAC TRIP)

Field	Content
Setpoint	≤ 22 inHg (74.5 kPa)
Means	Turbine protection vacuum trip region.
Actions	1) Verify turbine trip. 2) Control reactor/SG. → PWR-E10

PWR-A28 — Reactor/Turbine Load Imbalance (LOAD IMBAL)

Field	Content
Logic	`sg_imbalance_active` true — indicated reactor power and turbine load differ by more than 4 % of rated (4 MWe)
Means	The reactor and the turbine are not making and taking the same amount of steam, so the steam generator is filling (load above power) or draining (power above load). In MANUAL load control the turbine sits at whatever load setpoint you last gave it, so changing reactor power alone always produces this.
Actions	1) Compare reactor power against generator output. 2) In MANUAL, walk the load setpoint to match the power you are at — or put load control in FOLLOW. 3) Watch Tavg: a sustained imbalance with the turbine high overcools the primary, and there is no trip that will stop it. 4) Watch SG level, which is moving in the direction the imbalance names.

PWR-A27 — Reactor Coolant Pump Cavitation (RCP CAVITATION)

Field	Content
Logic	`rcp_cavitating` true — suction-node subcooling `Tsat(P_suction) − Tcold` below ~14.4 °F (8 °C) on a running pump
Means	The RCS is approaching saturation at the pump suction — the pumps are drawing two-phase fluid, losing head and flow. A voiding / depressurizing primary. Not an instrument fault — believe it.
Actions	1) Cross-check LO SUBCOOL / SUBCOOL LOST and pressurizer pressure — treat as loss of subcooling. 2) Suspect a LOCA / stuck-open relief path; do not secure injection for level alone. 3) Restore subcooling (inject, arrest depressurization). 4) Per site EOPs, trip the RCPs if subcooling cannot be restored (avoid running cavitating pumps). → PWR-E07 / X01

PWR-A29 — Low Coolant Temperature (LO TAVG / P-12)

Field	Content
Setpoint	Tavg ≤ 532.4 °F (278 °C) — the P-12 line, ~14.4 °F (8 °C) below the 547 °F (286.1 °C) no-load Tavg program anchor (2026-09-11 — corrects a stray 566.6 °F anchor this row was never updated to follow when the no-load Tavg moved to Ginna's programmed value)
Means	The primary is below the hot operating band. At power or at hot standby this is an overcooling transient: excess steam demand, a stuck-open dump or relief path, or an overfed steam generator. Moderator feedback adds positive reactivity as the primary cools, so an unattended overcool raises power.
Deliberately not a trip	A PWR does not scram on low Tavg. The real cold-side protections are this permissive and low-temperature overpressure protection — neither is a reactor trip.
Actions	1) Find the steam path that is taking too much heat: steam dump position, PORV / SG safeties, turbine load against reactor power (A28). 2) Isolate or close it. 3) Watch power — Tavg falling with power rising is the overcool feeding itself. 4) Cross-check pressure and subcooling; a cooling primary shrinks and drops pressurizer level.
In Mode 4 or 5	Expected. A cooldown is meant to take Tavg here, so the annunciator reclassifies to Status and reads "expected, plant is cold" (§2.0).

PWR-A30 — Charging Flow High (CHG FLOW HI)

Field	Content
Setpoint	Charging flow ≥ 60 % of maximum
Means	The chemical and volume control system is making up more than it normally does. Charging is a level controller: it only works this hard because pressurizer level is being pulled down. Something is taking inventory out of the reactor coolant system.
Why this alarm exists	A leak small enough for charging to keep up is held indefinitely and moves level only a per cent or two — far above PZR LVL LO, the deeper rung of the same deviation ladder, which never comes in. Without this annunciator the plant would lose inventory silently with make-up near its limit. This is the one that tells you to look.
Automatic actions	None. Charging is already responding; that response is the indication.
Immediate operator actions	1) Confirm level is at or below its program (A31 if the deviation is large). 2) Check letdown is not isolated or throttled — the same alarm comes in if charging is making up for letdown that was shut. 3) Look for the leak: containment sump and humidity, pressurizer relief tank pressure and temperature (a weeping PORV or safety), steam generator activity (PWR-E05, tube leak). 4) Log the charging demand and trend it — a rising demand at steady load means a growing leak.
If not expected	Treat as unidentified reactor coolant leakage. If charging reaches its maximum and level still falls, make-up has lost the leak — see A31 and PWR-E04.
Watch for	Deliberate level changes. Raising the level setpoint, or drawing a pressurizer bubble, sends charging high for a legitimate reason. Check what was asked for before hunting a leak.

PWR-A31 — Pressurizer Level Below Program (PZR LVL DEV LO)

Field	Content
Setpoint	Indicated level ≥ 10 % below its programmed value
Means	Make-up is no longer holding. Level is programmed against Tavg, so it is supposed to move on a load change — this alarm measures the gap between where level is and where the program says it should be, which only opens when mass is actually leaving the system faster than charging replaces it.
Why a deviation and not a low level	Level legitimately swings more than eight percentage points across a normal load change, so any absolute setpoint tight enough to catch a leak early would come in every time load moved. The deviation does not move on load at all. It is also the shallower of the two deviation rungs — A31 at 10 points below program, A13 at 20 — so this one comes in first and A13 says the situation has got away.
Automatic actions	None at this alarm. Charging is already at or near maximum.
Immediate operator actions	1) Verify charging at maximum and letdown isolated — recover any make-up capacity that is being wasted. 2) Confirm subcooling margin and pressure; falling level with falling pressure is a leak, falling level with rising pressure is not. 3) Enter PWR-E04 (loss of reactor coolant). 4) Prepare for safety injection if level continues down toward PZR LVL LO LO at 12 %.
Companion alarm	A30 normally comes in first and stays in. A30 alone = a leak inside make-up authority, held. A30 with A31 = make-up has lost it. That pair is the diagnosis.
If A31 comes in without A30	Charging is not working hard, so this is probably not a leak — suspect the level or Tavg instrument, or charging isolated. Cross-check level against the wide-range indication and Tavg against the loop temperatures.

PWR-A32 — Accumulators Still Lined Up (SI ACCUM ALIGNED < 1000 PSI)

Field	Content
Setpoint	Primary pressure below 1000 psi (6.895 MPa) and the accumulator discharge isolation valve still open
Means	The safety-injection accumulators are aligned to the reactor coolant system and pressure has entered the band where they should be isolated. They are passive: nitrogen behind a check valve. Nothing automatic shuts them, and the safety-injection block set entering a cooldown blocks pumps, not these tanks.
Why gated on the valve	Pressure alone is not the condition. A Mode 5 plant is below this setpoint all day with the tanks correctly isolated, and an alarm on pressure alone would stand in permanently and be normalized. This one clears the moment you isolate — and never comes in at all if you isolate on schedule.
Automatic actions	None, deliberately. There is no autoclose interlock. Real plants power these valves open and remove control power to prevent inadvertent closure; the closure is the operator's, made off this indication. An automatic closure keyed on falling pressure would also shut them during a LOCA, which is precisely when they must inject.
Immediate operator actions	On a planned cooldown: isolate the accumulators — shut the discharge isolation valve on the ECCS side of the board. Confirm SIT fill and cover-gas pressure hold steady afterwards. See PWR-N15 step 3 and 05 Phase C step C3.
On a LOCA or unplanned depressurization	Do not isolate. The same annunciator here means passive injection is about to start, which is the design intent. The tile states a lineup, not an order — deciding which situation you are in is the point of it.
If it stays in after you isolate	The valve did not shut. Check its position indication; the alarm reads valve position, not the command.
If you see it with the tanks already empty	It came in about 1 minute of plant time before the first discharge on a brisk cooldown, and it stays lit afterwards. Lit tile plus SIT fill at 0 % is the post-mortem: this is why the tanks emptied and why RCS boron rose toward the 2500 ppm accumulator charge.
Watch for	Time acceleration. That ~1 plant-minute of warning is a couple of seconds of wall clock at 30×. Cooldown rates in this trainer are compressed (see 12 §14) — slow down through the band rather than relying on reaction time.
What this tile does NOT cover	The heatup. There is no annunciator for accumulators left isolated on the way up, and no automatic open signal — re-alignment is an operator action. This tile is silent in that case, because shut tanks are the condition it clears on. PWR-N01 step 7 (re-align accumulators) is the step that catches it.

PWR-A33 — Shutdown Cooling Not In Service (RHR NOT IN SERVICE)

Field	Content
Setpoint	Plant in Mode 4 or Mode 5 and the RHR hot-leg suction valve not open
Means	The plant is in a mode where residual heat removal is the heat sink, and it is not aligned. Decay heat is going somewhere else — or nowhere.
Why gated on the mode	Not on pressure, and not on the reactor-trip latch. RHR is correctly unaligned for the whole of Modes 1–3, so a pressure-only gate would stand in through every cooldown; and a Mode 5 plant reads not tripped — it was never scrammed, it is simply cold — so gating on the trip latch made the tile impossible to get in the one mode where it matters most.
Automatic actions	None, and now nothing opened it automatically in the first place. Until 2026-08-11 this trainer had an entry permissive that opened the valve by itself on the first crossing below 400 psi (2.76 MPa); that was a declared simplification and it is retired — see the row below. Nothing aligns RHR for you, ever. The ruling that created this annunciator stands and is why you are reading it — annunciation, not automation, was always the point.
How a real plant does this	It has no automatic open at all — and neither does this trainer any more. NUREG-0933 Issue 99: "Two basic features are incorporated in the interlock design: (1) an automatic closure signal on high RCS pressure (typically 600 psig), and (2) a block of the manual open signal at a lower RCS pressure (typically 425 psig)." Westinghouse Technology Systems Manual §5.1 (ML11223A219) puts it in the same direction for valves 8701/8702: "These interlocks prevent the valves from being opened unless* the reactor coolant system pressure is less than 425 psig."* NUREG-1431 tests the two directions as separate surveillances — SR 3.4.14.2 "prevents the valves from being opened", SR 3.4.14.3 "causes the valves to close automatically". The operator opens the suction valves; the interlock only blocks that open above the setpoint. Both setpoints are modelled — block-open 400 psi (2.76 MPa), autoclose 600 psi (4.14 MPa) — and the automatic entry that used to sit alongside them is gone.
This is a real event, not a contrivance	Inadvertent RHR suction valve closure is one of the better-documented PWR nuisances: NUREG-0933 Issue 99 cites 27 events through 1981, a frequency of 0.12 unplanned closures per plant-year, with the consequence "the potential for RHR pump damage and loss of decay heat removal by the RHR system." The issue was resolved by Generic Letter 88-17 through improved instrumentation, procedures and administrative controls — annunciation, not automation, which is why this tile exists.
Immediate operator actions	First ask whether safety injection is running. If it is, this tile is telling you where the plant is, not what to do — see the row below — and the align will be refused. Otherwise: confirm RCS pressure is below 400 psi (2.76 MPa) — the valve interlock refuses to open above it. Throttle the HX split before you open the valve (04 PWR-N15 step 5). Re-align RHR from the ECCS side of the board. Confirm the ECCS card reads RHR and that Tavg resumes falling.
If it is in during an ACCIDENT, do NOT align RHR	This tile stands in during a loss-of-coolant accident too — deliberately — and there it reads "you are on injection, not on shutdown cooling", which is what you need to know before you decide to stop injecting. It is not a call to align. The RHR pumps are the low-head injection pumps, and while safety injection is running they are lined up to the refueling water tank, not to your hot leg; their heat exchangers have no cooling water in that alignment (WTSM 5.2 §5.2.4.5: "the RHR pumps start and recirculate water through the uncooled* RHR heat exchangers"). The board will refuse the align and say so. Shutdown cooling becomes available when you* secure injection — which is a decision about core cooling, not about this annunciator. See 12 §12.20 for what that refusal is and is not.
The way this usually happens	A repressurization while aligned, past 600 psi (4.14 MPa). The suction valve auto-closes there — that protection is real and stays — and pressure coming back down does not bring RHR back, because nothing brings RHR back but you. Note it takes a genuine 200 psi (1.38 MPa) excursion above the alignment pressure: a plant merely hunting around 400 psi no longer sheds the valve, which it did until 2026-07-31.
If it comes in with pressure ABOVE the interlock	Expected, briefly. Losing the valve took 600 psi (4.14 MPa); getting it back takes 400 psi (2.76 MPa) — the block-open permissive is the lower of the two setpoints, so you must come down past where you lost it. Get pressure down, then re-align — and throttle the HX split before you open the valve, or you buy the shock 04 PWR-N15 step 5 exists to prevent.
What told you before this tile existed	Nothing, directly. The only indication was the ECCS card quietly changing from RHR back to LPI, which is why this annunciator was added.
Watch for	Losing RHR in Mode 5 with the steam generators unavailable — there is no other heat sink in that lineup, and the temperature rise is slow enough to be missed until it is not.

PWR-A34 — Cooldown Rate High (RCS COOLDOWN RATE HI)

Field	Content
Setpoint	Indicated Tavg falling faster than 100 °F/hr (55.6 °C/hr) — the technical-specification-class heatup/cooldown limit
Means	The primary is shedding heat faster than the limit written to protect the vessel and nozzles from thermal stress. The classic cause is a steam path taken too far: a Dump SP walked deep below the program, a stuck-open dump or relief, or an uncontrolled blowdown.
The meter	The rate channel is derived from the indicated Tavg, so it inherits the Tavg channel's lag and any failure on it. It is the agreement of two filters: a slow one, damped over about ten minutes like a chart recorder, and a fast one of about 30 seconds that says what Tavg is doing now. The meter reads the smaller of the two when they point the same way, and zero when they do not — so a rate reads high only while it is both sustained and still happening. After a reactor trip from full power, Tavg drops about 27 °F (15 °C) in the first minute and then sits nearly flat: the meter peaks near −154 °F/hr (−85.3 °C/hr), the tile lights, and it clears about 3 minutes after the trip. Steady plant jitter reads a few °F/hr; a genuine cooldown reads tens to hundreds and keeps the tile lit for as long as it lasts. The Heatup Rate High tile (PWR-A35) reads the same meter. ⚠ Basis UNVERIFIED: no source this plant has describes how a real plant computer forms this rate — the two-filter method is this plant's own. What is sourced is that a reactor trip is a different design transient from a cooldown (WTSM 3.2 Table 3.2-10, ML11223A213).
Immediate operator actions	1) Find the heat path: steam dump position and setpoint, PORV/SG safeties, feed lineup. 2) Close it down — raising the Dump SP back toward the program arrests a dump-driven cooldown at once. 3) Cross-check pressure and pressurizer level: a cooling primary shrinks. 4) If the cooldown is planned, slow it to the limit — the limit applies especially during planned cooldowns.
Not reclassified when cold	Modes 4/5 do not demote this tile. The limit binds exactly during a planned cooldown; exceeding it there is the error, not the lineup.

PWR-A35 — Heatup Rate High (RCS HEATUP RATE HI)

Field	Content
Setpoint	Indicated Tavg rising faster than 100 °F/hr (55.6 °C/hr) — the same technical-specification-class limit, in the other direction
Means	The primary is gaining heat faster than the vessel stress limit allows. Causes run from an overdriven heatup (rods, pumps against a bottled secondary) to a lost heat sink with the core still making power.
Immediate operator actions	1) Check the heat sink first: steam path open, feed available, condenser alive. 2) If this is a planned heatup, slow it to the limit. 3) Cross-check pressurizer pressure and level — an expanding primary swells into the pressurizer.

PWR-A36 — Containment Pressure High (CTMT PRESS HI)

Field	Content
Setpoint	Containment pressure above 18.1 psi (0.125 MPa) absolute — the sourced 3.5 psig safety-injection backup signal (WTSM 12.3)
Means	A high-energy line is discharging inside the building — a primary break, an open relief path, or a steam line break upstream of the isolation valve. This signal starts safety injection, and it is the backup entry — automatic only. WTSM 12.3: "The setpoint for this protection signal is 3.5 psig … This SI actuation signal cannot be blocked by the operator." Unlike the plant's other three SI paths it is not gated by permissive P-11, so a break that pressurizes containment without depressurizing the loop or the steam side still starts injection here. This is a real, live pressure reading and a real alarm on the same signal that acts. An SGTR does not light this alarm: that break discharges into the steam generator — the one leak containment cannot see.
Automatic actions	Safety injection latches on this signal alone if none of the other three SI paths has already latched it. No isolation and no spray at this setpoint — those wait for A37, ten psig higher.
Immediate operator actions	1) Confirm SI actually latched (A02) — this signal joins primary pressure ≤ 1715 psi (11.824 MPa), steam pressure ≤ 328 psi (2.26 MPa) and steam flow ≥ 1.55× rated as a fourth, independent path to the same latch. 2) Diagnose the discharge path: RCS pressure/inventory falling → LOCA (E09); PORV tailpipe hot → stuck relief valve (E07); steam pressure collapsing with the MSIV shut → upstream steam break. 3) Watch the sump — rising level with steady pressure is the small-cold-leak signature.

PWR-A37 — Containment Pressure High-High (CTMT PRESS HI HI)

Field	Content
Setpoint	Containment pressure above 44.7 psi (0.308 MPa) absolute — the sourced 30 psig spray / steam-line-isolation signal (WTSM 12.3: "indicative of a large line break")
Means	A large break is pressurizing the building. This signal is one bistable with three consumers, all auto-only and built: containment spray, the fan-cooler safety realign, and the main steam isolation valve. WTSM 12.3: "The setpoint is 30 psig", and main steam isolation is "(1) a high-high containment pressure signal or (2) high steam flow coincident with …" — this is signal (1). A38 and A39 are the tiles that report the first two; the isolation shows on the MSIV indication itself, not a separate tile.
Automatic actions	Spray demands on this signal and starts delivering 28.5 s later — one credited train, 1800 gpm (6.81 m³/min) of 50 °F (10 °C) refueling-water-storage-tank water. The fan coolers realign on safety injection, not on this signal directly — see A39 — and start delivering 44 s after that realign. The main steam isolation valve shuts on this signal and stays shut; nothing re-opens it automatically. Spray secures automatically once containment falls back below the A36 setpoint (18.1 psi / 0.125 MPa) — declared inference, the same reset the retired engine used, because no source documents a spray reset and this auto-only build has no operator lever to do it by hand.
Immediate operator actions	1) Confirm the automatic actions actually ran — A38 and A39 lit, MSIV indication shows shut. In a station blackout neither spray nor the fan coolers deliver: both are AC loads and stay dark; the MSIV still shuts, because it is not a motor load. 2) Treat the initiating event (E09 / E07) — mitigation slows the rise, it does not stop it without the loop itself being controlled. 3) Watch containment pressure and temperature trend: a mitigated large break turns over and falls; one that keeps climbing under full automatic response is a break outrunning removal, not an unmitigated one.

PWR-A38 — Containment Spray Running (CTMT SPRAY ON)

Field	Content
Logic	`ctmt_spray_active` — live and built. Lights when spray is actually delivering, which is 28.5 s after the A37 demand latches and AC power is available — `ctmt_spray_demand` lights at the demand and can stand alone through a station blackout, with this tile dark, because the pumps are AC loads.
Means	Containment spray is running: one credited train (the sourced post-single-failure configuration, Ginna TS Bases B 3.6.6), 1800 gpm (6.81 m³/min) of 50 °F (10 °C) refueling-water-storage-tank water knocking down building pressure and temperature. Measured on a large loss-of-coolant accident, full power: delivering by 88.2 s, and the mitigated containment peak falls from 78.5 psig (0.643 MPa) unmitigated to 57.8 psig (0.500 MPa), turning over instead of still climbing. This plant has no refueling-water-storage-tank inventory node, so spray runs for as long as it is demanded rather than draining a tank and switching to recirculation (12 §12.4d).
Actions	None to take — spray is auto-only, no board control. Confirm it is actually removing heat: containment pressure and temperature should be falling, not just holding. If the tile is lit and pressure keeps climbing, the break is outrunning both spray and the fan coolers, not failing to actuate.

PWR-A39 — Containment Fan Coolers, Safety Realign (CTMT FANS SI)

Field	Content
Logic	`ctmt_fan_safety` / `ctmt_fan_active` — live and built. `ctmt_fan_safety` lights on any safety injection, not on a containment setpoint of its own [sourced — Ginna TS Bases B 3.6.6: "In post accident operation following a SI actuation signal, the CRFC System fans are designed to start automatically if not already running"]; `ctmt_fan_active` lights 44 s later, once AC power is available, when they are actually delivering.
Means	The diverse, slower heat-removal train: two fan units credited (post-single-failure), pulling heat out of the building atmosphere down to its pre-accident condition. Measured at the mitigated peak, the fan coolers remove 3.9 MWt against spray's 9.2 MWt — sourced ordering, GEND-061: "Heat transfer from the containment atmosphere to containment sprays is rapid compared to heat removal by containment coolers." One-shot, no automatic securing — once realigned the fans stay realigned; this auto-only build has no operator surface to restore normal mode.
Actions	None to take — auto-only, no board control. In a station blackout this tile stays dark: the fans are AC loads, and `ctmt_fan_safety` can still be lit with nothing delivering. See A36/A37 for the signal that drives safety injection.

PWR-A40 — Containment Hydrogen Above Flammability Limit (CTMT H2 HI)

Field	Content
Logic	`ctmt_h2_pct` > 4.1 % by volume — the lower flammability limit of hydrogen in air (NUREG-1431 Bases). This channel is real, unlike its neighbours below: containment hydrogen is a live quantity on this plant, computed from cladding oxidation, not a declared constant.
Means	An overheated core has been burning its zirconium cladding in steam, and the hydrogen has reached the building through whatever opening the primary is discharging from. Nothing removes it on this plant: there are no recombiners (A42 can never light) and no ignition/burn (A41 can never light) — see those cards. Whether it comes in is PATH-DEPENDENT, and the path matters more than the severity. On the flagship TMI-2 ride the cladding measured at 94 % uncovered still read only 555 °F (290.6 °C) — below the 1200 °F (648.9 °C) onset of significant Baker-Just generation (08 §6.0), so that ride makes almost no hydrogen. A station blackout with auxiliary feedwater failed is a different plant: measured 2026-09-18, full stack from `hot_full_power`, cladding reaches 3162.2 °F (1739 °C) by three hours, fuel damage latches, and containment hydrogen climbs 0.04 % → 2.22 % by volume in the last 45 minutes — still short of this alarm's 4.1 %, and still rising steeply when the measurement ended. Treat a quiet CTMT H2 tile as evidence about this transient, never as evidence the plant cannot make hydrogen.
Actions	The alarm is a core symptom, not a containment one — nothing in the building can be operated on it. Restore core cooling: injection, and close the discharge path if it is closable (block valve). Expect the concentration to keep climbing after the core is recovered — the RCS holds an inventory in transit — and to never come back down on its own.

PWR-A41 — Containment Hydrogen Burn Occurred (CTMT H2 BURN)

Field	Content
Logic	`ctmt_h2_burned` — always zero on this plant — hydrogen never ignites here (12 §12.4e). This tile can never light.
Means	A real plant's hydrogen, once it reaches the flammability limit, can find an ignition source and deflagrate — at TMI-2 a one-time burn consumed an estimated ~85 % of the atmosphere's hydrogen in seconds and put a sharp, roughly 28 psi (193 kPa) spike on the containment pressure recorder that the operators first took for electrical noise. This plant does not model ignition: hydrogen accumulates (see A40) and never burns (09 §3.0).
Actions	None — the tile cannot light. If containment pressure spikes sharply, look for a break growing worse (A36/A37), not a hydrogen burn.

PWR-A42 — Hydrogen Recombiners In Service (H2 RECOMB ON)

Field	Content
Logic	`ctmt_recomb_active` — declared static false on this plant, always. This tile can never light.
Means	A real plant starts hydrogen recombiners automatically on rising containment hydrogen and removes it over hours; this plant has none (09 §3.0). Containment hydrogen (A40) accumulates with nothing to bring it back down.
Actions	None — treat a lit tile as a display defect. If A40 is in, the answer is at the core (see that card), not here.

PWR-A43 — Pressurizer Heaters Shed (PZR HTRS SHED)

Field	Content
Logic	`pzr_heaters_shed` — latched by a safety injection signal or a loss of offsite power, and also asserted by the 17 % low-level heater cutoff
Means	The heaters are a large non-safety load, so they are automatically dropped off the emergency buses to leave capacity for equipment that matters more. They are not faulted and the bus is not dead — they have simply been taken off it. This lamp separates a shed from the other reasons heater power can read zero (a blackout and a heater failure), and it is also what annunciates the 17 % low-level cutoff — the point at which falling level uncovers the bank. Raised from `status` to `caution` at Rev 17: losing pressure control is not a lineup report, and a `status` row arrives pre-acknowledged behind a grey dot.
Actions	1) Expect heater power 0 % and the pressurizer to stop holding pressure — pressure now follows the plant, not the controller. 2) They do not come back on their own, and securing safety injection does not restore them. 3) When you want pressure control back, put them back deliberately: any heater action (AUTO, MANUAL, OFF, or typing a %) reloads them. 4) Before you do, know what you are asking for — on a depressurized plant the heaters answer at full demand, so expect a pressure rise, and with a relief path or a break still open that rise also increases what leaves through it. 5) Restoring pressure control matters most for natural circulation, where subcooling has to be maintained without the pumps.

PWR-A44 — Pressurizer Level Above Program (PZR LVL DEV HI)

Field	Content
Setpoint	Indicated level ≥ 10 % above its programmed value
Means	Letdown is no longer holding. The mirror of A31, on the same deviation channel and at the same ten points. Level is programmed against Tavg, so it is supposed to rise as the plant heats up — this alarm measures the gap between where level is and where the program says it should be, which only opens when mass is entering the system faster than letdown removes it, or when the water already in it is expanding faster than letdown can take the surplus away.
Why a deviation and not a high level	The absolute high-level alarm, A12 (PZR LVL HI), sits at 75 %. The level program runs 25 % at no load to 61.5 % at full power, so at the cold end of that span 75 % is fifty points away and an excursion can run the whole heatup without touching it. Measured on the shipped Mode 5 → Mode 3 heatup: level ran 20.4 points above a 25.00 % program (peak 45.37 %) for 11.6 of the leg's 13.4 plant-hours and nothing annunciated. A31 and A44 do not move on load at all; A12 and the 97 % trip do the absolute job.
Automatic actions	None at this alarm. The backup heaters have already come on by themselves five points earlier, at program +5 % — an automatic action with no lamp of its own, so this tile is also the first thing that tells you it happened.
Immediate operator actions	1) Check letdown — orifice selection, and whether the 17 % low-level cutoff has latched letdown shut from an earlier excursion (A13a). 2) Check charging: if it is at its floor and level is still rising, letdown capacity is the constraint, not make-up. 3) Check the heatup or cooldown rate — during a heatup the surplus is thermal expansion, and slowing the rate with RHR heat-exchanger flow is the lever that works. 4) Confirm the excursion is inventory and not indication: cross-check level against Tavg and the loop temperatures.
Where you will see it	The heatup and the cooldown, where the program sits on its 25 % floor while the plant's own expansion outruns a pressure-starved letdown path; a fast unload, where level swells above a program that has not caught up; and the TMI-2 deception, where level pegs at 100 % against a 25 % program while the reactor coolant system is emptying through a stuck relief valve. The last one is the reason to read this tile as "level has left its program" and never as "there is plenty of water."
If it comes in with LO SUBCOOL	Stop treating it as an inventory surplus. High indicated level with subcooling falling is the stuck-relief pattern — voiding in the reactor coolant system pushing water up into the pressurizer. See 07 PWR-E07 and 08.

4.0 Multi-alarm patterns (quick diagnosis)

Pattern	Suspect
SG LVL LO → LO LO + REACTOR TRIP	Loss of feed (E01)
RCP TRIP + REACTOR TRIP	Loss of flow (E02)
PORV OPEN or no PORV alarm + LO SUBCOOL + PZR LVL HI	Stuck PORV / TMI (E07, X01)
RCP CAVITATION + LO SUBCOOL / SUBCOOL LOST	Primary voiding — RCS at saturation (E07, X01)
TURB TRIP + HI TAVG + PZR PRESS HI	Load rejection (E03)
PZR PRESS LO LO + HPI ACTIVE + inventory drop	LOCA (E09)
COND VAC LO → TURB TRIP	Vacuum event (E10)

5.0 Related documents

07_ABNORMAL_EMERGENCY.md
09_SETPOINTS_LIMITS.md
08_ACCIDENT_TMI.md

These manuals are licensed CC BY 4.0 — see Legal. Training documents for an educational simulator, not licensing-basis documents for a real plant.