PWR Operator Manual · Open the simulator

09 — Setpoints, Limits, and Normal Values

Document: PWR-SP-01
Title: Operating Limits and Protection Setpoints — PWR
Revision: 24
Source: the as-built plant; normal values captured from the live engine

NOTE: Values are trainer setpoints (SI). Real US plant Tech Specs differ.

Plant MODES: Mode 1, At Power = Power Operation (power > 5 %); Mode 2, Startup = Startup (critical ≤ 5 %); Mode 3, Hot Standby = Hot Standby; Mode 5, Cold Shutdown is simulated and is the cold end of this plant — cold_shutdown and hot_shutdown are Free Play initial conditions and the Mode 5 ↔ Mode 1 heatup/cooldown runs on integrated physics. See 05_MODE_TRANSITIONS.md.

1.0 Normal operating point — Mode 1, At Power (Hot Full Power)

Mode 3, Hot Standby — Hot Standby (typical)

2.0 Reactor Protection System (RPS) trips → SCRAM

Permissives / blocks

Rod withdrawal interlocks — the four rod stops

All four are sourced together, WTSM 8.1 §8.1.7.3 (ML11223A252), Manual Rod Withdrawal Stops, and corroborated on the anchor plant — Ginna UFSAR ch7 (ML20339A027): *"The overpower rod stops are initiated by one-out-of-four high nuclear flux of 103 %; one-out-of-two high flux at 20 % current equivalent power; two-out-of-four high overtemperature delta T at 3 % of rated loop T below trip setpoints; and high overpower delta T at 3 % of rated."*

"Rated ΔT" is 58.9 °F (32.7 °C) — this plant's own settled hot-full-power loop split, so the 3 % rod stop is 1.8 °F (1.0 °C) of ΔT and the 6 % clear is twice that. Every overtemperature and overpower ΔT number on this page is a fraction of that one figure, and it is the plant's OWN reading rather than a design target: the source defines it that way — USNRC HRTD 12.2 (ML11223A301) and NUREG-1431 Rev 4 (ML12100A222) both say *"ΔT₀ = indicated ΔT at rated thermal power"*. Added 2026-09-06, when the constant behind it was found to be 56.0 °F (31.1 °C), a figure sourced to nothing and 5 % below what the plant actually reads — which put a healthy plant 5 % into both ΔT bands before anything happened. The manual had never printed the number at all, which is part of why it went three weeks unnoticed.

Pressing WITHDRAW into a standing rod stop is refused, and the refusal names which stop. Inward motion still takes — that is the source's own scope, quoted at the end of this section.

There is no startup-rate rod stop, and this table used to say there was. It listed a withdrawal block at 1.5 DPM clearing below 0.8, and the SUR readout on the board painted a red band there. No source in the corpus contains such an interlock; the figure came from the retired engine's control tables, which the board was still reading. **Measured before the fix: the plant ran to 10.00 DPM — 6.7× the band it was painting — across 90 consecutive withdrawal commands with none refused, and stopped only at a reactor trip. The band is gone. The SUR HI alarm at 1 DPM is real and stays**: it is an annunciator, not an interlock, and it is still the right thing to watch on a startup.

The ΔT rod stops are the OTΔT / OPΔT trip's own early warning, three percent before it fires, and they annunciate as OTΔT ROD STOP / OPΔT ROD STOP on Panel A. Sourced: WTSM 12.2 §12.2.3.7–.8 and Table 12.2-2 rows C-3/C-4 — "Loop ΔT > (OTΔT reactor trip setpoint − 3%)… Stops control rod outward motion (manual & automatic) and initiates a turbine runback." The turbine runback is built, and it is the half that acts rather than refuses. When the ΔT margin has HELD below the rod stop for about 8.5 seconds — a brief dip does not count, and that delay stands in for the two-out-of-four loop voting a single-loop plant cannot have — the plant reduces the generator load target by 5 % of rated in about 1.5 seconds, then holds it steady for 28.5 seconds and looks again — if the condition has not cleared, another 5 % in the next 30-second interval, and so on. You will see the number in the Generator Load box drop in steps with nobody touching it. It does not put the load back afterwards; that is yours to do once the condition is fixed. It never touches the reactor: it reduces LOAD, and the core follows the load down through the moderator coefficient, which is why it works and also why it is not instant. Sourced: WTSM 11.3 Westinghouse Electrohydraulic Control System (ML11223A295), Turbine Runbacks — "the EHC system reduces load at 200%/min for 1.5 sec (a 5% load change), then holds the load constant for 28.5 sec. If the runback condition has not cleared, the load will be reduced by another 5% in the next 30-sec interval." Measured on this plant: a 15 % steam line break takes two steps to 90 MWe and becomes a ride-out instead of a reactor trip, while a 30 % break and a continuous rod withdrawal still trip — they outrun the coupling the runback works through. Like every rod stop here, it blocks withdrawal only — "The rods can always be inserted into the core using either manual or automatic rod control" (WTSM 8.1 §8.1.7.3).

3.0 Engineered safety & automatic actuations

**A NOTE ON psi vs psig, because this set mixes the two conventions and the difference is real. Every pressure printed in this manual set is absolute, and written psi** — the board writes it the same way, accumulator nitrogen included. It is a conversion of the engine's MPa, which is absolute. Where a source document's own figure is quoted, it keeps its psig. Real Westinghouse documentation quotes pressurizer setpoints in gauge (psig), and the two differ by one atmosphere, 14.7 psi.

The consequence is a small internal inconsistency, declared here rather than silently carried. Our nominal 2235 psi takes the real plant's 2235 psig and reads it as absolute — so it is 14.7 psi below the real operating point.

The PORV is not affected, because it is not a converted number at all. It lifts **100 psi above whatever the pressure setpoint is**, which is the real plant's own nominal-to-PORV margin taken directly, so the margin is exactly 100 psi and stays 100 psi wherever you put the setpoint. What the sourced 2335 psig figure gives us is the valve's rating point — the pressure at which "179,000 lb/hr" is the flow — not its lift point. (Before 2026-08-30 this paragraph claimed a fixed 2350 psi PORV and a 115 psi margin; that was the retired engine's.)

This is not being "fixed" by moving 2235. That number is the pressure anchor of the whole plant — every equilibrium, initial condition, alarm band and scenario is referenced to it — and re-anchoring it 14.7 psi to buy 15 psi of margin fidelity would re-baseline the entire model for no behavioural gain. Recorded 2026-08-12 so the next reader who spots the mismatch finds the reason instead of the discrepancy. Real values for reference (WTSM 10.2, ML11223A287): nominal 2235 psig, spray starts 2260 psig, spray full open 2310 psig, PORV 2335 psig, safeties 2485 psig.

HPI pump curve (merged HPI/LPI)

• High-head trickle against operating pressure.
• Two pumps, two curves. High-head shutoff 1390 psi (9.58 MPa), reaching its full 300 gpm only below about 515 psi (3.55 MPa); low-head shutoff 215 psi (1.48 MPa), delivering 1200 gpm near atmospheric. Injection that looks inert at high pressure is the pump curve, not a fault.

AFW delivery

• Delivered flow = capacity × throttle × level-hold taper near target.
• AFW latches. Once it auto-starts on low steam-generator level it keeps feeding until

an operator secures it — it does not stop by itself. Deciding when to secure it is the operator's call, and it should not be left running once a trusted heat sink is back.

• Level hold: full flow below 32 %, tapering to zero at 40 %. Against decay-heat steam

draw an AFW-only generator settles around 37 % — inside the normal green band, clear of the 30 % SG LVL LO alarm. The approach is slow (AFW is rated 86.2 gpm against main feed), so expect level to take the best part of an hour to walk back up from a low-level start.

4.0 Alarm setpoints

Panel A — Reactor / primary

Panel B — Secondary / systems

§ The only annunciator gated on a LINEUP as well as a reading. It requires the accumulator discharge isolation valve indication (accum_valve_open) to read open as well as pressure to be below setpoint, so a correctly-isolated Mode 5 plant — which sits below this pressure indefinitely — never sees it. The setpoint is where LCO 3.5.1 stops requiring the accumulators OPERABLE ("MODE 3 with RCS pressure > [1000] psig") and LTOP SR 3.4.12.3 starts requiring them isolated, leaving 400 psi (2.76 MPa) above their cover gas. There is no autoclose interlock and that is deliberate — see 06 PWR-A32.

§ RHR — the suction valve has TWO setpoints, and the autoclose is the higher one. The valve will not open above 440 psi (3.03 MPa) — the sourced 425 psig, WTSM §5.1. That is the block-open permissive: a gate on your open command, not a trigger, because there is no RHR start actuation. A standing-open valve autocloses only once pressure rises back above 600 psi (4.14 MPa). Both are sourced. NUREG-0933 Issue 99, "RCS/RHR Suction Line Valve Interlock on PWRs" (Rev. 3): "Two basic features are incorporated in the interlock design: (1) an automatic closure signal on high RCS pressure (typically 600 psig), and (2) a block of the manual open signal at a lower RCS pressure (typically 425 psig)." The Westinghouse Technology Systems Manual §5.1 (ADAMS ML11223A219) gives the same structure for valves 8701/8702 — open block 425 psig, autoclose ~585 psig.

Why the gap matters to you. Between the two setpoints the valve stays where it is. That is what keeps a plant hunting around the permissive from chattering the valve — and since nothing re-opens it but you (06 PWR-A33), a spurious closure is permanent until you act. Until 2026-07-31 this plant used one constant for both jobs, so the deadband was zero: a cooldown whose pressure-control setpoint sat at 409 psi (2.82 MPa) aligned RHR, rebounded nine psi, auto-closed, and never recovered. Practical consequence: do not read "below 400 psi" as the condition for keeping RHR — it is the condition for getting it. Once aligned you have to reach 600 psi (4.14 MPa) to lose it.

Setpoints do not move with plant mode — priorities do. Every setpoint above is fixed in every mode. What changes is classification: the annunciators marked † drop to Status in Mode 4 or 5, where the condition is the planned lineup rather than a casualty, and ‡ drops to Status whenever the pumps were stopped by the handswitch rather than lost. The alarm still comes in and still reads its instrument; the priority, the wording, and — because Status-class annunciators arrive pre-acknowledged — the ACK demand are what change. Full table, the exclusions, and what it does not cover: 06 §2.0.

5.0 Safety / damage limits (physics)

6.0 Pressurizer control bands (AUTO)

7.0 Rod drive

7.5 Estimated Critical Condition (ECC) — reference data

What pins this curve. Two independent anchors, and they constrain different things. Shape — the boron dependence — is measured: the BEAVRS / Watts Bar U1 Cycle 1 HZP physics tests (OSTI 1991715, Table IV) report isothermal temperature coefficients at three boron concentrations (975 ppm → −1.75 pcm/°F, 902 → −4.65, 810 → −8.01), which put the moderator coefficient's zero crossing at 986 ppm. Level — the ARO critical boron at hot zero power — is also measured, at 975 ppm from the same tests. Magnitude is measured too: both parameters are least-squares fitted to those same three points, which supersedes the earlier 2026-07-21 ruling pinning the full-power coefficient at −20 pcm/°C. The plant runs −26.8 pcm/°C there now, and reproduces all three measured coefficients to within 0.09 pcm/°F instead of missing two of them by 0.88 and 1.64. A test checks every one of them, and nothing in this curve is set by preference any more.

Critical boron concentration (ppm) by Tavg and control-bank position, shutdown bank withdrawn, no xenon, zero power:

*(Re-measured 2026-09-03 on the shipped engine, RD.pwr2.kinetics.criticalBoron, against the 627-step bank. It previously described the RETIRED engine's 912-step bank, and so did the gate that was supposed to catch the drift — see the note below. The bank-IN and ARO columns barely moved; the 25 % and 75 % columns did, because this plant's worth curve is a different shape: curve_flatten 0.36, the four-bank overlap program of WTSM 8.1 §8.1.5.4.)*

Every cell is computed at normal operating pressure, 2235 psi (15.41 MPa), including the cold rows — which is a stated simplification, not a claim that a 122 °F plant is at 2235 psi. Boron is a density coupling, so pressure moves these numbers: the same 122 °F bank-IN cell reads 818 ppm at a realistic cold-shutdown 363 psi (2.5 MPa) against 811 ppm here, and the spread is largest in the bank-IN column and smallest at ARO. **Read the cold rows for the temperature lesson in §7.5.1, not as a dilution target for a depressurized plant.**

Differential boron worth (pcm/ppm). It is larger cold — denser water carries more boron atoms per unit volume — so the same dilution buys more reactivity at 122 °F than at power. Use the value for the temperature you are actually at.

Control-bank integral worth (pcm added, withdrawing from fully inserted). The curve is an S: least effective at either end, most effective mid-travel.

7.5.1 Reading the table — and the one rule that matters

WARNING — do not dilute toward a hot boron figure while the plant is cold. Read the first column of the table again: with the bank inserted, critical boron is **811 ppm at 122 °F (50.0 °C) and only 619 ppm at 547.0 °F (286.1 °C)**, this plant's no-load temperature. A number that is comfortably subcritical hot is critical, or worse, cold. This is not a modelling quirk — cold water is a better moderator, so a cold core needs more poison to stay shut down. Reaching Mode 3 at the no-load temperature before you dilute is what makes the dilution safe.

This is exactly how the real procedure handles it. WTSM 2.2 *Reactivity Balance Calculations* (ML11216A051), Attachment 2.2-1, note on line O: *"Since T avg is required to be >541°F, the reactivity change from moderator temperature is considered negligible."* A real ECC is only ever computed hot, which is why a real operator never faces this question. Our plant will let you drive it cold and dilute anyway, **and the source-range trip is what catches you — §2.0, 1e5 cps**, not blocked on a shutdown plant (since 2026-09-26; before that this plant had none). Measured, a runaway withdrawal from hot zero power at normal drive speed (full stack, 2026-09-26, times from rod_start): SUR HI at 267 s, SR HI FLUX at 298 s, the source-range trip at 304 s, rod 243 of 627. Once the source range has been blocked at P-6, what stands below P-10 (8 % power) is one caution and then two flux functions, in this order: **SUR HI at 1 DPM — an annunciator, not an interlock — then the intermediate-range high-flux rod stop at 20 % current equivalent, then the intermediate-range high-flux trip at 25 %**. Measured on a runaway withdrawal from hot zero power (2026-09-18; full stack, normal drive speed 0.800 steps/s — the normal rod speed — times given **relative to the start of withdrawal, i.e. the rod_start command, not engine boot): SUR HI at 267 s**, the rod stop at 338 s, the trip at 339 s. With the source range blocked, the annunciator is the whole of your early warning — nothing acts for you before the rod stop. *(Those three times were measured before the source-range trip existed; unblocked, the same runaway now trips at 304 s.)*

The acceptance band. Attachment 2.2-1 line Q brackets the prediction at ±750 pcm around the estimated critical position, or the rod insertion limit, whichever is tighter. On this plant's lumped bank the 719 ppm reference startup goes critical at 208 steps, and that gives a band of roughly 88 to 297 steps (ρ = −750 pcm at bank 88 and +750 pcm at bank 297, read off a one-step-at-a-time sweep with boron and T-avg held; 207 statically, 208 on the settled plant, one step being 0.66 °F of T-avg). The 223 steps / 111–310 printed here until 2026-09-14 was this plant computed at a benchmark anchor 10 °F above its no-load point — see 04 PWR-N02 §Step 15. The two tables above already said so, three paragraphs up: at 546.8 °F the bank-in critical boron is 619 ppm, so 719 ppm is 1137 pcm of boron to pull out (99.9 ppm at the 11.38 pcm/ppm measured there), and the integral-worth row puts 1137 pcm at about 206 steps — within two steps of the measurement, and seventeen from what the prose underneath them claimed. Work the tables; they are computed from the engine. Criticality outside the band means the estimate was wrong — stop and re-work it, do not keep pulling.

The band is checked against, not steered to. WTSM 19.0 (ML11223A342) Appendix 19-1 step 11 gives the response, and it is not a rod adjustment: if the bank goes critical below the 0 %-power insertion limit, reinsert all control rods to the bottom, recompute the estimated critical boron, borate to it, and withdraw again. NUREG-1431 Rev 4 Bases B 3.1.6 is explicit that the estimate "could be substantially in error" — it is a prediction with an acceptance band, never a target.

7.5.2 The calculation

Adapted from WTSM 2.2 Attachment 2.2-1 (Delta Rho Method). Work from a **last known critical condition**; every line is a reactivity difference between then and the startup you are planning.

NOTE. The real worksheet also carries samarium (lines L–N) and drops the moderator term because Tavg is required above 541 °F. This plant does not model samarium separately, and it will let you sit below 541 °F — so if you are cold, the moderator term is not negligible and the §7.5 table, not this worksheet, is your reference.

7.5.3 SHUTDOWN MARGIN — and why it is not the number the board shows you

SDM is computed with ALL RODS ASSUMED INSERTED except the single highest-worth rod, which is assumed stuck fully withdrawn. It is a calculated quantity, not a reading: it answers *"if the reactor tripped right now, how far subcritical would it be?"* — which is a different question from "how far subcritical is it right now?"

This manual set said "cold shutdown margin" for the second quantity until 2026-08-12. The two coincided only because the shutdown bank used to be parked withdrawn in Mode 5, which it no longer is (04 PWR-N01 step 2a). Measured on this plant at cold shutdown, 857 ppm:

The operational point. Withdrawing the shutdown bank does not make the plant unsafe — it is still 1000 pcm subcritical — but it spends the margin that was buying you time. Measured: an unattended dilution at the plant's make-up rate takes 79 minutes to reach criticality with the bank in; with the bank out it starts from −1000 pcm instead of −4676, so the same dilution gets there far sooner. And nothing stops it. This manual said that case "trips the source range inside the hour" until 2026-09-08 — there is no source-range trip on this plant (§2.0), so what the dilution buys you is indication only: the count rate climbing, **SR HI FLUX at 5e4 cps, and SUR HI** at 1 DPM once the rate is real. That is what a shutdown margin is for, and it is why the real procedure verifies it before the bank moves (ML11223A342 App 19-1 A.12 / C.8).

Applicability: NUREG-1431 LCO 3.1.1 — MODE 2 with k_eff < 1.0, and MODES 3, 4, 5. Commercial practice keeps boron sufficient for at least 1 % Δk/k (WTSM 19.2.1).

8.0 Operator training limits (authored standards)

9.0 Nuclear instrumentation scaling (reference)

10.0 Load mode parameters

11.0 Normal values by initial condition

Expected readings at each named engine initial condition, captured from the live engine after settling 70 s at 10x, the same for every column — the low-power states are still walking their pressure up at 6 s, which is how the old table came to quote a hot-standby pressure 9 psi (0.06 MPa) light. These six are the whole list and the engine refuses any other name, but only five are on the Free Play picker: hot_full_power, 50_percent, low_power (listed as At Power — power ascension, added 2026-09-28), hot_zero_power and cold_shutdown. hot_shutdown is engine-only — real, loadable by the gates, not offered to the player.

low_power is where the startup walkthrough hands you the plant. Its control bank sits at 222 of 627 steps, which is what the startup actually hands over: Ginna UFSAR §15.4.5.1.1 (ML20339A101), "the reactor is operated with the RCCAs inserted only far enough to permit load follow." Since 2026-09-25 it is also xenon-free, like the plant the startup hands over — a core that went critical minutes ago, not one that has run at 10 % for days: that is why its boron reads 719 ppm (the startup's own concentration) and its xenon 0 %. Xenon then starts building the moment you load the plant, over about two days.

The other two at-power columns used to boot on the top stop, 627 of 627, and no longer do. They sit at 606 of 627 — 96.7 % withdrawn, the sourced full-power position: NUREG-1431 Rev 4 STS Bases B 3.2.3A (ML12100A228) puts control bank D "near its normal position (i.e., 210 steps withdrawn)" at high power, and with banks A, B and C fully out that is 627 − (231 − 210) = 606 on this plant's bank-overlap step scale (WTSM §8.1.5.4, ML11223A252). Booting on the stop left the operator no upward rod authority at all — measured full stack, commanding the bank out moved settled T-avg by −0.01 °F; from 606 the same command gives +4.67 °F (+2.59 °C), and insertion is unchanged. The design point itself does not move (T-avg, level, power and output are identical to 0.01 °F at every bank position from 439 to 627, because critical boron re-trims); only boron moves — 621 → 612 ppm at full power and 777 → 768 ppm at half.

RE-CAPTURED AGAIN, AND SO WAS §1.0 (hours after the note below). Two unrelated constants moved the at-power columns:

• The rated loop ΔT the overtemperature and overpower ΔT trips normalise against was

56.0 °F (31.1 °C), a figure sourced to nothing, against a plant that settles at 58.9 °F (32.7 °C). It is also the construction input every initial condition is built from, so correcting it to the plant's own split moved all three at-power columns — but only a little, and toward where they already sat: T-avg +0.1 °F at hot full power and at 50 %, primary pressure +3.7 psi (+0.026 MPa) and +1.1 psi (+0.008 MPa).

• low_power's thermal power fraction is now derived from its 10 MWe dispatch instead of

typed beside it. It declared 10.5 % against a plant that needs 9.6 % to make 10 MWe, so the state opened 0.9 points hot and walked down. That column moved most: T-avg −0.6 °F (−0.3 °C), primary pressure −10.3 psi (−0.071 MPa), pressurizer level −0.8 points. §1.0's normal operating point was stale by far more than either, and is re-captured on the same ride: T-avg 577.7 → 580.4 °F, legs 607.2 / 548.2 → 609.8 / 550.9 °F, pressurizer level 59 → 62 %, steam pressure 808 → 827 psi (5.70 MPa), control bank "≈ 92 %" → 100 % withdrawn (every at-power initial condition but low_power boots on the top stop). That table dated from before the no-load T-avg anchor moved to 547 °F (286.1 °C) and nothing gates it — run_manual_setpoints reads the §11.0 table below, and skips §1.0 by design because both open with the same | Parameter | header.

THE TWO PART-LOAD COLUMNS WERE RE-CAPTURED (after the no-load anchor moved). This plant's programmed no-load average coolant temperature (T-avg) is Ginna's 547 °F (286.1 °C), not the four-loop reference plant's 557 °F (291.7 °C) — in the T-avg program and in the pressurizer level program. Every reading between no load and full power moved with it, and 50_percent and low_power are the two columns that live there. T-avg falls 5.0 °F (2.8 °C) and 8.1 °F (4.5 °C) respectively. Subcooling margin is saturation temperature at RCS pressure minus T-hot, and the pressurizer holds a pressure setpoint — so saturation stays where it was and the margin gains what T-hot loses. That, and nothing else, is the +5 and +9 °F (+2.8 and +5.0 °C) in that row: at low_power T-hot falls 8.6 °F (4.8 °C) while saturation rises 0.4 °F (0.2 °C) on the 5 psi (0.034 MPa) of extra pressure, for +9.0 °F (+5.0 °C) of margin against the +8.8 °F (+4.9 °C) measured. Pressurizer level rises for a different reason: the level program is a straight line between the no-load and full-power T-avg knots, and moving the lower knot down makes that line shallower — 1.10 points of level per °F (1.98 per °C) where it was 1.58 (2.84) — so at any temperature below the full-power knot the programmed level is now higher. That is also why hot_full_power moved two points while hot_zero_power, hot_shutdown and cold_shutdown did not move at all: those three sit at the no-load knot or below it, where the program is already sitting on its 25 % floor and reads the same under either anchor. **That floor is why the error was invisible for two investigations** — the no-load point, which is the one anybody checks first, was never wrong.

MODE 5 EXISTS. The water-property floor moved from 14.5 psi (0.1 MPa) to 0.29 psi (0.002 MPa), so a steam generator can sit at ambient — the cold_shutdown column below is a real, loadable state whose secondary rides at 1.8 psi (0.0127 MPa), saturation at the plant's own 123 °F (50.6 °C). The cold end of the ladder is Mode 5, Cold Shutdown — 122 °F (50 °C), 363 psi (2.50 MPa) at boot, RHR in service, reactor coolant pumps secured, turbine tripped, both main feed pumps secured with level control in MANUAL, pressurizer heaters OFF and spray in hand and shut, both banks in. 5_percent remains the retired engine's and is refused by name. hot_shutdown IS NOT ON THE FREE PLAY MENU. The column stays because the initial condition is real, is booted by three gates, and is the reference for what a Mode 4 plant should read — but the player cannot select it. Measured when the question was put: Mode 4 and Mode 5 differ in exactly one independent quantity — temperature. 250 °F (121.1 °C) against 122 °F (50.0 °C); 105 of 122 true-state fields are identical and the whole lineup is the same, so the two were one choice the player could not act on. Modes 2 and 4 are transitions — you reach them by operating, which is why neither is a preset.

healthy board after selecting an IC, and as the "what should this read?" reference during evolutions. At steady state the indicated values track these true values through each instrument's lag and noise (see 03_CONTROLS_AND_INDICATIONS.md §16.0) — a mismatch that persists is either a transient in progress or a failed instrument.

Notes:

• PZR level rides the Tavg program (1.10 %/°F, 1.98 %/°C, 61.5 % at full-power Tavg): the level column

IS the program — do not "correct" a 30 % level at low power, it is where the program wants it. Both figures were re-measured 2026-09-06; the slope followed the no-load knot down to 547 °F (286.1 °C), and the plant now reaches the full-power end (it settled 2.4 °F (1.3 °C) short of it, and held 59 %, until the initial conditions' fuel seed was fixed).

• Steam pressure rides the load: full-power 826 psi (5.696 MPa) up to the 1020 psi (7.03 MPa) no-load point

(= Psat of the 547 °F (286.1 °C) no-load Tavg anchor).

• Boron differs per IC by design (rod position and xenon differ); the hot_zero_power

value is low because the control bank is fully inserted and xenon-free ≈ criticality is held down by rods, not boron.

• hot_shutdown starts with RCPs secured, RHR aligned, both banks in, the SR detector energized and (since 2026-09-04) the pressurizer heaters off with the spray in hand — the cooldown's own lineup throughout, with the P-11 blocks already taken. PWR-N12 turns the heaters off at its depressurization step, before the RHR alignment that makes the plant Mode 4, so a Mode 4 reached by the book already has them off. See 05_MODE_TRANSITIONS.md PWR-T20 for the climb out, and read its Mode 5 steps against the note above.
• BOTH cold columns boot with pressurizer pressure control OUT OF SERVICE. Heaters OFF, spray in hand and shut — the lineup PWR-N12 leaves behind, so a preset

and a plant you cooled down yourself finally read the same. Neither is a degraded state; measured untouched for 60 plant-minutes, cold_shutdown moves 362.6 psi (2.500 MPa) → 362.9 psi (2.502 MPa) (+0.3 psi/hr) and hot_shutdown 364.0 psi (2.510 MPa) → 364.2 psi (2.511 MPa) (+0.2 psi/hr). Putting it back in service is PWR-N01 step 5b, from either start, and until you do the Pressure SP is inert — 0.05 psi in 10 plant-minutes against +133 psi (0.92 MPa) with the heaters in AUTO.

• Two Primary pressure cells moved with it, and both were reading the same artefact:

cold_shutdown 368 → 363 psi (2.537 → 2.500 MPa) and hot_shutdown 369 → 364 psi (2.545 → 2.510 MPa). Neither old figure was that state's settled pressure — each was the AUTO ladder walking its own preset off its construction point during this table's 70-second settle, at +11.7 psi/hr and +12.2 psi/hr respectively. With the heaters off both columns read what the initial condition is actually built at. hot_shutdown was left in AUTO for about an hour on the day of the change, on the reading that the ruling named the Mode 5 lineup; the measurement above is what took it across.

12.0 Related documents

• 06_ALARM_RESPONSE.md
• 04_NORMAL_OPERATIONS.md
• 07_ABNORMAL_EMERGENCY.md

These manuals are licensed CC BY 4.0 — see Legal. Training documents for an educational simulator, not licensing-basis documents for a real plant.