CANDUsim — Game Design Document & System Architecture

Version 0.1 · A 3D operator simulation of a generic 480-channel CANDU unit (Bruce-class geometry, CANDU 6 public state points). This document specifies what is simulated, how it is computed, how the player interacts with it, and how faults are injected. It is written for a reader who already knows the plant.

Contents

• Part 0 — Design pillars & scope
• 1.1 Time & tick architecture
• 1.2 Neutron kinetics
• 1.3 Spatial model
• 1.4 Reactivity feedback & coefficients
• 1.5 Fuel & fuel management
• 1.6 Reactivity devices
• 1.7 Reactor Regulating System
• 1.8 Heat transport architecture
• 1.9 Secondary side & turbine-generator
• 1.10 Electrical classes & instrument air
• 2.1 Roles & 3D spaces
• 2.2 The core loop: keep the zones in band
• 2.3 Gamified procedures
• 2.4 HMI design
• 2.5 Scoring & progression
• 3.1 Fault engine architecture
• 3.2 Scenario catalogue
• 3.3 Special Safety Systems interaction
• 3.4 Severe-accident boundary
• Part 4 — Technical architecture

Part 0 — Design pillars & scope

Pillars

Difficulty tiers

Simulated versus abstracted

Engine recommendation

design decision The physics core is a separate deterministic module with no engine dependency, integrated by a thin adapter. The JavaScript reference implementation in assets/candu-core.js defines the contract: PLANT (constants), ReactorCore (kinetics, feedback, devices), RRS (regulation), HeatTransport (primary and secondary lumped model), SafetySystems (SDS1, SDS2, ECCS, containment), and Unit (scheduler, annunciator, fault injection). A game-engine port (C# for Unity, GDScript or C++ for Godot 4) is expected to be line-for-line, and the JS core stays as the golden reference for regression tests. Godot 4 is preferred for an independent developer (open licence, good 3D, built-in multiplayer); Unity is acceptable if the team already knows it. The 3D world must never own plant state; it reads a snapshot and posts commands.

Part 1 — Core simulation architecture

1.1 Time & tick architecture

Plant phenomena span nine orders of magnitude in time: the prompt neutron lifetime is under a millisecond, an MCA drop takes seconds, a zone fills in minutes, xenon peaks in ten hours, burnup drifts over months. A single tick rate cannot serve all of them, so the simulation is layered:

Adaptive step and time acceleration

The scheduler in Unit.advance(wallDt) multiplies wall time by the selected time scale and substeps. The substep is 20 ms whenever anything fast is happening (|log rate| > 2 %/s, shutoff rods or poison in motion, power above 105 %FP); 100 ms when the rate exceeds 0.2 %/s; otherwise up to 0.5 s at real time and up to 2 s when accelerated. Two numerical choices make large steps safe:

• The prompt term (ρ−β)/Λ, which is stiff (a −80 mk trip gives a rate of −95 s⁻¹), and the inter-zone coupling term are solved fully implicitly: the 14 zone powers are the unknowns of a 14×14 linear system solved by Gaussian elimination with partial pivoting (solveDense). The system matrix is diagonally dominant, so any step length is stable.
• Precursor groups, iodine and xenon are advanced semi-implicitly (production explicit, decay and burn-out implicit), which is unconditionally stable and exact for constant flux within a step. The 3.01 s⁻¹ sixth delayed group and the 0.277 s⁻¹ shortest photoneutron group would otherwise force steps below 0.3 s.

Time acceleration is offered in ×1, ×10, ×60 and ×600. At Trainee tier it is always available; at higher tiers it is inhibited while any annunciator is unacknowledged or any device is in motion. design decision

Determinism and replay

All randomness (transmitter noise, fault onset jitter, fuelling machine hiccups) comes from a seeded generator. The event log — every operator command with its simulated timestamp, every fault activation, every trip — is the ground truth of a session; a replay is the event log re-applied to the same seed. A save is the state vector (zone powers, precursors, poisons, temperatures, device positions, HTS state, SSS state, per-channel fuel state) plus the seed and event log. Golden-run regression tests (Part 4) compare state vectors at fixed checkpoints.

1.2 Neutron kinetics

Each of the 14 zones carries its own set of point-kinetics equations. For one zone with relative power n, delayed precursor concentrations C_k, photoneutron precursors C^p_j, and a coupling term to the other zones:

dn/dt   = ((ρ − β)/Λ)·n + Σ_k λ_k·C_k + Σ_j λ^p_j·C^p_j + S + κ·Σ_i w_i·(n_i − n)

dC_k/dt = (β_k/Λ)·n − λ_k·C_k          k = 1..6   (fission-product delayed groups)
dC^p_j/dt = (β^p_j/Λ)·n − λ^p_j·C^p_j  j = 1..9   (D2O photoneutron groups)

β = Σ_k β_k + Σ_j β^p_j      (β_eff is the TOTAL delayed fraction)
ρ = ρ_fuel + ρ_cool + ρ_mod + ρ_void + ρ_Xe + ρ_LZC + ρ_adj + ρ_MCA + ρ_SDS1 + ρ_SDS2 + ρ_poison + ρ_burnup + ρ_zone
κ = 2·Δk_harmonic / Λ,  Σ_i w_i = 1   (see 1.3)

Delayed-neutron data

The six fission-product groups use Keepin's U-235 thermal relative yields and decay constants, scaled so that their sum plus the photoneutron fraction equals β_eff. β_eff is a PLANT parameter because it drifts with burnup: a fresh natural-uranium core is dominated by U-235 (β ≈ 0.0065), while an equilibrium core derives a large share of its fissions from bred Pu-239 (β ≈ 0.0021), pulling the effective value to roughly 0.0056 assumed. The fuel-management module (1.5) supplies the current value; the kinetics module never assumes it.

Why the CANDU is "soft"

The prompt neutron lifetime in a heavy-water lattice is about 0.9 ms, thirty to fifty times longer than in a light-water core. Combined with the delayed fraction, this means the stable period for a given reactivity is long and the power response to a device movement is gentle: a 1 mk ramp over 100 s peaks at 100.1 %FP under RRS control in the reference model, and a −80 mk shutoff-rod insertion drops power by a factor of about 15 in the prompt jump rather than by orders of magnitude. The other side of the coin is that positive reactivity is also slow to arrest; the positive void coefficient (1.4) is only tolerable because two independent fast shutdown systems exist.

Photoneutrons

Deuterium has a (γ,n) threshold of 2.22 MeV, and several fission-product gamma emitters exceed it. Their decay produces neutrons long after fission has stopped. The model carries nine photoneutron groups assumed yields with half-lives from 2.5 s to 12.8 d and a total fraction near 3×10⁻⁴ of neutrons at equilibrium. Consequences that the player will experience:

• After a trip the log rate settles at a few tenths of a percent per second negative and keeps flattening for hours; the reactor never reaches a "zero" reading, which is why the start-up instrumentation reads a genuine signal from a recently-operated core.
• A restart within a day is an approach to critical from a strong internal source; a restart after weeks is a source-range start-up with the external neutron source and a much longer, more careful 1/M procedure (2.3).
• Photoneutrons slightly increase the effective delayed fraction in steady operation, and the model accounts for their share inside β_eff — omitting it produced a persistent +0.29 mk imbalance during development, a useful reminder that the bookkeeping must close.

1.3 Spatial model

A CANDU core is large compared with the neutron migration length, so it is loosely coupled: one side of the core can rise in power while the other falls, with the bulk power unchanged. This is what makes xenon spatial oscillations possible and is the entire reason liquid zone control exists. Point kinetics cannot show it. A full 3-D diffusion solve at game frame rates is unnecessary. The chosen model is fourteen coupled point-kinetics nodes, one per liquid zone compartment, laid out in two axial halves of seven (top-left, top-centre, top-right, mid-left, mid-right, bottom-left, bottom-right).

Coupling weights are proportional to 1/d² between zone centres and row-normalised. The coupling strength κ is not a free constant; it is set from the eigenvalue separation between the fundamental and first-harmonic flux modes, a quantity with physical meaning that a reactor physicist can adjust. With a first non-trivial eigenvalue of the weight matrix near 0.5, a pure tilt mode decays at κ(1−λ₁), giving κ ≈ 2·Δk_harmonic/Λ. The default Δk_harmonic = 13 mk assumed; at 12 mk the xenon oscillation diverges violently, at 14 mk and above it is stable — 13 mk gives the slowly divergent behaviour a large CANDU actually has.

Tier-2 option: coarse-mesh diffusion for display

design decision For the flux-mapping display and the fuelling engineer's channel-power map, a coarse-mesh two-group diffusion solve on roughly 22×22×12 nodes can run asynchronously every simulated two minutes (matching the real flux-mapping cadence), constrained to reproduce the 14 zone powers from the kinetics model. It has no feedback into the game state; it exists to make the channel power map and CPPF (1.5) spatially credible. If it is never built, channel powers are synthesised from zone powers, a stored reference shape, and per-channel fuel age.

Instrumentation model

1.4 Reactivity feedback & coefficients

The iodine–xenon chain

dI/dt = γ_I·φ − λ_I·I
dX/dt = γ_X·φ + λ_I·I − λ_X·X − σ_X·φ·X
λ_I = 2.87e-5 s⁻¹ (6.6 h)     λ_X = 2.09e-5 s⁻¹ (9.1 h)
γ_I = 0.0639                   γ_X = 0.0025
σ_X·φ_FP = 2.6e-4 s⁻¹          (σ ≈ 2.65e6 b, φ ≈ 1e14 n·cm⁻²·s⁻¹)
ρ_Xe = −28 mk · X / X_eq(FP)

Because the burn-out rate at full power is more than ten times the xenon decay constant, the post-trip peak is severe: burn-out stops instantly while the accumulated iodine keeps decaying into xenon. This is the physical fact behind the poison-override window, and it is the single most important number in the operator's day.

Fresh cores

A core loaded entirely with fresh natural-uranium fuel has far more excess reactivity than the devices can hold and a moderator temperature coefficient of the opposite sign. The initial load therefore contains depleted-uranium bundles in selected positions, and the first months of operation are a distinct regime (the "plutonium peak", when bred Pu-239 raises reactivity before fission products and burnup bring it down). The game treats the fresh-core state as a separate scenario family with its own coefficient set; the default career starts in an equilibrium core. design decision

1.5 Fuel & fuel management

Channel power peaking factor and the ROP margin

The regional overpower (ROP) trip protects against fuel dryout in the highest-powered channel. Its setpoint is not a fixed 122 %: it is adjusted for the current channel power peaking factor (CPPF), the ratio of the highest actual channel power to its reference value. Refuelling a channel raises its power for days (fresh bundles in the highest-flux positions, before the plutonium peak passes), raising CPPF and lowering the effective ROP margin. This gives the fuelling engineer's list its constraints: fuel channels that are burnt out, but not so many high-flux channels at once that the ROP margin collapses, and keep the zone average in band (2.2). In the model:

ROP_setpoint_effective = ROP_base / CPPF          (ROP_base ≈ 1.22 FP, CPPF typically 1.06–1.12)
Trip if any zone-mapped detector reading > ROP_setpoint_effective

Data model

Channel {
  id: "L12", row, col, zone: 4,
  bundles: [ { burnupMWdkg, ageDays, positionIndex } × 13 ],
  powerMW, referencePowerMW, cppfContribution,
  flowKgS, outletTempC, dryoutMargin,          // channel-level lookup
  feederStatus, pressureTubeStatus, annulusGasDewPoint
}
Zone { index, powerFraction, lzcLevel, xenon, iodine, bias_mk }

Each refuelling raises the target zone's bias_mk by a scheme-dependent amount (≈ +0.3 mk for a 4-bundle shift, ≈ +0.5 mk for an 8-bundle shift assumed), which then decays toward the burnup baseline over the following weeks. The bulk burnupMk falls continuously at full power. The sum of the two is the reactivity budget the operator manages with the zones.

1.6 Reactivity devices

All worths are equilibrium-core representative values assumed. Device worths interact (a rod's worth depends on where the flux is), which the reference model ignores; the Tier-2 diffusion option can supply position-dependent worths later.

1.7 Reactor Regulating System

RRS is a program on the dual digital control computers. DCC X and DCC Y each run the full program; one is in control, the other tracks and takes over on watchdog failure. The game models both computers as objects with health states so that a DCC failure is a first-class fault (3.2).

Power error

e_P = (P − P_d) / P_d                                  fractional power error
e_R = logRate − demandedRate                           demandedRate = clamp(ln(P_d/P)/5 s, ±2 %/s)
E   = K_P·e_P + K_R·e_R                                K_P = 40, K_R = 60  (design decision)
      → 100 % valve lift at 2.5 % power error or ≈1.7 %/s rate error
zone lift_i = clamp(E + K_S·(n_i − n̄)/n̄, −1, +1)       K_S = 4 (spatial control gain)

Positive E means power is high: zones fill (inflow valve opens, adding light-water absorber). Negative E drains them. The spatial term acts on the deviation of each zone from the mean, so the bulk and spatial functions share the same valves. When the average zone level leaves its 20–80 % band and the power error agrees, RRS calls on the slower devices in a fixed order: zones low and power low → MCAs out first, then adjuster banks out; zones high and power high → adjusters in first, then MCAs in. Nothing moves when the band is satisfied, which is why a unit at steady state can sit for hours with zone levels drifting and no device motion — and why the operator is watching that average.

Modes

Setback and stepback

The stepback endpoint of 60 % on turbine and grid initiators is the poison-prevent level: the reactor stays high enough that the xenon transient does not poison it out, with CSDVs dumping steam to the condenser until the turbine returns. If the condenser is lost too, the ASDVs relieve to atmosphere and the unit is on a clock: ASDV capacity alone does not sustain 60 %, and the operator must reduce power further and accept the poison-out risk.

Post-trip behaviour

design decision On a trip the setpoint is driven to a post-trip value of 10⁻⁴ FP. Zones keep regulating against it, so they fill while power is still above it (the conservative direction), and adjusters and MCAs are inhibited from automatic motion until the shutoff rods are fully out. The poison-override decision — whether to withdraw adjusters manually to chase the xenon — is deliberately the operator's, not the computer's. Stations differ in the details of post-trip RRS behaviour; this is the behaviour the game commits to, and it is one line in RRS.step() to change.

Loss of regulation

Any failure that leaves RRS unable to hold power at the setpoint is a loss of regulation: a DCC failure with a failed transfer, a zone drain on a failed valve or a wrong-sign power signal, a stuck adjuster bank, or a false-low power signal driving the zones empty. LOR events are the primary source of the "slow-then-fast" dramatic arc in the game (3.2): the plant does nothing alarming for a minute, then the rate meter moves, then either the operator or SDS1 ends it.

1.8 Heat transport architecture

Topology profiles

design decision The plant profile selects a topology: CANDU 6 (two figure-of-eight loops, each with 2 RIH, 2 ROH, 2 pumps, 2 SGs; loops can be isolated on a LOCA signal) or Bruce-class (single loop, 4 pumps, 8 SGs with integral preheaters, 4 RIH/4 ROH representative). The lumped model carries one pressure and temperature per header group and a per-loop inventory; loop isolation makes the two halves independent in the CANDU 6 profile.

Components and their state

Boiling at the outlet

A CANDU at full power operates with a few percent steam quality at the outlet of the highest-powered channels. The lumped model computes a saturation temperature from ROH pressure (T_sat ≈ 180 + 13.5·P_MPa across 8–11 MPa, a linear fit accurate to ~1 °C assumed fit) and a bulk void fraction from the ROH temperature margin to it. Void is fed to the kinetics as a positive reactivity. A depressurisation therefore does two things at once — it takes away the coolant's ability to remove heat and it adds reactivity — which is the physics behind the high and low HT pressure trips and the sizing of SDS1 and SDS2.

1.9 Secondary side & turbine-generator

Load rejection response

The sequence the game reproduces on a loss of line: the generator breaker opens; the turbine governor closes to hold speed on house load; SG pressure rises immediately; BPC opens the CSDVs; RRS steps back to 60 % by dropping the MCAs; power undershoots (to ~38 % in the reference run) and recovers to 60 % on the zones; xenon begins to rise and the zones drift down, and after some minutes RRS begins withdrawing adjusters to hold 60 %. The operator's tasks are to confirm CSDV operation, confirm the stepback endpoint, verify house load is stable, and decide with the grid operator whether to resynchronise. If the condenser is lost as well, the sequence becomes a race against the poison-out.

1.10 Electrical classes & instrument air

Part 2 — Gameplay loop & operator mechanics

2.1 Roles & 3D spaces

A twelve-hour shift

2.2 The core loop: keep the zones in band

The average liquid zone level is the reactor's reactivity budget shown as a single number. Everything that adds reactivity raises it (RRS fills the zones to hold power): refuelling, xenon burn-down after a power increase, moderator poison removal, moderator temperature rise. Everything that removes reactivity lowers it: burnup, xenon build-up after a power reduction, poison addition. RRS keeps power exactly at the setpoint as long as the zones can, and asks for adjusters or MCAs only outside 20–80 %. The operator's standing job is to keep the average comfortably inside the band, with enough margin in both directions to absorb the next disturbance:

• Too high (approaching 80 %): the next refuelling would push RRS into driving adjusters in, which distorts the flux shape and reduces ROP margin; the operator defers fuelling or adds a little moderator poison.
• Too low (approaching 20 %): a power reduction or a lost fuelling day would push RRS into withdrawing adjusters, again distorting the flux; the operator requests fuelling or removes poison.
• Tilt: a zone sitting at 90 % while the others sit at 40 % means the spatial control is working hard against a local perturbation — a recently fuelled channel, a xenon oscillation seed, or a failed zone valve. The operator watches individual zone levels, not only the average.

This loop is not invented; it is what the RRS design creates, and it is satisfying for the same reason the real job is: the numbers move slowly enough to reason about, every action has a visible consequence over the next hour, and there is always a next disturbance on the way. The fuelling list, the poison concentration, the ROP margin and the zone average are the four dials of the strategic layer; the annunciator wall is the tactical layer that interrupts it.

2.3 Gamified procedures

Each procedure below is described as: the real procedure skeleton; the in-game interaction; scoring and consequence; what is deliberately not abstracted.

On-power refuelling

Liquid zone control management

Reactivity mechanism handling and Approach to Critical

Power manoeuvres

Start-ups, shutdowns and the guaranteed shutdown state

Routine tests

SDS channel trip tests (trip one channel of three, verify the logic, reset), ECC valve stroke tests, emergency diesel starts, and annunciator lamp tests are short procedures with real risk: a second channel failing during a test trips the reactor. They give the fault engine a natural place to reveal latent failures (a valve that does not stroke, a diesel that does not start) and give the player a reason to walk to the field.

2.4 HMI design

Alarm philosophy

• Annunciator windows are grouped by system, lamp-tested at shift start, and follow the standard sequence: new alarm flashes with an audible; acknowledge stops the flash; the window stays lit until the condition clears; a cleared-but-unacknowledged window flashes at a different rate. The reference model's Unit.annunciator implements alarm / acknowledged / clear states with timestamps.
• Sequence of events: every alarm is logged with a simulated timestamp to the millisecond on the DCC; the player can scroll it. Post-event analysis (the debrief screen) is built from this log.
• Alarm flooding is modelled honestly. A large LOCA produces dozens of windows in seconds. Prioritisation is by colour and by position in the summary display; the tutorial teaches the player to look at the first-out and at the safety-system status before anything else.
• DCC mimic displays present the system flowsheets with live values; trend displays present up to eight selected variables against time; both exist as objects in the 3D control room and as a 2D overlay for practicality.

Physical interlocks

Key-locked controls (SDS test switches, rod drive enable), guarded switches (manual trip, manual ECC initiation), and two-hand actions (poison injection, containment button-up override) are modelled as their physical objects: the player must obtain the key, lift the guard, or hold two controls. These are not decoration; they are the reason accidental trips are rare, and they make deliberate ones feel deliberate.

Learnability layer

2.5 Scoring & progression

There is no score. There is an evaluation, modelled on how a unit and a crew are actually assessed:

Career progression is Trainee → ANO → SS by completing the tutorial campaign and then catalogued scenarios at the tier above. Scenario unlocks are gated on the corresponding tutorial lesson, never on score.

Part 3 — Fault injection & emergency scenarios

3.1 Fault engine architecture

The fault engine is separate from the plant model. It never edits plant state directly; it edits the parameters and boundary conditions the plant model reads (a valve's stroke, a transmitter's transfer function, a break area, a pump's availability). This keeps the plant model honest and the faults composable.

Fault {
  id: "lzc.valve.stuck",
  target: { system: "lzc", component: "zone[7].inletValve" },
  kind: "process" | "sensor" | "logic" | "power",
  onset: { profile: "step" | "ramp" | "intermittent", duration_s, jitter_s },
  severity: 0..1,                          // maps to break area, drift rate, stuck position...
  latent: true | false,                    // latent faults show only when the component is demanded
  observability: [                         // ordered chain, each with a delay
    { layer: "physical", cue: "zone 7 level frozen", delay_s: 0 },
    { layer: "sensor",   cue: "zone 7 level transmitter reads constant", delay_s: 0 },
    { layer: "alarm",    cue: "FLUX TILT HIGH", delay_s: 300..1200 },
    { layer: "field",    cue: "valve positioner air leak audible in LZC room", delay_s: 0 }
  ],
  clears: { by: "field.repair" | "auto" | "never", time_s }
}

Scenario scripts

# scenario: lor-zone-drain-with-failed-dcc-transfer
seed: 8841
plant: bruce-class-480
initial: { power: 1.0, xenon: equilibrium, zoneAvg: 0.62, cppf: 1.09, shiftTime: "09:40" }
timeline:
  - at: 00:12:00
    inject: { id: "dcc.x.powerSignal.failLow", severity: 0.6, onset: { profile: "ramp", duration_s: 90 } }
  - at: 00:12:30
    inject: { id: "dcc.transfer.fail", latent: true }        # DCC Y will not take over
  - at: 00:20:00
    condition: { trip: false }
    inject: { id: "field.fo.busy", duration_s: 600 }          # FO is in the turbine hall
evaluation:
  win:  [ "manual trip before highNeutronPower", "post-trip actions complete within 10 min" ]
  fail: [ "SDS1 trip on HIGH NEUTRON POWER", "no acknowledgement within 60 s of first alarm" ]

Randomiser and plausibility

The procedural randomiser draws faults from the library with weights derived from representative failure rates (valves and transmitters often, DCC and SDS logic rarely), applies plausibility constraints (no two independent SSS failures in one shift unless the scenario is tagged "beyond design basis"; latent faults are placed before the shift and revealed by demand), and keeps a difficulty budget per shift so that the plant is usually quiet. The scenario director mode exposes the same library to an instructor or a second player, who can inject faults live and see what the operator sees.

Sensor versus process failures

Half of the fault library is instrumentation: transmitters failing high, low, stuck or drifting; detectors losing HV; RTDs open. These are the faults that make the game about diagnosis rather than reaction. A stuck SG level transmitter with the real level falling is an entirely different event from a real low level, and the plant gives the operator the information to tell them apart — redundant channels, the sequence of events, the physics (feed flow versus steam flow) — if the operator looks.

Implemented fault ids in the reference core

Unit.inject(id):  load-rejection · turbine-trip · ht-pump-trip · loss-of-regulation ·
                  small-loca · large-loca · loss-of-feedwater · loss-of-condenser ·
                  channel-blockage · feed-bleed-fail · moderator-cooling-loss · clear

3.2 Scenario catalogue

3.3 Special Safety Systems interaction

The operator's hands are tied by design. The Special Safety Systems act automatically, on their own instrumentation, with their own logic, and cannot be prevented from acting by anything the operator does in the control room. The player's job during an event is verification (did each system do what it should?), backup manual initiation (if a system should have acted and did not), and the Emergency Operating Procedure flow (establish and maintain heat sinks, control inventory, monitor containment). The game makes this explicit: the SSS status panel is the first thing the tutor points to after any trip.

SDS1

Logic is two-out-of-three on channels D, E and F for each parameter; a single failed channel trips its own channel (fail-safe) and annunciates but does not trip the reactor. Rod drop is spring-assisted gravity, complete within two seconds. Reset requires all rods fully inserted and no trip parameter present; withdrawal is by motor in two banks of roughly half the rods, about three minutes each, and the player can hold at any time. In the reference model the reset guard and banked withdrawal are implemented in SafetySystems.resetSds1() and SafetySystems.step().

SDS2

Channels G, H and J, two-out-of-three, on a parameter set that overlaps SDS1 but with independent sensors, cabling and logic. Actuation opens fast-acting valves and helium pressure drives gadolinium nitrate solution through nozzles into the moderator within about a second; the worth is about −300 mk. Recovery is slow: the gadolinium is removed by the moderator ion-exchange columns over hours, which is why an SDS2 actuation is a guaranteed poison-out and a multi-day event. The game models the clean-up as a rate, and the operator initiates it from the moderator panel.

ECCS

Containment

Button-up closes ventilation dampers and isolates penetrations on high RB pressure or high activity. In the Bruce-class profile the reactor buildings connect by a pressure relief duct to a vacuum building held well below atmospheric pressure; pressure relief valves open at about +7 kPa(g) assumed and the vacuum building absorbs the steam release; dousing sprays in the vacuum building condense steam above about 14 kPa(g). Filtered air discharge manages long-term pressure; hydrogen igniters and recombiners manage the deuterium and hydrogen that a degraded core would release. The reference model implements the pressure, PRV and dousing thresholds in SafetySystems.step(); the CANDU 6 profile replaces the vacuum building with in-building dousing.

Emergency heat sinks

The EOP flow the game teaches is the heat-sink hierarchy: steam generators with main feed, then auxiliary feed, then the emergency water supply; shutdown cooling once the HTS is depressurised; the moderator as a heat sink if the fuel channels lose cooling entirely; and ECC recirculation for a LOCA. The player's decisions are about which is available, which to establish next, and in what order to line up valves — which is also what sends the field operator into the plant.

3.4 Severe-accident boundary

The model stops at the point where a fuel channel fails. If a channel is predicted to lose cooling (dryout margin exhausted and no ECC), the channel is flagged as damaged, activity is released into the HTS and then containment, and the moderator becomes the heat sink for that channel. The game does not model core disassembly, calandria failure, or anything beyond a core damage state flag with its radiological consequence modelled as containment activity and a filtered release. The reasons are practical and principled: severe-accident phenomenology is not operator-facing in the sense this game cares about; it would require a different class of model; and the events that matter to an operator — everything up to and including the last heat sink — are already the hard part. A scenario that reaches the core damage state ends with a debrief, not a spectacle. design decision

Part 4 — Technical architecture

Interface contract

Unit.advance(wallDt: seconds)                     // advances simulation by wallDt × timeScale
Unit.snapshot(): Readonly<State>                   // immutable copy for HMI/3D; never a live reference
Unit.command(op, args, actor): Result              // e.g. ("rrs.setTarget", {fraction:0.6, rate:0.002}, "CRO")
                                                   // validated: permission (role, key, guard), interlocks,
                                                   // two-hand actions (requires two concurrent holds)
Unit.inject(faultId | Fault)                       // fault engine entry point
Unit.on(event, handler)                            // "alarm", "trip", "sss", "violation", "milestone"
Unit.serialize() / Unit.restore(blob)              // state vector + seed + event log

Performance budget

Multiplayer

design decision Co-op with one authoritative simulation host (the CRO's machine or a dedicated server) and clients that receive snapshots at 10 Hz plus event deltas. The field operator client renders the plant areas and posts field commands; the SS client renders approvals and the log. Latency is not critical: nothing in the plant needs sub-second reaction, and the physics is deterministic, so clients can interpolate.

Test strategy

Golden-run regression: each validation scenario is run from a fixed seed and its state vector compared at checkpoints against a stored baseline with tolerances. The current baselines, all produced by the reference core in this session:

Roadmap