Tutorial Campaign

Nine lessons that take a new operator from reading the panel to running a twelve-hour shift with faults. Every lesson runs on the same physics core as the game; nothing here is scripted theatre. The reactor does what a CANDU does, and the lesson only tells you where to look.

How the tutorial teaches

Each lesson introduces one new concept and one new set of controls. You will never be asked to do something the previous lesson did not prepare you for. The lesson text is written the way a shift supervisor would brief you: what the plant is doing, what you are expected to do, and why the plant is built to behave that way.

Trainee

Procedure sidebar open, the next control to operate is highlighted on the panel, and the tutor voice (shown in italics below) speaks each step. Wrong actions are intercepted with an explanation before they take effect.

ANO

Procedure sidebar only. No highlighting, no voice. Wrong actions take effect and the plant responds. You are expected to recover.

Shift Supervisor

Nothing. The lesson objective is stated once at the start. Pass criteria are checked at the end. This is the level you will be scored at in the capstone.

Glossary strip

Term	Meaning
`mk`	Milli-k. One thousandth of reactivity (Δk/k). The core is critical at 0 mk. All device worths, feedback effects and xenon loads are quoted in mk.
`%FP`	Percent of full power (thermal). The reactor power readout and setpoint use this scale.
`LZC`	Liquid Zone Control. Fourteen light-water compartments in the calandria. Filling a compartment absorbs neutrons (negative reactivity); draining it adds reactivity. The RRS's fine control.
`ROP`	Regional Overpower Protection. Trip logic using in-core detectors that protects individual fuel channels, not just bulk power.
`CPPF`	Channel Power Peaking Factor. Ratio of the highest channel power to its reference value. Refuelling raises it; the ROP trip setpoints are lowered to match.
`RIH / ROH`	Reactor Inlet / Outlet Header. The heat transport pressure and temperature readouts are taken here. ROH pressure is the number you watch.
`BPC`	Boiler Pressure Control. Holds steam generator pressure by moving turbine governor valves or, if the turbine cannot take the steam, opening discharge valves to the condenser (CSDV) or atmosphere (ASDV).
`UPR`	Unit Power Regulator. In Normal mode the turbine leads and the UPR adjusts the reactor setpoint to follow; in Alternate mode the reactor leads and the turbine follows.
`SDS1 / SDS2`	Shutdown System 1 (spring-assisted gravity shutoff rods, about −80 mk in two seconds) and Shutdown System 2 (gadolinium nitrate injected into the moderator, about −300 mk in one second). Fully independent of each other and of the RRS.
`ECC`	Emergency Core Cooling. High-pressure injection, medium-pressure injection, then long-term recovery from the sump.
`GSS`	Guaranteed Shutdown State. Enough moderator poison that the reactor cannot go critical no matter what the reactivity devices do.
`Poison override`	Restarting after a trip before xenon build-up makes the core subcritical. You have roughly forty minutes. After that the reactor is "poisoned out" for a day and a half.

Cheat sheet: the six numbers

An operator's eyes move between six readouts. Learn their normal bands and the physical reason for each, and most of the panel will make sense.

Readout	Normal band	Why it matters
Reactor power	At setpoint ± 1 %FP	Bulk neutron power from ion chambers and in-core detectors. The high-power trip is at 122 %FP; ROP trips are lower and depend on CPPF.
Log rate	0 ± 0.1 %/s at steady power; ≤ 2 %/s during manoeuvres	The rate of change of the logarithm of power. It is the earliest signal of a reactivity problem because it does not wait for power to become large. The SDS1 trip is at 10 %/s.
Average zone level	20–80 %, ideally 40–60 %	Fourteen compartments, 7 mk in total. When the average leaves the band, the RRS reaches for the coarse devices (adjusters, MCAs). Outside the band you are running out of fine control.
Flux tilt	< 5 %	Maximum zone deviation from the mean. A large loosely-coupled core wants to tilt; xenon makes it oscillate over hours. Spatial control exists to stop this.
ROH pressure	9.9 MPa ± 0.2	Heat transport pressure. Too low and the outlet coolant boils (positive void reactivity, then fuel cooling problems). Too high and the relief valves lift. Trips at 8.6 and 10.45 MPa.
SG level	50 % of span ± 10	Steam generator inventory is the heat sink. Low level means feedwater is not keeping up; the trip is at 25 % of span.

Lessons

Walkdown: reading the panel

Goal

Identify every readout, understand what an annunciator window is telling you, and acknowledge an alarm correctly.

Concept you will learn

A control room is not a dashboard. Every indication is placed where it is because of what fails around it. The annunciator windows above the panel are wired to plant conditions directly and do not depend on the control computers; the readouts below them do. A flashing window is a new alarm. A steady lit window is an alarm you have acknowledged but that is still true. A dark window is a condition that is not present. The trend is your memory: it tells you what the plant was doing before you looked.

What you will see

The unit at 100 %FP, grid connected, 915 MW gross. Zone levels near 50 %. All windows dark except ADJUSTERS OUT OF CORE, which is not lit because all adjusters are in. No alarms.

Steps

Read the top row of readouts left to right: REACTOR POWER, LOG RATE, LZC AVG, TILT. "Power one hundred, rate zero, zones fifty, tilt under one. That is a quiet reactor."
Read the heat transport row: ROH PRESS, PZR LEVEL, SG PRESS, SG LEVEL, GEN MW. "Nine point nine megapascals, pressuriser sixty-five, boilers four point seven, level fifty, nine-fifteen megawatts. Everything is where the design put it."
Look at the fourteen zone bars. The dashed lines are the 20 % and 80 % band. "Every bar sits between the dashed lines. When they do not, the reactor is telling you it is short of reactivity in one direction."
Press SDS1 TRIP guard open, but do not operate the switch. Close the guard. "You have just learned that the trip switches are guarded. Nothing on this panel that can shut the unit down works with one motion."
Set time scale to ×10 and wait for the annunciator ZONE LEVEL HIGH to be raised by the instructor. It flashes. Press ACK ALARMS. "Flashing means new. Acknowledging does not clear it — it stays lit until the condition is gone. Your acknowledgement tells the rest of the crew you have seen it."
Watch the trend for thirty seconds. Note the three traces: power, xenon load, zone average.

Pass criteria

The alarm is acknowledged within 60 seconds of appearing and you did not operate any control that changes plant state.

Common mistakes and what they teach

Operating the trip switch. Lesson 0 ends with a tripped reactor and a long explanation. The guard is there to make you think.
Acknowledging before reading. The ANO level will ask you what the alarm said. Read, then acknowledge.

Why the plant does this. The annunciator is hard-wired because the control computers can fail. A CANDU has two digital control computers (DCC X and DCC Y); either can run the plant, but the annunciator windows for the safety-related conditions come from field contacts, not from either computer. If both computers were lost, you would still know the state of the plant from the windows.

Try it on the live panel

Holding full power: watch the zones work

Goal

Introduce a slow reactivity disturbance and watch the Reactor Regulating System absorb it with the liquid zones; understand the 20–80 % band and why the mechanical control absorbers trim in.

Concept you will learn

Reactivity is added and removed continuously in a running CANDU: by fuel burnup, by refuelling, by moderator poison, by temperature, and by xenon. The RRS holds power constant by moving light water in and out of fourteen zone compartments. Each compartment is worth about half a milli-k; all fourteen together about 7 mk. When the fine control runs out of range, the RRS reaches for the coarse devices: adjuster rods (16 mk, normally in the core) and mechanical control absorbers (10 mk, normally out).

What you will see

Same start as Lesson 0. You will use the POISON REMOVE button, which represents the moderator purification system pulling boron or gadolinium out of the heavy water.

Steps

Confirm RRS AUTO is lit. "The RRS is in automatic. You are not going to control power in this lesson; you are going to watch it be controlled."
Set time scale ×1. Press and hold POISON REMOVE for about 100 seconds. This removes about 1 mk of moderator poison, at 0.01 mk/s. "Watch the log rate. It will go positive by a few hundredths of a percent per second. Now watch the zone bars."
Observe: all fourteen bars rise together. Power peaks at about 103–104 %FP and returns to 100. "The RRS saw power above setpoint and filled every zone at once. That is bulk control."
Watch the zone average climb through 80 %. The annunciator ZONE LEVEL HIGH flashes. Then MCA IN CORE. Acknowledge both. "The zones are nearly full. The RRS cannot absorb any more reactivity with water, so it is driving a mechanical control absorber into the core. That is the coarse device taking over."
Watch the zones drift back toward 80 % as the MCA takes the load. "The MCA stopped as soon as the zones came back inside the band. Nothing moves in this reactor unless there is a reason."
Now press POISON ADD for 100 seconds to restore the original state. Observe the reverse: zones drain, the MCA drives back out when the average falls below 20 % and power is below setpoint.

Pass criteria

Power stayed within 95–105 %FP throughout; both alarms acknowledged; you did not touch the setpoint or the RRS mode.

Common mistakes and what they teach

Holding POISON REMOVE too long. The MCAs are only 10 mk. Remove 12 mk of poison and you will see what a reactor looks like when it has nowhere left to put reactivity — and then you will see SDS1 act at 122 %. The trainee level stops you at 4 mk.
Switching RRS to MANUAL "to help". The zones freeze. Power runs away at the rate the poison is leaving. The lesson here is that the RRS is faster and more consistent than you are at this task.

Why the plant does this. A CANDU is a big, loosely-coupled core running on natural uranium with almost no excess reactivity. Its fine control has to be continuous and small, which is what light water in zone compartments provides: about 0.1 mk/s across all fourteen, with no mechanical wear. The coarse devices are slower on purpose — adjusters take about ten minutes for all seven banks, MCAs three minutes — so that the fine control always has time to catch what the coarse control does. The 20–80 % band leaves headroom in both directions for the next disturbance.

Try it on the live panel

Power manoeuvre: 100 → 80 → 100 %FP

Goal

Change reactor power deliberately using the setpoint and ramp rate, watch the turbine follow, and see the xenon response that makes the return to full power a different task from the reduction.

Concept you will learn

The RRS drives power toward a setpoint at a ramp rate you choose. The turbine follows in Normal mode: as reactor power falls, steam generator pressure would rise, so BPC closes the governor valves to hold pressure and generator output drops. Xenon-135 is produced from iodine-135 decay and destroyed mostly by neutron capture. When you reduce power, burn-out drops immediately but iodine keeps decaying at the old rate, so xenon rises for several hours before falling. The reactor gets more poisoned after you reduce power, not less.

What you will see

Same start as Lesson 0. The xenon trace on the trend is the number to watch.

Steps

Set RAMP RATE to 0.1 %FP/s. Enter TARGET 80. "Two hundred seconds to eighty percent. Watch the setpoint and the actual power together; the RRS holds actual within a percent of setpoint the whole way."
Watch the zones. They fill as power comes down (fuel cools, adding reactivity; the zones absorb it). Watch GEN MW drop to about 730. "Boiler pressure stayed at four point seven. The governor valves closed to hold it. That is Normal mode: the turbine follows the reactor."
At 80 %, set time scale ×60. Watch the xenon trace for two simulated hours. "Xenon load is rising — from twenty-eight milli-k toward thirty-two. The zones are draining to compensate. Nothing is wrong. The reactor is paying the xenon bill for the power reduction."
Around the two-hour mark the zone average approaches 20 % and the annunciator ZONE LEVEL LOW may flash, followed by ADJUSTERS OUT OF CORE. Acknowledge. "The RRS is withdrawing adjuster rods to make up the reactivity. That is normal at reduced power. Note the adjuster position readout."
Set time scale ×1. Enter TARGET 100 at 0.1 %FP/s. "Now the return. Fuel heats up and takes reactivity away; xenon starts to burn out again and gives it back over the next few hours. The zones will swing the other way."
At 100 %, set ×60 again and watch the adjusters drive back in as xenon burns off and the zone average climbs above 80 %.

Pass criteria

Power within 2 %FP of setpoint at all times; no trip; adjusters back in the core at the end; you can state, in one sentence, why xenon rose after the reduction.

Common mistakes and what they teach

Choosing 0.4 %FP/s. Fast, and legal, but the log rate gets to 0.5 %/s and the zones move at their limit. On a real unit this rate is reserved for specific procedures. Lesson 4 will show you a much faster change that you do not choose.
Returning to 100 % as soon as you reach 80 %. Nothing bad happens, but you will not see the adjusters move and will not understand Lesson 6 when it matters.

Why the plant does this. Xenon-135 has a thermal absorption cross-section of about 2.6 million barns. At CANDU flux levels (around 10¹⁴ n/cm²·s) burn-out dominates its removal, which is why the equilibrium load is a large 28 mk and why any power change produces a xenon transient measured in hours and tens of milli-k. Adjuster rods carry 16 mk precisely so that these transients can be ridden through without shutting down. This is not a feature of the game; it is the reason adjusters exist.

Try it on the live panel

Refuelling day: tilt, spatial control and ROP margin

Goal

See what a single refuelled channel does to the flux shape, watch spatial control correct it, and manage the reactivity that fuelling adds over a day.

Concept you will learn

A CANDU refuels on power: a fuelling machine pair pushes fresh bundles into one channel while the reactor runs. Fresh bundles add local reactivity, so power in that region rises — a flux tilt. The RRS corrects it with spatial control: it fills the zone compartment nearest the refuelled channel more than the others. Meanwhile the highest-power channel sets the Channel Power Peaking Factor. The ROP trip setpoints are lowered as CPPF rises, so an aggressive fuelling schedule eats into your margin to trip. Fuelling engineers plan channel selection to keep CPPF within its limit.

What you will see

The unit at 100 %FP. A channel in zone 4 has just been refuelled (+0.3 mk local). The zone 4 bar is rising and TILT reads about 1 %.

Steps

Watch the fourteen bars. One is climbing alone. "That compartment is filling because the power in its region went up. The other thirteen are hardly moving. This is spatial control working: each zone gets its own correction on top of the bulk correction."
Read TILT. It peaks around 1 % and settles below 1 %. "One channel out of four hundred and eighty is about one percent of tilt. The flux mapping system would show you which channel."
Press REFUEL CHANNEL three more times, choosing different zones, at ten-minute intervals (×10). "A real fuelling day is about two channels. You are doing four to see the effect faster."
Watch the zone average climb. When it exceeds 80 %, ZONE LEVEL HIGH flashes and, after a while, the adjuster readout starts to move — "The adjusters are already in. So the RRS is putting the MCAs in. The fuelling has added more reactivity than the zones can hold."
Press POISON ADD for 60 seconds. Watch the zones drain back toward 50 % and the MCA withdraw. "On a real unit the fuelling engineer would call for boron to be added to the moderator exactly like this, to give the zones their room back."
Open the ROP display. Note the trip setpoint has dropped from 122 % toward about 118 % as CPPF rose. "That is the margin you spend when you fuel. Xenon and burnup will give some back over the next day."

Pass criteria

Tilt stayed below 5 %; zone average was returned to within 30–70 % by poison addition; you did not let the MCAs fully insert.

Common mistakes and what they teach

Refuelling four channels in the same zone. Tilt reaches several percent and that zone's compartment goes to 100 %. It can hold no more. You have just discovered why the fuelling schedule spreads channels across the core.
Switching spatial control off. The instructor mode lets you. Over twenty hours the tilt grows on its own to over 30 % as the xenon in one half of the core burns out while the other half poisons up — a xenon spatial oscillation. It is the best demonstration in the game of why the fourteen zones exist.

Why the plant does this. A CANDU core is about six metres across and the neutron migration length is a fraction of that; the two halves of the core are only loosely coupled. The first harmonic flux mode is only about 10–15 mk from the fundamental, so small local reactivity changes produce large local power changes, and xenon feedback can make them grow into oscillations with a period of about a day. Point kinetics cannot represent any of this. CANDUsim runs fourteen coupled zones so that the tilt you see is real, and so that the spatial control you watch is doing something necessary.

Try it on the live panel

Grid load rejection

Goal

Recognise a loss of line, understand what the plant does on its own in the first minute, know what to check, and return the unit to service.

Concept you will learn

When the generator breaker opens the turbine has nowhere to send its power. The governor valves slam shut to stop overspeed; steam that was going to the turbine now goes nowhere and boiler pressure rises. Two things happen in seconds: BPC opens the condenser steam discharge valves to dump steam, and the RRS initiates a stepback — it drops the mechanical control absorbers into the core and lets power fall to about 60 %FP. The unit then holds at a power high enough to stay ahead of xenon ("poison prevent") until the grid is back.

What you will see

100 %FP, grid connected. You will inject LOAD REJECTION yourself.

Steps

Time scale ×1. Press LOAD REJECTION. "Loss of line. Say it out loud. Now read the windows."
Windows: LOSS OF LINE, RRS STEPBACK, MCA IN CORE, CSDV OPEN, SG PRESSURE HIGH. GEN MW reads 0. Acknowledge them all. "Five alarms in ten seconds. The plant has already done the important things. Your job is to confirm each one happened."
Check the MCA readout: about 40 % inserted. Check power: falling through 60 %. The stepback ends when power is below its target, and the MCAs stop where they are. "The stepback drops rods until power is below sixty. It does not put them all the way in."
Watch power undershoot to about 40 % and the zones drain to zero. "The zones are empty and power is still below setpoint. The RRS will now withdraw the MCAs — slowly — and if that is not enough, the adjusters."
Watch power recover to 60 %FP over about five minutes. Check SG PRESS: held near 4.7 MPa by the CSDVs. Check the condenser is available (no ASDV OPEN alarm). "Steam is going to the condenser, not to the sky. If the condenser had been lost you would see atmospheric discharge instead and you would have a decision to make about how long to run this way."
Set ×10. Hold at 60 % for twenty minutes and watch the zone average fall as xenon rises after the power reduction. Adjusters begin withdrawing. "Sixty percent is not an arbitrary number. It is high enough that xenon builds slowly and the adjusters can cover it for several hours."
Press CLEAR FAULTS (grid restored; on the real unit this is a synchronising procedure). Enter TARGET 100, 0.2 %FP/s. Watch MW climb and the zones fill as fuel heats and xenon burns out.

Pass criteria

All alarms acknowledged within 60 s; no reactor trip; unit back at 100 %FP with adjusters returning to the core.

Common mistakes and what they teach

Entering a lower setpoint "to help the stepback". The stepback already has the setpoint. Lowering it further deepens the undershoot and, at lower power, the xenon transient becomes harder to override. Let the RRS finish.
Raising power before the MCAs are out. The zones have to fill against the MCA withdrawal and the xenon burn-out at the same time. It works, but the zone average will spike and you will get ZONE LEVEL HIGH. The plant prefers one thing at a time.

Why the plant does this. A stepback rather than a trip is the CANDU answer to a turbine or grid event: it reduces power fast enough to protect the steam side without losing the unit to the xenon transient. The alternative — tripping — costs a day and a half of poison-out. The dump valves to the condenser are sized for exactly this: they can take about 70 % of full-power steam, which is why 60 % is the stepback target on a load rejection.

Try it on the live panel

Loss of regulation

Goal

Recognise a reactivity control failure from its earliest signs and make the correct call: trip the reactor manually before the shutdown system has to.

Concept you will learn

Loss of regulation means the RRS is adding reactivity it should not be. In this scenario the zones are draining without a power error to justify it — a failed level controller, a failed computer output, a stuck valve. Power rises slowly at first because the reactivity is arriving slowly (about 0.03 mk/s). The log rate goes positive and stays positive. Nothing on the annunciator says "loss of regulation"; you infer it from the zones moving the wrong way for the power error.

What you will see

100 %FP, quiet. You inject LOSS OF REGULATION. The RRS mode indicator will show MANUAL — the control computer output has failed.

Steps

Press LOSS OF REGULATION. Say nothing for twenty seconds and watch. "Power one hundred point three. Rate plus zero point one. Zones... forty-seven and falling. Why are the zones draining when power is above setpoint?"
Read the zone bars every ten seconds. All fourteen falling together. Power 101, 102, 103. "Every zone at once. That is not a valve; that is the bulk demand. The RRS is telling the zones to add reactivity and it is wrong."
Try to restore control: press RRS AUTO. It will not take. "The computer output has failed. You cannot regulate. You have two choices: let SDS1 trip at one twenty-two, or trip it yourself now."
Open the guard on SDS1 TRIP and operate it. "Manual trip. Shutoff rods in two seconds. Read the windows."
Windows: SDS1 TRIPPED. Power falls through 10 % in the first seconds and continues down. Log rate reads large negative and then settles around −1 %/s. Acknowledge. "That is a tripped CANDU. Rods in, power collapsing on the delayed neutrons. Note the time. Lesson six starts here."

Pass criteria

Manual trip initiated before power reached 110 %FP; loss of regulation identified from the zone behaviour (the ANO level asks you to state the reason before you trip).

Common mistakes and what they teach

Waiting for the automatic trip. SDS1 will trip at 122 % on high neutron power; you will see it act at about the two-minute mark and it works exactly as designed. But you allowed the fuel to run at 120 % for a minute with no idea why, which no shift supervisor accepts. The correct action is the early manual trip, and the trainee level tells you so at 108 %.
Adding moderator poison to fight it. Poison addition is slow (0.01 mk/s) and the loss of regulation is adding 0.03 mk/s. You will lose. This teaches that the coarse reactivity systems are not protection systems; only SDS1 and SDS2 are.

Why the plant does this. CANDU defence in depth separates control from protection completely. The RRS runs on the control computers and can fail in any way software can fail. SDS1 and SDS2 run on their own triplicated instrument channels, their own logic, their own actuators, and each can shut the reactor down alone against any credible reactivity fault, including a loss of regulation at the maximum rate the reactivity devices can produce. The operator's manual trip is a third, independent path. You are part of the safety case; use the switch.

Try it on the live panel

Trip, reset and poison-override restart

Goal

Understand what a tripped reactor is doing, reset SDS1 correctly, withdraw the shutoff rods in banks with holds, approach criticality, and get the unit back to 60 %FP before xenon closes the window. Then see what happens when you are too late.

Concept you will learn

After a trip, power collapses in seconds on the prompt neutrons and then decays on the delayed neutrons and, later, on the photoneutrons — heavy water gives off neutrons when hit by fission-product gammas, so a CANDU never goes truly dark and the log rate after a trip is softer than in a light-water reactor. Meanwhile xenon builds at about 0.45 mk/min because nothing is burning it out. The adjuster rods carry 16 mk, so you have about forty minutes to be back at power. Shutoff rods come out under motor drive in two banks; each bank adds reactivity far faster (about 0.2 mk/s) than the zones can compensate (0.1 mk/s), so the second bank is withdrawn in steps with holds, watching the log rate, until the reactor is critical and the RRS has it.

What you will see

The reactor two minutes after a manual trip from 100 %FP. Power 0.2 %FP, rods in, zone compartments at 100 % (they filled while power was above the post-trip setpoint), SDS1 TRIPPED lit and acknowledged. Adjusters and MCAs are inhibited while the rods are in.

Steps

Read the panel. "Power zero point two and falling. Rate minus one. Zones full — the RRS wants power at its post-trip setpoint of ten to the minus four, so it filled everything. Xenon twenty-eight point six and climbing. Start a clock."
Confirm the trip parameter has cleared: SDS1 TRIPPED is lit but the parameter readout shows MANUAL with no live trip. Press SDS1 RESET. "Reset only works when every rod is fully in and no trip parameter is present. If it does not take, you are not ready."
Press WITHDRAW BANK A. Watch the shutoff rod readout go from 100 % to 50 % over three minutes. Power keeps falling. "Half the rods are out and the reactor is still deeply subcritical — forty milli-k of rods still in. Nothing to watch yet except the clock. Eight minutes gone."
Press WITHDRAW BANK B. Now watch LOG RATE every few seconds. When it goes positive, press WITHDRAW BANK B again to stop. "Rate plus zero point three. Hold. The reactor is close to critical. The zones are full, so the RRS has nothing more to give in the negative direction — you are the control system for the next minute."
Wait until the rate settles. Withdraw again in short steps until the rod readout shows 0 %. "Rods out. Rate positive but small. Power climbing through ten to the minus three. The RRS will now hold power at its setpoint by draining the zones as needed. You have handed control back."
Enter TARGET 60 at 0.4 %FP/s. "This is the one time the fastest ramp is the right ramp. The clock says twenty-two minutes. Adjusters are out of the inhibit and the RRS will pull them if the zones run dry."
Watch power climb. Below about 15 %FP the setpoint climbs exponentially at 2 %/s; above it, linearly. Watch the zones drain and the adjusters start to withdraw. Watch XENON POISON OUT IMMINENT: if it lights, you are about to lose. "Fifty percent. Adjusters half out. Xenon thirty-six. Fuel is heating and taking reactivity away, xenon is still climbing — but at sixty percent you are burning it faster than iodine makes it, and in an hour the zones will start to refill."
At 60 %, set ×60 and watch two hours. Xenon peaks, then falls. Adjusters drive back in. "You overrode the poison. That is a good shift."

The failed version

Restart the lesson with ?scenario=poison-override. Same start, but this time wait: set ×60 and let ninety minutes pass with the rods in.
Reset and withdraw both banks. Nothing happens; the rate stays negative. "Xenon fifty-three. Twenty-five milli-k more than at full power."
Press ADJUSTERS MANUAL OUT until all are out. Zones drain to zero. Power still falling. "Sixteen from the adjusters, three and a half from the zones, a couple from cold fuel. Twenty-two milli-k. Xenon is holding twenty-five and still climbing. The reactor is poisoned out."
Set ×600. Watch the xenon peak at about −125 mk near ten hours and decay. It is back to 28 mk after about thirty-five to forty hours. "A day and a half. That is what the forty-minute window is worth."

Pass criteria

Reactor critical with no trip during rod withdrawal (log rate never above 5 %/s); 60 %FP reached within 40 minutes of the trip; adjusters back in the core within four hours.

Common mistakes and what they teach

Withdrawing bank B without holds. The rods add about 0.2 mk/s; once critical, the reactor is on a twenty-second period before the zones can respond. Log rate passes 10 %/s and SDS1 trips again on high rate. You have spent five minutes of the window and are back where you started with more xenon. The real plant does this in steps for exactly this reason.
Withdrawing adjusters before the rods are out. Inhibited. The design does not let you stack reactivity devices on top of a partially shut-down reactor.
Raising power at 0.05 %FP/s "to be safe". Twenty minutes to 60 %; the window closes at forty. Sometimes slow is not safe.

Why the plant does this. The poison-override capability is a deliberate trade: adjusters cost about 16 mk of neutron economy every day the reactor runs (natural uranium fuel cannot spare it lightly), and in return the station can recover from a trip in forty minutes instead of forty hours. Every part of the restart sequence — reset conditions, bank withdrawal, device inhibits, the RRS post-trip setpoint — is a piece of the case that says this can be done safely with rods that add reactivity faster than the zones remove it. The operator's holds are part of that case.

Try it on the live panel The failed version

Loss of coolant

Goal

Follow a large break from the first indication to long-term recovery, know which actions are automatic and which are yours to verify, then handle a small break where the decision point belongs to you.

Concept you will learn

A break in the heat transport system depressurises the headers. In a CANDU the first consequence is reactivity: coolant that flashes to steam in the pressure tubes adds reactivity (positive void coefficient, about +10 mk for the whole core), so power rises before it falls. The shutdown systems trip on high log rate or on low header pressure within a second or two. Then the sequence is thermal: emergency core cooling injects at high, then medium, then low pressure; containment closes on high building pressure; the (Bruce-style) vacuum building draws the reactor building down through pressure relief valves; dousing condenses the steam. Most of this is automatic. The operator confirms each step happened and manages what the automatics do not: the steam generators as a heat sink, the moderator as a backup heat sink, and the long-term recirculation.

What you will see

100 %FP. You inject LARGE LOCA (0.05 m² equivalent) and, in a second run, SMALL LOCA (0.002 m²).

Steps: large break

Press LARGE LOCA. Watch ROH PRESS and LOG RATE in the first three seconds. "Pressure nine point six, nine point four. Rate positive. That is void. The coolant is boiling in the channels and the reactor is getting more reactive."
SDS1 trips: SDS1 TRIPPED, parameter HIGH LOG RATE or LOW ROH PRESSURE, whichever channel saw it first. SDS2 trips independently a moment later. Acknowledge. "Both shutdown systems. Rods and poison. Confirm the rod readout says one hundred percent."
Watch RB PRESSURE HIGH and CONTAINMENT BUTTON-UP. Building pressure climbs toward +7 kPa(g), the pressure relief valves open to the vacuum building, and it stops climbing. "Seven kilopascals and holding. Vacuum building has the steam. Containment is doing its job without you."
Watch ROH PRESS fall through 5.5 MPa. Thirty seconds later, or as soon as building pressure confirms the break: ECC INJECTION. ECC stage reads high-pressure. "Injection. The conditioning signal is low header pressure plus a second sign that this is a real break, so a single failed transmitter cannot fire it. Now watch inventory come back."
Verify: PZR LEVEL recovering, SG PRESS falling (the crash cooldown — main steam safety valves open to pull heat out of the steam generators and keep them as a heat sink). "Boilers are cooling the primary side from the outside. That is why you want feedwater alive."
Set ×10. Stage moves to medium-pressure at two minutes and recovery (recirc) at ten. "Long-term cooling. Water from the reactor building sump, through heat exchangers, back into the headers. This can run for weeks."

Steps: small break

Restart at 100 %FP. Press SMALL LOCA. Nothing trips. "Pressure nine point eight, nine point seven. Pressuriser level dropping slowly. Feed is keeping up. No alarm yet. What are you going to do?"
Watch PZR LEVEL for two minutes. It falls through 50 % and PZR LEVEL LOW flashes. HT PRESSURE LOW follows. "The plant is not going to trip on this for a while. You have a leak you cannot see, inventory you cannot replace forever, and a reactor at full power."
Correct action: reduce power (TARGET 60 at 0.4 %FP/s) to reduce the heat that has to be removed, then trip manually if pressure continues to fall below 9.0 MPa. "You tripped it at nine point one. SDS1 would have tripped at eight point six, a minute later, with void forming in the outlet feeders. The minute was yours."

Pass criteria

Large break: every automatic action confirmed (verbal check-off at the ANO level) within 90 s of occurrence. Small break: power reduced before HT PRESSURE LOW; manual trip before 8.8 MPa.

Common mistakes and what they teach

Trying to hold pressure with feed and bleed on the small break. It works for a few minutes and then the D₂O storage tank is empty. Feed and bleed is a pressure control system, not a make-up system for a leak.
Closing the CSDVs during the crash cooldown "because SG pressure is low". The steam generators are the heat sink for the primary side. Cooling them is the point.

Why the plant does this. The positive void coefficient is the reason CANDU has two fast, fully independent shutdown systems and the reason each is designed against the large LOCA power pulse specifically. It is also the reason the moderator matters so much in the safety case: the calandria is full of cool heavy water that surrounds every pressure tube, and if ECC failed altogether the moderator would still remove enough heat to keep the fuel channels intact. Nothing in this lesson is a scripted event; it is the physics core producing void, the trip logic seeing it, and the safety systems responding on their own conditioning signals.

Try it on the live panel

Capstone: a twelve-hour shift

Goal

Run the unit for twelve simulated hours at ×60 with faults injected at random by the scenario engine. Everything from Lessons 0–7 may occur. No tutor, no highlighting, no intercepts.

What you will see

Handover at 100 %FP with two channels scheduled for refuelling, a grid operator who may call for a load change, and a fault list you cannot see. The shift log is open.

Steps

Take the handover: read every readout and every window and write the state in the shift log (LOG ENTRY). The scorer checks this entry exists.
Perform the scheduled refuels at the requested times. Manage the zone average with poison addition as needed.
Respond to whatever occurs. Every alarm acknowledged within 60 s. Every abnormal event logged with time, indication, action taken.
Hand over at twelve hours with a written state entry.

Pass criteria

Criterion	Standard
Unplanned trips	None. A manual trip in response to a fault that warranted it is not unplanned; the scorer checks the log entry.
Zone levels	Average within 20–80 % for at least 95 % of the shift.
Flux tilt	Below 5 % at all times.
Alarms	Every window acknowledged within 60 s of flashing.
Reportable events	Every trip, stepback, setback, ECC action or containment action has a log entry within five minutes of occurrence.
Handover	State entries at start and end.

What the scorer does not care about. Megawatt-hours. A shift that generated less power but never let the plant surprise you is a pass. A shift that made full output and had one unlogged stepback is a fail. This is what an operating licence is for.

Start a shift on the live panel

Beyond the tutorial

From tutorial to career

The lessons follow the shape of an authorised nuclear operator training programme, compressed:

Systems (Lessons 0–1): what each system does and how to read it.
Integrated plant (Lessons 2–3): how the systems interact during normal manoeuvres and refuelling — reactor, heat transport, steam, turbine, fuel management.
Abnormal operation (Lessons 4–6): events the plant is designed to ride through, where the operator's contribution is verification, judgement and recovery.
Emergency operation (Lesson 7): design-basis accidents, where the special safety systems act and the operator manages heat sinks and long-term recovery.
Authorisation (Lesson 8): the simulator shift.

The full game extends each stage: additional systems (moderator, end shields, annulus gas, D₂O management, Class I–IV power), a field operator role for local actions, and a scenario library with the events that make up a real operating history.

Instructor mode

Lessons are data, not code. A lesson is a plant preset, a list of triggers, a list of checks and a list of hints. Instructors can write their own; the game engine and the physics core do not change.

lesson: load-rejection-basic
title: Grid load rejection
assist: trainee            # trainee | ano | ss
preset: steady             # plant state at start
timescale: 1
triggers:
  - at: 20s
    inject: load-rejection
    say: "Loss of line. Read the windows."
  - when: annunciator.RRS_STEPBACK == alarm
    highlight: ACK_ALARMS
    say: "Stepback. Confirm the MCA position."
  - when: core.power < 0.45
    say: "Undershoot is expected. Let the RRS recover."
checks:
  - id: ack-60s
    rule: all_alarms_acked_within(60)
    fail: "An alarm went unacknowledged for over a minute."
  - id: no-trip
    rule: sss.sds1.tripped == false
    fail: "The reactor tripped. Review the MCA and zone response."
  - id: back-to-power
    rule: core.power > 0.98 && time < 40min
hints:
  - if: rrs.target < rrs.setpoint && rrs.stepback
    say: "Do not lower the setpoint during a stepback."
pass: all(checks)