Emergency Operating Procedures (EOP, Symptom-Based) — The Dual Event-Based and Symptom-Based Structure with SPTA, ORP and FRP

Principle and mechanism

From event-based to symptom-based — the lesson of TMI

In the 1979 TMI-2 accident, the pressurizer power-operated relief valve (PORV) stuck open. Because the pressurizer level was high, the operators concluded that the system was full of water and throttled high-pressure safety injection. In fact coolant kept escaping, and about half of the core melted. The accident showed that an approach which first names the accident and then follows that accident's procedure breaks down when the diagnosis is wrong or failures overlap.

The NRC required reanalysis of accidents and improvement of the EOPs under item I.C.1 of NUREG-0737 (1980), and set out how to write them in NUREG-0899 (August 1982). The sequence is technical guidelines → procedures generation package (PGP) → writer's guide → verification and validation (V&V) → training. The owners' groups of each reactor type wrote the technical guidelines: the ERGs for Westinghouse plants and the CEN-152 EPGs for CE plants. In accepting CEN-152 Rev.1 in 1983 (GL 83-23), the NRC judged that its structure — "optimal recovery guidelines for simple events, functional recovery guidelines for everything else" — met the requirement for symptom-based response.

Flow of the CE-type EOP

The EOPs of CE-type plants such as the OPR1000 and APR1400 follow this structure; the flow is as follows.

1. Standard post-trip actions (SPTA): right after the trip, the nine safety functions are checked and initial recovery actions taken. If all are satisfied, go to the reactor trip procedure; if even one is not, go to diagnosis.
2. Diagnostic action (DA): the event is identified with a diagnostic flow chart. If a single event is identified and an ORP applies, go to that emergency procedure. If there are multiple events or diagnosis is impossible, go to the recovery procedures. Cautions note not to ignore early indications and not to diagnose an SGTR from radiation alarms alone.
3. Seven optimal recovery procedures (ORPs): reactor trip, LOCA, SGTR, excess steam demand event (ESDE), total loss of feedwater, loss of offsite power and forced circulation, and station blackout (SBO). While an ORP is carried out, the safety function status check (SFSC) is repeated. If it is not satisfied, re-diagnose and, if needed, move to the recovery procedures.
4. Functional recovery procedures (FRPs): each safety function has a resource assessment tree, listing the means of achieving the function as success paths. For reactivity control the success paths are CEA insertion → CVCS boration → SIS; for heat removal, SG cooling → once-through cooling (feed and bleed). The SFSC status is satisfied, challenged or jeopardized, and recovery is carried out in the order jeopardized → challenged → satisfied.
5. Then move to long-term actions after stabilization, or transfer to the SAMG if its entry conditions are met.

Westinghouse ERGs

Diagnosis in E-0 (reactor trip or safety injection) leads to E-1 (loss of reactor or secondary coolant), E-2 (faulted SG isolation), E-3 (SGTR), ECA-0.0 (loss of all AC power) and so on. Separately, six critical safety function status trees (CSFSTs) are monitored. The priority is subcriticality (S) → core cooling (C) → heat sink (H) → RCS integrity (P) → containment (Z) → inventory (I). A red path is an extreme challenge, so the procedure in progress is stopped and the corresponding FR procedure entered. An orange path is entered when there is no red. For example, a core exit temperature (CET) of 1,200 °F (649 °C) or more is a red core-cooling path, leading to FR-C.1. While ECA-0.0 is being performed, the CSFSTs are only monitored, and transitions to FR procedures follow the instructions of that procedure.

What it means in a plant

List of safety functions — differences by reactor type

The list of safety functions differs by reactor type. The CE-type design (OPR1000, APR1400) uses nine: reactivity control, maintenance of vital auxiliaries (power), RCS inventory control, RCS pressure control, core heat removal, RCS heat removal, containment isolation, containment temperature and pressure control, and containment combustible gas control. Some plants' recovery procedures combine core and RCS heat removal into one procedure (HR), giving eight. How functions are grouped can differ by unit and reactor type. Westinghouse has no power CSF: power is treated as a common support condition for several functions and handled by event procedures such as ECA-0.0.

Computerized procedures

The APR1400 performs EOPs on the computerized procedure system (CPS) at the operator workstations. The CPS provides the step flow, related parameters, links to control displays and monitoring of continuous-action steps, and all operators share the progress. If all workstations are lost, safe shutdown and EOP execution continue from the safety console.

Links with SGTR and MSLB

Event-specific strategies belong to each ORP. For an SGTR, the core is the three- or four-step strategy of identifying and isolating the ruptured SG → cooling with the intact SGs → depressurizing to equalize pressure → terminating SI. For an ESDE, the key points are isolating the faulted SG and managing PTS during overcooling.

Upper-head void during a LOCA

With natural circulation or the RCPs stopped, flow in the reactor vessel upper head stagnates and the head stays hot. If the RCS is then depressurized, the head fluid falls below its saturation pressure and flashes. The symptoms are an abnormal rapid rise in pressurizer level during depressurization or spray, and a falling upper-head level indication (RVLIS). The EOP responds by repressurizing, restarting an RCP when conditions allow, adjusting the cooldown and depressurization rates, and venting through the reactor coolant gas vent system (RCGVS). Venting is stopped when the upper-head level recovers, the pressurizer level limit is reached, the subcooling criterion is reached, or the containment hydrogen concentration limit is reached.

Regulatory and design criteria

The US requirements below, which shaped the symptom-based approach after TMI, and the IAEA guidance are examples of the applicable criteria.

Easily confused pairs

Transfer to the SAMG is not the normal end of an EOP but a conditional branch. Typical SAMG entry criteria combine a CET of 649 °C (1,200 °F) or more with failure of EOP core-cooling recovery; the detailed judgement follows each plant's guideline.

Key points at a glance

1. Definition: operator procedures that restore and maintain safety functions after trip or SI in DBAs and in multiple failures before core damage.
2. Background: TMI-2 misdiagnosis → NUREG-0737 I.C.1, NUREG-0899 (1982).
3. Dual structure: event-based ORPs + symptom-based SPTA, SFSC and FRPs; symptom-based does not mean no diagnosis — diagnosis runs alongside.
4. Flow: trip → SPTA (9 safety functions) → DA → 7 ORPs / FRPs → long-term actions.
5. SFSC: satisfied, challenged, jeopardized; recover jeopardized first; repeated during ORPs.
6. FRP: resource assessment trees and success paths (e.g. CEA → CVCS → SIS).
7. Westinghouse ERG: E-0 → E-1 to E-3, ECA-0.0; 6 CSFSTs S, C, H, P, Z, I; red and orange paths.
8. Boundary: transfer to SAMG when, typically, CET ≥ 649 °C AND core-cooling recovery fails.
9. Computerization: APR1400 CPS; safety console if it is lost.