Accidents, Safety Analysis & Severe Accidents · C-SA-020
Critical Safety Functions (CSF) — Monitored Variables, Status Trees, Priorities and the SPDS for the Six Functions
Keep the functions and the barriers hold, whatever the cause: six status trees read from measured variables, handled by colour and then priority.
Critical safety functions (CSFs) are the set of functions that, if maintained, keep the fuel, RCPB and containment barriers intact regardless of what caused the accident. Operators judge the status of each function from measured variables and restore the threatened functions first.
The Westinghouse (W) Emergency Response Guidelines (ERGs) define six: subcriticality, core cooling, heat sink, primary system integrity, containment and inventory. This note covers the monitored variables, the decision values and the tree logic for each function.
Principle and mechanism
Origin — "protect the functions and you need not know the cause"
Corcoran and co-workers (1981, Nuclear Technology, vol. 55) grouped the operator actions that prevent core melt and reduce releases into "safety functions". They proposed ten functions, covering reactivity; RCS inventory and pressure; core and RCS heat removal; containment isolation, temperature and pressure, and combustible gas; maintenance of vital auxiliaries; and control of indirect releases. After TMI-2, NUREG-0737 I.C.1 and NUREG-0899 (1982) required symptom-based EOPs. The reactor owners' groups built the concept into their procedures: W with six CSFs and status trees (CSFSTs), the CE type with a function-by-function safety function status check (SFSC).
The six CSFs — barriers protected and variables monitored
| CSF (priority) | Barrier protected | Main monitored variables | Red/orange example | Recovery procedure gist |
|---|---|---|---|---|
| ① Subcriticality S | Fuel and cladding | Power-range power, intermediate- and source-range SUR | Power ≥ 5 % red; positive intermediate-range SUR orange | FR-S.1 manual trip, emergency boration |
| ② Core cooling C | Fuel and cladding | CET, subcooling, RVLIS | CET > 1,200 °F red | FR-C.1 maximize SI, depressurize SGs, start RCPs |
| ③ Heat sink H | RCPB (indirectly the core) | SG narrow-range level, total feedwater flow, SG pressure | Red when both level and feed are insufficient | FR-H.1 restore feedwater; if that fails, feed and bleed |
| ④ Primary system integrity P | Reactor vessel | Cold-leg cooldown rate and temperature, RCS pressure (P-T) | Cooldown > 100 °F in 60 min + beyond Limit A red | FR-P.1 stop cooldown, depressurize, hold temperature |
| ⑤ Containment Z | Containment | Containment pressure, sump level, radiation | Above design pressure red | FR-Z.1 confirm sprays, fan coolers, isolation |
| ⑥ Inventory I | RCS inventory (indicator) | Pressurizer level, RVLIS upper range | Yellow only | FR-I.1–3 adjust charging and letdown, vent voids |
The decision values are from a W four-loop plant (the Salem Unit 2 CSFST basis document) and differ from plant to plant. The heat sink tree has no orange path. The inventory tree's unsatisfied paths are yellow only, because inventory is an early indicator for the other functions. The Salem procedure writes orange as PURPLE; procedure numbers here follow the ERG notation (FR-x.y).
Reading a status tree — the core cooling example
The tree is a binary decision path read from the top down with yes/no answers.
- Five or more CETs > 1,200 °F (649 °C): most of the coolant is gone and the steam is superheated. Red; go to FR-C.1. This value already includes the instrument uncertainty (about 200 °F).
- Subcooling > 0: if satisfied, green.
- RCPs running: if the RVLIS dynamic range is below the value for 50 % void fraction (44 % with four pumps), orange FR-C.2; if above, yellow FR-C.3.
- RCPs off: combine CET above 700 °F (371 °C) with RVLIS full range 39 %. The 39 % is a collapsed level of 3.5 ft above the bottom of the core plus uncertainty. If both are bad, red; if one is bad, orange; if both are fine, yellow.
Hot-leg temperature is not used for the decision, because in some core-uncovery scenarios it responds later than the CETs. "Five or more" is that plant's condition for screening out failed thermocouples.
Colours and priority
| Colour | Meaning | Operator action |
|---|---|---|
| Red | Extreme challenge | Stop the procedure in progress and go to the FR immediately |
| Orange | Severe challenge | Enter when there is no red |
| Yellow | Not satisfied | Operator judgement when there is no red or orange |
| Green | Satisfied | Keep monitoring |
The priority S → C → H → P → Z → I is the order of handling when the same colour appears in several trees at once. A red in any tree comes before any orange. After an FR's actions are complete and the operator returns to the original procedure, the same colour may remain (for example, the containment tree); whether to repeat it then follows the return instruction of that FR.
What it means in a plant
When and how often to monitor
- Start: monitoring begins when E-0 (reactor trip or safety injection) directs it, or on transfer from E-0 to another EOP. Right after the trip, E-0's immediate actions come first. If E-0 step 1 fails to confirm reactor trip (ATWS), however, the operator goes straight to FR-S.1. Some plants implement tree monitoring in parallel with the E-0 diagnostic steps (NRC public plant documents), so the start time follows the unit's procedures.
- Method: all six trees are checked and logged together at first, and then monitored continuously. In the Salem example, once all are green or yellow and stable, the interval can be relaxed to 15 minutes on the CRS's instruction.
- End: CSFST monitoring ends when the operator leaves the EOP network. During ECA-0.0 (loss of all AC power), the trees are only monitored and the operator does not transfer to FRs.
CE-type plants — means-based judgement
The OPR1000 and APR1400 designs follow the CE structure. What is judged is the success of each function's success path (the equipment in use). For example, the criteria for the core and RCS heat removal path HR-1 (SG cooling without SIS operation) check SG level or feedwater flow, the RCS ΔT, CET-based subcooling and the upper head level against plant-specific values.
If not satisfied, the operator moves to the next path on the resource tree (cooling with SIS operation → once-through cooling). W emphasizes diagnosing the function status to select the FR procedure; the CE type emphasizes judging which means is keeping the function.
SPDS — the CSFs on one screen
NUREG-0696 (1981) defined the SPDS in the functional criteria for emergency response facilities. NUREG-0737 Supplement 1 (1982) set the minimum information as five functions: reactivity control, core cooling and primary heat removal, RCS integrity, radioactivity control and containment conditions. Because implementation was weak, the NRC followed up with GL 89-06 and NUREG-1342. The SPDS is an auxiliary display; decisions are confirmed on safety-grade indicators (at Salem, the CET display is the only exception). In the APR1400, SPADES+ provides CSF displays and alarms integrated into the main control room design.
Boundary with the SAMG
The depressurization and RCP start of FR-C.1 may not work. If the CET then keeps rising above 1,200 °F, the operator moves to the SAMG. A red core cooling tree is not by itself SAMG entry. The detailed SAMG entry logic follows each unit's guidelines. The diagnostic flow chart and severe challenge status tree of the WOG SAMG carry the CSF tree concept beyond core damage.
Regulatory and design criteria
For example, the US NRC and IAEA references:
| Basis | Key point |
|---|---|
| NUREG-0737 I.C.1 (1980) / NUREG-0899 (August 1982) | Improvement of symptom-based EOPs and writing guidelines |
| NUREG-0737 Supp.1 (GL 82-33, December 1982) | Five functions as the minimum SPDS information |
| NUREG-0696 (February 1981) | Functional criteria for emergency response facilities and the SPDS |
| 10 CFR 50.34(f)(2)(iv), NUREG-0700 Section 5 | SPDS requirement and design guidance |
| IAEA SSR-2/1 Rev.1, Requirement 4 | Three fundamental safety functions |
Easily confused pairs
| W CSF (CSFST) | CE safety functions (SFSC) | SPDS five functions | IAEA fundamental safety functions | |
|---|---|---|---|---|
| Number | 6 | 9 (CE-type SPTA) | 5 | 3 |
| What is judged | Variable status | Success of the success path | Display scope | Design requirement |
| Grades | Red, orange, yellow, green | Satisfied, challenged, jeopardized | — | — |
| Output | Designates an FR procedure | Recovery procedure, next path | Aid to operator judgement | Design demonstration |
Key points at a glance
- Definition: functions that, if maintained, keep the barriers intact regardless of cause; the decision basis of symptom-based EOPs.
- Origin: Corcoran et al. (1981), ten functions → after TMI, NUREG-0737 and NUREG-0899.
- Six (by priority): subcriticality S → core cooling C → heat sink H → integrity P → containment Z → inventory I.
- Monitored variables: SUR and power / CET, subcooling, RVLIS / SG level and feedwater / cooldown rate and P-T / containment pressure, sump level, radiation / pressurizer level.
- Colours: red, FR at once; orange, when no red; yellow, judgement; green, satisfied.
- Core cooling example: CET > 1,200 °F red; combination of 700 °F and RVLIS 39 % (W plant example).
- Monitoring: continuous from E-0's instruction or transfer; interval relaxed when stable; monitor only during ECA-0.0.
- CE-type plants (e.g. OPR1000, APR1400): nine functions; SFSC satisfied, challenged, jeopardized; success-path judgement.
- SPDS: NUREG-0696, Supp.1 five functions, APR1400 SPADES+.
- SAMG: FR-C.1 fails + CET rising → SAMG.
- Links by barrier: S, C and H protect the fuel and cladding; H, P and I protect the RCPB; Z protects containment. Losing the heat sink (H) threatens core cooling (C) and then integrity (P) in turn.
