Engineered Safety Features Actuation Signals (ESFAS) — Which Variable Wakes Which Safety System

Principle and mechanism

The signal chain and its logic

Each variable is measured in four channels, and bistables compare the measurements with the setpoints. When two of the four channels for the same function trip (2/4), an initiation signal is produced. It then passes through the Train A and B actuation logic to operate pumps, valves and breakers.

• Selective 2/4: the OPR1000 forms the 2/4 logic from six logic combinations (AB, AC, AD, BC, BD, CD) and initiation relays. In the APR1400 the ESF-CCS group controllers apply selective 2/4 again to the signals from the four PPS divisions.
• Completion of protective action (lockout, latch): once initiated, the actuated state is held until manually reset, even if the variable recovers. The exception is AFAS. The OPR1000 AFAS has no lockout, so the auxiliary feedwater valves open and close automatically according to SG level; the pumps keep running after starting until the operator stops them. The APR1400 likewise excludes only the cycling part of AFAS from the latch.
• Manual initiation: every signal can be initiated with system-level switches on the safety console in the main control room. The APR1400 also has MSIS switches in the remote shutdown room.
• Operating bypass: to prevent unnecessary SIAS and CIAS during normal cooldown and depressurization, only the pressurizer low-pressure input is bypassed. The bypass can be applied only at low pressurizer pressure and is removed automatically when pressure rises again; in the APR1400 (DCD Section 7.3) it can be set at or below 400 psia and is removed automatically at 500 psia or above, and between the two a bypass already in place is kept. The containment high-pressure input is never bypassed.
• Channel bypass: removing one channel for maintenance or testing turns 2/4 into 2/3. Bypassing two or more channels of the same variable is prevented administratively, and overlapping whole-channel bypasses are prevented by interlock.
• Pressurizer low pressure and SG low pressure have variable setpoints. During cooldown the operator can lower the setpoint to follow the pressure, and it rises automatically when pressure increases.

The six NSSS-ESFAS signals of the OPR1000

The OPR1000 counts AFAS-1 and -2 as one function group, giving six signals (SIAS, CIAS, CSAS, MSIS, AFAS, RAS). The input variables of each signal are combined with OR: when two of the four channels of any one variable trip, the signal is generated by that variable. The setpoint values are unit-specific and are given in each unit's technical specifications; the APR1400 nominal values are listed below.

The SIAS and CIAS inputs are shared with reactor trip signals, so in a LOCA reactor trip, safety injection and isolation occur almost simultaneously. If the pressure difference between the SGs is large, AFAS treats the lower-pressure SG as ruptured and does not feed it. Feeding a ruptured SG would continue to overcool the primary side and keep mass and energy flowing out through the break.

BOP-ESFAS signals are actuated by radiation monitor inputs: main control room emergency ventilation and filtration (CREVAS), fuel building emergency exhaust (FBEVAS), and containment purge isolation (CPIAS).

What it means in a plant

APR1400 — the PPS initiates, the ESF-CCS actuates

In Section 7.3 of the APR1400 DCD (Rev. 0) the NSSS-ESFAS signals are the six SIAS, CSAS, CIAS, MSIS, AFAS-1 and AFAS-2. The names are almost the same as in the OPR1000, but the setpoints, actuated equipment and implementation differ, and there is no RAS: the water source, the IRWST, is inside containment, so there is no need to switch suction. The BOP-ESFAS signals are FHEVAS, CPIAS and CREVAS.

• Nominal setpoints: SIAS and CIAS pressurizer low pressure 1,810 psia and containment high pressure 1.9 psig; CSAS 20.03 psig; MSIS SG low pressure 855 psia and SG high level 90 % NR; AFAS SG low level 25 % WR.
• SIAS starts the spray pumps in advance, and CSAS opens the spray headers.
• All NSSS-ESFAS signals are initiated even if two PPS divisions lose power (fail-safe).
• Response-time requirements are 40 s or less for safety injection and 6.35 s or less for MSIV closure.

From the PPS local coincidence logic (LCL, 2/4), the signals go over safety-class data links to the ESF-CCS, a four-division digital system separate from the PPS. Group controllers (GC) handle selective 2/4 and latching, loop controllers (LC) handle component-level control logic, and the component interface modules (CIM) handle the priority between manual and automatic commands.

Loss of offsite power and load sequencing

Most ESF loads are large motors, so if the accident coincides with a loss of offsite power (LOOP) they must be loaded onto the emergency diesel generators (EDGs) in steps. The APR1400 puts this load sequencer in each ESF-CCS division. When two of four undervoltage relays on a Class 1E bus actuate, the EDG starts and large loads are shed. After the EDG breaker closes, an eight-step counter connects the load groups one by one. SIAS, AFAS and CSAS also start the EDGs. If offsite power is available, the EDGs stand by unloaded and the loads start in sequence on offsite power. The design ensures that the accident loads enter at the next step whether the accident comes before, with or after the LOOP.

Protection against digital common-cause failure

If the PPS and ESF-CCS fail together through a software common-cause failure, automatic ESF actuation is lost. The diverse protection system therefore backs up AFAS and, in later units, SIAS.

Signals and design basis accidents

The table shows the representative signals for each accident. Whether, and in what order, they actually occur depends on whether each variable reaches its setpoint.

Regulatory and design criteria

The criteria below are examples from the United States (US NRC) and IEEE standards.

In digital designs such as the APR1400, the ESFAS has moved from an analog relay matrix to a digital PPS and ESF-CCS; RAS has disappeared and DPS-SIAS has been added.

Easily confused pairs

Westinghouse plants use different names. The safety injection (SI) signal also produces reactor trip, Phase A isolation, feedwater isolation, auxiliary feedwater and EDG start. Containment high-3 pressure produces containment spray and Phase B isolation (isolation of essential lines such as RCP component cooling water). Steam line isolation is actuated by containment high-2 pressure or steam line low pressure. Many units switch to recirculation semi-automatically on RWST low-low level. Below the pressurizer pressure permissive (P-11), low-pressure SI can be blocked.

Key points at a glance

1. Definition: a safety-class system that automatically actuates the ESF when process variables reach their setpoints, keeping DBA consequences within acceptance limits.
2. Structure: 4-channel measurement → bistables → selective 2/4 → Train A/B actuation logic → equipment.
3. SIAS: pressurizer low pressure, containment high pressure → safety injection pumps, EDGs.
4. CIAS: same inputs → isolation of containment penetration piping.
5. CSAS: containment high-high pressure → spray.
6. MSIS: SG low pressure, SG high level, containment high pressure → main steam and main feedwater isolation.
7. AFAS-1/2: low level in each SG → auxiliary feedwater to the intact SG (no lockout; valves open and close automatically).
8. RAS: RWT low-low level → sump recirculation (none in the APR1400 because of the IRWST).
9. Features: lockout and manual reset, manual initiation, operating bypass at low pressurizer pressure (APR1400: ≤ 400 psia), 2/3 during channel bypass.
10. APR1400: PPS initiates → ESF-CCS (GC selective 2/4, LC, CIM) actuates, including EDG load sequencing.