[en] After generation of scram signals, the operation state of a reactor scram means is monitored on real time. When a higher rank reactor scram means is not operated or operated incompletely, lower rank reactor scram means are automatically caused to operate successively. The operation state of a reactor cooling means is monitored on real time, and when a higher rank reactor cooling means is not operated or operated incompletely, lower rank reactor cooling means are automatically caused to operate subsequently. This can reliably provide reactor scram and reactor cooling upon occurrence of a scram accident. Then, such an event that the scram accident develops to a severer accident due to poor countermeasure at the initial stage of the accident can effectively be avoided. Further, the cooling state of the reactor is evaluated with reference to a knowledge base which stores the relation of a reactor water level and a ratio between a predetermined measuring information and a minimum limit thermal flux, thereby capable of recognizing the reactor cooling state in an extremely short period of time. (N.H.)