EN IEC 60964:2019

Nuclear power plants - Control rooms - Design

IEC 60964:2018 is available as IEC 60964:2018 RLV which contains the International Standard and its Redline version, showing all changes of the technical content compared to the previous edition.IEC 60964:2018 establishes requirements for the human-machine interface in the main control rooms of nuclear power plants. The document also establishes requirements for the selection of functions, design consideration and organization of the human-machine interface and procedures which are used systematically to verify and validate the functional design. These requirements reflect the application of human factors engineering principles as they apply to the human-machine interface during plant operational states and accident conditions (including design basis and design extension conditions), as defined in IAEA SSR-2/1 and IAEA NP-T-3.16. This third edition cancels and replaces the second edition published in 2009. This edition constitutes a technical revision. This edition includes the following significant technical changes with respect to the previous edition: a) to review the usage of the term “task” ensuring consistency between IEC 60964 and IEC 61839; b) to clarify the role, functional capability, robustness and integrity of supporting services for the MCR to promote its continued use at the time of a severe accident or extreme external hazard; c) to review the relevance of the standard to the IAEA safety guides and IEC SC 45A standards that have been published since IEC 60964:2009 was developed; d) to clarify the role and meaning of “task analysis”, e) to further delineate the relationships with derivative standards (i.e. IEC 61227, IEC 61771, IEC 61772, IEC 61839, IEC 62241 and others of relevance to the control room design); f) to consider its alignment with the Human Factors Engineering principles, specifically with the ones of IAEA safety guide on Human Factors (DS-492) to be issued.

Kernkraftwerke - Warten - Auslegung

Centrales nucléaires de puissance - Salles de commande - Conception

IEC 60964:2018 est disponible sous forme de IEC 60964:2018 RLV qui contient la Norme internationale et sa version Redline, illustrant les modifications du contenu technique depuis l'édition précédente.L'IEC 60964:2018 établit des exigences en matière d’interface homme-machine pour la salle de commande principale des centrales nucléaires de puissance. Il établit aussi les exigences en matière de choix fonctionnels, de conception et d’organisation de l’interface homme-machine, ainsi que les procédures utilisées pour vérifier et valider systématiquement la conception fonctionnelle. Ces exigences reflètent les principes d’ergonomie tels qu’ils s’appliquent à une interface homme-machine pour les états opérationnels de la tranche et les conditions accidentelles (y compris les conditions de dimensionnement et les conditions hors dimensionnement), tels que définis par l’AIEA SSR-2/1 et l’AIEA NP-T-3.16. Cette troisième édition annule et remplace la deuxième édition publiée en 2009. Cette édition constitue une révision technique. Cette édition inclut les modifications techniques majeures suivantes par rapport à l'édition précédente: a) l’utilisation du terme «tâche» en garantissant la cohérence entre l’IEC 60964 et l’IEC 61839; b) la clarification du rôle, des capacités fonctionnelles, de robustesse et d’intégrité des services support pour la salle de commande principale pour garantir sa continuité d’utilisation au moment de la survenance d’accident grave ou de risques externes extremes; c) la revue de la pertinence de cette norme par rapport aux guides de sûreté de l’AIEA et aux normes de l’IEC SC 45A qui ont été publiés depuis le développement de l’IEC 60964:2009; d) la clarification du sens et du rôle de «l’analyse des tâches»; e) la définition des relations avec les normes dérivées (par exemple l’IEC 61227, l’IEC 61771, l’IEC 61772, l’IEC 61839, l’IEC 62241 et les autres normes pertinentes pour la conception des salles de commande); f) l’alignement par rapport aux principes d’ergonomie, en particulier ceux du Guide de Sûreté de l’AIEA sur les facteurs humains qui doit être publié prochainement.

Jedrske elektrarne - Nadzorne sobe - Zasnova (IEC 60964:2018)

Na voljo je IEC 60964:2018, ki vsebuje mednarodni standard in njegovo različico z revizijami, ki prikazujejo vse spremembe tehnične vsebine v primerjavi s prejšnjo izdajo. 60964:2018 določa zahteve za vmesnik človek-stroj v nadzornih sobah jedrskih elektrarn. Dokument določa tudi zahteve za izbiro funkcij, zasnove in ureditve vmesnika človek-stroj ter postopke, ki se morajo sistematično uporabljati za preverjanje in validacijo funkcionalne zasnove. Te zahteve odražajo uporabo načel človeškega inženiringa, saj se uporabljajo za vmesnik človek-stroj med obratovalnimi obdobji elektrarne in nezgodnimi razmerami (vključno s predvidenimi in nepredvidenimi pogoji), kot je opredeljeno v dokumentih IAEA SSR-2/1 in IAEA NP-T-3.16. Tretja izdaja razveljavlja in nadomešča drugo izdajo, objavljeno leta 2009. Ta izdaja je tehnično popravljena izdaja. Ta izdaja vključuje naslednje znatne tehnične spremembe glede na prejšnjo izdajo:
a) pregledati uporabo izraza »naloga«, da se zagotovi skladnost med standardoma IEC 60964 in IEC 61839;
b) razjasniti vlogo, funkcionalno sposobnost, robustnost in celovitost podpornih storitev za največjo trajno zmogljivost (MCR) za spodbujanje neprekinjene uporabe v času hujše nesreče ali izredne zunanje nevarnosti;
c) pregledati ustreznost standarda za varnostne priročnike IAEA in standarde IEC SC 45A, ki so bili objavljeni po tem, ko je bil pripravljen IEC 60964:2009;
d) razjasniti vlogo in pomen »analize nalog«;
e) nadalje razmejiti povezave z izpeljanimi standardi (tj. IEC 61227, IEC 61771, IEC 61772, IEC 61839, IEC 62241 in drugimi, ki so pomembni za zasnovo nadzorne sobe);
f) preučiti uskladitev izdaje z načeli človeškega inženiringa, zlasti z načeli varnostnih napotkov Mednarodne agencije za atomsko energijo (IAEA) o človeških dejavnikih (DS-492), ki bodo izdani.

General Information

• Status: Published
• Publication Date: 27-Jun-2019
• Withdrawal Date: 16-Jun-2022
• ICS: 27.120.20 - Nuclear power plants. Safety
• Technical Committee: CLC/TC 45AX - Nuclear power plants
• Drafting Committee: CLC/TC 45AX - Nuclear power plants
• Current Stage: 6060 - Document made available - Publishing
• Start Date: 28-Jun-2019
• Due Date: 18-Feb-2021
• Completion Date: 28-Jun-2019
• Ref Project: SIST EN IEC 60964:2019 - Nuclear power plants - Control rooms - Design (IEC 60964:2018)

Relations

• Replaces: EN 60964:2010 - Nuclear power plants - Control rooms - Design
• Effective Date: 23-Jan-2023
• Corrected By: EN IEC 60964:2019/AC:2019-08 - Nuclear power plants - Control rooms - Design
• Effective Date: 30-Jul-2019

Overview

EN IEC 60964:2019 (IEC 60964:2018 RLV) specifies requirements for the design of main control rooms (MCRs) in nuclear power plants, focusing on the human‑machine interface (HMI) and application of human factors engineering. This third edition replaces the 2009 edition and provides a technical revision that aligns control‑room design with IAEA safety guides and contemporary IEC SC 45A standards. The standard covers functional analysis, assignment of functions between humans and systems, and systematic verification and validation (V&V) of the integrated control room system under normal and accident conditions (including design basis and design extension conditions).

Key topics and technical requirements

• Functional design of the MCR
  • Identification and analysis of functions, information flows and processing requirements.
  • Assignment of tasks to operators, I&C systems and supporting services.
• Human factors engineering (HFE)
  • Job analysis, human capabilities database, ergonomic layout and cognitive considerations.
  • Alignment with IAEA Human Factors guidance and ISO ergonomic principles.
• Control‑room layout and environment
  • Space, configuration, panel layout, mirror‑image arrangements, location aids (nomenclature, coding, labelling).
• Information and control systems
  • Display and control integration, visual display unit (VDU) application, alarm presentation, control functions.
• Communication and supporting services
  • Verbal and non‑verbal communication systems, role and robustness of supporting services to ensure MCR use during severe accidents or extreme hazards.
• Verification & validation
  • Systematic V&V processes for function assignment and integrated system performance; general evaluation criteria for validation and verification.
• Reliability, qualification and maintainability
  • Power supplies, equipment qualification, maintainability, testability and repair considerations.

Significant technical updates include clarified use of “task”, strengthened requirements for supporting services during severe events, clearer definition of “task analysis”, and better alignment with related IEC and IAEA documents.

Applications and who uses it

EN IEC 60964:2019 is used by:

• Nuclear plant designers and control‑room architects
• Instrumentation & Control (I&C) engineers
• Human factors engineers and ergonomists
• System integrators and software/UI designers for MCRs
• Safety assessors, regulators and licensing bodies
• Plant operators and operations trainers involved in validation exercises

Practical uses include designing or refurbishing MCR layouts, specifying HMI controls and displays, preparing V&V test plans, and ensuring control‑room resilience under accident conditions.

Related standards

Relevant standards and guides referenced include IEC 61227, IEC 61771, IEC 61772, IEC 61839, IEC 62241, ISO 11064 series, and IAEA documents such as NP‑T‑3.16 and the Human Factors safety guide (DS‑492). Use EN IEC 60964:2019 together with these documents for comprehensive MCR design and verification.

Standards Content (Sample)

SLOVENSKI STANDARD
01-september-2019
Nadomešča:
SIST EN 60964:2010
Jedrske elektrarne - Nadzorne sobe - Zasnova (IEC 60964:2018)
Nuclear power plants - Control rooms - Design (IEC 60964:2018)
Kernkraftwerke - Warten - Auslegung (IEC 60964:2018)
Centrales nucléaires de puissance - Salles de commande - Conception (IEC
60964:2018)
Ta slovenski standard je istoveten z: EN IEC 60964:2019
ICS:
27.120.20 Jedrske elektrarne. Varnost Nuclear power plants. Safety
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN IEC 60964

NORME EUROPÉENNE
EUROPÄISCHE NORM
June 2019
ICS 27.120.20
English Version
Nuclear power plants - Control rooms - Design
(IEC 60964:2018)
Centrales nucléaires de puissance - Salles de commande - Kernkraftwerke - Warten - Auslegung
Conception (IEC 60964:2018)
(IEC 60964:2018)
This European Standard was approved by CENELEC on 2019-06-17. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.

European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2019 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. EN IEC 60964:2019 E
European foreword
This document (EN IEC 60964:2019) consists of the text of IEC 60964:2018 prepared by IEC/SC
45A: "Instrumentation, control and electrical power systems of nuclear facilities", of IEC/TC 45:
"Nuclear instrumentation".
The following dates are fixed:
• latest date by which this document has to be (dop) 2020-06-17
implemented at national level by publication of an
identical national standard or by endorsement
• latest date by which the national standards (dow) 2022-06-17
conflicting with this document have to be
withdrawn
As stated in the nuclear safety directive 2009/71/EURATOM, Chapter 1, Article 2, item 2, Member
States are not prevented from taking more stringent safety measures in the subject-matter covered by
the Directive, in compliance with Community law. In a similar manner, this European standard does
not prevent Member States from taking more stringent nuclear safety and/or security measures in the
subject-matter covered by this standard.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
Endorsement notice
The text of the International Standard IEC 60964:2018 was approved by CENELEC as a European
Standard without any modification.

Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications
The following documents are referred to in the text in such a way that some or all of their

content constitutes requirements of this document. For dated references, only the edition
cited applies. For undated references, the latest edition of the referenced document
(including any amendments) applies.
NOTE 1 When an International Publication has been modified by common modifications, indicated by (mod), the relevant

EN/HD applies.
NOTE 2 Up-to-date information on the latest versions of the European Standards listed in this annex is available here:
www.cenelec.eu.
Publication Year Title EN/HD Year
IEC 60671 -  Nuclear power plants - Instrumentation EN 60671 -
and control systems important to safety -
Surveillance testing
IEC 60709 -  Nuclear power plants – Instrumentation EN 60709 -
and control systems important to safety –
Separation
IEC/IEEE 60780- - Nuclear power plants – Electrical EN 60780-323 -
323 equipment of the safety system –
Qualification
IEC 60960 -  Functional design criteria for a safety - -
parameter display system for nuclear
power stations
IEC 60965 -  Nuclear power plants – Control rooms – EN 60965 -
Supplementary control room for reactor
shutdown without access to the main
control room
IEC 60980 -  Recommended practices for seismic - -
qualification of electrical equipment of the
safety system for nuclear generating
stations
IEC 61225 -  Nuclear power plants - Instrumentation - -
and control systems important to safety -
Requirements for electrical supplies
IEC 61226 -  Nuclear power plants - Instrumentation EN 61226 -
and control important to safety -
Classification of instrumentation and
control functions
IEC 61227 -  Nuclear power plants - Control rooms - EN 61227 -
Operator controls
IEC 61513 -  Nuclear power plants - Instrumentation EN 61513 -
and control important to safety - General
requirements for systems
IEC 61771 -  Nuclear power plants - Main control-room - - -
Verification and validation of design
IEC 61772 -  Nuclear power plants - Control rooms - EN 61772 -
Application of visual display units (VDUs)
IEC 61839 -  Nuclear power plants - Design of control EN 61839 -
rooms - Functional analysis and
assignment
IEC 62003 -  Nuclear power plants - Instrumentation - -
and control important to safety -
Requirements for electromagnetic
compatibility testing
IEC 62241 -  Nuclear power plants - Main control room - EN 62241 -
Alarm functions and presentation
IEC 62645 -  Nuclear power plants – Instrumentation - -
and control systems – Requirements for
security programmes for computer-based
systems
IEC 62646 -  Nuclear power plants – Control rooms – - -
Computer based procedures
IEC 62859 - Nuclear power plants – Instrumentation - -
and control systems – Requirements for
coordinating safety and cybersecurity
ISO 11064 series Ergonomic design of control centres - EN ISO 11064 series
IAEA NS-G-1.9 -  Design of the reactor coolant system and -
associated systems in nuclear power
plants
IAEA NS-G-1.11 -  Protection against internal hazards other -
than fires and explosions in the design of
nuclear power plants
IAEA NP-T-3.16 -  Accident Monitoring Systems for Nuclear -
Power Plants
IEC 60964 ®
Edition 3.0 2018-11
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
Nuclear power plants – Control rooms – Design

Centrales nucléaires de puissance – Salles de commande – Conception

INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
INTERNATIONALE
ICS 27.120.10; 27.120.20 ISBN 978-2-8322-6086-9

– 2 – IEC 60964:2018 © IEC 2018
CONTENTS
FOREWORD . 4
INTRODUCTION . 6
1 Scope . 9
2 Normative references . 9
3 Terms and definitions . 10
4 Abbreviated terms . 15
5 Standard use . 15
6 Design principles for the main control room . 18
6.1 Main objectives . 18
6.2 Functional design objectives . 18
6.3 Safety principles . 18
6.4 Availability principles . 19
6.5 Human factors engineering principles . 19
6.6 Utility operating principles . 19
6.7 Relationship with other control and management centres . 19
6.8 Operational experience . 20
7 Functional design of the main control room . 20
7.1 General . 20
7.2 Functional analysis . 20
7.2.1 General . 20
7.2.2 Identification of functions . 20
7.2.3 Information flow and processing requirements . 21
7.3 Assignment of functions . 21
7.3.1 General . 21
7.3.2 Operator capabilities . 22
7.3.3 I&C system processing capabilities . 22
7.4 Verification of function assignment . 23
7.4.1 General . 23
7.4.2 Process . 23
7.5 Validation of function assignment . 23
7.5.1 General . 23
7.5.2 Process . 23
7.5.3 General evaluation criteria for validation . 24
7.6 Job analysis . 24
8 Functional design specification . 24
8.1 General . 24
8.2 Provision of data base on human capabilities and characteristics . 25
8.3 Location, environment and protection . 25
8.3.1 Location . 25
8.3.2 Environment . 25
8.3.3 Protection . 26
8.4 Space and configuration . 26
8.4.1 Space . 26
8.4.2 Configuration . 27
8.5 Panel layout . 27

IEC 60964:2018 © IEC 2018 – 3 –
8.5.1 Priority . 27
8.5.2 Positioning on control desks and panels . 28
8.5.3 Mirror image layout . 28
8.6 Location aids . 28
8.6.1 Grouping of display information and controls . 28
8.6.2 Nomenclature . 29
8.6.3 Coding . 29
8.6.4 Labelling . 30
8.7 Information and control systems . 30
8.7.1 General . 30
8.7.2 Information functions . 30
8.7.3 Control functions . 34
8.8 Control-display integration . 35
8.9 Communication systems . 35
8.9.1 General . 35
8.9.2 Verbal communication systems . 35
8.9.3 Non-verbal communication systems . 37
8.10 Other requirements . 37
8.10.1 Power supplies . 37
8.10.2 Qualification . 37
8.10.3 Maintainability . 37
8.10.4 Repairs . 37
8.10.5 Testability . 37
9 Verification and validation of the integrated control room system . 38
9.1 General . 38
9.2 Control room system verification . 38
9.2.1 General . 38
9.2.2 Process . 38
9.2.3 General evaluation criteria for integrated system verification . 38
9.3 Control room system validation . 38
9.3.1 General . 38
9.3.2 Process . 38
9.3.3 General evaluation criteria for integrated system validation . 39
Annex A (informative) Explanation of concepts . 40
A.1 Control room system . 40
A.2 “Human” and “machine” . 40
Bibliography . 42

Figure 1 – Overview of control room system . 16
Figure 2 – Overall design process and the relationship to clauses and subclauses of
this document . 17

Table A.1 – Human and machine in functional domain and physical domain . 41

– 4 – IEC 60964:2018 © IEC 2018
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
NUCLEAR POWER PLANTS – CONTROL ROOMS – DESIGN

FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of
patent rights. IEC shall not be held responsible for identifying any or all such patent rights.
International Standard IEC 60964 has been prepared by subcommittee 45A: Instrumentation,
control and electrical power systems of nuclear facilities, of IEC technical committee 45:
Nuclear instrumentation.
This third edition cancels and replaces the second edition published in 2009. This edition
constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous
edition:
a) to review the usage of the term “task” ensuring consistency between IEC 60964 and
IEC 61839;
b) to clarify the role, functional capability, robustness and integrity of supporting services for
the MCR to promote its continued use at the time of a severe accident or extreme external
hazard;
c) to review the relevance of the standard to the IAEA safety guides and IEC SC 45A
standards that have been published since IEC 60964:2009 was developed;
d) to clarify the role and meaning of “task analysis”,

IEC 60964:2018 © IEC 2018 – 5 –
e) to further delineate the relationships with derivative standards (i.e. IEC 61227, IEC 61771,
IEC 61772, IEC 61839, IEC 62241 and others of relevance to the control room design);
f) to consider its alignment with the Human Factors Engineering principles, specifically with
the ones of IAEA safety guide on Human Factors (DS-492) to be issued.
The text of this International Standard is based on the following documents:
FDIS Report on voting
45A/1214/FDIS 45A/1224/RVD
Full information on the voting for the approval of this International Standard can be found in
the report on voting indicated in the above table.
This document has been drafted in accordance with the ISO/IEC Directives, Part 2.
The committee has decided that the contents of this document will remain unchanged until the
stability date indicated on the IEC website under "http://webstore.iec.ch" in the data related to
the specific document. At this date, the document will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
– 6 – IEC 60964:2018 © IEC 2018
INTRODUCTION
a) Technical background, main issues and organization of the standard
IEC 60964:1989 was developed to supply requirements relevant to the design of the main
control room of NPPs and reviewed in 2009. The first two editions of IEC 60964 were used
extensively within the nuclear industry. It was however recognized that there was a need to
develop an amendment for the 2009 edition to address:
• The usage of the term "task" needed to be examined.
• The role, functional capability, integrity of supporting services and robustness for the MCR
should be clarified to promote its continued use at the time of a severe accident or
extreme external hazard.
• The relevance of the standard to the IAEA safety guides and SC 45A standards published
since 2009.
Given the size of the proposal amendment, it was decided that a new edition of IEC 60964
should be issued instead of an amendment. During the preparation of this third edition, it was
agreed that the following points have to be covered:
• to clarify the role and meaning of “task analysis”,
• to further delineate the relationships with derivative standards (i.e. IEC 61227, IEC 61771,
IEC 61772, IEC 61839, IEC 62241 and others of relevance to the control room design);
• to consider its alignment with the Human Factors Engineering principles, specifically with
the ones of IAEA safety guide on Human Factors (DS-492) to be issued.
This IEC standard specifically focuses on the functional designing of the main control room of
NPPs. It is intended that the Standard be used by NPP vendors, utilities, and by licensors.
b) Situation of the current standard in the structure of the IEC SC 45A standard series
IEC 60964 is the second level IEC SC 45A document tackling the generic issue of control
room design.
IEC 60964 is to be read in association with the derivative standards mentioned above which
are the appropriate IEC SC 45A documents which provide guidance on operator controls,
verification and validations of design, application of visual display units, functional analysis
and assignment, and alarm functions and presentation.
For more details on the structure of the IEC SC 45A standard series, see item d) of this
introduction.
c) Recommendations and limitations regarding the application of the Standard
This standard is intended for application to new control rooms whose conceptual design is
initiated after the publication of this standard. The recommendations of the standard may be
used for refits, upgrades and modifications.
The primary purpose of this standard is to provide functional design requirements to be used
in the design of the main control room of a nuclear power plant to meet operational and safety
requirements.
This standard also provides functional interface requirements which relate to control room
staffing, operating procedures and the training programme which are, together with the
human-machine interface, constituents of the control room system.

IEC 60964:2018 © IEC 2018 – 7 –
To ensure that the Standard will continue to be relevant in future years, the emphasis has
been placed on issues of principle, rather than specific technologies.
d) Description of the structure of the IEC SC 45A standard series and relationships
with other IEC documents and other bodies documents (IAEA, ISO)
The top-level documents of the IEC SC 45A standard series are IEC 61513 and IEC 63046.
IEC 61513 provides general requirements for I&C systems and equipment that are used to
perform functions important to safety in NPPs. IEC 63046 provides general requirements for
electrical power systems of NPPs; it covers power supply systems including the supply
systems of the I&C systems. IEC 61513 and IEC 63046 are to be considered in conjunction
and at the same level. IEC 61513 and IEC 63046 structure the IEC SC 45A standard series
and shape a complete framework establishing general requirements for instrumentation,
control and electrical systems for nuclear power plants.
IEC 61513 and IEC 63046 refer directly to other IEC SC 45A standards for general topics
related to categorization of functions and classification of systems, qualification, separation,
defence against common cause failure, control room design, electromagnetic compatibility,
cybersecurity, software and hardware aspects for programmable digital systems, coordination
of safety and security requirements and management of ageing. The standards referenced
directly at this second level should be considered together with IEC 61513 and IEC 63046 as
a consistent document set.
At a third level, IEC SC 45A standards not directly referenced by IEC 61513 or by IEC 63046
are standards related to specific equipment, technical methods, or specific activities. Usually
these documents, which make reference to second-level documents for general topics, can be
used on their own.
A fourth level extending the IEC SC 45A standard series, corresponds to the Technical
Reports which are not normative.
The IEC SC 45A standards series consistently implements and details the safety and security
principles and basic aspects provided in the relevant IAEA safety standards and in the
relevant documents of the IAEA nuclear security series (NSS). In particular this includes the
IAEA requirements SSR-2/1, establishing safety requirements related to the design of nuclear
power plants (NPPs), the IAEA safety guide SSG-30 dealing with the safety classification of
structures, systems and components in NPPs, the IAEA safety guide SSG-39 dealing with the
design of instrumentation and control systems for NPPs, the IAEA safety guide SSG-34
dealing with the design of electrical power systems for NPPs and the implementing guide
NSS17 for computer security at nuclear facilities. The safety and security terminology and
definitions used by SC 45A standards are consistent with those used by the IAEA.
IEC 61513 and IEC 63046 have adopted a presentation format similar to the basic safety
publication IEC 61508 with an overall life-cycle framework and a system life-cycle framework.
Regarding nuclear safety, IEC 61513 and IEC 63046 provide the interpretation of the general
requirements of IEC 61508-1, IEC 61508-2 and IEC 61508-4, for the nuclear application
sector. In this framework IEC 60880, IEC 62138 and IEC 62566 correspond to IEC 61508-3
for the nuclear application sector. IEC 61513 and IEC 63046 refer to ISO as well as to
IAEA GS-R part 2 and IAEA GS-G-3.1 and IAEA GS-G-3.5 for topics related to quality
assurance (QA). At level 2, regarding nuclear security, IEC 62645 is the entry document for
the IEC SC 45A security standards. It builds upon the valid high level principles and main
concepts of the generic security standards, in particular ISO/IEC 27001 and ISO/IEC 27002; it
adapts them and completes them to fit the nuclear context and coordinates with the
IEC 62443 series. At level 2, IEC 60964 is the entry document for the IEC SC 45A control
rooms standards and IEC 62342 is the entry document for the ageing management standards.
NOTE 1 It is assumed that for the design of I&C systems in NPPs that implement conventional safety functions
(e.g. to address worker safety, asset protection, chemical hazards, process energy hazards) international or
national standards would be applied.

– 8 – IEC 60964:2018 © IEC 2018
NOTE 2 IEC SC 45A domain was extended in 2013 to cover electrical systems. In 2014 and 2015 discussions
were held in IEC SC 45A to decide how and where general requirements for the design of electrical systems were
to be considered. IEC SC 45A experts recommended that an independent standard be developed at the same level
as IEC 61513 to establish general requirements for electrical systems. Project IEC 63046 is now launched to cover
this objective. When IEC 63046 is published this NOTE 2 of the introduction of IEC SC 45A standards will be
suppressed.
IEC 60964:2018 © IEC 2018 – 9 –
NUCLEAR POWER PLANTS – CONTROL ROOMS – DESIGN

1 Scope
This document establishes requirements for the human-machine interface in the main control
rooms of nuclear power plants. The document also establishes requirements for the selection
of functions, design consideration and organization of the human-machine interface and
procedures which are used systematically to verify and validate the functional design. These
requirements reflect the application of human factors engineering principles as they apply to
the human-machine interface during plant operational states and accident conditions
(including design basis and design extension conditions), as defined in IAEA SSR-2/1 and
IAEA NP-T-3.16. This document does not cover special purpose or normally unattended
control points, such as those provided for shutdown operations from outside the main control
room or for radioactive waste handling, or emergency response facilities. Detailed equipment
design is outside the scope of this document.
The primary purpose of this document is to provide functional design requirements to be used
in the design of the main control room of a nuclear power plant to meet operational and safety
requirements. This document also provides functional interface requirements which relate to
control room staffing, operating procedures, and the training programmes which, together with
the human-machine interface, constitute the control room system.
This document is intended for application to new control rooms whose conceptual design is
initiated after the publication of this document. If it is desired to apply it to an existing control
room, special caution must be exercised so that the design basis is kept consistent.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their
content constitutes requirements of this document. For dated references, only the edition
cited applies. For undated references, the latest edition of the referenced document (including
any amendments) applies.
IEC 60671, Nuclear power plants – Instrumentation and control systems important to safety –
Surveillance testing
IEC 60709, Nuclear power plants – Instrumentation and control systems important to safety –
Separation
IEC/IEEE 60780-323, Nuclear power plants – Electrical equipment of the safety system –
Qualification
IEC 60960, Functional design criteria for a safety parameter display system for nuclear power
stations
IEC 60965, Nuclear power plants – Control rooms – Supplementary control room for reactor
shutdown without access to the main control room
IEC 60980, Recommended practices for seismic qualification of electrical equipment of the
safety system for nuclear generating stations
IEC 61225, Nuclear power plants – Instrumentation and control systems important for safety –
Requirements for electrical supplies

– 10 – IEC 60964:2018 © IEC 2018
IEC 61226, Nuclear power plants – Instrumentation and control important to safety –
Classification of instrumentation and control functions
IEC 61227, Nuclear power plants – Control rooms – Operator controls
IEC 61513, Nuclear power plants – Instrumentation and control important to safety – General
requirements for systems
IEC 61771, Nuclear power plants – Main control room – Verification and validation of design
IEC 61772, Nuclear power plants – Main control room – Application of visual display units
(VDUs)
IEC 61839, Nuclear power plants – Design of control rooms – Functional analysis and
assignment
IEC 62003, Nuclear power plants – Instrumentation and control important to safety –
Requirements for electromagnetic compatibility testing
IEC 62241, Nuclear power plants – Main control room – Alarm functions and presentation
IEC 62645, Nuclear power plants – Instrumentation and control systems – Requirements for
security programmes for computer-based systems
IEC 62646, Nuclear power plants – Control rooms – Computer based procedures
IEC 62859, Nuclear power plants – Instrumentation and control systems – Requirements for
coordinating safety and cybersecurity
ISO 11064 (all parts), Ergonomic design of control centres
IAEA NS-G-1.9, Design of the reactor coolant system and associated systems in nuclear
power plants
IAEA, NS-G-1.11, Protection against internal hazards other than fires and explosions in the
design of nuclear power plants
IAEA NP-T-3.16, Accident Monitoring Systems for Nuclear Power Plants
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply. For other terms,
refer to the general terminology defined in IEC 61513 and in the IAEA Safety Glossary.
ISO and IEC maintain terminological databases for use in standardization at the following
addresses:
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
3.1
accident conditions
deviations from normal operation that are less frequent and more severe than anticipated
operational occurrences
Note 1 to entry: Accident conditions comprise design basis accidents and design extension conditions.

IEC 60964:2018 © IEC 2018 – 11 –
[SOURCE: IAEA Safety Glossary, 2016]
3.2
alarm
item of diagnostic, prognostic, or guidance information, which is used to alert the operator and
to draw his or her attention to a process or system deviation
Note 1 to entry: Specific information provided by alarms includes the existence of an anomaly for which corrective
action might be needed, the cause and potential consequences of the anomaly, the overall plant status, corrective
action to the anomaly, and feedback of corrective actions.
Two types of deviation may be recognised:
– Unplanned – Undesirable process deviations and equipment faults;
– Planned – Deviations in process conditions or equipment status that are the expected response to but could be
indicative of undesirable plant conditions.
[SOURCE: IEC 62241:2004, 3.1]
3.3
auxiliary control systems
operating systems that are installed outside the control room such as local-to-plant control
points and local-to-plant shutdown systems
3.4
control room staff
group of plant personnel stationed in the control room, which is responsible for achieving the
plant operational goals by controlling plant through human machine interfaces
Note 1 to entry: Typically, the control room staff consists of supervisory operators, and operators who actually
monitor plant and plant conditions and manipulate controls but also may include those staff members and experts
who are authorized to be present in the control room, e.g. during long lasting event sequences.
3.5
control room system
integration of the human-machine interface, the control room staff, operating procedures,
training programme, and associated facilities or equipment which together sustain the proper
functioning of the control room
3.6
controls
devices which the operator uses to send demand signals to control systems and plant items
Note 1 to entry: Controls as defined in this document (i.e. devices used for control actions) hold a different
meaning from the one defined in the IAEA safety Glossary and are not replaceable.
3.7
design basis accident
postulated accident leading to accident conditions for which a facility is designed in
accordance with established design criteria and conservative methodology, and for which
releases of radioactive material are kept within acceptable limits
[SOURCE: IAEA Safety Glossary, 2016]
3.8
design extension conditions
postulated accident conditions that are not considered for design basis accidents, but that are
considered in the design process of the facility in accordance with best estimate methodology,
and for which releases of radioactive material are kept within acceptable limits. Design
extension conditions include conditions in events without significant fuel degradation and
conditions with core melting
– 12 – IEC 60964:2018 © IEC 2018
[SOURCE: IAEA Safety Glossary, 2016]
3.9
displays
devices used for monitoring plant conditions and status, e.g. process status, equipment status
3.10
format
display format
pictorial display of information on a visual display unit (VDU) such as message text, digital
presentation, symbols, mimics, bar-charts, trend graphs, pointers, multi-angular presentation
3.11
function
specific purpose or objective to be accomplished, that can be specified or described without
reference to the physical means of achieving it
[SOURCE: IEC 61226:2009, 3.7]
3.12
functional analysis
examination of the functional goals of a system with respect to available manpower,
technology, and other resources, to provide the basis for determining how the function may be
assigned and executed
3.13
functional goal
performance objectives that shall be satisfied to achieve the corresponding function
3.14
hierarchical goal structure
relationship between a functional goal and sub-functional goals structured in a hierarchical
order
3.15
high-level mental processing
human act to process and/or interpret information to obtain reduced abstract information
3.16
human-machine interface
interface between operating staff and I&C system and computer systems linked with the plant.
The interface includes displays, controls, and the Operator Support System interface
3.17
I&C system
system, based on E/E/PE items, performing plant I&C functions as well as service and
monitoring functions related to the operation of the system itself
Note 1 to entry: The term is used as a general term which encompasses all elements of the system such as
internal power supplies, sensors and other input devices, data highways and other communication paths, interfaces
to actuators and other output devices. The different functions within a system may use dedicated or shared
resources.
Note 2 to entry: The elements included in a specific I&C system are defined in the specification of the boundaries
of the system.
Note 3 to entry: According to their typical functionality, IAEA distinguishes between automation and control
systems, HMI systems, interlock systems and protection systems.
[SOURCE: IEC 62138:2018, 3.26]

IEC 60964:2018 © IEC 2018 – 13 –
3.18
job
set of tasks which are operationally related. The tasks within a job should be coherent with
regard to required skill, knowledge and responsibility
3.19
job analysis
analysis identifying basic requirements which a job imposes on the control room staff
structure, the operating procedures and training programme
3.20
local control points
local control facilities
points (or facilities) located outside the control room where local operators perform control
activities
3.21
local operators
operating staff that perform tasks outside the control room
3.22
operating procedures
set of documents specifying operational tasks it is necessary to perform to achieve functional
goals
3.23
operating staff
plant personnel working on shift to operate the plant
Note 1 to entry: The operating staff includes the control room staff, maintenance engineers, etc.
3.24
operator interaction
interrelation between operator and the I&C system. Specifically, display of plant status by the
I&C system and corresponding operator action
3.25
Operator Support System
OSS
system or systems supporting the high-level mental
...