IEC 62988:2018

Nuclear power plants - Instrumentation and control systems important to safety - Selection and use of wireless devices

IEC 62988:2018 establishes requirements relevant to the selection and use of wireless devices in instrumentation and control (I&C) systems important to safety used in nuclear power plants (NPPs). Those I&C systems may fully consist of wireless devices. This document applies to the I&C of new NPPs and to backfit of I&C in existing NPPs. Every wireless device or wireless system that is important to safety is in the scope of this document. Both fixed and mobile devices and all data types (voice, process data, etc.) are included within the scope if they provide a safety classified function. This document restricts the use of wireless devices to systems supporting category C functions according to IEC 61226, excluding explicitly their use for categories A and B. Non-safety devices and systems may use this document as guidelines, for example to ensure that important to safety devices are not disturbed.

Centrales nucléaires de puissance - Systèmes d'instrumentation et de contrôle-commande importants pour la sûreté - Sélection et utilisation des appareils sans fil

L'IEC 62988:2018 établit les exigences applicables pour la sélection et l’utilisation des appareils sans fil intégrés dans les systèmes d’instrumentation et de contrôle-commande (I&C) importants pour la sûreté employés dans les centrales nucléaires de puissance (CNP). Ces systèmes d’I&C peuvent être intégralement constitués d’appareils sans fil. Le présent document est applicable pour la construction des nouvelles CNP et pour la rénovation de l’I&C sur les CNP existantes. Tous les appareils sans fil ou les systèmes sans fil importants pour la sûreté relèvent du domaine du présent document. Les appareils fixes comme les appareils mobiles et tous les types de données (voix, données du procédé, etc.) sont couverts par le domaine du présent document s’ils réalisent une fonction classée de sûreté. Le présent document restreint l’utilisation des appareils sans fil aux systèmes réalisant des fonctions de sûreté de catégorie C telle que définie par l’IEC 61226, et exclut explicitement leur utilisation pour les catégories A et B. On peut utiliser le présent document comme un guide pour les appareils et les systèmes non classés de sûreté, par exemple pour s’assurer que les appareils importants pour la sûreté ne sont pas perturbés.

General Information

• Status: Published
• Publication Date: 06-May-2018
• ICS: 27.120.20 - Nuclear power plants. Safety
• Technical Committee: SC 45A - Instrumentation, control and electrical power systems of nuclear facilities
• Drafting Committee: WG 9 - TC 45/SC 45A/WG 9
• Current Stage: PPUB - Publication issued
• Start Date: 07-May-2018
• Completion Date: 18-May-2018

Standards Content (Sample)

IEC 62988 ®
Edition 1.0 2018-05
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
Nuclear power plants – Instrumentation and control systems important to
safety – Selection and use of wireless devices

Centrales nucléaires de puissance – Systèmes d’instrumentation et de contrôle-
commande importants pour la sûreté – Sélection et utilisation des appareils
sans fil
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite
ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie
et les microfilms, sans l'accord écrit de l'IEC ou du Comité national de l'IEC du pays du demandeur. Si vous avez des
questions sur le copyright de l'IEC ou si vous désirez obtenir des droits supplémentaires sur cette publication, utilisez
les coordonnées ci-après ou contactez le Comité national de l'IEC de votre pays de résidence.

IEC Central Office Tel.: [phone]
3, rue de Varembé [e-mail]
CH-1211 Geneva 20 www.iec.ch
Switzerland
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

IEC Catalogue - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
The stand-alone application for consulting the entire The world's leading online dictionary of electronic and
bibliographical information on IEC International Standards, electrical terms containing 21 000 terms and definitions in
Technical Specifications, Technical Reports and other English and French, with equivalent terms in 16 additional
documents. Available for PC, Mac OS, Android Tablets and languages. Also known as the International Electrotechnical
iPad. Vocabulary (IEV) online.

IEC publications search - webstore.iec.ch/advsearchform IEC Glossary - std.iec.ch/glossary
The advanced search enables to find IEC publications by a 67 000 electrotechnical terminology entries in English and
variety of criteria (reference number, text, technical French extracted from the Terms and Definitions clause of
committee,…). It also gives information on projects, replaced IEC publications issued since 2002. Some entries have been
and withdrawn publications. collected from earlier publications of IEC TC 37, 77, 86 and

CISPR.
IEC Just Published - webstore.iec.ch/justpublished
Stay up to date on all new IEC publications. Just Published IEC Customer Service Centre - webstore.iec.ch/csc
details all new publications released. Available online and If you wish to give us your feedback on this publication or
also once a month by email. need further assistance, please contact the Customer Service
Centre: [e-mail].
A propos de l'IEC
La Commission Electrotechnique Internationale (IEC) est la première organisation mondiale qui élabore et publie des
Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications IEC
Le contenu technique des publications IEC est constamment revu. Veuillez vous assurer que vous possédez l’édition la
plus récente, un corrigendum ou amendement peut avoir été publié.

Catalogue IEC - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
Application autonome pour consulter tous les renseignements
Le premier dictionnaire en ligne de termes électroniques et
bibliographiques sur les Normes internationales,
électriques. Il contient 21 000 termes et définitions en anglais
Spécifications techniques, Rapports techniques et autres
et en français, ainsi que les termes équivalents dans 16
documents de l'IEC. Disponible pour PC, Mac OS, tablettes
langues additionnelles. Egalement appelé Vocabulaire
Android et iPad.
Electrotechnique International (IEV) en ligne.

Recherche de publications IEC -
Glossaire IEC - std.iec.ch/glossary
webstore.iec.ch/advsearchform
67 000 entrées terminologiques électrotechniques, en anglais
La recherche avancée permet de trouver des publications IEC et en français, extraites des articles Termes et Définitions des
en utilisant différents critères (numéro de référence, texte, publications IEC parues depuis 2002. Plus certaines entrées
comité d’études,…). Elle donne aussi des informations sur les antérieures extraites des publications des CE 37, 77, 86 et
projets et les publications remplacées ou retirées. CISPR de l'IEC.

IEC Just Published - webstore.iec.ch/justpublished Service Clients - webstore.iec.ch/csc
Restez informé sur les nouvelles publications IEC. Just Si vous désirez nous donner des commentaires sur cette
Published détaille les nouvelles publications parues. publication ou si vous avez des questions contactez-nous:
Disponible en ligne et aussi une fois par mois par email. [e-mail].

IEC 62988 ®
Edition 1.0 2018-05
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
Nuclear power plants – Instrumentation and control systems important to

safety – Selection and use of wireless devices

Centrales nucléaires de puissance – Systèmes d’instrumentation et de contrôle-

commande importants pour la sûreté – Sélection et utilisation des appareils

sans fil
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
INTERNATIONALE
ICS 27.120.20 ISBN 978-2-8322-5655-8

– 2 – IEC 62988:2018 © IEC 2018
CONTENTS
FOREWORD . 3
INTRODUCTION . 5
1 Scope . 7
2 Normative references . 7
3 Terms and definitions . 8
4 Symbols and abbreviations . 11
5 Fundamental requirements . 11
5.1 Safety classification . 11
5.2 Physical separation and isolation . 11
5.3 Cybersecurity . 12
6 Wireless application: system requirements . 12
6.1 General . 12
6.2 Network architecture . 12
6.3 Network performance . 12
6.4 Network surveillance and monitoring . 12
6.5 Power supply requirements . 13
6.6 Physical security . 13
6.7 Electromagnetic security . 13
7 Device selection: evidence of correctness and device integration . 13
7.1 General . 13
7.2 Quality assurance . 13
7.3 Functional and performance suitability . 14
7.4 Integration into the application . 14
7.5 Device self-monitoring . 14
7.6 Solution preferences . 14
8 Radio emissions . 14
8.1 Electromagnetic compatibility . 14
8.2 Radio coverage requirements . 15
8.3 Spectrum management . 15
8.3.1 General . 15
8.3.2 Flexibility . 15
8.3.3 Mobility . 16
9 Cybersecurity . 16
9.1 General requirements . 16
9.2 Wireless-specific requirements . 16
9.2.1 Data logging . 16
9.2.2 Site topology . 16
9.2.3 Connection to a wired network . 16
9.2.4 Network surveillance . 16
10 Qualification . 17
10.1 Hardware qualification . 17
10.2 Software qualification . 17
11 Documentation . 17
Bibliography . 18

INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
NUCLEAR POWER PLANTS – INSTRUMENTATION AND CONTROL
SYSTEMS IMPORTANT TO SAFETY – SELECTION
AND USE OF WIRELESS DEVICES
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of
patent rights. IEC shall not be held responsible for identifying any or all such patent rights.
International Standard IEC 62988 has been prepared by subcommittee 45A: Instrumentation,
control and electrical power systems of nuclear facilities, of IEC technical committee 45:
Nuclear instrumentation.
The text of this International Standard is based on the following documents:
FDIS Report on voting
45A/1187/FDIS 45A/1198/RVD
Full information on the voting for the approval of this International Standard can be found in
the report on voting indicated in the above table.
This document has been drafted in accordance with the ISO/IEC Directives, Part 2.

– 4 – IEC 62988:2018 © IEC 2018
The committee has decided that the contents of this document will remain unchanged until the
stability date indicated on the IEC website under "http://webstore.iec.ch" in the data related to
the specific document. At this date, the document will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
INTRODUCTION
a) Technical background, main issues and organization of this document
This document sets out requirements applicable to wireless devices that are used to perform
functions important to safety in nuclear power plants (NPPs).
It is intended that this document be used by operators of NPPs (utilities), systems evaluators
and by licensors.
b) Situation of this document in the structure of the IEC SC 45A standard series
IEC 62988 is a third level IEC SC 45A document covering the selection and use of wireless
devices in instrumentation and control (I&C) systems important to safety used in NPPs.
For more details on the structure of the IEC SC 45A standard series, see item d) of this
introduction.
c) Recommendations and limitations regarding the application of this document
It is important to note that this document is applicable to all important to safety systems
containing wireless devices, including systems performing category A and B functions (and in
such systems, wireless devices are prohibited by this document). Therefore, only systems
performing category C functions are required to follow the requirements of this document.
To ensure that this document will continue to be relevant in future years, the emphasis has
been placed on issues of principle, rather than specific technologies.
d) Description of the structure of the IEC SC 45A standard series and relationships
with other IEC documents and other bodies' documents (IAEA, ISO)
The top-level documents of the IEC SC 45A standard series are IEC 61513 and IEC 63046.
IEC 61513 provides general requirements for I&C systems and equipment that are used to
perform functions important to safety in NPPs. IEC 63046 provides general requirements for
electrical power systems of NPPs; it covers power supply systems including the supply
systems of the I&C systems. IEC 61513 and IEC 63046 are to be considered in conjunction
and at the same level. IEC 61513 and IEC 63046 structure the IEC SC 45A standard series
and shape a complete, coherent et consistent framework establishing general requirements
for instrumentation, control and electrical systems for nuclear power plants.
IEC 61513 and IEC 63046 refer directly to other IEC SC 45A standards for general topics
related to categorization of functions and classification of systems, qualification, separation,
defence against common cause failure, control room design, electromagnetic compatibility,
cybersecurity, software and hardware aspects for programmable digital systems, coordination
of safety and security requirements and management of ageing. The standards referenced
directly at this second level should be considered together with IEC 61513 and IEC 63046 as
a consistent document set.
At a third level, IEC SC 45A standards not directly referenced by IEC 61513 or by IEC 63046
are standards related to specific equipment, technical methods, or specific activities. Usually
these documents, which make reference to second-level documents for general topics, can be
used on their own.
A fourth level extending the IEC SC 45 standard series, corresponds to the Technical Reports,
which are not normative.
– 6 – IEC 62988:2018 © IEC 2018
The IEC SC 45A standards series consistently implements and details the safety and security
principles and basic aspects provided in the relevant IAEA safety standards and in the
relevant documents of the IAEA nuclear security series (NSS). In particular, this includes the
IAEA requirements SSR-2/1, establishing safety requirements related to the design of nuclear
power plants (NPPs), the IAEA safety guide SSG-30 dealing with the safety classification of
structures, systems and components in NPPs, the IAEA safety guide SSG-39 dealing with the
design of instrumentation and control systems for NPPs, the IAEA safety guide SSG-34
dealing with the design of electrical power systems for NPPs and the implementing guide
NSS17 for computer security at nuclear facilities. The safety and security terminology and
definitions used by IEC SC 45A standards are consistent with those used by the IAEA.
IEC 61513 and IEC 63046 have adopted a presentation format similar to the basic safety
publication IEC 61508 with an overall life-cycle framework and a system life-cycle framework.
Regarding nuclear safety, IEC 61513 and IEC 63046 provide the interpretation of the general
requirements of IEC 61508-1, IEC 61508-2 and IEC 61508-4, for the nuclear application
sector. In this framework, IEC 60880, IEC 62138 and IEC 62566 correspond to IEC 61508-3
for the nuclear application sector. IEC 61513 and IEC 63046 refer to ISO as well as to
IAEA GS-R-3 and IAEA GS-G-3.1 and IAEA GS-G-3.5 for topics related to quality assurance
(QA). At level 2, regarding nuclear security, IEC 62645 is the entry document for the
IEC SC 45A security standards. It builds upon the valid high level principles and main
concepts of the generic security standards, in particular ISO/IEC 27001 and ISO/IEC 27002; it
adapts them and completes them to fit the nuclear context and coordinates with the
IEC 62443 series. At level 2, IEC 60964 is the entry document for the IEC SC 45A control
rooms standards and IEC 62342 is the entry document for the IEC SC 45A ageing
management standards.
NOTE 1 It is assumed that for the design of I&C systems in NPPs that implement conventional safety functions
(e.g. to address worker safety, asset protection, chemical hazards, process energy hazards) international or
national standards would be applied.
NOTE 2 IEC SC 45A domain was extended in 2013 to cover electrical systems. In 2014 and 2015 discussions
were held in IEC SC 45A to decide how and where general requirements for the design of electrical systems were
to be considered. IEC SC 45A experts recommended that an independent standard be developed at the same level
as IEC 61513 to establish general requirements for electrical systems. Project IEC 63046 is now launched to cover
this objective. When IEC 63046 is published this NOTE 2 of the introduction of IEC SC 45A standards will be
suppressed.
NUCLEAR POWER PLANTS – INSTRUMENTATION AND CONTROL
SYSTEMS IMPORTANT TO SAFETY – SELECTION
AND USE OF WIRELESS DEVICES
1 Scope
This document establishes requirements relevant to the selection and use of wireless devices
in instrumentation and control (I&C) systems important to safety used in nuclear power plants
(NPPs). Those I&C systems may fully consist of wireless devices.
NOTE The word “use” refers to the integration of the device, its qualification, administrative control, and every
other activity that may be necessary to use the device in an important to safety application.
This document applies to the I&C of new NPPs and to backfit of I&C in existing NPPs. Every
wireless device or wireless system that is important to safety is in the scope of this document.
Both fixed and mobile devices and all data types (voice, process data, etc.) are included
within the scope if they provide a safety classified function.
This document restricts the use of wireless devices to systems supporting category C
functions according to IEC 61226, excluding explicitly their use for categories A and B.
Non-safety devices and systems may use this document as guidelines, for example to ensure
that important to safety devices are not disturbed.
– Clause 5 describes the fundamental requirements regarding safety and cybersecurity.
– Clause 6 gives wireless-specific requirements that have to be included in the system
design.
– Clause 7 describes the requirements for the selection and integration of wireless devices.
– Clause 8 deals with electromagnetic compatibility and spectrum management.
– Clause 9 gives wireless-specific requirements regarding cybersecurity.
– Clause 10 describes the requirements for the qualification of wireless devices and their
environment.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their
content constitutes requirements of this document. For dated references, only the edition
cited applies. For undated references, the latest edition of the referenced document (including
any amendments) applies.
IEC/IEEE 60780-323, Nuclear facilities – Electrical equipment important to safety –
Qualification
IEC 60987:2007, Nuclear power plants – Instrumentation and control important to safety –
Hardware design requirements for computer-based systems
IEC 61513:2011, Nuclear power plants – Instrumentation and control important to safety –
General requirements for systems
IEC 62138, Nuclear power plants – Instrumentation and control important for safety –
Software aspects for computer-based systems performing category B or C functions

– 8 – IEC 62988:2018 © IEC 2018
IEC 62645, Nuclear power plants – Instrumentation and control systems – Requirements for
security programmes for computer-based systems
IEC 62671, Nuclear power plants – Instrumentation and control important to safety – Selection
and use of industrial digital devices of limited functionality
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following
addresses:
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
3.1
authentication
provision of assurance that a claimed characteristic of an entity is correct
[SOURCE: ISO/IEC 27000:2018, 3.5]
3.2
category of an I&C function
one of three possible safety assignments (A, B, C) of I&C functions resulting from
considerations of the safety relevance of the function to be performed. An unclassified
assignment may be made if the function has no importance to safety.
Note 1 to entry: See also "class of an I&C system".
Note 2 to entry: IEC 61226 defines categories of I&C functions. To each category there corresponds a set of
requirements applicable on both the I&C function (concerning its specification, design, implementation, verification
and validation) and the whole chain of items which are necessary to implement the function (concerning the
properties and the related qualification) regardless of how these items are distributed in a number of
interconnected I&C systems. For more clarity, this document defines categories of I&C functions and classes of
I&C systems and establishes a relationship between the category of the function and the minimal required class for
the associated systems and equipment.
[SOURCE: IEC 61513:2011, 3.4]
3.3
class of an I&C system
one of three possible assignments (1, 2 or 3) of I&C systems important to safety resulting
from consideration of their requirement to implement I&C functions of different safety
importance. An unclassified assignment is made if the I&C system does not implement
functions important to safety.
Note 1 to entry: See also "category of an I&C function", "safety system".
[SOURCE: IEC 61513:2011, 3.6]
3.4
spectrum management
coexistence management
process to establish and to maintain coexistence that includes technical and organizational
measures
[SOURCE: IEC 62657-2:2017, 3.1.15, modified – The preferred term "spectrum
management" has been added.]
3.5
cybersecurity
set of activities and measures whose objective is to prevent, detect, and react to digital
attacks that have the intent to cause:
• disclosures that could be used to perform malicious acts which could lead to an accident,
an unsafe situation or plant performance degradation (confidentiality),
• malicious modifications of functions that may compromise the delivery or integrity of the
required service by I&C computer-based and HDL programmed device (CB&HPD) systems
(including loss of control) which could lead to an accident, an unsafe situation or plant
performance degradation (integrity),
• malicious withholding or prevention of access to or communication of information, data or
resources (incl. loss of view) that could compromise the delivery of the required service by
I&C systems which could lead to an accident, an unsafe situation or plant performance
degradation (availability).
Note 1 to entry: This definition is tailored with respect to the scope of this document, focusing on the prevention
of, detection of and reaction to malicious acts by digital means on I&C CB&HPD systems. It is recognized that the
term “cybersecurity” has a broader meaning in other standards and guidance, often including non-malevolent
threats, human errors and protection against natural disasters, which are all out of the scope of this document
(see Clause 1).
[SOURCE: IEC 62645:2014, 3.6]
3.6
electrical/electronic/programmable electronic item
E/E/PE item
item based on electrical (E) and/or electronic (E) and/or programmable electronic (PE)
technology
[SOURCE: IEC 61508-4:2010, 3.3.2, modified]
Note 1 to entry: In this term and its definitions, the word “item” can be replaced by the words: system or
equipment or device.
3.7
encryption
(reversible) transformation of data by a cryptographic algorithm to produce ciphertext, i.e. to
hide the information content of the data
[SOURCE: ISO/IEC 18033-1:2015, 2.21]
3.8
access point
gateway
network device containing at least one host interface such as serial or Ethernet, acting as
ingress or an egress point enabling communication between host applications and wireless
devices
[SOURCE: IEC 62591:2016, 3.2.47, modified – The preferred term "access point" has been
added.]
3.9
I&C system
system, based on E/E/PE items, performing plant I&C functions as well as service and
monitoring functions related to the operation of the system itself.
Note 1 to entry: The term is used as a general term which encompasses all elements of the system such as
internal power supplies, sensors and other input devices, data highways and other communication paths, interfaces
to actuators and other output devices. The different functions within a system may use dedicated or shared
resources.
– 10 – IEC 62988:2018 © IEC 2018
Note 2 to entry: The elements included in a specific I&C system are defined in the specification of the boundaries
of the system.
Note 3 to entry: See also the definition of E/E/PE item and the associated notes.
Note 4 to entry: According to their typical functionality, IAEA distinguishes between automation/control systems,
HMI systems, interlock systems and protection systems.
3.10
item important to safety
item that is part of a safety group and/or whose malfunction or failure could lead to radiation
exposure of the site personnel or members of the public
Note 1 to entry: Items important to safety include:
a) those structures, systems and components whose malfunction or failure could lead to undue radiation
exposure of the site personnel or members of the public;
b) those structures, systems and components that prevent anticipated operational occurrences from leading to
accident conditions;
c) those features which are provided to mitigate the consequences of malfunction or failure of structures,
systems or components.
[SOURCE: IAEA Safety Glossary, 2016 edition]
3.11
latency
time it takes for a packet to cross a network connection, from sender to receiver
[SOURCE: IEC 62591:2016, 3.2.57]
3.12
mesh network
network topology in which redundant physically-diverse routing paths are available between
each pair of network nodes
Note 1 to entry: Wireless mesh topology is usable to extend coverage via multi-hop capability and/or to facilitate
communication reliability by providing redundant paths between devices.
[SOURCE: IEC 62734:2014, 3.1.2.95, modified – The term "mesh topology" has been
replaced by "mesh network".]
3.13
network
series of devices connected by some type of communication medium
[SOURCE: IEC 62591:2016, 3.2.70, modified – In the definition, "nodes" has been replaced
by "devices". Note 1 to entry has been deleted.]
3.14
quality assurance
function of a management system that provides confidence that specific requirements will be
fulfilled
Note 1 to entry: This definition is compatible with that of ISO 9000:2015, 3.3.6.
[SOURCE: IAEA Safety Glossary, 2016 Edition, modified – The term "quality management"
has been replaced by "quality assurance".]

3.15
redundancy
provision of alternative (identical or diverse) structures, systems and components, so that any
single structure, system or component can perform the required function regardless of the
state of operation or failure of any other
[SOURCE: IAEA Safety Glossary, 2016 Edition]
3.16
safety related system
system important to safety that is not part of a safety system
[SOURCE: IAEA Safety Glossary, 2016 Edition]
3.17
safety system
system important to safety, provided to ensure the safe shutdown of the reactor or the
residual heat removal from the reactor core, or to limit the consequences of anticipated
operational occurrences and design basis accidents
[SOURCE: IAEA Safety Glossary, 2016 Edition]
3.18
wireless device
device that is able to establish a wireless communication with another wireless device, that
may or may not be part of a wireless network
4 Symbols and abbreviations
CPU central processing unit
DMZ demilitarized zone
EMC electromagnetic compatibility
EMI electromagnetic interference
I&C instrumentation and control
NPP nuclear power plant
RFI radio frequency interference
SRS system requirement specification
5 Fundamental requirements
5.1 Safety classification
The wireless devices shall be limited to use in I&C systems performing category C functions
and shall not be used in I&C systems supporting category A and B functions.
The safety class of the wireless communication systems shall be consistent with the I&C
category C functions which they support and implement and should be safety class 3.
5.2 Physical separation and isolation
The wireless communication systems shall be electrically isolated and physically separated
from wired communication channels of I&C systems supporting category A and B functions.

– 12 – IEC 62988:2018 © IEC 2018
The wireless communication systems for category C functions shall be designed such that any
fault is not propagated to wired communication channels in I&C systems performing
category A and B functions.
5.3 Cybersecurity
Wireless communications shall not be used in systems that have been assigned an S1 or S2
security degree according to IEC 62645.
Each network connection with systems with a higher safety class shall be addressed within
the overall security plan in order to take adequate measures regarding cybersecurity.
Additional information for cybersecurity can be found in Clause 9.
6 Wireless application: system requirements
6.1 General
The requirements of IEC 61513 shall be met. In particular, a system requirement specification
(SRS) shall be written to support the system design.
6.2 Network architecture
Taking into account the intended application and functions of the wireless system, the SRS
shall specify and give justification for:
– network topology,
– access point locations,
– network configuration.
Mesh networks should implement load balancing routing algorithms. This means that if
several paths are available from node A to node B, the chosen path should avoid overloaded
intermediate nodes.
The network routing algorithms should be capable of handling packets/messages with
different priorities.
6.3 Network performance
In connection with the intended application, the SRS shall specify and give justification for:
– transmission delay between relevant locations of the network (typical and maximum),
– data transfer speed between relevant locations of the network (typical and minimum).
NOTE 1 IEC 62657-1 provides considerations regarding time behaviour of wireless communication systems, such
as transmission time, update time and availability.
The network load should be context-independent. This means that if a monitored event occurs,
the network load should not increase.
NOTE 2 A true context-independent design is difficult to achieve, thus a context-independent application layer is
sufficient.
6.4 Network surveillance and monitoring
Means shall be provided for surveillance and monitoring of the wireless network. Those
means shall be capable of detecting and correcting anomalies within the wireless network.

Data error rate shall be monitored. The SRS shall define the acceptable packet loss rate and
state whether or not lost messages shall be resent.
NOTE To suppress the error rate of the communication system within the acceptable range specified by the
system design, latency and/or jitter may be also monitored.
It shall be possible to monitor:
– the network status: load, transmission error rate, packet losses, latency;
– the comprehensive list of devices connected to the network;
– the network logs, including failed connections (unauthorized connection attempts, etc.);
– for each device:
• its self-monitored variables (see 7.5),
• its characteristics (software version, etc.),
• its physical location if relevant.
6.5 Power supply requirements
If required by the application, redundant power supplies should be used.
If required by the application, wireless devices should be battery-powered. In that case:
– the SRS shall specify the minimum battery capacity for the intended application,
– remote devices shall be physically accessible in order to be able to replace a defective or
discharged battery. If this is not possible, the battery capacity shall be dimensioned to last
a predefined time that has been shown to be adequate.
A one-hour electrical power loss shall not alter the device configuration. This includes a mains
electricity outage or a battery replacement. The SRS may specify a different duration for
configuration retention.
6.6 Physical security
Wireless devices shall be protected by physical measures so that they are not tampered with
or inadvertently damaged.
6.7 Electromagnetic security
Protection against intentional EMI shall be considered depending on the importance of the
wireless system to the safety of the NPP.
7 Device selection: evidence of correctness and device integration
7.1 General
It is common for pre-existing devices to be used to build a new wireless system. Clause 7
gives requirements for the selection and integration of such devices into the system.
7.2 Quality assurance
The selected device shall come with sufficient evidence that an adequate quality assurance
programme was used to develop the device.
NOTE A wireless device developed in accordance with IEC 61513 or complying with IEC 62671 is a good example
of a device with a good quality assurance programme.

– 14 – IEC 62988:2018 © IEC 2018
7.3 Functional and performance suitability
The performance characteristics, the features and the capability of the candidate device to be
selected shall be evaluated so that it is suitable to meet the system requirements (Clause 6).
NOTE For example, if the SRS specifies that encryption is used, the selected device provides an adequate
encryption feature.
The device selection is deeply connected to the system requirements, thus most requirements
are likely to have an associated device selection criterion. For example, power supply
requirements of Clause 6 have a clear impact on the selection of the device (battery life, etc.).
7.4 Integration into the application
For the integration of pre-existing devices, the following requirements shall be applied:
– IEC 61513:2011, 6.2.3.2 (Selection of pre-existing components), or
– IEC 62671.
NOTE IEC 62671:2013, 5.3.2 provides requirements for building an Evaluation and Application Plan (EAP) in
order to select and evaluate a pre-existing device in a nuclear power plant.
7.5 Device self-monitoring
The wireless device shall be able to monitor and transmit condition information such as:
– the power supply status;
– the battery status (if applicable);
– the wireless signal quality (uplink and downlink);
– data transfer speed;
– processor load;
– operative memory;
– processor temperature.
7.6 Solution preferences
Wireless protocols shall be based on a documented standard or a documented
communication protocol.
8 Radio emissions
8.1 Electromagnetic compatibility
Electromagnetic compatibility (EMC) shall be considered prior to the implementation of
wireless devices near equipment important to safety. This is to ensure the proper operation of
the wireless device and to prevent interference with other equipment.
An impact analysis regarding EMC shall be conducted prior to the on-site installation of the
system.
The impact analysis may include system reviews and evaluations in combination with
laboratory/on-site testing according to IEC 62003, such as:
– review of EMC test reports of nearby NPP equipment;
– determination of exclusion zones based on industry guidance;
– characterization of the electromagnetic environment;
– susceptibility testing of wireless devices to verify they can withstand the NPP environment;

– immunity testing of nearby NPP equipment during maintenance programmes.
NOTE These requirements are intended to protect systems important to safety and key control systems from
electromagnetic waves emitted by the wireless device.
Fixed wireless devices such as access points shall be installed at a pre-defined distance
away from other equipment important to safety if that equipment is sensitive to signals from
wireless devices. This exclusion zone distance shall be calculated based upon free-space
propagation models and shall account for the output power and antenna gain of the wireless
device as well as the demonstrated immunity level of the equipment performing category A
and B functions. The demonstrated immunity level shall be 8 dB higher than the expected field
strength of the wireless device at the exclusion distance boundary. If the equipment important
to safety was not tested for radiated immunity according to IEC 61000-4-3 (or equivalent) at
the transmitting frequency of the wireless device, then additional testing and/or evaluation
shall be performed. Additional testing could include in-situ immunity testing of the important to
safety equipment (or testing of equivalent equipment in a simulated environment) at a time
when its trip/control function can be bypassed such as during a refuelling outage according to
guidance in IEC 62003. This testing should determine the immunity of the NPP equipment and
establish an associated exclusion distance for the wireless device (if any).
Mobile devices shall be addressed in a similar manner but shall include administrative
controls such as training, signage, or other means, to ensure that the established exclusion
distances are not violated.
8.2 Radio coverage requirements
The access point location shall be defined through the results of coverage mapping and/or
EMI/RFI site survey.
The communication system coverage demands for the intended application shall be
...