CLC/TC 45AX - Nuclear power plants

This document specifies requirements for the software of computer-based instrumentation and control (I&C) systems performing functions of safety category B or C as defined by IEC 61226. It complements IEC 60880 which provides requirements for the software of computer-based I&C systems performing functions of safety category A. It is consistent with, and complementary to, IEC 61513. Activities that are mainly system level activities (for example, integration, validation and installation) are not addressed exhaustively by this document: requirements that are not specific to software are deferred to IEC 61513. The link between functions categories and system classes is given in IEC 61513. Since a given safety-classified I&C system may perform functions of different safety categories and even non safety-classified functions, the requirements of this document are attached to the safety class of the I&C system (class 2 or class 3). This document is not intended to be used as a general-purpose software engineering guide. It applies to the software of I&C systems of safety classes 2 or 3 for new nuclear power plants as well as to I&C upgrading or back-fitting of existing plants. For existing plants, only a subset of requirements is applicable and this subset has to be identified at the beginning of any project. The purpose of the guidance provided by this document is to reduce, as far as possible, the potential for latent software faults to cause system failures, either due to single software failures or multiple software failures (i.e. Common Cause Failures due to software). This document does not explicitly address how to protect software against those threats arising from malicious attacks, i.e. cybersecurity, for computer-based systems. IEC 62645 provides requirements for security programmes for computer-based systems.

See the scope of IEC 62988:2018. Adoption of IEC 62988:2018 is to be done without modification.

See the scope of IEC 61031:2020. Adoption of IEC 61031:2020 is to be done without modification.

See the scope of the revised IEC 60709 in 45A/1113/CDV that was unchanged for the preparation of the proposal of FDIS to be circulated in parallel in CENELEC.

See the scope of IEC 62646:2016. Adoption of IEC 62646 is to be done without modification

See the scope of the revised IEC 60709 in 45A/1113/CDV that was unchanged for the preparation of the proposal of FDIS to be circulated in parallel in CENELEC.

IEC 60964:2018 is available as IEC 60964:2018 RLV which contains the International Standard and its Redline version, showing all changes of the technical content compared to the previous edition.IEC 60964:2018 establishes requirements for the human-machine interface in the main control rooms of nuclear power plants. The document also establishes requirements for the selection of functions, design consideration and organization of the human-machine interface and procedures which are used systematically to verify and validate the functional design. These requirements reflect the application of human factors engineering principles as they apply to the human-machine interface during plant operational states and accident conditions (including design basis and design extension conditions), as defined in IAEA SSR-2/1 and IAEA NP-T-3.16. This third edition cancels and replaces the second edition published in 2009. This edition constitutes a technical revision. This edition includes the following significant technical changes with respect to the previous edition: a) to review the usage of the term “task” ensuring consistency between IEC 60964 and IEC 61839; b) to clarify the role, functional capability, robustness and integrity of supporting services for the MCR to promote its continued use at the time of a severe accident or extreme external hazard; c) to review the relevance of the standard to the IAEA safety guides and IEC SC 45A standards that have been published since IEC 60964:2009 was developed; d) to clarify the role and meaning of “task analysis”, e) to further delineate the relationships with derivative standards (i.e. IEC 61227, IEC 61771, IEC 61772, IEC 61839, IEC 62241 and others of relevance to the control room design); f) to consider its alignment with the Human Factors Engineering principles, specifically with the ones of IAEA safety guide on Human Factors (DS-492) to be issued.

See the technical scope of the amendment of IEC 62808 in 45A/1134/CDV that was unchanged for the preparation of the proposal of FDIS to be circulated in parallel in CENELEC.

See the scope of IEC 62465:2010. Adoption of IEC 62465 is to be done without modification.

IEC 60987:2021 provides requirements and recommendations for the hardware aspects of I&C systems whatever the technology and applies for all safety classes in a graded manner (as defined by IEC 61513). The requirements defined within this document guide, in particular, the selection of pre-existing components, hardware aspects of system detailed design and implementation and equipment manufacturing. This third edition cancels and replaces the second edition published in 2007. This edition includes the following significant technical changes with respect to the previous edition: a) Title modified; b) Take account of the fact that hardware requirements apply to all I&C technologies, including conventional hardwired equipment, programmable digital equipment or by using a combination of both types of equipment; c) Align the standard with the new revisions of IAEA documents SSR-2/1, which include as far as possible an adaptation of the definitions; d) Replace, as far as possible, the requirements associated with standards published since the edition 2.1, especially IEC 61513, IEC 60880, IEC 62138, IEC 62566 and IEC 62566‑2; e) Review the existing requirements and update the terminology and definitions; f) Extend the scope of the standard to all hardware (computerized and non-computerized) and to all safety classes 1, 2 and 3; g) Complete, update the IEC and IAEA references and vocabulary; h) Check possible impact of other IAEA requirements and recommendations considering extension of the scope of SC 45A; i) Highlight the use of IEC 62566 and IEC 62566-2 for HPD development; j) Introduce specific activities for pre-existing items (selection, acceptability and/or mitigation); k) Introduce clearer requirements for electronic module-level design, manufacturing and control; l) Complete reliability assessment methods; m) Introduce requirements when using automated tests or control activities; n) Complete description of manufacturing control activities (control process, assessment of manufactured equipment, preservation of products); o) Define and ensure the inclusion of a graded approach for dealing with the 3 different classes of equipment and related requirements.

This document presents the requirements for the on-site emergency response facilities (referred to hereinafter as the “ERF”) which are to be used in case of incidents or accidents occurring on the associated Nuclear Power Plant (NPP). The ERF consists of the Emergency Response Centre (ERC), the Technical Support Centre (TSC) and the Operational Support Centre (OSC), as shown in Figure 1. It establishes requirements for the ERF features and ERF I&C equipment to: • coordinate on-site operational efforts with respect to safety and radioprotection; • optimize the design in terms of environment control, lighting, power supplies and access control of the ERF; • enhance the identification and resolution of potential conflicts between the traditional operational means and emergency means (MCR/SCR and ERF, operating staff and emergency teams, operational procedures and emergency procedures); • aid the identification and the enhancement of the potential synergies between the traditional operational means and emergency means. This document is intended for application to new nuclear power plants whose conceptual design is initiated after the publication of this document, but it may also be used for designing and implementing ERF in existing nuclear power plants or in any other nuclear facility. Detailed equipment design is outside the scope of this document. This document does not define the situations (reactor plant conditions, hazards and magnitudes of hazards) leading to mobilisation of emergency response teams and activation / use of the ERF. These aspects are usually addressed in the NPP Emergency Plan. However, the need for consistency of the ERF design and operation with the NPP Emergency Plan is within scope.

This document establishes, for nuclear power plants2, a method of assignment of the functions specified for the plant into categories according to their importance to safety. Subsequent classification of the I&C and electrical power systems performing or supporting these functions, based on the assigned category, then determines relevant design criteria. The design criteria, when applied, ensure the achievement of each function in accordance to its importance to safety. In this document, the criteria are those of functionality, reliability, performance, environmental qualification (e.g. seismic) and quality assurance (QA). This document is applicable to: - the functions important to safety that are performed by I&C systems and supported by electrical power systems (categorization of I&C functions), - the I&C systems that enable those functions to be implemented (classification of I&C systems), - the electrical power systems that support those functions (classification of electrical power systems). The systems under consideration provide automated protection, closed or open loop control, information to the operating staff, and electrical power supply to systems. These systems keep the NPP conditions inside the safe operating envelope and provide automatic actions, or enable manual actions, that prevent or mitigate accidents, or that prevent or minimize radioactive releases to the site or wider environment. The I&C and electrical power systems that fulfil these roles safeguard the health and safety of the NPP operators and the public. This document follows the general principles given in IAEA Safety Requirement SSR-2/1 and Safety Guides SSG-30, SSG-34 and SSG-39, and it defines a structured method of applying the guidance contained in those codes and standards to the I&C and electrical power systems that perform functions important to safety in a NPP. This document is read in association with the IAEA guides together with IEC 61513 and IEC 63046 in implementing the requirements of the IEC 61508 series. The overall classification scheme of structures, systems and components for NPPs can be summarized as follows by Figure 1.

This part of IEC/IEEE 62582 contains methods for condition monitoring of organic and polymeric materials in instrumentation and control cables using insulation resistance measurements in the detail necessary to produce accurate and reproducible results during simulated accident conditions. It includes the requirements for the measurement system and measurement procedure, and the reporting of the measurement results. NOTE Measurement of insulation resistance during simulated accident conditions with the aim of determining the lowest value during the accident in order to assess cable performance involves special requirements given in this document. Methods for measurement under stable (non-accident) conditions are available in other international standards, e.g. IEC 62631-3-3. The different parts of the IEC/IEEE 62582 series are measurement standards, primarily for use in the management of ageing in initial qualification and after installation. IEC/IEEE 62582- 1 includes requirements for the application of the other parts of the IEC/IEEE 62582 series and some elements which are common to all methods. Information on the role of condition monitoring in qualification of equipment important to safety is found in IEC/IEEE 60780-323.

IEC 62855 provides the electrotechnical engineering guidelines for analysis of AC and DC electrical power systems in nuclear power plants (NPPs) in order to demonstrate that the power sources and the distribution systems have the capability for safe operation and shut down of the NPP, bringing it to a controlled state after an anticipated operational occurrence or accident conditions and finally reaching a safe state. The analytical studies discussed in this document provide assurance that the design bases are satisfied to meet their functional requirements under the conditions produced by the applicable design basis events. The studies provide assurance that the electrical power system is capable of supporting safety functions during all required plant conditions. NOTE The safety functions are described in IAEA Specific Safety Requirements SSR-2/1 related to the design of the nuclear power plants.. Analytical studies validate the robustness and adequacy of design margins and demonstrate the capability of electrical power systems to support plant operation for normal, abnormal, degraded and accident conditions. The analyses are used to verify that the electrical power system can withstand minor disturbances and that the consequences of major disturbances or failures do not degrade the capability of the electrical power systems to support safe shutdown of the plant and maintain the plant in shutdown condition. The analyses are performed with one or more of • simulation tools (software and hardware) that have been verified and validated, • hand calculations, and • tests. This document provides guidance on the types of analyses required to demonstrate that the plant's auxiliary power system can perform the required safety functions. This document does not provide specific details on how the analysis should be conducted. This document does not cover digital controllers (such as controllers for rectifiers, inverters, sequencers and electrical protection devices) used in electrical power systems. IEC 61513 gives recommendations that apply to the electronic controls and protective elements of the electrical power systems. This document does not include environmental conditions (i.e. temperature, humidity, etc.) or external events (seismic, flooding, fire, high energy electromagnetic pulse, etc.) that may impact equipment sizing or protection requirements. The external events lightning and geomagnetic storms are included. This document does not cover additional or unique requirements for stand-alone power system, such as power supplies for security measures in NPPs. Pertinent clauses of this document may be used as a guideline for such systems. Redundancy in the power system design can increase the availability of electrical power to critical plant equipment. Performing a probabilistic risk assessment (PRA) is a method of assessing system availability and optimizing design for high reliability. This document does not cover improving the reliability of NPP electrical power systems using statistical or diverse and redundant schemes. Requirements for safeguards of personnel involved with installation, maintenance and operation of electrical systems and general personal safety are outside the scope of this document. General guidance for lightning protection of equipment is provided in relevant clauses of this document. This document is intended to be used: • for verification of the design of new nuclear power plants, • for demonstrating the adequacy and impact of major modifications of electrical power systems in operating nuclear power plants, and • where there is a requirement to assess and establish operating limits and constraints for existing plants. Pertinent parts of this document can be used as guidance for decommissioning stages.

See the scope of IEC 63046:2020. Adoption of IEC 63046:2020 is to be done without modification.

See the scope of IEC/IEEE 60980-344:2020. Adoption of IEC/IEEE 60980-344:2020is to be done without modification.

See the scope of IEC 62566-2:2020. Adoption of IEC 62566-2:2020 is to be done without modification.

IEC 62003:2020 establishes requirements for electromagnetic compatibility testing of instrumentation, control, and electrical equipment supplied for use in systems important to safety at nuclear power plants and other nuclear facilities. The document lists the applicable IEC standards (principally the IEC 61000 series) which define the general test methods, and provides the necessary application-specific parameters and criteria to ensure that nuclear safety requirements are met. This second edition cancels and replaces the first edition published in 2009. This edition includes the following significant technical changes with respect to the previous edition: a) title modified. b) expand the scope to encompass Electromagnetic Magnetic Compatibility (EMC) considerations for electrical equipment. c) provide guidance for addressing the use of wireless technology. d) enhance the description of the electromagnetic environment to provide clarification when selecting custom test levels or for test exemptions. e) include example information to be contained within an EMC test plan. f) provide guidance for characterization of the electromagnetic environment at the point of installation within a nuclear facility.

IEC 62765-1:2015 provides strategies, technical requirements, and recommended practices for the management of ageing to ensure that ageing of pressure transmitters important to safety in nuclear power plants (NPPs) can be identified and that suitable remedial actions are undertaken as necessary to demonstrate that the safety of the plant will not be impaired. This standard is aligned with IEC 62342, which provides guidance on ageing management for I&C systems important to safety in NPPs. This standard, IEC 62765-1, is the first part for pressure transmitters in the IEC 62765 sensor and transmitter series for pressure, temperature, neutron and other sensors.

IEC/IEEE 60780-323:2016 describes the basic requirements for qualifying electrical equipment important to safety and interfaces (electrical and mechanical) that are to be used in nuclear facilities. The principles, methods, and procedures described are intended to be used for qualifying equipment, maintaining and extending qualification, and updating qualification, as required, if the equipment is modified. The qualification requirements in this standard, when met, demonstrate and document the ability of equipment to perform safety function(s) under applicable service conditions, including design basis events and certain design extension conditions, and reduce the risk of environmentally induced common-cause equipment failure. This new edition includes the following main changes with respect to the previous edition IEC 60780:1998 harmonizes in a unique standard qualification practices formerly given by IEC 60780:1998 and IEEE 323:2003 on initial qualification, takes into account the need to reassess and extend the qualified life of electrical equipment regarding projects to extend the operating life of nuclear facilities.

See the scope of IEC 62859:2016 and of its Amendment1:2019. Adoption of IEC 62859:2016+Amdt1:2019 is to be done without modification.

See the scope of IEC 62645:2019. Adoption of IEC 62645:2019 is to be done without modification.

IEC 61225:2019 specifies the performance and the functional characteristics of the low voltage static uninterruptible power supply (SUPS) systems in a nuclear power plant and, for applicable parts, in general for nuclear facilities. An uninterruptible power supply is an electrical equipment which draws electrical energy from a source, stores it and maintains supply in a specified form by means inside the equipment to output terminals. A static uninterruptible power supply (SUPS) has no rotating parts to perform its functions. This third edition cancels and replaces the second edition published in 2005. This edition includes the following significant technical changes with respect to the previous edition: a) the principal objective of this edition is to address the requirements on the static uninterruptible power supplies in nuclear power plants; b) in addition to Instrumentation and Control (I&C) power supplies include all static uninterruptible power supplies; c) emphasize that the static uninterruptible power supplies shall protect the connected equipment (loads) from transients on the on-site AC distribution system (the immunity concept); d) in accordance with the defence-in-depth concept, this standard applies to static uninterruptible power supplies for all equipment, not only for equipment important to safety, with a graded approach to verification and validation; e) addition of the requirement that, when batteries are connected in parallel under abnormal operating conditions, they shall be properly protected with isolation devices to avoid any failure that may impair more than one division of the uninterruptible power supply.

IEC 60965:2016 establishes requirements for the Supplementary Control Room provided to enable the operating staff of nuclear power plants to shut down the reactor, where previously operating, and maintain the plant in a safe shut-down state in the event that control of the safety functions can no longer be exercised from the Main Control Room, due to unavailability of the Main Control Room or its facilities. The design has to ensure that the Supplementary Control Room is protected against the hazards, including any localised extreme hazards, leading to the unavailability of the Main Control Room. This new edition includes the following significant technical changes with respect to the previous edition: - requirements associated with regular testing of the supplementary control room (SCR); - requirements to assess the time available during which the reactor will be safe but unattended, in order to move from the main control room (MCR) to the SCR and for the SCR to become operational; - taking into account new requirements laid down by the IAEA.

IEC 62808:2015 establishes requirements for the design, analysis and qualification of isolation devices used to ensure electrical independence of redundant safety system circuits, or between safety and lower class circuits, as specified in IEC 60709. This standard includes guidance on the determination of the maximum credible fault that is applied to the isolation devices. The maximum credible fault can be used as a basis for the test levels used in testing based on other standards (e.g. IEC TS 61000-6-5 or IEC 62003).

IEC 61227:2008 identifies the Human-Machine Interface (HMI) requirements for discrete controls, multiplexed conventional systems, and soft control systems. To be used with IEC 60964 and IEC 61772. Is intended for application to the design of new main control rooms in nuclear power plants designed to IEC 60964. This new edition takes into account the fact that computer design engineering techniques have advanced significantly during recent years.

Provides the functional requirements for the alarm systems in the main control room of nuclear power plants. Establishes the human factors requirements and the design guidelines for alarm presentation for the main control room of nuclear power plants.

IEC 62566:2012 provides requirements for achieving highly reliable 'HDL-Programmed Devices' (HPD), for use in I&C systems of nuclear power plants performing functions of safety category A as defined by IEC 61226. The programming of HPDs relies on Hardware Description Languages (HDL) and related software tools. They are typically based on blank FPGAs or similar micro-electronic technologies.

Specifies functional analysis and assignment procedures for the design of the control-room system for nuclear power plants and gives rules for developing criteria for the assignment of functions. Supplements IEC 60964. Is applicable to the design of new control-rooms or to backfits to existing control-rooms.

IEC 61772:2009 supplements IEC 60964 and presents design requirements for the application of VDUs in main control rooms of nuclear power plants. Assists the designer in specifying VDU applications including displays on individual workstations and larger displays for group-working or distant viewing. The main technical changes with respect to the previous edition are as follows: - expand the previous text to cover the use of large screen displays, to provide improved recommendations on the use of colour, and to improve the coverage of back-fit or upgrade applications; - present examples of good practice.

Instrumentation and control (I&C) systems important to safety may be implemented using conventional hard-wired equipment, computer-based (CB) equipment or by using a combination of both types of equipment (see Note 1). IEC 61513:2011 provides requirements and recommendations for the overall I&C architecture which may contain either or both technologies. The main technical changes with regard to the previous edition are as follows: - alignment with the latest revisions of IAEA documents; - alignment with new editions of IEC 60880, IEC 61226, IEC 62138, IEC 62340 and IEC 60987; - alignment with significant advances of software engineering techniques; - integration of requirements for staff training.

Lays down principles for testing I&C systems performing category A, B and C functions, per IEC 61226, during normal power operation and shutdown, so as to check the functional availability especially with regard to the detection of faults that could prevent the proper operation of the functions important to safety. Covers the possibility of testing at short intervals or continuous surveillance, as well as periodic testing at longer intervals. It also establishes basic rules for the design and application of the test equipment and its interface with the systems important to safety. The main change with respect to the previous edition includes an extension of the scope to cover all systems important to safety, and a requirement gradation for systems and equipment performing category A, B and C functions.

Gives requirements related to the avoidance of CCF of I&C systems that perform category A functions; additionally requires the implementation of independent I&C systems to overcome CCF, while the likelihood of CCF is reduced by strictly applying the overall safety principles of IEC SC 45A (notably IEC 61226, IEC 61513, IEC 60880 and IEC 60709); gives an overview of the complete scope of requirements relevant to CCF.

Provides requirements for the software of computer-based instrumentation and control (I&C) systems of nuclear power plants performing functions of safety category A as defined by IEC 61226. Provides requirements for the purpose of achieving highly reliable software. Addresses each stage of software generation and documentation, including requirements specification, design, implementation, verification, validation and operation.

Is applicable to computer-system hardware for systems of Class 1 and 2 (as defined by IEC 61513) in nuclear power plants. This new edition reflects recent developments in computer system hardware design, the use of pre-developed hardware and changes in terminology.

IEC 61500:2009 establishes requirements for data communication which is used in systems performing category A functions in nuclear power plants. It covers also interface requirements for data communication of equipment performing category A functions with other systems including those performing category B and C functions and functions not important to safety. This second edition is intended to accomplish the following: - to change the focus from multiplexed data transmission to data communication; - to restrict the scope to communication in systems performing category A functions.

IEC 60965:2009 establishes requirements for the supplementary control points provided to enable the operating staff of nuclear power plants to shut down the reactor and maintain the plant in a safe shut-down state in the event that control of the safety functions can no longer be exercised from the main control room, due to unavailability of the main control room or its facilities. The main technical changes with regard to the previous edition are as follows: - to clarify the definitions and review the requirements; - to update the references to new IEC standards published since the first issue; - to align the standard with new editions of the relevant IAEA documents.

Defines the technical requirements to be met for I&C systems important to safety and their cables, in order to achieve adequate physical separation between redundant sections of a system and between a system and another system.

IEC 61226:2009 establishes a method of classification of the information and command functions for nuclear power plants, and the instrumentation and control systems and equipment that provide those functions, into categories that designate the importance to safety of the function. The resulting classification then determines relevant design criteria. Is applicable to all the information and command functions and the instrumentation and control systems and equipment that provide those functions. The main changes with respect to the previous edition are listed below: - to introduce a definition for 'non-hazardous stable state'; - to clarify limits of categories; - to clarify requirements related to equipment used for beyond design events.

IEC 60964:2009 provides functional design requirements to be used in the design of the main control room of a nuclear power plant to meet operational and safety requirements. Also provides functional interface requirements which relate to control room staffing, operating procedures, and the training programmes which, together with the human-machine interface, constitute the control room system. This new edition takes into account the fact that software engineering techniques advanced significantly in the intervening years and introduces consistency with the latest revisions of relevant IAEA documents.

Provides requirements for the software of computer-based I&C systems performing functions of safety category B or C as defined by IEC 61226. Complements IEC 60880 and IEC 60880-2, which provide requirements for the software of computer-based I&C systems performing functions of safety category A. Is also consistent with, and complementary to, IEC 61513.

Is applicable to computer-system hardware for systems of Class 1 and 2 (as defined by IEC 61513) in nuclear power plants. This new edition reflects recent developments in computer system hardware design, the use of pre-developed hardware and changes in terminology.

Dimensions of the standard plug-in unit and rack-mounting unit; connector dimensions and pin arrangements.

Defines a modular instrumentation system capable of linking transducers and other devices with digital controllers or computers. It consists of mechanical standards and signal standards sufficient to ensure compatibility between units from different sources of design and production. The CAMAC system is primarily designed for nuclear instrumentation but may be utilized also for other applications.

Applies to equipment for the monitoring of radioactive substances within plant process streams of stationary nuclear power plants with light-water reactors during specified normal operation (routine operation) and during anticipated operational occurrences (incidents). Provides criteria for the design, selection, functional location, testing and calibration of stationary radiation equipment to be used for continuous monitoring of plant process streams.

Standard interface between a number of 'CAMAC' measuring instruments, display units, control units, actuators, data processing equipment (computers) and communication equipment.

Characteristics of the 'parallel highway' for the CAMAC instrumentation and interface system described in HD 357.This highway provides for the high-speed transfer of data between CAMAC crates and computers or other controllers and for the interconnection of CAMAC crates in multicrate systems. Signal, timing and logical organization. Appendix: specifications of a standard crate controller.

Gives the standard values for the diameters, heights and wall thickness of planchets made in well flat and dish-type configurations.

Defines a method for incorporating more than one source of control into a CAMAC crate through auxiliary controllers located in normal stations in the crate. An auxiliary controller bus (ACB) and priority arbitration protocol are fully defined.