EN 60965-2016 en Nuclear power plants - Control rooms - Supplementary control room for reactor shutdown without access to the main control room.pdf

1、Nuclear power plants Controlrooms Supplementary controlroom for reactor shutdown without access to the main control roomBS EN 60965:2016BSI Standards PublicationWB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06National forewordThis British Standard is the UK implementation of EN 60965:2016. I

2、t is identical to IEC 60965:2016. It supersedes BS EN 60965:2011 which iswithdrawn.The UK participation in its preparation was entrusted to TechnicalCommittee NCE/8, Instrumentation, Control any IEC National Committee interested in the subject dealt with may participate in this preparatory work. Int

3、ernational, governmental and non-governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The f

4、ormal decisions or agreements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees. 3) IEC Publications have the form of recommendations

5、 for international use and are accepted by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user

6、. 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication s

7、hall be clearly indicated in the latter. 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent cer

8、tification bodies. 6) All users should ensure that they have the latest edition of this publication. 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and members of its technical committees and IEC National Committees for any personal i

9、njury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications. 8) Attention is drawn to the Normative reference

10、s cited in this publication. Use of the referenced publications is indispensable for the correct application of this publication. 9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent rights. IEC shall not be held responsible for iden

11、tifying any or all such patent rights. International Standard IEC 60965 has been prepared by subcommittee 45A: Instrumentation, control and electrical systems of nuclear facilities, of IEC technical committee 45: Nuclear instrumentation. This third edition cancels and replaces the second edition pub

12、lished in 2009. This edition constitutes a technical revision. This edition includes the following significant technical changes with respect to the previous edition: a) requirements associated with regular testing of the supplementary control room (SCR); b) requirements to assess the time available

13、 during which the reactor will be safe but unattended, in order to move from the main control room (MCR) to the SCR and for the SCR to become operational; c) reference to SSR-2/1 which includes the following new requirements: BS EN 60965:2016 4 IEC 60965:2016 IEC 2016 1) the SCR should be functional

14、ly (as well as physically and electrically) separate from the MCR, 2) consideration shall be given to the provision of shielding against radioactivity on the access paths to the SCR; d) reference to DS431, the revision of NS-G-1.3, including the following new requirements: 1) to implement at least t

15、wo diverse methods for communication with a set of predefined locations, 2) to implement features to support monitoring of trends in key plant parameters; e) requirements for the role, functional capability and robustness of the SCR in design extension conditions; The text of this standard is based

16、on the following documents: FDIS Report on voting 45A/1060/FDIS 45A/1078/RVD Full information on the voting for the approval of this standard can be found in the report on voting indicated in the above table. This publication has been drafted in accordance with the ISO/IEC Directives, Part 2. The co

17、mmittee has decided that the contents of this publication will remain unchanged until the stability date indicated on the IEC website under “http:/webstore.iec.ch“ in the data related to the specific publication. At this date, the publication will be reconfirmed, withdrawn, replaced by a revised edi

18、tion, or amended. BS EN 60965:2016IEC 60965:2016 IEC 2016 5 INTRODUCTION a) Technical background, main issues and organization of the standard IEC 60965:1989 was developed to provide requirements relevant to the design of NPP supplementary control points for reactor shutdown without access to the ma

19、in control room. The first edition of IEC 60965 has been used extensively within the nuclear industry. It was however recognized in 2007 that technical developments especially those which were based on software technology should be incorporated. It was also recognized that the relationships with the

20、 standard for the main control room (i.e. IEC 60964) and the derivative standards to that standard (i.e. IEC 61227, IEC 61771, IEC 61772, IEC 61839, and IEC 62241) should be clarified and conditioned. In 2009 the second edition of IEC 60965 was published. In June 2013, during the Moscow meeting, WG

21、A8 experts recommended a limited revision be launched to take into account the lessons learned from TEPCO Fukushima Daiichi accident and some comments formulated during the circulation of the FDIS of the published second edition. In the course of development of this revision, the title of the standa

22、rd was amended to refer to Supplementary Control Room for consistency with IAEA SSR-2/1. This IEC standard specifically focuses on the functional design process of the supplementary control room of an NPP. It is intended that the standard be used by NPP designers, design authorities, vendors, utilit

23、ies, and by licensors. b) Situation of the current standard in the structure of the IEC SC 45A standard series IEC 60965 is the third level IEC SC 45A document tackling the issue of the design of a supplementary control room. IEC 60965 is to be read in association with IEC 60964 for the design of th

24、e main control room (including the derivative standards mentioned above) which is the appropriate IEC SC 45A document providing guidance on operator controls, verification and validation of design, application of visual display units, functional analysis and assignment, and alarm functions and prese

25、ntation. For more details on the structure of the IEC SC 45A standard series, see item d) of this introduction. c) Recommendations and limitations regarding the application of this Standard The purpose of this standard is to provide functional design requirements to be used in the design of the supp

26、lementary control room of a nuclear power plant to meet safety requirements. This standard is intended for application to a supplementary control room whose conceptual design is initiated after the publication of this standard. The recommendations of the standard may be used for refits, upgrades and

27、 modifications. Aspects for which special recommendations have been provided in this Standard, in accordance with IAEA safety standards, are: definition of the MCR and plant design bases for which the supplementary control room are to be used; access by station staff to the supplementary control roo

28、m in such emergencies; assurance for the station staff that the environment in the supplementary control room is safe when it is to be used; provision of information in the supplementary control room on the state of the reactor critical functions; transfer of control and indication functions from th

29、e main control room to the supplementary control room in emergencies; independence and separation of the cabling used by the supplementary control room from that used by the main control room; assurance that a safe state has been reached using the supplementary control room; BS EN 60965:2016 6 IEC 6

30、0965:2016 IEC 2016 communication facilities between the supplementary control room and to the station management. To ensure that the Standard will continue to be relevant in future years, the emphasis has been placed on issues of principle, rather than specific technologies. d) Description of the st

31、ructure of the IEC SC 45A standard series and relationships with other IEC documents and other bodies documents (IAEA, ISO) The top-level document of the IEC SC 45A standard series is IEC 61513. It provides general requirements for I location and configuration of the SCR to promote prompt mobilisati

32、on (6.29); qualified access path to the SCR, with hazard indication and suitable countermeasures along this path (6.27, 6.28); prevention of unauthorised access to or use of the SCR (6.21); safety functions of the MCR and SCR not affected by the same PIE, and independence of the circuits associated

33、with the SCR from those of the MCR (6.20, 6.23); priority of control between the MCR and SCR, and transfer of control from the MCR to the SCR (6.18, 6.20, 6.24); manual control in the SCR accomplished by simple actions (clause 6.22); displays and controls in the SCR similar to those in the MCR, to t

34、he extent possible (6.22); consideration of the difference of purpose between the MCR and the SCR (6.25); if long-term use is envisaged, suitable facilities for habitability and workspace for tasks (6.30). 5.2 Main objectives The IAEA requirements for the design of the SCR given in 5.1, paragraph 1,

35、 shall be met as detailed in this standard. The SCR shall be provided with the means to trip the reactor and bring the plant to a safe state and maintain it in that state without access to the MCR. However, the SCR is not required to perform all the other plant control and monitoring functions which

36、 are typically performed in the MCR. According to the type of NPP and the detailed safety arguments, provisions to cope with a predefined set of PIE could be integrated in the SCR. The SCR is required when the ability to perform safety functions in the MCR is lost. Possible causes include a control

37、room fire, the entry of excess smoke or a dangerous atmosphere to the MCR, severe damage to the MCR or its cables such that safety functions cannot be performed, major damage to the control room area, or major failure of control room facilities. The design basis PIE and sequences of events for which

38、 use of the SCR is necessary shall be identified. This shall include identification and justification of the assumed conditions throughout the plant and the corresponding durations for which the SCR may be required. Since events leading to the unavailability of the MCR are very infrequent, it is ant

39、icipated that the plant safety analysis will demonstrate that such events can only coincide with another independent event in the plant at an acceptably low frequency; in particular, it is anticipated that the primary coolant circuit will be intact. However, due account shall be taken of any plant f

40、ault that may occur as a consequence of reactor trip and of any plant faults at shutdown that are of sufficient frequency to coincide with use of the SCR. In particular, the design of the SCR shall take account of the possible long-term unavailability of the MCR due to fire or other reasons. The cri

41、teria for use of the SCR shall be clearly stated in the plant operating procedures. BS EN 60965:2016IEC 60965:2016 IEC 2016 11 It shall be possible to determine the complete safety state of the plant from outside the MCR. This should preferably be from the SCR. The SCR should therefore enable the mo

42、nitoring of the state of the relevant plant systems and key plant parameters. All information presented should comply with the ergonomic principles presented in the relevant parts of ISO 11064. For the purpose of efficient monitoring and later analysis of the events, key plant parameters should be r

43、ecorded to allow display of trends and later access for offline analysis. Automatic recording is recommended. If the MCR and SCR are assumed not to be staffed for an extended period of time, automatic recording shall be provided. From an operational viewpoint (e.g. to simplify operation and avoid mi

44、sunderstanding), it is preferable to have only one supplementary control room. Care shall be taken, however, to meet safety requirements, particularly requirements for redundancy and independence. If two or more supplementary control points are provided for an existing plant, each supplementary cont

45、rol point should display all information needed to perform the operator tasks. Computer-based information displays in the SCR should provide the same functionality for the presentation of information important to safety as the corresponding displays in the MCR. The content of the displays for a give

46、n plant state and for given operator tasks should be the same as in the MCR. There shall be adequate time to reach the SCR before necessary actions are required as well as sufficient equipment to provide necessary communication between all operating staff involved in these actions and with on-site a

47、nd off-site locations. Communication requirements are given in 7.7. The layout of the instrumentation and the mode of presentation at the SCR shall provide the operating staff with adequate information to assess the plant state and to supervise the shutdown (and subsequent hold down) of the reactor,

48、 the long-term cooling of the reactor core and confinement of all radioactive substances. The plant systems that can be controlled from the SCR may be limited to those providing the safety functions. The SCR shall provide sufficient control over the safety functions to reach and maintain a safe stat

49、e, for the defined set of PIEs and conditions for which the MCR cannot be used. The supervision and control provided at the SCR shall include the state of the safety functions concerned and control of their initiation and termination, and the state of the related fundamental safety functions (see IAEA SSR-2/1:2012, Requirement 4). Facilities for site security monitoring, plant access control and fire alarms which are normally provided in the MCR shall also be provided in an independent location. This independent location