SSG-30 Safety Classification of Structures, Systems and Components in Nuclear Power Plants

Sekce Odstavec Text
Main 1.1. The need to classify equipment in a nuclear power plant according to its importance to safety has been recognized since the early days of reactor design and operation. The methods for safety classification of structures, systems and components (SSCs) have evolved in the light of experience gained in the design and operation of existing plants. Although the concept of a safety function as being what must be accomplished for safety has been understood for many years, the process by which SSCs important to safety can be derived from the fundamental safety objective has not been described in earlier IAEA Safety Guides dealing with SSC classification. Therefore, the classification schemes used in practice to identify those SSCs deemed to be of the highest importance to safety have, for the most part, been based on experience and analysis of specific designs.
Main 1.2. This Safety Guide was prepared under the IAEA programme for safety standards. A Safety Guide on Safety Functions and Component Classification for BWRs, PWRs and PTRs (i.e. boiling water reactors, pressurized water reactors and pressure tube reactors) was issued in 1979 as IAEA Safety Series No. 50-SG-D1. This was withdrawn in 2000 because the recommendations contained therein were considered not to comply with the IAEA Safety Requirements publication Safety of Nuclear Power Plants: Design (IAEA Safety Standards Series No. NS-R-1), published in 2000.
Main 1.3. In developing this Safety Guide, relevant IAEA publications have also been considered. This includes the Fundamental Safety Principles [1], and the Safety Requirements publications on Safety of Nuclear Power Plants: Design [2] and Safety Assessment for Facilities and Activities [3].
Main 1.4. The goal of safety classification is to identify and classify those SSCs that are needed to protect people and the environment from harmful effects of ionizing radiation, based on their roles in preventing accidents, or limiting the radiological consequences of accidents should they occur. On the basis of their classification, SSCs are then designed, manufactured, constructed, installed, commissioned, operated, tested, inspected and maintained in accordance with established processes that ensure design specifications and the expected levels of safety performance are achieved. In accordance with Ref. [2], all items important to safety are required to be identified and classified on the basis of their functions and their safety significance1.
Main 1.5. In the preparation of this Safety Guide, the existing safety classification methodologies applied in operating nuclear power plants and for new designs have been broadly reviewed. This Safety Guide describes the steps of safety classification, which are often not expressed and documented in a systematic manner in national classification schemes.
Main 1.6. This publication is intended primarily for use by organizations involved in the design of nuclear power plants, as well as by regulatory bodies and their technical support organizations. It can also be applied to other nuclear installations subject to appropriate adjustments relevant to the specific design of the type of facility being considered.
Main 1.7. The objective of this Safety Guide is to provide recommendations and guidance on how to meet the requirements established in Refs [2, 3] for the identification of SSCs important to safety and for their classification on the basis of their function and safety significance. This is to ensure a high level of safety by meeting the associated quality requirements and reliability targets. The engineering design rules for items important to safety at a nuclear power plant are required to be specified and to comply with the relevant national or international codes and standards and with proven engineering practices, with due account taken of their relevance to nuclear power technology. The nuclear security aspects of the classification of SSCs are outside the scope of this publication. Guidance on these aspects can be found in the publications of the IAEA Nuclear Security Series (e.g. Refs [4, 5]).
Main 1.8. This Safety Guide applies to the design of all SSCs important to safety for all plant states, including all modes of normal operation, during the lifetime of a nuclear power plant.
Main 1.9. This Safety Guide is written in technology neutral terms. The approach proposed is intended to apply to new nuclear power plants and may not be applicable to existing plants built with earlier classification principles. The manner in which this Safety Guide is applied to such nuclear power plants is a decision for individual States.
Main 1.10. Section 2 provides the basis and general approach for identifying the SSCs to be classified and for assessing their individual safety significance on which their ranking is established. Section 3 recommends a process for undertaking the safety classification of SSCs that applies these principles. Section 4 provides general recommendations on selecting the engineering design rules for SSCs on the basis of their safety classes.
Main 2.1. The general approach is to provide a structure and method for identifying and classifying SSCs important to safety on the basis of their functions and safety significance. Once SSCs are classified, appropriate engineering rules can be applied to ensure that they are designed, manufactured, constructed, installed, commissioned, operated, tested, inspected and maintained with sufficient quality to fulfil the functions that they are expected to perform and, ultimately the main safety functions2 , in accordance with the safety requirements in Ref. [2].
Main 2.2. The basic requirements for classification are established in Ref. [2] and are reproduced here for convenience. Additional related requirements are established in Ref. [3].
Main “Requirement 4: Fundamental safety functions
Main “Fulfilment of the following fundamental safety functions for a nuclear power plant shall be ensured for all plant states: (i) control of reactivity, (ii) removal of heat from the reactor and from the fuel store and (iii) confinement of radioactive material, shielding against radiation and control of planned radioactive releases, as well as limitation of accidental radioactive releases.
Main “4.1. A systematic approach shall be taken to identifying those items important to safety that are necessary to fulfil the fundamental safety functions and to identifying the inherent features that are contributing to fulfilling, or that are affecting, the fundamental safety functions for all plant states.
Main “4.2. Means of monitoring the status of the plant shall be provided for ensuring that the required safety functions are fulfilled.” [2].
Main “Requirement 18: Engineering design rules
Main “The engineering design rules for items important to safety at a nuclear power plant shall be specified and shall comply with the relevant national or international codes and standards and with proven engineering practices, with due account taken of their relevance to nuclear power technology.” [2]
Main “Requirement 22: Safety classification
Main “All items important to safety shall be identified and shall be classified on the basis of their function and their safety significance.
Main “5.34. The method for classifying the safety significance of items important to safety shall be based primarily on deterministic methods complemented, where appropriate, by probabilistic methods, with due account taken of factors such as:

  • The safety function(s) to be performed by the item;

  • The consequences of failure to perform a safety function;

  • The frequency with which the item will be called upon to perform a safety function;

  • The time following a postulated initiating event at which, or the period for which, the item will be called upon to perform a safety function.
Main “5.35. The design shall be such as to ensure that any interference between items important to safety will be prevented, and in particular that any failure of items important to safety in a system in a lower safety class will not propagate to a system in a higher safety class.
Main “5.36. Equipment that performs multiple functions shall be classified in a safety class that is consistent with the most important function performed by the equipment.” [2]
Main “Requirement 27: Support service systems
Main “Support service systems that ensure the operability of equipment forming part of a system important to safety shall be classified accordingly.” [2]
Main 2.3. Safety classification is an iterative process that should be carried out periodically throughout the design process and maintained throughout the lifetime of the plant. Any assignment of SSCs to particular safety classes should be justified using deterministic safety analysis complemented by insights from probabilistic safety assessment and supported by engineering judgement.
Main 2.4. Safety classification should be performed during the plant design, system design and equipment design phases, and should be reviewed for any relevant changes during construction, commissioning, operation and subsequent stages of the plant’s lifetime.
Main 2.5. New or modified postulated initiating events and SSCs should be addressed in the safety classification process, with account taken of interfaces with existing safety functions and safety classes of the SSCs that may be affected.
Main 2.6. The safety classification process recommended in this Safety Guide is consistent with the concept of defence in depth set out in Ref. [2]. The functions3 performed at all five levels of defence in depth should be considered and the associated SSCs should then be classified according to their safety significance. Similarly, design provisions should also be classified (see paras 3.8 and 3.9).
Main 2.7. The basis for the classification and the results of the classification should be documented in an auditable record. The final classification of SSCs should be complete and available for audit by the organization(s) responsible for quality assurance and by the regulatory body. As classifications may be affected by subsequent design changes to the plant (throughout its operating life), the classification records should be included in the management system as part of the plant configuration control.
Main 2.8. This Safety Guide proposes a structured process for identifying and classifying the SSCs, which is illustrated in Fig. 1.
Main 2.9. Classification is a top down process that begins with a basic understanding of the plant design, its safety analysis and how the main safety functions will be achieved. Using this information, the functions and design provisions (see para. 3.9) required to fulfil the main safety functions are systematically identified for all plant states, including all modes of normal operation. Using information from safety assessments, such as the analysis of postulated initiating events, the functions are then categorized on the basis of their safety significance. The SSCs belonging to the categorized functions are then identified and classified on the basis of their role in achieving the function. An SSC implemented as a design provision should, however, be classified directly because the significance of its postulated failure fully defines its safety class without any need for detailed analysis of the category of the associated safety function.
Main 2.10. The process for classifying all SSCs according to their safety significance should take into account the following:

  • The plant design and its inherent safety features;

  • The list of all postulated initiating events4 , as required in Requirement 16 in Ref. [2]. The frequency of occurrence of the postulated initiating events, as considered in the design of the nuclear power plant, should also be taken into account.
Main 2.11. All functions and design provisions necessary to achieve the main safety functions (as defined in Requirement 4 in Ref. [2]) for the different plant states, including all modes of normal operation, should be identified.
Main 2.12. The functions should then be categorized into a limited number of categories on the basis of their safety significance, using an approach that takes account of the following factors:

  • The consequences of failure to perform the function;

  • The frequency of occurrence of the postulated initiating event for which the function will be called upon;

  • The significance of the contribution of the function in achieving either a controlled state or a safe state (as defined in Ref. [2]).
Main 2.13. Categorization of the functions provided by design provisions is not necessary because the safety significance of the SSC can be derived directly from the consequences of its failure. The SSCs implemented as design provisions can therefore be assigned directly to a safety class without the need for a further analysis of safety function categories.
Main 2.14. The next step in the process is to determine the safety classification of all SSCs important to safety. Deterministic methodologies should generally be applied, complemented where appropriate by probabilistic safety assessment and engineering judgement to achieve an appropriate risk profile, i.e. a plant design for which events with a high level of severity of consequences have a very low predicted frequency of occurrence. The overall intent is illustrated schematically in Fig. 2, showing that design provisions are implemented primarily to decrease the probability of an accident and functions are implemented to make the consequences acceptable with regard to its probability. For most initiating events, a combination of both design provisions and functions is implemented to decrease the frequency of occurrence of an accident and to make its consequences acceptable and also as low as practicable. Nevertheless, for a few initiating events, the implementation of functions to limit the consequences may not be necessary provided that the consequences are very low and that there is no need for any mitigation measures. The efficiency of both design provisions and safety functions will depend on the overall dependability of items of equipment, which itself is governed by their classification.
Main 2.15. To decrease the frequency of occurrence of accidents and to make their consequences acceptable and also as low as practicable, the SSCs that are needed to perform functions should be identified and classified into a limited number of classes on the basis of their safety significance, using a process that takes into account the factors indicated in Requirement 22 in Ref. [2].
Main 2.16. The SSCs implemented as design provisions should also be identified and classified using the same set of classes as those used for the classification of SSCs needed to perform safety functions.
Main 2.17. Based on the experience of Member States, in this Safety Guide three safety categories for functions and three safety classes for SSCs important to safety are recommended. Other approaches utilizing a larger or smaller number of categories and classes may be used provided that they are aligned with the guidance provided in paras 2.12 and 2.15.
Main 3.1. This section provides more detailed guidance on the identification of functions to be categorized and SSCs to be classified to ensure that all items essential to protect people and the environment from harmful effects of ionizing radiation will be captured.
Main 3.2. For the purposes of simplification, the term ‘function’ includes the primary function and any supporting functions that are expected to be performed to ensure the accomplishment of the primary function.
Main 3.3. The functions to be categorized are those required to achieve the main safety functions for the different plant states, including all modes of normal operation. These functions are primarily those that are credited in the safety analysis and should include functions performed at all five levels of defence in depth, i.e. prevention, detection, control and mitigation safety functions.
Main 3.4. Although the main safety functions to be fulfilled are the same for every plant state, the functions to be categorized should be identified with respect to each plant state separately.
Main 3.5. The lists of functions identified may be supplemented by other functions, such as those designed to reduce the actuation frequency of the reactor scram and/or engineered safety features that correct deviations from normal operation, including those designed to maintain the main plant parameters within the normal range of operation of the plant. Such functions are generally not credited in the safety analysis.
Main 3.6. Owing to the importance of monitoring to safety, functions for monitoring to provide the plant staff and the off-site emergency response organization with sufficient reliable information in the event of an accident should be considered for safety categorization. This should include monitoring and communication as required under the emergency response plan.
Main 3.7. Functions credited in the safety analysis with either preventing some sequences resulting from additional independent failures from escalating to a severe accident, or mitigating the consequences of a severe accident, are included in functions associated with design extension conditions.
Main 3.8. The safety of the plant is also dependent on the reliability of different types of features, some of which are designed specifically for use in normal operation. For the purpose of this Safety Guide, these SSCs are termed ‘design provisions’. Such design provisions should be identified and may be considered to be subject to the safety classification process, and hence will be designed, manufactured, constructed, installed, commissioned, operated, tested, inspected and maintained with sufficient quality to fulfil their intended role.
Main 3.9. Design provisions should include the following:

  • Design features designed to such a quality that their failure could be ‘practically eliminated’5 . For these design features, the plant design does not require an independent safety system to be available to mitigate the effects of their failure. Examples of these are the shells of reactor pressure vessels or steam generators. These design features can be readily identified by the high level of severity of consequences that can be expected should they fail.

  • Features that are designed to reduce the frequency of an accident. Examples of these are piping of high quality whose failure would result in a design basis accident.

  • Passive design features that are designed to protect workers and the public from harmful effects of radiation in normal operation. Examples of these are shielding, civil structures and piping.

  • Passive design features that are designed to protect components important to safety from being damaged by internal or external hazards. Examples of these are concrete walls between components that are built specifically for this purpose.

  • Features that are designed to prevent a postulated initiating event from developing into a more serious sequence without the occurrence of another independent failure. Examples of these are anti-whipping devices and fixed points.
Main SSCs implemented as design provisions should be classified as recommended in para. 3.22, depending on the outcome of the assessment of the consequences of their failure.
Main 3.10. The functions required for fulfilling the main safety functions in all plant states, including modes of normal operation, should be categorized on the basis of their safety significance. The safety significance of each function is determined by taking account of the factors indicated in para. 2.12. In the approach recommended in this Safety Guide, the severity of consequences (factor 1) is divided into three levels (high, medium and low) on the basis of the worst consequences that could arise if the function were not performed, as defined in para. 3.11.
Main 3.11. The three levels of severity are defined as follows:

  • The severity should be considered ‘high’ if failure of the function could, at worst:

    • Lead to a release of radioactive material that exceeds the limits accepted by the regulatory body for design basis accidents; or

    • Cause the values of key physical parameters to exceed acceptance criteria for design basis accidents6 .

  • The severity should be considered ‘medium’ if failure of the function could, at worst:

    • Lead to a release of radioactive material that exceeds limits established for anticipated operational occurrences; or

    • Cause the values of key physical parameters to exceed the design limits for anticipated operational occurrences.

  • The severity should be considered ‘low’ if failure of the function could, at worst:

    • Lead to doses to workers above authorized limits.
Main Where more than one of these definitions is met, the highest of the three levels should be applied. The assessment of the consequences is made under the assumption that the function does not respond when challenged.
Main For anticipated operational occurrences, in order to avoid ‘over-categorization’, the assessment of the consequences should be made with the assumption that all other independent functions are performed correctly and in due time.
Main 3.12. Factor 2 (see para. 2.12) reflects the frequency that a function will be called upon. This frequency should be evaluated primarily in accordance with the frequency of occurrence of the respective postulated initiating event.
Main 3.13. By including factors 1 and 2, the approach to classification recommended here is in line with the commonly agreed design principle that events with the most significant consequences ought to have the lowest frequency of occurrence. This means, for example, that functions dedicated to the mitigation of the consequences of severe accidents may involve less stringent engineering design rules than those applied for functions for mitigation of the consequences of design basis accidents, because the frequency of occurrence of severe accidents is lower than that of design basis accidents. Figure 2 illustrates this approach.
Main 3.14. Factor 3 (see para. 2.12) concerns functions intended to reach a particular plant state. Generally, two plant states are distinguished, namely a controlled state7 and a safe state7 . For functions that are performed to achieve a controlled state, the main focus is on automatic actuation or short term actuation, in order to reduce considerably the hazard potential. Functions that are applied to achieve a safe state are longer term functions, and are performed once the controlled state has been achieved. In many cases, for reactors, the functions applied following an accident transient will achieve a controlled state first before achieving a safe state. Typical functions for the controlled state are reactor trip, decay heat removal and safety injection. Depressurizing the reactor and connecting the residual heat removal system to ensure the long term function of decay heat removal are good examples of functions that are performed to achieve a safe state.
Main 3.15. The categorization of functions recommended in this Safety Guide is based on the following three safety categories:
Main Safety category 1: Any function that is required to reach the controlled state after an anticipated operational occurrence or a design basis accident and whose failure, when challenged, would result in consequences of ‘high’ severity.
Main Safety category 2: There are three possibilities in this category:

  • Any function that is required to reach a controlled state after an anticipated operational occurrence or a design basis accident and whose failure, when challenged, would result in consequences of ‘medium’ severity; or

  • Any function that is required to reach and maintain for a long time a safe state and whose failure, when challenged, would result in consequences of ‘high’ severity; or

  • Any function that is designed to provide a backup of a function categorized in safety category 1 and that is required to control design extension conditions without core melt.
Main Safety category 3: There are five possibilities in this category:

  • Any function that is actuated in the event of an anticipated operational occurrence or design basis accident and whose failure, when challenged, would result in consequences of ‘low’ severity; or

  • Any function that is required to reach and maintain for a long time a safe state and whose failure, when challenged, would result in consequences of ‘medium’ severity; or

  • Any function that is required to mitigate the consequences of design extension conditions, unless already required to be categorized in safety category 2, and whose failure, when challenged, would result in consequences of ‘high’ severity; or

  • Any function that is designed to reduce the actuation frequency of the reactor trip or engineered safety features in the event of a deviation from normal operation, including those designed to maintain the main plant parameters within the normal range of operation of the plant; or

  • Any function relating to the monitoring needed to provide plant staff and off-site emergency services with a sufficient set of reliable information in the event of an accident (design basis accident or design extension conditions), including monitoring and communication means as part of the emergency response plan (defence in depth level 5), unless already assigned to a higher category.
Main 3.16. The categorization described in para. 3.15 is summarized in Table 1. Where a function could be considered to be in more than one category (e.g. because the function is needed for more than one postulated initiating event), it should be categorized in the highest of these categories.
Main a Medium or low severity consequences are not expected to occur in the event of non-response of a dedicated function for the mitigation of design extension conditions.
Main 3.17. Once the safety categorization of the functions is completed, the SSCs performing these functions should be assigned to a safety class.
Main 3.18. All SSCs required to perform a function that is safety categorized should be identified and classified according to their safety significance following a process that takes into account the factors indicated by Requirement 22 in Ref. [2] and reproduced in para. 2.2.
Main 3.19. By applying factors (a) and (c) defined in para. 2.2, SSCs (including supporting SSCs) that are designed to carry out identified functions should initially be assigned to the safety class corresponding to the safety category of the function to which they belong. In the approach recommended in this Safety Guide, three safety classes are proposed consistent with the three categories recommended in para. 3.15.
Main 3.20. The initial classification should then be amended, as necessary, to take into account factors (b) and (d) defined in para. 2.2. For factor (d), consideration of the time following a postulated initiating event before the function is called upon may permit the SSC to be moved into a lower class, provided that its expected reliability can be demonstrated. Such a demonstration may use, for example, time to repair or maintain the SSC, or the possibility of using alternative SSCs within the time window available to perform the required safety function.
Main 3.21. If an SSC contributes to the performance of several functions of different categories, it should be assigned to the class corresponding to the highest of these categories (i.e. the one requiring the most conservative engineering design rules).
Main 3.22. By applying these and other relevant considerations (e.g. engineering judgement), the final safety class of the SSC should then be selected.
Main 3.23. As explained in para. 2.9, design provisions can be classified directly according to the severity of consequences of their failures:

  • Safety class 1: Any SSC whose failure would lead to consequences of ‘high’ severity.

  • Safety class 2: Any SSC whose failure would lead to consequences of ‘medium’ severity.

  • Safety class 3: Any SSC whose failure would lead to consequences of ‘low’ severity
Main Any SSC (for example, a fire or flood barrier) whose failure could challenge the assumptions made in the hazard analysis should be assigned to safety class 3 at the very least.
Main 3.24. Any SSC that does not contribute to any categorized function, but whose failure could adversely affect a categorized function (if this cannot be precluded by design), should be classified appropriately in order to avoid an unacceptable impact from the failure of the function.
Main 3.25. Where the safety class of connecting or interacting SSCs is not the same (including cases where an SSC in a safety class is connected to an SSC that is not classified), interference between the SSCs should be prohibited by means of a device (e.g. an optical isolator or automatic valve) classified in the higher safety class, to ensure that there will be no effects from a failure of the SSC in the lower safety class.
Main 3.26. By assigning each SSC to a safety class, a set of engineering, design and manufacturing rules can be identified and applied to the SSCs to achieve the appropriate quality and reliability. Recommendations on assigning engineering design rules are provided in Section 4.
Main 3.27. The adequacy of the safety classification should be verified by using deterministic safety analysis, which should be complemented by insights from probabilistic safety assessment and/or supported by engineering judgement8 .
Main 3.28. The contribution of the SSC to reduction in the overall plant risk is an important factor in the assignment of its safety class. Consistency between the deterministic and probabilistic approaches will provide confidence that the safety classification is correct. Generally, it is expected that probabilistic criteria for safety classification will match those derived deterministically. If there are differences, however, further assessment should be carried out in order to understand the reasons for these and a final safety class should be assigned, which should be supported by an appropriate justification.
Main 3.29. The process of verification of the safety classification should be iterative, keeping in step with and informing the evolving design.
Main 4.1. Engineering design rules are the relevant national or international codes, standards and proven engineering practices that should be applied, as appropriate, to the design of SSCs to meet the applicable design requirements.
Main 4.2. Once the safety classes of the SSCs have been established, corresponding engineering design rules should be specified and applied. The engineering design rules should be chosen so that the plant design meets the objective that the most frequent postulated initiating events yield little or no adverse consequences, while more extreme events (those having the potential for the greatest consequences) have a very low probability of occurrence (see Fig. 2).
Main 4.3. Engineering design rules are related to the three characteristics of capability, reliability (dependability) and robustness:

  • Capability is the ability of an SSC to perform its designated function as required;

  • Reliability (dependability) is the ability of an SSC to perform its required function with a sufficiently low failure rate consistent with the safety analysis;

  • Robustness is the ability to ensure that no operational loads or loads caused by postulated initiating events will adversely affect the ability of the SSC to perform its function.
Main These characteristics should be defined, with account taken of uncertainties.
Main 4.4. A complete set of engineering design rules should be specified to ensure that the SSCs will be designed, manufactured, constructed, installed, commissioned, operated, tested, inspected and maintained to appropriate quality standards. To achieve this, the design rules should identify appropriate levels of capability, reliability (dependability) and robustness. The design rules should also take due account of regulatory requirements relevant to safety classified SSCs.
Main 4.5. It is reasonable to distinguish between design requirements that apply at the system level and those that apply to individual structures and components:

  • Design requirements applied at the system level may include specific requirements, such as single failure criteria, independence of redundancies, diversity and testability.

  • Design requirements applied for individual structures and components may include specific requirements such as environmental and seismic qualification, and manufacturing quality assurance procedures. They are typically expressed by specifying the codes or standards that apply.
Main 4.6. The licensee or applicant should provide and justify the correspondence between the safety class and the associated engineering design and manufacturing rules, including the codes and/or standards that apply to each SSC.
Main 4.7. Once the engineering design requirements have been identified for systems and their individual components, it should be verified that the system can perform its function with the reliability that was assumed in the safety analysis.

  • EUROPEAN ATOMIC ENERGY COMMUNITY, FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, WORLD HEALTH ORGANIZATION, Fundamental Safety Principles, IAEA Safety Standards Series No. SF-1, IAEA, Vienna (2006).

  • INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Power Plants: Design, IAEA Safety Standards Series No. SSR-2/1, IAEA, Vienna (2012).

  • INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4, IAEA, Vienna (2009).

  • INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna, (2011).

  • INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Radioactive Material and Associated Facilities, IAEA Nuclear Security Series No. 14, IAEA, Vienna (2011).

  • INTERNATIONAL ATOMIC ENERGY AGENCY, IAEA Safety Glossary, Terminology Used in Nuclear Safety and Radiation Protection, 2007 Edition, IAEA, Vienna (2007).
Main