Nuclear-Ship Code Code of safety for nuclear merchant ships - Res. A.491(XII)

00 Preamble

1 The Code of Safety for Nuclear Merchant Ships has been developed as a guide to Administrations on Internationally accepted safety standards for the design, construction, operation, maintenance, inspection, salvage and disposal of nuclear merchant ships. It supplements applicable international conventions, codes and recommendations adopted by the Inter-Governmental Maritime Consultative Organization (hereinafter referred to as "the Organization").

2 This Code supersedes the Recommendations Applicable to Nuclear Ships annexed in Attachment 3 to the Final Act of the International Conference on Safety of Life at Sea,1974.

3 Paramount to the provisions of the Code is the priority given to the two main safety objectives:
.1 the protection of persons and of the environment, especially against unacceptable hazards due to the intentional or accidental emission of ionizing radiations and the release of radioactive substances, both at sea and in ports; and
.2 the safeguarding of the ship not only with respect to strictly nuclear hazards but also to those arising from interactions between the nuclear propulsion plant, the remainder of the ship, including its cargo, the sea and the ship's environment.

4 While development of the Code has been based upon established and accepted ship-building, marine and nuclear engineering principles, it is recognized that review will be necessary as technology Progresses. Initial application of the Code is restricted to conventional types of ships propelled by nuclear propulsion plants with pressurized light water type reactors.

5 To minimize the probabilities and consequences of failure of any nuclear component, system, structure or combination thereof, the Code is based on a philosophy of the defence-in-depth concept whereby independent safety systems complement the basic Integrity of the nuclear process systems.

01 Definitions

Component , active: A component whose functioning depends on an external input, such as actuation, mechanical movement, or supply of power, and which therefore influences system processes in an active manner.* (see "Component, passive")

* Examples of active components are pumps, fans, relays and transistors. It is emphasized that this definition is necessarily general in nature as is the corresponding definition of passive components. Certain components, such as rupture discs, check valves, safety valves, injectors and some solid-state electronic devices, have characteristics which require special consideration before designation as an active or passive component.
Component, passive: A component which has no moving part and only experiences such changes as changes in pressure, in temperature or in fluid flow in performing its functions. In addition, certain components which function with very high reliability based on irreversible action or change, may be assigned to this category. * (see ''Component , active'')

* Examples of passive components are heat exchangers, pipes. vessels. electrical cables and structures. It is emphasized that this definition is necessarily general in nature as is the corresponding definition of active components. Certain components, such as rupture discs, check valves, safety valves. injectors and some solid-state electronic devices. have characteristics which require special consideration before designation as an active or passive component.
Containment structure: That enclosure or boundary consisting of passive and active components designed to contain, within acceptable limits, releases of radioactivity from the primary pressure boundary .

Controlled area: An area or space where exposure to radiation or contamination can occur under PPC 1 and 2 which is subject to special rules for the purposes of protection against ionizing radiation and to which access is controlled. In a controlled area the dose equivalents received by exposed persons are likely to exceed 3/10 of the dose-equivalent limits recommended by ICRP for occupationally exposed persons.

Convention: The international Convention for the Safety of Life at Sea,1974. Term Definition

Design basis: The conditions selected as the basis for the design of a specific structure, system or component which performs a safety function for a postulated event or combination of events.

Design basis accident: A postulated accident which represents the design basis for the ship and the nuclear propulsion plant safety systems.

Dose equivalent: Quantity expressing the absorbed dose weighted by the quality, distribution and other relevant factors. The purpose of the dose equivalent is to estimate the effects of radiation doses received by persons. The unit of dose equivalent is the sievert (Sv); see ICRU definition .

Dose-equivalent limits: The annual limits on dose equivalent from ionizing radiation recommended by ICRP for occupationally exposed persons or for members of the public as may be appropriate.

Emergency control position: A location in the ship from which complete or partial control of systems or components essential to reactor safety may be exercised , if control from the main control position is precluded

Habitability: Those environmental conditions (space, temperature, humidity, radiation �d�d) which are necessary to allow the continuous stay of the personnel for a given period of time.

Intermediate cooling circuit: A cooling circuit, other than the secondary feed or main steam circuits, which over part of its length is separated from the primary coolant by a single physical boundary .

Loss of coolant accident LOCA: A postulated accident that results in loss of reactor coolant at a rate exceeding normal make-up capability.

New ship: A ship the keel of which is laid or which is at a similar stage of construction on or after the date six months after the Assembly of the Organization has adopted the Code.

Normal operation: Those conditions of a nuclear ship when all structures, equipment and systems are capable of performing their safety related functions within the specified operating limits and conditions including start-up, power operation , shutdown, maintenance, surveys, testing and refuelling.

Nuclear propulsion plant NPP: The total ship main propulsion system, including the nuclear steam supply system (NSSS).

Nuclear ship: Any merchant ship the normal mode of propulsion of which is based upon nuclear energy and whose characteristics are those of conventional displacement ships.

Nuclear steam supply system NSSS: That part of a nuclear propulsion plant intended for steam generation .

Occupationally exposed persons: Persons occupationally exposed to ionizing radiation. *

* ICRP has suggested that conditions of work may be divided into two classes:
working conditions A (dose equivalent greater than 3/10 of the dome-equivalent limits recommended by ICRP for occupationally exposed persons) ;
working conditions B (where it is most unlikely that dose equivalents will exceed 3/10 of the dose-equivalent limits recommended by ICRP for occupationally exposed persons) .
Plant process condition PPC: Events which may be encountered during normal operation, or anticipated operational occurrences or accidents, or may be imposed on the ship as a result of external or internal , natural or man-made phenomena.

Primary pressure boundary: That envelope of the nuclear steam supply system , up to and including the second isolation valve. that contains or may contain primary coolant at reactor power operating temperature and pressures.

Quality: The quality of an item of plant or equipment means its ability to perform the function for which it has been designed.

Quality assurance: Comprises all those Planned and systematic actions necessary to provide adequate confidence that a structure, system or component will perform satisfactorily in service. It includes quality control.

Quality control: Comprises those quality assurance actions related to the physical characteristics of a material, structure, component or system which provide a means of controlling the quality of the material , structure, component or system to pre-determined requirements.

Radioactive waste, gaseous: Any gas which originates from the NSSS or from treatment or storage of radioactive wastes.

Radioactive waste, liquid: Any liquid which originates from the NSSS or from control1ed areas.

Radioactive waste , solid: Any solid which originates from the NSSS or from filtration or treatment of other radioactive wastes or from controlled a react or from decontamination .

Reactor compartment: That compartment of the ship containing the nuclear components bounded by the hull, the bulkhead deck and fore and aft by athwartship cofferdams or bulkheads.

Reactor control room: A space of the ship containing the facilities for controlling and supervising reactor operation under normal, anticipated operational occurrences and accident conditions, including the means of shutting down the reactor and maintaining it in the cold subcritical condition. (See also " Emergency control position") .

Relief valve: A valve actuated manually or automatically to control system parameters to desired values by limiting , for example, pressure or rate of flow

Residual heat: The sum of the heal originating from decay ( radioactive decay and shutdown fissions) and the heal stored in reactor related structures and in heat transport media.

Responsible organization: The organization having overall responsibility for the nuclear ship, recognized by the Administration.

Safety Assessment: A document, approved by the Administration, in which all facets of the ship and its nuclear propulsion plant are described, including its design, construction and operation under normal and accident conditions.

Safety classes: A ranking of structures, systems and components according to their importance for nuclear and ship safety This importance is evaluated in the light of the consequences of loss of the function performed by these items of plant and equipment in the various foreseeable situations.

Safety enclosure: An enclosure which completely surrounds the containment structure and any significant source of radioactivity associated with the NSSS.

Safety system: Any system important to safety Provided to assure, in any condition, the safe shutdown of the reactor and the heat removal from the core, and/or to limit the consequences of anticipated operational occurrences and accident conditions.

Safety valve: An automatic pressure relieving device actuated by the static pressure upstream of the valve and characterized by rapid full opening so as to limit the pressure.

Shielding: Means of reducing radiation exposure below specified levels by interposing a barrier of attenuating material .

Shutdown: The procedure of rendering a reactor subcritical or the state of a reactor in a subcritical condition.

Single failure: A random occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failuses resulting from a single occurrence or from an operator's error followed by a malfunction, are considered to be part of the single failure.

Supervised area: An area or space where exposure to radiation or contamination can occur under PPC 1 and 2 which is subject to appropriate supervision for the purpose of protection against ionizing radiation. In a supervised area the dose equivalents received by exposed persons are likely to exceed 1/10 of the dose-equivalent limits recommended by ICRP for occupationally exposed persons.

Ultimate heat sink: The atmosphere or a body of water to which heat is transferred during normal operation, anticipated operational occurrences or accident conditions.

Uncontrolled area: Any area in the ship which is not a controlled or supervised area for the purposes of protection against ionizing radiation. In an uncontrolled area, the don equivalents received by exposed persons in PPC 1,2 and 3 are not likely to exceed the dose-equivalent limits recommended by ICRP for members of the public.

Volumetric examination: A procedure for investigating the complete body volrome of a component for flaws arid cracks by non-destructive methods, such as ultrasonic inspection. radiography or other appropriate means.

Chapter 1 General

1.1 Purpose

1.1.1 This Code is intended to provide a technical and regulatory reference for nuclear merchant ships. It supplements other applicable international conventions, codes and recommendations promulgated by the Organization and defines specific safety problems which should be addressed. Appropriate criteria are included to protect people and the environment from radiological hazard throughout all phases of the ship's life cycle: design, construction, commissioning, operation and decommissioning.

1.1.2 Owing to the special features of nuclear energy and the mobility of a nuclear ship, international consensus is required on the provision of technical and administrative constraints during the vessel's life cycle.

1.2 Application

The Code should be applied to new ships. The application of the Code to existing ships should be decided by the Administration to the extent it deems necessary .

1.3 General safes principles

1.3.1 The overall safety of the nuclear ship is a Primary objective.. The safety of the nuclear propulsion plant (NPP) is an integral Part of this overall safety. It could be necessary , however, for the safety of the ship, to require operation of the NPP during periods when power would otherwise be reduced or stopped if safety of the NPP were the sole consideration . Continued operation under such conditions should be decided on only after due consideration of the potential radiological hazard to the crew, the general public and the environment.

1.3.2 Radiological hazards present in a nuclear ship should be controlled to the extent necessary to ensure adequate protection for people and the environment. Measures to ensure the containment of radioactive materials and the attenuation of ionizing radiation should be taken when the ship is being designed, constructed, commissioned, operated and decommissioned .

1.3.3 NPP safety should not only reduce radiological risks but also, inter alia, those risks arising from concentrated energy sources, such as high pressure and high temperature fluids, by appropriate means to minimize the occurrence of accidents and the severity of their effects .

1.3.4 The provisions of this Code specifically address hazards that exist by virtue of the NPP of the ship, but Administrations should also recognize other hazards which affect conventionally powered ships and for which provisions have been made in other conventions or codes.

1.3.5 The following general principles should be adopted in meeting the requirements of the Code:
.1 Releases of radioactive products, under any PPC, should be prevented or controlled to the dose-equivalent limits by the provision of a series of successive physical barriers between the nuclear fuel and the environment. This defence-in-depth concept requires that:

.1.1 the fuel cladding, which is the first barrier, has among its functions the safes function of retaining radioactive fission products from the fuel;
.1.2 the primary pressure boundary , which is the second barrier, has among Its functions the safety function of preventing the unintentional release of radioactive material from the primary system ;
.1.3 the containment structure, which is the third barrier and totally contains the primary pressure boundary, has as its principal role the safety function of limiting the leakage of radioactive material from any contained equipment, under any PPC; and
.1.4 the safety enclosure, which is the fort rte barrier, surrounds the containment structure and any significant source of radioactivity associated with the NPP and has as its principal role the safety function of preventing the unintentional release and limiting the leakage of radioactive material..2 Protection against the effects of irradiation should be provided by applying, either singly or in combination , appropriate measures such as:

.2.1 interposing adequate shielding;
.2.2 establishing controlled areas of the ship;
.2.3 limiting exposure times;
.2.4 preventing the unnecessary approach of persons to sources of radiation; and
.2.5 actions by the personnel in emergencies in accordance with plans and instructions.
.3 The design of the NPP should ensure that human action is not required to start or operate protection and safety systems during the initial period of an emergency situation .

1.3.6 Effective containment of radioactive material and attenuation of radiation should be assured through a series of arrangements whose efficacy can be demonstrated for all plant process conditions (PPCs). This series of arrangements should be based upon:
.1 preventive measures ensuring high standards of design and execution, and adequate safety margins;
.2 monitoring facilities for detecting any encroachment into these margins; and
.3 means of action for preventing accident situations from developing or, failing that, for limiting consequences.

1.3.7 A nuclear ship should be designed, constructed, tested, inspected, operated and decommissioned under the quality assurance programme (QAP). Principles of quality assurance are as follows:
.1 For the NSSS and for its interface with the rest of the ship the basic requirements for the establishment and implementation of the quality assurance programme are given in the IAEA Safety Series No.50-C-QA and outlined in Appendix 5 of this Code. However, it should always be recognized that the basic responsibility for achieving quality in performing a particular task (i.e. in design in manufacturing, in commissioning, in operation in decommissioning) rests with those to whom the task is assigned and not with those seeking to ensure by means of verification that such quality has been achieved .
.2 At all stages in the ship's life cycle, a single organization responsible for the management and control of the overall QAP should be identified .
.3 In the event of a change of responsible organization, the transfer of responsibility should be so made that it does not interfere with the implementation of the QAP.
.4 As a precondition to Administration approval for the construction of a nuclear ship, a QAP should be developed by the responsible organization, describing the QAP to be followed throughout the entire lifetime of the ship to ensure its compliance with the provisions of the Code and other applicable regulations a no conventions.
.5 The complete description of the QAP should be included in the Safety Assessment approved by the Administration.
.6 The Administration or its competent authority should ascertain that the responsible organization establishes and implements the QAP in accordance with the provisions of this Code and with the commitments of the Safety Assessment
.7 The QAP requirements should be applied to structures , systems and components assigned to each of the safety classes.
.8 The extent to which the individual requirements should apply will depend upon:

.8.1 the safety classification of the item;
.8.2 the need for special controls, administrative measures and surveillance over processes, methods a equipment;
.8.3 the degree to which compliance with design requirements can be demonstrated by inspection or test;
.8.4 the quality, history and degree of standardization of the item;
.8.5 the accessibility, including both physical and environmental consideration, of the component after installation in the plant for maintenance, in-service inspection and replacement.
.9 However, in all cases a QAP consistent with the provisions of IAEA Safety Series No.50-C-QA should be implemented .

1.3.8 The dose equivalent likely to be received by persons on board or in the vicinity of the ship doring norma1 operation should be kept as low as is reasonably achievable and in any case not exceeding the dose-equivalent limits or, where they exist, the individual limits set by the competent authority.*

1.3.9 As a general principle governing the acceptability of accident risks, the probability of occurrence of accident situations should be in inverse ratio to the severity of their consequences. In assessing accident situations, the possible interactions between the NPP, the ship, its cargo and its intended service must be considered.

1.3.10 For all NSSS safety and protection systems, and elsewhere if specifically required, the single failure criterion as defined in Appendix 6 and in 2.6.3 should apply .

1.3.11 As a means of satisfying the single failure criterion in particular and of reducing the probability of failure of essential systems in general, four important concepts should be incorporated in the design of systems for nuclear ships. These provisions, which might be applied singly or in combination, are aimed at reducing the probability of system or component failure. They are:
.1 redundancy - which refers to the replication of systems or components to Provide excess capability for fulfilling an essential function;
.2 independence - which requires that the functioning of one system does not rely in any way upon the functioning of another given system ;
.3 segregation - which means the physical separation of systems performing a common function to reduce the probability of concurrent loss from a common external cause; and
.4 diversity - which means the protection of systems and components performing the same task from common mode failure, by having them differ from each other as regards design, operation , manufacturer, etc.

1.3.12 The following specific obligations should be imposed upon contractors and the responsible organization :
.1 The responsible organization should ensure that in any contract that it negotiates with a constructor, all safety principles are followed and are supplemented by any additional provisions that this responsible organization may deem necessary;
.2 Sub-contractors and prime contractors should bring to the attention of the Prime contractor and of the responsible organization any additional measures they consider would effectively improve the application of the general safety principles;
.3 At all phases of the ship's life cycle, a clearly designated authority should be appointed who is responsible to the Administration for the safety of the ship and its NPP. For the purpose of this Code, the designated authority is the responsible organization. In these countries where the Administration issues a licence to operate a nuclear ship, the responsible organization should also be the licensee; and
.4 The responsible organization for the safety of a nuclear ship should ensure that the ship's Safety Assessment is made available to hosts governmental authorities and kept up to date.

---

* Reference is made to ICRP Publication 26.

1.4 Principles of risk acceptance

1.4.1 In no human activity can safety be absolute and therefore no rule can be perfect. In the case of conventional ships, it is usually possible to prescribe in detail certain aspects of their design or construction by referring to a degree of risk that has been accepted on an empirical basis for a long period of lime without ever having been defined. In the case of nuclear ships, which pose specific safety problems, a more systematic approach is essential . It is therefore appropriate to rank situations qualitatively according to their frequency and consequences. These two concepts are introduced as follows:
.1 situations which are required to be considered in the design of the NPP are classified according to their likelihood of occurrence, which may range from continuous to extremely remote;
.2 for each class of occurrence frequency, a consequence limit is set - these limits may be raised as the frequency of the postulated situation becomes lower.

1.4.2 Situations are defined in this Code as plant process conditions (PPCs). They are assigned to 4 classes of PPC according to their general frequency of occurrence and their consequences as indicated in table 1.1. Typical examples of the classification of PPCs are given in 2.5.

Table 1.1

PPC	General description	Likelihood of occurrence	Consequence class
1 2 3 4	Normal operation Minor occurrences Major occurrences Severe accident	Continuous of frequent Infrequent Remote Extremely remote	1 2 3 4

Note: PPC 4 may be further subdivided into two categories. Category 4A should be used for those PPCs if some engineered energy sources are available. Category 4B should be used if no engineered energy sources are available.

1.4.3 The frequency classification of PPCs corresponds to the following qualitative descriptions:
.1 continuous if the PPC occurs continuously or is likely to occur often during the or frequent: service life of a given nuclear ship;
.2 infrequent: if the PPC will not occur often but is likely to occur several times during the lifetime of a given nuclear ship;
.3 remote: if, in principle, the PPC should not occur in the case'of a given nuclear ship, but could occur in a few nuclear ships of the same type during their service life;
.4 extremely if, in principle, the PPC should not occur during the total service life remote: of a certain number of nuclear ships of the same type, but is nevertheless possible.

1.4.4 Consequences for each class of PPC are defined as follows:
.1 Class 1 consequences: the ship and its NSSS operate with in the radiological limits for normal operation as defined in 6.3.1.1;
.2 Class 2 consequences: those which arise from unplanned occurrences without disturbing significantly the operation of the ship and which do not result in a dose equivalent in excess of the relevant dose-equivalent limit for occupationally exposed persons as measured at the ship's hull or at its vertical projection;
.3 Class 3 consequences: those that may involve a limited unavailability of a ship, either singly or in combination; a degradation of the ship's structure or NPP equipment; injuries; the need for external assistance; but do not result in a dose equivalent in excess of the relevant dose-equivalent limit for occupationally exposed persons as measured at the ship's hull or at its vertical projection;
.4 Class 4 consequences; those that may ultimately involve, either singly or in combination. loss of life or loss of the ship but do not result in a dose equivalent in excess of that laid down in 6.3.1.3 as measured at the ship's hull or at its vertical projection.

1.4.5 The frequency class to which each postulated occurrence has been assigned , should be described in the Safety Assessment and supported by objective evidence. The Administration should ensure that the assignment of an occurrence to any particular frequency class is acceptable.

1.4.6 The consequences of each postulated occurrence examined should be analysed to an appropriate degree of detail in the Safety Assessment, and the results should be consistent with the general principles given in th is section.

1.5 First commissioning of a nuclear ship and further surveys

1.5.1 Prior to building a nuclear ship, the Administration should review the preliminary plans and the Safety Assessment (see Appendix 3) and make further recommendations, if needed .

1.5.2 During the building phase, the Administration should carry out suitable surveys, mainly for quality assurance purposes but also to verify that the ship is built in conformity with the documents produced and with any added recommendations.

1.5.3 The Administration should then approve the pre-commissioning test programme and ensure the tests are carried out.

1.5.4 After which , having reviewed the up-to-date documents and the test results, the Administration should then authorize the commissioning and issue the certificate. During all the phases of the life of a nuclear ship, the ship and its NPP should be surveyed by the Administration, in particular to ensure compliance with the provisions of the Code.

1.5.5 The Administration may entrust the inspection and survey to organizations recognized by it, in accordance with Regulation 6 of Chapter I of the convention .

1.6 Review of the Code

1.6.1 The Code should be reviewed for the following reasons:
.1 technical progress in the design of the ships or pressurized light water reactors; and technical progress in the analysis of safety (for instance: in the field of quantitative data);
.2 application of the Code to new types of ship;
.3 change in the classification of degrees of risk, for example, as a result of large numbers of nuclear ships using a port at the same time;
.4 compatibility with future codes and conventions; and
.5 international agreement on revised safety standards.

1.7 Equivalents

The equivalency clause of Regulation 5 of Chapter I of the Convention is applicable to the provisions of th is Code, provided that where the equivalency clause is invoked a description of the equivalency and a justification analysis describing its reliability, should be included in the Safety Assessment.

1.8 Decommissioning or loss

1.8.1 The decommissioning of a nuclear ship may be intentional or unintentional, temporary or final. Intentional decommissioning refers to situations where the responsible organization or Administration considers that, for safety or any other reason , the ship should not be kept in service. Unintentional decommissioning occurs when a sea mishap or other cause renders the ship or its NPP unfit for service.


1.8.2 In the case of temporary decommissioning, or during the initial phase of final decommissioning, the responsible organization should take monitoring and safety measures appropriate to the potential hazards, nuclear or other, according to the state of the ship and its NPP The monitoring and safes teams should be given the necessary authority and facilities for dealing with any incident of internal or external origin involving the ship or its NPP.

1.8.3 The operations directly or indirectly concerned with the intentional or planned decommissioning of a nuclear ship should satisfy the requirement to protect man and his environment from unacceptable hazards that may be caused by the ship after its NPP has finally been shut down.

1.8.4 The likelihood of unintentional decommissioning, due to mishaps at sea, incidents of internal or external origin , acts of sabotage or any other unintended cause, should be considered during the design of the ship. Where appropriate, measures should be provide to prevent their occurrence or limit their consequences.

1.8.5 Where it is no longer possible to assure the overall safety of the ship, nuclear safes, which hitherto constituted one aspect of overall safety, should become the principal objective in both the short and long term.

1.9 Recovery following loss

1.9.1 The possible radiological consequences of the ship's sinking depend on the power level at which the NPP was operating beforehand, the various transients affecting it during the sinking process. and the final position of the wreck The sinking also affects:
.1 the continued supply of power and coolant, etc., to the NPP: and
.2 the possibility of operating control and safety equipment.

1.9.2 Consideration of the feasibility of recovering the wreck or part of it should be reflected in the design where this proves technically possible.

1.9.3 The marking and the surveillance of the wreck should be arranged as far as practicable.

Chapter 2 Design criteria and conditions

2.1 Basic criteria and safes functions

2.1.1 To ensure adequate safety during all PPCs, three basic safety criteria should be observed .
.1 Criterion A: Means should be provided adequately to shield radioactive sources and to minimize the Potential for the release of radioactive substances, so that exposure of those on board, the public and the environment will be kept as low as is reasonably achievable.
.2 Criterion B: Means should be provided to remove residual heat safely from the reactor core.
.3 Criterion C: Means should be provided to control and shut down the reactor safely and to maintain it in that state as long as necessary.

2.1.2 The following safety functions are generally necessary to satisfy the criteria given in 2.1.1. However, it may be necessary to supplement these functions in cases of special designs.
.1 Safely functions necessary to achieve criterion A are:

.1.1 to maintain acceptable integrity of the cladding of the fuel in the reactor source the first barrier;
.1.2 to maintain the integrity of the reactor primary pressure boundary as the second barrier;
.1.3 to prevent an unintentional release and limit the leakage of radioactive material from the containment structure as the third barrier;
.1.4 to prevent an unintentional release and limit the leakage of radioactive material from the safety enclosure as the fourth barrier.
.2 Safety functions necessary to achieve criterion B are:

.2.1 to transfer residual heat from the reactor core to an ultimate heat sink;
.2.2 to maintain sufficient coolant inventory for the core; and
.2.3 to provide services necessary for safety systems.
.3 Safety functions necessary to achieve criterion C are:

.3.1 to adequately control reactivity;
.3.2 to render the reactor subcritical without exceeding any of the specified fuel design limits; and
.3.3 to provide services necessary for safety systems.

2.2 Safety classes and design classes

2.2.1 Systems should be assigned a safety class, based upon the importance of the consequences of the loss of the function performed by the system. Requirements for materials, design, construction, testing, inspection and operation should reflect the assigned safety classification. The following typical allocation of safety classes is for general guidance only and is not intended to be a definitive requirement.

2.2.2 Safety class 1 (SC-1) applies to the following items:
.1 Reactor Protection system and the scram system;
.2 The pressure vessel and components of or with in the primary pressure boundary and core support structure whose failure could cause a PPC 3 or 4. Components connected to the reactor coolant system and forming part of the primary pressure boundary, need not be assigned to SC-1 , provided that:

.2.1 for Postulated fail use of the component during normal reactor operation, the reactor can be shut down and cooled down in an orderly manner assuming ma he-up is provided by the reactor coolant make-up system only; or
.2.2 the component is or can be isolated from the reactor coolant system by two valves. Each open valve must be capable of automatic actuation. The closure time should be such that in the event of postulated failure of the component during normal reactor operation , each valve remains operable and the reactor can be shut down and cooled down. in an orderly manner; and
.3 The steam generator shell and Main piping including the isolating valves on the steam line.

2.2.3 Safety class 2 SC-21 applies to the following items:
.1 Components of primary pressure boundary not covered by SC-1 ;
.2 Containment structure and its safety systems;
.3 Components and systems or subsystems which are necessary to:

.3.1 remove residual heat from the core under PPC 2,3 or 4 occurrences;
.3.2 control radioactivity released within the containment structure;
.3.3 control hydrogen within the containment after a loss of coolant accident;
.3.4 cool the core in an emergency (ECCS including emergency electrical power supply . accumulators, coolant tanks, etc.);
.3.5 cool the containment and/or suppress the pressure after loss of coolant accident;
.3.6 make up reactor coolant, as a safely function; and
.3.7 ensure any other function which may have results of similar importance to safety;
.4 Energy supply systems of the reactor protection system;
.5 Control rod drive and supply systems;
.6 Air clean-up system for the containment structure, including any portions of the clean-up system , external to the containment structure, that act as an extension of the containment structure boundary during clean-up recirculation;
.7 Primary over pressure protection and primary blow-down system, not covered by SC-1; and
.8 As determined by the Administration and recorded in the Safety Assessment. other ship equipment whose failure could directly cause a PPC 3 event affecting the NSSS.

2.2.4 Safety class 3 (SC-3) applies to the following items:
.1 Any safety system of the NSSS or portion thereof not covered by SC-1 or SC-2;
.2 Ancillary systems that Provide support for safety systems, such as: lubricating oil systems, hydraulic systems, seawater coolant circuits, compressed air systems, and fuel oil systems for ECCs emergency power generators;
.3 Seawater coolant circuits, fulfilling safety functions required to satisfy criterion B; and
.4 Systems that are not safety systems but whose failure would result in an unacceptable release, to the environment, of gaseous radioactive material , which would normally be held for time decay. Waste processing systems and purification circuits of the make-up loop are examples.

2.2.5 Safety class 4(SC4) applies to the following items:
.1 Secondary steam and feedwater systems that form part of the heat removal system and are located outside the containment structure beyond the second isolation valve, provided that an alternative redundant and independent system is available to transport heat to an ultimate heat sink;
.2 Turbines and condensers, including reactor-fed turbo generators not covered by SC-1,2, or 3, where required to act as heat sinks;
.3 Structure for the safety enclosure, the structure for collision protection and the structure in way of the reactor. except where covered by SC-3;
.4 Other ship equipment whose failure could directly cause a PPC 2 event;
.5 NSSS components not covered by SC-1,2 or 3.

2.2.6 Safely class assignment should be determined by system evaluation on a case-by-case basis, stated in the Safety Assessment, and should be approved by the Administration .

2.2.7 Within each safety class, every system or component should be assigned an appropriate design class, ranging from DC-1 to DC-4. Each design class defines specific standards of design, manufacture and quality assurance that are commensurate with the effect of failure of the system or component on the safety of the ship.

2.2.8 Design class 1 (DC-1) requires application of the highest standards of design and quality assurance. and includes the following provisions:
.1 For pressure retaining components, design requirements should be based upon the following considerations:

.1.1 load conditions, including:
.1.1.1 steady pressure loads;
.1.1.2 pressure transient during manoeuvring, shutdown or startup;
.1.1.3 pressure fluctuations due to inertial forces caused by extreme ship motions for all design sea states (see 2.3);
.1.1.4 steady and transient thermal loads;
.1.1.5 dynamic forces arising from loss of coolant accidents, acting on the primary system pressure boundary, its internals and its supporting structure;
.1.1.6 dynamic forces caused by pipe whip or a double ended pipe rupture;
.1.1.7 dynamic forces arising from any other accident postulated under PPC 3 or 4;
.1.1.8 ship-induced vibration effects;
.1.1.9 inertial forces from ship motions in a seaway, defined in table 2.1 for SC-1 ;
.1.1.10 continued operation when the ship is experiencing a static list of up to 30° or rolling angles of up to 45° or is inclined up to 10° either in the fore or aft direction , or is in any combination of angles within those limits. These angles may be reduced if it can be proven to the satisfaction of the Administration that the ship does not experience such attitudes, in which case the allowed reduction should be shown in the Safety Assessment;
.1.1.11 ensuring that their integrity is preserved at all angles of inclination;
.1.2 detailed stress analysis, to detect local bending and local peak stress under the load conditions referred to in .1.1 above;
.1.3 response analyses, with respect to dynamic loads from a seaway, pipe rupture accident, action of quick closing valves, and forced vibration from shipborne sources;
.1.4 for application of .1.3 above, relatively low damping factors should be assumed and where it can be proven to the satisfaction of the Administration that no significant resonance effects are possible, response analysis for ship vibrations may be waived;
.1.5 detailed analyses of brittle and ductile fracture beheaviour, assessment of fatigue and crack propagation and evaluation of allowances for acceptable flaws - the effects of radiation should be included in the analyses;
.1.6 in material selection;
.1.6.1 sufficiently high strength and ductility;
.1.6.2 proven fracture toughness values;
.1.6.3 developed knowledge of crack growth rates; and
.1.7 extensive testing of materials to Prove the properties referred to in.1.6 above and supervision of important tests by a qualified surveyor;
.2 Pressure-retaining shells and components of pumps and motors that are highly stressed - i.e. where the principal stress tends towards the maximum allowable stress value - should allow for unrestricted non-destructive testing, during periodic surveys, to detect and monitor flaws and cracks in their surface and body volume;
.3 Pressure-retain ins shells should;

.3.1 be welded with full penetration welds;
.3.2 have supporting structures, nozzles and standpipes integral with the shell;
.3.3 have reinforcement of openings and flanges adequate to maintain design stresses; and
.3.4 be generally designed and constructed to well established procedures and be of the highest quality.
.4 DC-1 components, other than pressure-retaining components, should be designed and constructed to the satisfaction of the Administration if not otherwise defined and should be of a quality commensurate with their importance to safety .

2.2.9 Design class 2 (DC-2) requires that components assigned to this class meet a high standard of design and quality assurance, including the Provisions of the following paragraphs:
.1 Loads applied to pressure-retaining structures and to their supports and to machinery components whose principal stress tends towards the maximum allowable stress value, should include the sum of static and dynamic. influences due to Process variables and ship motions in a seaway. As a minimum requirement, normal accelerations supplemented by load factors to account for other dynamic effects, should be applied;
.2 Stress analysis, where necessary, should follow relevant rules and. standards. Normally, scantlings should follow the requirements of the Administration, or of an organization duly recognized by the Administration. Piping should be analysed for temperature loads where temperatures exceed 120° and for static reaction to pressure, using dynamic load factors when considering inertia loads from dead weight and ship motions. Small diameter piping should satisfy the requirements of the Administration;
.3 Response analysis for piping systems need be carried out only where high or low temperature limits set in relevant codes or standards are exceeded, or in those cases involving particular accident conditions that require proven component reliability;
.4 Material choice , material testing and surveys should follow the requirements for the highest class boilers and pressure vessels, that are applied by the Administration or an organization duly authorized by it;
.5 Design and construction procedures should follow general experience in pressure vessel and piping design for ships, following the requirements for high temperature steam piping set by the Administration or an organization duly authorized by It: and
.6 The pressure-retaining shell of the containment structure should be designed to withstand :

.6.1 pressure and temperature variations arising from a loss of coolant accident, combined with stresses due to ship motions in a seaway defined in table 2.1 for SC-2; and
.6.2 pressure differences occurring during sinking of the ship and pressure differences due to subsequent flooding of the containment structure at a temperature of 4°.

2.2.10 Design class 3 (DC-3) should correspond to the same design standards as those used for ship boilers and steam piping, tool lowing the requirements of the Administration or an organization duly authorized by it.

2.2.11 Design class 4 (DC-4) should follow international and national standards for design, construction and testing. considering the inertial forces acting on components.

2.2.12 Design class assignment should be determined by system evaluation on a case-by-case basis and should be approved by the Administration.

2.2.13 Design classes do not necessarily correspond numerically with safely classes.

2.3 Environmental conditions

2.3.1 Local meteorological conditions, as well as population density and land usage factors, should be included when analysing the effect of a nuclear ship on ports being used. Results obtained from this analysis should be presented in the Safety Assessment.

2.3.2 As required by the various PPCs design considerations for the ship and its NPP should consider the effects of natural phenomena, such as extraordinary seaways, tornadoes, tsunamis, hurricanes, winds, snow and ice, applicable to the ship's service.

2.3.3 The inertial forces acting on the ship in a seaway should be analysed with respect to the safely classes. This analysis should exam me the motion of the ship in six degrees of freedom, utilizing wave spectrum fort the intended area of operation. Where such wave data are not available, alternative analysis acceptable to the Administration may be used.

2.3.4 SC-1 components and structures should be capable of withstanding the maximum inertial forces calculated. SC-2 to 4 should be capable of withstanding a portion of the maximum inertial forces according to table 2.1, commensurate with their safety functions.

2.3.5 As a guideline, the inertial forces acting on the ship in a seaway may be based upon North Atlantic seaway data, assuming that the ship encounters that seaway with equal frequency from all directions, over the number of days shown in table 2.1, for any required safety class.

TABLE 2.1 *
ASSUMED NUMBERS OF DAYS IN SEAWAY IN NORTH ATLANTIC

Safety class or structure	Number of days
Safety class 1	15,000
Safety classes 2 and 3	1,500
Safety class 4, hull, and equipment and machinery not covered by international or national standards	150

*See Appendix 2.

2.3.6 The Administration may prescribe less severe seaway design requirements for special ships operating only in restricted areas. Such restrictions should be clearly shown on the ship's certificate and in the Safety Assessment, together with the design limits used, such as climatic conditions, accelerations and ship motions in a seaway d using transients, and safety functions.

2.3.7 Shock loads on reactor plant components from accidents such as collision, grounding or explosion should be considered , and reflected in the design.

2.3.8 Motions of the ship in a seaway should be taken into account when evaluating the stability of the reactor control and when evaluating the dynamic behaviour of the reactor, assuming an average as well as an extreme condition of seaway.

2.3.9 The design of components relevant to the reactor protection and of safety systems the operation of which is necessary should withstand without any overstressing or malfunction those steady or dynamic inclinations evaluated assuming any two adjacent compartments flooded but the ship still afloat in a seaway.

2.3.10 Reactor safety systems as well as their energy supplies should be designed to operate without malfunction when the ship is experiencing a static list of up to 30° or rolling angles of up to 45° or is inclined to 10° either in the fore or aft direction, or is in any combination of angles within those limits. A single motion, not exceeding 45° to one side, should not cause a malfunction or overstressing even if it occurs during a fast shutdown operation or reactor excursion. These angles may be reduced if it can be proven to the satisfaction of the Administration that the ship does not experience such attitudes, in which case the at lowed reduction should be shown in the Safety Assessment .

2.3.11 For operation of equipment and machinery not covered by 2.3.10 the requirements of Regulation 2(f) of resolution A.325(IX) apply.

2.3.12 For design of air conditioning systems for controlled areas and electronic equipment of safety systems, extreme values of relative humidity should be assumed.

2.3.13 Consideration should be given in design to the effects of oil vapours from machinery, dust from the cargo, smoke in the event of fire and toxic gases originating from the cargo or the environment.

2.3.14 The effects of propeller and machinery induced vibrations should be considered and where necessary reflected in the design and testing of monitoring devices and control systems and components.

2.4 Nuclear propulsion plant design criteria

2.4.1 The NPP should be designed to operate satisfactorily under seagoing conditions, having regard to the environmental conditions given in 2.3. The NPP should be designed to limit mechanical and cyclical stresses under the effects of vibration, shock loading and accident conditions.

2.4.2 The following constraints govern the operation of the NSSS during any of the plant process conditions (PPCs) outlined in 2.5:
.1 The reactor should be operable and no automatic trip should occur as a result of any PPC 1 occurrence;
.2 PPC 2 occurrences should permit restarting of the reactor, at red traced power, within a reasonable time period, without reduction in safety or loss of safe propulsion;
.3 PPC 3 occurrences may require shutdown of the reactor;
.4 PPC 4 occurrences, as limiting conditions, should not result in unacceptable hazards to the public or the environment, nor exceed the radiation release limits given in 6.6.1 ; and
.5 Radiation doses to the public and to those on board, as a result of PPC 1, 2 or 3 occurrences, should be kept as low as is reasonably achievable and with in the appropriate limits recommended by ICRP.

2.4.3 The NPP should be capable of responding at least as rapidly as a conventional steam turbine plant of similar size and power. It should also be capable of being started from a dead ship condition, without external aid.

2.4.4 The astern power and the load change rate of the steam generators and turbines should be analysed to prove that the ship has a reasonably short emergency stopping distance.

2.4.5 NPP systems of SC-1 to 4 should be designed and constructed to permit adequate testing of their condition and functions. Where they are subject to mechanical , thermal or pressure loading, their strength should also be tested.

2.4.6 Testing for functional capability should be possible on the ECCS, the reactor protection system and the residual heat removal systems. Testing , with the reactor in operation and with the primary system under pressure, should not interrupt the performance of safety functions, lower the level of redundancy of any system below the required minimum, nor impair necessary operation of the system.

2.5 Plant process conditions

2.5.1 As presented in table 1.1, PPCs are assigned to the 4 classes in accordance with their frequencies and consequences. Such classification of occurrences in the PPC should be considered as requirements. Therefore in the Safely Assessment it should be demonstrated by objective evidence that the frequency and consequences of any occurrence is not higher than that corresponding to the class to which it is assigned. Differences in ship and NPP design, and in frequency or consequences, may dictate that a specific situation be assigned a different PPC class from that shown as guidance in this section. For PPC 4 conditions, the designer must lustily the severity of the accident considered. Some accidents may be more severe than the PPC 4 situations for which the dose limits of Chapter 6 apply and for these cases no guidance is given in this Code.

2.5.2 PPC 1 includes frequently occurring planned or unplanned situations, such as: .1 startup operation;
.2 low power standby or port operation;
.3 power operation;
.4 trials;
.5 routine inspection and maintenance;
.6 ship manoeuvring;
.7 heavy weather;
.8 cargo handling;
.9 cold water injection by make-up or feed systems, if any;
.10 design over-power operation, as far as considered in the design and operation specification; or
.11 shutdown .

2.5.3 PPC 2 includes infrequent unplanned situations occurring during routine operation, or special planned procedures carried out during abnormal operations, such as:
.1 failure or maloperation of an active component possibly resulting in temporary reduction of power or maneouvrability of ship, for example:

.1.1 electrical generator trip;
.1.2 turbine trip;
.1.3 condenser shutoff;
.1.4 seawater cooler closure;
.1.5 feedwater supply shutoff;
.1.6 closure of main steam valves; or
.1.7 failure of main electrical system, steering gear, or anchoring equipment;
.2 inadvertent coolant or feedwater pump startup;
.3 cold water injection after fail use event;
.4 error of operator;
.5 failure of a single component in reactor protection or other safety system;
.6 inadvertent operation of pressure relief valves or overpressure protection system;
.7 trip of a primary coolant pump;
.8 loss of a main condenser cooling pump;
.9 control rod withdrawal error;
.10 failure of a control component such as turbine regulator or feedwater controller or flow control , etc.;
.11 failure of preheater heating;
.12 minor reactor coolant system leakage requiring temporary reactor shutdown;
.13 blow-down from secondary system; or
.14 temporary loss of main electrical power.

2.5. PPC 3 includes unplanned situations the likelihood of which is remote such as:
.1 leakage of radioactive substances from the primary pressure boundary not resulting in depressurization of the primary system but requiring the application of safety functions such as containment structure isolation , emergency core cooling and reactor shutdown;
.2 significant leakage of radioactive substances after failure in radioactive waste handling and storage system;
.3 leakage of primary coolant into the secondary system requiring reactor shut- down;
.4 failure of controls operating the control rods;
.5 stuck control rod;
.6 failure of primary forced coolant circulation;
.7 failure of secondary feedwater supply;
.8 blow-down from primary system;
.9 failure of coolant supply during drydocking;
.10 stranding without total loss of heat sink, assuming that the ship remains intact;
.11 collision followed by flooding of any two adjacent watertight compartments;
.12 fire or explosion which does not significantly damage the reactor compartment;
.13 fire in machinery or service spaces; or
.14 weather conditions in planned areas of operation, the likelihood of which is remote.

2.5.5 PPC 4a is considered to cover situations the likelihood of which is extremely remote and for which some energy sources are available on the ship, such as:
.1 loss of coolant accident; .2 loss of integrity of waste storage;
.3 stranding, assuming intermittent loss of heat sink and an inclined ship but with the ship essentially intact;
.4 weather conditions the likelihood of which is extremely remote;
.5 control rod ejection, if no mechanical prevention means exist;
.6 grounding with local damage of complete double bottom height or, alternatively, damage over a substantial proportion of the length of the ship; or
.7 collision with fire and/or explosion on board or on the striking/struck ship or in the environs.

2.5.6 PPC 4b situations include those whose likelihood is extremely remote but which would be accompanied by a complete loss of all energy sources, such as:
.1 capsizing, if consideration of this event is deemed necessary by the Administration in accordance with 2.7.2 ;or
.2 sinking in deep water, or shallow water where emergency generating equipment is inoperable.

2.6 General conditions governing accident analyses

2.6.1 Accident analyses should be carried out for the PPCs given below and any other postulated accident scenarios required by the Administration. The principal assumptions made and the results obtained should be presented in the Safety Assessment and reflected in the design of the ship and its NPP.

2.6.2 Accident analyses should be approved by the competent authority and should include , at least:
.1 assumptions made regarding initiating events. conditions existing at commencement of accident situation and corrective measures assumed to be ineffective, If any;
.2 description of effective counter-measures, including details of systems and components initiated by the reactor protection system and any other measures initiated by operating personnel ;
.3 summarized description of the method of analysis employed, including experimental information, practical model tests, mathematical procedures and computer programmes used ;
.4 assumptions and theoretical basis for the calculation of radiological consequences (e.g. activity released from the fuel elements , specific activity of the primary coolant, deposit factors, filter efficiency, leakage rates, dispersion factors and dose factors);
.5 parameters for the calculation of the dispersion factors (e.g. source height and prevailing weather conditions) ;
.6 description of the anticipated course of the postulated accident , including an analytical presentation of its radiological and other consequences; and
.7 provisions made to prevent common mode failures in safety systems.

2.6.3 Assumptions for the onset of accidents and sequence of events should be based on the following principles:
.1 Residual heat removal systems for anticipated operational occurrences and after LOCA, heat removal system from containment, ECCS emergency supply, the reactor protection system, and any reactor safety system with its support systems should perform its functions when any single failure is assumed or has occurred;
.2 In analysing a given safety system, failure of each single component in turn should be generally assumed in association with the initiating event. Operator error, producing maloperation of a component or system should also be considered, either as an initiating event or in lieu of an assumed component failure;
.3 Those redundant safety subsystems which do not satisfy the single failure criterion in the case of the repair of one of them should not be assumed to be available in the event of a single failure, if the Operating Manual permits the repair of such subsystems during reactor operation;
.4 Protective devices should be automatically actuated at the onset of a reactor accident. Where operator action is necessary, it should be assumed not to occur until 30 minutes after the initiating event and should not negate correct operation of the protection systems. It should also be shown that, as far as is Practicable, the NSSS remains safe in the event of the unavailability of the crew; and
.5 Accident analyses should provide an adequate margin of safety where results of events studied cannot be predicted with certainty.

2.6.4 In evaluating the consequences of accidents, their long-term aspects should also be considered, and be reflected in the design. These aspects should include:
.1 continued fulfilment of safely functions;
.2 progressive damage; and
.3 fossil fuel storage and supply.

---

* See Appendix 6.

2.7 Evaluation of ship accident situations

2.7.1 Notwithstanding the collision and grounding protection afforded by the Provisions of Chapter 3, the following principles should be adopted for analysing certain ship accidents:
.1 The ship sustains the maximum extent of grounding or collision damage assumed in 3.4.3. All equipment subject to penetration damage and that located in flooded compartments is assumed to be inoperative. Equipment specially designed and approved for flooded operation may be assumed to operate. provided it can be shown that its energy source remains operable;
.2 The ship is assumed to be sunk, with the reactor shut down , in water having a depth equal to the depth of the ship to the uppermost continuous deck. The safety enclosure and the containment structure remain unflooded , except where special arrangements are provided to flood these spaces at this depth. Hydrostatic pressure equalization devices fitted in the containment structure may not operate and the ship may rest at angles determined by individual analysis approved by the Administration;
.3 Sinking deep water should be considered a design basis accident and. as a minimum, criteria A and C of 2.1.1 should be satisfied. Containment of the radioactivity should be effectively maintained over a sufficiently long time period to ensure that there is no significant release , by :

.3.1 maintaining at least one substantial structural barrier of sufficient tightness and corrosion resistance around highly radioactive sources; and
.3.2 maintaining a coolable core geometry, even if the core is damaged;
.4 The transient phases of the ship's sinking should recognize the following provisions,

.4.1 assumptions of sinking behaviour should be physically realistic and a reasonable margin for error should be applied to calculations for sinking velocity - a suggested mathematical model is given in Appendix 1 ;
.4.2 the reactor may be assumed to be shut down before the ship sinks, but not fully depressurized;
.4.3 activity released from the wrecked ship should be evaluated assuming that a containment structure pressure equalization device fails to seal totally after operation and remains in that state indefinitely; and
.5 Horizontal shock loads resulting from collisions and groundings should be determined by analysis and the conclusions reflected in the design.

2.7.2 Capsizing should be considered a design basis accident, except where it can be proven to the satisfaction of the Administration that the likelihood of such an occurrence is less than extremely remote, as defined in 1.4.3, for the ship in intact, damaged, or cargo loading condition . The method of transmitting heat from the reactor core to the sea, in a capisized state, should be analysed and the results presented in the Safety Assessment.

2.7.3 Stranding of the ship should be analysed , and the analysis should address:
.1 loss of seawater cooling supply from side or bottom sea in lets:
.2 stranding in tidal water with intermittent complete loss of seawater cooling; and
.3 determination of stranded ship inclinations to the satisfaction of the Administration.

2.7.4 Analysis of fire and explosions on board should be carried out in accordance with the tool lowing paragraphs:
.1 It may be assumed that the fire originates from a single source and occurs in any compartment containing flammable substances;
.2 The analysis should show that sufficient structural fire protection, fire detection and fire extinguishing systems are provided to ensure that reactor safety systems and equipment are adequately protected;
.3 Should it be possible for the ship's cargo to deflagrate or explode within a cargo hold, container or tank, the effect of such an occurrence should be analysed and the results should prove that the safely of the reactor will not be impaired; and
.4 Collision with subsequent fire and/or explosion should be analysed and the nuclear safety effects of fires of long duration should be considered.

2.7.5 Effects of possible missiles from exploding rotary or piston engines, from pipe whip or from other sources should be analysed with respect to reactor safety.

2.7.6 As far as practicable the effects of pressure waves from explosions, within and in the vicinity of the ship, should be analysed in detail to show that the hull structure adequately protects radioactive sources. The evaluation should take into account the hydroelastic reaction of the ship against such pressure waves. A typical explosion scenario should be postulated and its effects analysed in relation to reactor safety.

2.7.7 Specific protection against aircraft crashes need not be considered in the ship's design , except where it is intended to operate aircraft, such as helicopters, from the ship. Analyses of helicopter crashes should ensure that a crash or consequent fire will not impair radiation safely.

2.7.8 The effects of smoke and toxic gases originating from sources within or external to the ship should be analysed to ensure that safe operation of the ship or the reactor would not be dangerously prejudiced . Means should be provided to exclude smoke and toxic gases from control locations in the ship.

2.7.9 The likely consequences of extreme environmental conditions, such as those associated with tornadoes and hurricanes, for the safe operation of the ship and reactor, should be evaluated .

2.7.10 The Administration should be satisfied that adequate precautionary design measures are provided to protect the ship against malevolence, including sabotage , theft of radioactive material , hijacking or other criminal acts that prejudice nuclear safety, as described in 3.10.

2.8 Evaluation of NPP accidents

2.8.1 NPP accident situations that create a hazard to those on board the ship, the public or the environment should be classified under an appropriate PPC. The maximum design basis accident is that which causes the largest radiological hazards to persons and the environment and is, in general, the accident caused by the rupture of a primary pressure boundary pipe.

2.8.2 Reactor and machinery or equipment failures that may cause a PPC 2 to 4 situation should be analysed in accordance with the provisions of 2.6. The following events in particular should be analysed and the results presented in the Safety Assessment :
.1 withdrawal of any single control rod or control rod group moved by a common drive or with common control, from any starting position, including hot and cold , and in any critical or subcritical condition of the reactor core, independent of its Power level.
.2 leakage of primary coolant through defective steam generator tubing into the secondary system, considering closure of steam and feedwater lines after activity carry-over - the evaluated engine room dose rates being presented in the Safety Assessment and Operating Manual;
.3 ejection of a control rod from the core, with account being taken of any unfavourable reference conditions for power or power distribution , and/or reactivity insertion;
.4 stuck rod in any location in the core in the worst burn-up condition;
.5 fail use of a control rod drive;
.6 inadvertent start of any single primary coolant circulation pump , or of more than one if this is possible, due to the occurrence of a failure;
.7 cold water injection at maximum possible rate, from make-up system , feed system , or other existing source;
.8 pressure rise within the primary system resulting from events such as closure of containmerit isolation valves, trip of one or more turbines, manoeuvres or other causes;
.9 unintentional reduction in concentration of soluble neutron poison in the core; .
.10 failure of reactor power control ;
.11 loss of heat sink,
.12 loss of coolant accidents;
.13 leakage of primary coolant from a storage tank, or through gaskets, valves or seals in its associated piping system; and
.14 anticipated transient without scram condition.

2.8.3 Consideration of loss of heat sink should include:
.1 trip of the main turbine or one of two or more turbines;
.2 main condenser breakdown, with no recourse to auxiliary turbo-generator or turbo-pump condensers except where these are operating or are on standby;
.3 failure of one feed pump, closure of a feed line or other failure event within the secondary feed system; and
.4 failure of one heat transmission path while the ship is alongside or in drydock with no turbines in operation.

2.8.4 Loss of coolant accidents (LOCA) should be analysed in accordance with the following conditions:
.1 A rupture should be assumed in any pipe forming part of the primary pressure boundary, up to and including the largest pipe in the system , but not including nozzles on the reactor pressure vessel .
.2 The rate of loss of coolant from an assumed pipe break should be consistent with a double-ended instantaneous rupture of the pipe, except where it can be shown to the satisfaction of the Administration that sufficient physical restraint exists to restrict the movement of the broken ends , or other means are provided to prevent double-ended flow.
.3 The LOCA should be considered a design basis accident and should include the following provisions:

.3.1 the design limits of the reactor containment structure and containment systems should not be exceeded and the design pressure should allow for a sufficient margin with respect to the calculated pressure;
.3.2 the radiological consequences should be in accordance with Chapter 6;
.3.3 the core should maintain a coolable geometry;
.3.4 the fuel elements should be able to withstand the thermal and mechanical loads imposed upon them, to ensure that the core will remain coolable and that the number of fuel cladding failures is acceptable to the Administration;
.3.5 where blow-down tanks or pressure suppression tanks (wet wells) are fitted, their operation should not be impaired by any ship attitude resulting from sea and wind states assumed in the ship's design for PPC 1 and 2. .4 The Administration may require that an analysis be carried out to determine the number of steam generator tube failures which would significantly reduce emergency core cooling injection flow and assess the effect on core cooling system performance .
.5 The following additional initial or boundary conditions should be considered in LOCA analyses:

.5.1 one of the emergency core cooling subsystems fails and is assumed to be incapable of being restarted;
.5.2 a second emergency core cooling subsystem feeds into the ruptured piping and not into the primary pressure vessel ,
.5.3 repair, maintenance and testing of a third emergency core cooling system should also be considered , if in-service maintenance of emergency core cooling subsystems is permitted by the Administration;
.5.4 automatic initiation of reactor safety systems should be capable of shutting down the reactor and keeping it in a safe state for at least 30 minutes after an initiating event;
.5.5 the design should be such that an operator can activate protection and safety systems but cannot negate the correct action of the automatic systems;
.5.6 occurrence of chemical reactions (hydrogen and zirconium reactions);
.5.7 only those systems that are specially designed for LOCA conditions continue to operate.
2.8.5 Loss of secondary steam or feedwater, following an assumed full cross-section rupture of the main steam line or main feed line, should be treated as a design basis accident if necessary. In any case, the effect upon the reactor should be evaluated and described in the Safety Assessment.

2.8.6 Failure of an active component or administrative error should be considered for the waste processing systems and should not impair the safety function of the system, even in case of any PPC 3 or 4 occurring.

2.8.7 The effect of a failure involving any essential component of the electrical power generation and distribution systems should be analysed. Complete loss of main electrical power supply should be considered a design basis accident .

Chapter 3 Ship design, construction and equipment

3.01 Ship arrangements

3.1.1 The ship should be divided into areas classified in accordance with Chapter 6 on the basis of radiation hazards actually or potentially present.

3.1.2 The reactor compartment should:
.1 be located or protected to minimize damage in case of collisions, grounding and hazards arising from cargoes, missiles and other sources specifically identified by the safety analysis; and
.2 be bounded fore and aft by cofferdams or suitable bulkheads, extending from the double bottom to the bulkhead deck, providing adequate protection against external fires or explosions.

3.1.3 The use of cofferdams and double bottoms comprising the boundaries of the reactor compartment should be restricted to the carriage if any of non-potable water.

3.1.4 The reactor compartment should be so designed as to facilitate the salvage of the reactor or recovery of its essential parts from the ship in the event of shipwreck , without prejudicing the safety of the reactor installation in normal service.

3.1.5 The safety enclosure, which forms the fourth barrier described in Chapter 1, surrounds the containment structure and any significant source of radioactivity associated with the NPP. Its functions are:
.1 to control the leakage of radioactive material to the other parts of the ship and to the environment from the intact containment structure in all PPCs;
.2 to prevent and to control ( including: monitoring, delaying, and processing) the releases of rad inactive material to the other parts of the ship and to the environment from all other sources of radioactivity it may contain; and
.3 to ensure, when the second and third barriers are simultaneously opened for postulated operational purposes, that there remains at least one physical barrier between irradiated fuel and the environment with the gastightness and watertightness required for nuclear safety.

3.1.6 The safety enclosure should confine for treatment and controlled release to the environment by the off-gas ventilation system*
.1 radioactive material which may leak from the primary pressure boundary, or from a small line rupture outside the containment structure; and
.2 radioactive material leaking from an open containment structure, or from high or medium level waste storage containers within the safety enclosure.

3.1.7 All bulkheads and other boundaries forming the safety enclosure should be gaslight, of all-welded construction, and firelight as necessary to conform with 3.9.2 and 2.7.4. Piping and electrical penetrations in the safety enclosure should provide a boundary with gastight and firelight integrity equal to trial of the safety enclosure.

3.1.8 The safety enclosure is located entirely within the reactor compartment and within the structural boundaries designed to Protect it and its contained equipment from the external hazards of marine application. The enclosure may include penetrations and personnel access openings, which must be capable of maintaining the requisite gastightness.

3.1.9 The forward and after boundaries of the safety enclosure should be within the cofferdams or other structure forming the reactor compartment and may be integrated with such structures.

3.1.10 The longitudinal watertight, gaslight bulkheads forming the sides of the safety enclosure should be located at a distance inboard of the ship's side at least as great as the limits of penetration determined in 3.4.3.

3.1.11 The containment structure should be designed to limit the release of radioactive material. Design requirements should include the following :
.1 the containment structure should be within the safety enclosure;
.2 the primary pressure boundary should be located within the containment structure;
.3 the containment structure should be designed to afford adequate protection against damage arising from any PPC;
.4 penetrations of the containment structure should withstand the internal conditions occurring under any PPC;
.5 isolation valves should be provided on all lines penetrating the containment structure boundary and should be located as close to the boundary as practicable; such valves should be remotely controlled and automatically operated as the piping or trunked service requires and as necessary for automatic isolation of the containment structure;
.6 except for refuelling, access to the containment structure for personnel and equipment should be via airlocks, which should retain the gastight integrity of the structure under all conditions. The need for access, while the reactor is at pressure, should be reduced to a minimum;
.7 cleaning and cooling of the air within the containment structure to maintain the humidity, temperature and activity design values for PPCs should be provided by a separate independent air-conditioning system of either a closed circulation type or an open flow-through type;
.8 Where a closed circulation System is fitted, provision Should be made to purge the air within the containment structure with fresh air before entry of personnel to ensure that air quality meets acceptable health standards. The purge system should be designed so that it need operate for short periods only;
.9 where an open flow-through system is fitted , provision should be made for rapidly and automatically sealing all air ducts under conditions that may involve abnormal release of radioactive material into the containment structure. It must be shown that the sealing arrangements will operate reliably in a time commensurate with the development of the fault and in the conditions prevailing at the time of the accident;
.10 where provision is made to vent a containment structure to atmosphere after any postulated PPC, such venting should be capable of being controlled and monitored for radioactive material and hydrogen and should pass through high-efficiency filters to ensure that the dose limits are not exceeded;
.11 the containment structure venting system should not be used as a short-term pressure suppression system , nor should high-efficiency emergency filters be used except under PPCs that release radioactive material into the containment structure ;
.12 the design efficiency of high-efficiency filters should be stated in the ship's Safety Assessment , and equipment to verify the efficiency values claimed should be provided on board the ship;
.13 provision should be made to control and monitor activity levels inside the containment structure under appropriate PPCs; and
.14 deformation to hull structures and the safety enclosure from design basis events should not affect the structural integrity and leaktightness of the containment structure, nor cause its buckling or plastic instability.

3.1.12 Penetrations of the boundaries of the reactor compartment, the safety enclosure and the containment structure, should be kept to a minimum.

3.1.13 Location of areas and equipment essential to ship and reactor safety should be chosen , taking account of the following:
.1 disposition of such areas and equipment should ensure in the best way possible their immunity from damage in the event of an internal or external accident. SC-1 and other systems containing radioactive material including high-level radioactive waste which require protection of their integrity in case of a collision, should be located inboard of the collision protection;
.2 layout features should include adequate physical separation of redundant systems and components important to the safe operation of the ship and its NPP;
.3 machinery having a potential for missile generation should be oriented or shielded so as to minimize missile effects to ship and reactor safety equipment;
.4 the main reactor control room should be in the least vulnerable position (to fires, missiles resulting from explosions, toxic substances, radioactivity, etc. ) but as near to the reactor and machinery as possible to keep service lines short;
.5 those systems , including their energy supply, designed to ensure essential reactor safety functions in the event of a failure in the principal system, should be functionally independent of and physically segregated from the principal system. Wherever practicable, segregation by fire resistant and watertight structures should be adopted;
.6 separate and remote from the reactor control room, an emergency control position* should be provided. From this position, it should be possible for an operator to bring the reactor to a safe hot shutdown or cold shutdown condition and maintain it in a subcritical stale while maintaining residual heat removal;
.7 the emergency control position may be functionally connected with the navigating bridge so that, in case of emergency, a scram procedure could be performed under the control of the navigating bridge; and
.8 shielding should be arranged so that manning of essential control positions is possible for a reasonable period following PPCs 1 to 4.

3.1.14 Weatherdeck drains and drains from compartments not containing radioactive materials or systems should not pass through the safety enclosure.

---

* The off-gas ventilation system , in case of release, filters and cleans gaseous waste before discharge to the environment.
** See 4.4.4.

3.02 Ventilation - general provisions

3.2.1 Ventilation systems serving spaces which contain or may contain radioactive material should be segregated from other ventilation systems. They should also be segregated from all spaces outside the controlled area, except where the ducts and stacks are suitably provided with shielding, protected against external accidents, and enclosed sufficiently gastight.

3.2.2 Exhaust ventilation systems serving spaces which contain or may contain radioactive material should be monitored and controlled for possible radioactivity in accordance with Chapter 6. The location of exhaust outlets should be carefully selected to avoid accidental contamination of any area of the vessel.

3.2.3 Provision should be made to combat and exclude dense smoke and toxic materials from internal and external sources which could lead to loss of visibility, asphyxiation or other disabling of crew members within the main control room, emergency control position, or navigating bridge leading to a degradation of the safe operation of the ship.

3.2.4 Supply ventilation intake locations for all spaces should be carefully selected to avoid the possibility of re-entry of discharged radioactive gases.

3.2.5 Redundancy for essential ventilation and exhaust system active components should be included and one or more standby fans should be fitted and arranged to start automatically in the event of failure of any of the running fans.

3.2.6 If ventilating air flows from one space to another, the flow should be from areas of lower potential airborne contamination to areas of higher potential airborne contamination .

3.2.7 Ventilation and filtration arrangements for the safety enclosure should maintain subatmospheric pressure even when one entrance is open.

3.03 Structure

3.3.1 A longitudinal strength analysis of the ship's hull should be made, with due regard to the weight and stiffness characteristics of the reactor compartment and collision protective structure.

3.3.2 The section modulus in the area of the collision protective structures should not radically change at the end of the structures. This structure should be smoothly integrated into the rest of the ship. Structural members at the transition must be adequately sized and designed to transfer the weight and loads developed in the area of the reactor compartment and collision protective structure into the rest of the vessel The transition area should extend as far as necessary forward and aft of the reactor compartment to provide structural continuity of the hull. This structural continuity might be part of the protection provided against a glancing collision.

3.3.3 Proven design practices should be used and should be analysed by proven methods.


3.3.4 Where the nature of the ship's service requires it, consideration should be given to defence against brittle fracture by the use of special steel where indicated by analysis.

3.3.5 Only materials with a known satisfactory performance in similar application should be used , otherwise extensive testing may be required to substantiate the desired properties.

3.3.6 Construction should be to quality standards as defined by the quality assurance programme.

3.3.7 Ship's structure in way of the reactor compartment should be designed and constructed to give adequate protection to the NSSS from external forces as detailed in Chapter 2.

3.3.8 Reactor and containment structure foundations should be adequately designed for proper support under the conditions specified in Chapter 2. They should be adequate to retain the primary pressure boundaries and containment structure in position under any inclination. The supports should accommodate all thermal stresses. Accessibility for inspection and maintenance of the containment structure should be provided . Where necessary foundation structure (such as in way of the reactor) may be integrated with hull structure. Final loads should be taken in the hull structure.

3.3.9 Design of the foundations of the safety enclosure and of the containment structure should allow for interaction of hull structure with them and account for the inertial forces according to their safety class. 3.3.10 Reactor plant shielding supports should be designed to account for the inertial forces acting on that shielding as prescribed for SC-2 and 3 and due to the deformation of the ship.

3.3.11 Structural interfaces of the ship and nuclear components should be analysed by techniques acceptable to the Administration, using the inertial impacts accorded by their safety class.

3.04 Subdivision and damage stability

3.4.1 The ship should comply with the subdivision and damage stability requirements specified in 3.4.7 and 3.4.8. after the assumed side or bottom damage specified in 3.4.3, for any operating draught reflecting actual, partial or full load conditions consistent with trim and strength of the ship. Such damage should be applied to all conceivable locations along the length of the ship. At least a two-compartment standard of subdivision should be obtained .

3.4.2 The requirements of th is section should govern the operating draught for any actual condition of loading . However in no case should such draught be greater than that corresponding to the minimum freeboard calculated in accordance with the International Convention on Load Lines,1966., or, in the case of passenger ships, the Convention

3.4.3 Subject to the provisions of .4 of this paragraph and to any other considerations which the Administration may deem valid the extent of damage should be assumed as follows :

.1	Side damage:
.1.1	Longitudinal extent:	1.3 L 2/3 or 14.5 m, whichever is less
.1.2	Transverse extent : (inboard from the ship's side at right-angles to the centreline at the level of the summer load line)	B/5 or 11.5 m, whichever is less
.1.3	Vertical extent: (from the moulded line of the bottom shell plating at centreline)	upwards without limit
.2	Bottom damage: For 0.3 L from the forward perpendicular of the ship	For any other part of the ship
.2.1	Longitudinal extent: 1/3 L2/3- or 14.5 m, whichever is less	1.3 L2/3 or 5 m, whichever is less
.2.2	Transverse extent B/6 or 10.0 m, whichever is less	B/6 or 5 m, whichever is less

.2.3	Vertical extent
	B/15 or 2.0 m, whichever is less, measured from the moulded line of the bottom shell plating at centreline
.3	L and B in metres for any part of the ship and perpendiculars are as defined in Regulation 3 of the International Convention on Load Lines,1966.
.4	When collision Protective structures specially designed to limit penetration of a stricken ship are fitted abreast of the reactor compartment or the propulsion machinery space the Administration may accept a lesser extent of side damage than that given in 3.4.3, subject to an equivalent protection against flooding being provided.
.5	If any damage of a lesser extent than specified in 3.4.3 results in a more severe condition , such damage should be assumed.
.6	If pipes, ducts or tunnels are situated within the assumed extent of damage, arrangements should be made to ensure that progressive flooding cannot thereby extend to compartments other than those assumed to be floodable for each case of damage.

3.4.4 The requirements of 3.4.6 should be confirmed by calculations which take into consideration the design characteristics of the ship. the arrangements, configuration and contents of the damaged compartments; the distribution of dry cargo, the distribution , specific gravities and free surface effect of liquids. The calculations should be based on the following :

Spaces	Permeability
Appropriated to cargo	by calculation* but not less than 60
Appropriated to stores	60
Occupied by accommodation	95
Occupied by machinery	85
Intended for voids	95
Intended for liquids	0 to 95**

3.4.5 Whenever damage penetrates a tank. it should be assumed that the liquid therein , if any, is completely lost from that compartment and replaced by salt water up to the level of the final water plane of equilibrium.

3.4.6 The free surface effect in undamaged compartments should be calculated as follows:
.1 for each individual compartment by the moment of transference method throughout the full range of residual stability;
.2 for each type of consumable liquid, at leasts one free surface has to be assumed for each transverse pair or a single centreline tank and the tank or combination of tanks to be takan into account should be those where the effect of free surfaces is the greatest.

3.4.7 Subject to compliance with any higher applicable standard under the provisions of the Convention or as may be requested by the Administration , ships may be regarded as surviving flooding if the following conditions are met:
.1 The final waterline, taking into account sinkage, heel and trim, is below the lower edge of any opening through which progressive flooding may take place. Such openings include air pipes and those which are closed by means of weathertight doors or hatch covers and may exclude those openings closed by means of watertight manhole covers and flush scuttles, small watertight cargo lank hatch covers which maintain the high integrity of the deck, remotely operated watertight sliding doors and sidescuttles of the non-opening type.
.2 In the final stage of flooding, the angle of heel due to unsymmetrical flooding should nor exceed 15 degrees, except that this angle may be increased to a maximum of 17 degrees if no deck edge immersion occurs. Greater angles of heel may be accepted by the Administration if the general safety is thereby increased.
.3 The stability in the final stage of flooding may be regarded as sufficient if the righting lever curve has a minimum range of 20 degrees beyond the position of equilibrium, in association with a maximum righting lever of at least 200 mm within this range. The area under the curve within this range should not be less than 3.50 cm radians. The sills of unprotected openings should not be immersed with in th is range of residual stability unless the space concerned is assumed to be flooded. Within this range the immersion of all openings listed in 3.4.7.1 and other openings capable of being closed weather-tight may be permitted.
.4 The Administration should be satisfied that the stability is sufficient during intermediate stages of flooding .

3.4.8 Unsymmetrical flooding is to be kept to a minimum consistent with efficient arrangement.
.1 Where it is necessary to correct large angles of heel, the means adopted should, where practicable, be self-activating, but in any case where controls to cross-flooding fittings are provided they should be operable from the bulkhead deck. Suitable information concerning the use of cross-flooding fittings Should be supplied to the master of the Ship.***
.2 Equalization arrangements requiring mechanical aids. such as valves or cross- leveling pipes, if fitted. should not be considered for the purpose of reducing an angle of heel or attaining the minimum range of stability to meet the requirements of 3.4.7 and sufficient residual stability should be maintained during all stages of equalization. Spaces which are linked by ducts of large sectional area may be considered to be common.

3.4.9 The master of the ship should be supplied with information which should include:
.1 data necessary to maintain sufficient intact stability under service conditions to enable the ship to withstand various conditions of damage;
.2 information on damage resistance for the particular ship and recommended damage evaluation and damage control actions for each of the different damage conditions; and
.3 actual survival capability of the ship under more severe damage penetration than required by the Code in order to inform the master of the actual limit of survivability in all cases (e.g. penetration up to the centreline might be included ) .

---

* A detailed calculation of average permeability of cargo spaces should be carried out having regard to the permeability of cargoes intended to be carried in the space. Container or cargo vehicles should be assumed to be non-watertight and their permeability be taken as 65. The permeability of void spaces of partly tilled cargo spaces should be taken as 95.
** The permeability of partially tilled compartments should be consistent with the amount of liquid carried in the compartment.
*** Reference is made to the Recommendation on a Standard Method of Establishing Compliance with the Requirements for Cross-Flooding Arrangements in Passenger Ships, adopted by the Organization by resolution A.266(VIII).

3.05 Collision protection

3.5.1 Collisions considered in this section include collisions with fixed and floating objects as well as collisions between ships, i.e. the nuclear ship is striking as well as being struck .

3.5.2 Collision protective structure should be provided against a design basis collision to the satisfaction of the Administration, such that protection is provided to prevent penetration of the longitudinal watertight , gastight boundaries of the safety enclosure by the striking ship or struck object. Protective structure in way of reactor compartment including an additional reasonable area forward and aft of reactor compartment transverse bulkheads, is to be determined on an individual ship basis. A sufficient transition to ship's longitudinal structure must be provided (see 3.3.2).

3.5.3 Analysis of the collision protection should be made and the results of the analysis should be presented in the ship's Safety Assessment. The analysis should take into account the possibility of events the likelihood of which is remote , with regard to type of striking ship or struck object and include categories of open sea , coastal, offshore and port areas. It should also include and take into account :
.1 proof by calculation, model demonstration, etc., of the efficiency of the collision protective structure to prevent exceeding the penetration limit considered in the ship design ;
.2 location of reactor compartment;
.3 subdivision of ship;
.4 damage stability;
.5 hull strength in damaged conditions;
.6 displacement, speed and bow shape of striking ship, which may include for example striking ship being:

.6.1 of equal size travelling at design speed;
.6.2 a very large crude carrier with bulbous bow;
.6.3 a high speed vessel with fine bow;
.6.4 a nuclear ship striking a fixed object of infinite mass;
.7 risk of fire and explosion;
.8 loss of manoeuvrability; and
.9 effects on cargo.

3.5.4 Data and methods for assessing the effects of collisions between modern ships are insufficiently established to offer further specific guidance to be included in this Code. Consequently, the extent of transverse damage from a design basis collision and the adequacy of the collision protection must be determined for each ship and approved by the Administration .

3.06 Grounding and stranding

3.6.1 A double bottom is to be provided under the reactor compartment, sufficient for the protection of the reactor and safety related systems, including high level radioactive material storage areas. The depth of the double bottom under the reactor compartment should provide protection against bottom damage of the extent given in 3.4.3, but in no case should the bottom of the safety enclosure be less than the greater of B/15 or 2 metres above the bottom of the ship or be below the inner bottom plating.

3.6.2 A double bottom, of sufficient depth to withstand the assumed damage given in 3.4.3, should be provided under the propulsion machinery space.

3.6.3 Except where otherwise required by 3.6.1 and 3.6.2, double bottoms should be fitted in accordance with the requirements for non-nuclear ships of similar type and arrangements made to ensure structural continuity at transition areas.

3.6.4 An analysis of the ship's longitudinal strength to the satisfaction of the Administration should be made , assuming the ship is stranded.

3.07 Navigational aids and manoeuvrability

3.7.1 A nuclear ship should be fitted with an anti-collision aid and at least turn radars, each capable of being operated independently. The equipment fitted in compliance with this subsection should be of a type approved by the Administration and should conform to operational performance standards not inferior to those adopted by the Organization .

3.7.2 Manoeuvrability of a nuclear ship should be at least equivalent to that of a ship of like size and power using conventional steam turbine propulsion.

3.7.3 At all locations from which the ship can be steered, a manoeuvring booklet and diagrams, complying with resolution A.209(VlI), should be available.

3.08 Life-saving appliances

3.8.1 Portable radiation monitoring devices should be provided for use in survival craft.

3.8.2 The primary survival craft should be fitted with an external drenching system for decontamination .

3.09 Fire safety

3.9.1 Consistent with other safety requirements, safety systems should be so designed and located as to minimize the probability and effect of fires and explosions. Where safety systems must meet their safety functions in case of a fire, segregation by suitable fire resistant structures should be provided between redundant sections of the system or its subsystems.

3.9.2 Additional fire protection structure, equipment and systems may be required to ensure that the integrity of the shielding, the containment structure, the safety enclosure, and essential reactor safety systems is maintained , such that an onboard fire of single origin will not prevent safe shutdown of the reactor nor the maintenance of it in that state.

3.9.3 All spaces containing safety systems and equipment essential to the safely of the NSSS and personnel should be fitted with a fire detection and alarm system, and a remote fire suppression system which uses an agent that is as non-corrosive as practicable. Consideration should be given to:
.1 use of fire-extinguishing agents that permit easy decontamination;
.2 limited use of ionization detectors in spaces which may have high radiation levels, and
.3 limiting or controlling hydrogen releases, originating from the process of radiolysis, or from zircalloy-water reaction following a LOCA.

3.9.4 Suitable design , the use of structural fire protection, and the use and placement of fire protection equipment should minimize the probability of hazard or damage to the NSSS and its control systems resulting from a fire in a non-nuclear section of the ship .

3.9.5 At least two means of escape should be provided from the main reactor control room and from the compartment in which the emergency reactor control position is located . Each escape route should provide effective fire shelter from the compartment to the weatherdeck

3.9.6 Within spaces such as the reactor compartment and spaces containing equipment essential to the continued safe operation of the NSSS, the use of combustible substances and systems requiring combustible substances should be avoided to the greatest possible extent, provided that, where use of such substances cannot be avoided, appropriate equipment and management procedures should be described in the Operating Manual.

3.9.7 Systems within spaces such as the reactor compartment and spaces containing equipment essential to the continued safe operation of the NSSS or necessary to ship's operation, such as standby generating sets or auxiliary boilers, should be segregated and physically separated by structural fire protection and be provided with individual fire-extinguishing equipment.

3.9.8 The use of an emergency control position described in 3.1.13.6 should enable the reactor to be brought to a cold shutdown condition, and kept in a cold subcritical condition while maintaining residual heat removal functions, in the event of a fire in the main control room. Conversely, a fire at the emergency control position should not affect the ability to control the reactor at the main control room.

3.9.9 Risk of explosion or fire originating from the ship's cargo or external sources should be analysed. Where required by analysis , suitable fire protection arrangements , or other special considerations acceptable to the Administration, should be provided.

3.10 Security of the ship and physical protection of the fissile material

3.10.1 Security measures against malevolence should be taken into account in the design and the operation of the nuclear ship in order to achieve protection of the ship and fissile material on board. Security and safety measures should be consistent and harmonized.

3.10.2 No security measure should prevent the immediate and safe egress of a person from any compartment in the ship in the event of a fire or other emergency. nor prevent entry into a compartment as required for the performance of safety functions.

3.11 Access openings

Access openings in boundaries of the reactor compartment or in the boundaries of spaces within the reactor compartment which form watertight, gastight or fire protection divisions, should be fitted with closures which will maintain the integrity of the division in which they are located. Where necessary for security or safety purposes, closures should be provided with appropriate arrangements for local and remote operation. Provision should also be made, by airlock arrangements if necessary, to ensure that required air pressure differentials, where provided between adjacent compartments are not rendered ineffective during operation of access closures.

3.12 Non-propulsive steam systems

Steam supply for domestic or other non-propulsive purposes should not directly employ steam generated in the NSSS. Tertiary steam or steam generated directly by non -nuclear sources should be used.

Chapter 4 Nuclear steam supply system (NSSS)

4.01 General design criteria

4.1.1 System design should permit periodic in-service inspection and testing without loss of safety protection .

4.1.2 Fluid systems and pressure vessels should comply with their design class requirements and include provisions for:
.1 initial pressure testing;
.2 periodic inspection and/or pressure testing;
.3 periodic testing for leaktightness of penetrations;
.4 system isolation ;
.5 surveillance programmes;
.6 flushing of systems after initial installation, modification or repairs; and
.7 overpressure protection.

4.1.3 All systems essential to operation or safely of the NSSS should be capable of being manually controlled. in addition to any automation provided.

4.1.4 Automatic initiation of safety systems should be provided for all initiating events which require fast safety system action. In general, such automatic action should be provided where safety system action is required within 15 minutes to prevent unacceptable consequences. The automatically initiated systems should be able to place the reactor plant in a safe condition for at least 30 minutes without crew assistance. The design should ensure that an operator can resume control of safety protection system functions but cannot negate correct safety system action.

4.1.5 Safety systems to which the single failure criterion apply include:
.1 reactor shutdown system ;
.2 reactor protection system;
.3 residual heat removal system;
.4 emergency core cooling system;
.5 containment isolation system;
.6 containment heat removal system; and
.7 containment atmospheric clean-up system , if any.

4.1.6 Attention should be paid to interfaces between NSSS and non-nuclear areas of the ship, to ensure maintenance of nuclear and ship safety.

4.02 Reactor core

4.2.1 Critical conditions, which may cause the fuel to be damaged, should not occur under any normal service condition , nor under any predictable transient condition Calculation of thermal conditions should allow for uncertainties in calculations and should take into consideration the effects on thermal performance of ship motions. Thermal margins including a minimum departure from nucleate boiling ratio should be established, to the satisfaction of the Administration, as operational limits. Calculations should be supported by experimental heat transfer correlations that consider the most extreme transient and ship motion conditions. Calculations should be made available to the host Administration as required .

4.2.2 Coolant flow distribution through the individual fuel channels in the core and uncertain lies associated therewith should be taken into account. Particular attention should be accorded to the redistribution of coolant flow and effects on heat transfer and coolant properties under the influence of ship motions. For abnormal conditions of coolant flow, due to disturbances of pumping power or other causes, adequate safety margins should be demonstrated. Analyses and/or tests should demonstrate the absence or acceptability of any flow-induced vibration in the core, its supports or appurtenances, to ensure that no vibration-induced hazards exist which would prejudice safe reactor operation .

4.03 Reactivity control

4.3.1 The design basis for reactivity control should include the following considerations:
.1 The likelihood of events resulting in unplanned reactivity increases should be remote, as defined in Chapter 1, and should not lead to situations which pose a hazard to the public, crew or environment greater than that defined in Chapters 1 and 6;
.2 The effect of postulated reactivity accidents should neither result in damage to the primary pressure boundary greater than limited local yielding within the design specification, nor prevent shutting down the reactor;
.3 The net effect of prompt inherent nuclear feedback characteristics should tend to compensate for a rapid increase in reactivity when in the ship operating power range, taking into account design ship motions and accelerations; and
.4 Reactor fast shutdown (scram) system should be designed for, and be capable of. shutting down the reactor at angles of up to 90° and be capable of maintaining the reactor in shutdown condition at all angles. In addition, the reactor fast shutdown (scram) system should operate automatically at smaller inclinations for safety reasons when:

.4.1 the containment structure becomes flooded; or
.4.2 the ship becomes submerged; or
.4.3 the ship heels to an angle of 45° or is trimmed to 10° inclination either way in the fore and aft direction or the ship heels to the angle of vanishing intact stability, whichever is less, but the reactor should not shutdown automatically due to lesser angles of heel or trim .
4.3.2 The reactivity control provisions should meet the following requirements:
.1 At least two independent, reliable and effective reactivity control systems of diverse design should be provided . Each reactivity control system should independently be capable of holding the reactor core subcritical in cold conditions;
.2 One of the systems should be mechanical in nature and should :

.2.1 be capable of automatically rendering the core subcritical and maintaining it in a cold, subcritical state at any time of core life, without the use of soluble neutron poisons, assuming that the mosts reactive neutron absorbing element , in terms of reactivity worth, has been withdrawn and cannot be re-inserted;
.2.2 be capable of reliably controlling reactivity changes, to assure that specified fuel design limits are not exceeded under any PPC;
.2.3 incorporate arrangements to prevent unintentional displacement of a control element;
.2.4 operate properly despite a fault in the first initiated activation signal;
.2.5 upon receiving a signal from any trip parameter, be capable of reducing the reactor power so fast as to prevent any of the fuel design limits from being exceeded ;
.2.6 provide at the main reactor control room indication of the position of each neutron absorber element;
.2.7 be designed to reduce the probability of inadvertent continuous control element withdrawal to an acceptable level ;
.2.8 employ control element activation sequencing to minimize the probability of operator error; and
.2.9 incorporate arrangements to prevent withdrawal of control elements in unplanned groupings or in an unplanned sequence; .3 The other reactivity control system or systems, despite a single failure, should be alone capable of rendering and maintaining the core subcritical without exceeding the fuel design limits;
.4 Each reactivity control system should be fully operable within all design attitudes of the ship and should each be capable of:

.4.1 functional testing ;
.4.2 periodic calibration of instruments throughout the entire range of reactor power; and
.4.3 verification of proper functioning of instrumentation ; .5 The means of reactivity control should be capable of rendering the core subcritical by a sufficient margin during and after the service life of the core, including periods of maintenance, refuelling, reactor accident conditions and ship accident conditions including capsizing and sinking;
.6 The reactor should be operable at a power level sufficient to maintain steerageway under PPC 1 during design core life, with an appropriate margin for the most reactive neutron absorption element, in terms of reactivity worth , being inserted in the core and incapable of withdrawal; and
.7 The means of reactivity control should be designed to be operated from a reactor control room, with the capability of rendering and maintaining the core subcritical from a separate emergency control position.

4.3.3 To provide for the reactivity control system and reactor safety and protection systems, at least two independent sources of power should be available during reactor startup and until the power level is reached.

4.3.4 To prevent unplanned reactivity changes due to moderator density variations , means should be provided to detect and control involuntary power oscillations and shifts within the reactor core, unless it can be proven by analysis that such oscillations and shifts are of negligible effect and do not result in an encroachment on the acceptable margin for fuel design limits.

4.04 Reactor control

4.4.1 Failure of any control component should not prevent the safe shutdown of the reactor.

4.4.2 Means should be provided for testing reactor control systems while in operation to detect and, where possible, repair failed components, without reducing the system's capability of controlling the reactor in a safe and stable manner.

4.4.3 Complete control of the reactor should be possible from the reactor control room , which should:
.1 be equipped lo operate and monitor the reactors and all related safety systems under PPCs 1 to 4; and
.2 be suitably constructed to afford its inhabitants radiation and fire protection during all PPCs that allow it to remain manned.

4.4.4 The emergency control position should be equipped with the instrumentation and controls for:
.1 independent initiation of hot shutdown of the reactor;
.2 independent capability for subsequent cold shutdown;
.3 monitoring the reactor condition and maintaining it in a hot or cold shutdown state; and
.4 removal of residual heat from the reactor.

4.4.5 Taking into account the inherent stability of the reactor system itself, the control system should be designed to control reactor power, in response to operational demand , under all anticipated ship manoeuvres and sea states during normal and emergency situations. To the maximum extent practicable, the complete control system should be so designed that no operational restrictions are imposed upon the nuclear ship that would not also apply to a conventionally powered ship of like size and power.

4.4.6 Reactor control should be derived from diverse measurement parameters, including neutron fluence rate. Measurement of important reactor control parameters should not be restricted to one channel.

4.4.7 Reactor Period may be used as an indicator but should not be used in the reactor power control loop when the reactor is at power level.

4.4.8 Design of the reactor control systems should minimize the response to spurious signals.

4.4.9 Interlocks should be provided within the control systems to prevent inadvertent maloperation by an operator

4.4.10 Where interlocks are designed to be by-passed, the by-pass condition should be prominently displayed at the reactor control room. In general the design should be such that by-passes are not required .

4.05 Mechanical engineering considerations

4.5.1 Structural design provisions for reactor internals, fuel elements and safety related equipment of SC 1 and 2, should consider loads resulting from the conditions mentioned in 2.2 and 2.3. The effects of such loads should neither prevent the reactor from being shut down nor affect the ability to maintain a coolable geometry. These loads include those arising from:
.1 ship motions;
.2 induced vibrations from the propeller. slamming action, machinery, and other vibration sources;
.3 reactor and ship design basis accidents; and
.4 inertial loads and flow variations caused by flow redistribution due to ship motions.

4.5.2 The NPP, including reactor internals, should be designed and constructed to facilitate, to the maximum extent practicable, initial and in-service inspections required by the Code.

4.06 Primary pressure boundary

4.6.1 Components which form part of the primary pressure boundary should be designed , fabricated, erected and tested to DC 1 standards. Means should be provided for detecting reactor coolant leakage. Design provisions should be made for the static and dynamic forces imposed upon the system throughout its lifetime, from sources such as:
.1 anticipated cyclic loading induced by pressure and temperature variations;
.2 inertial loads imposed by ship motions and ship and reactor accidents; and
.3 vibration loads induced by sources internal or external to the system.

4.6.2 The primary pressure boundary should be designed with sufficient margin so that, when stressed under operation , maintenance, testing and postulated accident conditions, the boundary behaves in a ductile manner. The design should reflect consideration of service temperatures and other conditions affecting the boundary material under these conditions, as well as the uncertainties in determining:
.1 material properties,
.2 effects of irradiation on material properties;
.3 residual , steady-state and transient stresses; and
.4 sensitivity of non-destructive test equipment ant test frequency .

4.6.3 Materials and methods of construction should be selected with particular attention given to the following :
.1 suitability for use in nuclear and marine environments;
.2 corrosion and erosion from reactor coolant;
.3 trace elements, present In construction materials in actual or potential contact with reactor coolant. that may be susceptible to activation and transport, and
.4 effects of neutron irradiation on material properties.

4.6.4 Overpressure Protection of the primary coolant circuit should comply with the following requirements:
.1 At least two safety valves should be provided, that vent into a relief tank within the containment structure. The relief tank should be provided with automatic arrangements for safe release or older equivalent means. Safety valves may be replaced by other equivalent means only if:

.1.1 such means are at least equally reliable;
.1.2 the risk is not increased quantitatively;
.1.3 the primary pressure boundary maintains its integrity for all PPCs and the maximum stresses in that boundary are limited;
.1.4 the effects of those PPCs which involve the loss of heat sinks are analysed;
.1.5 criteria A, B and C of 2.1.1 are demonstrably achieved;
.1.6 such means are to the satisfaction of the Administration;
.1.7 the demonstration that .1.1 to .1.5 above are achieved as presented in the Safely Assessment. Relief tanks may be located outside containment provided that the requirements of 1.1 to .1.7 above are met, and that such provisions as,those for the containment structure and for components and systems carrying primary coolant outlined in 3.1.11 are maintained; .2 Rupture discs on lieu of valves should not be accepted;,
.3 The capacity of the safely valves should be such that, even if one valve fails to operate, the pressure in the primary system during any design basis accident cannot exceed the maximum permissible operating pressure by more than 10 per cent;
.4 Shutoff devices upstream and downstream of a safety valve should not be permitted unless :

.4.1 a positive interlock is provided which automatically opens additional adequate relief capacity; and
.4.2 an overpressure reactor shutdown signal is incorporated into the protection system ; .5 The qualify level and strength standards for overpressure protection components should be equal to those required for the primary pressure boundary of which they are a part; and
.6 Relief valves may be provided if acceptable to the Administration .

4.07 Secondary coolant system

4.7.1 Except where otherwise provided in this Code, the secondary coolant system should have safety arrangements and a quality level that comply with resolution A.325(IX)* and be to the satisfaction of the Administration.

4.7.2 The steam generators should have the same design standard and quality level as that applied to components of the primary pressure boundary

4.7.3 All steam generators and associated fittings that are under internal pressure should be subjected to tests in accordance with Chapter 8.
4.7.4 Secondary steam lines and feedwater pipes Penetrating the containment structure should be protected by an isolation valve at the containment structure boundary , to provide isolation of the system.

4.7.5 From the steam generator up to the first isolation valve and up to the containment structure boundary, quality control standards for secondary steam lines and feedwater pipes should be equal to those prescribed for the primary pressure system.

4.7.6 Steam generator tubing and components of the secondary coolant circuit should be designed for periodic maintenance, cleaning and inspection , except where the Administration waives this requirement for certain components which are designed for a prescribed, limited, maintenance-free, service lifetime and are to be replaced at the end of that lifetime.

4.7.7 Means should be provided to detect and limit leakage into the secondary cooling system from the primary cooling system.

4.7.8 Means should be provided for overpressure protection of the secondary cooling system upstream of the first isolation valve.

4.7.9 Each steam generator, or group of steam generating devices interconnected in such a way that they cannot be isolated from each other, should be protected against overpressure by at least two safety valves installed upstream of the first isolation valve.

4.7.10 Taking the single failure criterion into consideration, the dimensioning of the safety valves should be such that, whichever are the conditions considered , the internal pressure will never exceed the design pressure by more than 10 per cent.

4.7.11 If a leakage of the primary coolant towards the secondary circuit could lead to an actuation of the safety valves, then the discharge of these valves should be contained within the containment structure or the safety enclosure.

---

* Resolution A.325(IX) has been incorporated in Parts C, D and E of Chapter II-1 of the 1981 amendments to the Convention.

4.08 Residual heat removal

4.8.1 The residual heat removal system should be designed to permit unattended operation during and following all ship accident conditions, except:
.1 capsizing while remaining afloat - subject to the provisions of 4.8.3; and
.2 sinking below a depth where it can be proven that flooding of the containment structure will remove residual heat for as long as is necessary.

4.8.2 Residual heat removal should be proven to operate following capsizing while remaining afloat, if capsizing is a design basis accident according to 2.7.2.

4.8.3 The residual heat removal system should be capable of continuous operation for a period of time shown necessary by accident analysis.

4.8.4 The residual heal removal system should be designed with sufficient capacity, reliability and redundancy to ensure that :
.1 fuel cladding integrity and coolable geometry are maintained under PPCs 1 and 2; and
.2 fuel cladding failures are limited to a value acceptable to the Administration and coo table geometry is maintained under PPCs 3 and 4.

4.8.5 Consideration should be given to the provision of a residual heat removal system that is not dependent upon mechanically generated power for its operation.

4.09 Instrumentation

4.9.1 As far as is reasonably practicable, instrumentation of the reactor protection system should be redundant and be separated from that provided to monitor variables and systems operation .

4.9.2 The design of instrumentation should ensure continuity of its function under any anticipated service environment.

4.9.3 Physical location and duplication of components, wiring and equipment should be such that instrumentation of the reactor protection system will remain operable in the event of fire of single origin or any other ship or reactor accidents.

4.9.4 Limit values and normal working ranges should be indicated on all instruments.

4.9.5 Instrumentation channels monitoring important parameters and safely related equipment should, where practicable, be self-checking or fail-safe.

4.9.6 Subject to 4.10.6, failure of any item of equipment in any instrument channel or malfunction of the instrument channel should, wherever practicable, cause an audible and a visual alarm.

4.9.7 The design of instrumentation should provide for rapid, unambiguous assessment of plant condition. Visual and audible alarms should be used wherever they may contribute continuity of operation or safety.

4.9.8 All information essential to plant performance or to interpretation of malfunctions should be automatically recorded .

4.9.9 Wherever useful for continuity of operation, safety or maintenance, indicators should be provided in the reactor control room, locally and, as far as is necessary, in the emergency control position.

4.10 Reactor protection system

4.10.1 A reactor protection system should be installed, which will:
.1 continuously monitor appropriate reactor conditions;
.2 automatically initiate action by the appropriate systems, such as the reactivity control system, to ensure that reactor system design limits important to safely are not exceeded; and
.3 sense accident conditions and initiate action by systems and components important to safety.

4.10.2 The reactor protection system should have suitable redundancy and capability to ensure that its safety functions can be accomplished assuming a single failure.

4.10.3 The reactor protection system should be capable of being tested during operation without reducing the minimum protection stipulated in the Safely Assessment.

4.10.4 At least two diverse process variables should be measured to detect any malfunction or accident in the reactor system. If this is not reasonably achievable, additional redundancy should be incorporated in the measurement channel of the one available variable.

4.10.5 Reactor Protection system instrumentation, required to operate in PPC 3 or 4, should be specially qualified for operation during such conditions.

4.10.6 Failure of an instrument channel or malfunction of the instrument channel of the reactor protection system should cause an audible and visual alarm .

4.11 Engineered safety features

4.11.1 Containment structure and safety enclosure provisions should include the following :
.1 The containment structure and related systems should establish an essentially leaktight barrier against unacceptable release of radioactive material from the primary system , so that the consequences of any such release are within the limit set forth in Chapter 6;
.2 Only the reactor and NSSS reactor related systems should be within the containment structure and safety enclosure;
.3 In keeping with the concept of defence in depth, the safety enclosure and the containment structure should each provide separate barriers against the release of radioactive materials. Parts of the safety enclosure and containment structure that are in contact with each other should be kept to a minimum and should be designed to avoid a simultaneous breach of both barriers, where postulated hazards may lead to a loss of watertight or gastight integrity of one barrier;
.4 The containment structure should not collapse from external pressure due to sinking or from a live steam line rupture in the safety enclosure;
.5 If devices such as pressure balancing valves are used, in order to prevent collapse of the containment structure due to external overpressure following sinking, due attention should be paid to the leaktightness of the containment structure after completion of pressure compensation;
.6 Design of containment structure should include provisions for :

.6.2 periodic inspection;
.6.3 testing for leaktightness; and
.6.4 system isolation ; .7 Safety related components within the containment structure should withstand the most severe environmental conditions to which they may be subjected in accident situations during which they are required to work, including the effects of coolant jets, missiles and pipe whip forces;
.8 The containment structure should be designed with sufficient margin to ensure that , under operational and postulated accident conditions:

.8.1 materials behave in a non-brittle manner; and
.8.2 the probability of a rapidly propagating fracture is minimized; .9 The design should reflect consideration of service temperatures and other conditions of the containment structure material during operation, maintenance, testing, and postulated accident conditions. It should also reflect the uncertainties in determining:

.9.1 material properties;
.9.2 residual steady state and transient stresses; and
.9.3 size of flaws.
4.11.2 The following provisions apply to the emergency core cooling system (ECCS) :
.1 The number of ECCSs installed should satisfy the conditions of 2.8.4 and should be to the satisfaction of the Administration. Systems should be adequately segregated and redundancy provisions should ma he allowance for failure and repair ;
.2 ECCSs should , as far as is reasonably achievable, maintain the integrity of the fuel elements following LOCA with consequent reactor shutdown. An ample and diverse supply of core coolant should be provided at suitable pressures and flow rates, until long-term heat generated in the core can be safely removed by the residual heat removal systems;
.3 If used, pressurized water accumulators should be equipped with safety valves, pressure gauges and water level indicators to the satisfaction of the Administration. Dedicated supply sources should be available for maintaining the gas cushion in the accumulators;
.4 Except for the principal shutoff, all shutoffs of the ECCSs should be mechanically locked in the position required for operation of the system;
.5 As a minimum requirement, ECCs control components should be operable from the main reactor control room and emergency control positions;
.6 Without prejudice to their functioning or reliability , active components of the ECCS should be capable of being tested at any time to ensure that they will perform satisfactorily when required;
.7 It should be possible to supply power to ECCSs from all generators that are independent of reactor steam supply; and
.8 For short term operation, the ECCS should not require a source of cooling water that is external to the ship.

4.11.3 The following provisions should apply for containment heat removal and atmospheric clean-up :
.1 A system to remove heat from the containment structure should be provided having sufficient capacity lo remove heal released to the containment structure under normal and accident conditions;
.2 Means should also be provided to reduce the concentration of fission products, hydrogen and other gases which may be released into the containment structure, to below that which would sustain combustion or explosion :
.3 A system should be provided for controlling release to the atmosphere of radioactive material and other substances which may be released from the containment under postslated accident conditions;
.4 Systems should be designed to permit appropriate testing and inspection ; and
.5 Each system should have sufficient redundancy and capability to perform its safety function, assuming a single failure.

4.12 Interface of nuclear and ship systems

4.12.1 Piping systems that extend outside the containment structure and which contain or may contain radioactive material should be fitted with double isolation valves and leak detection capability. Where piping systems are over 15 mm in internal diameter, one of the isolation valves should be remotely controlled and operate automatically as the piping system demands.

4.12.2 Interconnexions between normal ship's piping and that which contains or may contain radioactive material, should be minimized. Where interconnexion between such piping is unavoidable. connexions should be fitted with double isolating valves, and provision made to keep the piping between the valves dry. In no event should interconnexions between radioactive fluid systems and potable water systems be allowed .

4.12.3 NSSS pipe supports should be appropriately designed for all ship operating conditions, including emergency conditions such as pipe rupture and subsequent whip.

4.13 Cyclic loading design considerations

4.13.1 Safety margins, acceptable to the Administration, should be used to establish:
.1 the number of cyclic loadings arising from all ship and NPP conditions;
.2 the number and degree of anticipated upset conditions used in design calculations that arise from ship and NPP transients; and
.3 the number and effect of postulated emergency ship and NPP transient conditions expected to occur during the ship's service lifetime.

4.13.2 The effects of each emergency and test condition should be calculated to determine the remaining safe lifetime of the primary system components in terms of further normal, upset, and emergency cycling effects.

4.14 General criteria on fuel behaviour in the reactor

4.14.1 The criteria in this section deal specifically with the behaviour of the fuel in the reactor.

4.14.2 The design, manufacture, inspection and modes of fuel operation should be such that releases of radioactive material from the fuel. during its use in the reactor, are kept as low as required by radiation protection and safety criteria.

4.14.3 For all PPCs, the design of the fuel should take into account such factors as material properties, the effects of irradiation, the need to maintain a coolable geometry, physical and chemical processes, static and dynamic loadings, manufacturing tolerances and uncertainties in calculations.

4.14.4 At the design stage, standards should be specified for the safe performance of the fuel under all PPCs.

4.14.5 The fuel should be assessed by a specified testing programme to confirm its design parameters under all PPCs.

4.14.6 The methods of manufacture and quality assurance should ensure that the fuel achieves the required high level of reliability.

4.14.7 Fuel behaviour monitoring programmes should be established to ensure that specified limits are maintained .

4.14.8 Monitoring of the primary circuit water for failed fuel should be carried out. Fuel that does not conform to the standards laid down for its performance under all PPCs should be removed from the reactor at the first suitable opportunity.

Chapter 5 Machinery and electrical installations

5.1 Scope

This Chapter covers all main and auxiliary machinery and electrical systems required for ship operation. Except where otherwise modified by the provisions of this Chapter, conventional main and auxiliary requirements should comply with Regulations 2 to 17* and electrical systems with Regulations 18 to 23** of resolution A.325(IX).

---

* See also Regulations 26 to 39 of Chapter II-1 and Regulation 15 of Chapter II-2 of the 1981 amendments to the Convention .
**See also Regulations 40 to 45 of Chapter II-1 of the 1981 amendments to the Convention.

Part A Main and auxiliary machinery

5.02 General

5.2.1 Adequate provision should be made to facilitate cleaning, inspection and maintenance of main propulsion and auxiliary machinery, including arrangements for radioactive decontamination, where required .

5.2.2 Steam turbines should, where necessary, be protected against the possibly damaging effects of very wet steam.

5.2.3 Arrangements should be provided to protect any supply systems of Safety classes 1 and 2 from damage due to missiles accidentally generated within the machinery spaces .

5.2.4 Where there is a danger of failures, such as loss of lubricating oil leading to complete breakdown, damage or explosion, main propulsion machinery and relevant auxiliary machinery should be provided with automatic shutoff arrangements. The Administration may permit provisions for over-riding automatic shutoff devices, but before manual over-ride is permitted on shut-off arrangements service safety related equipment, its effect should first be assessed on a case-by-case basis to ensure that dangerous conditions cannot arise or are prevented by alternative means.

5.2.5 The inclination angles at which main and auxiliary machinery should be capable of operation are :
.1 for main propulsion machinery - in accordance with the requirements of Regulation 2(f)* of resolution A.325( IX): and
.2 for auxiliary machinery - in accordance with the requirements of Regulation 2(f)* of resolution A.325(IX) , provided that essential reactor safety related machinery should be capable of meeting its required function under accident conditions.

5.2.6 Penetrations of the containment structure and the safety enclosure boundaries should be restricted to services essential to the operation of the reactor.

---

*See also Regulation 26.6 of Chapter II-1 of the 1981 amendments to the Convention.

5.03 Communications

5.3.1 At least one system of communication, which should be available in the event of complete loss of electrical power should be provided between each of the locations listed in this subsection. Where applicable, this provision may be met by the requirements of Regulation 15 of resolution A.325( IX)* Locations are:
.1 navigating bridge;
.2 reactor control room;
.3 emergency control position;
.4 machinery space containing main propulsion machinery, main service generating sets, standby generating sets and emergency generating sets;
.5 the main and emergency machinery control rooms, if any, and
.6 accessible spaces of the reactor compartment.

---

* See also Regulation 37 of Chapter II-1 of the 1988 amendments to the Convention.

5.04 Bilge pumping and ballast arrangements

5.4.1 Bilge pumping arrangements for all watertight compartments, except permanent ballast and cargo tanks, should comply with the most severe requirements of Regulation 18 of Chapter II-1 of the Convention.*

5.4.2 Bilge, ballast and drainage systems should be arranged to prevent the spread of radioactive liquids.

5.4.3 Bilge pumping installations, serving compartments into which radioactive liquids may leak in norma1 service, should be separate from and independent of the ship's main bilge system, and should be adequate for PPCs 1 to 4. Pumping machinery or piping containing radioactive material on a temporary or permanent basis should be adequately shielded.

---

* See also Regulation 21 of Chapter II-1 of the 1981 amendments to the Convention.

5.05 Cooling water systems

5.5.1 Liquids used for cooling components connected to the primary circuit, should be compatible with are materials normally in contact with the primary coolant.

5.5.2 To supply cooling water to essential auxiliaries and the main engines, systems having separate high and low sea suctions should be provided on both the port and starboard sides. Overboard discharges from essential services should be assured at all times, including periods when the ship is alongside a solid quay.

5.5.3 Facilities should be provided to ensure uninterrupted and reliable cooling for essential auxiliaries when the ship is in dry dock. Shore supplies of water may be used , preferably with two independent connexions.

5.06 Hydraulic and pneumatic systems

5.6.2 For each compressed air system essential to reactor safety there should be provided at least two independent and segregated air reservoirs, each of sufficient capacity to provide the essential services for which the system is intended. Single failure of any active component of the compressed air system should be considered.

5.6.3 Where necessary, compressed air for control equipment should be dried, filtered and temperature conditioned .

5.6.4 The requirements of 5.6.1 and 5.6.2 also apply to the provision of pumps and accumulators where relevant and , in principle, to hydraulic systems if the function of the system affects reactor safety .

5.07 Emergency propulsion

5.7.1 The NPP should be designed to have a reliability at least equal to the reliability of a conventional propulsion plant.

5.7.2 A ship equipped with a single reactor off type the reliability of which has not been demonstrated should be provided with an emergency source of propulsive power for the main propulsion plant, which should:
.1 have sufficient power to permit the ship to operate safely in port or harbour and to maintain steerageway in sea conditions corresponding to a wind force of Beaufort 6 approaching the ship on the beam, with the ship in any normal condition of loading;
.2 be in a state of readiness when the ship is under way in narrow or congested waters;
.3 be located outside the reactor compartment and should remain operable in the event of a reactor incident.

Part B Electrical systems

5.08 General

5.8.1 The reliability of the electrical installation should be commensurate with the requirements for both nuclear and ship safety given in this Code and in resolution A.325(IX).*

5.8.2 In any PPC up to and including PPC 4a, the electrical system as a whole, excluding the generating set dependent on the NSSS, should be capable of shutting down the reactor and holding it in a safe state for at least 30 days assuming a single failure in the electrical system in addition to the initiating event which caused the PPC (see Appendix 6).

5.8.3 The electrical installation should consist of a main electrical system and an emergency electrical system .

5.8.4 The main electrical system is composed of service generators, standby generators and main distribution system and supplies electrical power to both ship and reactor consumers.

5.8.5 Service generators are those electrical generators which are required to maintain the ship in normal operational and habitable conditions, with the NSSS at power, without recourse to either standby or emergency generation.

5.8.6 Standby generators are those electrical generators which are independent of the NSSS and are required to replace inoperable service generators. They supply those services necessary to provide normal operational conditions of propulsion and safety and to maintain minimum comfortable conditions of habitability and to start up the NSSS from dead ship conditions.

5.8.7 The emergency electrical system is that system , composed of emergency power sources and their associated distribution system. which supplies electrical power to consumers essential to ship and reactor safety.

5.8.8 The transitional electrical power source is that power source which ensures an uninterruptable source of electrical power to specified consumers when other sources of electrical power are unavailable.

5.8.9 The design of the electrical power system should permit appropriate periodic inspection and testing of equipment important to nuclear safety and ship safety.

5.8.10 The emergency electrical system and each section of the main electrical system, should be independently capable of providing sufficient power to the reactor safely systems, to ensure that:
.1 the specified fuel design limits and other reactor design conditions are not exceeded as a result of any condition up to and including PPC 4a: and
.2 the core is cooled and other vital functions are maintained in the event of postulated accidents at all angles required by Chapter 2.

5.8.11 The generating sets independent of the NSSS should be such as to ensure that with any one of them out of operation, the remaining generators will be capable of providing the ,electrical services necessary for startup from dead ship conditions and to maintain minimum comfortable and habitable conditions during reactor startup. Emergency generators may be used for the purpose of startup if their capacity is sufficient to provide, at the same time, those services essential for ship safety.

---

* Resolution A.325(IX) has been incorporated in Parts C, D and E of Chapter II-1 of the 1981 amendments to the Convention.

5.09 Main electrical system

5.9.1 The main electrical system should be designed in such a way that:
.1 the failure of a single component of a generator of the main electrical system, together with its prime mover and auxiliaries,

.1.1 does not involve a reactor trip;
.1.2 does not involve a loss of manoeuvrability of the ship; and
.1.3 allows the full electrical power necessary for maintaining the ship in normal operational and habitable conditions to be restored within a few minutes; .2 the failure of a single component of the main distribution system does not involve:

.2.1 a reactor trip;
.2.2 a loss of msnoeuvrability of the ship.
5.9.2 The service generating capacity should be sufficient to supply the full electrical power necessary for maintaining the ship in normal operational and habitable conditions.

5.9.3 The main electrical system should be capable of being supplied by at least one standby generating set.

5.9.4 The standby generators should have sufficient capacity to supply the electrical power necessary for startup of the NSSS from dead ship conditions, and for supplying those services necessary to provide normal operational conditions of propulsion and safety and minimum comfortable conditions of habitability.

5.9.5 Standby generator sets should be designed to start up and accept load automatically as quickly as is safe and practicable (for example, a few minutest) upon the loss of voltage of its associated busbars. In order to ensure ready availability of systems necessary for ship safety, load shedding arrangements should be provided where necessary to disconnect automatically those circuits not essential for ship safely.

5.9.6 The fuel supply, for the standby generating sets should :
.1 be of a design that will prevent a common mode failure from disabling all generating sets and be as close as practicable to the standby generator;
.2 be capable of being used by the emergency power generators;
.3 be sufficient for supplying any standby generator at full load for a time which is compatible with the ship's route and for emergency requirements;
.4 not be rendered unavailable to any emergency generator by a condition disabling a standby generator.

5.9.7 The main electrical system should be divided into at least two sections, each section having its own main switchboard , and each section being supplied by at least one service generator.

5.9.8 Main electrical system sections should be so arranged that any PPC 1 or 2 which disables one main electrical section does not disable another main electrical section .

5.9.9 Duplicated equipment fed by the main electrical system should be equally divided between main electrical sections and appropriately segregated . Distribution systems should be so designed and located as to minimize , to the extent practicable, the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions.

5.10 Emergency electrical system

5.10.1 The emergency electrical system, and any generating sets independent of the NSSS which supply emergency loads, and the emergency distribution systems, should have sufficient independence, redundancy and testabiltty to Perform their safety functions, assuming a single failure in any condition up to and including PPC 4a as defined in 5.8.2.

5.10.2 Any generating set provided to meet the requirements of 5.8.2 in order to supply emergency loads should comply with the requirements contained in this Code for emergency generating sets .

5.10.3 In addition to the emergency electrical system capacity required by resolution A.325(IX),* there should be sufficient capacity to :
.1 safely shut down the reactor;
.2 safely bring the reactor to a cold subcritical state and maintain it in that state; and
.3 supply all reactor safety functions.

5.10.4 The emergency distribution systems provided to meet the requirements of 5.8.2 should be segregated so that the initiating PPC will not disable more than one emergency distribution system .

5.10.5 Each emergency switchboard should be capable of receiving electrical power from either section of the main electrical system .

5.10.6 Reactor protection and safety systems and related safety loads should be fed by the emergency distribution system.

5.10.7 Each emergency generator should be capable of being started and controlled from the switchboard to which it is is connected and should he located in the compartment with the emergency switchboard to which it is connected.

5.10.8 The emergency power supply should be capable of being independently started from the main reactor control room, emergency control position and at the location of the emergency generating set. A casualty in any one of these spaces other than the location of the emergency generating set should not prevent the startup and control of the emergency generator from the emergency switchboard.

5.10.9 Electrical equipment and non-electrical machinery and systems unrelated to the emergency function should not be located in the spaces where the emergency generators, controls and switchboards are located.

5.10.10 Each emergency generator should automatically start up upon a signal of loss of voltage on its associated busbar.

5.10.11 The emergency electrical system should assume its electrical loads within a short period of time from startup.This time should be consistent with the requirement defined by PPC 1 to 4a.

5.10.12 The emergency electrical system should be capable of periodic full load and starting time testing, under simulated conditions of power failure. The emergency electrical source should be independent of other electrical supplies, to the extent that faults on those supplies will not prejudice the required reliability and effectiveness of the emergency system.

5.10.13 The design of the emergency electrical system should be such that direct synchronizing of power sources should not be required to meet an emergency demand .

5.10.14 Sufficient fuel should be available to emergency generator sets for a minimum of 30 days operation after any PPC, up to and including PPC 4a.

---

* Resolution A.325(IX) has been incorporated in Parts C, D and E of Chapter II-1 of the 1981 amendments to the Convention .

5.11 Transitional pouter sources

5.11.1 Transitional power sources should be provided and they should have sufficient independence, redundancy and testability to perform their safety functions, assuming a single failure in any condition, up to and including PPC 4a, as defined in 5.8.2.

5.11.2 Transitional porter sources may be omitted if it can be shown that the consumers defined in 5.11.4 have an uninterruptable power supply assuming a single failure in any condition up to and including PPC 4a, as defined in 5.8.2, and the requirements of 5.11.3 to 5.11.6 are met.

5.11.3 The transitional power sources should be segregated so that a PPC 1 to 4a does not disable more thats one redundant power source.

5.11.4 Each transitional power source should be designed to supply for a minimum period of 30 minutes the following reactor consumers
.1 the controls and monitoring equipment of the reactor safety system;
.2 radiation protection monitoring systems;
.3 other reactor controls and monitoring equipment used for anticipated PPC 1 to 4a; the supply of other equipment should be approved by the Administration.

5.11.5 If batteries are used for transitional power sources, the capacity of the battery charging system must be based on the largest combined steady/transient loads and the charging load to restore the battery from the minimum to the fully charged state. During discharging the tolerances of voltage deviation should be within the limit set in Regulations 20 and 21 (d) of resolution A.325(IX) .*

5.11.6 Accumulator batteries should meet the requirements laid down in resolution A.325(IX)** Batteries used exclusively for the NSSS may be located below the uppermost continuous deck , provided that this does not prejudice the integrity of the system as laid down in 5.11.1.

---

* See also Regulations 42 and 43.4 of Chapter II-1 of the 1981 amendments to the Convention .
** Resolution A.325(IX) has been incorporated in Parts C. D and E of Chapter II-1 of the 1981 amendments to the Convention .

5.12 Shore power connections

Shore power connections should be provided , through which power may be supplied to any section of the main electrical system.

5.13 Electrical wiring and component insulation

5.13.1 Electrical wiring and components which are to fulfil their safety function after a postulated accident should withstand the environmental conditions ( pressure, temperature, moisture, etc.), associated with that accident.

5.13.2 Cables to redundant safety systems, switchgear and consumers should be routed on fully segregated and/or protected paths.

5.14 Penetration of physical barriers by electrical cabling

5.14.1 Electrical cable penetrations of the containment structure, safety enclosure and reactor compartment boundaries, should be kept to a minimum consistent with safely considerations. Penetrations should not impair the required leaktightness and fire resistance of boundaries nor should they prevent satisfactory inspection and testing .

Chapter 6 Radiation safety

6.01 General

6.1.1 This Chapter sets out the basic principles and requirements for radiological protection and radioactive waste management having a bearing on the design, construction and operation of a nuclear ship. Elsewhere in the Code specific measures necessary to meet the requirements of this Chapter are dealt with in greater detail .

6.1.2 The expression "as low as is reasonably achievable" is used at frequent intervals throughout this Chapter and occasionally elsewhere in the Code. In the context of radiological protection. ICRP has indicated that the expression is intended to imply the optimization of radiological protection arrangements whereby activities involving exposure to radiation are carried out at a level of exposure (within dose-equivalent limits) such that further reduction would not justify the incremental cost required to accomplish it. The Commission's suggested procedure as to how such assessments be might be carried out is outlined in paragraphs 72 to 76 of ICRP Publication 26, while further guidance specifically related to the release of radioactive materials to the environment is provided by IAEA in its Safety Series No.45.

6.02 Radiological protection design

6.2.1 The nuclear power plant and other sources of radiation should be designed and shielded so that during PPC 1,2 and 3 all exposures are kept as low as is reasonably achievable and in any case within the relevant dose-equivalent limit. Distance and occupancy time, as well as shielding, should be considered for controlling exposure.

6.2.2 The design should be such as to ensure that when the reactor is operating normally or is shut down, no persons on board or in the vicinity of the ship may as a result of the ship's operation be subjected to radiation or contamination levels in excess of limits laid down in accordance with 6.3.1.

6.2.3 Where appropriate, safety factors should be adopted at the design stage to provide margins for contingencies.

6.2.4 The design of the ship and its NPP should be such that there is no significant increase in the background radiation level of a port, due to the operation of a ship In PPC 1 and 2.

6.2.5 The ship should be divided into areas designated according to the actual or potential magnitude of the radiological hazard involved . Taking into account the nature of the radiological hazard in controlled and supervised areas, access barriers, protective clothing, personnel monitors, washing facilities and changing rooms should be located, as needed , between controlled or supervised areas amici adjacent uncontrolled areas, to prevent the transfer of contamination from one area to another. Warning signs should be placed at the entrance to a controlled or supervised area to indicate the hazards. Access to a controlled area should be limited to authorized persons and their entrance and exit should be registered .

6.2.6 Radiological protection arrangements should be such that, under normal operating conditions, no restrictions are necessary on the carriage and handling of cargo or for the maintenance of the conventional part of the ship. While the ship is in drydock, access to the ship's bottom may be limited administratively.

6.2.7 Within the uncontrolled areas it would be expected that, as far as is reasonably achievable, dose rates at power for PPC 1 and 2 would not exceed the values set out for guidance in Appendix 4.

6.2.8 The design should be such as to minimize, as far as reasonably achievable, the spread of radioactivity. All purls of the ship in which radioactive materials or contamination may exist should be identified and appropriate design measures taken to ensure that the spread of radioactive material or contamination into other parts will be minimized and that any necessary decontamination procedures can be carried out safely within the relevant dose-equivalent limit .

6.2.9 Consideration should be given to the potential for contamination of surfaces and equipment. Appropriate design measures should be incorporated to minimize the difficulties of decontamination procedures and to permit proper control of the radio- active wastes which arise. Structural and surface irregularities should be avoided in all systems and equipment containing radioactive materials.

6.2.10 The design of the reactor and its associated plant (including the waste management installation) , their shielding and containment provisions and their location on the ship should be such that any release of radioactivity arising from PPCs will not prevent the ship being moved within requirements of 6.3.1.3.

6.2.11 The dose equivalent from external irradiation, together with the committed dose equivalent arising from intakes of radioactivity, which could be received at the outside surface of the hull or its vertical projection where appropriate should be within the requirements of 6.3.1.3 for any accident condition considered to be PPC 4.

6.2.12 Those parts of the ship which would be required to be occupied by either Passengers or crew during any PPC 4 event should be so located and/or shielded as to ensure that doses to personnel staying in such spaces for the whole course of the event would be within the requirements of 6.3.1.

6.2.13 Arrangements should be provided to ensure that servicing, maintenance and in-service inspection can be carried out safely, with neither unacceptable exposure of personnel to radiation nor unacceptable release of radioactive material to the environment.

6.03 Protection of persons

6.3.1 Limits for radiation exposure and contamination levels:

6.3.1.1 Radiation doses received by the crew, other persons on board and members of the public, as a result of operation of the ship in PPCs 1,2 and 3, should be kept as low as is reasonably achievable and within the appropriate dose-equivalent limits recommended by ICRP
6.3.1.2 Surface or airborne contamination as a result of PPCs 1,2 and 3 should be within limits that are derived from the relevant dose-equivalent limits.
6.3.1.3 The design basis limit for doses to persons on board the ship and members of the public in the event of a PPC 4 should not exceed twice the relevant annual dose-equivalent limit for occupationally exposed persons.
6.3.2 Unless designated as occupationally exposed persons, no member of the crew or any other person on board or in the vicinity of the ship should be exposed, as a result of the ship's operation, to radiation doses which exceed the relevant dose-equivalent limit for members of the public.

6.3.3 Only those persons who normally work within controlled or supervised areas of the ship are to be considered as occupationally exposed persons.

6.3.4 The ship should be equipped with sufficient means of individual protection, including filter respirators and air-supplied sets, to deal with PPC 1 to 4 requirements.

6.3.5 Documented procedures should be established that will provide adequate radiation protection to crew members under all PPCs and should include:
.1 systematic and thorough surveying of work areas prior to commencement of work,
.2 planning of work and worker occupancy time in the work area, to ensure that individual radiation exposures are kept as low as is reasonably achievable and within the limits laid down in 6.3.1.1 and 5.3.1.2;
.3 estimation of individual radiation exposures for the work planned;
.4 selection of the necessary personnel dosimeters, Protective clothing , respiratory, and communication equipment for each worker;
.5 administrative controls, to preclude inadvertent exposure to unexpectedly high radiation levels during maintenance and inspection;
.6 prophylactic measures and decontamination of contaminated workers and unshielded surfaces; and
.7 radiation emergency procedures on board the ship, including interfacing with the Administration's port contingency plan, and regular periodic exercise of all emergency plans.

6.3.6 No change in radiation protection procedures (ad hoc or routine) should be implemented without the advice of the designated on-board health physics authority and the approval of the master.

6.3.7 A detailed record should be kept of the doses received by each member of the crew who is an occupationally exposed person and who normally works in a controlled area . Other persons who are required to enter controlled or supervised areas should be issued with approved personal dosimeters and a dose record kept as appropriate.

6.3.8 When a nuclear ship is decommissioned, precautions should be taken to protect to an extent reasonably achievable persons and thus the environment from irradiation and contamination hazards originating principally from :
.1 highly radioactive fuel elements and effluents;
.2 the coolants and components of the reactor primary circuit and other circuits of low level radioactivity; and
.3 any other radioactive waste arising from decommissioning.

6.04 Dosimetry and monitoring

6.4.1 Monitoring facilities, incorporating fixed or portable equipment as appropriate, should be provided on the ship to indicate and record , where necessary, radiation levels, airborne and surface contamination levels, radioactive concentrations and flows. The following should be included in these facilities:
.1 measures to provide warning and, where necessary . take action if predetermined levels of radiation , contamination, radioactive concentrations or radioactive flows are exceeded;
.2 equipment to indicate and record radiation levels and activity concentrations of the primary and secondary coolant circuits and of all radioactive wastes stored on board and of all potentially radioactive discharges from the ship;
.3 equipment lo indicate the activity concentration of fluids cooling those components of the NSSS which are in contact with pressurized primary coolant; and
.4 adequate supply of spare monitoring instruments and suitable on-board facilities for the maintenance and calibration of monitoring equipment.

6.4.2 The range of fixed and portable monitoring equipment should permit radiation monitoring during normal operation of the NSSS and during accident conditions.

6.4.3 Where practicable, indications of radiation levels and of airborne contamination levels in controlled areas should be presented at a central control point. The secondary and intermediate coolant circuits as well as the atmosphere inside the containment structure anti the safety enclosure should be continuously monitored by separate systems that will give indication at a central control point and warning inside the safety enclosure if any significant increase in level is detected.

6.4.4 Data, reported by means of fixed monitoring equipment, should be supplemented by data collected during regular inspections from portable monitors. Personnel used for such inspections should be trained in the use of the instruments employed.

6.4.5 Sufficient fixed radiation checkpoints should be established so that it is possible to compare radiation levels or contours within the ship periodically during the life of the ship with the original surveys made when the ship was commissioned. An adequate number of fixed points should be selected. principally on plant within the safety enclosure. Points outside the safety enclosure, both within the ship and on its exterior surface, should also be used .

6.4.6 Radiation levels or contours should be checked at full power, harbour power, shutdown, berthing and drydocking. Contours should be redrawn where necessary. In addition, normally accessible areas of the ship should be periodically checked for contamination .

6.4.7 The ship should be equipped with sufficient portable monitors for routine and emergency radiation surveys; this equipment should include beta, gamma and neutron survey meters, air samplers, and alpha/beta contamination monitors.

6.4.8 The quantity of personal dosimeters carried on board should meet the needs of normal service and should be sufficient for all passengers and crew in the event of an accident.

6.4.9 In addition to the instruments mentioned above, the ship should be Provided with appropriate laboratory equipment, satisfactory to the Administration, for the analysis of radioactive sample .

6.4.10 The radioactive monitoring and recording systems should include :
.1 fixed and portable equipment for assessing the concentrations and amounts of gaseous and airborne particulate radioactive material which may be released to the environment;
.2 equipment to detect releases of radioactive material from the fuel elements and to detect the presence of radioactive gases with in the primary coolant;
.3 installed equipment, including a suitable alarm system, to monitor from the gaseous discharge lines the rate of release of radioactivity and the total activity released;
.4 equipment to assess to a specified accuracy the activity concentration and total amount of liquid wastes in the collection, treatment and storage facilities;
.5 equipment to determine the levels of specified radioactivity isotopes in liquid wastes prior to their discharge to the marine environment;
.6 installed equipment, linked to a suitable alarm system and having the capability of automatically isolating the liquid waste discharge lines , to measure and record the activity concentration and the discharge flow rate where liquid waste discharge to the sea is permitted;
.7 equipment for assessing the levels and types of radiation emitted by solid radio-active wastes, prior to segregation and treatment; and
.8 suitable procedures and testing and monitoring equipment to verify the correct operational condition of the waste management equipment.

6.4.11 A detailed, comprehensive and durable record should be maintained of
.1 doses to occupationally exposed persons and any others on board, as required by 6.3.7;
.2 radiation ten Is throughout the ship;
.3 contamination leveIs in accessible parts of the ship;
.4 the radioactive wastes arising (solid, liquid and gaseous), the types of treatment used and the quantities and locations of radioactive wastes stored on board;
.5 the amounts and activities of wastes discharged from the ship , the time and the geographical location of the discharges;
.6 the estimate made of the isotopic composition of discharges, including estimates of the amount of radioactivity associated with each of the major or otherwise specified constituents;
.7 the dose rates in waste storage areas for health physics record purposes; and
.8 the radioactivity of primary circuit coolant.

6.4.12 Provision should be made, in accordance with Chapter 7, for the prompt reporting and dissemination of information concerning the emergency or accidental release of radioactive substances in excess of recommended limits.

6.05 Radioactive waste management - general requirements

6.5.1 The design of the NSSS and associated parts of the ship, should provide for the safe management of radioactive wastes by storage and eventual disposal, or by controlled release to the environment within the limitations imposed by 6.6.1.

6.5.2 The design of the NSSS should be such as to minimize the production of radio- active wastes as far as can be reasonably achieved

6.5.3 The NSSS design should include adequate provisions for the control and treatment of solid, liquid and gaseous radioactive materials produced during PPCs 1 and 2, to ensure that the radiological impact on the ship and its environment is as low as is reasonably achievable and within the limits given in 6.6.1.

6.5.4 The design and operation of treatment and storage facilities should consider:
.1 the potential quantities of radioactivity arising;
.2 shielding and cooling requirements;
.3 possible corrosive effects of certain radioactive 1iquids or gases;
.4 the detection of leaks;
.5 the presence and detection of combustible gases, such as hydrogen; and
.6 provisions to prevent the explosion of combustible gases or liquids and to mitigate its effect should it occur.

6.5.5 The minimum capacity of liquid, solid and gaseous radioactive waste storage facilities should be suitable for the ship's service and should include an appropriate allowance for contingencies. The capacity should recognize a range of probable plant process conditions as well as the period between discharging the waste at suitable shore-based waste handling facilities.

6.5.6 The waste management facilities should be designed to prevent the uncontrolled release of radioactive waste to the environment.

6.5.7 Storage, on-board processing (if any) and transportation facilities and discharge pipelines for radioactive waste materials should be designed. constructed, operated, maintained and surveyed to a high standard commensurate with their safety implications and in such a way that any uncontrolled release of radioactive substances to the environment or into other compartments of the ship will be prevented.

6.5.8 Criteria should be defined in the Safety Assessment for the design, manufacture, operation and testing of the radioactive waste treatment foci lilies ( if any) and of the storage facilities. These criteria should take into account the possible need for segregation of wastes on account of their chemical properties and their radioactive characteristics, such as specific activity or radioisotope content.

6.5.9 Combustible wastes should be adequately protected against fire.

6.5.10 Handling and storage of radioactive waste, in quantities that could significantly contribute to personal doses received in the event of a collision, should normally be confined to areas within the collision protective structure. Limited quantities of radioactive wastes may be carried outside these areas provided that they are properly packaged in containers approved by the Administration.

6.5.11 No radioactive waste other than the ship's own treated waste should be carried on board the ship unless carried as cargo in accordance with accepted international agreements.

6.06 Criteria for discharge of radioactive waste

6.6.1 Radioactive levels of wastes arising from the ship's operations discharged from the ship to the environment in PPC 1 and 2 should be as low as is reasonably achievable and in any case within the following limits :


6.6.2 The design should be such as to prevent where practicable discharges of gaseous radioactive effluents when in port or harbour. If such discharges become necessary they should conform to the requirements of the host Administration .

6.5.3 Discharge of solid and liquid waste to appropriate dockside facilities should be in accordance with regulations of local authorities and the host Administration.

6.6.4 Protection against radiological hazards to those on board and in the vicinity of the ship , from the handling of wastes, should meet the requirements of 6.2.

6.07 Management of solid radioactive waste

6.7.1 Typical sources of solid radioactive wastes to be considered are those containing radioactivity originating from the NSSS, including :
.1 ion exchange resins;
.2 filters; and
.3 miscellaneous items, including contaminated clothing, tools and items from the sampling laboratory.

6.7.2 Solid radioactive waste should only be discharged to properly equipped dockside facilities and not to the sea. Transfer from the ship to appropriate dockside facilities should be under strict health physics control, to ensure that direct radiation exposure is minimized and that surface or airborne contamination is avoided.

6.7.3 Prior to storage, solid radioactive wastes should be segregated as appropriate according to their activity, types of radiation emitted, chemical activity, combustibility, etc. Solidification and/or volume reduction systems may be included in the design of the ship if they meet the ship specification and design requirements of the Code. If these facilities are included, due regard should be given to their safely in normal operation and to the need to discharge the waste eventually. The storage facilities for solid radioactive wastes should take account of the possibility that such wastes might contain or develop gases or liquids. Where this Possibility exists, the waste should be kept in closed, gastight containers or tanks which may require venting. Such tanks should be periodically inspected and maintained and suitable equipment should be available to check their integrity and leaktightness. Where a vent system is necessary. it should be connected to a storage facility or to an approved discharge route which should be acceptable to the Administration for operation when in port or at sea.

6.08 Management of liquid radioactive waste

6.8.1 The on-board waste collection, treatment (if any) and storage facilities should be designed to cope with the volume of liquid waste arising from NSSS operation, for example from sources such as:
.1 the increase in primary coolant volume resulting from thermal expansion as the reactor is brought to operating temperatures;
.2 operational leakages and wastes originating from primary and auxiliary circuits, equipment and personal decontamination, laundry, sampling and other miscellaneous sources; and
.3 repair and maintenance work .

6.8.2 The discharge of large amounts of chemically toxic and .radioactive wastes., which may result from major decontamination procedures requiring draining of radioactive circuits, should be carried out using special facilities complying with the requirements of the Administration where the discharge takes place. The facilities should provide for the transfer of liquid radioactive wastes from the ship to the shore, or to special floating facilities, by two separate systems, one intended for higher activity wastes and the other for lower activity wastes.

6.8.3 Subject to the provision of 6.5.10, radioactive liquids should be collected and stored on board ship in closed containers or tanks, if their discharge would exceed the limits given in 6.6.1.

6.8.4 The following requirements should be recognized in the design of liquid radioactive waste treatment and storage facilities.
.1 Wastes should be segregated on the basis of their physical and chemical nature and/or their radioactive characteristics, such as specific activity or isotope content;
.2 Means of removing unwanted sludge from systems should be provided;
.3 A monitoring system and delay tanks should be provided , with arrangements for determining the volume and radioactivity of their contents as well as the rate at which these contents are released to the environment. Design should allow for further treatment of contents , if required;
.4 Each discharge and transfer line handling radioactive waste should be provided with automatic isolation capability, to prevent inadvertent or uncontrolled releases;
.5 The capacity of storage tanks should be sufficient to cope with all bilge liquids produced in the safety enclosure and other controlled areas, under PPC 1 and 2: and
.6 Adequate cooling and shielding arrangements should be provided for treat- ment and storage facilities.

6.09 Management of gaseous radioactive waste

6.9.1 Included in the gaseous radioactive wastes requiring management are those arising from the NSSS, including those from :
.1 neutron activation of the primary coolant and its impurities;
.2 the escape of gaseous and volatile fission products from defective fuel elements: and
.3 direct neutron activation of the air of the containment structure.

6.9.2 Means should be provided to control all discharge routes through which gaseous radioactive waste could reach the environment. Typical discharge sources include :
.1 leakage from the primary coolant;
.2 venting of the primary circuit;
.3 venting of the waste tank gas spaces; and
.4 venting of the containment structure volume.

6.9.3 Discharges to the environment should meet the requirements of 6.6.1. Where this cannot initially be achieved, the waste gases should be treated to meet the release criteria or stored in specially provided facilities on board .

6.9.4 The compression of radioactive waste gases and their storage under pressure may be permitted provided that the design, construction, operation and in-service testing arrangements for the storage pressure vessels and associated pipework meet the requirements specified in the Code. It should be shown by evaluation that failure of a storage vessel would not lead to an unacceptable condition. The possible hazard arising from stored or compressed combustible gasps must also be taken into account.

6.9.5 The activity concentration of effluent gas to the atmosphere should be controlled and if necessary diluted so that the maximum allowable activity concentration is not exceeded. Discharge lines should be equipped with isolation capability to prevent inadvertent or uncontrolled releases.

6.9.6 It should be possible to monitor the activity or radiation level , as appropriate, in the storage container area.

6.10 Ventilation and filtration*

6.10.1 A combination of efficient ventilation and filtration arrangements should be provided to :
.1 maintain airborne radioactivity concentration in manned spaces within limits derived in accordance with 6.3.1.2;
.2 permit reactor containment structure purge capability; and
.3 prevent the uncontrolled spread of airborne contamination.

6.10.2 Exhaust from the containment structure purge system and from the safety enclosure ventilation system should be through a monitored, alarmed and filtered route leading to a discharge point. so designed as to avoid contamination of normally inhabited areas and accumulation of radioactive materials in the discharge lines.

6.10.3 The ventilation and filtration system for the containment structure should be completely independent of the systems serving any compartment outside the safety on closure .

6.10.4 Exhaust air from controlled and supervised areas should be continuously monitored and it should be possible to pass such air through efficient filters capable of a high standard of separation.

---

* See also 3.1.11,3.2and 4.11.1

Chapter 7 Operation

7.1 General operating principles and competent bodies

7.1.1 The following basic requirements apply to a nuclear merchant ship:
.1 No privileges in sailing rules should be afforded to nuclear ships that do not equally apply to conventionally powered ships of similar type;
.2 At all times, when there is fuel in the reactor, the NPP should be supervised by qualified personnel keeping continuous watch in the main reactor control room ;
.3 All work required on board ship involving the handling and disposal of gaseous, liquid or solid radioactive materials, or the possibility of spreading contamination , should be carried out only in properly arranged and equipped locations. An adequate control of radiation exposure should be ensured when performing such work ;
.4 No fissile materials, other than fuel in the reactor or cargo carried in accordance with the International Maritime Dangerous Goods Code, should be carried on the ship;
.5 Under normal operating conditions (PPC 1 ), provision should be made for rapidly starting the NPP and quickly raising its power to a level commensurate with the requirements for safe navigation. The emergency source of propulsion power, where fitted. should be ready for use when the ship is in coastal or harbour waters;
.6 Organization of the various operating modes of the NPP and its associated equipment should comply with the provisions of the Operating Manual approved by the Administration: and
.7 Manning levels and the training, qualifications and certification of officers and crew should be to the satisfaction of the Administration and be such that the ship may be safely operated .

7.1.2 Safety considerations in the use of ports and approaches are given in "Safety Recommendations on the Use of Ports by Nuclear Merchant Ships", published by IMCO on behalf of both IMCO and IAEA. Where required, supplementary provisions regarding the approach, entry and stay of a nuclear ship in their ports should be published by the Governments concerned .

7.1.3 The responsible organization should be responsible for the safe operation of the ship and its NPP. It should ensure that:
.1 the ship is operated in compliance with the provisions of the Safety Assessment, the Operating Manual and any applicable regulations of the flag or host Administrations;
.2 manning of the ship, by qualified personnel, complies with Administration requirements ;
.3 officers and crew are properly trained and retrained;
.4 the ship is made available at prescribed intervals for Administration surveys, as required by Chapter 8; and
.5 maintenance and repair work is carried out by properly trained persons.

7.1.4 The master, officers and crew members should have proper qualifications and have undergone training appropriate to their responsibilities and duties and in accordance with the requirements of the Administration. Certain crew members should be qualified in radiological protection matters and have the responsibility for ensuring that all necessary radiation protection measures are carried out. The lines of responsibility for radiological health and protection matters should be documented. The minimum number of such personnel on constant standby should be to the satisfaction of the Administration.

7.2 Operating documentation

7.2.1 Operating documentation reflecting specific features of the construction and operation of the ship should be kept permanently on board. These documents, which are additional to those required by non-nuclear ships of similar type, should be kept up to date and be available on board ship for inspection by flag and host Administrations. included in such documents are:
.1 the Nuclear Ship Safety Certificate;
.2 operating licence (if issued by the Administration) and details of any operational constraints imposed by the Administration;
.3 the Safety Assessment and associated drawings;
.4 the Operating Manual;
.5 certificates attesting to the nuclear training of the master and ship's officers, and other relevant crew members holding specialized certification;
.6 the radiation emergency plan and the radiation muster list;
.7 records of surveys, functional tests. maintenance and repairs of the NSSS; and
.8 registration logs for radiation control, radioactive waste management, and fissile material inventory.

7.2.2 The ship's Safely Assessment should contain detailed information that will permit qualified personnel to assess the safety of the ship and its NPP. The presentation and contents of the Safety Assessment should be generally in accordance with Appendix3.

7.2.3 The Operating Manual for the ship should present all information necessary for qualified personnel to operate the ship and its NPP safely under all normal operating conditions, as well as instructions on appropriate action to be taken in the event of specified emergencies. The following paragraphs describe some of the data that are to be included in the Operating Manual ;
.1 Particulars are to be given of the NPP, with diagrams of systems and other relevant data for items such as radiation monitoring, radiation health protection equipment, means of fire protection and extinguishment, spare equipment and parts;
.2 Values for normal operation of the NSSS and associated systems are to be shown, including nominal values, limiting values, and authorized deviations therefrom. Important parameters to be covered , include :

.2.1 residence times for personnel in radiation areas;
.2.2 radiation levels in selected areas; and
.2.3 activity levels in the primary and secondary coolants and in liquid, solid and gaseous wastes; .3 Operating instructions for normal modes of operation of the NSSS, such as startup, normal operation, power changes and shutdown should be presented, including data on :

.3.1 functional checking of control and protection systems of the NSSS prior to startup and in the process of normal operation;
.3.2 the determination of the critical position of the reactor control absorbers and their reactivity worth, as well as the reactivity balance of the core and its changes during reactor core life; and
.3.3 the minimum permissible redundancy provisions for NSSS equipment and electric generating sets, to ensure the safe startup and operation of the reactor. Equipment being tested or repaired should not be regarded as operational for purposes of meeting redundancy requirements except where testing places the equipment in an operational mode such as the running of a generating set; .4 Operating instructions for specified emergency conditions should be given which describe typical initiating sequences of events and the recommended procedures for remedial action and continued operation where necessary;
.5 Instruction on the organization of the ship's operation should be provided , including :

.5.1 manning considerations and responsibilities of personnel assigned to radiation safety duties and the safety of the NSSS;
.5.2 instructions for watchkeeping staff, while under way and in harbour;
.5.3 instructions on access procedures the controlled area and containment structure;
.5.4 drill instructions for personnel involved in the operation of the NPP, and crew musters; and
.5.5 instructions on maintaining ship's records dealing with the operation of the NPP and on-board radiation conditions, and reports to be submitted to the Administration on equipment failures and emergencies; .6 Survey instructions for the NPP. the containment structure and the hull structure should be given, including data on frequency , extent and methods of testing;
.7 In addition to any other instructions deemed necessary by the Administration to ensure the safety of the ship and the environment, further instructions to be given in the Operating Manual include:

.7.1 instructions on dockings and in-water surveys of the ship , relating to nuclear safety and public health ;
.7.2 instructions on radiation safety,
.7.3 instructions on the treatment of solid, liquid and gaseous radioactive wastes during their storage and discharges;
.7.4 instructions on fire safety and control over combustible materials inside the safety enclosure and reactor compartment;
7.5 special requirements, relating to the interface of the NPP with arrangements for loading , transport and discharge of dangerous cargoes;
.7.6 instructions on action of personnel to be taken in emergencies likely to affect the safety of the NPP, the ship and the environment; and
.7.7 administrative Procedures, to prevent maintenance work on reactor protection system components while testing of a related system is in progress.
7.2.4 All technical information involving the operation of the NPP should be recorded in the appropriate ship, engine room, radiation control , radiation waste or fissile material logs. and in any other document specified in the Operating Manual. The following information should always be recorded in these logs :
.1 the load mode of the NSSS and main parameters;
.2 a list of NPP operating equipment and their time of operation;
.3 functional checks and adjustments of control, monitoring and protection systems, calibration of instruments and surveys of equipment;
.4 operations involving core refuelling, equipment maintenance, repair and renewal , and associated decontamination;
.5 emergency situations, with details of rectifying measures taken and consequent results obtained;
.6 system and component failures and outages and deviations from normal operating performance;
.7 changes in operating conditions and instructions given to authorized persons to implement equipment changes;
.8 the condition of the ship's radiation protection arrangements and data on the measurement of radiation levels throughout the ship and in the primary and secondary coolants, together with a record of any contamination found and decontamination measures taken ;
.9 personnel radiation doses;
.10 quantity, type and activity level of radioactive waste carried on board or discharged from the ship, with data on the location and time of discharges;
.11 personnel drills and musters, with information on radiological emergencies assumed and equipment used; and
.12 any deviations in procedures from Operating Manual requirements.

7.2.5 Emergency plans and muster lists should be prepared to limit ship and environmental hazards while the ship is at sea (emergency underway plant) and in port (emergency port plan). These plans should describe technical and administrative action to be taken in an emergency and should establish:
.1 alarm signals for each type of emergency ;
.2 radiation emergency teams, their responsibilities, equipment and assembly points;
.3 a radiation muster list, giving the duties and responsibilities of crew members assigned to the reactor control room and emergency control positions;
.4 radiological emergency assembly areas for passengers and non-essential crew members at sea and evacuation routes and procedures while in port;
.5 instructions on drills of personnel involved with the operation of the NPP and musters for the crew;
.6 prior to entry info any port, a list of responsible port authorities and the means of communicating with them;
.7 operating modes of the ship's safety-related systems and equipment; and
.8 a sequential list of actions required to prevent or contain possible radiation hazards to the ship, the public or the environment, and the specific responsibilities of crew members during any radiation emergency.

7.2.6 A schedule of surveys, functional tests, maintenance and repairs of the NSSS equipment should stipulate the frequency and dates of the appropriate operations prescribed by the Operating Manual. Actual dates of performing these operations should be recorded to demonstrate that the prescriptions of the Administration are strictly fulfilled and that the technical condition of the equipment is duly controlled and maintained .

7.3 Normal operation procedures

7.3.1 Operation of the ship and its NPP should follow the procedures given in the Operating Manual. During normal operation, procedures to be followed include:
.1 functional testing of the control, monitoring and protection systems for the NSSS, calibration of instruments and radiation monitoring equipment, and the survey of safety-related equipment at specified intervals;
.2 maintenance, repair and replacement of equipment components;
.3 compliance with standards and regulations for the storage and disposal of radioactive wastes and handling of fissile materials;
.4 supervision of the NSSS, including control of coolant quality in the primary and secondary circuits;
.5 recording, in the appropriate logs of the ship, all incidents and information concerning the operation of the NPP and the maintenance and checking of equipment;
.6 the testing of the containment structure leaktightness, the efficiency of the air cleaning system and the control of radiological levels in the ship;
.7 checking the serviceability and start reliability of NSSS standby machinery and emergency power sources, the containment structure heat removal system , and the normal and emergency core cooling systems;
.8 correct rate of insertion of reactor control absorbers into the core;
.9 continues readiness of a system of communication between the navigating bridge, machinery spaces, reactor control room and emergency control position;
.10 training of personnel and holding of alarm drills; and
.11 arranging of dangerous or potentially explosive cargoes in a manner that will minimize potential damage to the NPP.

7.3.2 Regular in-service inspections and maintenance of equipment should not prejudice the ability of systems to perform their safety-related functions by producing levels of redundancy below minimum requirements.

7.3.3 The Administration should ensure that the requirements for safe operation of the ship are being observed , particularly with regard to :
.1 the manning of the ship with an adequate number of qualified personnel;
.2 compliance of the design and technical conditions of the ship and the NPP with the Safety Assessment and Operating Manual;
.3 the arrangements for watchkeeping and supervision of the NPP:
.4 the timely checking by the crew of the technical conditions of the ship and the NPP; and
.5 the availability of valid documents, as required by 7.2.1, the maintenance of records on the operation of the NPP, radiological loads and related incidents, and the submission of reports of all emergency situations occurring.

7.4 Emergency operation procedures

7.4.1 Should an emergency situation arise, an appropriate alarm signal should be given, the character of the emergency identified , and the extent of damaged or malfunctioning equipment determined . Action should be taken to rectify the emergency situation and to minimize its effects, in accordance with the provisions of the radiation emergency plan.

7.4.2 In the event of an emergency which threatens the safety of the ship or could result in the release of radioactivity, the master should immediately notify the Administration, the responsible organization, and the authorities of any coastal State likely to be affected.

7.4.3 In case of an uncontrolled release of radioactive substances, exceeding that specified in the safety Assessment, the ship should hoist the appropriate international emergency signal :
"AK" - "I have had a nuclear accident on board" or
"AJ'' - "I have had a serious nuclear accident and you should approach with caution ".

7.4.4 Where there is a danger of exposure of the crew and passengers to radiation doses exceeding the annual dose-equivalent limits for occupational exposure recommended by ICRP, the master should take appropriate steps to minimize the radiation exposure received by persons on board.

7.5 Maintenance and repair

7.5.1 Maintenance and repair of systems and components of SC-1 to 4, should be planned and executed to the satisfaction of the Administration.

7.5.2 Maintenance and repair of equipment within the controlled area, transportation of contaminates equipment , and space and equipment decontamination should be planned and carried out in a manner that will minimize local exposures and radiation doses of personnel engaged in the work , as required by 6.3.4 and 6.3.5.

7.5.3 Arrangements should be provided to ensure that maintenance and repair can be carried out safely without unacceptable exposure of personnel to radiation and without hazardous release of fission products to the environment. There should always be at least one substantial physical barrier, in addition to the fuel cladding, between irradiated fuel and the environment.

7.5.4 Only specially trained personnel who have been properly instructed in operating procedure and radiological hazards should be permitted to carry out maintenance and repair work involving high levels of radiation. Detailed procedures, as required by 6.3.5, should be prepared before such work is commenced.

7.5.5 Arrangements, tools and spares used by maintenance and repair personnel for replacing system components should comply in quality with the requirements of the Administration .

7.6 Manning, training, qualification, updating of knowledge, drills and musters

7.6.1 The minimum number of crew members carried on a nuclear ship as well as their qualifications should comply with the requirements of the Operating Manual approved by the Administration and should ensure that the ship and its NPP can be safely operated and maintained . The Administration should approve the minimum number of personnel assigned to operate the NPP.

7.6.2 The requirements below apply to the master and appropriate deck officers as follows:
.1 They should have successfully completed a special training course approved by the Administration, the curriculum of which includes as a minimum:

.1.1 the basic principles of nuclear energy and its application to ships;
.1.2 the particulars of the structure and performance of a nuclear ship;
.1.3 knowledge of the possible consequences of navigational accidents to the ship and to the environment;
.1.4 basic principles of radiation hazards and radiological protection; and
.1.5 action to prevent or alleviate postulated emergency situations; .2 The completion of such a course and an appropriate examination to the satisfaction of the Administration should be reflected in the certificates of qualification; and
.3 The master and qualified officers should hold certificates commensurate with their duties.

7.6.3 The requirements below apply to engineer officers, as appropriate to their duties, as follows :
.1 They should have successfully completed a special training course and examination satisfactory to the Administration. The course curriculum should include, as a minimum :

.1.1 the principles of nuclear engineering and nuclear reactor theory;
.1.2 a course in radiation physics, including radiological effects on health and the environment, principles of radiological protection and radiation monitoring;
.1.3 design and operating principles of the NSSS. its monitoring. control and protection systems; engineered radiation safety features of the ship and NPP; and Particulars of the ship's hull structure;
.1.4 detailed study of a NSSS of the type filled on the ship for which the officer is being trained and study of the Safety Assessment, Operating Manual and operating instructions for the NPP equipment;
.1.5 practical training in startup, shutdown and control of the NSSS, in normal and simulated emergency conditions, including maintenance, checking and survey procedures;
.1.6 principles for safe operation of NPP including maintenance inspections, surveys, core refuelling and waste management; and
.1.7 study of national and international safety requirements applicable to nuclear ships and their NPP; .2 The certificate of qualification for engineer officers should record the completion of the special training course; and
.3 The chief engineer and qualified engineer officers should hold certificates commensurate with their duties and should be subject to retraining and re-examination for each type of NSSS they may be required to operate.

7.6.4 All NSSS operators should have successfully completed a special training course approved by the Administration , the curriculum of which is in accordance with 7.6.3.1, and should hold an appropriate operator's certificate. The degree of detail of course content should be commensurate with the duties of the operator

7.6.5 All members of the ship's crew who would undertake specific or general tasks in the event of a radiation accident, should be trained in radiation protection to a level commensurate with the duties they would be expected to perform. This training should be periodically updated and repeated at a frequency sufficient to ensure a continued awareness and understanding of the radiation protection requirements.

7.6.6 The personnel responsible for radiation protection should :
.1 be trained in radiological protection and dosimetry to a level satisfactory to the Administration; and
.2 have successfully completed a detailed training course satisfactory to the Administration and possess a qualification certificate indicating the types of NSSS and radiation protection equipment for which they have been trained .

7.6.7 A ship's doctor, if carried, or other medically trained crew member, should have received adequate training in treating the effects of radiation exposure.

7.6.8 Other crew members involved in the operation of the NPP should be given theoretical courses and practical training commensurate with their official duties in the operation of the NPP and their. muster list. duties, as well as instructions on the use of personal health protection equipment. This training may be given in a training centre or on board ship by qualified engineer officers. The qualifications of the crew members referred to in this subsection should be to the satisfaction of the Administration . 7.6.9 Crew members not involved in the operation of the NPP should be acquainted with the established procedures for entering controlled areas of the ship and with their muster list duties. They should also be familiar with the measures necessary to ensure their personal protection in the event of accidents resulting in high radiation.

7.6.10 All persons on board, including non-crew members, should have received instruction on health physics and radiation protection procedures, before entering controlled areas of the ship .

7.6.11 The practical training in NSSS control, referred to in 7.6.3.1.5, should be carried oui on special simulators, or on ship- or land-based facilities having NPP installations of the type the trainee will operate. Trainees should, without assistance, perform a sufficient number of reactor startups and shutdowns to demonstrate to the satisfaction of the Administration their competence to suitably control reactor operation under all PPCs.

7.6.12 Appropriate officers and NSSS operators should be regularly retrained, to update their qualifications in theory and in the safe operation of the NPP The frequency and level of re-qualification training should be to the satisfaction of the Administration.

7.6.13 The qualifications and skills of crew members, in performing their assigned duties, should be exercised and improved by carrying out ship emergency and radiation alarm drills to the satisfaction of the Administration. The radiation alarm drills should simulate the probable damage and consequences of postulated accidents involving the NPP.

Chapter 8 Surveys

8.1 General

8.1.1 This Chapter sets forth the requirements for periodic surveys. These are supplemented by the quality assurance provisions a no the ship's staff in-service inspection requirements described elsewhere in the Code.

8.1.2 Survey requirements are described in this Chapter under the heading of the three principal phases of the ship's life cycle, which are :
.1 construction Phase - which encompasses the period of design; selection and procurement of materials, components and systems; vendor and sub-contractor performance testing; fabrication; transportation and storage; and final assembly and erection ;
.2 trial phase - which encompasses the period of pre-operational testing. core-loading initial criticality, core physics testing, initial power operation and sea trials; and
.3 operations Phase - which encompasses the period from certification and initial entry. into service (following sea trials) throughout the vessel's commercial life until retirement and preparation for decommissioning.

8.1.3 Throughout the development of the above-mentioned phases, the Administration or its competent authority should survey the nuclear ship through audit and/or inspection, as applicable, in order to verity that the responsible organization's activities connected with construction , trial and operation of the nuclear ship comply with the requirements of this Code and other applicable codes, standards and conventions.

8.1.4 Surveys should ensure that:
.1 materials and procedures used comply with the necessary quality level according to the design class of the component;
.2 test results of material properties before and during manufacture comply with the specifications approved by the Administration ;
.3 manufacturing processes comply with quality assurance procedures required to assure the intended performance and reliability of surveyed components and systems ;
.4 components and systems are manufactured and examined in compliance with drawings and specifications approved by the Administration ;
.5 operation of components and systems complies with their specified functions, particularly safety functions, as described in Chapter 2;
.6 the NPP and all associated safety systems meet the requirements of this Code and all other relevant safety requirements and specifications approved by Administration; and
.7 the ship and all systems essential to safety are maintained and continue to function properly throughout the ship's operating life.

8.1.5 The requirements of this Chapter should not be considered as substitutes for other applicable requirements or regulations except where the requirements of this Chapter are more stringent.

8.1.6 Survey periods and methods to be used should be specified in detail and be to the satisfaction of the Administration. These surveys should be described in the Safety Assessment and in the Operating Manual , as appropriate.

8.1.7 Surveys, tests and reviews of systems, components, structures and drawings, should be specified in accordance with the relevant safety or design class. The Safety Assessment or the Operating Manual , as appropriate, should describe details such as :
.1 methods to be used ;
.2 intervals between inspections;
.3 appropriate inspection authority;
.4 scope of inspections; and
.5 procedures for corrective action .

8.1.8 Where necessary for radiation safety, additional biological shielding, special test procedures and appropriate decontamination measures should be employed during surveys and tests.

8.1.9 The results of surveys and tests should be recorded and copies of all reports should be kept on board for examination by the Administration and other authorities concerned. If so required. copies of reports should be sent to the Administration which will determine how and where these reports will be kept for the lifetime of the ship or its NPP. Survey and test reports should contain the following data :
.1 the ship's name, identifying numbers or letters , name of responsible organization , date and place of survey;
.2 the systems, subsystems and components surveyed ;
.3 status of reactor operation ;
.4 the safety functions tested, including a description of the procedures and methods used;
.5 test results, including malfunctions observed before and during the test and including a description of the observed state of the components or systems;
.6 time under load and time of availability and equivalent information, if so required by the survey specification;
.7 radiation and contamination conditions, if any, including special shielding provisions made or decontamination action taken;
.8 requirements for survey repetition , where necessary;
.9 special conditions of operation, maintenance or repair, resulting from the survey or imposed by the Administration; and
.10 names of those conducting the tests and name of the surveyor and Administration or other authority represented .

8.2 Survey during construction

8.2.1 Survey activity during the construction phase should include a complete survey of the hull structure, machinery and equipment, the primary pressure boundary components, and components of safety systems.

8.2.2 Surveys referred to below should ensure that all machinery. electrical, structural, communication, radiation protection and other systems and equipment comply with the requirements of the Code.

8.2.3 The containment structure, its safety systems and their support systems, should be tested for compliance with their intended safety functions in accordance with the procedures described in 8.1 and by pressure testing and testing for leaks as described in the following :
.1 Upon completion of construction, a pressure test should be applied to the containment structure in suitable steps. until a test pressure of 110 per cent of the design pressure is reached. A hydrostatic test should be used, unless it could result in a risk of damage to the containment structure or its support or the equipment within, in which case pneumatic means may be utilized . Where the test temperature is less than the design temperature, the test pressure PTshould be determined in accordance with the formula:

P_T = 1.1 x Y_T / Y_t x P where: Y_T =yield strength of shell material of containment structure at test temperature;
Y_t= yield strength of shell material of containment structure at design temperature;
P = design pressure (see 2.8.4.3.1);
but in no case should the test pressure be less than 110 per cent of the design pressure nor should general membrane stress exceed 0.90 Y_T for hydrostatic tests and 0.75 Y_T for pneumatic tests;
.2 The test should be witnessed by s surveyor and special precautions should be taken to protect personnel when air or gas under pressure is used as the test medium;
.3 Following pressure testing, the containment structure should be visually and non-destructively examined for surface defects, flaws or cracks, to an extent acceptable to the Administration. Data from this examination should be the reference basis for later examinations;
.4 Prior to startup for the first time, the containment structure should be tested for integral leaktightness. The integral leak rate should be determined by methods approved by the Administration and should be carried out subsequent to the pressure test described in .1 above and after all containment shell penetrations have been installed : and
.5 The initial leak rate test results should be used to establish the methods and procedures necessary to extrapolate, from the results of tests carried out at lower test pressures, the leak rate corresponding to the design pressure P determined in accordance with 2.8.4.3.1.

8.2.4 The safety enclosure should be tested for leaktightness. Where leak prevention is based upon the maintenance of an underpressure within the safes enclosure of at least 100 pascals below that of surrounding compartments, the Administration may waive pressure leak testing. A pressure test should be made in any case where the safety enclosure is subjected to internal pressure above atmospheric pressure during those PPCs resulting in radioactive releases within the safety enclosure. 8.2.5 Pressure retaining, and other highly stressed components, should be tested in compliance with the following requirements:
.1 Components of SC-1 or SC-2 (except containment structure : see 8.2.3.1) should be pressure tested to a pressure suitably in excess of their design pressures so as to conform to the approved rules under which the components were designed . Account should be taken of material properties and temperature in determining test pressures;
.2 Components of SC-3 or 4 should be pressure tested to a pressure suitably in excess of the design pressure;
.3 Subject to .1 and .2 above, components and systems retaining radioactive liquid or gaseous substances or deposits should be pressure tested to not less than 1 bar overpressure and be examined for leaktightness. The sensitivity of the leak detection methods used should be commensurate with the level of radioactivity to be retained,
.4 After installation on board , all pressure-retaining components of the NSSS that have not been tested in accordance with .1 above should be pressure tested to the highest test pressure of any interconnected system (to ensure ten of closing welds) ;
.5 Shells of pressure vessels and highly stressed rotors of pump and motors of DC-1,should be 100 percent non-destructively tested for flaws and cracks in their surface area and body volume. Methods of nondestructive testing should be capable of detecting the smallest significant flaw and results should form a comparative basis for similar tests carried out during periodic surveys;
.6 Baseline measurements of wall thicknesses of pressure-retaining components should be documented for later comparative reference;
.7 Shells of pressure vessels and casings of machinery or equipment of DC-1 and 2, should be made of material approved by the Administration. Material testing should follow procedures approved by the Administration and be witnessed by a surveyor;
.8 Where deemed necessary by the Administration, the mechanical properties of the reactor pressure vessel material throughout its lifetime should be monitored for radiation-induced changes in ductility and fracture behaviour. Test samples, located within the pressure vessel so that neutron fluence, temperature and transients reflect the conditions affecting the pressure vessel, should be arranged for periodic removal and testing; and
.9 Shafts, blades, bolts and other highly loaded items of machinery and equipment of DC-1 should be subjected to tests equivalent to those required by.7 above and rotating parts should be tested by overspeed tests.

8.2.6 Sensing elements, instruments and other components that must operate reliably under accident conditions, should be tested in accordance with the following requirements:
.1 Prototype and periodic samples of a production run of such equipment should be tested under equivalent accident conditions of temperature, pressure , moisture, vibration and radiation;
.2 After completion of installation on board ship and prior to the reactor attaining initial criticality, the safety and reactor protection systems, including the radiation monitoring equipment control instrumentation , switch gear, controls and monitors, should be tested for satisfactory operation and accuracy . As far as is practicable, the operation of the sensing elements should also be checked.

8.2.7 Electrical and electron ic equipment of the reactor safety systems and appliances for instrumentation, controls and switch gear should be type tested if of SC-1 to 3 and should comply with the following requirements :
.1 The specified accuracy of the sensing elements and the signal processing gear should be demonstrated by the manufacturer. Calibration of the nucleonic measuring channels in safety systems should be demonstrated.
.2 Proof of the quality and characteristics of the materials of pressure retaining items of instrumentation for SC-1 and 2 should be provided. These constructional elements or components should be pressure-tested.

8.3 Survey during trials

8.3.1 Surveys during the trials phase should encompass the testing of all ship systems, including a complete Pre-operational test of the NPP, core loading, initial power operation and sea trials. The overall trials programme should be approved by the Administration and trials should be scheduled progressively, in a methodical manner, to ensure that all safety requirements are met.

8.3.2 Before core loading , the primary circuit and auxiliary circuits interconnected to it should be carefully checked for cleanliness, to avoid blocking of cooling channels or the activation of a significant quantity of impurities. Additionally, checks should be carried out to ensure :
.1 the leaktightness of the circuit, at nominal pressure;
.2 proper operation of instrument systems for measuring pressure, temperature , flow rate and liquid levels in the primary circuit and the steam generators; and
.3 proper operation of relief and safety valves on the primary and secondary circuits.

8.3.3 After core loading but Prior to warming up the primary circuit, the requirements of 8.3.2.1 and 8.3.2.2 should again be checked, as well as:
.1 physical/chemical quality of the primary, secondary and make-up water to ensure that it is with in acceptable parameters; and
.2 proper operation of main and emergency systems of electrical power.

8.3.4 During the testing phase preceding criticality, checks should be made to ensure:
.1 proper operation of the reactivity control systems, including scram;
.2 proper operation of the nuclear measurement system and associated safety features;
.3 proper operation of the health physics measurement equipment;
.4 proper operation of auxiliary and emergency circuits for core cooling, including the automatic relay and start-up of relevant equipment;
.5 containment structure leaktightness and proper functioning of automatic isolation provisions;
.6 non-occurrence of reactor trip as a result of non-valid scram signals;
.7 proper operation of the reactor protection systems;
.8 accuracy of measurement instrumentation related to core safety;
.9 proper switch-over to any standby unit of redundant systems; and
.10 proper performance of interlocks and alarms.

8.3.5 During initial criticality and core physics testing, but before powering the core, it should be assured that the NPP and more generally all the ship's equipment have the availability required by the Safety Assessment. Amongst others, the following should be checked :
.1 proper activation of the ECCS, including switch-over arrangements between emergency core cooling systems;
.2 proper operation of the steam isolation valves; and
.3 values of reactivity parameters and margins of subcriticality, in all appropriate conditions, to verify values claimed in the Safety Assessment.

8.3.6 During initial power operation prior to sea trials, the following should be checked by means of low power tests:
.1 proper operation of electrical power supplies and proper operation of the sequential transient from one connecting configuration to another;
.2 proper operation of the propulsion system;
.3 effectiveness of the shielding against radiation from reactor and auxiliary circuits;
.4 proper operation of equipment for measuring radioactivity in the primary, secondary and auxiliary circuits;
.5 accuracy and proper operation of instruments measuring reactor power;
.6 possible contamination of non-radioactive circuits;
.7 measurement of the reactivity Parameters and the subcriticality available margin in all appropriate conditions, to verify those values claimed in the Safety Assessment;
.8 proper switching of residual heat removal means from normal operational to alternative systems;
.9 provisions of effective reactivity and power control , sufficient to satisfy criterion C of 2.1.1;
.10 proper operation of the emergency residual heat removal system; and
.11 provision of sufficient radiation control , registration and protection equipment to satisfy criterion A of 2.1.1.

8.3.7 During the sea trials phase, surveys and tests should be carried out as prescribed in the following:
.1 Reactor and ship systems should be checked for safe and satisfactory operation under normal seagoing conditions. Items to be checked include:

.1.1 Proper operation of the NPP, due attention being paid to porter transients occurring during manoeuvring, Protracted full power operation and emergency power rate changes, such as full ahead to full astern;
.1.2 effectiveness of xenon poison override provisions;
.1.3 appropriate values of fundamental physical parameters related to the safety of the reactor;
.1.4 proper operation of electrical power supplies, using their primary energy from reactor plant and proper operation of the sequential transient from one connecting configuration to another ;
.1.5 Proper operation of equipment for measuring radioactivity in the primary, secondary and auxiliary circuits;
.1.6 accuracy and Proper operation of instruments measuring reactor power;
.1.7 possible contamination of non-radioactive circuits;
.1.8 restarting the reactor immediately following a random fast shutdown and after a period of low power operation; and
.1.9 ability to carry out in-service testing of the reactor Protection system, without loss of safety functions. .2 The NPP should also undergo trials at sea to prove that it will function in compliance with design requirements. as stated in the Safety Assessment . during any PPC 1 or 2 situations, such as those involving:

.2.1 relevant failure of any reactor or machinery active component;
.2.2 trip of any single turbine during full power operation; and
.2.3 failure of any electrical , hydraulic or pneumatic supply system during switchover to the standby system.
8.3.8 Following completion of sea trials, it should be demonstrated that:
.1 radioactivity is contained with in designed paths and primary coolant balance or other appropriate methods show no unintentional leakages into the secondary steam system or any other non-radioactive system or compartment: and
.2 intentional releases of radioactive gaseous or liquid wastes can be controlled to permissible levels and are not ingested by the ship's air and sea inlets.

8.4 Survey during operational phase

8.4.1 For the purposes of this section, the operational phase is defined as the period between commissioning of the ship and its de-commissioning.

8.4.2 The provisions of this section supplement the periodical survey requirements of the Convention which relate to non-nuclear components of the hull, machinery and equipment .

8.4.3 The NSSS and supporting hull structure should be periodically surveyed as follows:
.1 at intervals not exceeding one year, the NSSS should be surveyed in accordance with 8.4.5;
.2 the hull structure in way of reactor and containment structure supports, and the structure forming the collision protective structure, should be surveyed as required by 8.4.4;
.3 four year periodical surveys of pressure-retaining components of the NSSS should comply with the requirements of 8.4.6 and 8.4.7;
.4 at refuelling intervals, the reactor pressure vessel and its internals should be surveyed in accordance with 8.5.1;
.5 at the request of the Administration or with its approval , continuous surveys may be carried out in lieu of the periodical surveys. Continuous survey cycles should extend over a period no greater than that prescribed between relevant periodical surveys and every part subject to continuous survey should be inspected at least once during that time. If deemed necessary by the Administration , individual parts may require to be inspected more than once during the cycle;
.6 periodical or continuous surveys should not be unduly restricted by radiation and pressure vessels and piping systems should, whenever practicable, be accessible for survey.

8.4.4 Hull structure in way of the reactor and the collision protective structure should be surveyed annually. Every second year, the survey should include inspection for gross deformation and depreciations in thickness of the shell and main structural members, if such inspections were not done at the last drydocking ,

8.4.5 Annual surveys should ensure that the reactor plant fulfills specified safety functions and should include the following provisions:
.1 Engineer's logs of reactor operation, activity release reports, and periodic in-service test data should be examined for abnormal operation;
.2 Operation of the following safety functions should be demonstrated to the satisfaction of the attending surveyor:

.2.1 reactor protection;
.2.2 emergency core cooling (including supply systems);
.2.3 residual heat removal by mesas other than use of the steam generators;
.2.4 integrity of activity flow paths;
.2.5 reactivity control;
.2.6 emergency electrical system under full load;
.2.7 waste management and release control;
.2.8 containment functions, except leak rate measurements of containment structure and safety enclosure (closure function, isolation functional); and
.2.9 controlled area ventilation; .3 During demonstration of the safety functions required by .2 above, the surveyor should inspect support systems while they are in operation.

8.4.6 Each four-year survey of the NSSS should include, in addition to the annual survey requirements of 8.4.5, the following provisions:
.1 An examination should be made of the primary pressure boundary structure, secondary system pressure vessels and pressure piping, and associated machinery and equipment;
.2 The integral leak rate of the containment structure should be measured;
.3 All systems of SC-1 to 3 should be surveyed for specified capability. SC-4 systems should be surveyed following the general procedures applicable to important ship machinery equipment;
.4 Highly stressed parts of the primary pressure boundary and primary pressure boundary welds, including adjacent heat-affected areas, should be subjected to non-destructive surface and volumetric examination in order to measure quantitatively any flaws or cracks that may have developed or propagated;
.5 The reactor pressure vessel should be examined by ultrasonic methods for flaws and cracks, to compare with preceding measurements and basis measurements carried out in accordance with 8.2.5.5. These examinations should, as far as practicable, encompass the total surface area and body volume of the reactor pressure vessel in regions of maximum integral irradiation and high stresses and their extent, procedures and frequency should be to the satisfaction of the Administration bearing in mind that the whole reactor pressure vessel should be examined completely during the 12-year period of reactor operation. In considering reactor refuelling, the four-year period may be extended by a maximum of one year;
.6 The steam generators, pump casings and valve bodies, pressurizer pressure vessel and pressure vessels of the primary pressure boundary other than the reactor pressure vessel , should be tested by approved methods. The extent, frequency and procedures for these tests should be to the satisfaction of the Administration;
.7 All pressure-retaining components, other than the primary pressure boundary, should be pressure tested to a pressure suitably in excess of their design pressures so as to conform to the approved rules under which the component was constructed. In general, the following systems should be pressure tested and inspected if their design pressure exceeds 2 bar:

.7.1 pressure-retaining components of SC-1 or 2, other than the reactor pressure vessel ;
.7.2 demineralizer systems;
.7.3 primary make-up;
.7.4 buffer seal system, if any;
.7.5 ECCS with support systems;
.7.6 residual heat transmission system with standby system , except main condensers;
.7.7 waste handling and disposal system:
.7.8 spray system for pressure suppression in containment structure;
.7.9 hydraulic control system, if any;
.7.10 hydraulic scram systems (control red drive), if any;
.7.11 containment structure drain system, if any:
.7.12 containment structure interior cooling system;
.7.13 intermediate cooling system;
.7.14 seawater systems of reactor supply;
.7.15 secondary steam system up to main actuating turbine valves; and
.7.16 secondary feedwater system including feed pumps and preheaters.
8.4.7 The second and subsequent four-year surveys should , in addition to the requirements of 8.4.4, 8.4.5 and 8.4.6, include the following provisions:
.1 All pressure vessels and piping, except the containment structure, should be inspected for defects following pressure testing to a pressure suitably in excess of their design pressures so as to conform to the approved rules under which the pressure vessels and piping were constructed . Where extensive non-destructive examinations of the reactor pressure vessel are carried out to the satisfaction of the Administration , in accordance with the provisions of 8.4.6.4 and 8.4.6.5, and prove that the integrity of the boundary is unimpaired , periodic pressure testing of the reactor pressure vessel may be waived;
.2 Pressure testing, or other suitable leak detection method , should be carried out on all components containing radioactive gases or liquids, other than those of DC-1 . Containers should also be cleaned and visually inspected internally and externally for flaws; and
.3 Components of DC-2 to 4 that are fabricated from material having a 0.2 per cent proof stress exceeding 450 N/mm2 at ambient temperature, should be non-destructively tested to the satisfaction of the Administration, at welds, openings, branch pipes, mountings and fittings.

8.5 Special surveys, repairs, renewals and modifications

8.5.1 During periods of core refuelling and on all practical occasions during repair work when the NSSS is not in operation, the following surveys should be carried out.
.1 surveys of double bottom spaces, tanks, pressure vessels, pipes and fittings, structures and foundations in the reactor compartment;
.2 surveys of shields;
.3 surveys of the primary pressure boundaries and functional checking of the core residual heat removal systems;
.4 functional checking of all engineered safety systems, especially those repaired or renewed , and checking of the time required to scram the reactor;
.5 surveys of internal parts of the nuclear reactor (with the core refuelled );
.6 where necessary, the cleaning of all tanks, pressure vessels, pipes and spaces of the reactor compartment from corrosion, sediment and other contamination ; and
.7 leak testing of containment structure.

8.5.2 In accordance with the procedures and intervals given in the Operating Manual and any other relevant instructions approved by the Administration, trained personnel should check safety functions during operational service between periodic surveys. Testing should at least cover systems of SC-1 and 2 and should be supervised by the appropriate engineer officer and recorded in accordance with 7.2.4 and 8.1.9.

8.5.3 A survey, either general or partial, if required by the Administration, should be made every time an accident occurs or a defect is discovered which affects or could have affected the safety of the ship or the efficiency or completeness of its radiation protection or other equipment, or whenever any important repairs or renewals are made. The survey should be such as to ensure that the necessary repairs or renewals have been effectively made, that the material and workmanship of such repairs conform in all respects to all applicable quality requirements, and that the renewed or repaired parts comply in all respects with this Code.

8.5.4 Where a component of the NPP is replaced, added or altered during the lifetime of the ship, the pre-service examination requirements for the affected component should be complied with prior to resumption of service. This examination may be scheduled before or after the system leakage test.

Appendix 1 Sinking velocity calculations

1 After buoyancy of the ship becomes negative, sinking may be described in terms of the differential equation :

where:
m = mass of the ship, including cargo, if any, plus hydrodynamic added mass, plus mass of entered water;
U max =maximum negative buoyancy force;
v = vertical velocity of sinking;
t = time;
W = specific drag = c. A. d/2

where:
c = drag co-efficient
A = projection of sinking ship
d = water density

2 For constant values of U and m, the solution is:

v(t) = v₁tanh (b₀t/v₁), where
v₁ = (U/W)^{1/ 2} = final velocity
b₀ = U/m = initial acceleration.

3 The following initial condition should be used in the model evaluation:
.1 when sinking commences, buoyancy and velocity values are zero;
.2 sinking is initiated by flooding of the largest floodable compartment of the intact ship within a short period of time acceptable to the Administration .

4 The following conditions during sinking should be assumed in the model :
.1 at a depth where decks or hatch covers are not proven to withstand the differential water pressure, instantaneous rupture and flooding of all remaining intact compartments occurs; and
.2 motions in the horizontal plane are not considered .

Appendix 2 Seaway loads depending on service periods

(see Chapter 2)

1 General

1.1 For determination of seaway-induced loads on the ship and its machinery and equipment a model should be used describing the physical behaviour of the ship as exactly as possible.
For the mathematical treatment the seaway and the induced seaway effects of the ship are connected by a response operator. This response operator allows the prediction of regular seaway effects like inertia forces at each location of the hull taking into account the characteristics of the ship under consideration . An essential assumption for mathematical treatment is that the seaway effect is linearly proportional to the wave height.

1.2 The number of days of sea operation is connected with seaway-induced loads of the vessel. It is obvious that a longer duration of service periods not only increases the number of wave encounters and thus the number of load cycles, but also increases the probability of meeting higher waves and, due to the above assumption, higher stress levels.

2 Mathematical treatment

2.1 The irregular sea surface can be represented by superposition of simple harmonic waves of different periods, amplitudes and directions. The phase relationships of these various component waves are considered to be random.
The mathematical description is given by the seaway function

Appendix 3 Safety assessment

01 General principles

1.1 The Safety Assessment consists of the documentation initially submitted to the Administration together with subsequent submissions, additions and amendments.

1.2 The Safety Assessment should contain systematic analyses of the safely of the nuclear ship in the design, construction, operation and decommissioning of the ship and its NPP to provide assurance that there are no undue risks to those on board , the public or the environment. It should contain sufficient information to enable the Administration and that of a host State to perform their own assessment of the safety of the nuclear ship .

1.3 Information should be presented in a concise manner and the various items treated in accordance with their relative importance to the safety of the nuclear ship.

1.4 Where the equivalency clause of Regulation 5 of Chapter 1 of the Convention is invoked , a description of the equivalency and a justification analysis describing its reliability should be included in the Safely Assessment .

02 Practical aspects

2.1 The Safety Assessment document should be prepared in a format that facilitates the inclusion of additional information or revisions. All pages should be dated and unambiguously marked in sequence. Revised pages and additions should be clearly identified by revision number and date of change.

2.2 Drawings, graphs, diagrams, tabular information and charts should be employed wherever the information can be presented more adequately or conveniently by such means.

2.3 All information presented should be legible, symbols should be defined and drawings should not be scaled down to the extent that interpretation becomes difficult, The SI system of units and units actually used on instrumentation should be used .

2.4 Reference to topical reports may be made in the relevant sections, provided that such reports are readily available to the proper authorities.

03 general information and summary

3.1 The introduction should provide the reader with an overall review of the project, including the design, construction and operation of the ship and its NPP, together with a summary of conclusions regarding the ship's safety.

3.2 A brief description should be given of the following:
.1 the ship design and characteristics;
.2 NSSS description an d design parameters;
.3 containment structure and safety enclosure;
.4 nuclear propulsion plant;
.5 auxiliary machinery and systems;
.6 electric power systems;
.7 auxiliary propulsion (if provided );
.8 collision protective structure.

3.3 The summary should include an evaluation of nuclear safety with a discussion of provisions for preventing and limiting the consequences of accidents and comments regarding the degree of safety provided to personnel, the public and the environment.

04 Environmental design basis

This section should provide information on the ambient conditions used as a design basis, with particular emphasis on factors important to nuclear safety as well as overall ship safety. It should specify the rationale for selection of the design environment including:
.1 sea slates;
.2 design basis storm;
.3 fatigue life selection ;
.4 environmental risk factors for geographical regions of operation.

05 Safety rules

This section should list the naval architectural, engineering, radiological and administrative safety rules upon which design , construction and operation of both the ship and the NPP are based Detailed discussion should address the items in this section.

5.1 Design , construction and operation
.1 Design rules;

.1.1 Standards;
.1.2 classification society rules;
.1.3 design codes and standards;
.1.4 statutory requirements and regulations. .2 Construction codes and practices utilized.
.3 Operating rules both in service and during lay-up;

.3.1 established rules and regulations. .4 Rules for emergency operation;

.4.1 anticipated operational occurrences;
.4.2 accident conditions;
.4.3 conditions under which operation is authorized under less than prescribed conditions.
5.2 Description of quality assurance
.1 quality assurance in planning, design and procurement;
.2 quality assurance in construction, fabrication and commissioning;
.3 quality assurance in operation and maintenance.

06 Technical description and design evaluation

6.1 This section should provide a technical description and a design evaluation of the various systems, structures and components that are of importance to the safely of the ship and the NPP.

6.1.1 The design bases given in this section should specify the required performance and system parameter values and the ambient conditions under which this performance should be achieved . A design evaluation should be performed to demonstrate that the system design and component designs comply with the specified design bases.

6.1.2 Due to the nature of some systems, it may be desirable to list a given system under more than one subheading, to recognize the diverse requirements involved .

6.1.3 The evaluation should consider the following information as applicable to the system or structure being analyzed:
.1 function definition;
.2 description,
.3 design basis;

.3.1 normal and limiting operating parameters;
.3.2 material selection and qualification ;
.3.3 mechanical design;
.3.4 thermal and hydraulic considerations;
.3.5 nuclear physics considerations,
.3.6 inspection and tests;
.3.7 maintenance; .4 quality assurance requirements;
.5 design evaluation,

.5.1 structural analysis;
.5.2 thermal and hydraulic calculations.
6.2 The description and information required by 6.1 should apply to the various systems as follows (Note: This is an indicative list and should not be considered as being exhaustive. )

6.2.1 Ship and ship systems:
.1 arrangements;
.2 characteristics;
.3 stability and subdivision ;
.4 survivability;
.5 hull structure and strength;
.6 collision protection;
.7 navigation,
.8 communications;
.9 life-saving appliances;
.10 Ship machinery Systems;

.10.1 electrical power;
.10.2 main propulsion machinery (e.g. main condenser, turbine, stream line and feedwater system ) ;
.10.3 steering gear;
.10.4 fire protection an d detection;
.10.5 heating, ventilation and air conditioning systems;
.10.6 bilge and ballast systems;
.10.7 cargo hand ling;
.10.8 ground tackle; .11 other systems.

6.2.2 Nuclear steam supply system ( NSSS) :
.1 primary pressure boundary;

.1.1 reactor pressure vessel;
.1.2 primary coolant pumps;
.1.3 Safety, relief and isolation valves;
.1.4 primary coolant piping;
.1.5 steam generators;
.1.6 pressurizer system; .2 auxiliary systems;
.3 reactor core;

.3.1 fuel elements including enrichment,
.3.2 burnable poisons and control rods;
.3.3 core physics:
- neutron fluence rate and power distribution;
- power stability;
- reactivity calculation;
.3.4 other reactor internal structures;
.3.5 core thermal hydraulics; .4 instrumentation and control;

.4.1 reactor instrumentation and control;
.4.2 normal operation instrumentation and control;
.4.3 safety related instrumentation and control; .5 engineered safeguards;

.5.1 reactivity control systems;
.5.2 reactor scram ;
.5.3 reactor protection system;
.5.4 emergency core cooling ;
.5.5 residual heat removal ;
.5.6 soluble poison injection ;
.5.7 containment structure and containment structure isolation;
.5.8 leakage detection system .
6.2.3 Main and emergency control positions:
.1 control available;
.2 instrumentation;
.3 location and description;
.4 fire protection;
.5 habitability and access.

6.3.4 Other systems:
.1 radioactive waste;
.2 make-up feedwater;
.3 soluble poison control;
.4 containment atmospheric control and clean-up ;
.5 process auxiliary systems;
.6 water chemistry control ;
.7 safely enclosure including ventilation and air filtration,
.8 off-gas and excess primary water drainage systems.

07 NPP performance

7.1 This section should present detailed information on the functional behaviour of the Plant during normal operation For each phase shown below and any others deemed necessary, the conditions of the systems involved and the values of important parameters should be specified , showing that the plant can be operated within the limits of the design basis and the Safety Assessment .

7.2 Information on normal operation should include:
.1 startup;
.2 steady state power operation ;
.3 changes in power level during operation;
.4 shutdown to hot stand-by and thence to cold conditions;
.5 fast recovery to power operation after inadvertent scram .

08 Radiation protection

8.1 Basic radiation protection criteria should be discussed, with information given concerning:
.1 means of ensuring that radiation levels are as low as is reasonably achievable;
.2 radiation dose-equivalent limits;
.3 radiation activity and isotope release limits;
.4 radiation and contamination levels related to division of the ship into areas and resultant access restrictions;
.5 rules and procedures for management of radioactive materials and access to controlled and supervised areas;
.6 rules and procedures for access to controlled and supervised areas, depending upon PPCs.

8.2 Shielding should be discussed giving the following minimum information for each shield :
.1 identification of the source to be shielded;
.2 location and purpose of the shield;
.3 dimensions and materials of the shield,
.4 verification of design by calculation and tests as appropriate.

8.3 Radiation levels expected or permitted during any PPC should be compared with established levels .

8.4 Radiation monitoring information should discuss design principles and the location , type, sensitivity, range of measurement and methods of display and alarm applicable to the detectors used , and their ability to cope with any PPC.

8.5 Information relating to radioactive release to the environment should include discussion of .
.1 instrumentation and monitoring of plant effluents;
.2 automatic and manual initiation of release-limiting systems.

8.6 Laboratories, changing rooms, spaces and facilities used for handling contaminated persons or objects should be described and their locations given.

8.7 Health physics programme.

09 Accident and failure analysis

9.1 The safely analysis should present detailed information on possible sequences of events, affecting the plant and ship, due to:
.1 failure or malfunction of systems, components or structures;
.2 human error in operating the plant;
.3 external occurrences such as fire, collision, stranding , grounding and flooding.

9.2 The analysis should describe the possible sequences of events following failures or accidents by :
.1 identifying initiating events;
.2 establishing the cause of initiating events;
.3 determining the sequence of events following the initiating event;
.4 determining the resulting consequences.

9.3 The analysis should :
.1 verify that the design basis is adequate;
.2 describe the distribution of radioactive materials in the plant for use in the analysis and as a basis for evaluation of radiological effect;
.3 identify design basis events (accidents) and provide source term assumed in the analysis.

9.4 Analysis should include :
.1 parameter values used ;
.2 assumptions on which calculations are based ;
.3 substantiation of the results obtained;
.4 accuracy and safety margin of calculations;
.5 radioactive inventory and isotopic composition used ;
.6 cladding defects and failed fuel assumed;
.7 containment leak rate, and absorption and filtration efficiencies;
.8 automatic or operator action necessary or assumed;
.9 time after event that action is to be performed.

9.5 Failures involving the concept of single failure criterion should be analysed.

9.6 The results of the analysis for the event analysed should be described in detail.

9.7 Groups of events to be analysed .

9.8 NPP disturbances :
.1 Uncontrolled reactivity change including, for example :

.1.1 unintended movement of the most reactive control element and group;
.1.2 chemical control system malfunction;
.1.3 cold water injection;
.1.4 feedwater controller malfunction - i.e. injection of feedwater at maximum .2 Primary system events:

.2.1 disturbances in primary system make-up feedwater supply;
.2.2 partial or total loss of primary coolant forced circulation;
.2.3 loss of coolent pressure;
.2.4 primary coolant boundary rupture - loss of coolant accident (LOCA);
.2.5 excessive coolant heat-up rate;
.2.6 excessive pressurization rate;
.2.7 steam generator tube rupture. .3 Secondary system events:

.3.1 rupture of main steam line or main feedwater line;
.3.2 pressure increase;
.3.3 closure of main steam isolation valve;
.3.4 turbine trip;
.3.5 isolation of main condenser;
.3.6 loss of feedwater. .4 Anticipated transients without scram.
.5 Other events:

.5.1 disturbances of electrical power;
.5.2 instrumentation malfunctions;
.5.3 control room uninhabitability;
.5.4 common mode failures;
.5.5 unintentional activation of the ECCS;
.5.6 disturbances in radioactive waste treatment and storage systems and off systems.
9.9 Ship accidents: These conditions as appropriate should be considered with ship at sea and in ports.
.1 Collision ;
.2 Stranding /grounding;
.3 Capsizing;
.4 Shallow water sinking;
.5 Deep water sinking.
.6 Fire :

.6.1 within the safety enclosure;
.6.2 cargo fire or explosion;
.6.3 fire or explosion elsewhere on the ship; .7 External hazards in the vicinity of the ship (fire, explosion, toxic gas, etc.);
.8 Loss of manoeuvrability.

10 Conditions for authorized operation

10.1 This section should specify in detail the conditions that must be fulfilled prior to and during operation, including the observance of upper and lower limits of process variables that are relevant to nuclear safety and other requirements of a technical, administrative and procedural nature.

10.2 As a minimum, the items listed in the following should be addressed
.1 Safety limits;
.2 Alarm limits,
.3 Safety trip settings;
.4 Limiting conditions for emergency operation of the ship (see 5.1.4 of this Appendix);
.5 Surveys and inspections of technical conditions :

.5.1 frequency and scope of records and tests;
.5.2 calibrations and inspections; .6 Administrative control:*

.6.1 organization and lines of authority and responsibility:
.6.2 procedures for changing and approving operating instructions and orders;
.6.3 manning, number and qualification of operating personnel ;
.6.4 procedures and instructions governing normal operation, anticipated operational occurrences, accidents and casualty control . .7 Maintenance - surveillance requirements.

---

* Reference may be made to the organization manual and Operating Manual.

11 Ship and NPP security

11.1 Provisions made for protection of the plant against unauthorized intrusion, sabotage and theft of nuclear material should be described .

11.2 Special attention should be paid to possible conflicts between security provisions and other safety requirements.

11.3 The information provided for this purpose should be presented in a separate document classified in accordance with the requirements of the appropriate authorities. This information should be provided to appropriate host Administration authorities upon request .

11.4 Design provisions made for physical protection of the ship and the nuclear propulsion plant should be described.

12 Decommissioning

The concept for decommissioning without undue radiological hazards to the public should be presented.

13 Suggested list of contents

The following typical list of contents of a Safety Assessment is presented for guidance.

13.1 General
.1 designation and type of ship and intended service
.2 chronology of ship's creation; NSSS builder, shipyard
.3 supervision authorities during designing, construction and operation
.4 designation and standards of ship and nuclear power plant design
.5 quality assurance

.5.1 quality assurance in planning
.5.2 quality assurance in fabrication and installation of nuclear power plant equipment
.5.3 quality assurance in operation
13.2 Ship and its general safety
.1 general characteristics and description of ship

.1.1 general characteristics
.1.2 general description
.1.3 hull structure and strength
.1.4 arrangement of nuclear power plant, equipment and control stations
.1.5 manoeuvrability .2 collision protection in way of the reactor compartment
.3 stability and subdivision under normal and emergency conditions
.4 navigational equipment and communication means
.5 life-saving appliances
.6 fire protection
.7 ship's arrangement
.8 ship's system

13.3 Nuclear steam supply system
.1 general description and characteristics
.2 primary circuit

.2.1 general characteristics
.2.2 equipment redundancy
.2.3 arrangement of equipment
.2.4 equipment
.2.4.1 reactor
- structure , material, strength
- core
.2.4.2 steam generators
.2.4.3 circulating pumps
.2.4.4 devices of control and protection systems
.2.4.5 auxiliary equipment
.2.4.6 pressurizer
.2.4.7 safety, relief and isolation valves .3 auxiliary systems and equipment

.3.1 primary coolant purification equipment
.3.2 intermediate cooling system
.3.3 sampling system
.3.4 gas removal and drainage system .4 emergency systems

.4.1 reactor cooling
.4.2 emergency core cooling system
.4.3 soluble poison injection system
.4.4 steam generator overpressure protection
13.4 Control, monitoring and protection systems
.1 layout
.2 description
.3 parameters, instruments and equipment
.4 interaction with steam turbine plant
.5 control stations

13.5 Containment structure
.1 structure
.2 strength .
.3 tightness .
.4 pressure suppression system
.5 emergency flooding system

13.6 Safety enclosure
.1 structure
.2 strength .
.3 tightness

13.7 Radiation safely
.1 structure and materials of shields
.2 radioactivity in cooling systems
.3 subdivision of the ship into radiation control zones
.4 ionizing radiation levels
.5 special health protection measures and health protection
.6 radiation monitoring
.7 radioactive wastes

.7.1 gaseous wastes
.7.2 liquid wastes
.7.3 solid wastes .8 ventilation and air conditioning systems

13.8 Steam turbine plant
.1 description and general characteristics of the secondary circuit
.2 main condenser cooling system
.3 feedwater and condensate make-up systems
.4 auxiliary steam systems
.5 emergency source of power for propulsion

13.9 Electrical system
.1 electrical sources of power
.2 electrical load analysis
.3 distribution of electrical power
.4 electrical power supply of NSSS in emergency conditions

13.10 Modes of operation of nuclear power plant
.1 starting
.2 power operation
.3 shutdown
.4 operation from an emergency source of power

13.11 Ship's operation*
.1 operation organization
.2 number and qualification of ship's personnel
.3 watchkeeping organization
.4 musters and drills
.5 operational documentation
.6 surveys and inspections of technical condition
.7 port entry and stay in port

.7.1 description of local conditions
.7.2 arrangements prior to port entry
.7.3 conditions at the berth
.7.4 administrative arrangements for emergencies
.7.5 security measures .8 ship's salvage

13.12 Accident analyses
.1 disturbance of NSSS

.1.1 emergency stopping of primary coolant pump or pumps
.1.2 break of steam generator tubes
.1.3 disturbances of feedwater supply
.1.4 disturbances of electrical power supply
.1.5 disturbances of live steam extraction
.1.6 break of main steam pipe
.1.7 uncontrollable withdrawal of most effective control member
.1.8 cold water accident
.1.9 primary circuit rupture - loss of coolant accident .2 casualties

.2.1 collision (impact in way of reactor compartment)
.2.2 stranding/grounding
.2.3 capsizing
.2.4 sinking in shallow water
.2.5 sinking in deep water .2.6 fire
13.13 General estimation of ship's safety.

---

* Reference may be made to the Operating manual for details.

Appendix 4 Limiting dose equivalent rates for different areas and spaces

	Area or space	Dose-equivalent rate*
1.	In the navigating bridge	0.75 μSv/ h (0.075 m rem/h)
2.	In accommodation spaces	0.15 μSv/ h (0.015 m rem/h)
3.	On upper deck and in cargo spaces	0.50 μS v/ h (0.05 m rem/h)
4.	On ship's sides above the waterline	0.50 μS v/ h (0.05 m rem/h)
5.	On ship's bottom , where "in water" maintenance or survey is contemplated: with the reactor at 10 per cent power.	7.5 μS v/ h (0.75 m rem/h)

---

* The dose-equivalent rates in this Appendix are from ship sources only: they do not include natural background radiation

Appendix 5 Quality assurance programme (QAP)

1 General

1.1 As a precondition to Administration approval for the construction of a nuclear ship, a quality assurance programme (QAP) to cover the entire lifetime of the ship should be developed, documented and implemented to the satisfaction of the Administration to ensure its compliance with the provisions of the Code and other applicable regulations and conventions.

1.2 The QAP should detect non-conformances and cover all activities from initial design to final disposal, including: design; material procurement, handling and testing; construction; commissioning and post-commissioning trials; manning; operational procedures; repairs and inspections; decommissioning; final disposal .

1.3 Implementation of the QAP should ensure that all activities and materials comply with design documents, written procedures and instructions and that the effectiveness of the QAP itself is audited .

1.4 A complete description of the QAP should be included in the Safety Assessment for approval by the Administration prior to the commencement of the phases noted in 1.2.

1.5 General requirements of the QAP should ensure that:
.1 an organizational structure is established which clearly identifies responsibility for the programme throughout the life cycle of the ship;
.2 control of all documentation is maintained ;
.3 all specified requirements are implemented;
.4 materials and procedures comply with the necessary quality level corresponding to the design and safety classes assigned to the component or system;
.5 testing of material properties before and during manufacture satisfy approved specification requirements;
.6 design, procurement, manufacturing, handling, storage, installation, maintenance, testing and operating procedures comply with the quality levels corresponding to the assigned design and safety classifications;
.7 components and systems are manufactured , installed and maintained in compliance with plans, drawing and specifications approved by the Administration, or its competent authority;
.8 operation of systems and components complies with their specified functions, particularly with regard to safety functions;
.9 all provisions of the Code and other relevant requirements of the Administration are fully satisfied; and
10 records are kept of all quality assurance procedures, schedules, inspections, tests and test results and decisions in the case of non-conformity.

2 Organizational structure

2.1 The organizational structure of the QAP should clearly define functional responsibilities, levels of authority, lines of communication, and interfaces where multiple organizational arrangements are involved .

2.2 Functional responsibilities within the QAP should include:
.1 the attainment of quality objectives by those directly involved in carrying out the work ; and
.2 when verification of conformance to established requirements is necessary, it is carried out by those who do not have responsibility for performing the work.

2.3 At all stages in the ship's life cycle, there should be a single identified authority responsible for the overall management and control of the QAP Control should be exercised to ensure integration and continuity of quality assurance Provisions where work is subcontracted or where a transfer of primary responsibility occurs.

3 Documentation and records

3.1 Measures should be established and documented to control the preparation, review, approval, issuance, revision and recall of all documents essential to activities Affecting quality .

3.2 Control measures should be established and documented which assure that all applicable design provisions, such as regulatory requirements, applicable codes, standards and design bases are identified and properly applied .

3.3 Quality assurance records should be maintained for all aspects of the QAP. Records should present objective evidence of quality control and should include data on reviews, inspections, tests, audits, monitoring of work performance, material analyses, power plant operation logs, failures and deficiencies, repairs and other appropriate data. Quality assurance records should be collected , stored and maintained to provide ready reference.

4 Control procedures

4.1 Design control procedures should verify the adequacy of the design through the use of design reviews, alternative methods of calculation, critical assessment of design assumptions and the performance of suitable rests. Design changes should be subject to the same level of control as were applied to the original design.

4.2 Well documented measures should be established to ensure that all applicable regulatory requirements, design bases, standards, specifications, performance criteria and other necessary data are included or referenced in procurement documents for components and services. Purchased items and services should be subject to control to assure their conformance with procurement specifications.

4.3 A basic consideration in the evaluation and selection of suppliers should be their capability to provide items and services which fully comply with the requirements of the procurement document.

4.4 Measures should be established for the identification and control of items, including subassemblies, so that they can be readily identified during installation and use. Associated control documentation should be available for items as they pass through the various stages of processing.

4.5 Processes and procedures used in the fabrication, handling, installation, testing and operation of systems and components , should be continuously monitored to ensure that originally checked quality Performances are not degraded.

4.6 The QAP should prescribe the action required to detect, identify and rectify any defects that prejudice the proper functioning of any equipment or system to which the QAP applies. Failures, malfunctions, deficiencies, deviations, defective or incorrect material and equipment or any other relevant non-conformity should be reviewed and approved remedial action undertaken .

5 Testing

5.1 An approved test programme should be established which provides for the scheduling, identification , performance standards, procedures and documentation of all tests required to fulfil the requirements of the QAP. The test programme should include appropriate procedure and equipment qualification tests, prototype qualification tests, proof tests prior to installation, pre-operational and startup tests and in-service testis. Testing and measuring devices used for tests should be controlled and frequently calibrated to maintain accuracy within prescribed limits.

5.2 The scope of Quality assurance tests should be specified , as necessary, for the relevant documents, materials, structures, components or systems involved. Inspection and test personnel procedures and qualifications should be described.

Appendix 6 Application of single failure criterion

1 The single failure criterion is a design principle which states that the performance required of a safety system will be achieved despite the random failure of a component of the system .

2 A single failure is assumed to occur in those safety systems which have been designed to mitigate the effect of an initiating event. Accident analysis should be carried out, assuming a combination of an initialing event together with any other failures which occur as a direct result of the initiating event and, in addition, a random failure of any single component which is necessary for performance of a safety function which is intended to mitigate the effects of the initiating event.

3 All these considerations must be recognized when applying the concept of single failure criterion. Consequently:
.1 The concept is reserved for those systems important to the safety of the NSSS.
.2 The concept addresses the ability of a safety system as a whole and not each of the safety system's subsystems to perform the system function , following the failure of any component in the system. In simpler terms, the single failure criterion is applied to the safety system and not to each of its subsystems, even if each of these subsystems is able by itself to perform the system function .

4 A system is that total means made up of electrical, fluid and mechanical components by which a given function is accomplished. Additionally, a system may consist of a number of subsystems. A subsystem may be categorized by the type of component it includes, such as electrical, fluid or mechanical or the subsystem may itself contain all the components necessary to perform the system function. Together, the subsystems combine to provide the total means by which a stated function is accomplished and are collectively referred to as the "system''.

5 The systems to which the concept should be applied are, for example, the protection system, the residual heat removal system , the emergency core cooling system , the containment heat removal system. the containment isolation systems, the containment atmospheric clean-up system and the cooling writer system. These are the systems that are required to ensure safe reactor startup operation at power , shutdown and maintenance of the shutdown conditions under all PPCs.

6 The single failure criterion is not assumed to be applicable to normal operation. For other PPCs the single failure criterion should be incorporated in the design by the use of the principle of redundancy, diversity, independence, separation or, where necessary, by the provision of a safety system.

7 This criterion is a deterministic principle to be used when designing reactor safety systems in addition to other requirements, such as quality assurance and reliability analyses. In general, single failures are postulated in the case of passive as well as active components, for design basis accidents.

8 In conducting the single failure analysis the failure of a passive component designed, manufactured , inspected and maintained in service to an extremely high quality level may not need to be assumed. However, when it is assumed that a Passive component does not fail, such an analytical approach shall be justified, taking into account the total period of time, after the initiating event, that the component is required.

9 In general, the single failure criterion is applied to the electrical and fluid components, including component cooling water, in a particular safety system. An exception to the rule, however, occurs in those cases where a safety system does not have a dedicated electrical source, or where a particular electrical source supplies more than one safety system. If either of these situations exists, then the electrical power sources must be considered as a separate safety system and the single failure criterion applied to it.

10 Single failure criterion is not to be applied in the case of PPC 4b.

• Informatietype: Internationaal
• Documentsoort: Code
• Toegangsrechten: Extern
• Identificatie: PUC_3002_14
• Versie: 1
• Datum beschikbaarheid: 10-06-2009
• Geldigheid van: 19-11-1981
• Wijzigingsdatum: 02-12-2016
• Titel: Nuclear-Ship Code Code of safety for nuclear merchant ships - Res. A.491(XII)
• Organisatie: International Maritime Organization (IMO)
• Taal: Engels
• Thema: Codes (Informative)