标准编号:	HAF 102-2016
中文名称:	核动力厂设计安全规定
英文名称:	Safety regulation for design of nuclear power plant
行业分类:	HAD    核电行业标准
发布机构:	国家核安全局
发布日期:	2016-10-26
实施日期:	2016-10-26
标准状态:	现行
翻译语言:	英文
文件格式:	PDF
中文字符数:	40000 字
翻译价格(元):	4500.00 元
交付时间:	付款后 1 个工作日

Safety specifications for design of nuclear power plant

(Revised in 2016, approved and issued by the National Nuclear Safety Administration on October 26, 2016)



1 Introduction

1.1 Purpose

In order to realize the safe operation of nuclear power plants and prevent or mitigate the consequences of events that may endanger safety, this document specifies the design of structures, systems and components that are important for the safety of nuclear power plants, and the requirements that must be met by regulations and organizational processes.

This document is applicable to the analysis, verification and examination, technical support and nuclear safety supervision in the design, construction, operation and decommissioning stages of nuclear power plants.

1.2 Scope

1.2.1 This document specifies the requirements of comprehensive safety evaluation to determine the potential hazards that may arise in various operating conditions and accident conditions of nuclear power plants. The safety evaluation process involves two complementary technologies, i.e. deterministic safety analysis and probabilistic safety analysis. Various postulated initiating events must be considered in the analysis, including many factors that may affect safety individually or in combination. These events are of the following types:

(1) event originated from the operation of nuclear power plant;

(2) event caused by personnel behaviors;

(3) event directly related to the nuclear power plant and its environment.

1.2.2 This document does not involve general industrial safety which is extremely unlikely to affect nuclear safety and non-radioactive impact caused by the operation of nuclear power plant.

1.2.3 The nuclear power plant referred to hereof mainly refers to the onshore stationary nuclear power plant with water-cooled reactor, which is designed for power generation or other heating applications (such as centralized heating or seawater desalination).

1.2.4 The design of reactors of other types or adopting innovative technologies may refer to this document, but shall be subjected to careful evaluation and judgment.

2 Safety objective and defense in depth concept

2.1 Safety objectives

2.1.1 The basic safety objective is to establish and maintain effective defense against radioactive hazards in nuclear power plant so as to protect the people and environment from such hazards.

2.1.2 The following measures must be taken to achieve the basic safety objective:

(1) control the radiation exposure to personnel and the release of radioactive materials to the environment during operation;

(2) limit the possibility of events causing the reactor core, spent fuel, radioactive waste or any other radiation source of the nuclear power plant to get out of control;

(3) mitigate the consequences of the above events (if any).

2.1.3 The basic safety objective is applicable to all activities of nuclear power plants, including planning, site selection, design, manufacturing, construction, debugging, operation and decommissioning, as well as transportation of radioactive materials, management of spent fuel and radioactive waste, etc.

2.2 Radiation protection design

2.2.1 In order to achieve the basic safety objective, the radiation protection design must ensure that the radiation exposure in the nuclear power plant or the radiation exposure caused by any planned emission of radioactive materials from the nuclear power plant is lower than the specified limit value under all operating conditions, and may be as low as reasonably possible. At the same time, measures shall be taken to mitigate the radioactive consequences of any accident.

2.2.2 In order to achieve the basic safety objective, the radiation protection design must make all radiation sources of nuclear power plants under the control of strict technical and management measures. However, it neither rules out the limited exposure to personnel, nor the emission of radioactive materials permitted by laws and regulations from operating nuclear power plants to the environment. The above radiation and emission must be strictly controlled, meet the operating limits and radiation protection standards, and be as low as reasonably possible.

2.3 Safety design

2.3.1 The safety design must:

(1) prevent accidents with harmful consequences caused by out-of-control of the reactor core or other radiation sources, and mitigate the consequences in case of any accident;

(2) ensure that the radioactive consequences of all accidents considered in the design are lower than the relevant limits, and keep them as low as reasonably possible;

(3) ensure that the possibility of accidents with serious radioactive consequences is extremely low, and minimize the radioactive consequences of such accidents as much as possible.

2.3.2 To prove that the basic safety objective has been achieved in the design of nuclear power plant, the design must be subjected to comprehensive safety evaluation, so as to determine all sources of radiation exposure, and to assess the radiation dose to the nuclear power plant staff and the public, as well as the possible impact on the environment. The following contents should be considered for such safety evaluation: (1) normal operation of nuclear power plant; (2) the performance of nuclear power plant in case of anticipated operation event; (3) accident conditions. It is necessary to confirm the design capability of resisting the postulated initiating events and accidents, verify the effectiveness of items important to safety, and determine the input of emergency plan on the basis of analysis.

2.3.3 Although measures have been taken to control the radiation exposure in all operating conditions to be as low as reasonably possible and to minimize the possibility of out-of-control accidents of radiation sources, there is still the possibility of accidents. Therefore, it is necessary to take measures to ensure the mitigation of radioactive consequences. Such measures include: safety facilities and safety systems, accident management regulations for nuclear power plants formulated by operation units, and off-site intervention measures formulated by relevant national and local departments.

2.3.4 For the safety design of nuclear power plants, practical measures must be taken to reduce the impact of nuclear and radiation accidents on human life, health and environment. The accident sequence of nuclear power plants that may lead to high radiation dose or massive radioactive release must be eliminated practically; it must be ensured that the accident sequence of high-frequency nuclear power plants has no or only minor potential radioactive consequences. The basic objective of safety design is to limit or even cancel off-site protective actions that technically reduce the radioactive consequences.

2.4 Defense in depth concept

2.4.1 The main means to prevent accidents in nuclear power plants and mitigate the consequences of accidents is to apply the defense in depth concept. This concept is implemented throughout all safety-related activities, involving the organization, personnel behavior or design of nuclear power plants under various powers and shutdown conditions, so as to ensure that these activities are under the defense of various independent measures at different levels. Even if a fault occurs, it will be detected, compensated or corrected by appropriate measures. The defense in depth is implemented throughout the design and operation to deal with various anticipated operation events and accidents caused by equipment fault or human factors in the plant, as well as the consequences caused by external events.

2.4.2 The defense in depth concept is mainly applied through the combination of a series of continuous and independent defense levels to prevent accidents from harming people and environment. If the defense at a certain level fails, that at the next level will provide protection. Independent effectiveness of each level of defense is an essential component of defense in depth.

(1) The purpose of the first level of defense is to prevent facility from deviating from normal operation and prevent fault of items important to safety. At this level, it is required to select the site of, design, build, maintain and operate nuclear power plants correctly and conservatively according to proper quality level and verified engineering practice. Therefore, great attention shall be paid to the selection of appropriate design codes and materials, and the quality of the manufacturing of components and construction and debugging of nuclear power plants shall be controlled. At this level, the design measures reducing the possibility of internal hazard are helpful to prevent accidents. Moreover, attention shall also be paid to the design, manufacturing, construction, in-service inspection, maintenance and test processes and procedures, as well as the good accessibility during these activities, the operation mode of the nuclear power plant, the utilization of operation experience, etc. The whole process is based on the detailed analysis that is to determine the operation and maintenance requirements of nuclear power plants and their quality management requirements.

(2) The purpose of the second level of defense is to test and control the facilities from deviating from normal operation, so as to prevent the anticipated operation events from escalating into accident conditions. Despite precautions, some postulated initiating events may still occur in nuclear power plants during their service life. At this level, it is required to set up specific systems and facilities in the design, confirm their effectiveness through safety analysis, and formulate operation regulations to prevent these initiating events or minimize their consequences as possible, so that the nuclear power plant can return to a safe state.

(3) The third level of defense is set up based on the assumption that although it is impossible, the escalation of some anticipated operation events or postulated initiating events may still not be prevented by the previous level of defense and they evolve into accidents. In the design of nuclear power plants, it is assumed that these accidents may occur. Therefore, inherent safety characteristics and (or) engineered safety features, safety systems and regulations must be adopted to prevent the radioactive release that causes damage to the reactor core or requires off-site intervention measures, and to make the nuclear power plant return to a safe state.

(4) The purpose of the fourth level of defense is to reduce the accident consequences caused by the failure of the third level of defense in depth. The fourth level of defense is realized by controlling the progress of accidents and mitigating the consequences of serious accidents. The safety objective hereof is to take limited protective actions in area and time in case of serious accidents, and to avoid or minimize off-site radioactive contamination. This requires that the sequence of events that may lead to early radioactive release or massive radioactive release be actually eliminated.

(5) The purpose of the fifth level, that is, the last level of defense, is to reduce the radioactive consequences of the potential radioactive release caused by accident conditions. At this level, it is required to provide appropriate emergency facilities and formulate emergency plans and procedures for on-site and off-site emergency response.

2.4.3 On the other hand, the application of defense in depth concept is to set up a series of physical barriers in the design, and adopt the combination of active and passive facilities and inherent safety characteristics, so that the physical barriers can effectively contain radioactive materials in specific areas. The quantity of physical barriers required depends on the initial source terms characterized by total radionuclide and isotopic composition, the effectiveness of a single barrier, possible internal and external hazards and the potential consequences of various failures.

3 Design safety management

3.1 Design safety management responsibilities

The operation units must ensure that the design submitted to the nuclear safety regulator under the State Council meets all applicable safety requirements. All organizations involved in important activities related to safety design of nuclear power plants, including design units, shall be responsible to ensure that top priority is given to safety matters.

3.2 Quality assurance

3.2.1 The quality assurance program describing the overall arrangement of management, implementation and evaluation of nuclear power plant design must be formulated and implemented. This program includes measures ensuring the design quality of each structure, system and component as well as the overall design quality of the nuclear power plant, including measures to identify and correct design defects, check design appropriateness and control design changes.

3.2.2 The design, including change, modification or safety improvement, must be carried out in accordance with the procedures determined by appropriate engineering codes and standards, must reflect applicable requirements and design basis, and must determine and control design interfaces.

3.2.3 Whether the design (including design means, design input and output) is appropriate or not must be verified and confirmed by individuals or groups not originally engaged in design. The verification, confirmation and approval shall be completed as soon as possible in the design and construction process, no later than the first loading of the nuclear power plant in any way.

3.3 Maintenance of safety and integrity of nuclear power plant design throughout the service life

3.3.1 The operation unit shall take full responsibility for safety. It must establish a formal system to ensure the safety and integrity of nuclear power plant design throughout its service life.

3.3.2 To facilitate the transfer of detailed design data such as safety analysis report, design manual and other design documents to the operation unit, a department responsible for the overall design process shall be set up as soon as possible, and a management process shall be formulated to be responsible for the design safety and integrity of the nuclear power plant within the management system of the operation unit.

3.3.3 The design of nuclear power plant may be shared by many organizations: engineering company, supplier of reactor and its auxiliary system, supplier of main equipment, designer of electrical system and supplier of other system important to the safety of nuclear power plants, etc. The operation unit must manage the design activities entrusted to external organizations.

3.3.4 The department fully responsible for the design process must ensure that the design of nuclear power plant meets the acceptance criteria in terms of safety, reliability and quality. These criteria shall meet the relevant laws, regulations, standards and codes. The work scope and responsibilities must be established and determined so as to:

(1) ensure that the design conforms to its objective and meets the requirements of protection and safety optimization, so as to keep the radiation risk as low as reasonably possible;

(2) ensure that the ways to continuously ensure the design safety include design verification, determining engineering codes, standards and requirements, adopting verified engineering practices, providing feedback on construction experience, approving important engineering documents, conducting safety evaluation and maintaining safety culture;

(3) ensure that the design data required for safe operation, maintenance (including appropriate test period) and modification shall be available; the previous operation experience and verified research results shall be properly considered for design data, which shall be maintained in the latest state by the operation unit;

(4) ensure to maintain the management of design requirements and state control;

(5) ensure to establish and control necessary interfaces between the responsible designer and the supplier involved in design;

(6) ensure that the operation unit needs to maintain necessary engineering professional data and scientific and technological data;

(7) ensure that all design changes have been reviewed, verified, documented and approved;

(8) ensure to maintain sufficient documents to facilitate the decommissioning of nuclear power plants in the future.

核动力厂设计安全规定
（2016 年修订，2016 年 10 月 26 日国家核安全局批准发布）

1 引 言

1.1 目的
为实现核动力厂的安全运行，防止或减轻可能危及安全的事件 后果，本规定提出了核动力厂安全重要的构筑物、系统和部件的设 计，以及规程和组织流程所必须满足的要求。
本规定适用于核动力厂设计、建造、运行和退役阶段的分析、 验证和审查，技术支持以及核安全监督。
1.2 范围
1.2.1 本规定提出了进行全面安全评价的要求，以确定核动力 厂在各种运行状态和事故工况下可能产生的潜在危险。安全评价过 程涉及确定论安全分析和概率论安全分析这两种互为补充的技术， 分析中必须考虑各种假设始发事件，包括可能单独地或组合地影响 安全的诸多因素。这些事件有如下几种类型：
（1）源自核动力厂运行本身；
（2）由人员行为引起；
（3）与核动力厂及厂址环境直接相关。
1.2.2 本规定不涉及极不可能影响核安全的一般工业安全和由


核动力厂运行所引起的非放射性影响。
1.2.3 本规定中的核动力厂主要是指为发电或其他供热应用
（诸如集中供热或海水淡化）而设计的，采用水冷反应堆的陆上固 定式核动力厂。
1.2.4 其他类型或采用革新技术的反应堆设计可参照本规定， 但应经过细致的评价和判断。

2 安全目标和纵深防御概念

2.1 安全目标
2.1.1 基本安全目标：在核动力厂中建立并保持对放射性危害 的有效防御，以保护人与环境免受放射性危害。
2.1.2 为了实现基本安全目标，必须采取以下措施：
（1）控制在运行状态下对人员的辐射照射和放射性物质向环境 的释放；
（2）限制导致核动力厂反应堆堆芯、乏燃料、放射性废物或任 何其他辐射源失控事件发生的可能性；
（3）如果上述事件发生，减轻这些事件产生的后果。
2.1.3 基本安全目标适用于核动力厂的所有活动，包括规划、选 址、设计、制造、建造、调试、运行和退役，以及有关放射性物质 的运输、乏燃料和放射性废物的管理等。
2.2 辐射防护设计
2.2.1 为了实现基本安全目标，辐射防护设计必须保证在所有


运行状态下核动力厂内的辐射照射或由于该核动力厂任何计划排放 放射性物质引起的辐射照射低于规定限值，且可合理达到的尽量低。 同时，还应采取措施减轻任何事故的放射性后果。
2.2.2 为了实现基本安全目标，辐射防护设计必须使得核动力 厂所有辐射照射的来源都处在严格的技术和管理措施控制之下。但 不排除人员受到有限的照射，也不排除法规许可数量的放射性物质 从处于运行状态的核动力厂向环境的排放。此种照射和排放必须受 到严格控制，并符合运行限值和辐射防护标准，且可合理达到的尽 量低。
2.3 安全设计
2.3.1 安全设计必须：
（1）防止由于反应堆堆芯或其他辐射源失控所引起有害后果的 事故，并在一旦发生事故时减轻其后果；
（2）保证在设计中考虑的所有事故的放射性后果都低于相关限 值，并保持在可合理达到的尽量低的水平；
（3）保证有严重放射性后果的事故发生的可能性极低，并尽最 大可能减轻这种事故的放射性后果。
2.3.2 为了证明在核动力厂的设计中实现了基本安全目标，必 须对设计进行全面的安全评价，以确定所有辐射照射的来源，并评 估核动力厂工作人员和公众可能受到的辐射剂量，以及对环境的可 能影响。此种安全评价要考虑以下内容：（1）核动力厂的正常运行；
（2）预计运行事件时核动力厂的性能；（3）事故工况。在分析的
基础上，确认设计抵御假设始发事件和事故的能力，验证安全重要


物项的有效性，以及确定应急计划的输入。
2.3.3 尽管采取措施将所有运行状态下的辐射照射控制在可合 理达到的尽量低的水平，并将导致辐射源失控事故的可能性减至最 小，但仍然存在发生事故的可能性。这就需要采取措施以保证减轻 放射性后果。这些措施包括：安全设施和安全系统，营运单位制定 的核动力厂事故管理规程，以及国家和地方有关部门制定的场外干 预措施。
2.3.4 核动力厂的安全设计必须采取实际措施，以减轻核与辐 射事故对人的生命、健康以及环境造成的影响。必须实际消除可能 导致高辐射剂量或大量放射性释放的核动力厂事故序列；必须保证 发生频率高的核动力厂事故序列没有或仅有微小的潜在放射性后 果。安全设计的基本目标是在技术上实现减轻放射性后果的场外防 护行动是有限的甚至是可以取消的。
2.4 纵深防御概念
2.4.1 防止核动力厂发生事故和减轻事故后果的主要手段是应 用纵深防御概念。该概念贯彻于安全有关的全部活动，涉及核动力 厂各种功率及停堆状态下有关的组织、人员行为或设计，以保证这 些活动均置于各种独立的、不同层次措施的防御之下。即使有一种 故障发生，它将由适当的措施探测、补偿或纠正。在整个设计和运 行中贯彻纵深防御，以应对厂内设备故障或人因引起的各种预计运 行事件和事故，以及外部事件引起的后果。
2.4.2 纵深防御概念的应用主要是通过一系列连续和独立的防
御层次的结合，防止事故对人员和环境造成危害。如果某一层次的


防护失效，则由后一层次提供保护。每一层次防御的独立有效性都 是纵深防御的必要组成部分。
（1）第一层次防御的目的是防止偏离正常运行及防止安全重要 物项的故障。这一层次要求：按照恰当的质量水平和经验证的工程 实践，正确并保守地选址、设计、建造、维修和运行核动力厂。为 此，应十分注意选择恰当的设计规范和材料，并对部件的制造、核 动力厂的建造和调试进行质量控制。在这一层次，降低内部危险可 能性的设计措施有助于事故的预防。还应重视涉及设计、制造、建 造、在役检查、维修和试验的过程和规程，以及进行这些活动时良 好的可达性、核动力厂的运行方式和运行经验的利用等方面。整个 过程以确定核动力厂运行和维修要求及其质量管理要求的详细分析 为基础。
（2）第二层次防御的目的是检测和控制偏离正常运行状态，以 防止预计运行事件升级为事故工况。尽管注意预防，核动力厂在其 寿期内仍然可能发生某些假设始发事件。这一层次要求在设计中设 置特定的系统和设施，通过安全分析确认其有效性，并制定运行规 程以防止这些始发事件的发生，或尽量减小其造成的后果，使核动 力厂回到安全状态。
（3）设置第三层次防御是基于以下假定：尽管极不可能，某些 预计运行事件或假设始发事件的升级仍有可能未被前一层次防御所 制止，而演变成事故。在核动力厂的设计中，假定这些事故会发生。 这就要求必须通过固有安全特性和（或）专设安全设施、安全系统


和规程，防止造成反应堆堆芯损伤或需要采取场外干预措施的放射 性释放，并能使核动力厂回到安全状态。
（4）第四层次防御的目的是减轻第三层次纵深防御失效所导致 的事故后果。通过控制事故进展和减轻严重事故的后果来实现第四 层次的防御。安全目标是，在严重事故下仅需要在区域和时间上采 取有限的防护行动，且避免场外放射性污染或将其减至最小。这要 求可能导致早期放射性释放或者大量放射性释放的事件序列被实际 消除。
（5）第五层次，即最后层次防御的目的是减轻可能由事故工况 引起的潜在放射性释放造成的放射性后果。该层次要求配备恰当的 应急设施，制定用于场内、场外应急响应的应急计划和应急程序。
2.4.3 纵深防御概念应用的另一方面是在设计中设置一系列的 实体屏障，并采用能动、非能动设施和固有安全特性的组合，以使 实体屏障能够有效地将放射性物质包容在特定区域。所需实体屏障 的数目取决于放射性核素总量和同位素成份表征的初始源项、单个 屏障的有效性、可能的内部与外部危险以及各种失效的潜在后果。

3 设计安全管理

3.1 设计安全管理职责
营运单位必须保证提交国务院核安全监管部门的设计符合所有 适用的安全要求。所有从事与核动力厂安全设计重要活动相关的组 织，包括设计单位，都有责任保证将安全事务放在最优先的位置。


3.2 质量保证
3.2.1 必须制定和实施描述核动力厂设计的管理、执行和评价 的总体安排的质量保证大纲。该大纲包括保证核动力厂每个构筑物、 系统和部件以及总体设计的设计质量的措施,包括确定和纠正设计 缺陷、检验设计的恰当性和控制设计变更的措施。
3.2.2 设计，包括变更、修改或安全改进，必须按照合适的工 程规范和标准所确定的程序进行，并必须体现适用的要求和设计基 准，必须确定和控制设计接口。
3.2.3 设计（包括设计手段和设计输入与输出）的恰当与否， 必须由原先从事此工作的人员以外的个人或团体进行验证和确认。 在设计和建造过程中应尽早完成验证、确认和批准,最迟不晚于核动 力厂首次装料。
3.3 全寿期内保持核动力厂设计的安全和完整性
3.3.1 营运单位对安全负全面责任。营运单位必须建立一套正 式的体系，在整个寿期内始终保证核动力厂设计的安全和完整性。
3.3.2 为便于安全分析报告、设计手册和其他设计文件等详细 的设计资料转移至营运单位，应尽早设立全面负责设计过程的部门， 并制定管理流程，在营运单位的管理体系内负责核动力厂设计安全 和完整性。
3.3.3 核动力厂的设计工作可以由许多组织分担：工程公司、 反应堆及其辅助系统供应商、主要设备供应商、电气系统的设计单 位以及对核动力厂安全重要的其它系统的供应商等。营运单位必须
对委托给外部组织的设计活动进行管理。


3.3.4 全面负责设计过程的部门必须保证核动力厂设计满足安 全性、可靠性和质量方面的验收准则。这些准则符合相关的法律法 规和标准规范。必须建立并明确工作范围和职责，以保证：
（1）设计符合其目标，并满足防护和安全最优化的要求，使辐 射风险保持在可合理达到的尽量低的水平；
（2）持续保证设计安全的方式包括设计验证、确定工程规范和 标准及要求、采用经验证的工程实践、提供建造经验反馈、批准重 要工程文件、开展安全评价和保持安全文化；
（3）安全运行、维修（包括合适的试验周期）和修改所需的设 计资料应该是可用的，设计资料应适当考虑以往的运行经验和经验 证的研究成果，并由营运单位维护在最新状态；
（4）保持对设计要求和状态控制的管理；
（5）建立和控制责任设计者和参与设计工作的供应商之间必要 的接口；
（6）营运单位需维护必要的工程专业资料和科技资料；
（7）所有设计变更都经过审查、验证、形成文档并批准；
（8）维护充分的文件，以便今后开展核动力厂退役工作。


4 主要技术要求

4.1 基本安全功能
4.1.1 必须保证在核动力厂所有状态下实现以下基本安全功 能：


（1）控制反应性；
（2）排出堆芯余热，导出乏燃料贮存设施所贮存燃料的热量；
（3）包容放射性物质、屏蔽辐射、控制放射性的计划排放，以 及限制事故的放射性释放。
4.1.2 必须用全面、系统的方法来确定完成基本安全功能所必 需的安全重要物项，以及在核动力厂所有状态下用于实现或影响基 本安全功能的固有特性。
4.1.3 必须提供对核动力厂状态进行监测的手段，以保证实现 所要求的安全功能。
4.2 辐射防护
4.2.1 设计必须保证工作人员和公众在整个寿期内受到的辐射 剂量，在运行状态下不超过剂量限值，在事故工况下不超过可接受 限值，并可合理达到的尽量低。
4.2.2 设计必须实际消除可能导致高辐射剂量或大量放射性释 放的核动力厂状态，并必须保证发生可能性较高的核动力厂状态没 有或仅有微小的潜在放射性后果。
4.2.3 基于辐射防护目的，必须制定与核动力厂各类状态相对 应且符合监管要求的可接受限值。
4.3 设计管理
4.3.1 设计必须保证核动力厂及其安全重要物项具有合适的性 能，以保证其能可靠地执行安全功能；在设计寿期内核动力厂能够 在运行限值和条件范围内安全运行，并能够安全退役；对环境的影


响最小。
4.3.2 设计必须保证满足营运单位的安全要求，满足国务院核 安全监管部门和相关法律法规的要求，并适当考虑营运单位人员的 能力与局限性以及可能影响人员行为的各种因素。必须提供充分的 设计资料，保证核动力厂的安全运行和维修，并允许以后能对核动 力厂进行修改。同时推荐可纳入核动力厂管理规程和运行规程的实 践（即运行限值和条件）。
4.3.3 设计必须适当考虑其他核动力厂在设计、建造和运行中 获得的相关经验，以及相关的研究成果。
4.3.4 设计必须适当考虑确定论安全分析和概率论安全分析的 结果，保证已经适当考虑了事故的预防和事故后果的缓解。
4.3.5 设计必须保证采用合适的设计措施以及运行和退役实 践，使产生和排放的放射性废物活度和体积达到实际可行的最低水 平。
4.4 纵深防御的应用
4.4.1 设计必须体现纵深防御。纵深防御的各层次之间必须尽 实际可能地相互独立，避免一个层次防御的失效降低其他层次的有 效性。
4.4.2 设计必须应用纵深防御概念，提供多层次防御，预防可 能对人与环境产生有害影响的事故后果，并保证在防护失效时，采 取适当措施保护人与环境，减轻事故后果。
4.4.3 设计必须适当考虑这样的事实：当缺少某一层次防御时，


多层次防御的存在并不能作为继续运行的基础。纵深防御的各层次 必须总是可用的，对任何特定运行模式下的放松都必须进行论证。
4.4.4 设计：
（1）必须设置多道实体屏障，阻止放射性物质向环境释放；
（2）必须采用保守的设计和高质量的建造，以保证核动力厂的 故障和偏离正常运行减至最少，保证尽实际可能地预防事故，保证 核动力厂不存在陡边效应；
（3）必须利用固有特性和工程设施控制核动力厂的行为，尽可 能减少或排除那些需要启动安全系统的故障和偏离正常运行；
（4）必须对核动力厂提供附加控制，这些附加控制采用安全系 统的自动触发，以能够高置信度地控制那些超出控制系统能力的故 障和偏离正常运行，并使得早期阶段对操纵员动作的需求减至最少；
（5）必须提供构筑物、系统和部件以及规程，以控制超出安全 系统能力的故障和偏离正常运行的进程，并尽实际可能地限制其后 果；
（6）必须提供多种手段来保证实现每项基本安全功能，从而保 证各道屏障的有效性，并减轻任何故障和偏离正常运行的后果。
4.4.5 为了贯彻纵深防御概念，设计必须尽实际可能地防止：
（1）出现影响实体屏障完整性的情况；
（2）一道或多道屏障失效；
（3）一道屏障因另一道屏障的失效而失效；
（4）运行和维修差错产生有害后果的可能性。
4.4.6 在核动力厂运行寿期内，设计必须尽实际可能地使第一


层次防御至多第二层次防御能够阻止可能发生的所有故障或偏离正 常运行升级为事故工况。
4.4.7 用于设计扩展工况的安全设施（如用于减轻燃料熔化事 故后果的设施）应尽实际可能地与安全系统独立。
4.5 实物保护
4.5.1 必须设置实物保护措施，即核安保措施，包括实物保护 系统和相关管理措施，以防止、侦查和应对涉及核材料和核动力厂 相关设施的偷窃、蓄意破坏、未经授权的接触，非法转让或其他恶 意行为，以及防范恐怖分子获取材料、破坏核动力厂等。
4.5.2 应根据保护目标的重要程度和潜在风险确定核动力厂实 物保护的等级，并按照确定的等级进行实物保护系统设计。应合理 布置核动力厂的控制区、保护区和要害区，实现分区保护，并为各 区配备相应的设施和设备。
4.5.3 实物保护系统必须考虑出入口控制、探测、报警、集中 控制、照明、通讯、供电和巡更等方面，并设置多重实体屏障。
4.5.4 核动力厂应配备武警或守卫，制定实物保护相关管理程 序，使得管理措施与技防措施有机结合，以保证实物保护系统的完 整、可靠与有效。
4.5.5 应对实物保护设计方案进行风险分析和有效性评估。
4.5.6 必须以统筹兼顾的方式设计和实施核动力厂的核安全措 施、核安保措施及国家核材料衡算和控制体系，以免其相互制约。


4.6 经验证的工程实践
4.6.1 必须鉴别和评价用于核动力厂安全重要物项设计准则的 规范和标准，以确定其适用性、恰当性和充分性，并根据需要进行 补充或修改，以保证设计质量与所需的安全功能相适应。
4.6.2 核动力厂的安全重要物项必须是此前在相当使用条件下 验证过的，否则该物项必须具有高质量且其技术经过鉴定或试验。
4.6.3 当引入未经验证的设计或设施，或存在偏离已有工程实 践的情况时，必须借助适当的支持性研究计划、特定验收准则的性 能试验，或通过其他相关应用中获得的运行经验的检验，来证明其 安全性是合适的。新的设计、设施或实践必须在投入使用前经过充 分的试验，并在使用中进行监测，以验证达到了预期效果。
4.7 安全评价
4.7.1 必须在核动力厂的整个设计过程中进行全面的确定论安 全评价和概率论安全评价，以保证在核动力厂寿期内的各个阶段满 足全部设计安全要求，并确认在竣工、运行和修改时交付的设计满 足制造和建造的要求。
4.7.2 设计过程中必须尽早开展安全评价。随着设计和确认性 分析活动之间的不断迭代，安全评价的范围和详细程度随着设计计 划的进展不断地扩大和提高。
4.7.3 必须将安全评价形成文件以便于独立评估。
4.8 便于建造的要求
4.8.1 核动力厂安全重要物项的设计必须使其能够按照确定的 流程进行制造、建造、装配和安装，以保证满足设计规范和所要求


的安全水平。
4.8.2 核动力厂的建造和运行，必须适当考虑从其他类似核动 力厂及其相关构筑物、系统和部件建造中获得的相关经验。如果采 用其他相关工业的良好实践，则必须表明其适用于核动力厂。
4.9 放射性废物管理和退役
4.9.1 在设计阶段，必须专门考虑便于核动力厂放射性废物管 理以及核动力厂退役和拆除的特性。
4.9.2 在设计中必须适当考虑：
（1）材料的选取，以使放射性废物量尽实际可能地少，并便于 去污；
（2）必要的可达性和可操作性；
（3）管理（例如分离或分拣、表征、分类、预处理、处理和整 备）和贮存核动力厂在运行过程中产生的放射性废物所需的设施， 以及管理核动力厂在退役时所产生的放射性废物的措施。