1Features for the management of energy perform the following functions: pressure suppression, reduction in pressure and temperature of the containment atmosphere, and removal of the containment heat.

2A single failure is a failure which results in the loss of capability of a component to perform its intended safety function(s), and any consequential failure(s) which result(s) from it.

3Examples of the design margins applied in some States are as follows:10–25% between the containment design pressure and the peak accident pressure;15–40% at the design stage for the differential pressure across internal walls (this margin may be reduced in the as-built condition to take account of possible increases in the free area of the openings between compartments).

4A single failure criterion is a criterion (or requirement) applied to a system such that it must be capable of performing its task in the presence of any single failure. A single failure is a failure which results in the loss of capability of a component to perform its intended safety function(s), and any consequential failure(s) which result from it.

5Typical periods of grace range from 20 min to 12 h. The period of grace may be achieved by means of the automation of actuations, the adoption of passive systems or the inherent material characteristics (such as the heat capacity of the containment structure), or by any combination of these.

6A seismic level 2 (SL-2) earthquake corresponds directly to ultimate safety requirements. The level of ground motion associated with such an earthquake is required to have a very low probability of being exceeded over the plant lifetime. It represents the maximum level of ground motion to be assumed for design purposes.

7In some States this combination is not required; in other States, leaktightness of the containment is required to be ensured for the maximum DBA pressure combined with one half of the earthquake loads.

8A ‘cliff edge’ effect is an instance of severely abnormal plant behaviour caused by an abrupt transition from one plant status to another following a small deviation in a plant parameter, and so a discontinuity in the first derivative of the response to a small variation in an input.

9Examples of such limits that are applied in Member States are: 0.25–0.5% overall leakage of the contained mass of free gas and steam per day at design pressure for steel containments or concrete containments with a steel liner; 1.0–1.5% per day overall leakage for prestressed concrete containments without a steel liner.

10A closed loop is a piping or ducting system that penetrates the containment envelope and that is designed to form a closed circuit either inside or outside, or inside and outside the containment in operational states and in accident conditions.

11An automatic valve is a valve or damper that can be actuated either by the protection system signals or by other instrumentation and control circuits without action by the operator or by the process medium itself. For example, certain types of check valves are considered automatic valves. A normally closed valve is a valve that is closed under active administrative control (such as being locked closed or continuously monitored to show that the valve is in the closed position) except for intermittent opening for specific purposes such as monitoring, testing or sampling. A remotely operated valve is a valve or damper that can be actuated by an operator from the control room and in some cases also from the supplementary control points.

12In some States, structural integrity tests are conducted at intervals of once every 10 years.

13Recommendations for conducting safety analyses for severe accidents are provided in paras 4.104–4.122 of Ref. [3].

14In this context, the possibility of certain conditions occurring is considered to have been practically eliminated if it is physically impossible for the conditions to occur or if the conditions can be considered with a high degree of confidence to be extremely unlikely to arise.