Revision 6 – August 2016 

USNRC STANDARD REVIEW PLAN 

This Standard Review Plan (SRP), NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory 

Commission (NRC) staff responsible for the review of applications to construct and operate nuclear power plants intends to use in 

evaluating whether an applicant or licensee meets the NRC regulations. The SRP is not a substitute for the NRC regulations, and 

compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical 

techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed 

alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations. 

The SRP sections are numbered in accordance with corresponding sections in Regulatory Guide (RG) 1.70, "Standard Format and 

Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of RG 1.70 have a corresponding 

review plan section. The SRP sections applicable to a combined license application for a new light-water reactor (LWR) are based 

on RG 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)." 

These documents are made available to the public as part of the NRC policy to inform the nuclear industry and the general public of 

regulatory procedures and policies. Individual sections of NUREG-0800 will be revised periodically, as appropriate, to 

accommodate comments and to reflect new information and experience. Comments may be submitted electronically by email to 

NRO_SRP@nrc.gov. 

Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory 

Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section by fax to (301) 415 2289; or by 

email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC public Web site at 

http://www.nrc.gov/reading rm/doc collections/nuregs/staff/sr0800/, or in the NRC Agencywide Documents Access and

Management System (ADAMS), at http://www.nrc.gov/reading rm/adams.html under ADAMS Accession No. ML16020A097. 

NUREG-0800 

U.S. NUCLEAR REGULATORY COMMISSION 

STANDARD REVIEW PLAN 

7.9 DATA COMMUNICATION SYSTEMS

REVIEW RESPONSIBILITIES

Primary - Organization responsible for the review of instrumentation and controls 

Secondary - None 

Review Note: The revision numbers of Regulatory Guides (RG) and the years of endorsed 

industry standards referenced in this Standard Review Plan (SRP) section are centrally 

maintained in SRP Section 7.1-T, “Regulatory Requirements, Acceptance Criteria, and 

Guidelines for Instrumentation and Control Systems Important to Safety,” (Table 7-1). 

Therefore, the individual revision numbers of RGs (except RG 1.97) and years of endorsed 

industry standards are not shown in this section. References to industry standards incorporated 

by reference into regulation (IEEE Std 279-1971 and IEEE Std 603-1991) and industry 

standards that are not endorsed by the agency do include the associated year in this 

section. See Table 7-1 to ensure that the appropriate RGs and endorsed industry standards are 

used for the review. 
 

7.9-2 Revision 6 - August 2016 

I. AREAS OF REVIEW 

The objectives of the review are to confirm that data communication systems (DCSs): 

(1) conform to applicable acceptance criteria and guidelines, (2) will perform the safety functions 

assigned to them, (3) will meet the reliability and availability goals assumed for the system, and 

(4) will tolerate the effects of random transmission failures. A particular concern is that the 

transmission of multiple signals over a single path may constitute a single point of failure that 

may have a larger impact on plant safety than would occur in previous analog systems. The 

scope and depth of the review and the acceptance criteria will vary according to the importance 

to safety of the system that the DCS is supporting. 

1. This SRP section describes the review process and acceptance criteria for DCSs that 

are part of or support the systems described in SRP Sections 7.2 through 7.8 of the 

applicant’s safety analysis report (SAR). 

The DCSs may include multiplexers and more general communication systems. The 

distinction between multiplexers and more general data communication systems is often 

blurred. For purposes of this SRP section, a multiplexer is defined as equipment that 

transmits, receives, or connects in turn several different signals over an electrical 

conductor or optical-fiber medium on a fixed schedule or rotation. Internal computer 

buses are specifically excluded from the definition of DCSs used in this SRP section. 

Multiplexers may be analog or digital. More generally, a DCS transmits one or more 

signals on one or more electrical or optical media according to some analog or digital 

encoding. The schedule for transmission of the various signals may not be fixed and 

particular signals or data may be transmitted at unpredictable intervals. 

Communications via media other than electrical conductors or optical fiber are not 

addressed by this SRP section. 

The review described in this SRP section includes communication between systems and 

communication between computers within a system. This SRP section addresses both 

safety and nonsafety communication systems. 

2. Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC). For design certification 

(DC) and combined license (COL) reviews, the NRC staff reviews the applicant’s 

proposed ITAAC associated with the structures, systems, and components (SSCs) 

related to this SRP section in accordance with SRP Section 14.3, “Inspections, Tests, 

Analyses, and Acceptance Criteria.” The staff recognizes that the review of ITAAC 

cannot be completed until after the rest of this portion of the application has been 

reviewed against acceptance criteria contained in this SRP section. Furthermore, the 

staff reviews the ITAAC to ensure that all SSCs in this area of review are identified and 

addressed as appropriate in accordance with SRP Section 14.3. 

3. COL Action Items and Certification Requirements and Restrictions. For a DC 

application, the review will also address COL action items, requirements and restrictions 

(e.g., interface requirements and site parameters). 

For a COL application referencing a DC, a COL applicant must address COL action 

items (referred to as COL license information in certain DCs) included in the referenced 
 

7.9-3 Revision 6 - August 2016 

DC. Additionally, a COL applicant must address requirements and restrictions (e.g., 

interface requirements and site parameters) included in the referenced DC. 

Review Interfaces 

Other SRP sections interface with this section as follows: 

1. SRP Section 7.0, “Instrumentation and Controls - Overview of Review Process,” 

describes the coordination of reviews, including the information to be reviewed and the 

scope required for each of the different types of applications that the staff may review. 

Refer to that section for information regarding how the areas of review are affected by 

the type of application under consideration and for a description of coordination between 

the organization responsible for review of instrumentation and control (I&C) systems and 

other review organizations. 

The specific acceptance criteria and review procedures are contained in the referenced SRP 

sections. 

II. ACCEPTANCE CRITERIA 

Requirements 

Acceptance criteria are based on meeting the relevant requirements of the following 

Commission regulations: 

The requirements applicable to DCSs derive from the requirements for the system(s) supported 

by the DCS. The requirements for a specific DCS are the union of those requirements 

applicable to the systems supported by that DCS. A given plant design may contain more than 

one DCS. In this case, the requirements applicable to each DCS may be different. Acceptance 

criteria for the review of DCSs are based on meeting the relevant requirements of the 

regulations listed below. 

Requirements applicable to any DCS are as follows: 

1. Title 10 of the Code of Federal Regulations (10 CFR) 50.54(jj) and 10 CFR 50.55(i). 

 

2. 10 CFR 50.55a(h), “Protection and Safety Systems,” requires compliance with the 

Institute of Electrical and Electronics Engineers (IEEE) Standard (Std) 603-1991, “IEEE 

Standard Criteria for Safety Systems for Nuclear Power Generating Stations,” and the 

correction sheet dated January 30, 1995. For nuclear power plants with construction 

permits issued before January 1, 1971, the applicant or licensee may elect to comply 

instead with the plant-specific licensing basis. For nuclear power plants with 

construction permits issued between January 1, 1971, and May 13, 1999, the 

applicant or licensee may elect to comply instead with the requirements stated in IEEE 

Std 279-1971, “Criteria for Protection Systems for Nuclear Power Generating Stations.” 

The minimum requirements that are applicable to all DCS are IEEE Std 603-1991, 

Clause 5.6.3, “Independence Between Safety Systems and Other Systems,” or IEEE 
 

7.9-4 Revision 6 - August 2016 

Std 279-1971, Clause 4.7.2, “Isolation Devices,” or the plant-specific licensing basis, as 

defined by 10 CFR 50.55a(h), as noted above. 

3. 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities,” 

Appendix A, “General Design Criteria for Nuclear Power Plants,” General Design 

Criterion (GDC) 1, “Quality Standards and Records.” 

4. GDC 24, “Separation of Protection and Control Systems.” 

Additional requirements applicable to all DCSs that support protection system functions reactor 

trip system (RTS) (SRP Section 7.2, “Reactor Trip System”) or engineered safety features 

actuation system (ESFAS) (SRP Section 7.3, “Engineered Safety Features Systems”): 

1. 10 CFR 50.34(f)(2)(v), regarding automatic indication of bypassed and inoperable status 

of safety system equipment. 

2. 10 CFR 50.55a(h)(2), “Protection Systems.” 

3. GDC 2, “Design Basis for Protection against Natural Phenomena.” 

4. GDC 4, “Environmental and Dynamic Effects Design Basis.” 

 

5. GDC 13, “Instrumentation and Control.” 

 

6. GDC 21, “Protection System Reliability and Testability.” 

 

7. GDC 22, “Protection System Independence.” 

 

8. GDC 23, “Protection System Failure Modes.” 

 

9. GDC 29, “Protection against Anticipated Operational Occurrences.” 

 

Additional requirements applicable to all DCSs that support safe shutdown systems (SRP 

Section 7.4, “Safe Shutdown Systems”), information systems important to safety (SRP 

Section 7.5, “Information Systems Important to Safety”), or interlock systems important to safety 

(SRP Section 7.6, “Interlock Systems Important to Safety”): 

1. 10 CFR 50.55a(h)(3), “Safety Systems,” to the extent that the DCS supports the safety 

functions of these systems. 

 

2. GDC 4, “Environmental and Dynamic Effects Design Basis.” 

 

3. GDC 13, “Instrumentation and Control.” 

 

4. GDC 19, “Control Room.” 

Additional requirements applicable to all DCSs that support control system functions (SRP 

Section 7.7, “Control Systems”): 
 

7.9-5 Revision 6 - August 2016 

1. GDC 13, “Instrumentation and Control.” 

2. GDC 19, “Control Room.” 

Additional requirements applicable to all DCSs that support diverse I&C systems functions (SRP 

Section 7.8, “Diverse Instrumentation and Control Systems”): 

1. 10 CFR 50.62, “Requirements for the reduction of risk from anticipated transients without 

scram (ATWS) events for light-water-cooled nuclear power plants.” 

 

2. GDC 13, “Instrumentation and Control.” 

 

3. GDC 19, “Control Room.” 

Additional requirements applicable to any DCS proposed for standard DC or COLs under 

10 CFR Part 52, “Licenses, Certifications, and Approvals for Nuclear Power Plants”: 

1. 10 CFR 52.47(b)(1), which requires that a DC application contain the proposed ITAAC 

that are necessary and sufficient to provide reasonable assurance that, if the 

inspections, tests, and analyses are performed and the acceptance criteria met, a plant 

that incorporates the design certification is built and will operate in accordance with the 

design certification, the provisions of the Atomic Energy Act of 1954 (AEA), and the 

U.S. Nuclear Regulatory Commission’s (NRC's) regulations. 

2. 10 CFR 52.80(a), which requires that a COL application contain the proposed 

inspections, tests, and analyses, including those applicable to emergency planning, that 

the licensee shall perform, and the acceptance criteria that are necessary and sufficient 

to provide reasonable assurance that, if the inspections, tests, and analyses are 

performed and the acceptance criteria met, the facility has been constructed and will 

operate in conformity with the combined license, the provisions of the AEA, and the 

NRC's regulations. 

SRP Acceptance Criteria 

Specific SRP acceptance criteria acceptable to meet the relevant requirements of the NRC’s 

regulations identified above are contained in SRP Section 7.1, “Instrumentation and Controls – 

Introduction,” SRP Table 7-1, and SRP Appendix 7.1-A, Acceptance Criteria and Guidelines for 

Instrumentation and Control Systems Important to Safety,” which list standards, RGs, and 

branch technical positions (BTPs). The SRP is not a substitute for the NRC’s regulations and 

compliance with it is not required. However, an applicant is required to identify differences 

between the design features, analytical techniques, and procedural measures proposed for its 

facility and the SRP acceptance criteria and evaluate how the proposed alternatives to the SRP 

acceptance criteria provide acceptable methods of compliance with the NRC regulations. 

1. SRP Appendix 7.1-B, “Guidance for Evaluation of Conformance to IEEE Std 279,” 

provides guidance for evaluating conformance to the requirements of IEEE 

Std 279-1971. 
 

7.9-6 Revision 6 - August 2016 

2. SRP Appendix 7.1-C, “Guidance for Evaluation of Conformance to IEEE Std 603,” 

provides guidance for evaluating conformance to IEEE Std 603-1991. 

3. SRP Appendix 7.1-D, “Guidance for Evaluation of The Application of IEEE Std 7-4.3.2,” 

provides guidance for evaluating conformance to the acceptance criteria contained in 

RG 1.152, “Criteria for Use of Computers in Safety Systems of Nuclear Power Plants,” 

which endorses IEEE Std 7-4.3.2, “IEEE Standard Criteria for Digital Computers in 

Safety Systems of Nuclear Power Generating Stations.” 

III. REVIEW PROCEDURES 

The reviewer will select material from the procedures described below, as may be appropriate 

for a particular case. Typical reasons for a non-uniform placement of emphasis are the 

introduction of new design features or the use in the design of features previously reviewed and 

found acceptable. 

These review procedures are based on the identified SRP acceptance criteria. For deviations 

from these acceptance criteria, the staff should review the applicant’s evaluation of how the 

proposed alternatives provide an acceptable method of complying with the relevant NRC 

requirements identified in Subsection II. 

SRP Section 7.1 describes the general procedures to be followed in reviewing any I&C 

system. Therefore, review procedures specific to any DCS can be synthesized from SRP 

Appendix 7.1-A. NUREG/CR-6082, “Data Communications,” discusses data communication 

technology and the technical rationale for review issues specific to data communications and 

includes background information to assist the reviewer in identifying critical technical features. 

This part of SRP Section 7.9 highlights specific topics that should be emphasized in the DCS 

review. 

The review should include an evaluation of the DCS against the guidance of IEEE Std 603-1991 

or IEEE Std 279-1971, depending on the applicant’s or licensee’s commitment regarding these 

design criteria, and IEEE Std -7-4.3.2 as endorsed by RG 1.152. Procedures for these reviews 

are detailed in SRP Appendix 7.1-B for IEEE Std 279-1971, SRP Appendix 7.1-C for IEEE 

Std 603-1991, and SRP Appendix 7.1-D for IEEE Std -7-4.3.2. 

Although the primary emphasis is on the equipment comprising the DCS, the reviewer should 

consider the DCS functions at the system level. The DCS design should be compatible with the 

design of the supported systems as described in the process system chapters of the SAR and 

their functions and performance as assumed in the SAR Chapter 15 design bases accident 

analyses. It is not sufficient to evaluate the adequacy of the DCS only on the basis of the 

design’s meeting the specific requirements of IEEE Std 279-1971 or IEEE Std 603-1991. 

The DCS review should address the applicable topics identified in SRP Table 7-1. SRP 

Appendix 7.1-A describes review methods for each topic. Major design considerations that 

should be emphasized in the review of the DCS are identified below: 

• Quality of components and modules - See SRP Appendix 7.1-B, Subsection 4.3, 

or SRP Appendix 7.1-C, Subsection 5.3. 
 

7.9-7 Revision 6 - August 2016 

• DCS software quality - See SRP BTP 7-14, “Guidance on Software Reviews for 

Digital Computer-Based Instrumentation and Control Systems.” 

• Performance - The review should verify that the protocol selected for the DCS 

meets the performance requirements of all supported systems. The real-time 

performance should be reviewed with SRP BTP 7-21, “Guidance on Digital 

Computer Real-Time Performance.” This should include verification that DCS 

safety system timing is deterministic or bounded. Time delays within the DCS 

and measurement inaccuracies introduced by the DCS should be considered 

when reviewing the instrumentation setpoints (refer to RG 1.105, “Setpoints for 

Safety-Related Instrumentation,” and SRP BTP 7-12, “Guidance on Establishing 

and Maintaining Instrument Setpoints”). Data rates, data bandwidths, and data 

precision requirements for normal and off-normal operation, including the impact 

of environmental extremes, should be reviewed. There should be sufficient 

excess capacity margins to accommodate likely future increases in DCS 

demands or software or hardware changes to equipment attached to the DCS. 

The error performance should be specified. Vendor test data and in situ test 

results should be reviewed to verify the performance. Analytical justifications of 

DCS capacity should be reviewed for correctness. The interfaces with other 

DCSs or other parts of the I&C system should be reviewed to verify compatibility. 

• Reliability - The potential hazards to the DCS and from the DCS should be 

reviewed. Unneeded but included DCS functions should be reviewed to ensure 

that they cannot be inadvertently activated and thereby prevent operation of the 

safety functions. The effects of error detection and recovery should be reviewed. 

Error detection should be at least as good as four byte cyclic redundancy check 

(CRC). The effects of DCS equipment malfunction or failure that generates 

erroneous signals, either in content or rate, should be examined. Corrupted 

messages (missing or corrupted packets), missing messages and duplicate 

messages should be detected and repaired. The reviewer should determine that 

the operating history of the DCS in similar applications is known and that it has 

been satisfactory. The reviewer should verify the existence and quality of 

maintenance and operator documentation and ensure that appropriate training 

has been or will be performed. The DCS should be designed to support selftesting and surveillance testing (refer to SRP BTP 7-17, “Guidance on Self-Test 

and Surveillance Test Provisions”). 

• Time coherency of data - Methods to ensure the correct sequence of data 

packets at receiving DCS nodes should be reviewed. 

• Control of access - The review should confirm that the DCS does not present an 

electronic path by which unauthorized personnel can change plant software or 

display erroneous plant status information to the operators. Computers or 

equipment outside the control of the plant staff may be connected to nonsafety 

DCS (e.g., connections to remote data displays off site). In such cases, the 

connections should be through gateways that prevent unauthorized transactions 

originating from off site. Remote access to safety systems should not be 

implemented. 
 

7.9-8 Revision 6 - August 2016 

Additional major design considerations that should be emphasized in the review of DCS safety 

systems are identified below: 

• Single-failure criterion - See SRP Appendix 7.1-B, Subsection 4.2, or SRP 

Appendix 7.1-C, Subsection 5.1. The use of DCSs as single paths for multiple 

signals or data raises particular concerns regarding extensive consequential 

failures as the result of a single failure. This review should confirm that channel 

assignments to individual communication subsystems are appropriate to ensure 

that both redundancy and diversity requirements (refer to SRP BTP 7-19, 

“Guidance for Evaluation of Diversity and Defense-in-Depth in Digital ComputerBased Instrumentation and Control Systems”) within the supported systems are 

met. NUREG/CR-6082 provides additional discussion of independence and 

failure modes. 

• Independence - See SRP Appendix 7.1-B, Subsections 4.6 and 4.7, or SRP 

Appendix 7.1-C, Subsections 5.6 and 6.3, and SRP Appendix 7.1-D, 

Subsection 5.6. Redundant communications networks may lose a degree of their 

independence and therefore their redundancy if interconnected. If the redundant 

communications networks are not interconnected, or if safety and nonsafety 

communications networks are not interconnected, the determination of 

communications independence is self-evident. If, however, there is such an 

interconnection, the determination of independence is significantly more complex 

and will take more effort and time. The review will need to ensure that the 

interconnection is such that each safety system will perform its safety function 

with no input or influence from the interconnected system, and that any failure of 

the interconnected system, failure of communications from that system or faulty 

data transmitted by that system will not prevent or influence that independent 

safety determination. The review should confirm that a physical, electrical, 

logical or software malfunction in one portion cannot adversely affect the safety 

functions of the connected system. 

• System testing and inoperable surveillance - See SRP Appendix 7.1-B, 

Subsections 4.9, 4.10, and 4.13 or SRP Appendix 7.1-C, Subsections 5.7, 6.5, 

and 5.8. Insofar as bypass or deliberate inoperability of a DCS may induce the 

same condition on the system of which it is a part, the review should confirm that 

the bypassed and inoperable indications for DCSs are consistent with those of 

the systems of which they are part. 

• Protocols - The actual protocol functions needed to perform the safety mission 

should be determined. Protocols proposed for use, whether standard or 

proprietary, should be analyzed for hazards and performance deficits posed by 

unneeded functionality and complication. Additional guidance on protocols may 

be found in NUREG/CR-6082. 

• Electromagnetic/radiofrequency interference (EMI/RFI) susceptibility - See SRP 

Appendix 7.1-B, Subsection 4.4, or SRP Appendix 7.1-C, Subsection 5.4. The 

review should confirm that data communication media do not present a fault 

propagation path for environmental effects, such as high-energy electrical faults 

or lightning, from one redundant portion of a system to another or from another 
 

7.9-9 Revision 6 - August 2016 

system to a safety system. (Refer to RG 1.180, “Guidelines for Evaluating 

Electromagnetic and Radio-Frequency Interference in Safety-Related 

Instrumentation and Control Systems,” for implementation and testing practices 

to establish electromagnetic compatibility and to RG 1.204, “Guidelines for 

Lightning Protection of Nuclear Power Plants,” for grounding and surge 

protection methods to provide lightning protection). Fiber optics typically offer 

resistance to such effects but have other attributes that prevent universal 

acceptability. For example, if the fiber-optic medium may be subject to radiation, 

fiber that does not become opaque or brittle under irradiation should be specified, 

or there should be a defined replacement schedule. NUREG/CR-6082, “Data 

Communications,” compares the qualities of optical and conductive media and 

provides guidance regarding environmental and performance criteria. 

• Diversity and Defense-in-depth (D3) analysis - If one or more DCSs are parts of 

systems (e.g., RTS, ESFAS, anticipated transient without scram [ATWS], diverse 

I&C) for which a D3 analysis is required, the analysis should be performed by the 

applicant, and the vulnerabilities to common-cause failure of all similar DCSs 

should be evaluated. Based on the credibility of postulated failures, potential 

consequences, availability of diverse preventive or mitigatory responses, and the 

NRC’s diversity requirements (see the Staff Requirements Memorandum (SRM) 

on SECY-93-087, “Policy, Technical, and Licensing Issues Pertaining to 

Evolutionary and Advanced Light-Water Reactor (ALWR) Designs”), the reviewer 

should determine that the design, including DCSs, has sufficient D3. See SRP 

BTP 7-19 for guidance on reviewing D3 analyses. 

• DCSs exposed to seismic hazard - The reviewer should determine whether the 

subject DCS equipment is located in seismic Category I structures. In certain 

designs, some connected data communication or multiplexer equipment may be 

located in non-seismic Category I structures. For these cases, the reviewer must 

ensure that simultaneous seismic destruction or perturbation of the exposed 

equipment does not simultaneously render redundant DCSs ineffective. 

For review of a DC application, the reviewer should follow the above procedures to 

verify that the design, including requirements and restrictions (e.g., interface 

requirements and site parameters), set forth in the final safety analysis report 

(FSAR) meets the acceptance criteria. DCs have referred to the FSAR as the 

design control document. The reviewer should also consider the appropriateness 

of identified COL action items. The reviewer may identify additional COL action 

items; however, to ensure these COL action items are addressed during a COL 

application, they should be added to the DC FSAR. 

 

For review of a COL application, the scope of the review is dependent on 

whether the COL applicant references a DC, an early site permit or other NRC 

approvals (e.g., manufacturing license, site suitability report or topical report). 

For review of both DC and COL applications, SRP Section 14.3 should be 

followed for the review of ITAAC. The review of ITAAC cannot be completed 

until after the completion of this section. 
 

7.9-10 Revision 6 - August 2016 

IV. EVALUATION FINDINGS 

The reviewer verifies that the applicant has provided sufficient information and that the review 

and calculations (if applicable) support conclusions of the following type to be included in the 

staff's safety evaluation report. The reviewer also states the bases for those conclusions. 

1. Evaluation findings applicable to any DCS: 

The NRC staff conducted a review of these systems for conformance to the guidelines in the 

RGs and industry codes and standards applicable to these systems. The staff concluded that 

the applicant or licensee adequately identified the guidelines applicable to these systems. 

Based on the review of the system design for conformance to the guidelines, the staff finds that 

there is reasonable assurance that the systems fully conform to the guidelines applicable to 

these systems. Therefore, the staff finds that the requirements of GDC 1 and 10 CFR 50.54(jj) 

and 10 CFR 50.55(i) have been met. 

Additional evaluation findings applicable to all DCSs that support safety functions: 

The NRC staff concludes that the design of the DCS meets the relevant requirements of 

10 CFR 50.55a(h). 

The review included the identification of those systems and components for the DCS that are 

designed to survive the effects of earthquakes, other natural phenomena, abnormal 

environments, and missiles. Based on the review, the staff concludes that the applicant or 

licensee has identified those systems and components consistent with the design bases for 

those systems. Sections 3.10 and 3.11 of the SER address the qualification programs to 

demonstrate the capability of these systems and components to survive these events. 

Therefore, the staff finds that the identification of these systems and components satisfies the 

requirements of General Design Criteria 2 and 4. 

Additional evaluation findings applicable to all DCSs that support protection system functions 

(RTS, SRP Section 7.2, “Reactor Trip System,” or ESFAS, SRP Section 7.3, “Engineered 

Safety Features Systems,”): 

Based on the review of system functions, the staff concludes that the DCS conforms to the 

design basis requirements of (IEEE Std 603-1991 or IEEE Std 279-1971) and 10 CFR 50.34(f). 

Setpoint analyses account for measurement inaccuracies attributable to the DCS in accordance 

with the guidance of RG 1.105. The staff concludes that the DCS adequately supports RTS and 

ESFAS functions as necessary to sense accident conditions and anticipated operational 

occurrences in order to initiate protective actions consistent with the accident analysis 

presented in Chapter 15 of the SAR and evaluated in the SER. Therefore, the staff finds that 

the DCS appropriately supports RTS and ESFAS compliance with the requirements of GDC 20. 

The DCS conforms to the guidelines for periodic testing in RG 1.22, “Periodic Testing of 

Protection System Actuation Functions,” and RG 1.118, “Periodic Testing of Electric Power and 

Protection Systems.” The bypassed and inoperable status indication conforms to the guidelines 

of RG 1.47, “Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety 

Systems.” The DCS conforms to the guidelines on the application for the single-failure criterion 

in IEEE Std 379, “IEEE Standard Application of the Single-Failure Criterion to Nuclear Power 
 

7.9-11 Revision 6 - August 2016 

Generating Station Safety Systems,” as supplemented by RG 1.53, “Application of the SingleFailure Criterion to Nuclear Power Plant Protection Systems.” Based on the review, the 

staff concludes that the DCS satisfies the requirement of (IEEE Std 603-1991 or IEEE 

Std 279-1971) with regard to the system reliability and testability. Therefore, the staff finds that 

the DCS satisfies these requirements of GDC 21. 

Based on the review of software development plans and the inspections of the computer 

development process and design outputs, the staff concludes that the computer systems 

conform to the guidance of RG 1.152. Therefore, the special characteristics of computer 

systems have been adequately addressed, and the staff finds that the DCS satisfies these 

requirements of GDC 21. 

The DCS functions were included in the staff’s review of diversity and defense-in-depth analysis 

for RTS and ESFAS. Based on this review, the staff concludes that the protection systems, 

including the DCS functions, comply with the criteria for defense against common-cause failure 

in digital I&C systems. Therefore, the staff finds that adequate diversity and defense against 

common-cause failure has been provided to satisfy the diversity guidance of GDC 22 and the 

SRM on SECY-93-087, Item II.Q. 

The staff has reviewed EMI/RFI susceptibility and seismically exposed portions of the DCS. 

Based on this review and the finding that the requirements of GDC 2 are satisfied, the staff 

concludes that the DCS satisfies the requirement for independence from the effects of natural 

phenomena. The DCS conforms to the guidelines in RG 1.75, “Criteria for Digital Computers in 

Safety Systems of Nuclear Power Plants,” for protection system independence. Based on the 

review of system independence and separation, the staff concludes that the DCS satisfies the 

requirement of (IEEE Std 279-1971 or IEEE Std 603-1991) with regard to systems 

independence. Therefore, the staff finds that the DCS satisfies the requirements of GDC 22. 

DCS failure modes were accounted for in the failure modes and effects analysis for the RTS 

and ESFAS. Based on the staff’s review of these analyses, the staff concludes that the 

protection systems, including the DCS, are designed to fail into a safe mode if a condition such 

as disconnection of the system, loss of energy, or postulated adverse environment is 

experienced. Therefore, the staff finds that the DCS satisfies the requirements of GDC 23. 

Based on the review of the interfaces between the DCS and plant operating control systems, 

the staff concludes that the system satisfies the requirements of (IEEE Std 279-1971 or IEEE 

Std 603-1991) with regard to control and protection system interactions. Therefore, the staff 

finds that the DCS satisfies the requirements of GDC 24. 

Based on the review of all the above, the staff concludes that the DCS satisfies the 

requirements of GDC 29. 

The staff’s conclusions noted above are based on the requirements of (IEEE Std 279-1971 or 

IEEE Std 603-1991) with respect to the design of the DCS. Therefore, the staff finds that the 

DCS satisfies the requirement of 10 CFR 50.55a(h) with regard to (IEEE Std 603-1991 or IEEE 

Std 279-1971). 

Additional evaluation findings applicable to all DCSs that support the following functions: 

safe shutdown systems (SRP Section 7.4), information systems important to safety (SRP 
 

7.9-12 Revision 6 - August 2016 

Section 7.5, “Information Systems Important to Safety”), or interlock systems important to safety 

(SRP Section 7.6, “Interlock Systems Important to Safety”): 

Based on the staff’s review, the staff concludes that DCSs used in the [safe shutdown system, 

information systems important to safety, or interlock systems important to safety], taken in 

context with other provisions of the design, transmit the variables and commands necessary to 

maintain the fission process, the integrity of the reactor core, the reactor coolant pressure 

boundary, and the containment and its associated systems within prescribed operating ranges 

during plant shutdown. Therefore, the staff finds that the DCSs employed by the (safe 

shutdown system, information systems important to safety, or interlock systems important to 

safety) satisfy the requirements of GDC 13 and the Staff Requirements Memorandum on 

SECY-93-087, Item II.T. 

Data communications systems have been provided to support instruments and controls within 

the control room to allow actions to be taken to maintain the nuclear power unit in a safe 

condition during shutdown, including shutdown following an accident. Equipment at appropriate 

locations outside the control room is also supported by the DCS design to achieve: (1) prompt, 

hot shutdown of the reactor, and (2) subsequent, cold shutdown of the reactor. Therefore, the 

staff concludes that the DCSs employed by the [safe shutdown system, information systems 

important to safety, or interlock systems important to safety] satisfy the requirements of 

GDC 19. 

Additional evaluation findings applicable to all DCSs that support control system functions (SRP 

Section 7.7, “Control Systems”): 

Based on the staff’s review, the staff concludes that DCSs used in the reactor control system, 

taken in context with other provisions of the design, transmit the variables and commands 

necessary to maintain the fission process, the integrity of the reactor core, the reactor coolant 

pressure boundary, and the containment and its associated systems within prescribed operating 

ranges during plant shutdown. Therefore, the staff finds that the DCSs employed by the reactor 

control system satisfy the requirements of GDC 13. 

DCSs have been provided to support instruments and controls within the control room to allow 

actions to be taken to maintain the nuclear power unit in a safe condition during shutdown, 

including shutdown following an accident. Therefore, the staff concludes that the DCSs 

employed by the reactor control system satisfy the requirements of GDC 19. 

Additional evaluation findings applicable to all DCSs that support diverse I&C systems functions 

(SRP Section 7.8, “Diverse Instrumentation and Control Systems”): 

Based on the staff’s review of DCS performance and diversity between the DCSs that support 

ATWS mitigation functions and DCSs that support RTS functions, the staff finds that the DCS 

meets the requirements of 10 CFR 50.62. 

Based on the staff’s review, the staff concludes that DCSs used in the diverse I&C system, 

taken in context with other provisions of the design, transmit the variables and commands 

necessary to maintain the fission process, the integrity of the reactor core, the reactor coolant 

pressure boundary, and the containment and its associated systems within prescribed operating 
 

7.9-13 Revision 6 - August 2016 

ranges during plant shutdown. Therefore, the staff finds that the DCSs employed by the diverse 

I&C system satisfy the requirements of GDC 13. 

DCSs have been provided to support instruments and controls within the control room to allow 

actions to be taken to maintain the nuclear power unit in a safe condition during shutdown, 

including shutdown following an accident. Equipment at appropriate locations outside the 

control room is also supported by the DCS design to achieve: (1) prompt, hot shutdown of the 

reactor, and (2) subsequent, cold shutdown of the reactor. Therefore, the staff concludes that 

the DCSs employed by the diverse I&C system satisfy the requirements of GDC 19. 

2. Note: the following conclusion is applicable to all applications. 

The conclusions noted above for the DCS are applicable to all portions of the systems except 

for the following, for which acceptance is based on prior NRC review and approval as noted (list 

applicable system or topics and identify references). 

3. For DC and COL reviews, the findings will also summarize the staff’s evaluation of 

requirements and restrictions (e.g., interface requirements and site parameters) and 

COL action items relevant to this SRP section. 

4. In addition, to the extent that the review is not discussed in other SER sections, the 

findings will summarize the staff's evaluation of the ITAAC, including design acceptance 

criteria, as applicable. 

V. IMPLEMENTATION 

The staff will use this SRP section in performing safety evaluations of DC applications and 

license applications submitted by applicants pursuant to 10 CFR Part 50 or 10 CFR Part 52. 

Except when the applicant proposes an acceptable alternative method for complying with 

specified portions of the Commission’s regulations, the staff will use the method described 

herein to evaluate conformance with Commission regulations. 

The provisions of this SRP section apply to reviews of applications docketed six months or more 

after the date of issuance of this SRP section, unless superseded by a later revision. 

VI. REFERENCES 

1. Institute of Electrical and Electronics Engineers, EEE Std 279-1971, “Criteria for 

Protection Systems for Nuclear Power Generating Stations,” Piscataway, NJ. 

2. Institute of Electrical and Electronics Engineers, IEEE Std 379, “IEEE Standard 

Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety 

Systems,” Piscataway, NJ. 

3. Institute of Electrical and Electronics Engineers, IEEE Std 603-1991, “IEEE Standard 

Criteria for Safety Systems for Nuclear Power Generating Stations,” Piscataway, NJ. 
 

7.9-14 Revision 6 - August 2016 

4. Institute of Electrical and Electronics Engineers, IEEE Std -7-4.3.2, “IEEE Standard 

Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations,” 

Piscataway, NJ. 

5. U.S. Nuclear Regulatory Commission, NUREG/CR-6082, “Data Communications,” 

August 1993. 

6. U.S. Nuclear Regulatory Commission, “Periodic Testing of Protection System 

Actuation Functions,” Regulatory Guide 1.22. 

7. U.S. Nuclear Regulatory Commission, “Bypassed and Inoperable Status Indication for 

Nuclear Power Plant Safety Systems,” Regulatory Guide 1.47. 

8. U.S. Nuclear Regulatory Commission, “Application of the Single-Failure Criterion to 

Nuclear Power Plant Protection Systems,” Regulatory Guide 1.53. 

9. U.S. Nuclear Regulatory Commission, “Criteria for Independence of Electrical Safety 

Systems,” Regulatory Guide 1.75. 

10. U.S. Nuclear Regulatory Commission, “Setpoints for Safety-Related Instrumentation,” 

Regulatory Guide 1.105. 

11. U.S. Nuclear Regulatory Commission, “Periodic Testing of Electric Power and Protection 

Systems,” Regulatory Guide 1.118. 

12. U.S. Nuclear Regulatory Commission, “Criteria for Use of Computers in Safety Systems 

of Nuclear Power Plants,” Regulatory Guide 1.152. 

 

13. U.S. Nuclear Regulatory Commission, “Guidelines for Evaluating Electromagnetic and 

Radio-Frequency Interference in Safety-Related Instrumentation and Control Systems,” 

Regulatory Guide 1.180. 

14. U.S. Nuclear Regulatory Commission, “Guidelines for Lightning Protection of Nuclear 

Power Plants,” Regulatory Guide 1.204. 

15. U.S. Nuclear Regulatory Commission, SECY-93-087, “Policy, Technical, and Licensing 

Issues Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Designs,” 

April 2, 1993. 

16. U.S. Nuclear Regulatory Commission, Staff Requirements Memorandum on 

SECY-93-087, “Policy, Technical, and Licensing Issues Pertaining to Evolutionary and 

Advanced Light-Water Reactor (ALWR) Designs,” July 15, 1993. 

 
 

7.9-15 Revision 6 - August 2016 

PAPERWORK REDUCTION ACT STATEMENT

The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Part 50 and 

10 CFR Part 52, and were approved by the Office of Management and Budget, approval number 3150-0011 and 3150-0151. 

PUBLIC PROTECTION NOTIFICATION

The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information 

collection requirement unless the requesting document displays a currently valid OMB control number. 
 

7.9-16 Revision 6 - August 2016 

SRP Section 7.9 

Description of Changes 

SRP Section 7.9 “Data Communication Systems” 

This SRP Section affirms the technical accuracy and adequacy of the guidance 

previously provided in SRP 7.9, Revision 5, dated March 2007. See ADAMS Accession 

No. ML070650036. 

The main purpose of this update is to incorporate the revised software Regulatory Guides and 

the associated endorsed standards. For organizational purposes, the revision number of each 

Regulatory Guide and year of each endorsed standard is now listed in one place, Table 7-1. As 

a result, revisions of Regulatory Guides and years of endorsed standards were removed from 

this section, if applicable. For standards that are incorporated by reference into regulation 

(IEEE Std 279-1971 and IEEE Std 603-1991) and standards that have not been endorsed by 

the agency, the associated revision number or year is still listed in the discussion. 

Existing language under Section II, “ACCEPTANCE CRITERIA,” ”Requirements,” for plants not 

listed in 10 CFR 50.34(f), “Additional TMI-Related Requirements” was deleted. 

Part of 10 CFR was reorganized due to a rulemaking in the fall of 2014. Quality requirement 

discussions in the former 10 CFR 50.55a(a)(1) were moved to 10 CFR 50.54(jj) and 

10 CFR 50.55(i). The incorporation by reference language in the former 10 CFR 50.55a(h)(1) 

was moved to 10 CFR 50.55a(a)(2). There were no changes either to 10 CFR 50.55a(h)(2) or 

10 CFR 50.55a(h)(3). 

Additional changes were editorial.