This regulatory guide is being issued in draft form to involve the public in the early stages of the development of a regulatory 

position in this area. It has not received final staff review or approval and does not represent an official NRC final staff position. 

Public comments are being solicited on this draft guide (including any implementation schedule) and its associated regulatory 

analysis or value/impact statement. Comments should be accompanied by appropriate supporting data. Written comments may 

be submitted to the Rulemaking, Directives, and Editing Branch, Office of Administration, U.S. Nuclear Regulatory 

Commission, Washington, DC 20555-0001; e-mailed to nrcrep.resource@nrc.gov; submitted through the NRC=s interactive 

rulemaking Web page at http://www.nrc.gov; faxed to (301) 415-5144; or hand-delivered to Rulemaking, Directives, and Editing 

Branch, Office of Administration, US NRC, 11555 Rockville Pike, Rockville, Maryland 20852, between 7:30 a.m. and 4:15 p.m. 

on Federal workdays. Copies of comments received may be examined at the NRC’s Public Document Room, 11555 Rockville 

Pike, Rockville, MD. Comments will be most helpful if received by December 22, 2008. 

Electronic copies of this draft regulatory guide are available through the NRC’s interactive rulemaking Web page (see above); the 

NRC’s public Web site under Draft Regulatory Guides in the Regulatory Guides document collection of the NRC’s Electronic 

Reading Room at http://www.nrc.gov/reading-rm/doc-collections/; and the NRC’s Agencywide Documents Access and 

Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML082140114. 

U.S. NUCLEAR REGULATORY COMMISSION October 2008

OFFICE OF NUCLEAR REGULATORY RESEARCH Division 1

DRAFT REGULATORY GUIDE

Contact: K. Nguyen 

(301) 415-0701

DRAFT REGULATORY GUIDE DG-1205

(Proposed Revision 1 of Regulatory Guide 1.47, Rev. 0, dated May 1973) 

BYPASSED AND INOPERABLE STATUS INDICATION FOR 

NUCLEAR POWER PLANT SAFETY SYSTEMS 

A. INTRODUCTION 

This guide describes a method that the staff of the U.S. Nuclear Regulatory Commission (NRC) 

considers acceptable for use in complying with the NRC’s regulations with respect to bypassed and 

inoperable status indication for nuclear power plant safety systems. 

The regulatory framework that the NRC has established for nuclear power plants consists of a 

number of regulations and supporting guidelines applicable to bypassed and inoperable status indication, 

including, but not limited to, General Design Criterion (GDC) 1, “Quality Standards and Records,” 

GDC 13, “Instrumentation and Control,” GDC 19, “Control Room,” GDC 21, “Protection System 

Reliability and Testability,” GDC 22, “Protection System Independence,” and GDC 24, “Separation of 

Protection and Control Systems,” as set forth in Appendix A, “General Design Criteria for Nuclear Power 

Plants,” to Title 10, Part 50, “Domestic Licensing of Production and Utilization Facilities,” of the Code of 

Federal Regulations (10 CFR Part 50) (Ref. 1). GDC 1 requires that structures, systems, and components 

important to safety be designed and installed to quality standards commensurate with the importance-tosafety of the functions to be performed. GDC 13 requires that appropriate controls be provided to maintain 

variables and systems that can affect the fission process, the integrity of the reactor core, the reactor 

coolant pressure boundary, and the containment and its associated systems within prescribed operating 

ranges. GDC 19 requires that a control room be provided from which actions can be taken to operate the 

nuclear power unit safely under normal operating conditions. GDC 21 requires that the protection system 
DG-1205, Page 2 

be designed for high functional reliability and inservice testability. GDC 22 requires that the protection 

system be designed to ensure that the effects of normal operating, maintenance, and testing on redundant 

channels do not result in the loss of the protection function or be demonstrated to be acceptable on some 

other defined basis. GDC 24 requires that interconnection of the protection and control systems be limited 

to ensure that safety is not significantly impaired. 

In 10 CFR 50.55a(h), the NRC requires compliance with Institute of Electrical and Electronics 

Engineers (IEEE) Standard (Std) 603-1991, “IEEE Standard Criteria for Safety Systems for Nuclear Power 

Generating Stations,” and the correction sheet dated January 30, 1995 (Ref. 2). For nuclear power plants 

with construction permits issued before January 1, 1971, the applicant/licensee may elect to comply instead 

with its plant-specific licensing basis. For nuclear power plants with construction permits issued between 

January 1, 1971, and May 13, 1999, the applicant/licensee may elect to comply instead with the 

requirements in IEEE Std 279-1971, “Criteria for Protection Systems for Nuclear Power Generating 

Stations” (Ref. 3). Both IEEE Std 603-1991 and IEEE Std 279-1971 list requirements with regard to 

bypassed and inoperable status indication for safety systems. In addition, Criterion XIV, “Inspection, Test, 

and Operating Status,” as given in Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and 

Fuel Reprocessing Plants,” to 10 CFR Part 50, requires that measures be established for indicating the 

operating status of structures, systems, and components of the nuclear power plant, such as by tagging 

valves and switches, to prevent inadvertent operation. The provisions of 10 CFR 50.34(f)(2)(v), 

“Additional TMI-Related Requirements,” also require automatic indication of bypassed and operable status 

of safety systems. 

IEEE Std 603-1991 uses the term “safety systems” rather than “protection systems” to define its 

scope. The standard offers the following definition of a “safety system”: 

“...a system that is relied upon to remain functional during and following design basis 

events to ensure: (i) the integrity of the reactor coolant pressure boundary, (ii) the 

capability to shut down the reactor and maintain it in a safe shutdown condition, or (iii) 

the capability to prevent or mitigate the consequences of accidents that could result in 

potential offsite exposures comparable to the 10 CFR Part 100 guidelines.” 

In addition, IEEE Std 603-1991 defines a “safety function” as “one of the processes or conditions 

(for example, emergency negative reactivity insertion, post-accident heat removal, emergency core cooling, 

post-accident radioactivity removal, and containment isolation) essential to maintain plant parameters 

within acceptable limits established for a design basis event.” The standard also defines a “division” as 

“the designation applied to a given system or set of components that enable the establishment and 

maintenance of physical, electrical, and functional independence from other redundant sets of 

components.” 

IEEE Std 279-1971 states that a “protection system” encompasses all electric and mechanical 

devices and circuitry (from sensors to actuation device input terminals) involved in generating those 

signals associated with the protective function. These signals include those that actuate a reactor trip and 

that, in the event of a serious reactor accident, actuate engineered safety features, such as containment 

isolation, core spray, safety injection, pressure reduction, and air cleaning. This standard defines 

“protective function” as “the sensing of one or more variables associated with a particular generating 

station condition, signal processing, and the initiation and completion of the protective action at values of 

the variables established in the design bases.” 

Clause 4.13 of IEEE Std 279-1971 requires in part that, if the protective action of some part of the 

protection system has been bypassed or deliberately rendered inoperable for any purpose, this fact shall be 
DG-1205, Page 3 

continuously indicated in the control room. Clause 5.8.3 of IEEE Std 603-1991 requires that, if the 

protective actions of some part of a safety system have been bypassed or deliberately rendered inoperative 

for any purpose other than an operating bypass, continued indication of this fact for each affected safety 

group shall be provided in the control room. Clause 5.8.3 also provides guidance that (1) the bypass 

display instrumentation need not be part of the safety systems, (2) this indication shall be automatically 

actuated if the bypass or inoperative condition is (a) expected to occur more frequently than once a year 

and (b) expected to occur when the affected system is required to be operable, and (3) the capability shall 

exist in the control room to manually activate this display indication. 

The NRC issues regulatory guides to describe to the public methods that the staff considers 

acceptable for use in implementing specific parts of the agency’s regulations, to explain techniques that the 

staff uses in evaluating specific problems or postulated accidents, and to provide guidance to applicants. 

Regulatory guides are not substitutes for regulations and compliance with them is not required. 

This regulatory guide contains information collection requirements covered by 10 CFR Part 50 that the 

Office of Management and Budget (OMB) approved under OMB control number 3150-0011. The NRC 

may neither conduct nor sponsor, and a person is not required to respond to, an information collection 

request or requirement unless the requesting document displays a currently valid OMB control number. 

B. DISCUSSION

The Working Group Subcommittee 6.3 of the IEEE Nuclear Power Engineering Society developed 

IEEE Std 603-1991, and the IEEE Standards Board approved it on June 27, 1991. The standard provides 

guidance on the minimum functional design criteria for the electrical power, instrumentation, and control 

portions of nuclear power plant safety systems. This standard evolved from IEEE Std 279-1971 and, 

through interfaces with other referenced standards, reflects advances in digital technology. Nuclear power 

plants are currently replacing existing instrumentation and control (I&C) equipment with digital computerbased I&C systems or advanced analog systems. However, compared to existing I&C systems, these 

technologies may pose a number of new vulnerabilities for the nuclear power plant. This regulatory guide 

provides an acceptable method for establishing the design criteria for existing I&C systems and for 

establishing the design criteria for digital and advanced analog systems for bypassed and inoperable status 

indication. 

Clause 5.8 of IEEE Std 603-1991 presents the requirements for safety system information displays. 

 Clause 5.8.2 of IEEE Std 603-1991 requires that “display instrumentation shall provide accurate, 

complete, and timely information pertinent to safety system status.” Clause 5.8.3 of the standard provides 

the specific guidance on the indication of bypasses, which may be provided by a nonsafety system. The 

clause states, “If the protective actions of some part of a safety system have been bypassed or deliberately 

rendered inoperative for any purpose other than an operating bypass, continued indication of this fact for 

each affected safety group shall be provided in the control room.” IEEE Std 603-1991 defines a safety 

group as “a given set of interconnected components, modules, and equipment that can accomplish a safety 

function.” Clause 5.8.3.2 of IEEE Std 603-1991 specifically requires that the indication of bypasses “shall 

be automatically actuated if the bypass or inoperative condition (a) is expected to occur more frequently 

than once a year and (b) is expected to occur when the affected system is required to be operable.” 

Clause 5.8.4 of the standard requires that the location of information displays be “accessible to the 

operator.” 

Current designs of safety systems and protective actions are such that certain safety functions of a 

nuclear power plant may be bypassed or made inoperable during the performance of periodic tests or 

maintenance. Regulatory Guide 1.118, “Periodic Testing of Electric Power and Protection Systems” 

(Ref. 4), endorses IEEE Std 338-1987, “Criteria for the Periodic Testing of Nuclear Power Generating 
DG-1205, Page 4 

Station Safety Systems” (Ref. 5), as an acceptable method for the periodic testing of electric power and 

protection systems. Generally, the plant’s administrative procedures require that the operator give 

permission before the initiation of any activity that would or could affect a safety system. The decision to 

grant such permission should be based on knowledge of the operating status of the safety systems, the 

extent to which the activity will affect those systems, and whether that effect is permissible within the 

provisions of the license. Experience at operating plants, however, suggests that when the measures used 

to indicate inoperable status consist solely of administrative procedures, the operator is not always fully 

aware of the ramifications of each bypassed or inoperable component. Automatic indication display of any 

bypass or inoperability in a safety system supplements administrative procedures and aids the operator. 

Clause 5.16 of IEEE Std 338-1987 states that “indication should be provided in the control room if a 

portion of the safety system is inoperable or bypassed. Systems that are frequently placed in bypass or 

inoperative condition for the purposes of testing should have automatic indication.” 

Digital computer-based I&C systems make extensive use of self-testing. Digital computer-based 

I&C systems are more prone to different kinds of failures than traditional analog systems. Self-testing and 

watchdog timers should reduce the time to detect and identify failures. Computer self-testing is most 

effective at detecting random hardware failures. A bypass and inoperable status indication system should 

include a capability of assuring its operable status during normal plant operation to the extent that the 

indicating and annunciating function can be verified. However, the bypass and inoperable status indication 

system should be designed to avoid erroneous bypass indications. If the use of self-testing in digital 

computer-based I&C systems causes a protective action of some part of a safety system to be bypassed or 

deliberately rendered inoperative, then this fact should be automatically indicated in the control room. 

With regards to surveillance testing, if the protective action of some part of a protection or safety 

system is bypassed or deliberately rendered inoperative for testing, that fact should be continuously 

indicated in the control room. Operations staff should also be able to confirm that a bypassed safety 

system has been properly returned to service. In a given plant design, it may be best to group the bypass 

indicators according to the safety systems’ dependence on a common electric power supply; for example, 

the bypass indicators for all engineered safety feature systems that are assigned to one standby power 

source could be located near the bypass indicator for that source. Other groupings could be acceptable. 

The arrangement of bypass indicators should enable the operator to determine the status of each safety 

system and whether continued reactor operation is permissible. When a protective function of a shared 

system can be bypassed, the control room of each affected unit should receive an indication of that bypass 

condition. In any design, it may be necessary to include an audible, as well as visual, alarm to attract the 

operator’s attention when the status of the safety system changes. 

Clause 5.8.3.3 of IEEE Std 603-1991 requires that, for indication of bypasses, “the capability shall 

exist in the control room to manually activate this display indication.” The effectiveness of an automatic 

indicating system is enhanced by including a manual capability to activate the indicators. Manual 

capability is useful in displaying those inoperable or bypassed conditions, whether deliberately induced or 

not, that are not automatically indicated. 

Bypass indication should aid the operator in recognizing the effects on plant safety of seemingly 

unrelated or insignificant events. Therefore, the indication of bypass conditions should be at the safety 

group level, whether or not it is also at the channel, component, or module level. Clause 5.8.3.1 of IEEE 

Std 603-1991 states that “this display instrumentation need not be part of the safety systems.” The 

indication system should be designed and installed in a manner that precludes the possibility of adverse 

effects on plant safety systems. The bypass and inoperable status indications may be provided via operator 

workstations or hardwired indicators and analog signal processing circuits. 
DG-1205, Page 5 

However, Clause 5.6.3.1(1) of IEEE Std 603-1991 specifies that “equipment that is used for both 

safety and nonsafety functions shall be classified as part of the safety systems.” Therefore, if the bypassed 

and inoperable status indication is used for both safety and nonsafety functions, then the indication system 

will require classification as part of safety systems. Unless the indication system is designed in 

conformance with criteria established for safety systems, it should not be used to perform functions that are 

essential to safety, and administrative procedures should not require immediate operator action based 

solely on bypass indications. Therefore, if the design or administrative procedures establish the bypassed 

and inoperable status indication as an element of the safety system, then the following paragraphs 

addressing single failure, independence, and qualification would apply. 

If bypass and inoperable status indication is deemed to be part of a safety system, then the singlefailure criterion of IEEE Std 603-1991, Clause 5.1, would apply to the indication system. Regulatory 

Guide 1.53, “Application of the Single-Failure Criterion to Safety Systems” (Ref. 6), endorses IEEE 

Std 379-2000, “IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating 

Station Safety Systems” (Ref. 7), as an acceptable method to meet the regulations concerning the 

application of the single-failure criterion to the electrical power, instrumentation, and control portions of 

nuclear power plant safety systems. Digital system common-cause failures are not treated as a single 

failure with respect to the single-failure criterion. IEEE Std 7-4.3.2-2003, “IEEE Standard Criteria for 

Digital Computers in Safety Systems of Nuclear Power Generating Stations” (Ref. 8), provides guidance 

on using diversity to address common-cause failures in computer-based safety systems. In addition, 

NUREG/CR-6303, “Method for Performing Diversity and Defense-in-Depth Analyses of Reactor 

Protection Systems” (Ref. 9), describes a method for analyzing computer-based nuclear reactor protection 

systems to identify design vulnerabilities to common-mode failure. 

In addition to meeting the single-failure criterion, if bypass and inoperable status indication is 

deemed to be part of a safety system, then maintaining independence between redundant portions of the 

safety system is essential to the effective utilization of the single-failure criterion. Regulatory Guide 1.75, 

“Independence of Electrical Safety Systems” (Ref. 10), provides guidance through the application of IEEE 

Std 384-1992, “IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits” (Ref. 11), 

to meet the regulations with respect to the physical independence requirements of the circuits and electric 

equipment that comprise or are associated with safety systems. Regulatory Guide 1.152, “Criteria for 

Digital Computers in Safety Systems of Nuclear Power Plants” (Ref. 12), endorses IEEE Std 7-4.3.2-2003 

as an acceptable method for addressing high functional reliability and design requirements for computers 

used in safety systems of nuclear power plants, including safety-related digital communications, 

independence, and integrity. 

If bypass and inoperable status indication is deemed to be part of a safety system, the equipment 

qualification criterion of IEEE Std 603-1991, Clause 5.4, would apply to the indication system. Clause 5.4 

requires that safety system equipment be environmentally qualified. Regulatory Guide 1.209, “Guidelines 

for Environmental Qualification of Safety-Related Computer-Based Instrumentation and Controls Systems 

in Nuclear Power Plants” (Ref. 13), endorses IEEE Std 323-2003, “IEEE Standard for Qualifying Class 1E 

Equipment for Nuclear Power Generating Stations” (Ref. 14), as acceptable guidance for environmental 

qualification of safety-related computer-based I&C systems for service in mild environments. Regulatory 

Guide 1.89, “Environmental Qualification of Certain Electronic Equipment Important to Safety for 

Nuclear Power Plants” (Ref. 15), provides guidance for environmental qualification of equipment intended 

for use in harsh environments. Regulatory Guide 1.180, “Guidelines for Evaluating Electromagnetic and 

Radio-Frequency Interference in Safety-Related Instrumentation and Control Systems” (Ref. 16), presents 

guidance for complying with the NRC’s regulations on design, installation, and testing practices for 

addressing the effects of electromagnetic and radiofrequency interference (EMI/RFI) and power surges on 
DG-1205, Page 6 

safety-related I&C systems. Clause 5.4 of IEEE Std 7-4.3.2-2003 provides requirements for equipment 

qualification of digital computers used in safety systems. 

REGULATORY POSITION 

Conformance with the requirements of IEEE Std 603-1991 provides a method that the NRC staff 

considers acceptable for satisfying the agency’s regulatory requirements with respect to bypassed and 

inoperable status indication, subject to the following: 

1. Administrative procedures should be supplemented by an indication system that automatically 

indicates for each affected safety system or subsystem the bypass or deliberately induced 

inoperability of a safety function and the systems actuated or controlled by the safety function. 

Provisions should also be made to allow operations staff to confirm that a bypassed safety function 

has been properly returned to service. 

2. The indicating system of Position 1 above should also be activated automatically by the bypassing 

or deliberately induced inoperability of any auxiliary or supporting system that effectively 

bypasses or renders inoperable a safety function and the systems actuated or controlled by the 

safety function. 

3. Annunciating functions for system failure and automatic actions based on self-test or selfdiagnostic capabilities of digital computer-based I&C safety systems should be consistent with 

Positions 1 and 2 above. 

4. The bypass and inoperable status indication system should include a capability for assuring its 

operable status during normal plant operation to the extent that the indicating and annunciating 

functions can be verified. 

5. Bypass and inoperable status indicators should be arranged such that the operator can determine 

whether continued reactor operation is permissible. The control room of all affected units should 

receive indication of the bypass of shared system safety functions. 

6. Bypass and inoperable status indicators should be designed and installed in a manner that 

precludes the possibility of adverse effects on plant safety systems. The indicator system should 

not be used to perform functions that are essential to safety, unless it is designed in conformance 

with criteria established for safety systems. 

IMPLEMENTATION 

The purpose of this section is to provide information to applicants and licensees regarding the 

NRC’s plans for using this draft regulatory guide. The NRC does not intend or approve any imposition or 

backfit in connection with its issuance. 

The NRC has issued this draft guide to encourage public participation in its development. The 

NRC will consider all public comments received in development of the final guidance document. In some 

cases, applicants or licensees may propose an alternative or use a previously established acceptable 

alternative method for complying with specified portions of the NRC’s regulations. Otherwise, the 

methods described in this guide will be used in evaluating compliance with the applicable regulations for 

license applications, license amendment applications, and amendment requests. 
DG-1205, Page 7 

REGULATORY ANALYSIS 

1. Statement of the Problem 

The current version of Regulatory Guide 1.47 (Revision 0), dated May 1973, is based solely on 

IEEE Std 279-1971. Section 50.55a, “Codes and Standards,” of 10 CFR Part 50 requires that applications 

filed on or after May 13, 1999, for preliminary and final design approvals (Appendix O, “Standardization 

of Design: Staff Review of Standard Designs,” to 10 CFR Part 52 (Ref. 17), "Early Site Permits; Standard 

Design Certifications; and Combined Licenses for Nuclear Power Plants”), design certification, and 

construction permits, operating licenses, and combined licenses must meet the requirements for safety 

systems in IEEE Std 603-1991 and the correction sheet dated January 30, 1995. In addition, nuclear power 

plants are currently replacing existing I&C equipment with digital computer-based I&C systems or 

advanced analog systems. Regulatory Guide 1.47 (Revision 0) does not address the application of digital 

I&C systems to bypassed and inoperable status indication in nuclear power plants. 

Therefore, revision of this regulatory guidance is necessary to incorporate the updated IEEE Std 603-1991 

on safety systems endorsed by the NRC and to discuss the implications of the use of digital systems on the 

bypassed and inoperable status indication in nuclear power plants. 

2. Objective 

The objective of this regulatory action is to include appropriate references to IEEE Std 603-1991 

and a discussion of digital computer-based I&C systems or advanced analog systems. 

3. Alternative Approaches 

The NRC staff considered the following alternative approaches: 

• Do not revise Regulatory Guide 1.47. 

• Update Regulatory Guide 1.47. 

3.1 Alternative 1: Do Not Revise Regulatory Guide 1.47

Under this alternative, the NRC would not revise this guidance, and the original version of this 

regulatory guide would be retained. This alternative is considered the baseline or “no action” alternative 

and, as such, involves no value/impact considerations. This alternative would leave the regulatory guide 

outdated with the current regulations in 10 CFR 50.55a(h) and 10 CFR 50.34(f)(2)(v), and would not 

address the existing new digital I&C technology. 

3.2 Alternative 2: Update Regulatory Guide 1.47

Under this alternative, the NRC would update Regulatory Guide 1.47 to reflect the requirements of 

IEEE Std 603-1991. The updated version would include a discussion of digital computer-based I&C 

systems and advanced analog systems. The update would retain references to IEEE Std 279-1971, because 

this IEEE standard remains applicable to plants with construction permits issued after January 1, 1971, but 

before May 13, 1999. 

One benefit of this action is that it would enhance reactor safety by addressing the revised IEEE 

Std 603-1991 on safety systems endorsed by the NRC. Important digital computer-based I&C system 

issues such as single-failure criteria and communications would receive consideration. Also, the updated 
DG-1205, Page 8 

guide would address considerations from current regulations in 10 CFR 50.55a(h), and 

10 CFR 50.34(f)(2)(v). 

\ 

The impact to the NRC would be the costs associated with preparing and issuing the 

regulatory guide revision. The impact to the public would be the voluntary costs associated with 

reviewing and providing comments to NRC during the public comment period. The value to 

NRC staff and its applicants would be the benefits associated with enhanced efficiency and 

effectiveness in using a common guidance document as the technical basis for license 

applications and other interactions between the NRC and its regulated entities. 

4. Conclusion 

Based on this regulatory analysis, the NRC staff recommends revision of Regulatory Guide 1.47. 

The staff concludes that the proposed action will enhance reactor safety by reflecting current regulations 

and referencing the updated IEEE Std 603-1991on safety systems endorsed by the NRC. The revised 

guide could also lead to cost savings for the industry, especially with regard to applications for standard 

plant design certifications and combined licenses. 
DG-1205, Page 9 

REFERENCES 

1. 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities,” U.S. 

Nuclear Regulatory Commission, Washington, DC. 

2. IEEE Std 603-1991, “IEEE Standard Criteria for Safety Systems for Nuclear Power Generating 

Stations,” Institute of Electrical and Electronics Engineers, Piscataway, NJ, 1991, and the 

correction sheet dated January 30, 1995. 

3. IEEE Std 279-1971, “Criteria for Protection Systems for Nuclear Power Generating Stations,” 

Institute of Electrical and Electronics Engineers, Piscataway, NJ, 1971. 

4. Regulatory Guide 1.118, “Periodic Testing of Electric Power and Protection Systems,” U.S. 

Nuclear Regulatory Commission, Washington, DC, April 1995. 

5. IEEE Std 338-1987, “Criteria for the Periodic Testing of Nuclear Power Generating Station Safety 

Systems,” Institute of Electrical and Electronics Engineers, Piscataway, NJ, 1987. 

6. Regulatory Guide 1.53, “Application of the Single-Failure Criterion to Safety Systems,” U.S. 

Nuclear Regulatory Commission, Washington, DC, November 2003. 

7. IEEE Std 379-2000, “IEEE Standard Application of the Single-Failure Criterion to Nuclear Power 

Generating Station Safety Systems,” Institute of Electrical and Electronics Engineers, Piscataway, 

NJ, 2000. 

8. IEEE Std 7-4.3.2-2003, “IEEE Standard Criteria for Digital Computers in Safety Systems of 

Nuclear Power Generating Stations,” Institute of Electrical and Electronics Engineers, Piscataway, 

NJ, 2003. 

9. NUREG/CR-6303, “Method for Performing Diversity and Defense-in-Depth Analyses of Reactor 

Protection Systems,” U.S. Nuclear Regulatory Commission, Washington, DC, December 1994. 

10. Regulatory Guide 1.75, “Independence of Electrical Safety Systems,” U.S. Nuclear Regulatory 

Commission, Washington, DC, February 2005. 

11. IEEE Std 384-1992, “IEEE Standard Criteria for Independence of Class 1E Equipment and 

Circuits,” Institute of Electrical and Electronics Engineers, Piscataway, NJ, 1992.

12. Regulatory Guide 1.152, “Criteria for Digital Computers in Safety Systems of Nuclear Power 

Plants,” U.S. Nuclear Regulatory Commission, Washington, DC, January 2006.

13. Regulatory Guide 1.209, “Guidelines for Environmental Qualification of Safety-Related 

Computer-Based Instrumentation and Controls Systems in Nuclear Power Plants,” U.S. Nuclear 

Regulatory Commission, Washington, DC, March 2007. 

14. IEEE Std 323-2003, “IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power 

Generating Stations,” Institute of Electrical and Electronics Engineers, Piscataway, NJ, 2003. 
DG-1205, Page 10 

15. Regulatory Guide 1.89, “Environmental Qualification of Certain Electronic Equipment Important 

to Safety for Nuclear Power Plants,” U.S. Nuclear Regulatory Commission, Washington, DC, 

June 1984. 

16. Regulatory Guide 1.180, “Guidelines for Evaluating Electromagnetic and Radio-Frequency 

Interference in Safety-Related Instrumentation and Control Systems,” U.S. Nuclear Regulatory 

Commission, Washington, DC, October 2003. 

17. 10 CFR Part 52, “Early Site Permits; Standard Design Certifications; and Combined Licenses for 

Nuclear Power Plants,” U.S. Nuclear Regulatory Commission, Washington, DC.