U.S. NUCLEAR REGULATORY COMMISSION 

REGULATORY

September 1997

GUIDE

OFFICE OF NUCLEAR REGULATORY RESEARCH 

REGULATORY GUIDE 1.170 

(Draft was DG-1056) 

SOFTWARE TEST DOCUMENTATION FOR DIGITAL COMPUTER SOFTWARE 

USED IN SAFETY SYSTEMS OF NUCLEAR POWER PLANTS

A. INTRODUCTION 

In 10 CFR Part 50, "Domestic Licensing of Pro

duction and Utilization Facilities," paragraph 55a(aXl) 

requires, in part, that systems and components be de

signed, tested, and inspected to quality standards com

mensurate with the safety function to be performed. 1 

Criterion 1, "Quality Standards and Records," of 

Appendix A, "General Design Criteria for Nuclear 

Power Plants," to 10 CFR Part 50 requires, in part, that 

a quality assurance program be established and imple

mented in order to provide adequate assurance that sys

/' tems and components important to safety will satisfac

torily perform their safety functions. 1 Appendix B, 

"Quality Assurance Criteria for Nuclear Power Plants 

and Fuel Reprocessing Plants," to 10 CFR Part 50 

describes criteria that must be met by a quality assur

ance program for systems and components that prevent 

or mitigate the consequences of postulated accidents. 

In particular, besides the systems and components that 

directly prevent or mitigate the consequences of postu

lated accidents, the criteria of Appendix B also apply to 

all activities affecting the safety-related functions of 

such systems and components, such as designing, pur

chasing, installing, testing, operating, maintaining, or 

Iln this regulatory guide, many of the regulations have been paraphrased; 

see 10 CFR Part 50 for the full text.

modifying. A specific requirement is contained in 10 

CFR 50.55a(h), which requires that reactor protection 

systems satisfy the criteria of IEEE Std 279-1971, 

"Criteria for Protection Systems for Nuclear Power 

Generating Stations." 2 Paragraph 4.3 of IEEE Std 2793 

states that quality of components is to be achieved 

through the specification of requirements known to 

promote high quality, such as requirements for design, 

inspection, and test. 

Many of the criteria in Appendix B to 10 CFR 

Part 50 contain requirements closely related to the ac

tivities of verification and testing. 1 Criterion I, "Organ

ization," requires the establishment and execution of a 

quality assurance program. Criterion II, "Quality 

Assurance Program," requires the quality assurance 

program to take into account the need for verification of 

quality by inspections and tests. Criterion III, "Design 

Control," requires, in part, that measures be established 

for verifying and checking the adequacy of design, such 

as by the performance of a suitable testing program, and 

2Revision I of Regulatory Guide 1.153, "Criteria for Safety Systems," 

endorses IEEE Std 603-1991, "Criteria for Safety Systems for Nuclear 

Power Generating Stations," as a method acceptable to the NRC staff for 

satisfying the NRC's regulations with respect to the design, reliability, 

qualification, and testability of the power, instrumentation, and control 

portions of the safety systems of nuclear power plants. 

31EEE publications may be obtained from the IEEE Service Center, 445 

Hoes Lane, Piscataway, NJ 08854.

USNRC REGULATORY GUIDES The guides w'e issued In ft following ton broad disions: 

Regulatory Guides are issued to describe mnd mele available to the public such Worms

lIn as methods acceptable to lhe NRC staff for irplemerolrlg spedfic parts of te Com- 1. Powereactors 6. Products 

mission'sreguietlons, techniques used by•t• staff in evaluang specific problems or - 2. Research an TeT Reactors 7. Transportadon 

iulated ascderns, aid data needed by fti NRC staff In Its review of applilcadIons for per- &. Fuels and Materials Facilties 8. Occtional Health 

mits mid Scenses. Regulatory guides re not substitutes for regulations, emd con-p--nce 4. Erironmental and Siting 0. Anititrtnarid Firund Review 

with tien is not required. Methods aid soluhlors dliferent from those oet out in the guides & Materials mid Plant Protection 10. Gera! 

wit be acceptable I hey provide a basis for fte finings requisite to t•e issuance or con Inec of 8 per.mit or Slcenes by the Commlisson. Skigle copies of regulatory guides may be obtained kee of charge bywriting te Prinrting, 

This guide was Issued after consideratIon of comments received from the public. Corn- Graphics aid Distribullon Branch, Office of Administnrtion, U.S. Nuclear Regulatory Com

merdt arclsuggestlons forimprovements Intheseguides weoncouraged stall times, and mision, Wasington, DC 2D555-0001; or by fatx a (301)415-5272. Idea wilt be revised, as appropriate, to accommodate comments mid to refect new in

or vflbrv.Asedaa appaIssued guides may as be purchased from to National Technical Informtilon Service on 

Witten comments may be asubmitted to tie Rules Review mid Directives 8ranch. DFIPS, astandlng order basis. Details on fil service may be obtained by wrrdng NTIS, 5285 Port 

ADM, US. Nudear Reguatory Commisslon, Wasington, DC 2055 -0001. Royal Road, Springfield, VA 2161.
that design control measures be applied to items such as 

the delineation of acceptance criteria for inspections 

and tests. Criterion V, "Instructions, Procedures, and 

Drawings," requires activities affecting quality to be 

prescribed by documented instructions, procedures, or 

drawings of a type appropriate to the circumstances and 

that these activities be accomplished in accordance 

with these instructions, procedures, or drawings. Crite

rion V further requires that instructions, procedures, 

and drawings include appropriate quantitative or quali

tative acceptance criteria for determining that impor

tant activities have been satisfactorily accomplished. 

Criterion XI, "Test Control," requires establishment of 

a test program to ensure that all testing required to dem

onstrate that structures, systems, and components will 

perform satisfactorily in service is identified and per

formed in accordance with written test procedures that 

incorporate the requirements and acceptance limits 

contained in applicable design documents. Test proce

dures must include provisions for ensuring that all pre

requisites for the given test have been met, that ade

quate test instrumentation is available and used, and 

that the test is performed under suitable environmental 

conditions. Criterion XI also requires that test results be 

documented and evaluated to ensure that test require

ments have been satisfied. Finally, Criteria VI, "Docu

ment Control," and XVII, "Quality Assurance 

Records," provide for the control of the issuance of doc

uments, including changes thereto, that prescribe all 

activities affecting quality and provide for the mainte

nance of sufficient records to furnish evidence of activi

ties affecting quality. The latter requires test records to 

identify the inspector or data recorder, the type of ob

servation, the results, the acceptability of the results, 

and the action taken in connection with any deficiencies 

noted. 

This regulatory guide endorses ANSI/IEEE Std 

829-1983, "IEEE Standard for Software Test Docu

mentation," 3 with the exceptions stated in the Regula

tory Position. This guide describes methods acceptable 

to the NRC staff for complying with parts of the NRC's 

regulations for achieving high functional reliability and 

design quality in software used in safety systems. 4 In 

particular, the methods are consistent with the pre

viously cited General Design Criteria and the criteria 

for quality assurance programs of Appendix B as they 

apply to the documentation of software testing activi

4

The term "safety systems" is synonymous with "safety-related systems." 

The General Design Criteria cover systems, structures, and components 

"important to safety." The scope of this regulatosy guide is, however, 

limited to "safety systems," which are a subset of "systems important to 

safety."

ties. The criteria of Appendices A and B apply to sys

tems and related quality assurance processes, and if 

those systems include software, the requirements 

extend to the software elements. 

In general, information provided by regulatory 

guides is reflected in the Standard Review Plan 

(NUREG-0800). The Office of Nuclear Reactor Regu

lation uses the Standard Review Plan to review applica

tions to construct and operate nuclear power plants. 

This regulatory guide will apply to the revised Chapter 

7 of the Standard Review Plan. 

The information collections contained in this regu

latory guide are covered by the requirements of 10 CFR 

Part 50, which were approved by the Office of Manage

ment and Budget, approval number 3150-0011. The 

NRC may not conduct or sponsor, and a person is not 

required to respond to, a collection of information un

less it displays a currently valid OMB control number. 

B. DISCUSSION 

The use of industry consensus standards is part of 

an overall approach to meeting the requirements of 

10 CFR Part 50 when developing safety systems for 

nuclear power plants. Compliance with standards does 

not guarantee that regulatory requirements will be met. 

However, compliance does ensure that practices 

accepted within various technical communities will be 

incorporated into the development and quality assur

ance processes used to design safety systems. These 

practices are based on past experience and represent in

dustry consensus on approaches used for development 

of such systems. 

Software incorporated into instrumentation and 

control systems covered by Appendix B will be referred 

to in this regulatory guide as safety system software. 

For safety system software, software testing is an im

portant part of the effort to achieve compliance with the 

NRC's requirements. Software engineering practices 

rely, in part, on software testing to meet general quality 

and reliability requirements consistent with Criteria 1 

and 21 of Appendix A to 10 CFR Part 50, as well as Cri

teria I, II, III, V, VI, XI, and XVII in Appendix B. 

Current practice for the development of software 

for high-integrity applications includes the use of a 

software life cycle process that incorporates software 

testing activities. See IEEE Std 1074-1991, "IEEE 

Standard for Developing Software Life Cycle Pro

cesses." 3 Software testing is a key element in software 

verification and validation activities, as indicated by 

IEEE Std 1012-1986, "IEEE Standard for Software 

Verification and Validation Plans," 3 and IEEE Std

1.170-2
7-4.3.2-1993, "Standard Criteria for Digital Comput

ers in Safety Systems of Nuclear Power Generating Sta

tions." 3 The latter is endorsed by Revision 1 of Regula

,' tory Guide 1.152, "Criteria for Digital Computers in 

Safety Systems of Nuclear Power Plants." The consen

sus standard, ANSI/IEEE Std 829-1983, "IEEE Stan

dard for Software Test Documentation" (reaffirmed in 

1991), defines software test documentation and speci

fies its form and content. The term 'documentation' is 

used here in accordance with the first meaning given in 

IEEE Std 610.12-1990, "IEEE Standard Glossary of 

Software Engineering Terminology," which defines 

documentation as a collection of documents on a given 

subject. IEEE Std 829-1983 describes a method for 

software test documentation consistent with the pre

viously cited regulatory requirements as they apply to 

safety system software. 

The documentation identified in IEEE Std 

829-1983 falls into three categories: test planning, test 

specification, and test reporting. All three categories 

provide for test information consistent with the require

ments of Appendix B to 10 CFR Part 50, in particular, 

with the requirements of Criterion XI, "Test Control," 

as applied to software. The test planning category con

sists of a test plan that addresses key aspects of the test 

program, such as scope, risks, tasks, resources, respon

sibilities, and acceptance (pass or fail) criteria for the 

software item being tested. The test specification cate

gory consists of test designs, test cases, and test proce

dures that contain the detailed procedures and instruc

tions for testing as well as the feature or test case 

acceptance criteria to be employed during the testing 

effort. This category is particularly relevant to Criterion 

V, "Instructions, Procedures, and Drawings." The test 

reporting category consists of transmittal reports, test 

incident reports, test logs, and test summary reports 

that provide for the recording and summarization of test 

events and that serve as the basis for evaluating test re

sults. All information in this category is summarized in 

the test summary report. This category addresses the re

quirements of parts of Criterion VI, "Document Con

trol," Criterion XI, "Test Control," and Criterion XVII, 

"Quality Assurance Records," as applied to software. 

The documentation in the test reporting category con

tains most of the specific information itemized in Crite

rion XVII (although anomaly resolution typically will 

be handled through the change process of the software 

configuration management (SCM) function). IEEE Std 

829-1983 also provides for the inclusion of additional 

material in any of its defined documentation; therefore, 

any special testing information associated with unique 

circumstances may also be included.

C. REGULATORY POSITION 

The requirements contained in IEEE Std 

829-1983, "IEEE Standard for Software Test Docu

mentation," provide an approach acceptable to the 

NRC staff for meeting the requirements of 10 CFR 

Part 50 as they apply to the test documentation of safety 

system software subject to the exceptions listed below. 

The appendices to this standard are not covered by this 

regulatory guide. (In this Regulatory Position, the cited 

criteria are in Appendix B to 10 CFR Part 50 unless 

otherwise noted.) 

To meet the requirements of 10 CFR 50.55a(h) and 

Appendix A to 10 CFR Part 50 as assured by complying 

with the criteria of Appendix B applied to the test docu

mentation of safety system software, the following 

exceptions are necessary and will be considered by the 

NRC staff in the review of submittals from applicants 

and licensees. 

1. TEST PROGRAM 

Criterion XI, "Test Control," requires that a test 

program be established to ensure that all testing 

required to demonstrate that systems and components 

will perform satisfactorily in service is identified and 

performed in accordance with written test procedures 

that incorporate requirements and acceptance limits 

contained in applicable design documents. Criterion I, 

"Organization," Criterion II, "Quality Assurance Pro

gram," Criterion III, "Design Control," Criterion V, 

"Instructions, Procedures, and Drawings," Criterion 

VI, "Document Control," and Criterion XVII, "Quality 

Assurance Records," contain requirements regarding 

information associated with testing. IEEE Std 

829-1983 does not mandate the use of all of its software 

test documentation in any given test phase. It directs the 

user to specify the documents required for a particular 

test phase. If a subset of the IEEE Std 829-1983 docu

mentation is chosen for a particular test phase, informa

tion necessary to meet regulatory requirements regard

ing software test documentation must not be omitted. 

As a minimum, this information includes: 

" Qualifications, duties, responsibilities, and skills 

required of persons and organizations assigned to 

testing activities, 

" Environmental conditions and special controls, 

equipment, tools, and instrumentation needed for 

accomplishing the testing, 

" Test instructions and procedures incorporating the 

requirements and acceptance limits in applicable 

design documents,

1.170-3
"* Test prerequisites and the criteria for meeting 

them, 

"* Test items and the approach taken by the testing 

program, 

"* Test logs, test data, and test results, 

"* Acceptance criteria, and 

"* Test records indicating the identity of the tester, the 

type of observation, the results and acceptability, 

and the action taken in connection with any 

deficiencies. 

Any of the above information items that are not 

present in the subset selected for a particular test phase 

must be incorporated into the appropriate documenta

tion as an additional item. 

2. SOFTWARE DOCUMENTATION 

Criterion VI, "Document Control," and Criterion 

XVII, "Quality Assurance Records," as well as 10 CFR 

21.51, "Maintenance and Inspection of Records," of 

10 CFR Part 21, "Reporting of Defects and Noncom

pliance," require the control and retention of docu

ments and records affecting quality. Since design con

trol measures must be applied to acceptance criteria for 

tests and since some software test documentation is re

used and evolves during the course of software devel

opment and software maintenance (for example, re

gression test documentation), such test documentation 

should be controlled as one or more configuration items 

under a software configuration management system. 

Test records, such as test reports, must be maintained as 

quality records and should be controlled by the soft

ware configuration management system. 

3. TEST DOCUMENTATION 

IEEE Std 829-1983 describes software test docu

mentation as a set of individual documents. It is accept

able for the individual documents to be incorporated 

into larger test documents, provided the identity of each 

component document is retained. 

4. SYSTEM TESTING 

Criterion XI, "Test Control," requires that testing 

demonstrate that systems and components will perform 

satisfactorily in service. In section 4.2.2 of IEEE Std 

829-1983, in describing the features to be tested by a 

given test design, it is noted that other features may be 

exercised but not identified. Each feature in safety sys

tem software is to be formally tested under at least one 

test design.

5. TRACEABILITY 

Criterion XI, "Test Control," requires that testing 

demonstrate that systems and components will perform 

satisfactorily in service. Traceability analyses, relating 

functions and test cases, provide a means for ensuring 

that all functions are tested. These analyses are ad

dressed in planning for software verification and val

idation.5 In section 5.2.2, IEEE Std 829-1983 suggests 

consideration of supplying references to item docu

mentation as part of test case documentation. These ref

erences must be included in the test case documentation 

unless equivalent traceability information is main

tained elsewhere in the verification and validation 

records. 

6. OTHER CODES AND STANDARDS 

Standards endorsed by regulatory guides some

times refer to other standards. These references to other 

standards should be treated individually. If a referenced 

standard has been incorporated separately into the 

NRC's regulations, licensees and applicants must com

ply with that standard as set forth in the regulation. If 

the referenced standard has been endorsed in a 

regulatory guide, the standard constitutes a method ac

ceptable to the NRC staff of meeting a regulatory re

quirement as described in the regulatory guide. If a ref

erenced standard has been neither incorporated into the 

NRC's regulations nor endorsed in a regulatory guide, 

licensees and applicants may consider and use the in

formation in the referenced standard, if appropriately 

justified, consistent with current regulatory practice. 

D. IMPLEMENTATION 

The purpose of this section is to provide informa

tion to applicants and licensees regarding the NRC 

staff's plans for using this regulatory guide. No backfit

ting is intended or approved in connection with this 

guide. 

Except in those cases in which an applicant pro

poses an acceptable alternative method for complying 

with the specified portions of the NRC's regulations, 

the methods described in this guide will be used in the 

evaluation of submittals in connection with applica

tions for construction permits and operating licenses. 

This guide will also be used to evaluate submittals from 

operating reactor licensees that propose system modifi

cations voluntarily initiated by the licensee if there is a 

clear nexus between the proposed modifications and 

this guidance. 

5

SeC IEEE Std 1012-1986, "IEEE Standard for Software Verification and 

Validation Plans."

1.170-4

K
BIBLIOGRAPHY

Hecht, H., A.T. Tai, K.S. Tso, "Class 1E Digital Sys

tems Studies," NUREG/CR-6113, USNRC, October 

1993.1 

Institute of Electrical and Electronics Engineers, "Stan

dard Criteria for Digital Computers in Safety Systems 

of Nuclear Power Generating Stations," IEEE Std 

7-4.3.2, 1993. 

Lawrence, J.D., "Software Reliability and Safety in 

Nuclear Reactor Protection Systems," NUREG/ 

CR-6101 (UCRL-ID-117524, Lawrence Livermore 

National Laboratory), USNRC, November 1993.1 

t

Copies may be purchased at current rates from the U.S. Government Prin

ting Office, P.O. Box 37082, Washington, DC 20402-9328 (telephone 

(202)512-2249); or from the National Technical Information Service by 

writing NTIS at 5285 Port Royal Road, Springfield, VA 22161. Copies are 

available for inspection or copying for a fee from the NRC Public Docu

ment Room at 2120 L Street NW., Washington, DC; the PDR's mailing ad

dress is Mail Stop LL-6, Washington, DC 20555-0001; telephone 

(202)634-3273; fax (202)634-3343.

Lawrence, J.D., and G.G. Preckshot, "Design Factors 

for Safety-Critical Software," NUREG/CR-6294, 

USNRC, December 1994.1 

Seth, S., et al., "High Integrity Software for Nuclear 

Power Plants: Candidate Guidelines, Technical Basis 

and Research Needs," NUREG/CR-6263, USNRC, 

June 1995.1 

USNRC, "Criteria for Digital Computers in Safety 

Systems of Nuclear Power Plants," Regulatory Guide 

1.152, Revision 1, January 1996.2 

USNRC, "Standard Review Plan," NUREG-0800, 

February 1984. 

2

Single copies of regulatory guides may be obtained free of charge by writ

ing the Office of Administration, Printing, Graphics and Distribution 

Branch, U.S. Nuclear Regulatory Commission, Washington, DC 

20555-0001; orby fax at (301)415-5272. Copies are available for in

spection or copying for a fee from the NRC Public Document Room at 

2120 L Street NW, Washington, DC; the PDR's mailing address is Mail 

Stop LL-6, Washington, DC 20555-0001; telephone (202)634-3273; 

fax (202)634-3343.

1.170-5
REGULATORY ANALYSIS

A separate regulatory analysis was not prepared for this regulatory guide. The 

regulatory analysis prepared for Draft Regulatory Guide DG-1056, "Software 

Test Documentation for Digital Computer Software Used in Safety Systems of 

Nuclear Power Plants," provides the regulatory basis for this guide. A copy of the 

regulatory analysis is available for inspection and copying for a fee at the NRC 

Public Document Room, 2120 L Street NW., Washington, DC; the PDR's mailing 

address is Mail Stop LL-6, Washington, DC 20555-0001; phone (202)634-3273; 

fax (202)634-3343.

1.170-6
Federal Recycling Program
-I

UNITED STATES 

NUCLEAR REGULATORY COMMISSION 

WASHINGTON, DC 20555-0001

FIRST CLASS MAIL 

POSTAGE AND FEES PAID 

USNRC 

PERMIT NO. G-67

OFFICIAL. BUSINESS 

PENALTY FOR PRIVATE USE, $300