Document: NUREG-0800
Document ID: 6209b3e7-917d-48d2-a299-4d1230aa5b51
Document Type: srp
Title: Revision 5 - March 2007
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0705/ML070550070.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ands or software or hardware changes to equipment. Design basis documents should identify design practices that the applicant/licensee will use to avoid timing problems. Risky design practices such as non-deterministic data communications, non-deterministic computation, use of interrupts, multitasking, dynamic scheduling, and event-driven design should be avoided. When such practices are allowed, the applicant/licensee should describe methods for control of the associated risk. NUREG/CR-6082 and NUREG/CR-6083 describe risky design practices in more detail. Performance Verification The means proposed, or used, for verifying a system's timing should be consistent with the design. Testing and/or analytic justification should show that the system meets limiting response times for a reasonable, randomly selected subset of system loads, conditions, and design basis BTP 7-21-8 Revision 5 - March 2007 events. The subset should include some limiting load conditions and be chosen by persons independent of the persons who designed the system. Both analytical and test techniques of timing analysis have drawbacks. It is difficult to demonstrate completeness of timing tests. Completeness is easier to demonstrate for analyses, but analyses predict extreme times that are not actually possible. Therefore, analysis and testing are often combined in a complementary manner to confirm that a system can meet the limiting response times. Measurement methods should be appropriate to the resolution and detail required. Timing measurements should meet projections or the anomalies should be satisfactorily explained (NUREG/CR-6083, Sections 2.1, 2.3.3, and 2.3.4). Use of Cyclic Real-Time Executive In systems that include a cyclic real-time executive (operating system), a typical cycle includes application modules, diagnostic modules, and other support modules. A watch-dog timer is normally set at the beginning of each cycle and reset at the end. If the cycle is not completed before the