Document: NUREG-0800
Document ID: 65f2433f-2c4a-4580-b173-0c6da7fa4d73
Document Type: srp
Title: Draft Revision 7 – August 2015
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1515/ML15159A996.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ential CCF, the credited safety function (or a different function that will accomplish the same desired safety protection) can be accomplished via either an automated system or manual operator actions performed from the MCR. The preferred diverse means is generally an automated system. The primary focus of BTP 7-19 is to identify whether a diverse means of performing protective actions is necessary due to an automated safety function being subject to a postulated CCF. Functions performed manually normally would be expected to still be performed manually in the presence of a CCF (even if different equipment is called upon to function). If the manual actuation method could be adversely affected by the postulated CCF, then a diverse manual means is needed to perform the safety function or an acceptable different function. 1.8 Potential Effects of CCF: Failure to Actuate and Spurious Actuation There are two inherent safety functions that safety-related trip and actuation systems provide. The first safety function is to provide a trip or system actuation when plant conditions necessitate that trip or actuation. However, in order to avoid challenges to the safety systems and to the plant, the second function is to not trip or actuate when such a trip or actuation is not required by plant conditions. A simple metric would be: Plant conditions require a trip or actuation Plant conditions do not require a trip or actuation Trip or Actuation Occurs Proper System Operation System Failure (Spurious Actuation) Trip or Actuation does not occur System Failure (Actuation does not occur or incomplete activation) Proper System Operation A failure of a system to actuate might not be the worst case failure, particularly when analyzing the time required for identifying and responding to conditions resulting from a CCF in an automated safety system. For example, a failure to trip might not be as limiting as a partial actuation of an emergency core cooling system, but with indication of a