Document: NUREG-0800
Document ID: 4cca74ec-66e0-4765-9c61-cf547e17c308
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although the NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1601/ML16019A114.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
reason, any software providing nonsafety functions that resides on a computer providing a safety function must be classified as a part of the safety system. If an applicant or licensee desires that a nonsafety function be performed by a safety computer, the software to perform that function must be classified as safety-related, with all the attendant regulatory requirements for safety software, including communications isolation from other nonsafety software. In some instances, vendors or applicants or licensees may wish to implement systems having some communication between the safety systems and nonsafety systems. General Design Criterion 24, “Separation of Protection and Control Systems,” requires that the protection system be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system, and that interconnection of the protection and control systems be limited so as to ensure that safety is not significantly impaired. In practical terms, this means that for communications between safety and nonsafety systems, the communications must be such that the safety system does not require any nonsafety input to perform its safety function, and that any failure of the nonsafety system, communications system, or data transmitted by the nonsafety system will not prevent or influence that independent safety determination. The portion of the safety software which actually performs the safety function, i.e., determining whether or not to trip based on sensor inputs, should not receive input or influence from any nonsafety system while the safety system is online and performing that safety function. The following provides some of the possible design approaches that a