Document: NUREG-0800
Document ID: fe8ec6c2-e960-404c-854f-55c77bde1672
Document Type: srp
Title: NUREG-0800
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML2400/ML24005A077.pdf
Revision Date: 2024-05
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ility and satisfying the necessary safety requirements. These matters include: ...(4) Consideration of the possibility of systematic, nonrandom, concurrent failures of redundant elements in the design of the protection systems and reactivity control systems [emphasis added]. All licensed facilities are considered to have sufficient design features to address CCFs associated with their specific designs and equipment. The use of different designs, equipment, or technology may result in the need for additional design features to address the specific vulnerabilities of the different designs, equipment, or technology. DI&C systems offer significant operational and maintenance benefits for nuclear power plants. DI&C systems consist of both hardware components and logic elements (e.g., software). Hardware components in DI&C systems are susceptible to failures similar to those considered for analog systems. In this guidance, the term “software” refers to software, firmware, and logic developed from software-based development systems (e.g., devices programmed with hardware description languages). BTP 7-19-3 Revision 9 — May 2024 DI&C systems may be vulnerable to CCFs due to latent design defects in active hardware components, software, or software-based logic.1 A CCF occurs when multiple (usually identical) systems fail due to a shared cause.2 Latent design defects in the design of a DI&C system can remain undetected despite traditional design-basis development, verification, validation, and testing processes. Certain events, unexpected external stresses, or plant conditions can trigger latent design defects within redundant portions of a system designed to perform safety functions and thus lead to a systematic failure of the redundant portions. CCFs can have two distinct effects: (1) they can cause a loss of the capability to perform a safety function or can initiate a plant transient, or (2) they can initiate the operation of a function without a valid demand or can