Document: NRC Regulatory Guide
Document ID: 0df18aa6-42a8-4990-aa7e-3df6d0907f3f
Document Type: regulatory_guide
Title: Criteria for Safety Systems (Rev. 1)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML2511/ML25114A021.pdf
Revision Date: 2025-11
Chapter: 
Section ID: RG-1.153
CFR Part: 
CFR Title: 

Content:
evice is one approach the NRC staff would consider acceptable to ensure that safety-related I&C systems do not present an electronic path that could enable unauthorized access to the plant’s safety- related systems. 4. The first sentence of Clause 5.16 of IEEE Std 603-2018, “Common-cause failure,” states, “The safety system design and development shall address common-cause failures (CCF) that create a potential to degrade or defeat the safety system function.” Changes to plant designs, equipment, or technology may introduce latent design defects in active hardware components, software, or software-based logic. Latent design defects in safety systems can remain undetected despite traditional design-basis development, verification, validation, and testing processes. Certain events, unexpected external stresses, failures occurring within shared resources, or plant conditions can trigger latent design defects within redundant portions of a system designed to perform safety functions and thus lead to a systematic failure of the redundant portions. Licensees and applicants should address systematic CCFs that are the result of latent design defects. RG 1.152, which endorses IEEE Std 7-4.3.2, provides an acceptable method for performing evaluations of systematic CCFs due to latent design defects. In addition, the NRC staff uses the guidance in BTP 7-19 and the DRG, to evaluate the applicants’ D3 assessments using either best- estimate methods or a risk-informed approach or both, to address CCFs due to latent design defects in digital safety-related systems. For digital I&C, the Commission’s policy on addressing CCF documented in SRM-SECY‑22-0076 allows the use of risk-informed approaches to demonstrate the appropriate level DG-1251, Page 9 of defense-in-depth, and the use of design techniques or mitigation measures other than diversity to address a potential CCF. If diversity is used as an approach, then independent and diverse means not susceptible to the