Document: NUREG-0800
Document ID: fe8ec6c2-e960-404c-854f-55c77bde1672
Document Type: srp
Title: NUREG-0800
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML2400/ML24005A077.pdf
Revision Date: 2024-05
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ate potential consequences of a postulated CCF. Generally, except in a few structures, systems, and components (SSCs) with relatively simple designs, DI&C systems cannot be fully tested, nor can their failure mechanisms be completely known, because their complexity leads to too many potential failure mechanisms. Therefore, DI&C systems may be vulnerable to a CCF if any of the following are present in redundant divisions of the systems: (1) identical system requirements or designs, (2) identical copies of software or software-based logic, or (3) unidentified dependencies, unintended interactions, or emergent behavior, especially when the DI&C systems are interconnected or use shared resources. Traditionally, CCF vulnerabilities of DI&C systems have been addressed using the principles of defense in depth and diversity (D3). Under these principles, the operation of facility systems is modeled as a series of successive layers of defense (called “echelons of defense”), all of which would need to be defeated for a CCF to result in unacceptable harm to public health and safety. A CCF could affect multiple echelons of defense and redundant divisions, depending upon, for example, the system architecture, the extent of interconnections, and the types and use of shared resources. Generally, the design technique of independence (e.g., communication independence) is used to ensure that multiple echelons will not fail concurrently. An overall DI&C system architecture that maintains the integrity of multiple layers of defense is key to ensuring a system’s ability to limit, mitigate, withstand, or cope with the effects of a CCF. Traditional design techniques such as redundancy, independence (e.g., communication independence), and diversity provide the basic framework and structure for maintaining defense in depth. Other design features (or design techniques) can also contribute to overall defense in depth. Such features (or design techniques) include segmentation; predictable