Document: NUREG-0800
Document ID: 65f2433f-2c4a-4580-b173-0c6da7fa4d73
Document Type: srp
Title: Draft Revision 7 – August 2015
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1515/ML15159A996.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
res as well as CCF effects that do not exist in systems that use separate discrete components. While a single random failure could affect multiple echelons in one division, a CCF could affect multiple echelons in multiple divisions. However, the four echelons of defense described above are only conceptual and, with the exception of the monitoring and indication echelon of defense noted in Point 4 (see Section B.1.4, “Four-Point Position”), NRC regulations do not require nor does this guidance imply that RTS and ESFAS echelons of defense must be independent or diverse from each other with respect to a CCF. Plant responses to postulated CCF that could impair a safety function should be in accordance with the acceptance criteria of this BTP, regardless of the echelons of defense that may be affected. 1.4 Four-Point Position On the basis of reviews of the ALWR DC applications for designs that use digital safety systems, the NRC has established the following four-point position on D3 for new reactor designs and for digital system modifications to operating plants. The foundation of BTP 7-19 is the “NRC position on D3” from the SRM on SECY-93-087, Item 18, II.Q. The four points (i.e., SRM on SECY-93-087 items) are quoted below: Point 1 “The applicant shall assess the defense-in-depth and diversity of the proposed instrumentation and control system to demonstrate that vulnerabilities to common- mode failures have adequately been addressed.” Point 2 “In performing the assessment, the vendor or applicant shall analyze each postulated common-mode failure for each event that is evaluated in the accident analysis section of the safety analysis report (SAR) using best-estimate methods. The vendor or applicant shall demonstrate adequate diversity within the design for each of these events.” Point 3 “If a postulated common-mode failure could disable a safety function, then a diverse means with a documented basis that the diverse means is unlikely to be BTP 7-19-7