Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
to perform that function must be classified as safety-related, with all the attendant regulatory requirements for safety software, including communications isolation from other non-safety software. In some instances, vendors or applicants/licensees may wish to implement systems having some communication between the safety systems and non-safety systems. GDC 24, “Separation of protection and control systems,” requires that the protection system be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system, and that interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired. In practical terms, this means that for communications between safety and non-safety systems, the communications must be such that the safety system does not require any non-safety input Appendix 7.1-D-17 March 2007 to perform its safety function, and that any failure of the non-safety system, communications system, or data transmitted by the non-safety system will not prevent or influence that independent safety determination. The portion of the safety software which actually performs the safety function, i.e., determining whether or not to trip based on sensor inputs, should not receive input or influence from any non-safety system while the safety system is on-line and performing that safety function. The following provides some of the possible design approaches that a reviewer may encounter for data communications. It is neither exhaustive nor limiting in the possible approaches. If the reviewer is not sufficiently familiar with the communications systems and methods being used, the reviewer should seek the