Document: NUREG-0800
Document ID: 5e40cf60-028d-44c3-b9b8-735a6a68a48a
Document Type: srp
Title: Revision 6 - August 2016
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1602/ML16020A036.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
G/CR-6082 and NUREG/CR-6083 describes risky design practices in more detail. Performance Verification The means proposed, or used, for verifying a system's timing should be consistent with the design. Testing and/or analytic justification should show that the system meets limiting response times for a reasonable, randomly selected subset of system loads, conditions, and design basis events. The subset should include some limiting load conditions and be chosen by persons independent of the persons who designed the system. Both analytical and test techniques of timing analysis have drawbacks. It is difficult to demonstrate completeness of timing tests. Completeness is easier to demonstrate for analyses, but analyses predict extreme times that are not actually possible. Therefore, analysis and testing are often combined in a complementary manner to confirm that a system can meet the limiting response times. Measurement methods should be appropriate to the resolution and detail required. Timing measurements should meet projections or the anomalies should be satisfactorily explained (NUREG/CR-6083, Sections 2.1, 2.3.3, and 2.3.4). Use of Cyclic Real-Time Executive In systems that include a cyclic real-time executive (operating system), a typical cycle includes application modules, diagnostic modules, and other support modules. A watch-dog timer is normally set at the beginning of each cycle and reset at the end. If the cycle is not completed before the watch-dog timer period is complete, an error is generated. BTP 7-21-9 Revision 6 – August 2016 A basis should be provided that describes the cycle and demonstrates that the watch-dog timer is correctly implemented, the time required for the application modules does not exceed the allotted time given in the architecture timing budget, and diagnostic and other support modules will not cause the allotted time to be exceeded. Use of Part-Scale Prototypes In systems that have not been implemented and tested on a full scale,