Document: NUREG-0800
Document ID: 757b676a-0f71-4094-8677-ca3a50743281
Document Type: srp
Title: Revision 7 – August 2016
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1601/ML16019A344.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
sent the actual process. Such errors place further emphasis on the need for diversity to avoid or mitigate CCF. 1 IEEE 100, “The Authoritative Dictionary of IEEE Standards Terms,” defines firmware as the combination of a hardware device and computer instructions and data that reside as read-only software on that device. BTP 7-19-9 Revision 7 – August 2016 1.5 Manual Initiation of Automatically Initiated Protective Actions Subject to CCF Two types of manual initiation of automatically initiated protective actions may be necessary. To satisfy IEEE Std 603-1991 Clauses 6.2 and 7.2, a safety-related means shall be provided in the control room to implement manual initiation of the automatically initiated protective actions at the division level. System level actuation of all divisions also may be used to meet the requirements of IEEE Std 603-1991. If a D3 analysis indicates that the safety-related manual initiation would be subject to the same potential CCF affecting the automatically initiated protective action, then under Point 3 of the NRC position on D3, a diverse manual means of initiating protective action(s) would be needed (i.e., two manual initiation means would be needed). This diverse manual means may be safety or nonsafety. If the system/division level manual initiation required by IEEE Std 603-1991 is sufficiently diverse, the diverse (second) manual system level or division level actuation would not be necessary for the automated protective actions (see Figure 1). BTP 7-19-10 Revision 7 – August 2016 Figure 1. Two Manual Initiation Methods verses One Initiation Method 1.6 D3 Assessment To defend against potential CCF, the NRC staff considers D3 and the use of defensive measures to avoid or tolerate faults and to cope with unanticipated conditions to be key elements in high quality digital system designs. However, despite high quality in the development and use of defensive design measures, system errors could still defeat safety functions in