Document: NUREG-0800
Document ID: dd4f84a9-8976-44c4-b631-d7c0254f4efc
Document Type: srp
Title: PROBABILISTIC RISK ASSESSMENT AND SEVERE ACCIDENT EVALUATION FOR
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1416/ML14161A594.pdf
Revision Date: 2023-06
Chapter: 19
Section ID: 19.0
CFR Part: 
CFR Title: 

Content:
ned properly or fail to operate appropriately. The potentially negative effects of these features should be included in the probabilistic model. The PRA should account for the possibility that after a failure is detected, the system may fail to reconfigure properly, may be set up into a configuration that is less safe than the original, may fail to mitigate the failure altogether, or the design feature itself may contain the fault. The benefits of these features also may be credited in the PRA. Care should be taken to ensure that design features intended to improve safety are modeled correctly (e.g., ensuring that the beneficial impacts of these features are only credited for appropriate failure modes and that the limitations, including failure of the design feature itself, is considered in the model). An issue associated with including a design feature such as fault tolerance in a DI&C system modeled in a PRA is that its design may be such that it can only detect, and hence mitigate, certain types of failures. A feature may not detect all the failure modes of the associated component, but just the ones it was designed to detect. The PRA model should only give credit to the ability of these features to automatically mitigate these specific failure modes; it should consider that all remaining failure modes cannot be automatically tolerated. Those failure modes that were not tested should not be considered in the fault coverage, and should be included explicitly in the logic model. When a specific datum from a generic database, such as a failure rate of a digital component, is used in a DI&C risk assessment, the risk analyst, in conjunction with the I&C reviewer, should assess whether the datum was adjusted for the contribution of design features specifically intended to limit those postulated failures. If so, the failure rate may be used in the PRA, but no additional fault coverage should be applied to the component, unless it is demonstrated that the 19.0-35 Draft