Document: NUREG-0800
Document ID: 757b676a-0f71-4094-8677-ca3a50743281
Document Type: srp
Title: Revision 7 – August 2016
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1601/ML16019A344.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
3 above” refers to the safety-related automated RTS and ESFAS. For digital system modifications to operating plants, retention of existing analog displays and controls in the MCR could satisfy this point (see Section B.1.5, “Manual Initiation of Automatically Initiated Protective Actions Subject to CCF.”) However, if existing displays and controls are digital and/or the same platform is used to provide signals to the analog displays, this point may not be satisfied. Where the Point 4 displays and controls serve as the diverse means, the displays and controls also should be able to function downstream of the lowest-level components subject to the CCF that necessitated the use of the diverse means. One example would be the use of hard-wired connections. Once manual actuation from the MCR using the Point 4 displays and controls has been completed, controls outside the MCR for long-term management of these (plant) critical safety functions may be used when supported by suitable HFE analysis and site-specific procedures or instructions. The above four-point position is based on the NRC concern that software based or software logic based digital system development errors are a credible source of CCF. In this guidance, common software includes software, firmware,1 and logic developed from software-based development systems. Generally, digital systems cannot be proven to be error-free and, therefore, are considered susceptible to CCF because identical copies of the software based logic and architecture are present in redundant divisions of safety-related systems. Also, some errors labeled as “software errors” (for example) actually result from errors in the higher level requirements specifications used to direct the system development that fail in some way to represent the actual process. Such errors place further emphasis on the need for diversity to avoid or mitigate CCF. 1 IEEE 100, “The Authoritative Dictionary of IEEE Standards Terms,” defines firmware