Document: NRC Regulatory Guide
Document ID: fc586342-92f7-4c77-ae76-79e3674cf288
Document Type: regulatory_guide
Title: Criteria for Programmable Digital Devices in Safety-Related Systems of  Nuclear Power Plants + HISTORY –HISTORY 02/2023 – DG-1374, Proposed Revision 4 Prior to issuance of DG-1374, RG 1.152 was entitled, “Criteria for Use of Computers in Safety-Systems of Nuclear Power Plants” 06/2010 – DG-1249, Proposed Revision 3 – Revise 12/2004 – DG-1130, Proposed Revision 2 – Revise 05/1995 – DG-1039, Proposed Revision 1 03/1983 – DG-1130, Proposed Revision 2 – Revise (Rev. 4)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML2301/ML23012A242.pdf
Revision Date: 2023-05
Chapter: 
Section ID: RG-1.152
CFR Part: 
CFR Title: 

Content:
using watchdog timer (WDT) or processors, monitoring communication channels, monitoring central processing unit statuses, and checking data integrity. A WDT used to detect lock-up conditions should be independent of the microprocessor it is monitoring such that the WDT is not subject to the same failure condition as the microprocessor. Upon detection of a lock-up condition or other failure, the WDT should place the output of the system into a predetermined fail-safe state based on the safety-related system application. This WDT function should be completed independently of the microprocessor it is monitoring. One approach the NRC staff finds acceptable for implementing a WDT is to use a hardware-based device to perform the WDT counter, reset, time-out, and fail-safe functions. 1.2.2 If self-diagnostic features are integrated into the safety-related DI&C systems, the following criteria should be applied: (a) The design of self-diagnostic features maintains channel independence and system integrity and meets the single-failure criterion. (b) The safety classification of the hardware and software used to perform self- diagnostics is equivalent to that of the tested system unless physical, electrical, and communication independence are maintained such that no failure of the test function can inhibit the performance of the safety function. (c) Failures detected by self-diagnostics are consistent with the failure detectability assumptions of the single-failure analysis and the failure modes and effects analysis. (d) Self-diagnostic features do not add complexity to the safety-related system. Interfaces between software that performs protection functions and software for other functions such as self-diagnostics should be designed to minimize the complexity of the software logic and data structures. (e) Self-diagnostic functions are verified during periodic functional tests. 1.2.3 Self-diagnostics could be credited, on an application-specific basis, to either reduce or