Document: NUREG-0800
Document ID: 4865fc6d-b85f-4173-9bca-162fa9fe67d2
Document Type: srp
Title: Appendix 7-A
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0525/ML052500555.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ethods. The vendor or applicant/licensee shall demonstrate adequate diversity within the design for each of these events. 3. If a postulated common-mode failure could disable a safety function, then a diverse means, with a documented basis that the diverse means is unlikely to be subject to the same common-mode failure, should be required to perform either the same function or a different function. The diverse or different function may be performed by a non-safety system if the system is of sufficient quality to perform the necessary function under the associated event conditions. 4. A set of displays and controls located in the main control room should be provided for manual system-level actuation of critical safety functions and monitoring of parameters that support the safety functions. The displays and controls should be independent and diverse from the safety computer systems identified in items 1 and 3 above. The above position is based on the NRC concern that software design errors are a credible source of common-mode failures. Software cannot be proven to be error-free, and therefore is considered susceptible to common-mode failures because identical copies of the software are present in redundant channels of safety-related systems. To defend against potential common-mode failures, the Staff considers high quality, Rev. 4 — June 1997 Appendix 7-A BTP HICB-19-4 defense-in-depth, and diversity to be key elements in digital system design. High-quality software and hardware reduces failure probability. However, despite high quality of design, software errors may still defeat safety functions in redundant, safety-related channels. Therefore, as set forth in points 1, 2, and 3 above, the Staff requires that the applicant/licensee perform a D-in-D&D assessment of the proposed digital I&C system to demonstrate that vulnerabilities to common-mode failures have been adequately addressed. In this assessment, the applicant/licensee should analyze design basis events