Document: NRC Regulatory Guide
Document ID: fc586342-92f7-4c77-ae76-79e3674cf288
Document Type: regulatory_guide
Title: Criteria for Programmable Digital Devices in Safety-Related Systems of  Nuclear Power Plants + HISTORY –HISTORY 02/2023 – DG-1374, Proposed Revision 4 Prior to issuance of DG-1374, RG 1.152 was entitled, “Criteria for Use of Computers in Safety-Systems of Nuclear Power Plants” 06/2010 – DG-1249, Proposed Revision 3 – Revise 12/2004 – DG-1130, Proposed Revision 2 – Revise 05/1995 – DG-1039, Proposed Revision 1 03/1983 – DG-1130, Proposed Revision 2 – Revise (Rev. 4)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML2301/ML23012A242.pdf
Revision Date: 2023-05
Chapter: 
Section ID: RG-1.152
CFR Part: 
CFR Title: 

Content:
3 “Point-to-point” data communication means that the message is passed directly from the sending node to the receiving node without the involvement of equipment outside the division of the sending or receiving node. DG-1374, Page 10 2.2 In addition to the independence criteria in Clause 5.6, Clauses 5.8.1 and 5.8.2 provide criteria that apply to multidivisional control and display stations for control of safety-related equipment. The term “control,” used in the context of multidivisional control and display workstations, includes all functions that can affect the safety-related equipment, including, but not limited to, bypass, lockout, blocks, and inhibit functions. In addition, the criteria for the interface between information displays and safety-related systems in Clause 5.8.2 should be supplemented with the following: 2.2.1 The control processor and its associated communication processor should only process the commands that pass the error checking. (3) Control of Access 3.1 Clauses 5.9 and 5.6 of IEEE Std 7-4.3.2-2016 provide criteria that the NRC staff finds acceptable for the protection of safety-related systems from non-malicious acts, such as undesirable behavior of connected systems and unintended access to safety-related systems. Licensees and applicants should provide a vulnerability assessment for the SDOE in accordance with the guidance of Clause 5.9 of IEEE Std 7-4.3.2-2016. Based on the results of the vulnerability assessment, the licensee and applicant should identify measures, design features, or both to address identified vulnerabilities. 3.2 Clause 5.9.3 provides criteria for the interaction between cyber security features (e.g., intrusion detection software, virus protection software, access control software) and safety functions. Licensees and applicants should avoid implementation of cyber security features directly in the safety-related systems. In any case, implementation of cyber security features shall not adversely impact the