Document: NUREG-0800
Document ID: dc63e8aa-2a74-4078-9e19-9a26ed1b4d8c
Document Type: srp
Title: Revision 6 – July 2012
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1105/ML110550791.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ted CCF, then a diverse manual means is needed to perform the safety function or an acceptable different function. 1.8 Potential Effects of CCF: Failure to Actuate and Spurious Actuation There are two inherent safety functions that safety-related trip and actuation systems provide. The first safety function is to provide a trip or system actuation when plant conditions necessitate that trip or actuation. However, in order to avoid challenges to the safety systems and to the plant, the second function is to not trip or actuate when such a trip or actuation is not required by plant conditions. Revision 6 – July 2012 BTP 7-19-12 A simple metric would be: Plant conditions require a trip or actuation Plant conditions do not require a trip or actuation Trip or Actuation Occurs Proper System Operation System Failure (Spurious Actuation) Trip or Actuation does not occur System Failure (Actuation does not occur or incomplete activation) Proper System Operation A failure of a system to actuate might not be the worst case failure, particularly when analyzing the time required for identifying and responding to conditions resulting from a CCF in an automated safety system. For example, a failure to trip might not be as limiting as a partial actuation of an emergency core cooling system (ECCS), but with indication of a successful actuation. In cases such as this, it may take an operator longer to evaluate and correct the safety system failure than it would if there was a total failure to send any actuation signal. For this reason, the evaluation of failure modes as a result of CCF should include the possibility of partial actuation and failure to actuate with false indications, as well as a total failure to actuate in accordance with Section 3 of NUREG/CR-6303. The primary concern is that an undetected failure within a digital safety system could prevent proper system operation. A failure or fault that is detected can be addressed; however, failures that are non-detectable may