Document: NRC Regulatory Guide
Document ID: fc586342-92f7-4c77-ae76-79e3674cf288
Document Type: regulatory_guide
Title: Criteria for Programmable Digital Devices in Safety-Related Systems of  Nuclear Power Plants + HISTORY –HISTORY 02/2023 – DG-1374, Proposed Revision 4 Prior to issuance of DG-1374, RG 1.152 was entitled, “Criteria for Use of Computers in Safety-Systems of Nuclear Power Plants” 06/2010 – DG-1249, Proposed Revision 3 – Revise 12/2004 – DG-1130, Proposed Revision 2 – Revise 05/1995 – DG-1039, Proposed Revision 1 03/1983 – DG-1130, Proposed Revision 2 – Revise (Rev. 4)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML2301/ML23012A242.pdf
Revision Date: 2023-05
Chapter: 
Section ID: RG-1.152
CFR Part: 
CFR Title: 

Content:
afety-related systems that use digital communication may be more susceptible to due to the increased potential for errors to be introduced during communications processing and transmission. Sufficient independence should be incorporated into the instrumentation and control design to prevent (1) the propagation of faults from systems that are NSR to safety-related systems or (2) the propagation of faults between redundant portions of a safety-related system and (3) the effects of design-basis events on the safety-related system. Furthermore, sufficient independence should be incorporated to ensure the effectiveness of the redundancy provided in the instrumentation and control design for maximizing the reliability of systems that support safety functions. Clause 5.6 of IEEE Std 7- 4.3.2-2016 provides criteria that the NRC staff finds acceptable for maintaining independence between PDDs belonging to redundant safety divisions and between safety-related PDDs and NSR PDDs. In addition, the criteria for communication independence in Clause 5.6.4.2 should be supplemented with the following: 2.1.1 Provisions for interdivisional communication should be included to prevent the ability to send software instructions to a safety function processor that could adversely impact the processor’s functionality unless all safety functions associated with that processor are either bypassed or not in service. The progress of a safety function processor through its instruction sequence should not be affected by any message from outside its division. For example, a received message should not be able to direct the processor to execute a subroutine or branch to a new instruction sequence. 2.1.2 Data communication capacity (i.e., bandwidth) should be sufficient to prevent data congestion. 2.1.3 “Point-to-point” data communication means that the message is passed directly from the sending node to the receiving node without the involvement of equipment outside the division of the sending