Document: NUREG-0800
Document ID: 106978f1-fb10-4fa9-ad95-601f3c16bd36
Document Type: srp
Title: Revision 5 - March 2007
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0705/ML070550072.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
the system is of sufficient quality to perform the necessary function under the associated event conditions. Point 4 A set of displays and controls located in the main control room should be provided for manual system-level actuation of critical safety functions and for monitoring of parameters that support safety functions. The displays and controls should be independent and diverse from the computer-based safety systems identified in Points 1 and 3. The above four-point position is based on the NRC concern that software design errors are a credible source of common-cause failures. Software cannot typically be proven to be error-free and is therefore considered susceptible to common-cause failures because identical copies of the software are present in redundant channels of safety-related systems. For digital system modifications to operating plants, retention of existing displays and controls in the main control room may satisfy Point 4. To defend against potential common-cause failures, the staff considers high quality system designs, including the use of defensive design measures to avoid or tolerate faults and to cope with unanticipated conditions, and D3 to be key elements in digital system design. High-quality software and hardware reduce failure probability. However, despite high quality of design and use of defensive design measures, software errors may still defeat safety functions in redundant, safety-related channels. Therefore, as set forth in Points 1, 2, and 3, the Staff requires that the applicant/licensee perform a D3 assessment of the proposed digital I&C system to demonstrate that vulnerabilities to common-cause failures have been adequately addressed. In this assessment, the applicant/licensee should analyze design basis events (as identified in the SAR). If a postulated common-cause failure could disable a safety function that is required to respond to the design basis event being analyzed, a diverse means of effective response (with documented