Document: NUREG-0800
Document ID: 4865fc6d-b85f-4173-9bca-162fa9fe67d2
Document Type: srp
Title: Appendix 7-A
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0525/ML052500555.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
�� June 1997 BTP HICB-19-3 B. Branch Technical Position 1. Introduction Based on experience in detailed reviews, the Staff has established acceptance guidelines for D-in-D&D assessments. The Staff has identified four echelons of defense against common-mode failures: • Control system — The control echelon consists of that non-safety equipment which routinely prevents reactor excursions toward unsafe regimes of operation, and is used for normal operation of the reactor. • RTS — The reactor trip echelon consists of that safety equipment designed to reduce reactivity rapidly in response to an uncontrolled excursion. • ESFAS — The ESFAS echelon consists of that safety equipment which removes heat or otherwise assists in maintaining the integrity of the three physical barriers to radioactive release (cladding, vessel, and containment). • Monitoring and indicators — The monitoring and indication echelon consists of sensors, displays, data communication systems, and manual controls required for operators to respond to reactor events. As a result of the reviews of ALWR design certification applications that used digital protection systems, the NRC established the following position on D-in-D&D for the advanced reactors. Points 1, 2, and 3 of this position apply to digital system modifications to operating plants. 1. The applicant/licensee should assess the defense-in-depth and diversity of the proposed instrumentation and control system to demonstrate that vulnerabilities to common-mode failures have been adequately addressed. 2. In performing the assessment, the vendor or applicant/licensee shall analyze each postulated common-mode failure for each event that is evaluated in the accident analysis section of the safety analysis report (SAR) using best-estimate methods. The vendor or applicant/licensee shall demonstrate adequate diversity within the design for each of these events. 3. If a postulated common-mode failure could disable a safety function, then a