Document: NUREG-0800
Document ID: 988a555f-fdfa-4452-829d-c06654bfbba5
Document Type: srp
Title: Initial Plant Test Program - Design Certification and New License Applicants
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660618.pdf
Revision Date: 2023-06
Chapter: 14
Section ID: 14.2
CFR Part: 
CFR Title: 

Content:
otherwise be demonstrated. In addition, the ITAAC should verify that the protection system was designed to permit periodic testing of its functioning with the reactor in operation, and this capability includes testing channels independently to identify any failures or losses of redundancy that may have occurred. • GDC 22, as it pertains to protection system independence. The ITAAC should verify that the safety-related I&C systems were designed so that neither natural phenomena, nor normal operating, maintenance, testing, and postulated accident conditions should affect redundant channels in a manner that results in loss of the protection function. Alternatively, the ITAAC should demonstrate on some other defined basis that (1) the safety-related I&C systems offer acceptable independence of the protection system, and (2) design techniques, such as functional diversity or diversity in component design and principles of operation, were used to prevent loss of the protection function. • GDC 23, as it pertains to protection system failure modes. The ITAAC should verify that the safety-related I&C systems were designed to fail into a safe state or into a state that is demonstrated to be acceptable if they experience conditions such as disconnection of the system, loss of energy, or postulated adverse environments. • GDC 24, as it pertains to separating protection systems from control systems. The ITAAC should verify that the safety-related I&C systems were separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems, leaves intact a system that satisfies all reliability, redundancy, and independence requirements of the protection system. In addition, the ITAAC should verify that interconnection of the protection and control systems was sufficiently limited to ensure that safety is