Document: NUREG-0800
Document ID: 324fd048-3706-4f47-8130-3ca734d7d820
Document Type: srp
Title: B-8
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1515/ML15159A226.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.1
CFR Part: 
CFR Title: 

Content:
Draft Revision 6 – August 2015 units is not impaired. The review of shared displays and controls should be coordinated with the organization responsible for the review of human factors to confirm that shared user interfaces are sufficient to support the operator needs for each of the shared units. The organizations responsible for the review of electrical systems and balance of plant systems review power source requirements. Reviewers in the organization responsible for the review of I&Cs should coordinate with these organizations to confirm that I&C protection system power sources are adequate. The review of channel integrity should confirm that the design provides for protection systems to fail in a safe state, or into a state that has been demonstrated to be acceptable on some other defined basis, if conditions such as disconnection of the system, loss of energy, or adverse environments are experienced. This aspect is typically evaluated through evaluation of the applicant’s or licensee’s failure modes and effects analysis. The analysis should justify the acceptability of each failure effect. RTS functions should typically fail in the tripped state. ESFAS functions should fail to a predefined safe state. For many ESFAS functions this predefined safe state will be that the actuated component remains as-is. 4.6. Channel Independence (IEEE Std 279-1971, Clause 4.6) Two aspects of independence should be addressed: • Physical independence. • Electrical independence. Guidance for evaluation of physical and electrical channel independence is provided in RG 1.75, “Criteria for Independence of Electrical Safety Systems,” which endorses IEEE Std 384, “IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits.” The applicant or licensee should confirm that the protection system design precludes the use of components that are common to redundant channels, such as common switches for actuation, reset, mode, or test; common sensing lines; or