Document: NUREG-0800
Document ID: 2dffe24e-cd37-4ffc-9c37-16faf25676b1
Document Type: srp
Title: Appendix 7-A
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0525/ML052500579.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
design should develop refined timing allocations down to unit levels in the software architecture. A design should be feasible with currently known methods and representative equipment. Design timing feasibility may be demonstrated by allocating a timing budget to components of the system architecture (Annex E of IEEE Std 7-4.3.2) so that the entire system meets its timing requirements. See also Sections 2.2, 2.3.1, and 2.3.2 of NUREG/CR-6083, and NUREG/CR-6082. The timing budget should include internal and external communication delays, with adequate margins. Any non-deterministic delays should be noted, and a basis provided that such delays are not part of any safety functions, nor can the delays impede any protective action. Software architectural timing requirements should be addressed in a software architectural description as described in BTP HICB-14. Databases, disk drives, printers, or other equipment or architectural elements subject to halting or failure should not be able to impede protective system action. Design Commitments Design basis documents should describe system timing goals. Timing requirements should be satisfied by design commitments. Design basis documents should identify design practices that the applicant/licensee will use to avoid timing problems. Risky design practices such as non-deterministic data communications, non-deterministic computation, use of interrupts, multitasking, dynamic scheduling, and event-driven design should be avoided. Where such practices are allowed, the applicant/licensee should describe methods for control of the associated risk. NUREG/CR-6082 and NUREG/CR-6083 describe risky design practices in more detail. Performance Verification The means proposed, or used, for verifying a system's timing should be consistent with the design. Testing should show that the system meets limiting response times for a reasonable, randomly-selected subset of system loads, conditions, and design basis events. The subset should