Document: NUREG-0800
Document ID: 106978f1-fb10-4fa9-ad95-601f3c16bd36
Document Type: srp
Title: Revision 5 - March 2007
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0705/ML070550072.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
with respect to the above criteria must be justified. Interconnections between the RTS and ESFAS (for interlocks providing for reactor trip if certain ESFs are initiated, ESF initiation when a reactor trip occurs, or operating bypass functions) are permitted if it can be demonstrated that the functions required by the ATWS rule (10 CFR 50.62) are not impaired. NUREG/CR-6303, Section 3.2, describes six types of diversity and describes how instances of different types of diversity might be combined into an overall case for the sufficiency of the diversity provided. Typically, several types of diversity should exist, some of which should exhibit one or more of the stronger attributes listed in NUREG/CR-6303. Functional diversity and signal diversity are considered to be particularly effective. The following cautions should be noted where applicable: • The justification for equipment diversity, or for the diversity of related system software such as a real-time operating system, must extend to the equipment's components to assure that actual diversity exists. For example, different manufacturers might use the same processor or license the same operating system, thereby incorporating common failure causes. Claims for diversity based just on difference in manufacturer name are insufficient without consideration of the above. BTP 7-19-7 Revision 5 - March 2007 • With respect to software diversity, experience indicates that independence of failure causes may not be achieved in cases where multiple versions of software are developed using the same software requirements. Other considerations, such as functional and signal diversity, that lead to different software requirements form a stronger basis for diversity. Displays and manual controls provided for compliance with Point 4 of the NRC position on D3 should be sufficient both for monitoring the plant state and to enable control room operators to actuate the systems that will place the plant in a hot shutdown condition.