Document: NUREG-0800
Document ID: 65f2433f-2c4a-4580-b173-0c6da7fa4d73
Document Type: srp
Title: Draft Revision 7 – August 2015
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1515/ML15159A996.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
ponent of a system can be fully tested, then it can be considered not to have a potential for software-based CCF. Fully tested or 100% testing means that every possible combination of inputs and every possible sequence of device states are tested, and all outputs are verified for every case. Further, in assessing the system states, the guidance provided in IEEE Std 7-4.3.2, Clause 5.4.1, “Computer System [Equipment Qualification] Testing,” should be addressed: Computer system [equipment] qualification testing (see 3.1.36) shall be performed with the computer functioning with software and diagnostics that are representative of those used in actual operation. All portions of the computer necessary to accomplish safety functions, or those portions whose operation or failure could impair safety functions, shall be exercised during testing. This includes, as appropriate, exercising and monitoring the memory, the CPU, inputs and outputs, display functions, diagnostics, associated components, communication paths, and interfaces. Testing shall demonstrate that the performance requirements related to safety functions have been met. The use of the term “software” or “software-based” should be extended to any form of logic that is used in a safety system to accomplish a safety system function and relies upon the use of software for its development. Similarly, the use of the phrase “All portions of a computer” should be extended to “All components of a safety system relying upon a software development system.” BTP 7-19-18 Draft Revision 7 – August 2015 Clause 5.4.1 of IEEE Std 7-4.3.2 directs the system developer or user to perform equipment qualification of the system (i.e., hardware and software) in its operational states while the system is operating at the limits of its equipment qualification envelope. The logic and diagnostics should be representative of the logic used in actual operation to a degree that provides assurance that the system states