Document: NUREG-0800
Document ID: f4b8f0c1-9a14-46be-88c9-a6cb74d64dff
Document Type: srp
Title: Rev. 4 — June 1997
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0525/ML052500499.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
he requirements of IEEE Std 603. Computer system software integrity (including the effects of hardware-software interaction) should be demonstrated by the applicant/licensee's software safety analysis activities. Section 3.1.i of BTP HICB-14 describes the acceptable characteristics of software safety plans. Section 3.2.a of BTP HICB-14 describes the characteristics of acceptable software safety analyses. Evaluation of computer system design for test and calibration is covered in item 12 below. The review of system integrity should confirm that the design provides for safety systems to fail in a safe state, or into a state that has been demonstrated to be acceptable on some other defined basis, if conditions such as disconnection of the system, loss of energy, or adverse environments are experienced. This aspect is typically evaluated through evaluation of the applicant/licensee's failure modes and effects analysis. The analysis should justify the acceptability of each failure effect. Reactor trip system (RTS) functions should typically fail in the tripped state. Engineered safety feature actuation system (ESFAS) functions should fail to a predefined safe state. For many ESFAS functions this predefined safe state will be that the actuated component remains as-is. Computer-based protection systems should, upon detection of inoperable input instruments, automatically actuate the protective functions associated with the failed instrument(s) (e.g., automatically place the affected channel(s) in trip. Hardware or software failures detected by self-diagnostics should also cause protective function actuation. Failure of computer system hardware or software should not inhibit manual initiation of protective functions or the operator performance of preplanned emergency or recovery actions. During either partial or full system initialization or shutdown after a loss of power, control output to the protection system actuators should fail to a predefined, preferred failure