Common Cause Failure Mitigation Experience on Digital I and C System in NPP
CCF is failures of redundant or separate structures, systems, or components due to a shared root cause. The CCF includes those are resulted from severe environments, design errors, calibration and maintenance errors, and consequential failures. In addition, digital I and C systems can be vulnerable to CCF caused by software errors or software developed logic, which could defeat the redundancy achieved by the hardware architecture. Therefore, diversity and defense in-depth (D3) has become an important issue to overcome the CCF of the safety I and C system. The U.S. NRC has established regulatory guidance addressing a method for assessing D3 provided by the safety I and C system architecture at a NPP. This method enables determination of whether vulnerabilities to CCF have been adequately addressed. The guidance is included in BTP 7-19 and Chapter 7 of NUREG-0800. The regulatory guidance provides a methodology for designing diversity. APR1400 establishes the mitigating strategies that consider the characteristics of digital I and C system that contribute to the potential for CCF. The diversity strategies consist of a combination of diversity attributes and associated criteria to address potential CCF vulnerabilities in digital safety I and C system. (authors)