4.28. When diverse I&c systems are provided to meet requirements for defence-in-depth, the diverse systems should not both be subject to the same errors in design or fabrication.

4.29. Diversity is not required where the possibility of CCF is negligible .

4.30. Where independence is claimed between two systems (for example an NPP’s main reactor protection system and its diverse actuation system) through multiplying their failure probabilities within the PSA, then the system platforms should be diverse and that diversity should also extend to the plant sensors and actuators.

5. Safety classification of I&c functions, systems, and equipment

5.1. SSR 2/1 Requirement 22 states:

All items important to safety shall be identified and shall be classified on the basis of their function and their safety significance.

The method for classifying the safety significance of items important to safety shall be based primarily on deterministic methodologies complemented where appropriate by probabilistic methods, with account taken of factors such as:

(1) The safety function(s) to be performed by the item;

(2) The consequences of failure to perform the safety function;

(3) The frequency at which the item will be called upon to perform a safety function;

(4) The time following a postulated initiating event at which, or the period for which, it will be called upon to operate.

Equipment that performs multiple functions shall be classified consistent with the most important function performed.

5.2. Assessment of the consequences of potential I&C system failures during safety classification should take into account the possibility that the I&C system itself could cause a PIE as well as the combination of the probability and consequences of such a PIE

5.3. The timeliness and reliability with which alternative actions can be taken and the timeliness and reliability with which any failure in the I&C system can be detected and remedied may be considered when assigning the safety classification.

5.4. The various Member States use many different classification schemes. This guide does not recommend any specific scheme.

5.5. The following classification scheme is used to grade the recommendations of this guide according to safety significance.

5.6. All I&C functions, systems, and components fit into one of two safety categories: important to safety or not important to safety.

5.7. Functions, systems, and components important to safety are those whose malfunction or failure could lead to radiation exposure of the site personnel or members of the public.

5.8. Functions, systems, and components important to safety are further categorized as either safety or safety related.

5.9. Safety functions, systems, and components are those provided to ensure the safe shutdown of the reactor or the residual heat removal from the core, or to limit the consequences of anticipated operational occurrences (AOO) or design basis accidents (DBA).

5.10. Safety-related items are items important to safety that are not part of a safety system.

5.11. The classification scheme above can be mapped to most of the Member State classification schemes currently in use. Some Member States further divide the safety related or safety categories.

5.12. Figure 1 illustrates the relationship between these safety categories used in this guide. And the safety classifications that are typically assigned to commonly provided I&C functions.

5.13. In power reactors the following systems are typically classified as safety systems:

• Reactor protection system

• Some elements of the accident monitoring systems.

• The minimum I&C systems needed to achieve safe shutdown from normal operating or design basis accident conditions.

FIG. 1. Examples of I&C systems important to safety. (Examples are given for illustration. Some systems are listed in one column although they might also belong in another column, e.g. control room I&C.)