System Evaluation

DOE-STD -3009-94

4.3.X.4

System Evaluation

This subsection provides performance criteria imposed on the safe ty-class SSC

so it can meet functional requirement(s) and thereby satisfy its safety function.

Performance criteria characterize the specific operational responses and

capabilities necessary to meet functional requirements.

Engineering judgment may be used to develop performance criteria for

existing safety SSCs (i.e., already designed) where documentation of design

and operational responses may not exist. In determining performance criteria

for safety-class SSCs, existing criteria traditionally associated with safety-class

designation, such as single failure criteria, should be considered in the

judgment process. However, for existing SSCs, formal design comparison and

compliance with traditional safety-class performance criteria is not required.

Evaluate the capabilities of the SSC to meet performance criteria. The

evaluation should be as simple as possible, and rely on engineering judgment,

calculations, or performance tests as opposed to formal design reconstitution.

For example, the hydrogen detector could be fed a test gas composition that

would exceed its interlock trip point. Such a pass- fail test would typically

bound the needed equipment performance as response time is not a highly

sensitive parameter.

4.3.X.5

Controls (TSRs)

This subsection id entifies those assumptions requiring TSRs to ensure

performance of the safety function.

4.4

S A F E T Y-SIGNIFICANT STRUCTURES, SYSTEMS, AND

COMPONENTS

Relevant information is provided, in the following SSC specific subsections, with

descriptions sufficiently detailed to provide an understanding of the safety function

of safety-significant SSCs. Descriptions for each safety-significant SSC must be

complete enough to allow for verification of the accuracy of the safety analysis

inputs and assumptions.

Provide a summary list of safety-significant SSCs. This summary list should

identify, in tabular form, safety-significant SSCs, the rationale from Chapter 3 for

which safety-significant designation was made, safety functions, functional

requirements, and performanc e criteria judged to require TSR coverage. The

remaining subsections provide details that correlate to the summary list.

Note: The following format is repeated sequentially for each ("X") safety

significant SSC. The examples provided are for illustration purposes only, and

should not be construed as a requirement to designate such systems safety-class or

safety-significant.

Page 59