IEEE Std 379-2014 pdf download – IEEE Standard for Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems.
4. Statement of the single-failure criterion The safety systems shall perform all required safety functions for a design basis event in the presence of the following:  Any single detectable failure within the safety systems concurrent with all identifiable but non- detectable failures  All failures caused by the single failure  All failures and spurious system actions that cause or are caused by the design basis event requiring the safety function The single failure could occur prior to, or at any time during, the design basis event for which the safety system is required to function. 5. Requirements 5.1 Independence and redundancy The principle of independence is basic to the effective utilization of the single-failure criterion. The design of a safety system shall be such that no single failure of a component will interfere with the proper operation of an independent redundant component or system.
5.2 Nondetectable failure The detectability of failures is implicit in the application of the single-failure criterion. Detectability is a function of the system design and the specified tests. A failure that cannot be detected through periodic testing or revealed by an alarm or anomalous indication is nondetectable. An objective in an analysis of safety systems is to identify nondetectable failures. Nondetectable failures should be identified by performing an evaluation of the safety system design that includes postulated component level failures and evaluating the effects of these failures including the ability to detect them. Some designs include redundant components to mitigate the effects of a failure, to improve system availability, or to support maintenance without impacting system availability. When evaluating the effects of a failure in such a configuration, care shall be taken to identify components whose failure will not be revealed by periodic test, alarm or anomalous indication. When nondetectable failures are identified, one of the following courses of action shall be taken:  Preferred course: The system or the test scheme shall be redesigned to make the failure detectable  Alternative course: When analyzing the effect of each single failure, all identified nondetectable failures shall be assumed to have occurred. 5.3 Cascaded failures Whenever the design is such that additional failures could be expected from the occurrence of a single failure, these cascaded failures shall be included in the single-failure analysis.