pfk REG q UNITED STATES

NUCLEAR REGULATORY COMMISSION - .WASHINGTON, D. C. 20555

NRC INSPECTION MANUAL RSIB

INSPECTION PROCEDURE 37700

DESIGN CHANGES AND MODIFICATIONS

PROGRAM APPLICABILITY: 2515, 2525

37700-01 INSPECTION OBJECTIVE

To verify that design changes and modifications which have been determined

by the licensee to not require approval by the NRC are in conformance with

the requirements of the Technical Specifications (TS), 10 CFR 50.59, the

Safety Analysis Report, the licensee's Quality Assurance Program and

10 CFR 50, Appendix B, Criterion III, "Design Control;" and to selectively R

verify adequacy of installation and testing of plant modifications. R

37700-02 INSPECTION REQUIREMENTS

02.01 Perform the following steps for design changes and modifications which

the licensee did not submit to the NRC for approval:

a. Select at least three design changes/modifications from the systems R

listed below for review/observation. If the licensee has divided

a major design change/modification into one or more subpackages for

partial completion over two or more outages, at least one of the three R

changes/modifications selected for review should be of this type.

This examination should be performed at least once every SALP cycle. R

The current risk significance of the system should be considered when R

selecting the changes/modifications for review: R

1. Reactor trip system.

2. Reactivity control.

3. Instrumentation: safety related and nonsafety-related: (e.g.,

SPDS, ATWS, etc.)

4. Reactor coolant system.

5. Emergency core cooling system (light-water reactor) or liner

cooling system (high temperature gas-cooled reactor).

6. Containment systems.

7. Plant and electrical power systems (safety related and nonsafetyrelated).

8. Radwaste system.

9. Power conversion systems.

Issue Date: 09/17/90
10. Safety significant balance of plant systems.

b. Verify that the design changes/modifications chosen in 02.01a were

reviewed and approved by on-site and off-site review organizations in

accordance with TS and established QA/QC program controls and did not

invalidate modifications made previously to the same system/component.

c. Verify that design changes/modifications selected in 02.01a were

controlled by approved procedures.

d. Verify by review of completed test records that the licensee conducted

a review and evaluation of test results prior to the modification

being declared operable and that:

1. Test results were within previously established acceptance

criteria.

2. Test deviations were reviewed, corrections were completed as

required, and retesting was accomplished as necessary prior to

final acceptance and operability.

3. Appropriate test requirements, including verification of scope,

were established by the responsible engineering organization when

applicable.

e. Verify that operating procedure and emergency operating procedure

modifications were made and approved prior to the modification being

declared operable in accordance with TS for those design changes/

modifications selected in 02.01a.

f. Verify that operator training programs were revised and that necessary

operator training was conducted prior to the modification being

declared operable to reflect the design change/modification that was

implemented.

g. Verify that prior to each design change/modification being declared

operable, the controlled copies of as-built documents used by the

plant operators were either revised and distributed, or were legibly

marked-up on an interim basis to show all changes relating to the

design change/modification(s). Also verify that administrative

controls and responsibilities were clearly established for the

following:

1. Marking of the as-built documents for design changes/modifications on an interim basis, including document review, approval,

and safeguarding the document and related papers until all

marked-up changes have been incorporated on the revised (updated/

final) documents.

2. Directions for users of the as-built document to use and refer to

the marked-up copy for the purpose of testing, maintenance and

future design change activities, until the revised as-built

document incorporating all marked-up changes is officially

issued.

Issue Date: 09/17/90 -2 - 37700
3. Revision of documents incorporating all marked-up changes, and

issuance and distribution in a timely manner.

4. Verification that the set of drawings maintained "as-built" is

adequate to support operations, maintenance and design.

h. Verify that design changes/modifications selected in 02.01a were

planned to be on or were listed on the required 10 CFR 50.59(b) annual

report to the NRC, and that appropriate FSAR revisions were planned or

completed.

i. Verify that preventive maintenance, inservice inspection (ISI), and

inservice test (IST) requirements for newly installed equipment were

added to or appropriately changed in the respective programs maintained and implemented by the licensee, prior to the modification

being declared operable.

j. For design changes/modifications that are partially completed, that

the integration of the modification into interfacing systems was

controlled by the licensee to ensure that:

1. If the modification was not completely operable (i.e., hardware

installed during one outage, but electrical hookup not scheduled

until the following outage), the licensee implemented positive

control of system boundaries.

2. The effects of partial completion of the modification were fully

considered in items e, f, g, h, and i, above; and the partially

completed status was adequately assessed in accordance with the

requirements of 10 CFR 50.59.

k. Verify that changes to the design as described in the FSAR were

properly controlled and documented in updates to the FSAR.

02.02 Select one temporary modification and selectively review the

implementation of program controls that require:

a. The review and approval of temporary modifications in accordance with

Section 6 of this TS, 10 CFR 50.59, and the approved QA program.

b. The use of detailed approved procedures when performing temporary

modifications.

c. Assigning responsibility for approving procedures inr02.02b.

d. Maintaining of a formal record of the status of temporary

modifications, lifted leads and jumpers, temporary strainers,

temporary trip setpoints of control equipment, etc.

e. Evaluation of the need for independent verification, where

appropriate, of installation and removal of temporary modifications,

lifted leads and jumpers.

37700 -3 - Issue Date: 09/17/90
f. Functional testing of equipment following installation of removal of

temporary modifications.

g. Periodic reviews of lifted lead and jumper records, including a check

of outstanding entries.

h. The correct installation of jumpers and/or lifted leads, i.e., that

the termination points/lift points are consistent with the design

package.

02.03 For one to three minor design changes/modifications not submitted to R

the NRC for approval (if applicable, select from those identified in R

accordance with 02.01) determine the schedule for installation and post- R

modification testing, and do the following: R

a. Verify that work is being performed by qualified workers in accordance R

with approved instructions, procedures, and drawings contained in the R

work package. R

b. Examine the installed hardware to selectively verify that the R

installation conforms to the as-built drawings. This verification R

process should selectively include confirmation that equipment model R

or serial numbers, dimensions, materials, sizes, and configurations, R

including mounting details, are correct. The hardware inspections for R

safety systems should verify that the system licensing design criteria R

approved by the NRC remains valid following the modifications (e.g., R

that separation is still maintained between redundant divisions; that R

fire protection requirements are still met; or that equipment qualifi- R

cation has been degraded). R

c. Inspect the modification at the installation phase to determine the R

extent to which jumpers and/or lifted leads are to be used and R

controlled during the installation phase and subsequent phases through R

the time that the modification is declared operational. R

d. Determine, through selective observations of the actual installation R

of hardware and associated activities in progress, whether the R

modified structures, systems, and components were properly prepared R

for preoperational testing. This determination should include obser- R

vations and selective examinations of the following preparations as R

appropriate: R

1. Preservation (e.g., painting). R

2. Wiring continuity, termination integrity, and separation checks. R

3. Cleaning and flushing. R

4. Calibration of instrumentation and setpoints. R

5. Hydrostatic pressure testing of fluid systems. R

6. Component functional testing including: R

(a) Trip testing of breakers. R

(b) Freedom of movement checks for mechanical components. R

(c) Rotational directional testing of prime movers. R

7. Structural concrete and structural steel tests. R

8. Greasing and lubrication. R

Issue Date: 09/17/90 -4 - 37700
9. Installation of packing and filtering materials. R

10. Connection of support systems. R

11. Reservoir filling and venting. R

12. Adjustment of limit switches, interlocks, and stops. R

13. Preventive maintenance (depending on the elapsed time between R

construction and commencement of preoperational testing). R

14. Torque and limit switch settings for MOVs. R

e. Selectively verify that the licensee's review and evaluation of com- R

pleted construction phase test procedures addressed whether test R

results were within previously established acceptance criteria, that R

test deviations were resolved, and that retesting was accomplished as R

appropriate. R

f. Selectively verify that pre-test training was conducted to ensure R

proper test performance and proper operation of new or modified R

equipment. R

g. Selectively verify that test procedures and changes thereto were R

reviewed and approved in accordance with TS and the licensee's admin- R

istrative procedures. R

h. Selectively verify that the licensee's review and evaluation of com- R

pleted test procedures addressed whether test results met previously R

established acceptance criteria, that test deviations were resolved, R

and that required retesting was accomplished prior to the next test- R

ing phase or release for operation. R

i. Review a sample of quality assurance records to verify that the test R

performance records received an independent QA audit in accordance R

with the licensee's approved QA program. R

j. Selectively verify that the testing criteria and results established R

that the levels of performance of new structures, systems, and compon- R

ents were as described in the license amendment application, if appli- R

cable, and in the detailed design documentation. R

37700-03 INSPECTION GUIDANCE

The Core Inspection Program (CIP) Task Group has recommended that IP 37700 be R

included within the CIP with a frequency of once every SALP cycle and be R

revised to emphasize that the inspection should include verification that R

hardware installations match the as-built drawings and that adequate post- R

modification testing is performed. Requirements and guidance found in R

IP 37828, "Installation and Testing of Modifications" have been incorporated R

into IP 37700 for this reason. The number of design changes/modifications R

requiring review has been reduced in recognition of the increase in attri- R

butes being inspected and the required frequency of inspection. R

03.01 General Guidance. Guidance related to the applicability of 10 CFR

50.59 to changes in the facility or procedures as described in the SAR, or

the conduct of tests and experiments not described in the SAR is discussed

in the 10 CFR 50.59 subsection of the Guidance section of the NRC inspection

37700 -5 - Issue Date: 09/17/90
Manual entitled, "Part 9900 CFR Discussions; Changes to Facilities, Procedures, and Tests (or Experiments)." Additionally, general guidance can be

found in ANSI N18.7-1976 and ANSI N45.2 and its daughter standards. Design

changes and modifications relating to low-level radioactive waste storage are

addressed in NRC Inspection Procedure 65051.

03.02 Specific Guidance

a. Inspection Requirement 02.01a. The licensee is required to determine

to which of the following categories a design change or modification

must be assigned:

1. Not subject to review pursuant to 10 CFR 50.59. This category is

only appropriate for facility changes that do not change the

description as stated in the FSAR nor fit the 10 CFR 50.59

conditions.

2. Subject to review pursuant to 10 CFR 50.59. Design changes or

modifications that cause a system or component described in the

FSAR to be changed require a written 10 CFR 50.59 safety evaluation to assess whether the change constitutes an unreviewed

safety question or a change to the facility TS. This written

safety evaluation must provide an adequate basis for determining

that the design change or modification:

(a) does not require NRC approval because TS need not be changed

or an unreviewed safety question is not relevant, or

(b) requires NRC approval because of the need for a change in TS

or the existence of an unreviewed safety question.

Regardless of the category to which the selected design change is

assigned by the licensee, the inspector should verify that the written

basis upon which the determination was made is technically correct and

that the questions necessary to determine whether the design change

constitutes an unreviewed safety question pursuant to 10 CFR 50.59

have been considered by the licensee in the safety evaluation. These

questions are:

" Does the design change increase the probability of occurrence or

the consequences of an accident or malfunction of equipment

important to safety, as previously evaluated in the updated FSAR?

o Does the design change create a possibility for an accident or

malfunction of a different type than any evaluated previously in

the updated FSAR?

" Does the design change reduce the margin of safety as defined in

the basis for any technical specification?

For significant design changes that affect several plant systems, an

integrated safety evaluation should be performed in addition to

discipline-specific safety evaluations to ensure that a comprehensive

review of the change against the design objectives of affected plant

systems is conducted.

Issue Date: 09/17/90 -6 - 37700
It has been found that the licensees' philosophical approach to 10 CFR

50.59 safety evaluations has sometimes placed significance on identifying potential failure modes instead of examining the potential

consequences of system or component failures. The inspector should

ensure that the licensee examined potential consequences of system or

component failures in conducting the 10 CFR 50.59 safety evaluation

for design changes and modifications (i.e., the question "what would

happen if..." was explored and answered during the conduct of the

safety evaluation).

If the licensee revised the initial determination from category 1 to

2.(a) as identified in Section 03.02.a, the inspector should ensure

that the root cause for the incorrect initial determination was

identified and made known to all groups who participated in the

initial review. This action by the licensee is necessary to prevent

recurrence of the problem.

If the licensee revised the initial determination from either categories 1 or 2.(a) to 2.(b) subsequent to the implementation of the

modification or to correct an event or condition that was the subject of a 50.72 or 50.73 report, the inspector should ensure that the

licensee made prompt notification to the NRC pursuant to 10 CFR 50.72

and 50.73. Additionally, the inspector should verify that commitments

made by the licensee regarding specific corrective action were fully.

implemented in the required time frame and the licensee submitted an

application for amendment of the license pursuant to 10 CFR 50.90. A

determination change of this nature by the licensee warrants the

consideration of enforcement action by the NRC.

The sample of design change/modification to be inspected should be

selected from the listing of subsystems identified in the standard TS.

The failure of certain nonsafety-related mechanical systems could

result in adverse environmental conditions (e.g., high energy line

break, flooding) or unwarranted challenges to safety-related systems.

Thus, modifications to these systems will be subject to periodic

review under this inspection procedure. Likewise, modifications

to nonsafety-related electrical/instrumentation systems, should be

reviewed to ensure that failures cannot compromise safety-related

electrical/instrumentation systems due to a lack of physical separation, isolation, or the imposition of excessive loads. The sample

also should be rotated such that each subsystem is sampled. It should

be evident to the inspector that the licensee made the evaluations

required by 10 CFR 50.59(a)(2).

b. Inspection Requirement 02.01b. Requirements for the plant and corporate safety committees or review groups to review proposed design

changes and modifications are defined in the TS. The QA program for

design control should be defined in Section 17.2.3 of the FSAR. The

inspector should also refer to Inspection Procedure 37702, "Design

Changes and Modifications Program," for information regarding QA

controls for design change. The inspector should ensure that the

design changes were subject to the same level of engineering review

37700 -7 - Issue Date: 09/17/90
and approval as the original design, including definition of testing

requirements.

The inspector should give consideration to whether the modification

under review compromised the original design bases and margins for the

applicable system/component. Regarding multiple design changes to

the same system/component, the possibility exists that the latest

design change could have invalidated a design change previously made.

As an example, a licensee made a modification to a diesel generator

control circuit that invalidated a prior modification partly because

the drawings used to design the second modification did not reflect

the first modification. The probability of this situation occurring

increases if the design changes to the same system/component were made

within a short period of time to one another.

c. Inspection Requirement 02.01c. Work procedures should normally

include:

1. Identification of specifications, guides, and codes governing the

work.

2. Identification of inspections required by codes or standards.

3. Acceptance tests which stipulate acceptance values or performance

requirements.

4. QA/QC requirements.

d. Inspection Requirement 02.01d. Acceptance tests which define acceptance values or performance requirements should be consistent with TS,

SAR, and NRC requirements.

e. Inspection Requirement 02.01e. Other documents, such as vendor

technical manuals, that could be affected by the design change should

be verified as having been revised. Additionally, ascertain whether

personnel involved in the change are properly qualified and knowledgeable. Licensed operators are required by 10 CFR 55, Appendix A,

Section 3.c to be cognizant of all facility design changes.

f. Inspection Requirement 02.01g. Modifications to the plant systems may

result in design changes which in some cases may be very extensive.

In these cases, the affected design documents should be expected to be

revised and issued before implementation of the modification. In

other cases where design changes are minimal, the affected documents

are updated by marking-up the design changes on a controlled set of

documents on an interim basis, pending completion of the document

revision, review and approval cycle. In every case, whether updating

of the document is done by revising or through interim mark-up, the

updating must be completed prior to the modification being declared

operable. Drawings changed by the modification should indicate that a

change is outstanding until all work (including drawing change) is

complete. If the drawing mark-up is for a temporary modification, the

applicable document shall clearly show period of time of its validity.

In cases where documents have been updated through a temporary

mark-up, revision of the document to incorporate the marked-up changes

should be done in a timely manner following the modification. The

Issue Date: 09/17/90 - 8- 37700
timeliness of document revision should be consistent with the safety

function of the modified system. Effects of marked-up design changes

should not preclude the document being a "useable" reference document,

i.e., without clutter which could cause difficulties in determining

the actual installed configuration. The marked-up document should be

referred to for testing, maintenance and future design change activities until the revised document is issued.

g. Inspection Requirement 02.01h. Paragraph (b) of 10 CFR 50.59 requires

the licensee to furnish to the NRC annually or at shorter intervals, a

report containing a brief description of facility and procedure

changes as described in the FSAR as well as tests and experiments not

described in the FSAR which were performed or implemented without

prior Commission approval. The report must contain a brief summary of

the safety evaluation made for each change, test, or experiment

reported. Annual operations reports are most often used as the

vehicle for reporting this information.

h. Inspection Requirement 02.029. The installation of a jumper or the

lifting of a lead in a nuclear safety-related circuit constitutes a

modification to the circuit. In general, the installation of jumpers

and the lifting of leads should be carefully controlled. A formal

control of such jumpers is required according to Section 5.2.6 of ANSI

N18.7-1976 and Section 6.5 of TS. The use of mechanical devices such

as dutchmen, temporary strainers, blind flanges, or piping bypasses

also constitutes system modifications and must be controlled. Such

modifications that result in changes to the system or component description in the FSAR require written safety evaluations pursuant to

10 CFR 50.59 as well as review and approval by a committee so charged

by TS, or other required method.

It is not intended that the inspection requirements identified in

02.03 be applied to test leads used in the performance of routine

surveillance testing. Installation and removal of such test leads

should be controlled by the respective test procedure. Additionally,

it is not intended that the inspection requirements of 02.03 be

applied to hand-held jumpers used for trouble shooting or maintenance

checks on equipment that has been removed from service.

However, if a jumper or lifted lead is physically installed, even

temporarily, it should be controlled and accounted for. Control may

be accomplished via steps in properly approved procedures, such as

maintenance procedures, or by the use of a jumper control log and

administrative procedures. Independent verification of jumper installation and removal is required by Section 5.2.6 of ANSI N18.7-1976.

Guidance regarding review of temporary modifications pursuant to

10 CFR 50.59 can be found in the 10 CFR subsection of the Guidance

section of the NRC Inspection Manual entitled, "Part 9900 CFR Discussions; Changes to Facilities, Procedures, and Tests (or Experiments)."

37700 - 9- Issue Date: 09/17/90
i. Inspection Requirement 02.03a. R

1. Selectively examine the licensee's records to verify that the R

drawings, procedures and instructions have the appropriate revi- R

sion number. R

2. On a sample basis, interview workers for familiarity with the R

requirements of the work package. R

3. Audit the licensee's training records selectively to determine R

worker training lever and currency. R

j. Inspection Requirement 02.03c.

IEEE Standard 338, "IEEE Standard Criteria for the Periodic R

Periodic Testing of Nuclear Power Generating Station Safety Systems," R

as supplemented by Regulatory Guide (RG) 1.118, "Periodic Testing of R

Electric Power and Protection Systems," provides guidance for compli- R

ance with the Commission's regulations concerning periodic testing of R

safety systems; namely, GDC 21, "Protection System Reliability and R

Testability," and Section 4.10 (Capability for Test and Calibration) R

of IEEE Standard 279, "Criteria for Protection Systems for Nuclear R

Power Generating Stations." This guidance states that procedures for R

periodic tests should not require makeshift test setups (i.e, abnor- R

mal circuit configurations involving the installation of jumpers, R

lifting leads, pulling fuses tripping breakers, blocking relays, R

etc.) The removal of fuses during periodic testing is only allowed R

if such action causes the protection action to occur; and the use of R

jumpers is only allowed for the connection of portable test equipment R

via permanently installed test connections designed to the same R

standards as the system being tested. R

Although the incentive to install jumpers and/or lift leads may exist R

during the implementation of design changes/temporary modifications, R

these practices (along with pulling fuses, blocking relays, tripping R

breakers, etc.) should be carefully controlled. Operating experience R

indicates that inoperability of safety systems frequently results fol- R

lowing maintenance (including design changes/modifications), surveil- R

lance and testing activities, due to human errors involving such prac- R

tices. These errors occur at commercial reactor facilities despite R

the existence of "strict administrative controls." IE Information R

Notice 84-37, "Use of Lifted Leads and Jumpers During Maintenance or R

Surveillance Testing," discusses the potential for significant degrad- R

ation of safety systems associated with the use of jumpers and lifted R

leads during either maintenance or surveillance testing. Even though R

many facilities have post maintenance/surveillance procedures that R

require independent verification of proper system realignment, errors R

still occur. Operating experience has disclosed a number of short- R

comings with administrative controls/procedures including poor coord- R

ination between multiple procedures used to accomplish a given task, R

inconsistent nomenclature, poor format, improper numbering, direct- R

Issue Date: 09/17/90 - 10 - 37700
ions not given for all alternatives, and procedures which do not accu- R

rately reflect the installed design. A staff audit of plant procedures R

incorporating the independent verification concept found that, in most R

cases examined, the independent verification was not truly independent R

(e.g., the two operator/technicians performed the verification walk- R

through together, or the second person used the same checklist filled R

out by the first person.) Also, IE Information Notice 84-51, "Inde- R "pendent Verification," discusses personnel errors and procedural R

errors that have resulted in safety related equipment being inadever- R

tently placed in an inoperable status. R

10 CFR Part 55a(h) endorses IEEE Standard 279, "Criteria for Protec- R

tion Systems for Nuclear Power Generating Stations." Section 4.13 R

(Indication of Bypassed) of IEEE Standard 279 requires that, if the R

protective action of a portion of a safety system has been bypassed or R

deliberately rendered inoperative for any purpose, this fact shall be R

continuously indicated in the control room. This requirement is R

intended to ensure that sufficient information concerning the inop- R

erable status of redundant portions of plant safety systems is R

provided to the operators such that they are continually aware of R

their status and can make knowledgeable decisions regarding their R

availability for use during accident conditions. Additional guidance R

concerning bypass indication is provided in RG 1.47, "Bypassed and R

Inoperable Status Indication for Nuclear Power Plant Safety Systems." R

NUREG/CR-3621, "Safety System Status Monitoring," published in March R

1984, emphasizes the importance of monitoring the status of safety- R

related systems or components designed to respond to plant transient R

and accident conditions, and which are routinely made inoperable R

during periodic tests or maintenance, or intentionally disabled for R

other reasons. NUREG/CR-3621 identifies some of the tasks associated R

with monitoring the inoperable status of safety systems, such as ver- R

ifying the operability of redundant systems, updating status boards, R

and determining system status during all modes of operation, as tasks R

that are important to plant safety, and which are also prone to human R

errors. The deliberately induced inoperable status of safety systems R

(for the purposes of performing routine maintenance/surveillance act- R

ivities or for implementing design changes/modifications) should be R

continuously indicated in the control room for as long as the inoper- R

able condition exists. R

NUREG/CR-3621 also identifies tasks involving completion of jumper and R

lifted lead forms, removal of jumpers and reinstallation of lifted R

leads, and obtaining proper authorization for the repositioning of R

jumpers and lifted leads, as tasks that are very important to the R

plant safety. R

k. Inspection Requirement 02.03e. Test procedures should normally in- R

clude: R

1. Procedures scope and objective. R

2. Prerequisites. R

3. Precautions. R

4. Limitations and action. R

5. Acceptance criteria. R

37700 - 11 - Issue Date: 09/17/90
6. Checkoff lists. R

7. Reference to the application, TS, drawings, specifications codes, R

commitments or other requirements. R

8. Provision for recording details of the conduct of the test, R

including observed deficiencies, resolution and retest. R

9. Requirements that valve lineups, temporary connections, discon- R

nections, or jumpers be restored to normal, or reference to R

another procedure governing these requirements. R

10. Provision for identification of personnel conducting the test- R

ing and evaluation of test data, or reference to another test R

for this information. R

11. Provision for quality control verification of critical steps or R

parameters. R

12. Based on the complexity of the changes, additional testing guid- R

dance may be found in Inspection Procedure 72701, "Modification R

Testing". R

37700-04 INSPECTION RESOURCES

On the average, 60 direct inspection hours are allotted for the completion of R

this procedure. R

37700-05 REFERENCES

10 CFR 50.59

10 CFR 50.72

10 CFR 50.73

10 CFR 50.90

10 CFR 50, Appendix A

10 CFR 50, Appendix B

10 CFR 50.59 subsection of the Guidance section of the NRC Inspection Manual

NRC Inspection Procedures 65051 and 72701

Technical Specifications, Section 6.5

FSAR, Section 17.2.3

ANSI N18.7-1976

ANSI N45.2 and its daughter standards

ANSI NQA-1 and NQA-2

END

Issue Date: 09/17/90 - 12 - 37700