**NRC INSPECTION MANUAL**	            NMSS/DFM

INSPECTION PROCEDURE 88135 ATTACHMENT 17

RESIDENT INSPECTION PROGRAM

PLANT MODIFICATIONS

Effective Date:  01/01/2021

PROGRAM APPLICABILITY:  2600C

88135.17-01	INSPECTION OBJECTIVES

The objective of the procedure is to provide requirements and guidance for evaluating the licensee’s implementation of their configuration management system (CMS) for facility changes or modifications program to ensure that safety-related systems, structures, and components (i.e., Items Relied on for Safety (IROFS) or other credited safety controls) can adequately perform their intended safety function and that changes have not adversely impacted the operability and safety of the facility.

88 135.17-02	GENERAL GUIDANCE

Title 10 of the *Code of Federal Regulations* (CFR) Part 70.72, “Facility changes and change process,” establishes requirements for licensees to have a CMS to evaluate, implement, and track each change to the site, structures, processes, systems, equipment, components, computer programs, and activities of personnel.  Additionally, 70.72 establishes the conditions under which licensees may make changes without prior NRC approval.

Regulatory Guide (RG) 3.74 “Guidance for Fuel Cycle Facility Change Process,” describes the types of changes for which fuel cycle facility licensees should seek prior approval from the NRC and discusses how licensees can evaluate potential changes to determine whether NRC approval is required before implementing a change.  This regulatory guide also describes the level of information, and one method, that the NRC staff considers acceptable for use in documenting and reporting changes made without prior NRC approval.  The inspectors should use the guidance contained in RG 3.74 to assist them in their review of 10 CFR 70.72 evaluations.  In addition, the inspectors should verify that the 10 CFR 70.72 evaluation properly concludes whether NRC pre-approval of the change was required.

The review of design aspects for a modification should focus on conformance to relevant design criteria, not the programmatic elements of licensee programs.  Consider inspecting only those design parameters which are significant for the particular modification being reviewed. Modifications to one system may also affect the design bases and functioning of interfacing systems.  In addition, similar modifications to several systems could introduce potential for common cause failures that affect facility risk.  For temporary modifications, identification of temporary modifications on drawings and at placement of appropriate tags for equipment being affected by the temporary modification should make operators aware of their impact on the operation of plant equipment and components. 

Review of modifications being actively installed (and, if applicable, the restoration from a temporary modification) should ensure that the impact on the operation of other equipment is expected and previously analyzed, and should verify all unexpected effects were subsequently evaluated resulting in no significant impact on the safe operation of equipment or facility.

The review of post-installation test results should ensure that the parent system and/or affected IROFS remain operable and that their safety functions have not been impaired. 

NOTE:  Potential issues regarding the impact that changes have on Emergency Preparedness and Security should be raised and addressed under their respective inspection procedures.

§ 70.72 Facility changes and change process.

For each sample, conduct a routine review of problem identification and resolution activities using the guidance in Inspection Procedure (IP) 88135.02, “Resident Inspector Program Plant Status,” Section 03.05, “Identification and Resolution of Problems.”

88135.17-03	INSPECTION REQUIREMENTS AND INSPECTION GUIDANCE

03.01	Facility Change/Modifications.

a. Inspection Requirement.  Verify that licensee facility change/modification evaluations were performed in accordance to the CMS required in10 CFR 70.72 and/or the license application.

b. Inspection Guidance.  

1. Select facility changes or modifications to be inspected, based on the risk significance of the equipment and/or process(es) involved.  The annual summary of changes required by 10 CFR 70.72 (d)(2) and (d)(3) (or as stated in the license) is generally a good source for sample selection; however, preference should be given to reviewing changes as they occur.  Routine configuration change management meetings, as part of the licensee’s CMS program, is the best source for resident inspectors to gather information on upcoming facility changes.  During selection, prioritize modifications which impact safety controls, however, consider selecting samples in different categories to verify the licensee properly implemented a graded approach to reviews.  Consider the following types of changes for the sample selection:

(a) Major modifications that involve the design of new processes at existing facilities,

(b) Hardware or field changes potentially involving Items Relied on for Safety (IROFS) or credited safety controls,

(c) Software modifications potentially related to licensed material,

(d) Minor modifications to non-safety equipment that do not trigger in-depth reviews,

(e) Procedure changes for operations potentially-related to licensed material,

(f) Like-for-like replacements of hardware, 

(g) Temporary modifications related to licensed material operations,

(h) Changes that impacted the Integrated Safety Analysis (ISA) Summary, and/or

(i) Changes made to the license application both approved by the NRC and those not submitted to the NRC under a license amendment.

2. During the review, the inspector should verify that facility change evaluations address the following aspects:

(a) Ttechnical basis for the change.  The technical basis should provide (1) an explanation of the proposed change, (2) what is to be changed and how, and (3) is the change safe to make and why.  The level of detail in the document should be commensurate with the complexity and safety significance of the change.  For example, a minor change with little or no safety impact may only require a simple qualitative explanation.  However, for more complex changes, it may be necessary to develop calculations, technical reports, and safety evaluations to serve as the technical basis for the change.  At a minimum, there should be enough information available to allow appropriate supervisory, management, technical, and regulatory review of the change to ensure it will not adversely impact nuclear or chemical safety.

(b) Impact of the change on safety and health or control of licensed material.  Verify the licensee adequately evaluated each change and reached the proper conclusion as to whether the change could be made without prior NRC approval.

(c) Modifications to existing operating procedures including any necessary training or retraining before operations.  Verify the licensee has updated the affected operating procedures and conducted training on the modified procedures prior to beginning operations.  Review a sample of operator training records for specific changes to assess whether the level of training provided is consistent with the training requirements in the license.

(d) Review and authorization requirements for the change.  Facility changes are typically required to be reviewed by impacted safety groups such as Nuclear Criticality Safety (NCS), Emergency Preparedness, Environmental, Fire Protection, ISA, Licensing, Radiological Protection, Operations, and Security prior to authorizing the change.  The purpose of the review by impacted safety groups is to (1) concur on the change, (2) identify potential impacts to the safety or licensing basis, and (3) identify action items and documents that will require revision in support of the change.  Authorization is typically documented on a work clearance permit or other similar form or may take the form of signature or a time/date stamp in a CMS software program.  For the selected change(s), the inspector should verify action items identified by the review process were completed prior to field implementation.  

(e) Approved duration of temporary[footnoteRef:2] changes.  If the modification was temporary, confirm that the duration of the change was approved and adequate. CMS procedures may allow extensions to temporary modifications with the proper approvals and justification.  In some cases, the licensee may place a limit on the number of extensions that can be granted or may require higher levels of approval for multiple extensions  If the inspector identifies multiple temporary modifications that have exceeded their approved duration consider reviewing the licensee’s temporary modification control process to evaluate whether the issues are isolated or if there are associated programmatic performance issues.  [2:  Temporary modifications may include jumpers, lifted leads, temporary systems, repairs, design modifications and procedure changes which can introduce changes to facility design or operations.] 

(f) Impacts or modifications to the ISA or other safety program information. The inspector should verify that facility change evaluations determine if the modification results in an impact to the Integrated Safety Analysis (ISA), ISA Summary, or other safety program information developed in accordance with 10 CFR 70.62.  This evaluation is typically documented on a 10 CFR 70.72 evaluation form. Safety program documents that could be impacted by modifications include procedures, drawings, technical documents, engineering calculations, process hazard analysis (PHA), and training records.  There may also be questions to determine if the change impacts other licensing basis documents such as the Emergency Plan, Fundamental Nuclear Material & Control Plan (FNMCP), Quality Assurance Plan (QAP), and license application.  The inspector should review the modification package to verify impacted documents are properly identified. 

3. For modifications that did not require a license amendment, the inspector should verify the licensee’s evaluation provided valid technical basis to confirm the modification did not:

(a) Create new types of accident sequences that, unless mitigated or prevented, would exceed the performance requirements of 10 CFR 70.61 and that have not previously been described in the ISA summary (see 10 CFR 70.72(c)(1)(i)).

(b) Use new processes, technologies, or control systems for which the licensee has no prior experience (see 10 CFR 70.72(c)(1)(ii)). 

(c) Remove, without at least an equivalent replacement of the safety function, an IROFS that is listed in the ISA summary and is needed for compliance with the performance requirements in 10 CFR 70.61 (see 10 CFR 70.72(c)(2)).

(d) Alter any IROFS listed in the ISA summary that is the sole item preventing or mitigating an accident sequence that exceeds the performance requirements in 10 CFR 70.61 (see 10 CFR 70.72(c)(3)).

(e) Is not otherwise prohibited by the license.

Based on the guidance contained in RG 3.74, it is acceptable for 10 CFR 70.72 evaluations to take the form of a simplified “yes/no” checklist unless the change is directly associated with one of the 10 CFR 70.72 evaluation criteria listed above.  For example, changes to a sole IROFS should demonstrate that the change is not an alteration (i.e., the change will not modify, positively or negatively, any of the attributes associated with the safety function of the IROFS).  The justification for answering “no” should be clearly documented in the 10 CFR 70.72 evaluation and simply checking the box “no” would not be an acceptable response.  The inspectors should use the guidance contained in RG 3.74 to assist them in their review of 10 CFR 70.72 evaluations.  In addition, verify that the 10 CFR 70.72 evaluation properly concluded whether NRC pre-approval of the change was required.

4. For changes that involved new processes verify the licensee addressed the baseline design criteria requirements of 10 CFR 70.64. 

(a) Quality standards and records.  The inspectors should verify the design of the new process was developed and implemented in accordance with management measures such that the performance requirements of 10 CFR 70.61 will be met.  The inspector should determine whether appropriate records of these items (post maintenance testing and walk downs, accident sequence assessment, operator training, etc.) are being held by the facility until license termination.

(b) Natural phenomena hazards.  The inspector should verify the design provided adequate protection against the most severe documented historical natural phenomena event for the site.

(c) Fire protection.  The inspector should verify the design provided adequate protection against fires and explosions.

(d) Environmental and dynamic effects.  The inspector should verify the design adequately accounted for the environmental conditions and dynamic effects associated with normal operations, maintenance, testing, and postulated accidents that could lead to loss of safety functions.

(e) Chemical protection.  The inspector should verify the design adequately protects against chemical risks produced from licensed material, facility conditions which affect the safety of licensed material, and hazardous chemicals produced from licensed material.

(f) Emergency capability.  The inspector should verify the design provided emergency capabilities to maintain control of licensed material and hazardous chemicals produced from licensed material in case of an accident.  Verify the evacuation of on-site personnel was considered and on-site emergency facilities and services that facilitate the use of available offsite services would be able to effectively provide support.

(g) Utility services.  The inspector should verify the design provided continued operation of essential utility services.

(h) Inspection, testing, and maintenance.  The inspector should verify the design of IROFS provided for adequate inspection, testing, and maintenance, to ensure their availability and reliability to perform their function when needed.

(i) Instrumentation and controls.  The inspector should verify the design provided for inclusion of instrumentation and control systems to monitor and control the behavior of IROFS.

The inspector should verify the design incorporated, to the extent practicable, preference for the selection of engineered controls over administrative controls to increase overall system reliability.  The inspector should verify the design incorporated features that enhance safety by reducing challenges to IROFS.

Changes that involve new processes at existing facilities and were submitted to the NRC for approval do not require an in-depth inspection of the baseline design criteria.  The inspection should be focused on verifying the licensee implemented the change in accordance with the license amendment and the safety evaluation report.

5. The inspector should verify that the installation of the modification (if accessible) is consistent with the modification documents. Also, if applicable, verify restoration of the temporary modification (if accessible).

6. The inspector should verify that documentation (i.e. design and licensing bases documents) affected by a change performed under 10 CFR 70.72 is updated promptly. For the purpose of this procedure, “promptly” generally means within the timeliness expectations established in the CMS procedures. As required by 10 CFR 70.72(a)(3), operating procedures shall be updated prior to implementation of the change.

NOTE:  This procedure may be performed in conjunction with performing a system walkdown as outlined in IP 88135.04, “Resident Inspection Program Operational Safety.”

03.02 Management Measures.  

a. Inspection Requirements.  Verify the licensee established appropriate management measures for IROFS or other credited safety controls that were affected by the facility change selected for the inspection sample.  Verify the management measures ensure that affected IROFS or credited safety controls are designed, implemented, and maintained, as necessary, to ensure they are available and reliable to perform their function when needed to comply with the performance requirements of 10 CFR 70.61 or applicable conditions of the license.

b. Inspection Guidance

The management measures applied to the selected facility changes should comply with the specific requirements in the license application and the implementing procedures. Management measures applicable to the CMS or facility change process include:

1. Configuration Management

The inspector should verify the licensee implemented the applicable aspects of Configuration Management described in the implementing procedures and the license application.  Configuration Management for IROFS affected by plant changes/modifications may involve the following processes or attributes:

(a) Establishment of technical design bases/criteria – This includes incorporating  the design requirements of applicable codes and standards committed to in the license to the change package (e.g. National Fire Protection Association (NFPA) and American Nuclear Society (ANS)).

(b) Unintended system interactions – This includes considering the impact on interconnecting systems, during design and implementation of the modification.

(c) Set points – Modifications involving instrumentation & controls have established bases for set points and associated uncertainties.

(d) Design development, review and control process – Design and technical assumptions contained in the technical basis, safety analyses, or other design/safety basis documents are revised and validated as necessary.  Additionally, the validity of the existing Natural Phenomena Hazards (NPH) structural analysis for the buildings or engineered equipment should be confirmed.

(e) Like-for-like changes – This includes ensuring the changes do not impact the fit, form, or function of the IROFS.

(f) Post-modification testing (PMT) – This includes identification of PMT requirements and necessary criteria to verify IROFS (or credited safety controls) will function as required

(g) Project approval, initiation, and control process – This includes project readiness review/startup approval, operational turnover, and closeout.

(h) Classification of Modification/Change – Changes are properly classified according to the modification type outlined in CMS procedures (e.g. minor modifications, temporary modification, procedure revision, etc.).

The inspector should interview applicable process and safety engineers and operators to obtain insights on the operational and safety parameters of the modification and should verify that applicable design bases and assumptions were properly considered.

The inspector should conduct walk downs to verify, to the extent possible, that as-built equipment reflects the design description in the modification packages.  During walk downs, consider neighboring process systems and utility lines to ensure the licensee evaluated any potential interactions.

2. Procedures

The inspector should review risk significant procedures affected by the modifications and should verify  the licensee followed its procedure control process and the management measure attributes described in the license application.    

3. Post-Modification Testing

Review PMT procedures and test results, and if possible, observe any PMT in progress.  Consider the following in the review:

(a) The boundary of the IROFS or credited safety control (i.e. the components necessary for the safety function to operate) is adequately considered in the test scope.

(b) Any measuring and test equipment used during performance of the test is properly calibrated.

(c) Unintended system interactions do not occur during testing.

(d) The test procedures have appropriate acceptance criteria to demonstrate the intended function(s) of the IROFS or credited safety controls.

(e) Test results have been met and deviations from acceptance criteria are resolved appropriately

This portion of the procedure may be performed in conjunction with PMT inspection activities as outlined in IP 88135.19, “Resident Inspection Program Post-Maintenance Test.”

NOTE:  Licensees often use existing procedures, such as surveillance procedures, for post-modification testing.  Although performance of existing procedures may have been reviewed by inspectors, inspectors still need to determine the appropriateness of using the existing procedures for validating the modification (as opposed to simply confirming continued operability).

4. Maintenance/ Surveillance

The inspector should ensure the licensee has established adequate periodic surveillance testing for modifications affecting IROFS or credited safety controls (active-engineered or passive).  The inspector should review the technical content of the surveillance test procedure to verify it meets the applicable license requirements.

This portion of the procedure may be performed in conjunction with PMT inspection activities as outlined in IP 88135.22, “Resident Inspection Program Sureveillance Testing.”

5. Training

The inspector should verify the licensee identified and conducted the necessary training to implement the modification as described in the license application and plant procedures.   

88135.17-04	RESOURCE ESTIMATE

The annual resources to complete this inspection are estimated to be 20 hours.  This estimate is only for direct inspection effort and does not include preparation for and documentation of the inspection.  Time spent conducting activities associated with this procedure should be charged to IP 88135.17.  Completion of plant modification inspection activities should be documented in the quarterly inspection report for the quarter in which the inspections were performed.

88135.17-05	PROCEDURE COMPLETION

This procedure is completed when the inspection requirements are performed with a minimum of one (1) change/modification sample inspected per year.

88135.17-06	REFERENCES

1. 10 CFR 70.34, “Amendment of Licenses”

2. 10 CFR 70.61, “Performance Requirements”

3. 10 CFR 70.62, “Safety Program and Integrated Safety Analysis”

4. 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing Facilities”

5. 10 CFR 70.72, “Facility Changes and Change Process”

6. Reg Guide 3.74, “Guidance for Fuel Cycle Facility Change Processes”

7. NUREG-1513 “Integrated Safety Analysis Guidance Document”

8. NUREG-1520 “Standard Review Plan for the Review of License Application for a Fuel Cycle Facility”

END

Attachment:

  Revision History for IP 88135.17

Issue Date:  12/02/20	1	88135.17

Issue Date:  12/02/20	1	88135.17

Attachment 1 - Revision History for IP 88135.17

Issue Date:  12/02/20	Att1-1	88135.17