ML24040A214

(CN 90-010) IP 37700 Design Changes and Modifications

ML24040A214
Person / Time
Issue date:	09/17/1990
From:	NRC/NRR/DRO/IRIB
To:
References
CN 90-010
Download: ML24040A214 (1)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 NRC INSPECTION MANUAL INSPECTION PROCEDURE 37700 DESIGN CHANGES AND MODIFICATIONS PROGRAM APPLICABILITY:

2515, 2525 37700-01 INSPECTION OBJECTIVE RSIB To verify that design changes and modifications which have been determined by the licensee to not require approval by the NRC are in conformance with the requirements of the Technical Specifications (TS), 10 CFR 50.59, the Safety Analysis

Report, the licensee's Quality Assurance Program and 10 CFR 50, Appendix B, Criterion Ill, "Design Control;" and to selectively R verify adequacy of installation and testing of plant modifications.* R 37700-02 INSPECTION REQUIREMENTS 02.01 Perform the following steps for design changes and modifications which the licensee did not submit to the NRC for approval:

a.

Select at least three design changes/modifications from the systems R 1 i sted below for review/observation.

If the 1 i censee has divided a major design change/modification into one or more subpackages for partial completion over two or more outages, at least one of the three R changes/modifications selected for review should be of this type.

This examination should be performed at least once every SALP cycle. R The current risk significance of the system should be considered when R selecting the changes/modifications for review:

R

1.

Reactor trip system.

2.

Reactivity control.

3.

Instrumentation:

safety related and nonsafety-related:

(e.g.,

SPDS, ATWS, etc.)

4.

Reactor coolant system.

5.

Emergency core cooling system (light-water reactor) or liner cooling system (high temperature gas-cooled reactor).

6.

Containment systems.

7.

Plant and electrical power systems (safety related and nonsafety-related).

8.

Radwaste system.

9.

Power conversion systems

• Issue Date: 09/17/90

10.

Safety significant balance of plant systems.

b.

Verify that the design changes/modifications chosen in 02.0la were reviewed and approved by on-site and off-site review organizations in accordance with TS and established QA/QC program controls and did not invalidate modifications made previously to the same system/component.

c.

Verify that design changes/modifications selected in 02.0la were controlled by approved procedures.

d.

Verify by review of completed test records that the licensee conducted a review and evaluation of test results prior to the modification being declared operable and that:

1.

Test results were within previously established acceptance criteria.

2.

Test deviations were reviewed, corrections were completed as required, and retesting was accomplished as necessary prior to final acceptance and operability.

3.

Appropriate test requirements, including verification of scope, were established by the responsible engineering organization when applicable.

e.

Verify that operating procedure and emergency operating procedure modifications were made and approved prior to the modification being declared operable in accordance with TS for those design changes/

modifications selected in 02.0la.

f.

Verify that operator training programs were revised and that necessary operator training was conducted prior to the modification being declared operable to reflect the design change/modification that was implemented.

g.

Verify that prior to each design change/modification being declared operable, the controlled copies of as-built documents used by the plant operators were either revised and distributed, or were legibly marked-up on an interim basis to show all changes relating to the design change/modification(s).

Also verify that administrative controls and responsibilities were clearly established for the following:

1.

Marking of the as-built documents for design changes/modifica-tions on an interim basis, including document review, approval, and safeguarding the document and related papers until all marked-up changes have been incorporated on the revised (updated/

final) documents.

2.

Directions for users of the as-built document to use and refer to the marked-up copy for the purpose of testing, maintenance and future design change activities, until the revised as-built document incorporating all marked-up changes is officially issued.

Issue Date: 09/17/90 37700

3.

Revision of documents incorporating all marked-up changes, and issuance and distribution in a timely manner.

4.

Verification that the set of drawings maintained 11as-built 11 is adequate to support operations, maintenance and design.

h.

Verify that design changes/modifications selected in 02.0la were planned to be on or were listed on the required 10 CFR 50.59(b) annual report to the NRC, and that appropriate FSAR revisions were planned or completed.

i.

Verify that preventive maintenance, inservice inspection (ISI), and inservice test (IST) requirements for newly installed equipment were added to or appropriately changed in the respective programs main-tained and implemented by the licensee, prior to the modification being declared operable.

j.

For design changes/modifications that are partially completed, that the integration of the modification into interfacing systems was controlled by the licensee to ensure that:

1.

If the modification was not completely operable (i.e., hardware installed during one outage, but electrical hookup not scheduled until the following outage), the licensee implemented positive control ot system boundaries.

2.

The effects of partial completion of the modification were fully considered in items e, f, g, h, and i, above; and the partially completed status was adequately assessed in accordance with the requirements of 10 CFR 50.59.

k.

Verify that changes to the design as described in the FSAR were.

properly controlled and documented in updates to the FSAR.

02.02 Select one temporary modification and selectively review the implementation of program controls that require:

a.

The review and approval of temporary modifications in accordance with Section 6 of this TS, 10 CFR 50.59, and the approved QA program.

b.

The use of detailed approved procedures when performing temporary modifications.

c.

Assigning responsibility for approving procedures in 02.02b.

d.

Maintaining of a

formal record of the status of modifications, lifted leads and

jumpers, temporary temporary trip setpoints of control equipment, etc.

temporary strainers,

e.

Evaluation of the need for independent verification, where appropriate, of installation and removal of temporary modifications, lifted leads and jumpers

• 37700 Issue Date: 09/17/90

f.

Functional testing of equipment following installation of removal of temporary modifications.

g.

Periodic reviews of lifted lead and jumper records, including a check of outstanding entries.

h.

The correct installation of jumpers and/or lifted leads, i.e., that the termination points/lift points are consistent with the design package.

02.03 For one to three minor design changes/modifications not submitted to the NRC for approval (if applicable, select from those identified in accordance with 02.01) determine the schedule for installation and post-modification testing, and do the following:

a.

Verify that work is being performed by qualified workers in accordance with approved instructions, procedures, and drawings contained in the work package.

b.

Examine the installed hardware to selectively verify that the installation conforms to the as-built drawings.

This verification process should selectively include confirmation that equipment model or serial numbers, dimensions, materials, sizes, and configurations, including mounting details, are correct. The hardware inspections for safety systems should verify that the system licensing design criteria approved by the NRC remains valid following the modifications (e.g.,

that separation is still maintained between redundant divisions; that fire protection requirements are still met; or that equipment qualifi-cation has been degraded).

c.

Inspect the modification at the installation phase to determine the extent to which jumpers and/or lifted leads are to be used and controlled during the installation phase and subsequent phases through the time that the modification is declared operational.

d.

Determine, through selective observations of the actual installation of hardware and associated activities in progress, whether the modified structures, systems, and components were properly prepared for preoperational testing. This determination should include obser-vations and selective examinations of the following preparations as appropriate:

1.

Preservation (e.g., painting).

2.

Wiring continuity, termination integrity, and separation checks.

3.

Cleaning and flushing.

4.

Calibration of instrumentation and setpoints.

5.

Hydrostatic pressure testing of fluid systems.

6.

Component functional testing including:

(a) Trip testing of breakers.

(b)

Freedom of movement checks for mechanical components.

(c) Rotational directional testing of prime movers.

7.

Structural concrete and structural steel tests.

8.

Greasing and lubrication.

Issue Date:

09/17/90 37700 R

R R

R R

R R

R R

R R

R R

R R

R..

R R

• R R

R R

R R

R R

R R

R R

R R

R R

R R

R R

9.

10.

11.

12.

13.

14.

Installation of packing and filtering materials.

Connection of support systems.

Reservoir filling and venting.

Adjustment of limit switches, interlocks, and stops.

Preventive maintenance (depending on the elapsed construction and convnencement of preoperational Torque and limit switch settings for MOVs.

R R

R R

time between R testing).

R R

e.

Selectively verify that the licensee's review and evaluation of com-R pleted construction phase test procedures addressed whether test R results were within previously established acceptance criteria, that R test deviations were resolved, and that retesting was accomplished as R appropriate.

R

f.

Selectively verify that pre-test training was proper test performance and proper operation equipment.

conducted to ensure R of new or modified R R

g.

Selectively verify that test procedures and changes thereto were R reviewed and approved in accordance with TS and the licensee's admin-R istrative procedures.

R

h.

Selectively verify that the licensee's review and evaluation of com-R pleted test procedures addressed whether test results met previously R established acceptance criteria, that test deviations were resolved, R and that required retesting was accomplished prior to the next test-R ing phase or release for operation.

R

i.

Review a sample of quality assurance records to verify that the test R performance records received an independent QA audit in accordance R with the licensee's approved QA program.

R

j.

Selectively verify that the testing criteria and results established R that the levels of performance of new structures, systems, and compon-R ents were as described in the license amendment application, if appli-R cable, and in the detailed design documentation.

R 37700-03 INSPECTION GUIDANCE The Core Inspection Program (CIP) Task Group has recormnended that IP 37700 be R included within the CIP with a frequency of once every SALP cycle and be R revised to emphasize that the inspection should include verification that R hardware installations match the as-built drawings and that adequate post-R modification testing is performed.

Requirements and guidance found in R IP 37828, "Installation and Testing of Modifications" have been incorporated R into IP 37700 for this reason.

The number of design changes/modifications R requiring review has been reduced in recognition of the increase in attri-R butes being inspected and the required frequency of inspection.

R 03.01 General Guidance.

Guidance related to the applicability of 10 CFR 50.59 to changes in the facility or procedures as described in the SAR, or the conduct of tests and experiments not described in the SAR is discussed in the 10 CFR 50.59 subsection of the Guidance section of the NRC inspection 37700 Issue Date:

09/17/90

Manual entitled, "Part 9900 CFR Discussions; Changes to Facilities, Proce-dures, and Tests (or Experiments)."

Additionally, general guidance can be found in ANSI NlB.7-1976 and ANSI N45.2 and its daughter standards.

Design changes and modifications relating to low-level radioactive waste storage are addressed in NRC Inspection Procedure 65051.

03.02 Specific Guidance

a.

Inspection Requirement 02.0la.

The licensee is required to determine to which of the following categories a design change or modification must be assigned:

1.

Not subject to review pursuant to 10 CFR 50.59. This category is only appropriate for facility changes that do not change the description as stated in the FSAR nor fit the 10 CFR 50.59 conditions.

2.

Subject to review pursuant to 10 CFR 50.59.

Design changes or modifications that cause a system or component described in the FSAR to be changed require a written 10 CFR 50.59 safety evalua-tion to assess whether the change constitutes an unreviewed safety question or a change to the facility TS.

This written safety evaluation must provide an adequate basis for determining that the design change or modification:

(a) does not require NRC approval because TS need not be changed or an unreviewed safety question is not relevant, or (b) requires NRC approval because of the need for a change in TS or the existence of an unreviewed safety question.

Regardless of the category to which the selected design change is assigned by the licensee, the inspector should verify that the written basis upon which the determination was made is technically correct and that the questions necessary to determine whether the design change constitutes an unrev i ewed safety question pursuant to 10 CFR 50. 59 have been considered by the licensee in the safety evaluation.

These questions are:

0 0

0 Does the design change increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety, as previously evaluated in the updated FSAR?

Does the design change create a possibility for an accident or malfunction of a different type than any evaluated previously in the updated FSAR?

Does the design change reduce the margin of safety as defined in the basis for any technical specification?

For significant design changes that affect several plant systems, an integrated safety evaluation should be performed in addition to discipline-specific safety evaluations to ensure that a comprehensive review of the change against the design objectives of affected plant systems is conducted.

Issue Date:

09/17/90 37700

It has been found that the licensees' philosophical approach to 10 CFR 50.59 safety evaluations has sometimes placed significance on identi-fying potential failure modes instead of examining the potential consequences of system or component failures.

The inspector should ensure that the licensee examined potential consequences of system or component failures in conducting the 10 CFR 50.59 safety evaluation for design changes and modifications (i.e., the question "what would happen if *** " was explored and answered during the conduct of the safety evaluation).

If the licensee revised the initial determination from category 1 to 2.(a) as identified in Section 03.02.a, the inspector should ensure that the root cause for the incorrect initial determination was identified and made known to all groups who participated in the initial review.

This action by the licensee is necessary to prevent recurrence of the problem.

If the licensee revised the initial determination from either catego-ries 1 or 2.(a) to 2.(b) subsequent to the implementation of the modification or to correct an event or condition that was the sub-ject of a 50.72 or 50.73 report, the inspector should ensure that the licensee made prompt notification to the NRC pursuant to 10 CFR 50.72 and 50.73. Additionally, the inspector should verify that commitments made by the licensee regarding specific corrective action were fully_

implemented in the required time frame and the licensee submitted an application for amendment of the license pursuant to 10 CFR 50.90. A determination change of this nature by the licensee warrants the consideration of enforcement action by the NRC.

The sample of design change/modification to be inspected should be selected from the listing of subsystems identified in the standard TS.

The failure of certain nonsafety-related mechanical systems could result in adverse environmental conditions (e.g., high energy line break, flooding) or unwarranted challenges to safety-related systems.

Thus, modifications to these systems will be subject to periodic review under this inspection procedure.

Likewise, modifications to nonsafety-related electrical/instrumentation systems, should be reviewed to ensure that failures cannot compromise safety-related electrical/instrumentation systems due to a lack of physical separa-tion, isolation, or the imposition of excessive loads.

The sample also should be rotated such that each subsystem is sampled.

It should be evident to the inspector that the licensee made the evaluations required by 10 CFR 50.59(a)(2).

b.

Inspection Requirement 02.0lb.

Requirements for the plant and corpo-rate safety con111ittees or review groups to review proposed design changes and modifications are defined in the TS.

The QA program for design control should be defined in Section 17.2.3 of the FSAR.

The inspector should al so refer to Inspection Procedure 37702, "Design Changes and Modifications Program," for information regarding QA controls for design change.

The inspector should ensure that the design changes were subject to the same level of engineering review 37700 Issue Date: 09/17/90

and approval as the original design, including definition of testing requirements.

The inspector should give consideration to whether the modification under review compromised the original design bases and margins for the applicable system/component.

Regarding multiple design changes to

c.

the same system/component, the possibility exists that the latest design change could have invalidated a design change previously made.

As an example, a licensee made a modification to a diesel generator control circuit that invalidated a prior modification partly because the drawings used to design the second modification did not reflect the first modification.

The probability of this situation occurring increases if the design changes to the same system/component were made within a short period of time to one another.

Ins\\ection Requirement 02.0lc.

inc ude:

Work procedures should normally

1.

Identification of specifications, guides, and codes governing the work.

2.

Identification of inspections required by codes or standards.

3.

Acceptance tests which stipulate acceptance values or performance requirements.

4.

QA/QC requirements.

d.

Inspection Requirement 02.0ld.

Acceptance tests which define accep-tance values or performance requirements should be consistent with TS, SAR, and NRC requirements.

e.

Ins~ection Requirement 02.0le.

Other documents, such as vendor tee nical manuals, that could be affected by the design change should be verified as having been revised.

Additionally, ascertain whether personnel involved in the change are properly qualified and knowl-edgeable.

Licensed operators are required by 10 CFR 55, Appendix A, Section 3.c to be cognizant of all facility design changes.

f.

Inspection Requirement 02.0lg. Modifications to the plant systems may result in design changes which in some cases may be very extensive.

In these cases, the affected design documents should be expected to be revised and issued before implementation of the modification.

In other cases where design changes are minimal, the affected documents are updated by marking-up the design changes on a controlled set of documents on an interim basis, pending completion of the document revision, review and approval cycle.

In every case, whether updating of the document is done by revising or through interim mark-up, the updating must be completed prior to the modification being declared operable. Drawings changed by the modification should indicate that a change is outstanding until all work (including drawing change) is complete.

If the drawing mark-up is for a temporary modification, the applicable document shall clearly show period of time of its validity.

In cases where documents have been updated through a temporary mark-up, revision of the document to incorporate the marked-up changes should be done in a timely manner fol lowing the modification.

The Issue Date:

09/17/90 37700

g.

h.

37700 timeliness of document rev,s,on should be consistent with the safety function of the modified system.

Effects of marked-up design changes should not preclude the document being a "useable" reference document, i.e., without clutter which could cause difficulties in determining the actual installed configuration.

The marked-up document should be referred to for testing, maintenance and future design change activi-ties until the revised document is issued.

Inspection Requirement 02.0lh. Paragraph (b) of 10 CFR 50.59 requires the licensee to furnish to the NRC annually or at shorter intervals, a report containing a brief description of facility and procedure changes as described in the FSAR as well as tests and experiments not described in the FSAR which were performed or implemented without prior Commission approval. The report must contain a brief summary of the safety evaluation made for each change, test, or experiment reported.

Annual operations reports are most often used as the vehicle for reporting this information.

Inspection Requirement 02.02f.

The installation of a jumper or the lifting of a lead in a nuc ear safety-related circuit constitutes a modification to the circuit.

In general, the installation of jumpers and the lifting of leads should be carefully controlled.

A formal control of such jumpers is required according to Section 5.2.6 of ANSI NlB.7-1976 and Section 6.5 of TS.

The use of mechanical devices such as dutchmen, temporary strainers, blind flanges, or piping bypasses also constitutes system modifications and must be controlled.

• Such modifications that result in changes to the system or component des-cription in the FSAR require written safety evaluations pursuant to 10 CFR 50.59 as well as review and approval by a committee so charged by TS, or other required method.

It is not intended that the inspection requirements identified in 02.03 be applied to test leads used in the performance of routine surveillance testing.

Installation and removal of such test leads should be controlled by the respective test procedure.

Additionally, it is not intended that the inspection requirements of 02.03 be applied to hand-held jumpers used for trouble shooting or maintenance checks on equipment that has been removed from service.

However, if a jumper or lifted lead is physically installed, even temporarily, it should be controlled and accounted for.

Control may be accomplished via steps in properly approved procedures, such as maintenance procedures, or by the use of a jumper control log and administrative procedures.

Independent verification of jumper instal-lation and removal is required by Section 5.2.6 of ANSI NlB.7-1976.

Guidance regarding review of temporary modifications pursuant to 10 CFR 50.59 can be found in the 10 CFR subsection of the Guidance section of the NRC Inspection Manual entitled, "Part 9900 CFR Discus-sions; Changes to Facilities, Procedures, and Tests (or Experiments)." Issue Date:

09/17/90

i.

j.

Inspection Requirement 02.03a.

R

1.

Selectively examine the licensee's records to verify that the R drawings, procedures and instructions have the appropriate revi-R sion number.

R

2.

On a sample basis, interview workers for familiarity with the R requirements of the work package.

R

3.

Audit the licensee's training records selectively to determine R worker training lever and currency.

R Inspection Requirement 02.03c.

IEEE Standard 338, "IEEE Standard Criteria for the Periodic R

Periodic Testing of Nuclear Power Generating Station Safety Systems,"

R as supplemented by Regulatory Guide (RG) 1.118, "Periodic Testing of R Electric Power and Protection Systems," provides guidance for compli-R ance with the Commission's regulations concerning periodic testing of R safety systems; namely, GDC 21, "Protection System Reliability and R Testability," and Section 4.10 (Capability for Test and Calibration) R of IEEE Standard 279, "Criteria for Protection Systems for Nuclear R Power Generating Stations." This guidance states that procedures for R periodic tests should not require makeshift test setups (i.e, abnor-R mal circuit configurations involving the installation of jumpers, '.R lifting leads, pulling fuses tripping breakers, blocking relays, R etc.) The removal of fuses during periodic testing is only allowed R if such action causes the protection action to occur; and the use of R jumpers is only allowed for the connection of portable test equipment R via permanently installed test connections designed to the same R standards as the system being tested.

R Although the incentive to install jumpers and/or lift leads may exist R during the implementation of design changes/temporary modifications, R these practices (along with pulling fuses, blocking relays, tripping R breakers, etc.) should be carefully controlled. Operating experience R indicates that inoperability of safety systems frequently results fol-R lowing maintenance (including design changes/modifications), surveil-R lance and testing activities, due to human errors involving such prac-R tices. These errors occur at commercial reactor facilities despite R the existence of nstrict administrative controls."

IE Information R Notice 84-37, "Use of Lifted Leads and Jumpers During Maintenance or R Surveillance Testing," discusses the potential for significant degrad-R ation of safety systems associated with the use of jumpers and lifted R leads during either maintenance or surveillance testing. Even though R many facilities have post maintenance/surveillance procedures that R require independent verification of proper system realignment, errors R still occur.

Operating experience has disclosed a number of short-R comings with administrative controls/procedures including poor coord-R ination between multiple procedures used to accomplish a given task, R inconsistent nomenclature, poor format, improper numbering, direct-R Issue Date:

09/17/90 37700 *

k.

37700 ions not given for all alternatives, and procedures which do not accu-R rately reflect the installed design.

A staff audit of plant procedures R incorporating the independent verification concept found that, in most R cases examined, the independent verification was not truly independent R te.g., the two operator/technicians performed the verification walk-R through together, or the second person used the same checklist filled R out by the first person.) Also, IE Information Notice 84-51, "Inde-R "pendent Verification," discusses personnel errors and procedural R errors that have resulted in safety related equipment being inadever-R tently placed in an inoperable status.

R 10 CFR Part 55a(h) endorses IEEE Standard 279, "Criteria for Protec-R tion Systems for Nuclear Power Generating Stations." Section 4.13 R (Indication of Bypassed) of IEEE Standard 279 requires that, if the R protective action of a portion of a safety system has been bypassed or R deliberately rendered inoperative for any purpose, this fact shall be R continuously indicated in the control room.

This requirement is R intended to ensure that sufficient information concerning the inop-R erable status of redundant portions of plant safety systems is R provided to the operators such that they are continually aware of R their status and can make knowledgeable decisions regarding their R availability for use during accident conditions. Additional guidance R concerning bypass indication is provided in RG 1.47, "Bypassed and R Inoperable Status Indication for Nuclear Power Plant Safety Systems."

R NUREG/CR-3621, "Safety System Status Monitoring,"

published in March R

• 1984, emphasizes the importance of monitoring the status of safety-R related systems or components designed to respond to plant transient R and accident conditions, and which are routinely made inoperable R during periodic tests or maintenance, or intentionally disabled for R other reasons.

NUREG/CR-3621 identifies some of the tasks associated R with monitoring the inoperable status of safety systems, such as ver-R ifying the operability of redundant systems, updating status boards, R and determining system status during all modes of operation, as tasks R that are important to plant safety, and which are also prone to human R errors. The deliberately induced inoperable status of safety systems R (for the purposes of performing routine maintenance/surveillance act-R ivities or for implementing design changes/modifications) should be R continuously indicated in the control room for as long as the inoper-R able condition exists.

R NUREG/CR-3621 also identifies lifted lead forms, removal leads, and obtaining proper jumpers and lifted leads, as plant safety.

tasks involving completion of jumper and R of jumpers and reinstallation of lifted R authorization for the repositioning of R tasks that are very important to the R R

Inssection Requirement 02.03e. Test procedures should normally in-R clue:

R

1.

Procedures scope and objective.

2.

Prerequisites.

3.

Precautions.

4.

Limitations and action.

5.

Acceptance criteria

• Issue Date:

09/17/90 R

R R

R R

6.

Checkoff lists.

R

7.

Reference to the application, TS, drawings, specifications codes, R commitments or other requirements.

R

8.

Provision for recording details of the conduct of the test, R including observed deficiencies, resolution and retest.

R

9.

R~quirements that valve lineups, temporary connections, discon-R nections, or jumpers be restored to normal, or reference to R another procedure governing these requirements.

R

10.

Provision for identification of personnel conducting the test-R ing and evaluation of test data, or reference to another test R for this information.

R

11.

Provision for quality control verification of critical steps or R parameters.

R

12.

Based on the complexity of the changes, additional testing guid-R dance may be found in Inspection Procedure 72701, "Modification R Testing".

R 37700-04 INSPECTION RESOURCES On the average, 60 direct inspection hours are allotted for the completion of R this procedure.

R 37700-05 REFERENCES 10 CFR 50.59 10 CFR 50.72 10 CFR 50.73 10 CFR 50.90 10 CFR 50, Appendix A 10 CFR 50, Appendix B 10 CFR 50.59 subsection of the Guidance section of the NRC Inspection Manual NRC Inspection Procedures 65051 and 72701 Technical Specifications, Section 6.5 FSAR, Section 17.2.3 ANSI NlB.7-1976 ANSI N45.2 and its daughter standards ANSI NQA-1 and NQA-2 END Issue Date:

09/17/90 37700 *