NRC INSPECTION MANUAL CQVB

INSPECTION PROCEDURE 37805

ENGINEERING DESIGN VERIFICATION INSPECTIONS

PROGRAM APPLICABILITY: 2507

37805-01 INSPECTION OBJECTIVES

01.01 Verify that the design authority (e.g., the organizations contracted by an NRC
applicant to provide engineering, procurement, and construction support) has developed
processes that allow for the complete and accurate transfer of the high level design
information and performance requirements specified in the Final Safety Analysis Report
(FSAR) into detailed procedures, specifications, calculations, drawings, procurement,
and/or construction documents, in a manner consistent with the requirements of Appendix
B to 10 CFR Part 50.

01.02 Verify that the design authority has developed processes to ensure changes to the
design are adequately controlled.

01.03 Verify, through a detailed technical review of selected systems, that the design
authority’s implementation of its design and design control processes has produced
detailed procedures, specifications, calculations, drawings, procurement, and/or
construction documents that are consistent with NRC regulations, the FSAR, and the
NRC’s Safety Evaluation Report (if issued).

37805-02 INSPECTION REQUIREMENTS

Through a detailed technical review of selected systems, this Engineering Design

Verification (EDV) Inspection will provide the NRC an opportunity to assess the design
authority’s implementation of its processes for completing and controlling the detailed
design. The detailed technical review will provide reasonable assurance that the design
authority’s processes are sufficient to result in the complete and accurate transfer of the
high level design information contained in the FSAR into detailed engineering,
procurement, and /or construction documents consistent with NRC requirements and
FSAR. The successful completion of this inspection will also provide confidence in the
validity of the resulting detailed design information which may ultimately be utilized by
Combined License holders to support the closure of Inspections, Tests, and Acceptance
Criteria (ITAAC).

It is anticipated that one EDV (and related follow-up inspections) will be completed for each
certified design.

02.01 Inspection Preparation.

Issue Date: 04/25/11 1 37805

 a. Pre-inspection Meeting With Design Authority. Prior to the beginning of the actual
inspection, the team leader and selected members of the inspection team should
visit the design authority’s offices to ensure sufficient progress has been made in
completing the detailed design to allow for the successful completion of this
inspection. To aid in this determination, the design authority should be asked for a
list of all systems indicating the status of design completion for each system. These
should be systems for which the design has been “frozen” from a licensing basis
perspective.

The EDV inspection should be performed when the detailed design is complete for
at least 70% of safety systems. Design complete in this context means that the
initial detailed design is complete for the system. Additional activities to validate
the detailed design to actual “as purchased” or “as installed” component level data
may remain since these activities may be incomplete at the time of the inspection.

An additional limited scope EDV may be performed at a later date if detailed design
work for a significant system was not complete at the time of the initial EDV (such
as would be the case if the I&C system design was incomplete) or if significant
design validation activities remain to be completed.

The team leader should acquire the following documents which will be provided to
the team to aid in the system sample selection process:

Latest revision of the FSAR

NRC Safety Evaluation Report (drafts if not completed)

listing and description of scope of design work performed by each

organization contributing to the development of the detailed design

engineering / design control procedures and quality assurance (QA)

procedures related to design

diagrams indicating the flow of design information

design and engineering procedures specified for contractor and

subcontractor use

documents listing the scope and standards for engineering and design
work expected to be done in the field

documents indicating the scope of and procedure for the exchange of

design information among the design organizations including procedures
used to control design interfaces and procedures associated with the
design change process
procedures related to the software development and life-cycle control
process supporting safety-related design activities.

Issue Date: 04/25/11 2 37805

 procedures describing the design authority’s involvement in the
engineering process (e.g., oversight and audit of engineering activities)

QA manuals for all organizations performing design work on the project

significant reports and other correspondence related to progress, status,

or control of the engineering and design process

b. System Selection. Prior to selecting its inspection sample, the team should meet
with NRO’s Division of Safety Systems and Risk Assessment (DSRA), Division of
Engineering (DE), Division of Construction Inspection Programs and Operational
Programs (DCIP), and Division of Site and Environmental Reviews (DSER) to
obtain information on the systems, design features, and components that are
important based upon their relative risk significance . The NRO technical divisions
should also be asked to provide insights on systems and design features that they
believe would be good candidates for review during the inspection. Considering the
insights obtained above, the information obtained during the team’s pre-inspection
visit, and the following considerations, two systems should be selected for review:

uniqueness and degree of industry experience with system design

features

margins to design requirements

representative of safety-related features in other systems

a design that involves internal interfaces between the various functional

areas and external interfaces between the design authority and
designated design, fabrication and construction organizations

In general, the systems selected for review should be mechanical systems. The
Electrical and Instrumentation and Control (I&C) features of the design should be
reviewed as supporting to the selected mechanical systems. Note: It is possible
that at the time this inspection is performed the detailed design for the I&C system
may be incomplete. In such cases, a separate inspection of the I&C system may
be required. In addition, at least one civil structure associated with the selected
mechanical systems should be reviewed.

It is important to note that the EDV is an inspection activity that is meant to assess
the adequacy of the design authority’s processes for developing and controlling the
detailed design and is not meant to take the place of specific technical reviews
performed as part of the licensing process or as part of ITAAC verification
inspections. As such, the EDV may not be able to cover all the technical staff’s
suggested systems and design features. In certain instances, and in order to meet
the objectives of the inspection, some inspection may also be authorized by the
team leader beyond the boundaries of the sample systems.

c. Notification of Design Authority of Sample Selection. At least two weeks prior to the

Issue Date: 04/25/11 3 37805

 scheduled start of the onsite inspection, the team leader will notify the design
authority of the results of the sample selection process. At this time, notification
should also be made to any sub-vendors doing design work where it is anticipated
the team will need to perform offsite inspection activities. The team leader should
request the design authority collate the following documents relative to the selected
systems and have copies of the documents ready for the team’s review onsite:

principal design criteria

system descriptions describing design bases, system functions and

operation,

component data

data regarding associated I&C and electrical system interfaces

engineering, design, and purchase specifications

system flow diagrams showing flow paths, calculated flows, and

temperatures and pressures for designed conditions of operation

piping and instrumentation diagrams for the sample systems and

interfacing systems, including the symbols and legend diagrams

functional logic diagram

independent validation and verification reports

applicable calculations and analyses

applicable electrical system calculations for onsite and offsite interfaces

(e.g. load flow/voltage regulation studies, short circuit analyses, equipment
sizing studies, equipment coordination and protection studies, insulation
coordination, and grounding)

component qualification test reports

significant design reports, including audits and assessments

design documents prepared by the design authority and designated

design, fabrication, and construction organizations

engineering contractor correspondence and documentation

d. Development of Inspection Plans. Each team member should develop a

customized inspection plan based upon the scope of work assigned to them by the
team leader. Team members should utilize the guidance included in Appendix A as

Issue Date: 04/25/11 4 37805

 an aid in developing their individual inspection plans. As applicable, inspection
procedures contained in IMC 2502 through 2508 may also be utilized to help in
developing an inspection plan. The sample size for each document type to be
reviewed should be established by each member of the inspection team, and
discussed with the team leader. Based on the in-progress inspection and results,
the initial inspection plans may be revised as needed.

02.02 Inspection Implementation.

The following inspection requirements should be completed for work controlled by the
design authority. Parallel inspection activities may be necessary for design work being
completed by sub-vendors under control of the design authority.

a. Design Program Review. Review the design authority’s processes that govern the
transfer of the high level design information and performance requirements into
detailed procedures, specifications, calculations, drawings, procurement, and/or
construction documents. Verify the design authority’s processes meet the
requirements of Appendix B to 10 CFR Part 50 as well as the applicable
requirements contained in the FSAR. This inspection requirement should be
completed by a subset of the inspection team as directed by the inspection team
leader. Ensure that sufficient processes are in place to validate the detailed design
against “as procured” and “as installed” component level data.

b. Design Document Review. For the selected sample, confirm that the design
documents have been prepared in accordance with the applicable design
procedures, specifications and instructions. Specific design control attributes to be
checked include:

control of design inputs and outputs

design interface control (including control and integration of design work

performed by sub-vendors)

design verification

design change control

document control

c. Design Technical Review. Utilizing the guidance contained in Appendix A for each
design discipline, verify that the design authority’s implementation of its design and
design control processes has produced detailed procedures (including
maintenance, operating, and emergency operating procedures), specifications,

d. calculations, drawings, procurement, and/or construction documents that are

consistent with NRC regulations, the FSAR, and the NRC’s Safety Evaluation
Report (if issued).

Issue Date: 04/25/11 5 37805

02.03 Problem Identification and Resolution.

Verify that the design authority has identified and entered design issues in the applicable
corrective action programs. Verify the adequacy of a sample of corrective actions for the
system(s) selected for review.

37805-03 INSPECTION GUIDANCE

Inspection Manual Chapter 2507 will be followed for additional guidance.

Refer to the guidance in Appendix A for discipline-specific design review attributes. The
information in Appendix A is intended to provide a focus for each inspection team
member’s discipline-specific reviews. An inspection team member is not required to
address all of the inspection elements in Appendix A, or restrict the scope of the inspection
to the inspection elements listed in the appendix.

Appendix B provides detailed administrative inspection guidance to the inspection team

leader and the inspection team members.

37805-04 RESOURCE ESTIMATE

This inspection is estimated to require 1280 hours of preparation time, 1600 hours of direct
inspection, and 800 hours of documentation (assuming a ten person team). This does not
include time for any follow-up inspection activities, the extent of which will vary based upon
the results of the inspection. Appendix B provides additional discussion of the projected
level of effort, program scope and timetable, and the team composition expected to be
used in the conduct of an initial or follow-up EDV inspection.

37805-05 REFERENCES

10 CFR 52.47, “Contents of Applications; Technical Information”

Appendix B to 10 CFR 50, “Quality Assurance Criteria for Nuclear Power Plants and Fuel
Reprocessing Plants”

10 CFR Part 21, “Reporting of Defects and Noncompliance”

Manual Chapter 2507, “Vendor Inspections”

37805-06 COMPLETION STATUS

An EDV inspection is completed when the staff has performed an inspection that meets the

Issue Date: 04/25/11 6 37805

inspection objectives and the staff’s follow-up inspections confirm that the design authority
has adequately closed the inspection team’s initial findings.

END

Attachments: Appendix A, Functional Area Inspection Plan Guidelines

Appendix B, Inspection Team Responsibilities and Authorities
Attachment 1, Revision History Sheet

Issue Date: 04/25/11 7 37805

 APPENDIX A

FUNCTIONAL AREA INSPECTION PLAN GUIDELINES

The information in this appendix is intended to provide a focus for each inspection team
member’s discipline-specific reviews. An inspection team member is not required to
address all of the inspection elements in this appendix, or restrict the scope of the
inspection to the inspection elements listed in the appendix. While this inspection is not
meant to verify ITAAC, inspectors should be familiar with the ITAAC level design
requirements that apply to the selected systems and consider such requirements when
constructing their individual inspection plans. Applicable sections of the NRC’s Standard
Review Plan and associated Regulatory Guides may be referred to for additional guidance.

Mechanical Systems Inspection Plan Guidelines

a. The overall design basis of the mechanical fluid system should be known by the
inspection team. Particular attention should be given to the functional and
performance requirements imposed on the system for the purpose of assuring
reactor safety. To accomplish a review of the mechanical fluid system, the
inspection team should review the design requirements in the FSAR as well as the
system description for the selected fluid system.

If the selected fluid system is directly connected to or related in function and

behavior to the reactor coolant system, it will be necessary to review the
requirements imposed by the reactor coolant system. The associated parameters
could include such items as temperature, pressure, flow rates, chemical
characteristics as well as information related to redundancy, accident analyses,
physical location and protection from or control of the surrounding environment.
Review calculations to confirm that the design requirements in the FSAR will be
met.

b. Identify a function which is related to the selected mechanical fluid system.

Determine if the design ensures that this function will be met during all plant
conditions. Various system parameters, such as temperature, pressure, flow rates,
and action times, should be reviewed to verify proper design basis and to evaluate
system interfaces. The system flow diagram and supporting calculations should be
reviewed to evaluate whether the design ensures that system functions will be met
under all anticipated conditions.

c. Review calculations that are important to the performance of the system to be

inspected, e.g., net positive suction head calculations for fluid systems and flow
calculations for systems where required flow rates are safety-related items.

Issue Date: 04/25/11 A-1 37805

 d. Review the design methods and assumptions used in evaluating the effects of pipe
rupture on surrounding structures, systems, and components. Interfaces are
involved in reviewing the designs of protective structures, pipe whip restraints,
break exclusion runs, environmental effects of pipe rupture on essential electrical
equipment and instrumentation, subcompartment pressurization, inservice
inspection, and inservice testing of piping components within protective structures
or guard pipes.

e. Verify that the portions of the system penetrating the containment barrier are
designed with isolation features that are acceptable for maintaining containment
integrity for all operating and accident conditions. Check interfaces with the
instrumentation and control functional area relative to isolation valve actuation and
control.

f. Evaluate the classification of the structures related to the selected fluid system for
conformance to the requirements for safety-related systems. Evaluate the
spectrum of conditions that have been considered in the design of the structures.
Evaluate the loading conditions that arise from events such as pipe rupture, LOCA,
earthquakes, operational transients, reactor trip, loss of component cooling, etc.

g. Verify the compatibility of the materials and components of the selected fluid
system with the service conditions, including normal and accident conditions as well
as the design life. Ensure that the fluid system's components have proper safety
and code classifications.

Mechanical Components Inspection Plan Guidelines

a. Select a sample of calculations and qualification reports to be reviewed; the sample

should include the following items:

● piping analysis problems

● major components attached to the piping problem such as a pump, heat

exchanger or tank

● valves in the pipe run

● pipe supports: rigid, snubber, and spring

b. Review all input information used in the piping analysis. This will require
coordination with other team members to determine that the correct design inputs
are used. Verify that the piping analysis will be updated to incorporate as-built
information, when that data becomes available.

c. Review the model used in the piping analysis. This includes review of the analyses
performed (thermal, deadweight, seismic, etc.), review of the computer programs

Issue Date: 04/25/11 A-2 37805

 and the analytical model for conformance with the design requirements of the
FSAR and procedures. Particular attention should be given to the model used for
seismic analysis for the appropriateness of the boundary conditions assumed at
anchors and supports.

d. Review stress and support load summary sheets for correct load combinations as
specified in the FSAR. Also verify that these documents have been transmitted to
the appropriate group for support evaluations.

e. Review component design reports to verify that the basic premises are correct and
that data are in conformance with the design requirements of the FSAR. Review
test qualification documents, if applicable, including correctness of the test
parameters for conformance with the design requirements of the FSAR. This
review should verify that the loads from the piping analysis are included in the
component evaluation.

f. Review valve design reports for conformance with the design requirements of the
FSAR. Particular attention should be given to the operability evaluation for seismic
events. Also, valve actuator qualification documentation should be reviewed for
conformance with licensee commitments the design requirements of the FSAR.

g. Review the loads used in the evaluation of pipe supports and verify that these are
the correct loads from the piping analysis. Review the support analysis for
conformance with the design requirements in the FSAR and procedures. The load
combinations should be checked for the correct specification of primary and
secondary loadings. Verify that integral attachments have been evaluated for their
effects on the piping and that buckling of compression members has been
considered. For spring hangers and snubbers, verify that thermal movements were
considered. Review the attachments to the structure and verify that the loads have
been considered by the structural group.

h. Verify appropriate standards were applied on drawings to specify correct weld

sizes, fastener sizes (bolts) and torque requirements.

Civil-Structural Inspection Plan Guidelines

a. Identify the location of the fluids system selected. Include associated equipment,
such as:

● pumps, heat exchangers, tanks

● power supplies

● control systems

● piping supports

Issue Date: 04/25/11 A-3 37805

 The load path of the structure or structural elements should be reviewed to ensure
that the applied loads are properly carried through the structure or structural
elements to the supporting points.

b. Verify that structural safety categories are consistent and correct. Consider the
location and possible effect of non-safety-related items on the fluids system.

Review the safety categories defined in FSAR Section 3 and the classification of
structures. Compare the safety categories of the mechanical fluid system selected
against these criteria for compatibility.

c. Review the model and boundary conditions used in the structural analysis of the
design configuration utilizing the output and information from other functional areas
such as mechanical, electrical power, instrumentation and control, and systems
design to verify the correctness. Also review the output provided from the civil-
structural area to the other disciplines. Assess the safety impact of these reviews.

d. Verify that all pertinent loads and load combinations are considered in the analysis
of structural elements, in addition to the piping system. Ensure that appropriate
codes and standards are used in the design of structures. Examine the sensitivity
of the structural analysis and design to changes in piping system loads, supports,
and configurations as well as the influence on resulting structural deformations.
Emphasis should be placed on the identification of the discipline boundaries and
necessary interfaces in the design process. Determine that the correct loads and
load combinations have been used and that methods for combining loads or load
elements are correct.

e. Review samples of the design calculations based on the internal forces resulting
from the analyses. Determine that the design techniques committed to in the FSAR
have been or are being met. Also review specific areas of the design calculations.

f. Review examples of the design documents produced as a result of the design

calculations, such as detailed specifications, drawings, and procedures to verify
that analysis results have been correctly translated into structure and member
sizes, reinforcement requirements, concrete requirements, fastener sizes, bolting
requirements, etc..

g. Review examples where the basic design documents are used to produce product,
components, or elements that will be integrated into the final structure. This review
would include such items as fabrication and shop drawings, produced by a
subcontractor, or installation procedures, defined by a supplier.

h. Review and evaluate the process by which design documents are checked and
verified and the process by which the final documents are issued for use and
construction.

i. Review and evaluate several types of design changes, such as those initiated by:

Issue Date: 04/25/11 A-4 37805

 design authority

designated design office(s)

field engineering

j. Review and evaluate the acceptance process used in the civil-structural area for
final acceptance of the structures or elements thereof, including the incorporation of
as-built information, when that information becomes available.

k. Review the seismic analysis of one seismic Category I structure that is associated
with the sample system being inspected.

Review seismic inputs, such as the developing of ground response spectra,

artificial time-history generation.

Review procedure of seismic modeling, including stiffness, masses, damping

values. Verify that the seismic model is representative of and consistent with
the actual structural configuration.

Review the techniques dealing with modal combinations, peak broadening,

closely spaced modes, etc.

Review the adequacy of computer programs used for seismic analysis.

Review the procedure for soil-structure interaction (SSI), if applicable, to

ensure that the adequacy of the procedure and the methodology prescribed
is consistent with FSAR commitments.

Electric Power Inspection Plan Guidelines

Note: for passive plants the electrical review should focus on the Class 1E safety related
portions of the system (generally batteries and 120 VAC). Other non-safety portions of the
electrical system may be reviewed based upon their relative risk significance.

a. Identify all components of the mechanical fluid system selected that require electric
power to perform their safety function(s). Determine if the electric power system
supplying power to each of these components will be capable of providing the
required electric energy as needed by each component. Examine required voltage,
current, and frequency (maximums, minimums, and nominal including transient
values) and compare with power source voltage, current and frequency for several
sample sets of conditions representative of maximum and minimum loads and
expected perturbations on the power source. Determine if required power quality
can be provided for the needed time of interest. A review of diesel generator (or
other stand-by power source such as a gas turbine generator) load sequencing of

Issue Date: 04/25/11 A-5 37805

 the selected mechanical fluid system components (requiring power to perform their
safety function) should be performed.

b. Identify all components of the mechanical fluid system that require disconnection
from their electric power source in order to perform their safety function. Review
the control circuit for at least two such components to determine if it meets its
design requirements. Focus on time allowed for disconnection from power source
in the electric power system design and the corresponding time assumed in safety
analysis.

c. Examine the control relaying for at least two components of the mechanical fluid
system that require power to perform their safety function and two components that
require power disconnection to perform their safety function. Evaluate the
documentation and actual installation of these circuits and assess the ability of the
circuits to perform as required.

d. For several samples of each kind of electric component (i.e., motors, valve
operators, relays, connections, cables), determine if the design meets acceptance
criteria for performing the required safety function in the presence of the most
severe environment specified in the component's design bases. Verify that
acceptance criteria are consistent with licensee commitments the design
requirements in the FSAR.

e. Examine the physical arrangement of redundant electric power source components,

including separation, barriers, and environmental controls, to ensure that single
failures affecting such components will not cause the mechanical fluid system to fail
and be unable to perform its safety function(s).

f. Examine the qualification documentation of at least two motors, valve operators,

relays, connections/connectors, and cables to determine if:

the test conditions specified were consistent with predicted accident

conditions at the equipment location

required equipment performance was properly specified for the worst

accident for which the equipment was required to operate

test results showed the equipment able to meet specified performance under
the design-basis conditions specified

g. Compare procurement specifications for the sample of equipment examined in item

(f) above to determine if they are consistent with qualification specification for
performance and environment.

h. Examine methods and procedures for providing electric power to operable electric
equipment when the normal offsite source and the normal onsite emergency source
are unavailable. Determine if these methods or procedures could compromise
redundant power source independence or prevent supply of electric power to one
Issue Date: 04/25/11 A-6 37805
 or more redundant loads.

i. Confirm the power distribution system to safety-related electric loads has been
adequately designed with regard to breaker, motor starter, and cable sizing, as well
as breaker coordination. Review several sample calculations in this area.

j. For at least 2 electric loads, determine the basis for interruption of electric power in
the case of an electric power demand in excess of the normal rating for the loads.
Determine what basis was used to decide if the system was designed to ensure the
performance of the safety function or to protect the equipment in cases of
overloads. Review design of electric motor-operated valves provided with torque
switches used to cause motor shutdown when excess torque is detected.
Determine the validity of basis for torque switch settings. Review procedures for
testing such switches.

k. Examine specifications for several items of electric equipment and compare to the
expected environment in their designated location to determine if special
environmental controls should have been provided or if a different location should
have been selected.

l. Determine how the need for special environmental controls (e.g., battery room
ventilation) on electric equipment was determined. Review design documentation
(descriptions, drawings, etc.) to determine how the environment is to be maintained
and how operating personnel are made aware of the needs for these special
environmental controls.

Instrumentation and Control Inspection Plan Guidelines.

Note: Depending on the timing of this inspection, significant portions of the Instrumentation
and Control System may be incomplete. In such cases, the team’s review should consist of
verifying the details of the design to the maximum extent practicable. As an option, an
additional limited scope inspection of the I&C system may be performed at a later date.

a. Select two different process measurements, such as flow, level, pressure,

temperature, etc., associated with the mechanical fluid system selected and select
two associated control (or non-safety measurement) systems. The selected
measurements (at least one) should be selected from those that perform a safety
function, such as reactor trip or actuation of one or more engineered safety
features.

b. Review all input information used for the design. It will be necessary to Interface
with the electrical power system design and the mechanical system design. Verify
that the design input parameters meet the design requirements for the fluid system
design. This should include the ranges of system process parameters required for
normal and accident conditions.

c. Review the appropriate functional, wiring, and installation drawings to assure

conformance to licensee commitments.

Issue Date: 04/25/11 A-7 37805

 d. Select several field design change requests and verify that the vendor's design
verification program is being effectively and accurately implemented. The inspector
should review: the verification method; the procedure for implementation; the
authority for the design change; the associated equipment documentation, such as
equipment specification purchase orders, IEEE Standards, Regulatory Guides,
"Approved for Construction" drawings, and the as-built installation drawings, if
available, that complete the design change cycle; the results of the functional tests
after the components/systems have been installed; the documentation to assure
that the field change had been evaluated for general implications.

e. Review qualification documentation associated with safety-related instruments to

determine compliance with regulations, regulatory guides and national standards
applicable to qualification. Included should be a review of software development
controls for digital I&C components. Review installation drawings and instructions
to determine their adequacy to maintain qualification

f. Identify alarms or annunciators provided from the instrumentation for the

mechanical fluid system and review the basis for providing these alarms or
annunciators, their set-points, and their locations.

g. Review the system description for any unusual operating requirements. Examples
of these requirements could be: special operation required of the systems during
and after an accident, capability of the systems to shut down the reactor from a
remote location, or any special automatic/manual control features.

h. Verify that the instrumentation and control system detects and maintains essential
parameters during all anticipated plant conditions. Check if the capability to provide
the required detection and control during loss of offsite power, or other anticipated
operational occurrences and accident conditions meets design requirements.

i. Review a sample of logic functions, i.e., interlocks, automatic actuation and

permissives, to assure they have been properly implemented.

j. Assure that bypassed and inoperable status is indicated as necessary.

k. Review procedures and basis for developing set points. Verify setpoints for a
sample of instruments were properly established, including consideration of any
relevant as-built deviations from the original design.

l. Review sample I&C valve data sheets to make sure that appropriate process data,
setpoints, accuracy specifications, and other features have been correctly
considered.

m. Verify that all attributes of control system input and output points have been
appropriately implemented.

n. Review the detailed I&C architecture diagrams to assure that all applicable

Issue Date: 04/25/11 A-8 37805

 requirements have been incorporated.

o. Ensure that the control room design is consistent with the detailed I&C architecture
diagrams.

p. Review sample control room screen graphics to ensure that the control system
input and output points and their functions have been correctly specified.

q. Check the traceability for the implementation of sample I&C functions and
requirements.

r. Review the software lifecycle development documents related to the selected

instrumentation, including software development and configuration management,
software procurement and supporting services, and version control.

s. Review data communication interfaces.

t. Review implementation of I&C response timing.

END

Issue Date: 04/25/11 A-9 37805

 APPENDIX B

INSPECTION TEAM RESPONSIBILITIES AND AUTHORITIES

RESPONSIBILITIES AND AUTHORITIES

a. Implementation The Office of New Reactors, Division of Construction Inspection

and Operational Programs, Quality and Vendor Branches are responsible for
implementing initial EDV inspections.

b. Level of Effort. The NRC staff should perform the EDV inspection when the
detailed design is complete for at least 70% of the safety systems. Design
complete in this context means that the initial detailed design is complete for the
system. Additional activities to validate the detailed design to actual component
level data may remain, since final procurement activities may have yet to be
completed. An additional limited scope EDV may be performed if detailed design
work for a significant system was not complete at the time of the initial EDV (such
as would be the case if the I&C system design was incomplete). The NRC staff will
perform additional inspections to follow up on identified problems and to verify
corrective actions. The NRC staff will perform a sufficient number of follow-up
inspections after the initial EDV inspection has been performed for the defined
scope of review to confirm that the design authority has adequately closed any
inspection team’s initial findings.

The typical EDV inspection is expected to involve eight to ten inspectors. At a

minimum, each inspector will be assigned to the team for two weeks of preparation,
three weeks of onsite inspection, one week of in-office inspection, and one week of
in-office documentation, for a total of seven weeks (see below timeline). Follow-up
inspections may also be required to closeout issues identified during the EDV.

c. Inspection Timeline. A typical schedule to complete an initial EDV inspection is

outlined below:

Time
EDV Inspection Activity Allocation
(Weeks)

Team Leader Planning 4

- Initial visit to design authority to determine readiness for inspection
(including determination of design completion by system)
- Schedule Preparation
- Inspection Team Selection
- Acquisition of key program documents from design authority

Issue Date: 04/25/11 B-1 37805

 Time
EDV Inspection Activity Allocation
(Weeks)

Team Preparation 2
- Team Indoctrination Meeting
- Review of Information Obtained from Pre-inspection visit
- Meetings with NRO technical divisons
- System Selection
- Preparation of Draft Inspection Plans

Notification to Design Authority of System Selection 2

- Design Authority prepares document packages based upon sample
selection

Commencement of Initial Inspection Activities 2

- Inspection of Design Authority and Select Subvendor (opt.)

Inspection Plan Refinements and Additional Review In Office 1

Completion of EDV Inspection 1-2

- Continued Inspection of Design Authority and Subvendors
- Exit Meeting

Team Members Complete Documentation of Inspection Results and 1

Submit to Team Leader

Team Leader Integrates Inputs and Issues Draft Report 2

Team Member Review of Draft Report 1

Management Review and Issuance of Final Report 2

Identification of all Design Deficiencies and Potential Enforcement 1

Findings

d. Inspection Team Composition. Inspectors assigned to initial and follow-up EDV

inspections should have the appropriate training and experience. Assigned team
members should remain with the team for the duration of each inspection, with no
other duties. Consideration should be given to participation in the initial EDV

Issue Date: 04/25/11 B-2 37805

 inspections by NRO technical staff, staff from Region II, and/or the host region.

Specific inspection and experience needs for a particular team will depend on the
certified design, the system or systems selected in the sample, and the safety and
risk significance of specific disciplines such as digital instrumentation and controls
(I&C). Some inspections may require the use of contractor support to augment
available NRO and Regional staff.

At least 2 inspectors with a QA background should participate on an inspection

team, particularly for an initial EDV inspection where the design authority is
finalizing the design for its first plant in accordance with 10 CFR Part 52.

e. Additional Guidance. The guidance documented in IMC-2507, and the QA

inspection procedures referenced in Attachment 1 of IMC-2507, provide additional
guidance for the conduct of EDV inspections. See also the inspection procedures
referenced in IMC-2515.

f. Management Entrance and Exit Meetings. An entrance interview between the

design authority’s management and the EDV inspection team members should be
held on the first day of the onsite inspection.

At the conclusion the inspection, the inspection team should discuss their
preliminary findings with the design authority’s management at a scheduled exit
meeting. These exit meetings may be scheduled on the last day of planned
inspection activities or deferred until some later date after a team meeting / briefing
of NRC management personnel. The design authority should be briefed on
ongoing inspection results daily over the course of the inspection.

g. Inspection Documentation. The team will prepare an inspection report that

documents the results of the initial or follow-up inspection(s). The format of the
inspection report will conform to the requirements of IMC-0617. Additional
requirements concerning the inspection report documentation will be given by the
team leader.

h. Follow-up and Enforcement. Section 08 of IMC-2507 discusses enforcement

actions associated with the inspection process. IMC-2507 also contains guidance
for documenting violations and non-conformances.

During an inspection, a significant concern may be identified that warrants

consideration of prompt action (e.g., NRC order, investigation of wrongdoing, or
stop-work consideration). If the inspection team identifies a significant concern, the
team will promptly inform NRO management. The inspection team=s priority will
then become the continued assessment of the concern until the concern has been
resolved.

END

Issue Date: 04/25/11 B-3 37805

 Attachment 1 - Revision History Sheet for IP 37805

ENGINEERING DESIGN VERIFICATION INSPECTIONS

Commitment Issue Description of Change Training Training Comment Resolution

Tracking Date Needed Completion Accession Number
Number Date
Conducted a 4-year search for No ML100140219
N/A 04/01/10 commitments and found none.
CN 10-010
N/A ML110871858 Revised Inspection Procedure to refer None N/A N/A
04/25/11 to Manual Chapter 2507. Added
CN 11-XXX Manual Chapter 2507 to the
references. This revision is in
response to OIG audit (OIG-10-A-02
(ML103020267)).

Issue Date: 04/25/11 Att1-1 37805