DS397 Saf Use Mod RRs with NUSSC comments 18-06-2010

surveillance requirements should also be determined during the design stage (see paras 7.2and 7.6).5.20. Management system criteria on design control should be established and implemented,covering all aspects of the design, including inspection and testing methods, and construction.For the design, measures should be established and documented to ensure that the applicablecodes, standards and regulatory requirements are correctly incorporated into designdocuments for safety related items. Measures should also be provided for verification of theadequacy of design. This verification should be performed by individuals other than thosewho made the original design. Further recommendations and guidance are given in Section 2.5.21. Detailed safety analyses should be provided to the extent necessary for the potentialhazards. The analyses should determine whether the design will be safe, and in particularshowing that:– a new system or component complies with all relevant safety standards and that it willfunction safely, for all conditions of operation;– new systems will not adversely affect the safety characteristics of other itemsimportant to safety under any conditions of operation, or the safety relevantcharacteristics of the reactor;– an experiment or modification can be carried out without significantly increasing thedoses to staff personnel and members of the public; this should be in accordance withthe radiation protection optimization principle, or with the risk of an accident;– a modification or experiment can be carried out without adversely affecting the safetyof reactor operation and that it will not introduce new hazards at any stage of theproject.Care should be taken that up to date safety documents and data are used in these analyses.5.22. It should be demonstrated and documented that the:– introduction of the new system does not adversely affect the consequences, in terms ofradiological or other hazards, for any conditions of reactor operation; and that– failure of the new system does not result in any new event scenario with significantlyincreased risks (different failure modes may have to be considered).25