511
1 INTRODUCTION
Modificationisinevitablewithinanytypeofbusiness
and arises from the need to respond and adapt to
varyingconditions.Modificationsmayberequiredto
the equipment, operational policies, and
organizational structure or personnel. Whenever a
modification ismade, the potential consequences of
that modification should be assessed before
implementation.
In the area of European Railways the release of
European Commission regulation 352/
2009 (2009a)
has led to a new approach regarding the Safety
Management which is called Common Safety
Methods (CSM). One part of this CSM is a new
process for judging the significance of a proposed
modification.Aftertheanalyzat
ionofthisprocessfor
judgingmodificationswewilldiscusstheapproaches
usedinthetransportsectorsofaviationandmaritime
transportation.
A next step all three approaches used in the
transport sector are compared regarding their
structure, the role of the proposer, expert
organization and regulatory body within each
methodandtherelevantasp
ectswhichareusedfor
thedeterminationofthesignificance.
Furthermore, we will take into account
experiences in another area of high public interest
regarding safe operation, the procedure to classify
modifications in nuclear power plants (NPPs) is
includedasitisusedintheGermanFederalStateof
Baden‐Württemberg.
2 MANAGEMENTPROCESSFORTHECOMMON
SAFETYMETHODAPPLIEDTORAILWAY
SYSTEMS
The revised CSM regulation 402/
2013 (EC 2013)
containsthedescriptionoftheCSMapproach.Main
Process of Judging Significant Modifications for
Different Transportation Systems compared to the
Approach for Nuclear Installations
N.Petrek
TechnischeUniversitätBraunschweig,Germany
H.P.Berg
BundesamtfürStrahlenschutz,Salzgitter,Germany
ABSTRACT: The implementation of the CSM regulation by the European Commission in 2009 which
harmonizestherisk assessment processandintroduces a rathernewconceptofjudgingchanges within the
Europeanrailwayindustry.Thiscircumstancehasrisenthequestionhowothertechnologysectorshandlethe
aspect of modifica
tions and alterations. The paper discusses the approaches for judging the significance of
modifications withinthethreetransportsectorsofEuropeanrailways, aviation and maritime transportation
andtheprocedurewhichisusedintheareaofnuclearsafety.Wewilloutlinethesimilaritiesanddifferences
betweenthesefourmethodsanddiscusstheunderlyingreasons.Finally,wewillta
keintoaccounttheroleof
theEuropeanlegislatorandthefundamentalideaofaharmonizationofthedifferentapproaches.
http://www.transnav.eu
the International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 9
Number 4
December 2015
DOI:10.12716/1001.09.04.07
512
partistheharmonizedriskassessmentprocesswhich
has to be applied for all safety relevant and
significantchangesandwhichisshowninFigure1.
Against this background, the significance of the
changeanditsdeterminationbecomeafundamental
element of this risk assessment process. For the
determinationof
thechangetheproposershallapply
the following six criteria which are described in
Article4oftheCSMregulation:
1 failure consequence: credible worst‐case scenario
in the event of failure of the system under
assessment, taking into account the existence of
safety barriers outside the system under
assessment;
2 novelty used in implementing the change: this
concerns both what is innovative in the railway
sector, and what is new for the organization
implementingthechange;
3 complexityofthechange;
4 monitoring: the inability to monitor the
implemented change throughout the system life‐
cycleandinterveneappropriately;
5 reversibility:
theinabilitytorevertto the system
beforethechange;
6 additionality:assessmentofthesignificance ofthe
change taking into account all recent safety‐
related changes to the system under assessment
andwhichwerenotjudgedtobesignificant.
Inthisrespectthereisnofurtherguidanceforthe
applicationofthesecriteria.Due to this uncertainty
with the correct application different approaches
weredevelopedonthebasisofthegivencriteriaand
the relevant parts of the CSM regulation which are
broadly discussed in (Petrek 2014a). Besides the
correct understanding of the criteria and what they
assess, also the
weighting of the criteria and the
thresholdvalueabove whichachange issignificant
is not given by the regulation itself. The
determinationofthistwoelementsbytheapplication
of multivariate statistics is described in (Petrek
2014b).
Figure1. Harmonized Risk Management Process of CSM
regulationNo.402/2013.
(Petrek 2014a) also develops the framework for
judgingthesignificanceofachangewhichisshown
inFigure2.Inthisfiguretheassessmentofthesafety
relevanceand significanceofthe change arepartof
thelightbluebox.Firststepofthewholeprocessis
the analysis, if the
change falls within the scope of
theCSMregulationfollowedbytheconsiderationof
the criterion “Additionality”. This consideration
takesintoaccount,if therewere anysafetyrelevant
changeswithinthesameareaoftheproposedchange
whichwerenon‐significant.
If the change is considered as significant by the
application of the criteria, the proposer has to
evaluatetheassociatedriskitselfandhowitwillbe
managed.
The purpose of the process of Figure 2 is to
classify the proposed change into categories. A
change,which isneithersafetyrelatednordoes fall
withinthescopeoftheCSM
regulation,resultsinthe
end of the CSM process. Thus, there is no further
assessmentofthesignificance ofthechange andno
application of the harmonized risk management
process but, in turn, an application of QM‐
Procedures, if such procedures are required by the
Safety Management System (SMS) of
the company.
Forexample,thesubstitutionoffaultycomponentsof
thedoorcontrolofatrainwithstructurallyidentical
componentsdoesnotrequirethefurtherapplication
oftheCSMriskmanagementprocess.
Figure2. Caption of the framework of the CSM risk
managementprocess.
Furthermore, the application of own safety
procedures is required for those changes which are
safety related but not significant or which are
significantduetotheanalysisofthecriteriabutthe
proposer decides that the associated risk is either
already controlled or can be controlled by well‐
knownmeasures.Only
forsignificantchangeswhich
include risks that cannot be controlled by well‐
known measures the proposer has to apply the
harmonizedriskmanagementprocess.
The application of an own safety procedure and
theapplicationoftheharmonized riskmanagement
processaredistinguishedregardingtheparticipation
of an independent assessment body.
Within the
513
harmonized process an independent assessment
body must check the suitability of the chosen
methods as well as the results of the risk
managementprocess.
Consequently,thesignificanceofachangeisnot
decisive whether a risk management process has to
be appliedornotbutdetermines if an independent
assessment
isrequiredornot.Inthiscontext,thefour
qualitative criteria innovation, complexity,
monitoringand reversibilityconsider ifthereisany
experience with the change itself and its
implementation or not. Therefore, it is more likely
that a change is significant, if there is only little
experience with the proposed
change within the
companywherethechangetakesplace.Againstthis
background, the implementation of new technology
likethe first‐timeuse ofLEDtechnology withinthe
signalingsystemforrailwaysrepresentsanexample
fora significantchange.Ontheotherhand,addinga
new function to an electronic interlocking is
a
complex task and the interlocking is also highly
safety relevant. However, the company which
implements this type of change usually has the
experience to do so and uses well‐known practices.
Therefore, in this case the change is not significant
and the company has to apply its own safety
procedure without the participation of an
independentassessmentbody.
3 APPROACHTOEVALUATECHANGESIN
AVIATION
In the area of European aviation the European
AviationSafetyAgency(EASA)isresponsibleforthe
safety management and the certification of aviation
productswithintheEuropeanUnion(EU).Onemain
elementofthe safety
management withintheEUis
the Commission Regulation No 748/2012 (2012),
which lays down implementing rules for the
airworthiness as well as for the certification of
aircraftandrelatedproductsandthe certificationof
designandproductionorganizations.
Article 2 of this regulation constitutes that
products, parts and appliances shall
be issued
certificates,whicharespecifiedinAnnex1(Part21)
of the Commission Regulation. Also design and
production organizations which are responsible for
thedesignrespectivelythemanufactureofproducts,
parts and appliances have to demonstrate their
capability. Moreover, Section B of this Annex
addresses the type certification and the
relevant
proceduresforissuingthesetype‐certificates.Basisof
thetypecertificationaretheapplicableairworthiness
code and any relevant special condition. These
special conditions refer to aspects of the product
whichmaybeunusualregardingthedesignfeatures
orpracticesaswellasto unconventional use of the
product
or unsafe conditions which may appear
during operation. Additionally, the type‐certificate
hastocontainthedemonstrationofcompliancewith
theenvironmentalrequirementswhichrefertonoise
and emission requirements and it has to be shown
that “no feature or characteristic makes it unsafe”.
Furthermore, any aircraft type‐certificate requires a
type‐certificate for the engine or the propeller
installedinthegivenaircraft.
The given Commission Regulation distinguishes
between repairs and changes. Speaking of changes,
point 21.A.19 of Subpart B describes a “change in
design,power,thrustormass[which]issoextensive
that a substantially complete investigation of
compliance
with the applicable type‐certification is
required”. In this case, the changed product can
generally be regarded as a new product which
requires a reinvestigation of compliance with the
airworthiness requirements. An example for a
substantial change in this area is the change in the
numberorthelocationofengines
ofanaircraft.
Beside these substantial changes, Subpart D
addresses further changes to type design and type‐
certificatesanddescribestheprocedureswhichhave
to be done by the proposer. For this purpose,
proposed changes to a type design are subdivided
into three categories: standard changes, minor and
majorchanges
whereassubstantialchangesdescribed
above are also major changes. According to point
21.A.90B,standardchangesrefertoaircraftsof5.700
kgMaximumTake‐OffMass(MTOM)orlessaswell
as to rotorcrafts, sailplanes, balloons or European
Light Aircrafts. For standard changes acceptable
methods, techniques and practices issued by the
EASA
for the identification and implementation of
standard changes have to be applied. If these
conditions are met, a change is regarded as a
standard change and is not subject to an approval
process.
Changes in type design which are no standard
changesareclassifiedintominorandmajorchanges.
In
thisrespect,point21.A.91ofSubpartDdescribes
thatachangeisregardedasaminorchange,ifithas
no “appreciable effect on the mass, balance,
structural strength, reliability operational
characteristics,noise,fuelventing,exhaustemission,
orothercharacteristicsaffectingtheairworthinessof
the product”. All other changes are regarded
as
major changes. This classification determines the
further proceeding for the implementation of the
change. Minor and major changes to a type design
havetoappliedinformandmannerdeterminedby
theEASA.Accordingtopoint21.A.93theapplication
has to include a description of the change which
identifies
all parts of the type design and the
approved manuals affected by the change. In
addition, the application has to outline “the
certification specifications and environmental
protection requirements with which the change has
beendesignedtocomply”.
Minorchangeshavetobeapprovedeitherbythe
EASA or by an appropriately
approved design
organization. Furthermore, minor changes require a
record‐keepingforeachchange.Moreover,variations
ininstructionsforcontinuedairworthinessduetothe
changeshallbemadeavailabletoallknownowners
of affected products. Nevertheless, this type of
approvalisonlypossible,iftheapplicantshowsthat
the change
meets the applicable certification
specifications of point 21.A.101 regarding the
compliance with the airworthiness code and the
environmental protection requirements. In this
context,thesingleinstallationofaGPS‐basedFlight
514
ManagementSystemwithoutanynewfunctionality
ortechnologyandwhichis,inaddition,notlinkedto
theautopilotisregardedasaminorchange.
The applicant for a major change in turn has to
fulfillthe requirementsof point21.A.97. Atfirst, he
has to submit relevant data for the
inclusion in the
type design together with the demonstration of the
compliance of the changed product with applicable
certification specifications and environmental
protectionrequirements.Moreover,theapplicanthas
todemonstratecompliancewiththetype‐certification
basis.In order to demonstrate this compliance with
the type‐certification basis, the applicant has
to
perform inspections and tests according to point
21.A.31 and, if necessary, also flight tests according
topoint21.A.33.Inordertogettheissueofapproval
describedinpoint21.A.103,theapplicantalsohasto
demonstrate that in case of not complied
airworthinessprovisionsanequivalentlevelofsafety
is
providedbycompensatingfactors.Additionally,it
has to be shown that “no feature or characteristic
makes the product unsafe for the uses for which
certificationisrequested”. Incontrasttotheexample
of a minor change, the single installation of a GPS‐
based Flight Management System which has a
dedicated
linkage to the autopilot or the dual
installationof suchasystem is regardedasa major
change.
Figure3. Classification of design changes according to
CommissionRegulationNo748/2012.
RepairsinturnareregulatedbySubpartManda
repair is defined as follows: “A repair means
elimination of damage and/ or restoration to an
airworthy condition following initial release into
serviceby themanufacturerof anyproduct,part or
appliance.”Furthermore,an“eliminationofdamage
by replacement of parts
or appliances without the
necessityfordesignactivityshallbeconsideredasa
maintenance task” which requires no further
approval. Comparable to the classification of
changes, standard repairs are not subject to an
approvalprocess.Theconditionsforstandardrepairs
are oriented to the conditions for standard changes
which are
described above. On the basis of point
21.A.435, all but standard repairs are classified as
majororminorrepairsandthisclassificationshallbe
made in accordance with the criteria which are
definedwithinpoint21.A.91fortheclassificationof
changes. Against this background, repairs to the
load‐bearingstructureof
anaircraftseatareregarded
as a major repair which requires some kind of
engineering analysis or assessment (IAA 2010).
Whereasminorrepairslikearepairwhichislimited
to the aircraft seat and its surface and upholstery
onlyrequirestandardorgenerallyacceptedpractices.
Figure 3 shows the overview
of the exposed
procedurefortheclassificationofchangeswithinthe
Europeanaviationsector.
The assessment of changes in the area of
Europeanaviation,theevaluationofmodificationsin
European air traffic management with the Safety
Scanning Method is discussed in (Petrek & Berg
2015).
4 ASSESSMENTOFMODIFICATIONSAND
CONVERSIONS
OFSHIPS
If a modification of a ship is technically
inappropriate, poorly executed, its risks poorly
understood, or management fails to ensure
communicationtokey personnel, accidents or other
undesired consequences can result. Thus, a formal
and effective management of modification program
playsacriticalroleinpreventingaccidentsand
losses
(ABS 2013). It requires organizational support,
assignment of necessary resources, and a clear,
definedprocess.Therefore,guidancetothemaritime
andoffshoreindustriesisoffered(e.g.ABS2013)asa
tooltoaidinthedevelopmentandimplementationof
aneffectivemanagementofmodificationstrategyto
optimizeexistingrisk
managementefforts.
Modificationsandconversionsofqualifyingships
are zero‐rated under Group 8, items 1 and 2 of
VTRANS 120200 provided, after modification or
conversion, the ship remains a qualifying ship
(VTRANS2010).Thisincludes,forexample:
rebuildingorlengtheningofaship,
updating or improvement of
serviceable
equipment,
structuralalterations.
Itisimportanttonotethatthisprovisionrequires
the ship to be qualifying before the modification
workisstarted.Thismeansthatthemodificationor
conversionofanon‐qualifyingshipisnotzero‐rated
even if the modification or conversion results in a
qualifying
one. However, after conversion the ship
will then be treated in the same way as any other
qualifyingshipforfuturesupplies.
For example, the conversion of a trawler (gross
tonnage of 20.72 tons) to a vessel designed for
commercial scientific research would be zero‐rated
underGroup8,item
1.The servicesofmodifying a
14 ton ship to be a 16 ton ship would not be zero‐
ratedasthemodificationisnotofaqualifyingship.
Where a contract to supply modification services
across a fleet of ships is being undertaken it is
permissibleforpartsbeingmodified
toberemoved
from one ship, be modified, and then installed in a
sister‐ship whose parts are similarly destined for
anothersister‐shipaftermodification.
The interaction between ship repair and ship
conversionisalsodiscussedin(Senturk2011).
515
There are various different kinds of conversions
but no commonly defined definition does exist.
Repairsin accordancewithapproveddrawings and
documentsarenotconsideredtobeaconversion.A
conversionincludes,e.g.,anymodificationsonboard
ofaclassedshipwhichdeviatesfrom theapproved
drawings oranincrease
of the maximum allowable
draft. Considering the various scope of conversion
issuesitistobenotedthatsomemodificationsmay
beregardedtobeso‐calledmajorconversionswhich
is comparable to significant modifications in other
transportationssystemsandinthenuclearfield.
The definition of a major conversion
is to be
distinguishedfromabovedefinitionofaconversion.
Thedefinitionof amajorconversionis individually
provided in the applicable statutory instruments
(SOLAS,Marpoletc.).However,amajor conversion
doesincludebut isnotlimitedtoeachmodification
whichsubstantiallyaltersthedimensionsorcarrying
capacity or engine power
of the ship as all these
measures do normally imply new requirements
which are to be observed. Major conversions
normally do imply complete application of rules
effective at the time of conversion. Moreover, any
conversion which substantially alters the energy
efficiencyoftheshipandincludesanymodifications
that could
cause the ship to exceed the applicable
requiredenergyefficiencydesignindexassetoutin
regulation21isamajorconversion(MEPC2011).
Amajormodificationofashipis,forexample,the
changeofthetypeofvessel,e.g.,fromacargoshipto
a passenger ship in order
to carry more than 12
passengers.Inthiscase,theapplicablerules for the
wholeshiparetobeappliedasinthecaseofanew
built. A simple replacement of the engine the
regulationisnottobeappliedtothewholeship.The
new components must comply
with the latest
regulations.Anotherexamplewouldbeanextension
ofapassengervesselbyanewinsertedsection.This
mightbeseenasasignificantmodification;however,
ithasbeenagreedthatthecurrentrulesasforanew
builtshipisapplicableonlyforthenewsection.
As already
indicated in the maritime
transportation the ships are classified. The objective
of ship classification is to verify the structural
strengthandintegrityofessentialpartsoftheship’s
hull and its appendages, and the reliability and
function of the propulsion and steering systems,
power generation and those other features and
auxiliarysystemswhichhavebeenbuiltintotheship
in order to maintain essential services on board
(IACS2011).
The purpose of a classification society is to
provide classification and statutory services and
assistance to the maritime industry and regulatory
bodies as regards maritime safety and pollution
prevention, based on the
accumulation of maritime
knowledge and technology. The different
classification organizations have their own and not
identicalrules(e.g.DNV2013orDNV‐GL2014).
Any modifications on board of a classed ship
whichdeviates fromtheapproveddrawingsorcause
alterations of previously approved documents are
regarded to be a
conversion of the ship. Such
modificationsnormallydohaveeffectonthevalidity
of class and in addition also on the statutory
certificates issued by the classification society on
behalfoftheflagStateAdministrationorbytheflag
State Administration itself. In so far such intended
modifications are to be
planned well in advance in
orderto maintainvalidityofclassorvalidityofthe
corresponding statutory certificates, or even to
ensure the issue of new additional statutory
certificateswhichmightberequiredafterconversion.
The tasks and roles of the classification society
andflagdependverymuchonthe
flag.Usually,the
flag accepts the results of the investigation of the
classification society, sometimes the flags partly
checkthemodificationsthemselves.
For example in case of Iceland, no major
modifications may be made to a ship, such as
enlargement of the cargo spaces or superstructure,
replacement of the main engine
or modifications
whichaffecttheship’smeasurements,seaworthiness
and stability, safety and/or facilities of the crew,
unless approval has been given by the Icelandic
Maritime Administration, or another party
authorized by the Administration. Modifications
shall be carried out under the monitoring of the
Maritime Administration, and the same rules apply
concerningmonitoringandnotification,asinthecase
oftheconstructionofanewships (IMA2003).
Ships and associated equipment are subject to
prescriptive regulations. This framework contains
very narrow requirements, for example in terms of
number components or maximum capacity. These
provisions restrain further developments. One
consequence is a
delayed introduction of new
developmentsbecause theyare onlypermitted after
theamendmentofthenormativedocument.
Theso‐calledalternativedesignallowstheuseof
solutions as long as the safety equivalence of the
modifications can be demonstrated. It is important
that the realization of the modification must be
approvedbytheflagState.Theprocessofapplying
thealternativedesignisdescribedinFigure4.
For that purpose the formal safety assessment
(FSA) can be applied. FSA is described as a
structured and systematic methodology for rule‐
making, aimed at enhancing maritime safety,
includingsafety oflife,health and
protection of the
marine environment and property, by using risk
analysisandcost‐benefitassessment(IMO2013).
FSA can also be used as a tool to help in the
evaluation of new regulations for maritime safety
and protection of the marine environment or in
makingcomparisonsbetweenexistingandproposed
improved regulations. The basic philosophy of the
FSA is that it can be used as a tool to facilitate a
transparent decision‐making process. FSA should
facilitate the development of regulatory changes
equitable to the various parties thus aiding the
achievement of consensus. Thus, FSA is seen as an
alternativeto
thesetofexistingregulations.
Thealternativesofperforming ariskanalysisare
illustratedinFigure5.
516
Figure4.Alternativedesign.
Figure5.Risk‐basedmethodsinthemaritimeindustry.
In addition, FSA provides a mean of being
proactive, enabling potential hazards to be
considered before a serious accident occurs (e.g.
Zaman etal.2015). However, inarecent review on
the FSA (Psaraftis 2012) expresses a need for
scientificdiscussioninthemaritimedomainabouta
numberoffundamentalissuesconcerningtheFSA.
5 COMPAR
ISONOFTHEAPPLIED
APRROACHESINTHEDIFFERENT
TRANSPORTSYSTEMS
The comparison of the three different transport
systems shows that in the area of railways and
aviation a European regulation describes the
frameworkfortheimplementationofmodifications.
Concerningmodificationsinmaritimetransportation,
there does not exist a com
parable European
regulation, while there are international guidance
notesandgeneralrulesfromdifferentorganizations
like the American Bureau of Shipping (ABS), the
International Maritime Administration (IMA) and
also from the International Association of
Classification Societies (IACS). The classification
societies are an essential element within the
assessment of modifications in ma
ritime
transportation. However, the responsibilities of the
classification societies and the further requirements
fortheimplementationofmodificationsdependson
theflagoftheshipandnationalregulations.
Furthermore, the comparison points out that all
three approaches contain an explicit or implicit
definition which modifications are relevant. Within
theapproachofEuropeanrailwaystheproposerhas
to check, if the change falls within the scope of the
CSMregulation andinthe ongoingifthe change is
safety relevant. In thi
s context, repairs do not fall
withinthescopeoftheregulation,iftheyareonlythe
application of well‐known mea
sures or the
substitution of faulty components. In the area of
maritime transportation, repairs are also not
considered to be a modification respectively a
conversion, if the repair is implemented in
accordancewithapproveddocumentsanddrawings.
The conversion in turn is any modification which
deviatesfromtheapproveddrawings,alt
houghthis
definition hasnogeneralvalidityand also depends
on the flag of the ship. In the area of European
aviation, the regulation distinguishes between
repairsandchangesandthetermrepairsisexplicitly
defined within the given regulation while changes
areonlyimplicitlydefinedby theprovisions within
Subpa
rt D (EC 2012). In contrast to maritime
transportation and European Railways, also major
repairsrequiresomekindof riskanalysiswhilefor
the implementation of minor repairs comparable to
the other two transport areas generally accepted
practicesandQM‐procedureshavetobeapplied.
Regarding the assessment of the modification
it
self,allthreeareas areusingdifferentapproaches.
Whilebasiselementsoftheconsiderationwithinthe
area of European railways are the experience with
theimplementationandfurtherqualitativeelements
like the monitoring and the reversibility of the
change in combination with risk‐based
considerations,withintheothertwoapproachessuch
crit
eria do not have any explicit relevance for the
assessment. Although the use of new technology
often result in major changes, proposed changes in
theareaofEuropeanaviationareclassifiedregarding
their influence on safety relevant elements like the
mass, bala nce or further influences on the
airworthiness. In this context, also the extent of the
changehasaninfluenceonthefinalclassification.
Also within the assessment of modifica
tions in
maritime transportation, the distinction between a
major and a minor conversion is done by the
consideration if any substantial aspect of the ship
will be altered. Additionally, the extent of the
modifica
tionandifithasaninfluenceonthewhole
shipor, incontrast,only alimitedinfluence on one
certaincomponentliketheengineisrelevantforthe
classification. However, the regulations within the
areaofEuropeanaviationaremuchmorerestrictive
517
since the influence of the proposed change on the
certification specifications has to be taken into
account for the classification of the change. One
connecting element between the procedure in the
aviation area and the CSM approach is the
considerationofpreviouschangesinthesameareaas
the proposed
change which were not classified as
major respectively significant changes. In this case,
the cumulative effect may result in a major
respectively significant change such as a repeated
discreteincreaseofspeedbytwopercent.
The purpose of the different approaches is to
classify the proposed modifications within each
transportsysteminordertodeterminetherequired
proceedings for the safe implementation. For this
purpose, the CSM approach has three different
categories:changeswhich are notsafetyrelevant or
which do not fall within the scope of the CSM
regulation,changeswhicharesafetyrelevantandnot
significantandchanges
whicharesafetyrelevantand
significant.Whereasonlysignificantchangesrequire
theapplicationoftheharmonized riskmanagement
process with participation of an Independent
AssessmentBody.Safetyrelevantbutnotsignificant
changes allow the application of own safety
procedures without any independent assessment
neitherfortheclassificationofthechange
norforthe
chosen risk management process and its results. In
contrast, the approach within the aviation area
distinguishes between repairs and changes and
possesses the three categories standard, minor and
major within both groups. Furthermore, the major
change is subdivided into substantial and non‐
substantial changes and some national authorities
like the Irish Aviation Authority (IAA) additionally
differentiates non‐substantial changes into two
subcategories, significant and not significant
modifications to a type design (IAA 2010). In this
context, only standard changes and repairs in the
aviation area do not require a participation of the
authorityor an approved organization. All
types of
minorormajorchanges andrepairsinturnhaveto
beclassifiedandapprovedbytheEASAoracertified
organization whereas major changes and major
repairsalwaysincludesomeformofriskassessment.
This aspects illustrates the restricted room for
maneuvers concerning the assessment and the
implementation of
modifications in this area.
Considering maritime transportation, modifications
inthisarea eithermeetthedefinitionofaconversion
or not. Conversions in turn are classified into two
groups, normal and major conversions, which may
have an effect on the validity of class and the
statutory certificates and normally require a
participationoftheclassificationsociety.Depending
ontheflagoftheship,theresultsofanassessmentof
such a classification society may be accepted or a
participationofthenationalauthorityisrequired.In
addition, some flags do not permit any major
conversions without previous authorization by the
authority or
an authorized organization. Therefore,
thelevelofparticipationoftheauthoritydependson
the flag of the ship but it is obvious that the
regulations in this area are less restrictive than the
regulationsintheareaofEuropeanaviationandgive
moreroomformaneuverstotheproposer.
6
CATEGROIZATIONANDASSESSMENTOF
MODIFICATIONSINNUCLEAR
INSTALLATIONS
The nuclear technology is not monitored by
European or other international authorities. The
licensing and supervision of nuclear installations is
perceived by the respective national authorities.
However, the International Atomic Energy Agency
provides fundamental principles, requirements and
guidancewithrespecttonuclearsafety
whichisnot
legally binding. One safety guide regarding
classificationofstructures,systemsand components
(SSCs)hasbeenrecentlyissued(IAEA2014).
At European level, so‐called safety reference
levels have been defined by the Western European
NuclearRegulators’Associationwhichwererecently
updated (WENRA 2014). These reference levels
should
beadheredtobyallmembercountriesofthe
European Union (EU). In Part G of these reference
levels, the safety classification of SSCs is described.
ThegoalistoidentifyallsafetyrelatedSSCsandto
classify them according to their importance for
safety. Part Q reflects modifications to a
nuclear
power plant (NPP) and it is requested that no
modification degrades the plant’s ability to operate
safely. National regulations and international
agreements are supplemented by a directive of the
European Commission (2009b) which the EU
membershavetoimplementintothenationallaw.
The licensing and supervision of nuclear
installations in Germany is the responsibility of the
Federal States (Länder) who are subject of
expediency supervision of the Federal Ministry for
theEnvironment,NatureConservation,Buildingand
Nuclear Safety (BMUB). In addition to the German
AtomicEnergyAct(Atomgesetz–AtG)(2013),there
existseveralnationalrequirementswhichhaveto
be
consideredintheapproval and supervision process
ofnuclearfacilities.Acomprehensive update ofthe
German sub‐legal nuclear regulations has recently
beenissued(BMUB2015).
Basically, each NPP in Germany must have a
valid operating license. An essential part of this
approval is the condition of the AtG
to show all
planned modifications (plant, operation and
organization) to the competent authority and to
examine their safety relevance. Significant
modifications of systems according to § 7 AtG are
subjecttoapprovalbythesupervisoryauthority.The
implementationofauthorizationsbelowthislevelis
subjecttoagradedsupervisorycontroldepending
on
theirsafetysignificance.
The approach in nuclear technology is that all
importantequipmentofaNPPareclassifiedinterms
of their safety significance, accompanied by
respective requirements and specifications. The
procedural rules for the treatment of modifications
areregulatedinoperatingmanualswhicharespecific
for each NPP
and part of the approval of the
authoritytostart/continuetheoperationoftheNPP.
Moreover, also modifications of the organizational
structure or reduction of personnel are part of the
process.
In the following, the procedure to evaluate
modifications in the Federal State of Baden‐
518
Württemberg is exemplarily described because this
FederalStatehasdevelopedaconceptforregulatory
supervisionofNPPs‐thelastversion is issuedlast
year (UM BW 2013)‐and a supervisory manual
(UMBW2011) with a separate detailed chapter
describing the regulatory plant modification
procedure (LEÄV) anticipating the safety
requirements
forNPPs(BMUB2015).Inthismanual
ofBaden‐Württembergmodificationsaresubdivided
intothreecategories,designatedascategoryA,Bor
CwhereAcontainsthehighestrequirements.
Figure 6 shows the procedure how to categorize
modifications. In a first step, it must be considered
whether the proposed modification
relates to
equipmentwhichissubjecttotheAtG.Inthatcaseit
must be examined whether this modification is a
modification in the legal sense. If yes, the
modificationfallsintocategoryA.
Figure6. Procedure of categorizing modifications of
equipmentinNPPs.
One example is a modification which is not of
nuclearrelevancebutrequiresotherapproval,e.g.by
therespectivebuildingauthority.
Otherwise, it must be checked whether the
modification is subject to the uniform modification
process. In this case, the modification falls into the
category B or category C depending on
the type of
modification: is it only an exchange by equivalent
equipment (components or systems) or leads the
modification to a deviation in the approved
specification. In the first case it would be a
modification of category C, in the second one a
modification of category B. In the following
it is
explained which procedure depending on the
classificationofthemodificationin one of thethree
categoriesisrequiredaccordingto(UMBW2011).
Category A: If the modification belongs to
category A, an authorization procedure is required
by§7oftheAtGandapermitapplicationhasto
be
submitted by the licensee to the supervisory body.
Thelicensingprocedureisconductedinlinewiththe
Nuclear Licensing Procedure Ordinance (2006). In
addition, a probabilistic assessment is required to
check the influence of the modification on the
probabilistic safety analysis (PSA). It must be
explained why the proposed
modification has no
effectonthePSA.
One example is the request for changing the
license pursuant to § 7 AtG for the further
development of the organizational structure at
various nuclear power plant sites run by the same
company.
Category B: If the modification belongs to
category B, it must
be supervised by the authority
under§19oftheAtG.Anotificationoftheplanned
modificationmustbesubmittedbythelicenseetothe
supervisory authority. The implementation of the
modification can only take place if the supervisory
authority has provided its written supervisory
opinionthattheproposedmodification
isseenfrom
the perspective of the supervisor asʺwithout any
concern or not subject to licensing.ʺ An example is
thedismantlingofthewallhydrantsinabuilding;as
partofthisplannedmodificationhydrantshavetobe
takenoutofserviceanddismantledandportablefire
extinguishers have to
be installed. This is a
modification of technical equipment and requires a
modificationoftheoperatingmanual.
The supervisory authority and the technical
support organisation monitor and accompany the
implementation of the planned modifications. In
addition,aprobabilisticassessmentisrequired,asin
case of a modification of category A
showing the
influenceofthemodificationonthePSA.Itmustbe
explained why the proposed modification has no
effectonthePSA.
Category C: If the modification belongs to
category C, it must be monitored by the authority
under § 19 of the AtG. An examination of the
modificationsin
categoryCbyanexpertaccordingto
§20 of the AtG is required. The implementation of
the modification can only start after the expert has
finalised his supervisory report and the authority
doesnotmakeanyobjectionsuntilthemodification
starts. It is, however, no probabilistic evaluation
requiredas
incategoriesAandB.
An example is the replacement of a fluid level
sensorincludingevaluationequipment.Intheframe
ofthismodificationalevelsensor isreplacedbecause
nosparepartsfortheexistingdevicewereavailable
but an equivalent configuration is available on the
market; this is seen
as a minor modification of
technicalequipmentandtheoperationalmanual.
519
Figure7. Categorization of modifications with expected
riskrelevance
Thecategorizationofmodificationswithexpected
riskrelevanceisillustratedinFigure7abovewherea
subordinateoraclearimpactontheexistingPSAis
expected.
Modificationsthatarenotsubjecttotheprocedure
described above are performed by the operator
accordingtoitsinternalwrittenoperatingprocedures
withoutparticipation
oftheauthoritiesand experts.
The supervisory authority will perform random
checksbasedonthedocumentationprovidedbythe
operator,ifthemodificationsarecorrectlyclassified.
7 CONCLUDINGREMARKS
The comparison in Section 5 has illustrated the
fundamentaldifferencesbetweentheapproachesand
regulations of the three different transport sectors.
Firstly,thisaffectslegislationandsupervision,e.g.if
nationalorEuropeaninstitutionsareresponsible.For
both,theareaofEuropeanaviationandtheEuropean
railwaysystem,theapplicablerequirementsdirectly
resultfromEuropeanregulations.Incontrast,inthe
area of maritime transportation, the responsibilities
of the internationally active classification societies
dependontheflagoftheshipwithouttheexistence
of an European legislation. It also depends on the
flag, if in the case of an intended modification the
resultsoftheinvestigationdonebytheclassification
societyareacceptedoriftheflaganditsauthorities
check the modifications
and the results of the
investigation. The consideration in Section 6 has
shown, that alsomodifications inthenuclearsector
are not controlled by an European regulation,
whereasthe Europeanlegislator hasprovided some
effort to create a common framework in nuclear
safety as a reaction to accidents at the NPPs
of
Fukushima‐Daiichiin2011.
Therearealsofundamental differencesregarding
theconsiderationswithintheapproaches.Whilethe
experience of the organization with the
implementationofthechangeandfurtherqualitative
criteriaareanessential partoftheassessmentwithin
theCSMapproach,theseaspectsdonothaveexplicit
relevance
within the other approaches. This means
that the classification of changes within the area of
Europeanrailwaysdepends not onlyonthechange
itselfbutalsoontheorganizationanditsexperience.
On the other hand, basis of the approach which is
used within the nuclear area are deterministic and
risk
‐based considerations, for instance, if any
possible influence by the modification on the PSA
can be excluded. An extensive comparison of the
approaches used in European railways and in
European nuclear safety is discussed in (Petrek &
Berg 2014). Also the approaches in the area of
Europeanaviationaswell
asintheareaofmaritime
transportation use such a risk‐based consideration
without any qualitative aspects. However, the
discussion in the previous sections has shown that
also these three risk‐based approaches are not
identical but have fundamental differences with
regardtotheirstructure.Thisapplies,forinstance,to
the
different number of categories used for the
classification of the modifications within each
method as well as to the degree of participation of
theauthority.Italsobecomesobviousthatthereisno
common definition neither for the term change nor
forthetermrepairandhowtohandlerepairs
varies
between the approaches. Additionally, there are
major differences between the further process
requiredonthebasisofthefinalclassificationofthe
modification and, therefore, also between the room
for maneuvers within each approach. The partially
significant differences within the management of
modifications and changes between the different
technology sectors
raises the question if a
harmonizationof the process and approaches could
be reasonable. This applies in particular to the
general question, if the experience of the proposer
withthemodificationanditsimplementationshould
have any relevance within the assessment and, in
addition, if the further differences described and
analyzedwithinthispaperareacceptableagainstthe
backgroundofsimilartools and fundamentals used
for the demonstration of safety within the different
technologysectors.
REFERENCES
AmericanBureau of Shipping (ABS). 2013. Guidance notes
on management of change for the marine and offshore
industries,Houston,Texas,USA,February2013.
Act on the peaceful utilisation of nuclear energy and the
protection against its hazards (Atomic Energy Act,
Atomgesetz–AtG),23December1959,promulgatedon
15July1985,lastamendmentofAugust28,
2013.
DetNorskeVeritas(DNV).2013.Conversionofships,April
2013.
DNV‐GL. 2014. Rules for classification, DNVGL‐RU‐0050,
GeneralRegulations,EditionOctober2014.
European Commission (EC). 2009a. Commission regulation
(EC) NO 352/2009 of 24
April 2009 on the adoption of a
commonsafetymethodonriskevaluationandassessmentas
referred to in Article 6(3) (a) of Directive 2004/49/EC of
EuropeanParliamentandoftheCouncil,April2009.
European Commission (EC). 2009b. Directive
2009/71/EURATOM establishing a community framework
forthenuclearsafetyofnuclearinstallations
,June25,2009.
European Commission (EC). 2012. Commission Regulation
(EU) No 748/2012 of 3 August 2012 laying down
implementingrulesfortheairworthinessandenvironmental
certification of aircraft and related products, parts and
520
appliances, as well as for the certification of design and
productionorganizations,August2012.
EuropeanCommission(EC).2013.CommissionImplementing
regulation (EU) No 402/2013 of 30 April 2013 on the
common safety method for risk evaluation and assessment
andrepealingRegulation(EC)No352/2009,April2013.
Federal Ministry for the
Environment, Nature
Conservation, Building and Nuclear Safety (BMUB)
2015. Safety requirements for nuclear power plants of 22
November2012,FederalGazette,ATJanuary24,2013B3,
amendment of 3 March 2015, Federal Gazette, AT
March,3
rd
2015B2.
InternationalAssociationofClassificationSocieties(IACS).
2011. Classification societies – what, why and how? June
2011.
IcelandicMaritimeAdministration(IMA).2003.ShipSurvey
ActNo47/2003.
International Atomic Energy Agency. 2006. Fundamental
SafetyPrinciples.SafetyStandardsNo.SF–1,2006.
International Atomic Energy Agency. 2014. Safety
classification
of structures systems and components in
nuclear power plants. SpecificSafety Guide No. SSG‐30,
IAEA,Vienna,May2014.
International Maritime Organization (IMO). 2013. Revised
guidelinesforformalsafetyassessment(FSA) foruseinthe
IMOrule‐makingprocess.MSC‐MEPC.2/Circ.12,London,
UnitedKingdom.
Irish Aviation Authority (IAA). 2010.
Aircraft Design
Changes – Guidance on the approval of modifications and
repairs.January2010.
Maritime Environment Protection Committee (MEPC).
2011. Resolution MEPC.203 (62), MEPC 62/24/Add.,
Annex19,July2011.
Ministry of the Environment, Climate Protection and the
Energy Sector Baden‐Württemberg (UM BW). 2011.
Regulatory Plant Change Procedure (Landeseinheitliches
Änderungsverfahren
–LEÄV),September2011.
Ministry of the Environment, Climate Protection and the
Energy Sector Baden‐Württemberg (UM BW). 2013.
Conceptforregulatorysupervisionofnuclearpowerplantsin
Baden‐Württemberg.June2013.
OrdinanceontheProcedureforLicensingofInstallationsunder
§7oftheAtomicEnergyAct(NuclearLicensingProcedure
Ordinance‐AtomrechtlicheVerfahrensverordnung‐AtVfV)
of18February1977,promulgatedon3February1995,
lastamendmentof9December2006.
Petrek,N.2014a.KonstruktioneinesVerfahrenszurSigni‐
fikanzbewertung von Änderungen im europäischen
Eisenbahnwesen. Ph.D.‐Thesis of the Department of
Architecture, Civil Engineering andEnvironmental Science
oftheTechnischeUniversitätBraunschweig,
August2014.
Petrek, N. 2014b. A New Approach for Judging the
SignificanceofChangesinEuropeanRailways.FORMS/
FORMAT 2014 – 10
th
Symposium on Formal Methods,
September2014.
Petrek,N.&Berg,H.P.2014.Comparingthetwomethods
for judging changes in European railways and in
European nuclear safety. In Nowakowski et al. (eds),
SafetyandReliability:Methodology andApplications:1649
–1654.London:Taylor&FrancisGroup.
Petrek,N.
&Berg,H.P.2015.Approachesandregulations
regarding significant modifications in transportation
and nuclear safety. Safety of marine transport. Marine
Navigation and Safety of Sea Transportation: 283 – 291,
CRCPress.
Psaraftis,H.N. 2012.Formalsafetyassessment:anupdated
review.JMarSciTechnology,17(3),390–402.
Senturk, Ö. U.
2011. The interaction between the ship
repair, ship conversion and shipbuilding industries,
OECDJournal:GeneralPapers,Vol.2010/3,August2011.
VTRANS120200.2010. Repair, maintenance, modificationand
conversion of ships and aircraft and their parts: Repair,
maintenance, modifications and conversions, Draft
November2010.
Western European Nuclear Regulators’ Association
(WENRA).2014.ReportWENRA
safetyreferencelevelsfor
existing reactors, updateinrelation to lessons learned from
TEPCOFukushima‐Daiichiaccident,24thSeptember2014.
Zaman M.B., Santoso A., Kobayashi E., Wakabayashi N.,
Maimun A.2015. Formal SafetyAssessment (FSA) for
Analysis of Ship Collision Using AIS Data. TransNav,
theInternationalJournalonMarineNavigation
andSafetyof
SeaTransportation,Vol.9,No.1,67‐72.
