ML20004F044

Memorandum & Order Denying Licensees Joint Motion to Stay Three Items in Final Rule on Fire Protection for Operating Plants,Pending Judicial Review.Also Denies Petitions for Exemption from Schedule Requirements in Rule

ML20004F044
Person / Time
Issue date:	06/12/1981
From:	Chilk S NRC OFFICE OF THE SECRETARY (SECY)
To:	CONNECTICUT LIGHT & POWER CO. (SUBS. OF NORTHEAST, HARTFORD ELECTRIC LIGHT CO., NORTHEAST UTILITIES SERVICE CO.
Shared Package
ML20004F045	List: ML20004F044 ML20004F046
References
FRN-45FR76602, RULE-PR-50 CLI-81-11, NUDOCS 8106160441
Download: ML20004F044 (52)

Text

1 at

.s\\

UNITED STATES OF AMERICA

/

N MUCLEAR REGULATORY COMMISSION Occero

,y

,m q

COMMISSIONERS:

J(jy12 % h y"ee d the sq 3

N Joseph M. Hendrie, Chairman o

g T*r 'senic.

t victor Gilinsky p

g[I@/W.

h 5

y y

Peter A. Bradford John F. Ahearne 4 "JUNigiggyh -

~M 'h 12 g

'%d 8 WA

$)

8 In the Matter of

//

FIRE PROTECTION FOR OPERATING

)

4 45 Fed. Reg. 76602

~

NUCLEAR POWER PLANTS

)

(November 19,1980)

(10 CFR 50.48) itEMORANDUM AND ORDER (CLI-81-ll)

Several licensees if have jointly moved the Commission to stay three items in the Final Rule on Fire Protection for Operating Nuclear Power Plants, pending judicial review. 45 Fed. P.eg. 76602 (November 19,1980). The items are: Item G*(Fire Protec-tion for Safe Shutdown Capability); Item L (Alternative and Dedicated Shutdown Capability); and Item 0 (011 Collection System for Reactor Coolant Pump) of Appendix R. III to 10 CFR Part 50. These licensees have also requested a stay of the effective and compliance dates for those items.

Subsequently, these licer. sees and several others petitioned the Commission for exemptions from schedule requirements in the rule pursuant to 10 CFR 50.12.

In addition, some licensees also oetitioned for exerptions from various substantive fire protection features required by.ippendix R including Items III.G, III.L and III.O. For the reasons discussed below, the motion is denied.

9 If The movants are: Northeast Utilities Service Company, the Connecticut Light and Pcwer Company, the Hartford Electric l.ight Company, Western Massachusetts Elec-tric Company, Northeast Nuclear Energy Company, Boston Edison Company, Florida Power and Light Company, and Arkansas Power and Light Company.

JD$8h

/

si eo ieoq/./ l

2 I.

Introduction Before addressing the motion for a stay, it would be useful to review the events leading to the promulgation of 10 CFR 50.48 and Appendix R to Part 50.

The NRC's current concern with fire protection was initiated by a fire at the Browns Ferry Nuclear Station in March 1975. The fire damaged over lc00 electrical cables and caused the temporary unavailability of some core coolina systecs.

Because this fire did substantial damage, the NRC established a Special Review Group which initiated an evaluation of the need.or improving the fire protection programs at all nuclear power plants. The group found serious design inadequacies regarding fire protection at Browns Ferry, an its report " Recommendations Related to Browns Ferry Fire" (NUREG-0050, February 1976), contained over fifty reconsnen-dations regarding improvements in fire prevention and control in existing facilities.

The report also called for the development of specific guidance for implementing fire protection regulations, and for a comparison of that guidance with the fire protection program at each operating plant.

NRC developed technical guidance from the technical recomendations in the Special Group's report, and issued those guidelines as Branch Technical Position Auxiliary Power Conversion Systems Branch 9.5-1 (B7P 9.5-1), 2] " Guidelines for Fire Protection for Nuclear Power Plants." This guidance did not apply to plants operating at that time. Guidance to operating plants was provided later in Appendix A y to BTP 9.5-1 which, to the extent practicable, relies on BTP 9.5-1.

The guidance in these documents was also published for public comment as 2/

Rather than serving as inflexible, legal requirements that must be followed by licensees, issuances such as regulatory guides and branch technical posi-tions are meant to give guidance to licensees concerning those methods the staff finds acceptable for implementing the general criteria embcdied in the NRC's rules.

--See, e&, Pstition for Emergency & Remedial Action, CLI-78-6, 7NRC400,406(T97BI,GulfStatesutilitiesComoany(RiverBendStation, Units 1 and 2), ALAB-444, 6 NRC 760, 772 (1977).

3]

Guidelines for Fire Protection for Nuclear Power Plants Occketed Prior to July 1, 1976.

,,,,v,

.,,-c,

,~,- - -, - - - -,, -

g

-em

-ev--

w,

-,,-n,.---,,a,.,

---,,,--e.---

g,-

n.

e,,--,

-w-,-m--e,.,-a-,,,++ew--w

--w,,,.,

m,,,

.w., ---e9s

3 Regulatory Guide 1.120, " Fire Protection for Nuclear Power Plants" (June 1976).

In response to public comment, the NRC issued an extensively revised version of Regulatory Guide 1.120 for further public comment.

In May 1976, the NRC asked licensees to compare operating reactors with BTP 9.5-1, and in September 1976, those licensees were informed that the cuidelines in Appendix A would be ured to analyze the consequences of a fire in each plant area.

Early in 1977 each licensee re3ponded with a Fire Protection Program Eval-uation which included a Fire Hazard Analysis. These evaluations and analyses iden-tified aspects of licensees' fire protection programs that did not conform to the NRC guidelines.. Thereafter, the staff initiated discussions with all licensees aimed ar. achieving implementation of fire protection guidelines by October 1980.

The staff held many meetings with licensees, conducted extensive correspondence with them, and visited every operatir.g reactor. As a result, many fire protection items were resolved, and agreements were mer,.ialized in Fire Protection Safety Evaluati,on Reports issued by the NRC. Other fire protection issues remained un' resolved.

By early 1980, most operating plants had implemented most of the guidelines in Appendix A.

However, as the Commission noted in its Order of May 23, 1980, the fire protection program has had some significant problems with implementation. 3/

Despite the staff's efforts, several licensees had expressed continuing disagree-ment with, and refused to adopt, recommendations relating to several generic, issues, including the requirements for fire brigade size and training, water supplies for fire suppression systems, alternate and dedicated shutdown capability, emergency lighting, the qualifications of seals used to enclose places where cables pene-trated fire barriers, and the prevention of reactor coolant pump lubrication system fires. To establish a definitive resol" tion of these contested subjects f/

11 NRC 707, 718 (1980).

~.

4 in a manner consistent with the general guidelines in Appendix A and to assure timely compliance by licensees, the Connission issued a proposed fire protection rule and its Appendix R, which was described as setting out minimum fire protection require-ments. 45 Fed. Reg. 36082 (May 29, 1980). The fire protection features addressed included protection of safe shutdown capability, emergency lighting, fire barriers, associated circuits, reactor coolant pump lubrication system, and alternate shutdown systems. The Commission stated that it expected all modifications (except for alter-nate and dedicated shutdown capability) to be implemented by November 1,1980. ff As originally proposed. Appendix R would have applied to all plants including those for which the staff had previously accepted other fire protection modifica-tions. After analyzing connents on the rule, tne Commission determined that only three of the fifteen items in Appendix R were of such safety significance that they should apply to all plants, including those for which alternative fire protection actions had been approved previously by the staff. These items are protection of safe shutdown capability (including alternate shutdown systems), emergency lighting, and the reactor caviant pump lubrication system. Accordingly, the final rule requires all reactors licensed to operate before January 1, 1979, to comply with these three items even if the NRC had previously approves alternative fire protection features in these areas. 45 Fed. Reg. 76602 (Nov. 19, 1980). However, the final rule is more flexible than the proposed rule because Item III.G now provides three alternative fire protection features which do not require analysis to demonstrate the protection of redundant safe shutdown equipment, and reduces the acceptable distance in the physical separation alternative from fifty feet to twenty feet.

In addition, the rule now also provides an exemption procedure which can be initiated by a licensee's assertion that any required fire protection feature will not enhance fire protection safety in the facility or that such modifications may be detrimen*al to overall Sj M. at 719.

5 facility safety.

10CFR50.48(c)(6).

If the Director, Nuclear Reactor Regulation determines that a licensee has made a prima facie showing of a sound technical basis for such an assertion, then the implementation dates of the rule are tolled until final Comission action on the exemption request.

Movants have requested a stay of Item III.G. Protection of Safe Shutdown Capabil-ity, the related Item III.L., Alternate Shutdown System, and Item III.0, Reactor Coolant Pump Lubrication System.

II. Stay Request In deciding whether to grant a stay pending judicial review, the Comission considers four factors: (A) whether 'movants are likely to prevail en the merits; (B) whether movants will be irreparably injured without a stay; (C) whether other interested parties would be harmed by a stay; and (D) whether the public interest supports a stay. Virginia Petroleum Jobbers Association v.

FPC, 259 F.2d 921, 925 (D.C. Cir.1950); Washington Metropolitan Area Transit Comission

v. Holiday Tours, Inc., 559 F.2d 841, 843 (D.C. Cir. 1977); see also 10 CFR 2.788.

For the reasons discussed below, we find that Nyants have utterly failed to sustain their burden. Accordingly, their motion is denied.

A.

Probability of Success on the Merits Movants contend that the rule is defective because it is not supported by an adequate statement of basis and purpose or by an adequate record. They also assert that there were a number of procedural flaws in the process used in the promulgation of the rule. They allege that the fire protection rule is an unlawful attempt to avoid adjudication, and contend that plant-by-plant adjudications were required because there are material factual disputes regarding each affected facility. Movants also believe that the fire protection rule is really a license amendment and, thus,

,a r-e

6 believe they are entitled to a hearing under Section 189 of the Atomic Energy Act of 1954, 42 U.S.C. 5 2239, and 10 CFR 2.204. Movants contend that the f RC abused its discretion by undertaking the rulemaking when the agency previously had sought to deal with fire protection problems as they concerned each individual nuclear facility.

Movants also challenge the agency's decision to "backfit" Items III.G, III.L and III.0, for alleged failure to comply with the terms of 10 CFR S 50.109(a) and as an impermissible retroactive rulemaking.

1.

Basis and Purpose fiovants challenge the adequacy of the record supporting Items III.G, III.L. and III.O. For the past several years, the NRC staff and licensees for all operating reactors have engaged in extensive discussions and exchanges of correspondence regard-ing the many aspects of fire protection, including Items III.G, III.L. and III.O.

These' interactions have led to the creation of a substantial volume of publicly available material containtrig the factual premises and policy considerations underly-ing the various portions of this fire. protection rule. 6f These documents must be considered part of the record for this rulemaking and they provide a more than adequate basis to support the final rule. L/

In particular, a review of the record 6/

Additionally, congressional hearings on the Browns Ferry fire contain informa-tion about the fire protection issues which was available to the Comission when it adopted the rule. Sag Browns Ferry Nuclear Plant Fire: Hearings Before the l

Joint Comittee on Atomic Energy, 94th Cong.,1st Sess. (1975).

7/

Although Federal Rules of Appellate Procedure 16 and 17 speak of a " record" that l

must be compiled and filed for the purpose of judicial review, this record for informal, notice and coment rulemaking is to be distinguished from the " record" compiled in a formal, "on the record" rulemaking with its more elaborate pro-cedural requirements. See National Nutritional Foods Ass'n v. Wainberger, 512 F.2d 688, 701 (2d Cir.), cert. denied, 423 U.S. 827 (1975).~ The record in informal rulemaking consists of copies of the notice of rulemaking, any coments on the proposed rule, the final rule supported by a general statement of basis and purpose, 5 U.S.C. 553(b)-(c), and those background materials that indicate adequate support for the rule's factual premises, see Portland Cement Ass'n v.

Ruckelshaus, 486 F.2d 375, 393 (D.C. Cir. 1973), cert. denied, 417 U.S. 921 (1974). See generally 1 K. Davis ~ Administrative Law Treatise, SS 6:4, : 10, :13 (2d ed. I M ).

t l

i

-, _,..,. -. -.. ~.,

7 shows that the movants are unlikely to succeed on the merits of their arguments regarding Items III.G, III.L and Item III.O. The specific detaffs of the record for these Items are ' discussed in order below.

a. III.G. Protection of Safe Shutdown Capability All reactors are designed to include redundant independent equipment in safety systems so that the failure of any component or subsystem will not prevent the func-tion of a safety system. A fundame.tal purpose of the fire protection requirements is maintenance of the ability of safety systems to shut down a nuclear power plant in the event of failure caused by a fire. 8f Item III.G of the final rule is intended to accomplish this goal by providing ifcensees a choice from among three specific fire protection features that would ensure that redundant safety equipment would be protected from damage by a single fire in a fire area. These features are:

(1) separation by a fire barrier having a three-hour rating; (2) enclosure of one redundant train by a fire barrier having a one-hour fire rating in combination with automatic fire detection and suppression systerrs; or (3) physical separation

• of redundant systems by twenty feet of space free of intervening combustible material and automatic fire detection and suppression systems.

If none of these features can be achieved in a specific fire area, then an af ternative or dedicated shutdown system should be installed. Licensees could also request an exemption from these requirements based on a fire hazards analysis for a specific plant.

Electrical cables which carry power to this equipment must also be redundant and independent to preserve the. action of safety systems.

Thus, for example, cables which connect to one set of safety equipment must be separated froir. the cables which connect to the redundant safety equipment so that the same event will not simultaneously disable both sets of cables and, thus, their connected safety equipment. Most cables 8]

STP 9.5-1, App. A., pg. 2, A.2 (1976).

-e..-

-v-

,r----

8 are grouped together in metal cable trays; and trays containing cables connected to redundant safety equipment are usually physically separated from each other.

Never-theless, the fire at Browns Ferry showed that some redundant cables were not adequately separated and could be simultaneously disabled by the same fire. For example, cables connected to one division of safety equipment were close to. other cables connected to the redundant safety equipment. Even though the cables from one division were in electric conduit (lightweight metal pipes) and the cables from the other division were in metal trays, the burning cables in the trays caused the cabla in the conduit to fail. 9f Moreover, redundant systems were found not to be independent as previously believed because non-safety cables connected to safety cables were not recognized as being capable of causing the failure of safety equipment. At Browns Ferry, these non-safety circuits, which are also called " associated circuits," were not separated into divisions. As a result, the fire simultaneously damaged both sets of non-safety cables and caused the failure of 'edundant safety equipment.10]

As a result of the experience at Browns Ferry, and in accordance with national and international publications on fire protection at nuclear power plants lif the NRC, beginning in 1976, estabitshed a guideline that required redundant safety related cable divisions in new plants should be separated by fire barriers having a mini-mum fire resistance rating of three hours.12/ Three-hour barriers were also established 9]

NUREG-0050 at 36.

~~~10/For extmple, redundant control circuits providing power to operate valves neces-sary for safe shutdown were simultaneously disabled by fire damage to associated non-safety circuits which connected the safety circuits to indicato* lights in the control room. NUREG-0050 at 35-36.

11/ Among the documents considered by the NRC are "The International Guidelines for the Fire Protection of Nuclear Power Plants," 1974 Edition, 2nd Reprint, published on behalf of the National Nuclear Risks Insurance Pools and Association and "Speci-fications for Fire Protection of New Plants" published by Nuclear Energy Liability and Property Insurance Association; see BTP 9.5.1-16.

M/ BTP 9.5-1, pp. 9.5.i-24.and 9.5.1-52 (1976).

9 as separations between many other redundant safety relate.d systems.13/

These guidelines are consistent with the well-recognized principle that walls having a tnree-hour fire rating should be used in significant comercial, residential, and industrial Latidings wherever essential structural features must be protected from fire damage. H/

For plants already built or operating, staff recognized that tne separation of redundant safety systems by three-hour fire barriers might not always be possible.

Accordingly, the guidelines in Appendix A provided that equivalent protection could be provided by a combination of alternative fire protection features including physical separation, fire detection and suppression systems, fire barriers or enclosures having less than a three-hour fire rating, and fire retardant coatings.15/ If a suitable ecmbination of features could not be achieved in a plant alreadv built and operating, an alternative or dedicated shutdown system was to be considered.16/ The guidelines also addressed'the treatment of associated circuits. Associated circuits were either to be treated as safety circufts regarding separdtion and independence or were to be adequately isolated from safety circuits.17/

These guidelines were used by each licensee to prepare a Fire Hazard Analysis which evaluated the potential effects of a fire at each operating utility. The NRC staff reviewed each Fire Hazard Analysis, visited each plant, and prepared a Fire Safety Evaluation Report (Report) for each plant. Each report described the various i

l

-13/ See, for example, BTP 9.5-1, pg. 9.5.1-54 which requires three-hour barriers between redundant switch gear safety divisions, battery rocms, and each battery room and the rest of the plant.

(

14/ See, for example, the " Fire Protection Handbook," Fourteenth Edition, National Fire Protection Association, 6-37 (1976).

15/

See, for exarple, BT? 9.5-1, App. A at pg.12, D.l(a)(2) and pg.15, D.1(j) (1976).

16/ BTP 9.5-1, App. A at pp. 2, 12, 39 (1976).

l 17/ See, for example, Reg. Guide 1.75, Rev. '2, pp.1.75-2 and 1.75-3 (1979).

l l

l

10 fireprotectionfeatureswhichwouldimplementtheguidelines.18/ All operating plants were found to require modifications to protect redundant safe shutdown equip-ment. 19/ Subsequently, several licensees installed the fire protection features described in the Reports, including the rercating of associated circuits or installa-tion of relays to isolate associated circuits fran safety circuits. 20/ Others installed alternate or dedicated safe shutdown systems. 21/ However, some licensees questioned whether all the modifications proposed by the staff to protect safe shutdown systems were needed; and in spite of extensive explanations by the staff, these licensees refused to voluntarily implement all of those modifications. Because the staff believed that implementation of those fire protection features was necessary to assure that a single fire would not disable redundant safe shutdown systems, the staff included proposed Items II.A.2.f, III.G, III.M, II.E, III.Q, and II.A.3 in the proposed rule issued on May 29, 1980.

45 Fed. Reg. 36082.

Iten II.A.2.f provided that fire retardant, heat shields, or local fire barriers shall be provided between redundant safe shutdown systems and components or between such systems where their physical separation is inadequate to ensure that automatic and manual fire suppression can limit fire damage to one division of shutdown systems.

--18/ See, for example, the NRC Fire Protection Evaluation of February 22, 1980 for Haddam Neck, a facility operated by one of the movants.

Staff informed the licensce.that an alternate shutdown system would be required because the inad-equate separation of electrical cables and equipment was not adequately com-pensated for by flame retardant coatings and fire suppression systems.

Pp. 4-1 and 4-9.

19/ See, for example, the Fire Protection Safety Evaluation Report for Pilgrim Nuclear Station, Unit No.

l.,

in which the staff found that additional analysis of cable separation was required because neither the existing separation between cables nor the asbestos sheets interposed between cables provided adequate fire barriers.

P. 4-13 (1978).

Inadequate separation of redundant cable trays was also identified in several other plants including Millstone Nuclear Power Station, Unit No. 2, Fire Protection Safety Evaluation Report at pp. 4-7 to 4-8 (1978).

20/ See, for example, Fire Protection Safety Evaluation Report for Arkansas Nuclear One, Unit 1, pg. 3-3 (1978).

21/ See, for example, Memorandum from Edson Case to Commission which reported that five plants had installeo alternate or dedicated shutdown systems and that twelve more plants requ' ired such modifications (July 6,1979).

t 11 4

Item III.G of the proposed rule provided that the protective features to protect safe shutdown capability could be a combination of several measures already familiar to licensees, i.e., fire barriers, physical separation, automatic and manual fire suppression capability, fire retardant coatings, and af ternative shutdown capability.

Item III.G also contained a datailed discussion of the combination of fire hazards, susceptibility activities, fire suppNssion means available, and availability of alternative shutdown capability that would have to be considered in evaluating the effectiveness of fire protection in areas containing safe shutdown equipment.

Item III.M of the proposed rule required that fire barriers separating fire areas, or equipment, or components of redundant ;ystems important to safe shutdown in an area should have a fire rating of three hours unless a lower rating is justified by a fire hazard analysis. As discusced above, such three-hour barriers are a well-recognized fire protectiorc feature. 2_2/ Moreover, in 1977, the staff explained its choice of a three-hour barrier in a pubif cly available memorandum to the Advisory Committee on Reactor Safeguards. Enclosure A.

Staff gave five reasons for choosing three-hour barriers. First there is no precise quantitative relation between the amount l

of cembustible material in a fire area (tne fire load) and the rating of a fire barrier that will not be breached by a fire in that area.

Thus, an 'issessment of the fire I

load in a fire area will provide only a general estimate of the appropriate fire rating for a barrier that would isolate a fire in that area.

Second, a three-hour barrier provides the plant fire brigade an extra margin of time fit fighting a fire.

l The extra time is especially important for nuclear power plants located in remote locations. For such plants, fire fighters in the vicinity would require additional time to respond to a call for help from the plant. Third, a three-hour barrier is the minimum fire related barrier that is constructed entirely of non-combustible f

material.

Fourth, three-hour barriers are contr.only used to protect buildings which i

are "high value risks." Finally, three-hour barriers provide a safety margin to 22/ See Regulatory Guide 1.120, Sections C.4.a. (1) and C.4.c.(2) (1977).

1 I

12 compensate for the uncertainties over the level of transient combust 1bles which may be introduced into the plant over its 40-year life.

Iten II.E of the proposed rule provided that no additio s1 fire hazard analysis would be needed for redundant systems and components separated by either a three-hour fire barrier or fifty feet both h,rizontal and vertical of clear air space. Lesser fire barriers or separations would require justification.

Item III.Q of the proposed rule required either that associated circuits be isolated from safety circuits, or, if they could not be isolated, be treated as part of the safe shutdown circuit with which they were associated. Reference was made to Regulatory Guide 1.75, which introduced the concept of associated circuits in 1974, and IEEE 384-1974.

Item II.A.3 of the proposed rule required the provision of alternative shutdown capability if safe shutdown could not be ensured by a combinatica of fire protection features including barri*ers and detection and suppression systems.

Comentors objected to the level of detail in proposed Item III.G. They also objected to the fifty-foot separation criterion in Item II.E; Alabama Power and Light noted that a twenty-foot separation is accepted practice in the nuclear industry and the Edison Electric Institute stated that in the past the NRC considered adequate a twenty-foot separation. Some commentors requested a definition of associated circuits.

Several comentors contended that they could not identify all associated circuits and take the required actions in the time period provided by the rule.

In response, much of the detail was deleted from Item III.G as proposed and the five proposed items discussed above were consolidated into Item III.G of the final rule, which provided three acceptable alternatives for ensuring maintenance of the redunoant shutdown capability in the event of fire.

They are: (1) separation of redundant safety trains by a three-hour fire barrier; or (2) separation of redundant

0 13 i

trains by twenty feet free of intervening combustibles coupled with fire detectors and an automatic fire suppression system; or (3) enclosure of one redundant safety train by a ene-hour fire barrier coupiel with fire detectors and an automatic fire suppression system. Thus, the final rule relaxes some of the requirements in the propo. sed rule and provides. licensees with greater flexibility.

Instead of a fifty-foot separation between redundant systams, a twenty-foot separation is now considered adequate without analysis. An additional alternative, enclosure of one redundant safety trr.in by a.one-hour fire barrier coupled with fire detectors and an automatic fire suppression system, is available to demonstrate the protection of redundant safe shutdown equipment without further analysis.

In addition, associated circuits that can adversely affect redundant trains of safety equipment are to be treated in the same manner as redundant safety circuits.

If these features cannot be provided, then an alternate or ded'icated independent safe shutdown capability is required.

The statement of supplemental information (Statement) accompanying the final rule explained that the rule specifies design basis protective features instead of a design basis fire because it is not possible to predict the specific conditions under l

which fires may occur and propagate. That Statement also discussed the bases supporting the well-known choice of a three-hour fire barrier.

Such barriers are inherently reliable because they are passive and thus not subject to mechanical failure. Moreover, the choice of three-hour barriers is consistent with the poten-tially serious consequences of a fire in a nuclear power plant a.r.d is in the range of values used for barriers in c.omparable industrial properties. The Statement goes on to explain that if specific plant conditions preclude the installation of a tnree-hour barrier, then licensees may rely on alternate methods that provide equivalent l

fire protection. The example analyzed in the Statement is the combination of a one-hour barrier with an automatic suppression system. The Statement explains that because a fire may not imediately actuate an automatic suppression system, a one-hour barrier is also required to protect the redundant safety train frem fire until the suppression s'ystem goes on.

14 Regarding associated circuits, the Statement notes that the definition of~

associated circuits was provided in Reg. Guide 1.75, and IEEE Standard 384-1974, a commonly used industry standard. Staff also noted that the objections by some

~

commentors clearly indicated that they understood the proposed requirements regarding associated circuits. Since the rule has been issued, the NRC staff has met with some licen' sees to discuss associated circuits and provided a modified definition of asso-ciated circuits in a February 20, 1981 generic letter sent to all power reactor licensees with plants licensed prior to January 1,1979.

Exhibit B.

The new defini-tion of associated circuits removes any uncertainty over their identification.

Although the new definition includes more types of circuits, it does not appear to materially affect the number of circuits which will be identified as associated circuits because the definition now excludes circuits which are protected by coordin-ated circuit breakers, fuses, or other such devices. Credit previously given for such devices is uncertain. No licensee has requested an exemption on the basis of inability to identify associated circuits.

In addition to the Statement of Consideration, other publicly available informa-tion long known to licensees supports the rule. For example, there were an extensive series of fire protection discussions between the staff and licensees preceding promulgation of this rule. As discussed above, the requirement of a three-hour fire barrier was well-known even before the proposed rule was issued for comment. Sim-ilarly, NRC documents have long-recognized the principle of substitution, which permits licensees to use protection features that provide equivalent protection to redundant safe shutdown that cannot be separated by a three-hour barrier. 23/

The Division of Safety Systems, Nuclear Reactor Regulation, for several years has used a twenty-foot separation criterion in reviewing license applications for new plants. The need for such physical separation is also supported by the results of cable fire tests reported by Sandia Laboratories in 1977 and by a draf t report pre-and the Fire Protection See, for example, Reg. Guide 1.120, pg(.1.120-12 (1977),

~-'23/ Handbook, Fourteenth Edition, p. 6-37 1976).

+=-

• e---

y'.-p eiT e+y 3

m e--,r-

.->,.-w-rp, r,eg.

p,.,,

-a er e

<--N

-'e--w g==-'f'a

-"T--=---tmFP 4*-uP-T--'

e' T'-Fu---w-t'--*

15 l

pared by Gage-Babcock and issued on August 8,1979. The Sandia test results showted that under some circumstances a fire in a cable tray could damage redundant cables in a separate metal trry five fett away. These results were widely distributed, and provided one basis for a " Petition for Emergency and Remedial Relief" filed by the Union of Concerned Scientists on November 4,1977. Many NRC licensees participated in the Commission's proceeding on that petition. In response to that petition, the Comission noted that the Sandia tests confimed earlier conclusions based on the review of the Browns Ferry fire that additional fire protection measures were required over and above the cable separation distances previously accepted by theNRC.2_4/ The Gage-Babcock report had been available in the NRC Public Document Room for approximately one year before publication of the proposed rule. 2_5/

Substantial publicly available information also supports the decision in the final rule not to consider fire retardant coatings on electrical cables to be an acceptable alternat,ive to satisfying Item III.G.- Although staff has never treated 24/ 7 NRC at 420-21 (1978).

In reaching this conclusion, the Comission had before it several comments from utilf tfes who criticized as unrealistic certain aspects of the test procedures used in SAND-77-1424. They contended that the exposure fires used could not be considered credible, and that the fire was more severe than could be expected in a nuclear plant. These comments have been available in the NRC's Public Document Room since late 1977.

See, for example, Response of Commonwealth Edison Company of November 23, 1977; letter of November 23, 1977 from Consumers Power Company; letter of November 25, 1977 from Debevoise and l

Liberman on behalf of the Duke Power Company; and Coments of the Connecticut Light and Power Company, the Hartford Electric Light Company, Western Massachu-setts Electric Company, Northeast Nuclear Energy Company, and Connecticut Yankee I

Atomic Power Ccmpany, November 27, 1977.

The staff responded to these criticisms in a December 15, 1977 memorandum from E. Case, Acting Director, Office of Nuclear Reactor Regulation, to the Comission which is also part of the admin-istrative record on the UCS petition and has been readily available in the-l Pubitc Document Room.

25/ Mr. M. Bender, a fire protection expert and member of the Advisory Comittee for Reactor Safeguards also had the report for at least one year before publica-l tion of the proposed rule. Transcript of the ACRS meeting of July 9,1980 at 102. At that meeting, in a discussion with representatives of the NP.C staff and reactor operators, Mr. Sender also noted that "For some reasons or other these kinds of reports which the industry ought to be just as interested in as the regulatory staff don't seem to be of any interest to the industry. Why is that?"

l 16 coatings as fire barriers, 26/ it has previously accepted coatings as an alternative to the physical separation of redundant cables. However, beginning in 1977, test results from the Sandia Laboratories showed that fire retardant coatings did not protect electrical cables under certain fire conditions. 27/ Fire caused coated cables to lose electric integrity (short circuit to cable trays) even if the cables didnotburn.28/ Those test results have been broadly disseminated among licensees.

8 Licensees were also informed in November 1978, by IE Circular 78-18 that some fire retardant coatings are consumed by fire. The Union of Concerned Scientists raised that issue in its Petition for Reconsideration of its Petition for Emergency and Remedial Action; and the Consnission expressed concern over the efficacy of fire retardant coatings in its Order of May 27, 1980, denying that petition. 29/ Finally, the staff informed some licensees, including some of these movants, of the inadequacy of fire retardant coatings before the proposed rule was issued for comment. 3_0/

0 26/ See, for example, Memorandum from Moore to Vassallo (June 26,1979).

-27/ See, for example, "A Preliminary Report on Fire Protection Research Program Fire Retardant Coatings Test" in which it was concluded that although fire retardant coatings offer some measure of fire protection, there is a wide range in the relative effectiveness of various coatings.

SAND-78-0518 (1978).

28/ SAND-78-1456 (1978).

2_9/ CLI-80-21,11 NRC at 717-18 (1980).

9

-'-30/ See, for example, Staff Positions on the Turkey Point Fire Protection Program (April 3, 1980). The staff states:

The fire retardant coating used at Turkey Point has also been tested at Sandia Laboratories. The Sandia tests subjected coated cables to a larger exposure fire than that used in the licensee tests.

The cable tray directly exposed to the fire in the Sandia tests suffered considerable damage and burned for approximately 42 minutes.

Coated cables in a tray 10-1/2 inches above the exposed tray were also damaged. Although the cables in the upper tray did not burn, propagation of flames to the upper tray would have occurred if a larger exposure fire had been used, if the cables had been energized at rated current or if the coating had been applied and the cables arranged to simulate more closely a field installation.

It is therefore concluded that the combination of fire retardant coating and the minimum separation permitted between redundant divisions of cables at Turkey Point is not acceptable fire protection to assure safe shutdown capability.

It has' been shown repeatedly tk.at coated cables directly exposed to a flame (for several minutes) will be damaged and will ignita.

[ Footnote continued on next page.]

17 Thus, several years of test results have created a clear basis for doubting the efficacy of fire retardant coatings. The NRC's response to those results has clearly been developing in the direction of reduced reliance on fire retardant coatings, and the uncertainties regarding fire hazards led the Commission to finally endorse the position taker, in this rule. Under these circumstances, we find no merit in any contention regarding the adequacy of the basis for that part of the rule that gives no credit to fire protection retardant coatings as a fire barrier.

This review of the record on the fire protect 4n features in Item III.G.2 clearly shows that the requirement of a three-hour barrier to protect redundant safe shutdown systems has long been accepted as appropriate for protection against the potential hazard posed by a fire in a nuclear power plant. Moreover, in recognition of the limits imposed by the, circumstances that the affected plants ar'e'already built, t,he rule provides alternatives for achieving the same level of protection as provided by a three-hour barrier and also provides licensees an ooportunity to seek an exemption if they can demonstrate that any required fire protection feature will not enhance fire protection safety in the facility or that such modifications may be detrimental to overall facility safety.

10 CFR 50.48(c)(6).

30f (Footnote continues from previous page.]

Although flame propagation is retarded by the coating, coated cables will burn and add their heat of combustion to the heat input to a compartment in a fire. The lack of adequate separation between redundant divisions of safe shutdown cables at Turkey Point could result in damage to both divisions from direct flame impingement from an exposure fire.

~

18 b.

III.L. Alternative and Dedicated Shutdown Capability Movants also challenge the adequacy of the statement of basis and purpose sup-porting Item III.L which establishes criteria for acceptable alternative or dedicated shutdown capability. A review of the development of these criteria shows that mcvants' contentions are without merit.

As previously discussed with regard to Item III.G, the Fire Hazard Analyses conducted by licensees after the Browns Ferry fire showed that some plants required alternative or dedicated shutdown systems. Some utilities promptly installed such systems. Staff's experience from reviewing these systems led it to formulate general guidelines for acceptable alternative or dedicated shutdown systems. These guide-lines were set out in a document entitled " Staff Position - Safe Shutdown -

Capabili ty."

Copies of staff's position were sent on November 6,1979 to all 0

power reac' tar licensees with plants ifcensed to operate prior to January l',

1979.

Staff's position statement provided that in the event of fire the alternate shutdown capability shall be able to achieve and maintain suberf tical conditions in the reactor, maintain reactor coolant inventory, achieve and maintain hot standby conditions (for a Pressurized Water Reactor) or hot shutdown (for a Boiling Water Reactor) as defined in the Technical Specifications, achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown conditions thereafter. These criteria were to be satisfied under post-fire conditions where either off-site power is available or is not available f' e 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Moreover, during the post-fire shutdown, the reactor coolant system process variables shall be maintained within the range predicted for a loss of nonaal alternating current power and the fission v

w, yw--

w-

-_-w-,,

w ---

--7.

• -w-

-r-m-we w--.+-

w v-v-m,--v-iewy w,-e.,-r+-w w w-www--

v

,-w-vm---

--*-*m-e ww w - - ww

,ww wrw-w. w----

e-y*-

,-m,,w--we-

4 19 product boundary integrity shalk not be affected; i.e. there shall be no damage to fuel cladding, rupture of any primary coolant boundary, oc rupture of the containment boundary.

Staff's position statement also established performance goals. These included provision of: (1) a reactivity control function capable of achieving and maiataining cold shutdown reactivity conditions; (2) a reactor coolant makeup function capable of maintaining the reactor coolant level above the top of the core for a BWR and in the pressurizer in a PWR; (3) a reactor heat removal function capable of achieving and maintaining decay heat removal; (4) a process monitoring function capable of providing direct readings of the process variables necessary to perfonn and control the above functions; and (5) a supporting functi,on capable of providing the process cooling, lubrica-tion and other services necessary to permit the operation of the equipment used for safe shutdown by the systems identified above.

In addition, the l

equipment and systems used to achieve and maintain hot standby conditions at a l

PWR or hot shutdown at a BWR should be free of fire damage, capable of main-taining such conditions for longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the equipment required to achieve and maintain cold shutdown is unavailable due to fire damage, and apable of being powered by an on-site emergency power system. Equipment and systems used to maintain cold shutdown conditions should be either free of fire damage or reparable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; and equipment and systems used prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the fire should be capable of being powered by arr onsite emergency power system.

Equipment and systems used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be powered by off-site power only.

,..----en-,y

--,,-w.,4,

- - ~._,

,-,.-,,---.c

,-.,,.,,,,.-m-,-y,,.

_...w,--,--,----.,--

.4---.--

e-.c

.-w--

.-r-,.-vev

20 Finally, staff's position stacament listed the equipment generally re-quired for hot shutdown of a BWR, hot standby at a PWR, and cold shutdown at both types of reac tors. The statement also listed information required for staff review including des cription and design of the alternate or dedicated shutdown systems and a demonstration that wiring for these systems is independent of equipment wiring in the fire area for which the alternate shutdown system is required.

Item III.L of the proposed rule addressed the criteria for an acceptable alternate shutdown capability. The proposed requirements were derived entirely from the staff's earlier statement of position and essentially just reiterated the guidelines and perfonnance goals described above. Thus, proposed Item III.L was familiar to all licensees. Moreover, in restating the staff's position, the rule clarified the requirements for equipment and systems used to achieve and maintain hot standby conditions at a PWR or hot shutdown at a BWR in the event that fire disabled the equipment needed to achieve and main-tain cold shutdown.

Instead of requiring this equipment to be capable of

.aintaining these conditions for longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the equipment was required to be capable of maintaining such conditions until cold shutdown could be achieved. This clarification provided consistency with the require-ment that equipment needed to attain cold shutdown should be reparable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Commentors contended that the proposed Item III.L was too detailed re-(

garding alternatives to cold shutdown, did not provide a basis for requiring l

the attainment of cold shucdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, did not provide adequate time l

21 for the installation of an alternative or dedicated shutdown system, might result in plant modifications which could be inconsistent with other modifica-tions dich may be required pursuant to the Systeaatic Evaluation Program (SEP), _31/ and would require substanthi expenditures.

1 The comments were addressed in the Statement of Consideration acccmpany-ing the final rule. Staff explained that it was appropriate to require de-tailed alternatives to shutdown systems where a single fire could disable systems required to achieve either cold or hot shutdown. Specification of the minimum capability and time requirements for each shutdown condition ensured that safe shutdown would be achieved after a fire. Moreover, staff believes that adequate safety margins would be providad by requiring the reparability i

l l

l I

(

The Systematic Evaluation Program is an NRC review of the design of eleven older 31/

operating plants licensed before many of the current design features were requirec l

Upon completion of this review, staff may require licensees to install additional j

I safety equipment at these plants.

l l

l

~

1 J

22 of cold shutdown equipment within 72 tours. 3_2/ Regarding potential conflict 2

with modifications that may be required pursuant to the SEP, staff found that the current need to provide adequate fire protection was not consistent with deferral of the installation of an alternate or dedicated shutdown system pending completion of the SEP review.

In addition, staff believes that licensees can design an alternate or dedicated shutdown system which can acconinodate anticipated SEP requirements.

In response to the contention that 3_2/ Similar or shorter time limits have been imposed on the achievement of cold 2

shutdown in the event of other accidents.

For example, the Standard Technical Specifications for Combustion Engineering Pressurized Water Reactors require cold shutdown within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> if a Limiting Condition foe Operation is not met and corrective actions cannot be taken within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. NUREG-0212, Revision 2, pp. 3/4 0-1, 4-9, 6-7F.

Some deviations from nomal operation are so serious that an even quicker-response is required.

For example, cold shutdown within 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> is required if no emergency core cooling system subsystem is operable.

Id..at S-7.

See also, Standardized Technical Specifications for Westing-Fouse PWRS, NMTG-0452, 3/4 0-1, 5-11, 6-1 A, 7-15, 7-17, 7-19 (1978).

Similar Tecanical Specifications apply to other types of plants, including those operated by the petitioners. For example, the Technical Specifications for Millstone Nuclear Power Station, Unit No.1 require cold shutdown within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if both core spray subsystems are not operational and cannot be repaired in the specified time when irradiated fuel is in the reactor vessel, both con-tainment cooling systems are not operable and cannot be repaired in the specified time den irradiated fuel is in the reactor vessel, the automatic pressure release subsystem is not operable and cannot be repaired in the specified time when the reactor pressure exceeds 90 pounds per square inch, the isolation condensor is not operable and cannot be repaired in the specified time when the reactor pressure exceeds 90 pounds per square inch, and both emergency pour sources are not operable and cannot be repaired in the specified time when irradiated fuel is in the reactor Appendix A to License No. OPR-21, 3/4 6-1 to s

5-9 (December 1977).

See also Technical Specifications for H.R. Robinsc,

Unit No. 2 which, among other things require cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if certain deviations from the nomal operation of the Chemical and Volume Control System, Emergency Core Cooling System, Auxiliary Cooling Systems, Air Recirculation Fan Coolers, Containment Spray, Post-Accident Containment Venting Systems and Isolation Seal Water System cannot be restored in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Appendix A to Facility Operating License DPR-23, i

3.2-1 to 3.3-9 (1973).

Fire damage to plant systems could be o.s serious as the deviations from opera-r tion described above. Thus, the time specified in the rule to achieve the capability to attain. cold shutdown is consistent with other license conditions.

23 the proposed rule did not provide adequate time to install an alternative or dedicated shutdown system, staff modified the rule to provide additional time of up to 30 months. &

For the most p&rt'. Item III.L of the final rule is a slightly edited and rearranged version of the corresponding Item III.L in the proposed rule. The substantive requirements of this Item are consistent with staff's resolution of the comments on the proposed rule.

In addition, the final version of Item III.L contains a specific provision, Item III.L.7, which applies the asso-l l

ciated circuit concept of proposed Item III.Q to this partkular fire protec-l tion feature. The Statement of Consideration explains that this provision was l

added because most plants currently operating were designed before associated l

circuits were required to be idenf.ified. However, unles: these circuits are I

identified and preparly treated, an alternative shutdown system might not function in the event of fire damage tn the associated circuits. Therefore, the final rule provides that alternate safe shutdown equipment for a par-ticular fire area shall be known to be isolated from associated non-safety circuits in that fire area. Die rule also provides that an acceptable method l

l of compliance would be to meet Regulatory Guide 1.75, position 4 which essen-tially provided that associated. circuits should be treated as safety cir:uits.

Subsequent to publication of the final rule, some licensees requested further clarification of the associated. circuit requirement for an alternative shutdown system. On February 20, 1981, the NRC staff provided additional guidance in a letter to all power reactor licensees affected by Appendix R.

33/ Staff did not respond to the comments regarding cost because other utilities had installed such systems.

t

,, - - -,,...,,.., _...,,.,. -,,,., -,, _, _,,,,,.., _... -. ~,... -, _, _,,

l 24 The letter defines associated circuits related to an alternative shutdown system as circuit whose damage by fire could cause failure or mal-operation of the alternative safe shutdown system. This definition of associated circuits includes safety related as well as non-safety cables which are associated with the alternative or dedicated method of shutdown, are separated from the fire area they are alternate to by less than the requirements in Item III.G.2 and have either (1) electrically unprotected power source in common with the alternate shutdown equipment; (2) a connection to circuits or equipment whose spurious operation will adversely affect the shutdown capability; or (3) a common enclosure with alternative shutdown cables and which are not elec-trically protected from the post-fire shutdowm circuits. This definition is different from the guidance referenced in the rule in that it includes some safety-related cables as well as non-safety-related cables but excludes cables which are electrically protected from shutdown circuits by circuit breakers, fuses, or similar devicgs. This exclusion of certain cables provides licen-sees additional flexibility in satisfying the requirements of the rule.

c. III.0 Reactor Coolant Pump Lubrication System Movants have also challenged the adequacy of the statement of basis and purpose supporting Item III.0 of the rule. A review of events leading up to promulgation of this aspect of the rule shows there is no merit in movants' contentions.

The lubrication system for reactor coolant pumps has long been recognized as the single largest fire hazard inside the reactor containment.

Details of fires caused by leaks or drips of lubricating oil onto nearby hot surfaces

l l

25 were described as early as 1977 in a publicly available report. 34/ Additional analyses of the fire hazards associated with the reactor coolant pump lubrica-tion system are contained in several Fire Protection Safety Evaluation Reports prepared by the NRC in 1978. Some of these reports were prepared for facilities operated by the utilities seeking e stay of this rule. 35/

Because the fire hazard associated with the reactor pump lubrication system is a generic issue not resolved at all plants, Item P of the proposed rule would have required either an oil collection system or an automatic fire suppression system. 45 Fed. Reg. at 36090.

Either system was required to be designed to withstand a Safe Shutdown Earthquake (SSE) to protect nearby safety related equipment from fires resulting from earthquake induced of1 leaks. This seismic qualification requirement was contained in the staff's e:rly draft of the proposed rule. 36/ Shortly after staff prepared that draft, somc licensees, including some of the present movants, were requested to comply with the seismic qualification requirement. 37/ Thus, several months before the proposed rule was published, licensees wera aware that seismic qualitication would be required features which would protect reactors And from fire hazards associated with the reactor pump lubrication system.

before the final rule was issued, at least one of thue movants committed to the installation of a seismically qualified oil collection system. 38/

8

" Fire Damage Data Analysis As Related To Current Testing Practice For Nuclear 34/

Power Application." 8NL-NUREG-23364 (October 1977).

15,/ See, for example, the Fire Protection SER for the Haddam Neck Plant, 5

pp. 5-9 and 5-10 (1978).

16/ SECY-80-88 (February 13,1980).

6 See, for example, letter from D. L. Ziemann to W. G. Council, Vice President, 37./

Connecticut Yankee Atomic Power Company (February 22, 1980); and Letter from A. Schwencer to R. Uhrig regarding Turkey Point, Units 3 and 4

( April 3,1980).

38] Turkey Point, Units 3 and 4.

26 In view of this background, it is not surprising that, for the most part, cc:nmentors did not challenge the need for a system to protect against fires which could be caused by oil leaking from the reactor cooling pump lubrication system. Some commentors noted that-the seismic qualification requirement for either protection system had not been included in previous NRC regulatory guidance documents 2.nd contended that compliance with the requirement could not be achieved within the time provided by the rule. Comments were also provided on technical aspects of the proposed seismic design requirements for an oil collection system. 39/

The final rule on this issue is now contained in Item III.0, which requires a seismically qualified system to collect oil spills on leaks from reactor recirculation pumps. The bases fpr this requirement are extensively described in the accompanying Statement, which reiterates the well-known, publicly available' infonnation in the documents discussed above. The Statement explains that each reactor coolant pump motor-contains up to 225 gallons of lubricating oil and that oil leaking from some portions of the lubricating oil system may 39/ The principal technical comments were:

1.

An e. caption should be provided for containments with inerted atmospheres (i.e. atmospheres having substantially reduced levels of oxygen);

2.

Because reactor coolant pumps are not necessary for safe shutdown, the seismic design of a lubricating oil collection system need only be able to maintain structural integrity after an SSE, not operability; and l

3.

Although a seismically qualified oil collection system is good in principle, the only parts of the system which should be designed are those whose failure could expose safety-related equipment to fire.

One comment was received regarding the alternative of a seismically qualified fire suppression system. The commentor questioned the ability of se:h a system to function after an SSE if its water supply system is not designed c3 withstand an SSE.

-'-C-h

==

ww

,,,,_,_,o_.,

w_w

~m

27 come in contact with surfaces hot enough to ignite the oil. Such an oil spill could spread outside the coolant pump area and result in an unmitigated fire that could damage redundant divisions of safety related systems required for safe shutdown. Accordingly, the collection system must te capable of collecting lubricating oil from all potential leak sites and draining that oil to a vented closed container that can hold the entire oil intentory. Moreover, the oil collection system must be seismically qualified 4_0/ because an earthquake could cause an oil spill by damaging piping for lubricating oil systems. Any previously installed oil collection system Aich was not designed to withstand a design basis event must be modified to meet the new seismic qualification criteria.

In addition, the statement responds to the technical comments on the seism'ic design requirements for ^he oil collection system. The Statement explains that seismic qualification requirements wre already implicitly contained in General Design Criterion '.

" Design Bases for Protection Against Naturtl Pheno 1ena," which requires stiactures, systems, and components important to safety bt designed to withstand the effects of earthquakes without less of capability co perfonn their safety functions.

Regulatory Guide 1.29, " Seismic Design Classification, describes an acceptable method for identifying equip-l ment that should be designed to withstand a Safe Shutdown Earthluake. That guidance provides for the seismic qualification of equipment whose earthquake l

40/ Item III.0 requires the oil collection system to be qualified to a level which assures that it will withstand a Safe Shutdown Earthquake. This means that the oil collection system should be designed, engineered, and installed, so that an The earthquake will not lead to a fire affecting safety related equipment.

scope of this requirement was discussed at the Commission's public meeting of i

October 27, 1980. Staff stated that cil collection systems would be required to be seismically resistant, but would not be required to satisfy the higher levels of seismic qualification applicable to safe shutdown equipment. Transcript of October 27,1980 at 19.

1 i

_., _ _ _... -. _, _ _.. ~. _,

28 induced failure i:ould reduce Je functioning of safe shutdown systems. The reactor coolant pump oil collection system is in the category of such equip-ment because an earthquake induced failure in that system could cause a fire which would prevent a safety r ' lated system from perfonning its function.

Thus, the seismic qualificatiorr of the reactor coolant pump oil collection system is not a departure from previous NRC practice.

The final rule also responds to other comments on the proposed rule. The final rule now provides an exception for reactors with inerted containments, and the implementation schedule has been extended.

Finally, the alternative of.an automatic fire suppression system was deleted from the final rule. The Stmement of consideration explains this change. -Staff r~ealized that a suppression system may not prevent unacceptable fire damage to safety related systems because: (1) a suppression system may not be actuated soon enough after initiation of an oil fire; and (2) as noted by a commentor, the suppression system's water supply is not designed to withstand seismic events.

Moreover, in the event of seismically induced or other system malfunctions ir. the fire suppression system, it is self-evident that timely action by the fire brigade would be difficult because the reactor coolant pumps are located in a relatively inaccessible area within the biological shield sich is located inside the containment. This location also would pre-vent a fire patrol from either fixing a fire suppression system that failed during operation or periodically inspecting the area as is normally required.

For these reasons, the alternative of a fire suppression system was deleted from the final rule. However, the final rule provides licensees an opportunity e

,r

-,.-.-,,,--,#,,--..,w...

.,,,+.,--,-,-.--w-.---------,,-,.-,,,-,w,.,~,

-,----,r---,

w.c,-w.----...--.

..r-

29 to request an exemption from the requirement of an oil collection system. B Under these circumstances, the Commission believes that the record provides a substantial statement of basis and purpose supporting this aspect of the rule.

2.

Agency Choice of Procedure It is well-established that an agency's decision '.o use rulemaking or 4

adjudication is in its discretion. Q, NAACP v.,FE, 425 U.S. 662, 668 (1976); NLRB v. Bell Aerospace Co., 416 U.S. 267,194 (1974); SEC v. Chenery Corp., 332 U.S.194, 201-03 (1947). Because there is no bright line test to assess an agency's exercise of discretion, courts have focused on the nature of tha. decision reached in the proceeding. FTC v. Brigadier Industries Corp.,

613 F.2d 1110,1117 (D.C. Cir.1979); see, United States v. Florida East Coast Railway, 410 U.S. 224, 245 (1973). Ru1& making is usually prospective. in scope and non-accusatory in fann, directed to the implementation of general policy concerns through legal standards.

FTC v. Brigadier Industries Cora., supra, l

613 F.2d at 1117.

Rulemaking is particularly appropriate for the resolution of generic issues. Minnesota v. NRC, 602 F.2d 412 (D.C. Cir.1979). Adjudica-tion, on the other hand, is individual in impact and often condemnatory in pur-pose, directed to the du.ennination of the legal statas of particular persons or practices through the application of preexisting legal standards.

FTC v.

Brigadier Industries Corp., supra.

L i

I 41f Only one movant has requested an exemption to be allowed to use a fire suppression system. Staff has accepted that exemption request for evalua-tion and has tolled the compliance date for this item pursuant to 10 CFR 50.48(c)(6).

l

i 30 1

In this instance, although the efforts of the Commission re3arding fire l

protection may have been triggered by the pendancy of unresolved issues in-volving certain plants,.vithout question the rule addressed only generic concerns applicable to all plants, including those for which the staff pre-viously accepted different features.

Indeed, Items I1I.G and III.0, and by implication Item III.L. merely seek to establish for all licensees those safety measures that some have already instituted voluntarily. But, even if these general standards may actually affect only a few, or even one licensee, that circumstance does not make the agency's utilization of rulemaking improper.

See Hercules, Inc. v. EPA, 598 F.2d 91,118 (D.C. Cir.1978); Southern Tenninal Corp. v. EPA, 504 '.2d 646, 661 & n.13 (1st Cir.1974). 42/ In any event, these movants are not the only persons affected by various aspects of the Fire Protection Rule. The interest in seeing that nuclear power plants are pro-tectea from the potential destruction that fire can cause is a broad one affecting the public as a whole. Accordingly, rulemaking was an appropriate mechanism for the Commission to resolve fire protection issues.

Petitioners also challenge rulemaking as improper because of alleged material factual disputes 'regarding the requirements of Appendix R tnat could only be resolved by individual adjudications. However, movants have not provided a single, specific instance of a disputsi fact in their request for a i

stay.

Even if they had provided such examples, this contention is unlikely to

_42/ In Herculas, Inc. v. EPA, the District of Columbia Circuit held that even though a rule limiting the discharge of toxic substances into waterways taight apply to only two manufacturers, the use of rulemaking rather than adjudication to achieve that limitation was proper. Likewise, the unique effect upon a parking lot of an air pollution control rule restricting the number of parking spaces on a regional basis was found not to require an adjudicative hearing in Southern Tenninal Corp. v. EPA.

. - - - - - -. =. -.. -

31 succeed because it does not recognize that it is within the purview of an agency's authority to settle fac.tual issues within the context of a rule-maki ng. Ethyl Corp. v. EPA, 541 F.2d 1, 28-29 & n.58 (D.C. Cir.) (en, banc),

e cert. denied, 420 U.S. 941 (1976). _43/ To the extent factual questions relating 3

to generic fire protection issues existed, their resolution by means of rule-making undoubtedly was preferable to relitigating such questions in individual adjudicatory proceedings.

See_ Minnesota v. NRC, 602 F.2d 412, 416-17 (D.C.

Cir.1979); Ecology Action v. AEC, 492 F.2d 998,1002 (2d Cir.1974).

Likewise without substance are the petitioners' claim that Section 189 of the Atomic Energy Act of 1954 and 10 CFR 2.204 require the Commission to hold plant-by-plant adjudicative hearings. Movants' arguments are incorrect because Section 187 of the Atomic Energy Act, 42 U.S.C. { 2237, provides for ifcense modifications by rule. Certainly, to the extent that a rule is based on 'the general characteristics of an industry, rational decision is not furthered by requiring the agency to lose itself in an excursion into detail that coo often obscures fundamental issues rather than clarifies them. W8EN, Inc. v. United States, 396 F.2d 601, 618 (D.C. Cir.), cert, denied, 393 U.S. 914 (1968); see l

California Citizens Band Association v. United States, 375 F.2d 43, 50-53 (9th Cir.), cert. denied, 389 U.S. 844 (1967). g Thus, reactor license modifica-tion by means of notice and comment rulemaking is, ell within the Commission's l

1 authority.

In Ethyl Corp. v. EPA, the District of Columbia Circuit recognized that in 43/

detennining whether gasoline lead additives would endanger the public so as to authorize EPA to limit their use, the agency possessed the same fact-finding powers in rulemaking as those of a jury, al~iowing it to draw conclusions from l

uncertain or even conflicting scientific evidence to fonn the proper basis for the regulation.

In both WBEN, Inc. v. United States and California Citizens Band Ass'n v. United

_4_4/ States, the courts rejected the argument that Section 316 of tne Communications Act of 1934, which provides for a hearing when the FCC seeks by crder to amend a license, was applicable when a Commission rule relating to generic issues had the effect of modifying a license.

32 It also is apparent that the NRC did not abuse its discretion by deciding to initiate a rulemaking to consider generic fire protection issues despite its earlier attempts to promote fire protection by dealing with individual licensees. An agency's p; evious initiation of a case-by-case method of re-solving a problem cannot be raised as a bar to any later efforts to resolve generic issues by rulemaking. Pacific Coast European Conference v. United States, 350 F.2d 197, 205-06 (9th Cir.), cert denied, 382 U.S. 958 (1965); see also.Siegel v. AEC, 400 F.2d 778 (D.C. Cir.1968), f5/ Indeed, in this instance it was not the Wilm of the Commission that caused the change in procedure.

Rather, the more informal method of consultation with individual licensees previously used had to be abandoned because of an inability to achieve volun-tary implementation of the necessary fire protection guidelines.

3.

Backfit and Retroactivity Turning next to the questions of supposed backfitting and retroactivity under the fire protection rule, it is apparent that,movants' assertions re-garding the applicability of 10 CFR 9 50.109(a) and the agency's purported failure to comply with the regulations' requirement that the Commission find that a proposal "backfit" will provide " substantial, additional protection which is required for the public health and safety" are without merit. First, 35/ In Pacific Coast European Conference v. United States, the Ninth Circuit found that the Federal Maritime Commission could abandon its case-by-case considera-tion of the propriety of certain shipping contracts and revert to rulemaking to establish a general regulation. This Commission itself has indicated previously that a pending adjudication need not bar rulemaking on a contested subject.

Citing a pending proposed rule, the Atomic Energy Commission in 1967 ordered that the issue of the protection of nuclear plants from enemy attack not be considered in an ongoing adjudication. The final rule excluding that question fran licensing proceedings was upheld by the District of Columbia Circuit in Siegel v. AEC.

P

,-+,,-,---v--

w

,a-

,,..,--en-

.,,+r, r.

aw

,,em-----w,-,-,n.,

--a

-n.----

a--e.,, -

w -

n-----,a--w-

-smw.,-ve.m,,-

33 their contention must fail because it does not account for the language of subsection (b) of Section 50.109, which provides that "[n]othing in this Section shall be deemed to relieve a holder of a... license from compliance with the rules, regulations, or orders of the Commission." A rule that requires a licensee to take some action to modify an existing facility after issuance of a construction pennit does not requira any Commission consideration under Section 50.109(a). Moreover, even if Section 50.109(a) did apply, f t is evident that the Commission has complied with the rule's requirement that the agency find a plant design change will provide additional protection that is required for the public health and safety. Section 50.109 is directed at ansuring that plant modificattora will be carefully appraised before being imposed; certainly', the Commission's clarification of the proposed rule to i

require the unifonn application of only three of its twenty items is a reflec-tion of such careful concern. 4f6/ Further, the importance of Item III.G, associated Item III.L and Item III.0 as fire protection measures providing added protection to the public health and safety is made clear by the explana-tion accompanying the rule. The fonner two are designed to ensure that a safe reactor shutdown can always be achieved and maintained in the event of a fire, 45 Fed'. Reg. at 76605, while tne latter is aimed at preventing several large, smoky oil fires in the containment area, which would not be readily accessible because of the high radiation levels and could cause the breakdown of safety-i related equipment, id,. at 76608-09. Based as they are on the Commission's

" increased knowledge and experience developed on fire protection matters over 4!/ Besides Items III.G and III.0, Til licensees will be required to comply i

with Item III.J, relating 1.o eight-hour energency lighting, regardless of any efforts already undertaken to follow the guidance of Appendix A con-cerning ruch lighting. The petitioners do not challenge the Item III.J requi rements.

....,._y

.,,-._.m.._..

e,,_,,,y.

_._,,,.,,m,

,.,,,_.,.-.g-_.,-.

-h %

.%.4-...

+

TRST TARGET (MT-3) s

!.0 E8ELu I

E, EE l.

l-l % E = lHe p.-

1.25 j I.4 I

1.6 l/

6" e

p+i*>

+++

W,,,%t?

y.:.b?

bh

+

2

\\\\\\ > +$>/

+.

. \\\\\\\\

IMAGE EVALUATION TEST TARGET (MT-3)'

" 1.0 lff 8 2 E a m B E g "2 2 E na 1.1 SJ LE 3

/

l.8

~

=

1.25 l 1.4 g

/

=

6" a

a

+<%

+ sp

$ 7,,,$

d)dj'#4

+

'h~

Q

34 the last several years," id_. at 76603, the imposition of these requirements d

upon. all licensees supported by an expressed rationale is more than sufficient to satisfy Section 50.109(a).

So too, the question of dether the Commission has required impermissible retroactive modifications through its rulemaking is one dich is without substance. To whatever extent the Commission's rulemaking efforts may be considered retroactive, it is apparent that in this instance the regulations are fully in accord with the recognized standard for canoting a proper retro-active rule: one that is reasonable under the circumstances. See California

v. Simon, 504 F.2d 430, 438-39 (Temp. Emer. Ct. App.), cert. denied, 419 U.S.

1021 (1974); 2 K. Davis, Administrative Law Treatise 9 7:23, at 109 (2d ed.

1978).

In detennining whether a retroactive rule is reasonable, the relevant factors include the rule's degree of retroactivity as maasured by whether it is an abrupt departure from established practice or an attempt to resolve unsettled questions, the complaining party's reliance upon the agency's former policies, the burden imposed by the retroactive rule, and the need for adminis-trative flexibility in light of changing circumstances.

See, e.g., New York f

Telephone Co. v. FCC, 631 F.2d 1059,1068 (2d Cir.1980); Tennessee Gas Pipeline Co._ v. FERC, 606 F.2d 1094,1116 n.77 (D.C. Cir.1979), cert. denied, 445 U.S.

920 (1980).

Movants object to the requirements in Item III.G to the extent they go beyond fire protection modifications previously approved by the NRC staff. The Commission, on the basis of public discussions with the staff, detennined pro-tection of the public health and safety would require implementation of

---er-

• s-

-w---.-

---

+

,www-w-%-e-g e-%s-w.,w-.--me e-,

y.y p.

wpy,g.-e*,

-.g.-py--+ws,,,.,,--++we-

%.-y

%--e 7,,---y--e

,, -.#n---

~

35 Item III.G at all plants to ensure a unifonn level of safety.

In view of the

~

continuing growth of knowledge regarding fire safety, Itcensees cannot reason-ably expect that staff's acceptance of certain fire protection features will forever bar the imposition of additional features den the facts show them to be required to protect against fires. Further, with regard to Item III.0, there is no specific showing by any movant regarding either reliance on a fonner staff position or the burden of compliance.

In addition, the' other factors in the balance strongly support the reason-ableness of the rule's purported retroactive effects. The degree of retroactivity of the rule is not substantial. The nale is the culmination of an ongoing adminis-trative process and, as such, is intended to resolve a few remaining generic fire protection issues. Moreover, the rule is consistent with the recognized.

need for administrative flexibility in the regulction of nuclear plants.

Under Section 186(a) of the Atomic Energy Act, 42 U.S.C.12236, the NRC has the authority to apply new standards to already licensed plants, consistent with evolving concepts of dat measures are necessary to protect the public health and safety.

Congress, den it enacted Section 186(a) in 1954, must have envisioned that licensing standards, especially in the areas of health and safety regulations, would vary over time as more i

was learned about the hazards of generating nuclear energy.

l Insofar as those standards become more demanding, Congress I

surely would have wanted the new standards, if the Commission l

deemed it appropriate, to apply to those nuclear facilities already licensed.

j Ft. Pierce Utilities Authority _ v. United States, 606 F.2d 986, 996 (D.C. Cir.)

l (footnote omitted), cert. denied, 444 U.S. 842 (1979); see also General Telephone Co. v. United States, 449 F.2d 846, 863-64 (5th Cir.1971).

Under the circum-o stances, and in light of the rule's expressed purpose of protecting the public

\\

i 36 health and safety by ensuring that licensees take all prudent measures to prevent fires and are equipped adequately to fight any fire that may start while still maintaining control over reactor processes, we are unconvinced that movants can succeed in showing that most of the requirements in Items III.G, III.L. and III.0 violate the precept against unreasonable retroactive rulemaki ng.

B.

Irreparable Injury Movants contend they will be substantially and irreparably harmed because they will be required to make substantial investment in these fire protection features required by Items III.G and III.L which they believe unwarranted.

In particular, on the basis of their interpretation of the tenn " associated circuits" and their belief that the Commission will strictly adhere to the separation criteria in Section III.G, movants contend the rule offers them no alternative but to install a dedicated shutdown system. 47/

7 Novants' claims are without merit.

Item III.G of tne final rule provides three alternative fire protection features which do not require analysis to demonstrate the protection of redundant safe shutdown equipment and estab-lishes the acceptable distance in the physical separation distance at twenty feet instead of the fifty feet in the proposed rule. _48/ Moreover, the rule g We also note that because the definition of associated circuits has been clarified there is no longer any need to consider a ciaim based on movants' definition.

4_8/ We also note that even this reduced twenty-foot separation criterion will 8

not be applied rigidly.

See Transcript of Commission Meeting of October 21, 1980 at 17-18; Transcript of Commission Meeting of October 27,1980 at 20-2.

f 37 now also provides an exemption procedure which can be initiated by a licen-see's assertion that any required fire protection feature will not enhance safety in the facility or that such modifications may be detrimental to over-all facility safety. 10CFR50.48(c)(6).

If the Director, Nuclear Ructor Regulation detennines that a licensee has made a prima facie showing of a sound technical basis for such an assertion, then the implementation dates of the rule are tolled until final Commission action on the exemption request.

We understand that movants have filed such exemption requests with the staff.

Under these circumstances, the Commission cannot now conclude that movants' only method of compliance with this rule would be the installation of an alternate or dedicated shutdown system. Moreover, even if an alternate or dedicated shutdown system is ultimately required, movants have not provided details of cost estimates which ca'n be reviewed and corroborated by the staff.

Thus, the Commission finds that movants have not satisfied their burden of demonstrating irreparable injury if they are required to comply with Items l

III.G. and III.L.

Finally, petitioners' request for a stay of Item III.0 does not present l

any reasons why this item will result in irreparable injury. The bald request fer a stay of this item provided the Commission with no basis for a reasoned analysis of this request. Thus, it fails totally to meet petitioners' burden i

of persuasion in this regard. Moreover, as noted above, petitioners who believe that Item III.0 will cause irreparable injury have pursued the exemption procedurein10CFR50.48(c)(6). Until that procedure is concluded, it would be premature for the Commission to grant a stay of this item.

4 38 C.

Harm To Others And The Public Interest In addition to the above considerations supporting the merits of the rule, the Commission finds unpersuasive movants' other arguments for a stay.

As the movants themselves ute, the appropriate inquiry is whether a stay would serve the public interest. The Commission believes it would not.

Since the Browns Ferry fire of 1975, the Commission and its licensees have been involved in the development of an adequate fire protection program at each facility. During that time, an evolving program of fire protection has led to the installation of many fire protection features.

However, not all facilities have implemented all the fire protection features which the NRC believes are warranted on the basis of extensive fire hazard analysis. Thus, in order to complete the fire protection program which the Commission believes is necessary to protect the public health and safety, a rule has been pro-mulgated specifying acceptable ways of satisfying certain unresolved generic fire safety requirements. The Commission believes that the extensive review of safety at nuclear power plants demonstrates that all aspects of the rule are necessary to assure public health and safety, and does not believe that a stay of Item III.G, III.L and III.0 is consistent with that goal.

For all the above reasons, the motion to stay Items III.G, III.L, and III.0 of this rule are denied.

l 1

_ _, -. ~. _ _ -,, _,,. _. -. -. -, - _ _,.. _... _,.,..,., _ _ _ _ -. _ _. _. _ _ ~,... - -

39

' It is so ORDERED.

The separate views of Comissioner Ahearne and concurring opinion of Comissioner Bradford are attached.

For the Comission p RECy 8

4 s

Du Ph

[ }, 9

,.c V

SAMUEL J.

HILK

<.,, t,' f A/.? !

Secretary of th Comission s

U %,c;-r.7;'}4&J o$,,Es:..

p

"'*s Q..;: **l N

kk+5%

Dated at Washington. 0.C.

[ d day of f, 1981 this e-v--,-.-----,-,,-,,-,.,w,,--,-v--

---

,e--+.

-,-,---se-a--,..,,,n--s-..v,n--,

-w.nw-

--.--m,a.,,,-,m--

---

w w,-.w

Comissioner Ahearne's Separate Views I vote to deny the petition, for the following reasons.

This rule has a clear rationale.

On March 22, 1975 a fire occurred at the Browns Ferry nuclear power plant:

"The fire started in an elec.irical cable penetration between the cable spreading room and the reactor building; the cable spreading room is located beneath the comon control room for Units 1 and 2.

The fire burned for about seven hours, spreading horizontally and vertically to all 10 cable trays within the penetration, into the cable spreading room for several feet, and along the cables through the penetration about 40 feet into the reactor building. The fire damage, confined to an area roughly 40 feet by 20 feet in the Unit 1 secondary containment building, affected about 1,600 electrical power and control cables.

While both units were shut down safely, normally used shutdown ecoling systems and other components which comprise the emergency core cooling system (ECCS) for Unit 1 were inoperable for several hours. '

The cause of the fire was the ignition of cable penetration sealing material by a candle flame, being used by a construction werker checking for air leaks. The flexible polyurethane foam sealing material being used had not been specifically approved by the licensee's design department, nor had it been tested for this kind o f appli-cation. The dangers involved in ising flamable material in this manne: were evidently not recognized by platt management, even though several small fires had occurred durii., similar testing activities at the plant. Personnel inspecting, sealing and testing the cable penetrations had not been provided with an adequate written procedural guide. Another contributing factor may have been the plant's fire-fighting techniques and equipment." If if U.S. Nuclear Regulatory Comission, Annual Report 1975, pp. 93-94.

.~

w 2

The Nuclear Regulatory Comission learned a very straightforward lesson:

"While the Browns Ferry fire will be under scrutiny for some time to come -- in all its complexity of causal factors, contributing factors, real and possible consequences and implications for all nuclear facilities -- the event has already demonstrated both the importance and the effec-tiveness of multipu, mutually reinforcing back-up safety systems, or defense-in-depth.

The potential vulnerabilities revealed by the fire will be the subject of intense analysis and will probably result in new requirements both within the industry and the agency." 2_/

Unfortunately, final resolution of th:< fire protection issue was not straightforward. Six years later the industry and the agency are still arguing over what protection is required.

The precise hazards posed by fires are difficult to define: where will fires start, how Jg will they be, how long will it take to put them out, and what human errors will occur. However, clearly there are problems that must be dealt with. Furthennore, regulators must continuously make decisions even though faced with uncertainty.

Over the past six years the NRC staff did its best.

(I would note the industry was of little help.)

It has attempted to develop precise criteria, while recognizing it is always difficult to determine that a i

particular number is the correct one.

In many cases judgment played a major role. The Comission recognized that there might be room for argument on some of the decisions.

For this reason licensees were i

i 2/

Id. at 94.

--t'e-

• ew - erwo.

e-r.

-w-e..py,----

g-g-

g-y.we,.g-yw,r-.w,y---.+,-----ww.,yve-mg+%mgy.--

--w,,c-+-p-3g,

.-w-wry-m-a g m m-yq-Lr---iy-ww-3--,,ww.w----w--g--

e 3

invited to make the case that an alternate configuration would schieve the level of pmtection that the Comission desired. y The case made by the movants indicates they believe NRC requirements 4

to be invalid unless the NRC can demonstrate unequivocably that its numbers 'are corrtet based on reports, studies, 3r analyses. Their argument seems to be that the NRC has failed to sustain its burden, not that they have presented a better basis for a differant number which the NRC has improperly rejected. The regulat..y philosophy implicit in this approach is untenable. Certainly the Comission has an obligation to make rational decisions and provide an explanation of how those decisions were reached. However, given the uncertainties, it must be permitted to exercise ju@ ment when that is necessary. Absent a constructive alternative or e major n

, +.r e underlying rationale, that judgment must be allowed to stand.

If not, the result will be large gaps in the regulatory

~

scheme for the many areas in which problemt are clear but precise solutions are not.

y The Commission specifically inserted an exemption request procedure in 50.48(c)(6).

If the Director of Nuclear Reactor Regulation de-termines that the licensee has provided a sound technical basis, then the clock stops on the time limit (s) while the NRC evaluates the merits of the licensee's proposal. This amounts to a direct invitation, brause Section 50.12(a) of the regulations already provide for examptions from the requirements of Part 50.

.. ~ _... _ -.. -, -.. _ -. - - -. -.. - _.. -..

CONCURRING OPC! ION OF COMMISSIONER BRADFORD I concur in the Commission's decision and opinion against staying the fire protection rule.

However, I want also to set forth a more detailed history of NRC fire protection efforts as of this, the seventh year since the Browns Ferry fire.

The motion for stay decided today and the related lawsuit are tha latest effort by a minority segment of the nuclear power industry to resist the enhanced fire protection safety standards found necessary by the NRC.

This resistance shculd not obscure two important facts.

F i rs t, a potentially disastrous fire in a nuclear power plant is a real threat.

It is not hypothetical.

It happened in 1975 at Browns Ferry, and less serious fires are commonplace.1!

Second, in many plants an unmitigated fire could disable redundant systems necessary for the safe shutdown of the plant because the licensees have no+. Installed adequate barriers, automatic suppression systems and alternate shutdown systems.

It is the hazard posed by these two f acts which the NRC has finally attempted to cure by Appendix R.

Further delay will further subject the public to an unacceptable and avoidable risk.

The Browns Ferry fire in 1975 started when a candle flame, used to test for air leakage, ignited highly flammable insulation in cable penetrations between the cable spreading room and the Unit I reactor building.

It was the last in a series of fires at the same plant.

The fire spread to the cable spreading room and

-1/

For a list of recent fires, see Appendix A to this opinion.

Since NRC does not require the reporting of fires, the list may not be complete.

. to the Unit I reactor building, where within an area roughly 40 feet by 20 feet, about 1,600 electrical cables were damaged.

As a result, control power was lost for equipment such us valves, pumps and blowers.

All of the emergency core cooling systers for Unit 1 were rendered inoperable as were parts of the Unit 2 system.

The functioning of the non-emergency cooling systems was disrupted significantly during the accident.

After the fire began, the main steam isolation valves closed precluding the normal delivery of high pressure cooling water and thereby causing the operators to lower pressure ind rely on low pressure pumps.

This mechod of cooling was successful for a few hours until the fire caused four relief valves to close, forcing repressurization.

The operator then relied on a control rod drive system pump to provide reactor coolant.

Also, during the fire, short circuits in burned cables caused power to be fed backwards causing the failure of control panel indication lights designed to monitor electric power systems during emergencies.

Many redundant instruments no longer worked, including all neutron monitoring.

Ad hoc repairs in the control room were made in dense smoke by craftsmen wearing breather apparatus.

The fire burned for seven hours, and it took 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> from the beginning of the fire to return to a normal mode of cooling.2/

~2/

For a more complete description of the Browns Ferry fire, see Browns Ferry Nuclear Plant Fire, Hearings Before the Joint Committee on Atomic Energy, Sep.tember 16, 1975; Recommendations Related to Brownc Ferry Fire, NUREG 0050, February 1976; Browns Ferry:

The Regulatory Failure, Daniel F. Ford, et.

al., Union of Concerned Scientists, June 10, 1976.

... - -..-..c

.~...-

o

- Af ter the Browns Ferry fire, the NRC attempted to work with the licensees informally.

In late 1976, the NRC staf f set October 31, 1980 as the deadline for licensees to complete their fire pec-i.on modifications.

While this informal approach succeeded with many licensees, some resisted the staff's efforts.

Accordingly, in iP.s April 13, 1978 decision on fire protection, the Commission instructed the staff to use its best efforts to maintain current schedules [i.e., October 31, 1980] for implemen-tation of the reactor plant backfits required for fire protection.3/

The staff then sent letters to all licensees in August 1979 reminding them of the Commission's April order and the October

'1980 deadline.

These exhortations had little effdct on some licensees and by May 1980, the recalcitrance of these licensees became a major NRC concern.

In its May 23, 1980 order the Commission stated:

l "The staf f has completed Safety Analysis Reports concerning fire protection for all operating reactors.

The modi"ica-tions recommended by the staff are not being implemented smoothly.

Of utmost concern is the f act that some licensees, four and one-half years af ter the Browns Ferry fire, are resisting the modifications found necessary by the staff."

In the Matter of Petition for Emergency and Remedial Relief, 11 NRC 707, 718.

The Commission then noted it had approved Appendix R with a deadline of November 1, 1980 for all items except alternate and dedicated l

shutdown systems unless the Commission approved extensions.

However, the Commission noted that "since the issues involved are

-3/

In the Matter of Petition for Emergency and Remedial Relief, 7 NRC 40'0, 425.

. well known and have been under discussion for several years, the Commission anticipates approving few, if any, extensions."

11 NRC at 719.

In response to licensee comments on the proposed rule, the Commission subsequently relaxed the November 1980 deadline con-siderably to allow more time for implementation of fire protection modifications.

Even this relaxation has not satisfied that minority of the licensees who have failed to comprehend the 1975 fire and the recent decisions of the Commission starting in 1978 and culminating in the promulgation of Appendix R.

The fact is that many plants still do not have the fire barriers, automatic suppression systems and alternate shutdown systems which are necessary to protect their shutdown capability.

As a result, an unmitigated fire could disable those redundant systems necessary for safe shutdown of the plant.

For example, at Florida Power and Light's Turkey Point Units 3 and 4 the NRC's consultant, Brookhaven National Laboratory, stated, "It is not clear that this plant can sustain a fire and safety shutdown."

Among its conclusions were (1) that the licensee had not demonstrated the ability to achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and (2) that it had failed to demonstrate that fire damage to non-safety circu'its would not prevent the operation of shutdown equipment.1!

-4/

Interim Report, Post Fire Shutdown Capability, Turkey Point Units 3 and 4, March 31, 1981.

. At Commonwealth Edison's Dresd'en Units 2 and 3, Brookhaven found that all fire areas had not been addressc4 to ensure that a safe shutdown capability would exist after any fire.5/

At Haddam Neck, owned by Northeast Utilities, Brookhaven found that tne l

l l

l licensee had not undertaken to demonstrate that at least one l

method of achievir g shutdown would survive any fire in any area.

Among its specific conclusions were that the li'_.tsee had not shown the post-fire shutdown capability for achieving and I

i maintaining reactor coolant level and reector coolant pressure.

Indeed, Haddam Neck had so many problems, Brookhaven recommended that the unit install a dedicated shutdown system which would be completely independent from the existing cable runs.5/

This has not been done.

The Commission has also discovered that there are problems l

f or plants previously approved according to post-Browns Ferry guidelines.

At Salem Units 1 and 2, owned by Public Service Electric and Gas Company, et. al., a special NRC review team found that a single fire could f ail all instrum.ac channels, l

including the independent instrumentation provided for alternative 1

l shutdown.

The review team concluded that this condition presented I

an immediate safety concern and required immediate corrective actions.2/

-5/

Interim Report on Post Fire Shutdown Capability, Dresden Station, Units 2 and 3, March 11, 1981.

6/

Interim Report, Post Fire Shutdown Capability, Haddam Neck Plant, April 1, 1981.

7/

See Safety evaluation Report, Supplement No. 6, Salem Unit 2, May 1981.

. Finally, the Commission has recently discovered that there are' fire protection problems at Browns Ferry itself.

The staff found significant violations, including failure to provido automatic sprinkler protection for crucial pumps, fallare to adequately - protect emergency battery rooms and f ailure to provide adequate fire watches.

The NRC staff found that these violations could have prevented a crucial safety system from performing its intended function under certain conditions.

NRC required an immediate 24-hour fire watch at the intake structure and in the emergency battery room

-nding TVA modifications.

Because these requirements were in the license, the NRC has imposed a $45,000 civil penalty.

The foregoing history is, of course, not the technical justification for Appendix R.

As the Commission decision states, the record in the proceeding is sufficient for that purpose.

The Browns Ferry experience and the conditions actually existing in the plants demonstrate that a stay of Appendix R would further delay urgently needed fire protection measures in those plants that have thus far declined to adopt some or all of them.

Without I

an enforceable rule, the enhanced protection shown necessary by the 1975 Browns Ferry fire will not be put in place in the remaining

^

plants.

This enhanced protection was originally put on a generous and informal 5-year schedule.

Appendix R in its current form grants a very substantial extension to that schedule.

A further stay would penalize the management of those licensees who have complied, sould reward delay, would undercut six years of NRC l

.. -.... - - _ _, -... _, _. _. _. _. -, -. _, _ -. ~. _ _ _.,, _. -. -.. - -

7-staff effort, and would expose the public to undue risk.

The Commission does well to reject it.

.-,.--,-.ee...,..-

~,.. --.,. -

e

-n-.

. - -, --,,---- -,,.--,,_,,,- ~..,,,, -

---

n--r-

CONCURRING OPINION OF COMMISSIONER BRADFORD; ATTACHMENT A Fires at Operating Plants Reported in PN's (From 6/78 - Present)

Date of Event PN* Number,

, Facility Description 71/13/78 78-192 Cook - 2 Hydrogen fire in bushing area of electrical generator 11/28/78 78-196 Clinton - 1 Propane gas explosion and fire in drywell -

one fatality 12/12/78 78-208 Oresden - 3 Fire occurred in the main transformer 1/5/79 7 9-01 J. C. Summer Minor vandalistic fires at various Unit 1 locations - usuall; toilets 2/23/79 7 9-31 Dresden-3 Fire in main transformer - power transferre immediately to aux. trans.

7/12/79 79-238 THI - 2 Small fire in radiation monitoring readout panel for aux. bldg. waste gas systen

~~ ~

9/4/79 79-388 Indian Point Insulation fire - reactor coolant pump Unit 2 tube oil piping saturated insulation with oil and ignited 9/30/79 H. 8. Robinson Lagging fire on cold leg piping caused by Un't 2 lubricating oil leak 10/16/79 I'-79-07 Maine Yankee Fire in diesel generator turbocharger exhaust piping 12/27/79 PNO-II-79-48 Surry - 2 Small portable electrical heater caught fire in the containment of Unit 2 1 / 21 /8 0 PNO-II-80-13 Browns Ferry Small smoldering fire in a cable tray Unit 1 beneath the turbine building operating floor - was detected and extinguished by plant personnel 2/2/80 PNO-II-80-19 Brunswick A tenporary frame building, used for offic Units 1 & 2 space, was destroyed by fire 3/7/80 PNO-I-80-36 Calvert Cliffs A small fire occurred in diesel generator Unit 2 room f21 - extinguished within minutes 3 / 21 / 8 0 PNO-III-80-58 Midland Fire occurred in two trailers used by personnel designing small bore piping

2-Date of Everit PN Number Facility Description 4/ 21 /8 0 -

PNO-TMI-80-26 TMI - l'3'2 Fire broke out at a trailer next to TMI observation center 4/22/80 PNO-I-80-61 Nine Mile-Point A fire, which resulted from lube oil Unit 1 which had leaked from a main turbine

~

shaft driven feed water pump, was detected 6/3/80 PNO-II-80-98 Surry - 1 A fire in an instrument bus voltage transformer disabled one of four in-strument buses causing unit to trip from 100% power 70/5/80 PNO-III-80-180 Quad-Cities - 2 Small oil fires caused by oil on the hot main stream lines 11/6/80 PNO-TMI-80-50 TMI - 2 Fire in site trailer 12/9/80 PNO-TMI-80-54 TMI - 1 Fire in reactor building (containment) sump; extinguished within minutes 12/15/80 PNO-III-80-230 D. C. Cook - 2 Reactor tripped due to fire in the generator pilot excitor unit 3/7/81 PNO-II-81-22 Matts Bar -

- Fire in a digital computer system in I! nits 1 & 2 communications room of the facilities control room l

i l

-,n-..,-.,...,,....-

,-.,m-nn,,-w-_,,__..__.-__.

,c

,,..-,.,,m_

,,.,-,,,-.,.,,.,,-c,-,m,

,,.,.~,-e,,,-,.neng

.,~-

y.-m-

~ - = -

Significant Fires at Plants Occurring Prior to 6/78 Date Facility Descriotion 4/13/67 Peach Bottom, Unit 1 A fire occurred in the insulation of pipes from the helium cooling system located in the basenent of the con-tainnent building. Fire occurred

^

while the plant was. shutdown for modifications.

3/12/58 San Onofre A fire occurred in and was confined to three overhead cable trays cracked one abeve the other in the 480Y switchgear room. The fire was caused by overloaded and inadequately ventilated electrical cables supplying the pressurizer heaters.

The reactor was at power when the fire occurred.

11/4/71 Indian Point, Unit 2 A fire occurred in the Primary Auxiliary Building and was concentrated in a small construction shack inside the building.

The construction shack and its contents were destroyed. Also, three motor control centers, which controlled ESF equipment and were located above the shack, were badly damaged. The fire was caused by arson.

-..mm-m

_-,--.--c w-,-_, - - - -, -..,

.v..nr-., - - -

r..

.,,.,,,..,_w,

--,,7.--.m..--,,-_

,%,--,.w-,

.---,-.y

,- ~. -,- - - -. - ~-

-