ML20126F158

Recommendations Related to Browns Ferry Fire

ML20126F158
Person / Time
Site:	Browns Ferry
Issue date:	02/28/1976
From:	Collins H, Levine S, Minners W NRC, Office of Nuclear Reactor Regulation, NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
NUREG-0050, NUREG-50, PB-249-674, NUDOCS 8103090394
Download: ML20126F158 (97)

Text

-. _._

]

F 7 y ,

U.S. DEPAlliMENT OF COMMERCE National technicallafonnaties Sonice PB-249 674 RECOMMENDATIONS RELATED TO BROWNS FERRY FIRE l

NUCLEAR REGULATORY COMMISSION FEBRUARY 1976 i

~

NACC LIC69 W m'4+iWRMA*l uru.,y TI 63096 2,9 p ggee pegg o3144 po ,4 pmc/vnwr

.. .. - ..-. . . ...... ~. - .. .-._ ....,. - .- -__.

w" m y

-. .- mt* . ;

..k-- -n ,mrt

@4

- dgM. A 2 $;'%y

~

• , pg.-

, Nyy 1 PB 249 674 M h.c . .A & , . Y, 9 FG.Enhg gem Nk

.m,

.A p

, -ry y.g'Me y p s-mP%-

/t - . ., .

m

%p n:&c .

'w v.;w u v - :%,, ;w&* m.f.

y. , .

= wm,hs

.w.

w, 44 A.

Nk w.w

%,. , -. .m n.Q. .d.; y n.e. .

y~".~mY

o

.Cw wA.r w *~ h y? M w#q;y,w.,49 .. ~ p, - y;n ~. s.s.r~sw;e,.o ..

• M..,m.w.

j.- ,a, , srw n de.r.v ..

,* *e. ..m A. c.~ qyb.y r.M,n.i'.4;da w..

.t.bx+s;;r .c .m

.c%m 6

r.4 a,%y<m. f

• i'W.9y&3.s.a.

.y.:.- 3,7 .,"NgrJ pr.5g. 4<.My.>r A9 ~

g. .T ,IA w e.g+e.y';.M,.A.v3 w,Qe O.

w.,a  :.&of

, a

,c % m.a. - gy ;m..,3 v y,n: p - y .s <,1 .

, s .

. ApdWm.g I h AA Sm

& w.4.l.

2;.g p%

2 W et.W.;1.s g .,ff ght,1.Qs%'.,i:e' Ap

%m a%

N E D ' k b i b $ k..&-4@k%ghf. $ M@t&N.W h ,%h. }.e$ .bM'%'difQ $$ 7 @.;y -

Og& K?M h TU .?. v .

M@;fW&&r9$.N.o.WRd.lCl%.

Answ&$$r $ ,w'C' .;;wy;p.p:x.;jyq4 .p;,MrW,4;.fX+:~gy: c

u. b% tms % :1.gg v.:

Wl.,mcim}

• g. H ' f %m~Z';Ab@d -p:;n%.t 4;-.a.N Q W p ; .- Q'u r My;W d t C ,4 . s tf. 4:j $.t y?% J

'%pg N

'r

• s 1 <w p% % .'>e y &:

%:NEW+(.Q:,x wt. ; . .

.s.

F pp" y s :

s-c?'

r4%gMs.'.% &&t.2G%n'GL5.M'? y L s.y l.

.i ;s r.:hhv.Q:w'M C M

[w.i"::Qy,%yl' mnn

1. J; w :.m.&,m:.wec r

6M&lcu 5)*..?.'s

. b. x: ;.,<. q.m.eM

<W.s>k1.V 3 M tw , ;nw 13 W fW* g,fn: er .

. a. .

.g!., Vq.. ' t?.~ .p: +Q",;~>,:ly@mg? .m".!@%u: .us "A .;

JV

.- 2 y;q:-r; :a,k.v,f.: .?

. . . a m . h,w, a: .7 .w : , w ; . n. M .: ,;., , , .. v. ~ k -

n.pm;.af..sMqms.;W<i.&g,i1,;'.:@q::$ ff f'y.$.Q:,;h:l;.hy.tiq.Lr$&'[&p+T hk.p..p:m,h.I h

k$h.ef hk%WCry i '

W;. 3;'f'&y*, ',g[.rf-QLy~4.ah Q f.N '

C

" % p'% .P

.'{ s;6-M.1%" **be &s . 4n s.&

a M.% )2.%. .JQ~ %) ~ P *V *%. >,.  ;, d.s sl.M m- @4 fft);v*ph w e q q w w':&f5*. e 4, c$:g.k,,lj,f';..

r

g. % g gC'&.w. .a . . %,

r -

~ $bf'3;gy,4@8M.\.

. pr yh. . 4.c&n*f<> i.d. -

.: . M i? 3;.f p.tQ.:rt.y'ba l.'!M.f.*,.' .qMM'i,;gilW}y;.W.g;D'W@"Q( :_%.f:i' W q?:'d., g

.,W.'

e ;.Q. v .; ;g; p. .t (.,p: 1;.,a ; ;y,Y:

yp.ffp.:s;.; f.T0- TM . .n,:s : .a.tM Y. .m a q.:mmg.. ,.. u . g. n.;- .e n . m. .. m:a c z.m W m. W yx.s . . m . w...

y.n ,.3

q 1.,:, %g.,.1.e, v, y r.$' m 3 &. ..

.s y c m w p,v sy.m m~&.C,5(;*

..f $;51:ml.?!.f.?s'.pmp kk'yy%*U@: .

. ?:.Q .s e,.;.&. *qh d?&Z.n.:.'.,.R.Q,Q+':l;'

pO.,.w; 9 WMl,*t uQ .<(Ab b.m,  ;+'&1 h Q&.).>

. efs V. ,

.,.e. p .W.

me.e . ...

..u . , ;,,; s

f. .

~$ .5g,.., , . . ,'M  %, ,4. '3 ~ ",. 4 :% p y;. : u ;. / o 7. .. .. f.' .g. > . :. . ,4

.C_..lr*, : ., 's

• W .?. . . .%. .e.iT m i 6 ,f 4

M 4,t..i G .,3 ',.p., .

. /; 4

. J ' wy.TT,K.s s :p.

e ,,. ',

. . r

• *!;;T!,:. +R.! .'Q.. 76.3l;' y;>,;': J ;q ,..g,;y&-;{ 7- :i Q:g., .h;@g5::f.:." 4 ;I.f'- Q .3s;

+

., .<. ,. ;;7.c y  ;

,o r e g;T.i3 W: w,;;<

j; R 1 m *. ;v y .a..) e,4,.'y

"km

~, ;. : . a9 9 w.c , .

-Q. m. , yn. m w 2 ;~ ::. . .~? , w,s. r. a. ,% ; ,'.w.

'< * .v;

y. m. r,. . .- s .m2 a,;..;

o r.. ts' e.* J .- 4 4,., gu.er.,~,,o. . . ..:.

.3. g n w 1 .

N],.r;,-i *W .& ' '*,O ;hifL.oQlQ;n. ;f, Jb':.,5R. &

n,.'.%.;Q.Q:.d.,,,&.x,qq.$s'.  :?d{.M %Q. &'s:.1@Q,H, . M.p.. e %., h ,.ww. p&}t@, Q:.*

i s' ..y, 7 .v.a .. F.Tnu h.t.E,.a

.,L,dy,,.4,i' .-1.nq$" W , . %e ^W' M nA **t'Q:4,. yJ /p q:),?f

,,W v

n,

&y:.~? .  :.

p??, , .y'4..W %,,,.?.

.,.  :,. V f. /y

~1 ' yt

.*'%.n. ?.. ^ -:',:h

• h..N. , h-, .Y. .h?h. ..w' - .h,.y,./..iL.

y

..i,,

hf N r .I1 ,. .' N

. $. . ; , . . O u.

it y .h.lf'%d. y. Mp, ,, f; . wy

.$, k.a?f- QwQ,% ..,,E,#.

.:*O,.,+.".;.a.$.,.'h.yh,,f.').t.r17 f,.7,Q T:".ls,

;m;. M f, p *';N*w*-/ m T,p.$%y- mc,, s a.% g. 4 4"g,.,I _

5 c.,,, M ;M/C*>?:e M n.:'  :: y.;.;zh

~ <gy:.;.ly.g

~

-y fp;Npp_;?;;<@t-s,p.n$yQ g.f.

i:o d4.py" Qq xa >Q:yr.a f- p." %g.q.s.ps;, n ha.HlLTG;y.lf'.v.

. . w & .n:n..a;<, f. Plm,.3.

% g :- "n r

.o m, W '.h*M..~g f

~

'r. .

,% vt .-ify:g N ,s u -)d.-j

. ; .-. ,. m. . ,,':;: -t,, s.W'@Q&:k;i:,p!y-.tg',J.$ N, , ,n@Qi i N.'.' jp$., :.,,',r , "r',,.N.~y::)!).

..,. pg. 9 . , . . . + ~ , . .n.L. R: .W ';

fl.M $.. .. g .

. f ;ty,a n

+

I-

7. : . . , . .A

.: .n ,.

- , s . 2. 9. , ; . .n.4. ..u;p- n.,, v, .. . . r,9.s,

. , . . .. , .s  ; , ;, , ,

m .e .

I e ;g ,

.2 t[3.ch.5 h {e 7

,. . . .: - ' h (3;I,{ ,-- 'i[ ,. y I

',, y[,, .; lo9

.c .- c.- c.

[j ,

,j.

.m

• s ,- $.

. ^ >

.P <- .

1 ,, , ' * *

~ . ,.;Q:.':y," M~

i r ,G p~ w n,; .q.;;. 3G _

)* -

• -(e,' ,

,, a.g

~

j .

% , :( :-

, . g.. . ..

..,.. . , .3

,7/'5; Nu&u Q, AmW him T ,

"" 4 '

.. ,_. .: 2. . x. .  ;

-( e ., . .. .. e.

I NATICNAL TICHNICAL e s ] INFORMA..TIO. .N, c....S.ERVICE s ., .I ' v.wo-e. .s u s c, erw. ...o.op... . am**ei? g ..y fy-e, , ,

. . '..].

d

• C7 'j f1 Q*M'"* *i" ;6Qp'h,"*=

. *1([W.s t ' *.h 'v: b 1 hJ W sc.,W. ~

,. 5 m_..._,.. . ._ ;y e _C .s *:7\p > > v <

~;w > :ll: . :. .s_.3  :- A L a. : '_ '. . o N : * '. .O 2 - - -- 1 i .

~* * * ~

• ~~

]'

h 6.

sisL 1GR APHIC D ATa l. Kipoet No. 2. i r s

SHE5r NUREC-0050 .

4 -

i y .. 1 ie o.a 3.y. tie

5. "'m"h Report on Browns Ferry Fire 6.

t

7. A ut hert s ) S. Performana Orgassaation Rept.

No. NUREG-0050 i 9. Perivemana Organisation Name and AJ hese 10. Prosect/ Task /tork Umst No.

2 U.S. Nuclear Regulatory Courission 3 3. Coatsoet/Gr*** No.

Washington, D.C. 20555 t i

12. >pensoring Organisasica Name and Addresa 13. Type el keport a Period Covered f Same as 9 i 14 14 5=rriem m a.y Noses Vicent Panciera, Warren Minner8, Karl S"yfrit, other Group Members: Saul I.evine, W,ss Moore, Harold E. Colline. i

16. Atatracts I

The ')equence of events during and subsequent to the fire at the Brown.4 Ferry i nuclear plant is delineated. The impact of the fire on the health and safety of residents in the Browns Ferry locale is evaluated. The Special Review Group makes recommendations to be implemented by the Nuclear Regulatory Commission relating to fire-preventing systems and emergency plans at both Browns Ferry and .

other nuclear power plants.and for future license-application evaluatia.

I l?. Acy Sards amt ilucument Analyses. 17o. lhescripseers l

4 e

f a

171 ljentifiers/Opend nJed Terms 1

17c. ( 09 A Tl F ield (.roup

18. A vailat.itity statemen. 19. Set uest y Liass ( Thn 21. No. of Pages

• R e pori n

' q fi~

Unlignited availability from NTIS 2a 3e ur' SS[U.'.]'i n.-

, 22. Price s ".'w i m' r n n $ 3' O roa qs.nomtv *e. si uscouw.oceass. pre t s,in .ani la f 4 AN'l ANi6 i %. M .I. TillN tOMM MA) I't. kl P RE 1 DIM t.D

_ r_.. _.m._ _ . =g wi

.--- - . _ . . . .e . . . , ... . . . . . . . . - . . .

f f

NUREC-0050 t

RECOMMENDATIONS RELATED TO .

BRbWNS FERRY FIRE Report By Special Review Group Harold E. Collins Voss A. Moore Saul Levine Vincent W. Panciera Warren \linners Karl V. Setf rit Stephen 41. Hanauer, Chairman Date Published: February 1976

~

i U. S. Nuclear Regulatory Commission Washington, D. C. 20555 4

e Ay m @ e _wge.s-e,-

-r- - -+ -  %-

)

g q. . . - -

g I,

f

/"'N\ u mo mm mucteAn maoutATony conausesmse

} g wassessaton.e.c. muss ,3 g

g..... ia

.t I

i February 21,1976 ' '.

J i

Lee V. Gossick. Executive Director for Operations  :

REPORT OF *,PECIAL REV!EW GROUP ON BRDWNS FERRY FIRE i-Enclosed you will find the report of the Special Review Group you appointed on March 26. 1975.

te wiew the Browns Ferry fire of fiarch 22. In accordance with its charter, the Group has tried to distill from the available ir. formation those hssons that should be learned for the ,

'i future. Some of tnese lessons apply to operating plants. others to designers. standards developers. State and local authorities, and the NRC. .

Based on its review of the events transpiring before, during and after the Browns Ferry fire.

the Review Group concludes that the probability of disruptive fires of the magnitude of the Browns Ferry event is small, and that there is no need to restrict operation of nuclear ' power plants for public safety. However. it is clear that much can and should be done to reduce even further the likelihood of disabling fires and to improve assurance of rapid extinguishment of i fires that occur. Consideration sh)uld be given also to features that would increas; turtner the ability of nuclear facilities to withstand larse fires without loss of important functions should such fires occur. The Review Group believes that improvements especially in the areas of fire preventior and fire control, can and should be made in most existing facilities.

Unless further developments indicate a need to reconvene the Review Group. Its task is considered complete with the publication of the report.

Wb Harold E. Collins Y  !' W Voss A. floore YkW tiember. Special Review Group Member. Special Review Grous Chief. Emergency Preparedness Branch Assistant J1 rector Office of International and State Programs for Enviromental Projects

. Division of Site Safety and Envirornental Analysis Office of Nuclear Reactor Regulation v1 .P Member. Special Review Group Member. Special Review Group Deputy Director Chief. Engineering Methodology Office of Nuclear Regulatory Research Standards Branch Office of Standards Development W. Minners

/ W h)

K. V. Seyfrit

. tirber. Special Review Group Member. Special Review Group Reactor Systems Branch Branch Chief. Reactor Technical Division of Systems Standards Assistance Branch Office of fluclear Reactor Regulation Office of Inspection and Enforcement A h Y- A 4/ tephen H. Panauer Chaiman. Special Review Group Technical Advisor to the Executive Director for Operations

.a 11 6

. . , .-e,

3

. . . . . . _ . ,. . -. -- - - - - -- -. 4.-

q.3. -

i 1

l .I TABLE OF CONTENTS ,

l'

/aae No.

h I  :

GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . vil '

1.0 SU MARY AND RECOPNENDATIONS . . . . . . . . . . . . . . . . 1 i

1.1 I ntroduc ti on . . . . . . . . . . . . . . . . . . . . . 1

. 1.2 Sequence of Events in the Fire . . . . . . . . . . . . I 1.3 How Sa fe was the Public? . . . . . . . . . . . . . . . 2 1.4 Perspective ..................... 3  ;

1.5 General Conclusions. . . . . . . . . . . . . . . . . . 3 I3

. 1.6 Principal Reconnendations. . . . . . . . . . . . . . . 4 1 1.6.1 Fire Prevention . . . . . . . . . . . . . . . . 4 1.6.2 Fire Fighting . . . . . . . . . . . . . . . . . 5 i 1.6.3 Provisions to Maintain important Functions in ,

Spite of a Fire . . . . . . . . . . . . . . . 6 1.6.4 Quality Assurance . . . . . . . . . . . . . . 6 1.6.5 Response of Other Governmental Agencies . . . . 7 1.6.6 Recomendations for ths NRC . . . . . . . . . . 7

2.0 INTRODUCTION

' . . . . . . . . . . . . . . . . . . . . . . . 8 .

2.1 Objective and Plan of this Report. . . . . . . . . . . 8, 2.1.1 Objective . . . . . . . . . . . . . . . . . . . 8 i 2.1.2 Plan of this Report . . . . . . . . . . . . . . 3 2.2 Sources of Information . . . . . . . . . . . . . . . . 8 i t-2.3 Scope of Review . . . . . . . . ............ 9 - -

2.4 Note on Changes with the Passage of Time . . . . . . . 9 2.5 Perspective on Reactor Safety: Defense in Depth . . . 10 3.0 FIRE PREVENTION AND CONTROL . . . . . . . . . . . . . . . . 11 3.1 Details of the Fire . . . . . . ........... 11 3.1.1 Sequence of Events. . . . . . . . . . . . . . . 11 3.1.2 Extent of Fire Damage . . . . . . . . . . . . . 12 3.2 Criteria for Fire Prevention and Control . . . . ... . 14 3.3 Fire Prevention. . . . . . . . . . . . . . . . . . . . 15 4

3.3.1 Fire Prevention in Design . . . . . . . . . . . 15 3.3.2 Operating Considerations in Fire Prevention . . 16 } 4 1

3.4 Criteria for Combustibility of daterials . . . . . . . 17 I-I 3.4.1 Cable Insulation Criteria . . . . . . . . . . . 17 '

3.4.2 Criteria for Fire Stops and Seals . . . . . . . 19 ,l 3.5 Fire Fighting ..... . . . ........... 21

~

3.5.1 Fire Detection and Alam Systems. . . . . . . . 22 3.5.2 Design of Fire Extinguishing Systems. . . . . . 22 I 3.5.3 ventilation Systems and Smoke Control . . . . . 22 1 3.5.4 Fire Fighting . . . . . . . . . . . . . . . . . 25 'l 3.5.5 Prevention and Readiness Efforts During i Construction ano Operation ......... 26 i a

111 n a .

,,,go.h p. , wwe se w . Nw "'

,w,. .% e - . y,- -

i. ,

}

i

. iv ' 't i

k UI . '

' TA8tf Dr Ch4TffiTS (Continued)

Page fio.

- 2.0 S VSTE"5 C015:DE RAT!0*is. . . . . . . . . . . . . . . . . . 28 i

4.1 Availability of Systens During' the [ver.t . . . . . . . 28

.t .1.1 Pedundancy of Peactor Core Cooling Equipment . . . . . . . . . . . . . . . . . . 30 4.1.2, role of nor ul Cooling Systems. . . . . . . . . 31 *

. 4.2 Pedsedancy and Separation.r.erieral Considerations . . . 32 f

4.3 Separation of Dedandant Electric Circuits . . .... 35

• 4.3.1 Common wo de rallurcs Caused by the inre . . . 35 i 1

4.3.2 Common vnde Fillures Attribatable to IrMicater Light Convections . . . . . . . . . 35  !

4.3.3 rronimit/ of Cables of Pedandant Divisicos. . . . . . . . . . . . . . . . . . 36  !

4.3.3.1 Trars and Condsit. . . . . .... 36 i

• 3.3.?

4en-Divisional a r bles. . . . . . . . . 37 1

S 4.3.3.3 (4ble Spreading Paom . . . . . . . . . 37 ,

4.3 ; thfsica: Separation friteria for rebics . . . . 37 a.3.4.1. fro.ns rerry r.riteria for rhys' cal

'co4 ration afd Isolation cf r dandant e

t Cir(sits.............. 37 l 4.3.4.7 're ;.arist,n of recons ferry separation r iterie with '9erent *JC Separation e

riteria . . . . . . . . . . . . . . 43 f.3.4.3 4.*t,1cy af Emittiel %PC teparatlog f

'riteria . . . . . . . . . .... s2 '

4.3.4.4 Criteria for tra Tuture. . . . . . . . 42

• J.* .i r'. tr atactation L-1;lrej 'or nr era tor Act ion . . . . . 26 5.# * .'; A ~.* ; 9*.5 A f f C C 7 ! %#. i++C !%Cl?[%i. ............ 4E "

5.1 .'A Orsenitation . . . . . .... . . . . . . . ... 43 5.1.1 Gereral . . . . . . . . . . . . . . . . . . . . f3 5.1.? 1.alltf Asswrance organization and 9A Plan. .. 43

• 5.I.E.1 'Pslin and Construction. . . . . .. 48- j

-i

'.2 14:.ses in tulity

• s,carse at fro.as Terry. . ... . 49 5.3 014*.t a:erating itsff. . . .. ....... . ... 50 5.1.1 Daitological **onitoring . . . . . . . . . Ei $

5.3.'.1 '.nsite . . . . . . . . . . . . ... 50 5.3.1.2 e'fsite. . . . . . . , . . . . ... 51 C tl if 'I.T . *.'.T.L! AP Ff SJL A70D f CC"MI55!0*i. . . . . . 5?

. f.) 'ntrod.ction ........... . . + *

• ry

• f.1.1 Lessonsibilitt f or Sa fety . . . . . . ... 52 F

6 b

A , ~h r

, , i m -

gg , m g. i..4*M "'

I

..oaa s ers * -,  %~ .,r.% .e .-e..c., - , . nw . e-w -a % e --,2, , ..- +-. -,e, , -u. - - - -ww., m re, y 9 e v. - et-e+- e"-,e---er egn

• m --rw"e .-*

m 7- c - -

i

i. i I l' .* f

( lr l f v 1

l 0 i lj 1 TABLE OF CONTENTS (Continued)

/4 , Page No.

) 6.2 Organization'. . . . . . . . . . . . . . . . . . . . . 52 6.2.1 IE....................... 52 i 6.2.2 NRR . . . . . . . . . . . . . . . . . . . . . . 52 '

6.2.3 NRC Organization - Application to Unusual l

.A t

Events and Incid?nts. . . . . . . . . . . . . 52 l i

6. 2. 4 NRC Organization for Quality Assurance. . . . . 54 6.2.5 Evolution of Regulatory Requirements. . . . . . 55 6.3 NRC Action Before the Fire . . . . . . . . . . . . . . 55 .

~! 6.3.1 Design and Operatin

' 56 6.3.2 Quality Assurance .g,...........

Criteria . . . . . . . . . 57 -

6.3.3 Inspection of Licensea Operations . . . . . . . 57 l

6.4 NRC Action During and After the Fire . . . . . . . . . 58  !

6.4.1 During the Fire and the First 24 Hours  !

Af te rwa rds . . . . . . . . . . . . . . . . . . 58 l 6.4.2 After March 23. 19 7 5. . . . . . . . . . . . . . 59 3

. 7.0 RESPONSE OF OTHER GOVERNMENT AGENCIES . . . . . . . . . . . 61 7.1 Surm.ary ....................... 61 7.2 State Governments. . . . . . . . . . . . . . . . . . . 61 7.2.1 A l a bama . . . . . . . . . . . . . . . . . . . . 61 7.2.2 Tennessee . . . . . . . . . . . . . . . . . . . 62 7.3 Local Governments. . . . . . ............ 63 '

7.3.1 Limestone County. Alabama . . . . . . . . . . . 63 7.3.2 Lawrence County. Alaba:na ........... 63 7.3.3 %rgan County, Alabama ......: ..... 63 '

7.3.4 Athens Fire Department. . . . . . . . . . . . . 63 7.3.5 Tri-County Health Department. . . . . . . . . 63 7.3.6 Drills and Exercises ............. 64 7.4 Federal Agencies . . . . . . . . . . . . . . . . . . . 64 7.4.1 Energy Research and Development k Adminis tra tio.". ............... 64 {

7.4.2 Other Federal Agencies. . . . . . . . . . . . . 64 ,

REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 APPENDIXES A. NRC Announcement No. 45. " Appointment of Special

, Review Group." March 26. 1975. . . . . . . . . .. 73 i B. Management Directive Regarding Interface Petween Licensing (Now NRR) and Regulatory Operation:

(Now IE). December 29. 1972. . . . . . . . . . . . . 75 C. Feasibility of Retrofitting Existing Designs to Provide Pedundant Cable Spreading Rooms. . . . . . . 82

..u

,,%m..=.- a. -

? ;'.[:]1 p

l vi l l^

.i-6 TABLE OF CONTENTS (Continued) , 1 I

Page No. '

1 TACLES i i

1. Ca bl e Ma teria l s . . . . . . . . . . . . . . . . . . . . 17  !

i i

2. Assignment of Damaged Cables to Redundant Divisions. . 33  !

t

3. Unit,1 Redundant subsystens Not Available. . . . . . . 35 I 3

- "  ! t 4 Comparison or Browns Ferry FSAR Separation 3 Requ'rements with Regulatory Guide 1.75. . . . . . . ?8 .;

I FIG 0'RES .

f

1. Area o f F i re . . . . . . . . . . . . . . . . . . . . . 13 3 5

2. Region of Influence of Fire in Cab 1c Tray. . . . . . . 43 f

3. NRC Organization Chart . . . . . . . . . . . . . . . . 53 .

i l

t

a. 4- m. _

l I

l l

l

,,wv' w - --

+

3 y. m- -.-

.-m-- - , ,..m____a ____,_ _ , . _ _ ____ _________ _ _ _ _

[

( -

l i e t l l l GLOSSARY

t

ADRH A

sistant Director of Radiological Health. State of Tennessee.

l AEC U.S. Atomic Energy Corsaission (abolished January 1975).

AWG American Wire gauge. I

, Slowdown Release of reactor steam through relief valves in '

quantities sufficient to decrease reactor pressure, ,

i Cardoa A proprietary fixed carbon dioxide fire-fighting system. *

~

CD Civil defense co-ordinator.

• CECC Central Emergency Control Center. TVA.

f CFR Code of Federal Regulations. i Chemo A oroprietary self-contained breathing apparatus. '

CO Carbon Dioxide. '

2 Condensate Pwp that forms part (,f feedwater system.

booster pump Cp Ccnstruction permit.

CRD Control rod drive hydraulic mechanisms that move the control rods.

DCPA Defense Civil Preparedness Agency.

DRH Director of Radiological Health. State of Alabama or Tennessee.

EACT Emergency Action Co-or11 nation Team of ERCA.

ECC5 Emergency core cooling system.

EOC Er.ergency operations center of ERDA at f.ennantown. Md.

.tPA Envirorsneatal Protection Agency.

ERCA Energy Research and Development Administration.

FDA.BRH 1 Bureau of Radi? logical Health. Food and Drug Adninistration. >

Department of Health. Education and Welfare.

{

T Feedwater Norr.sl way of pumping water into the reactor for conversion 1 Into steam to run the turbine . generator.

Flamemastic A proprietary coating material to improve fire resistance. ~

FR '*

Federal Register (daily announcement journal). -

FSA't FinalSafetyAnalysisReport(OperatingLicense), i GDC Genera? Design Criteria for reactors; 10 CFR 50 Appendix A.

gpm Gallons per minute, a neasure of water flow.

HPCI High pressure infection system, part of ECC5.

vil

. .t 4

,,__,-...wwe - - . -

l

'l <

viii l li f IE Office of Inspection and Enforcement. NPt.  !

t

i l IEEE Institute of Electrical and Electronics Engineers. 1i t

i IRAP Interagency Radiological Assistance Plan. I )t NEL-FIA Nuclear Energy Liability and Property Insurance Association. ,

MFPA National Fire Protectir,n Association.

NRC U.S. Nuclear Regulatory Commission.

NRR Office of fluclear Reactor Regulation. NRC.

OL Operating license. j.

t PSAR Preliminary Safety Analysis Report (Construction Permit). j psig Pounds per square inch gauge, a reasure of pressure QA Quality Assurance.

t QAP Qualityassurance(program)fordesign, procurement.

r.anufacture, construction, and operation. l t j RCIC Peactor core isolation cooling system. i Relief Valve Method of releasing steam from the reactor. l RHR Residual heat removal system - uses river water to coc1 reac*.or ano suppression pool.

SAR Safety Analysis Report (by applicant).

Scram Shutdown of 'nucitar reaction by rapid insertian of all g control rods into the core. i 1

SER Eafety Evaluation Report (by NRC). ,

SLC Standoy liculo control - a system for pur'ptng water oi boron solution into the reactor, Suppression Large tank half full of water. Steam from relief valves pool is piped to below surface of-pool, which condenses the steem.

TVA Tennessee Valley Authority.

UL Underwriters

• Laboratories.

• 1 t

10

..,..%.L-..am ..-%_e.-. m --

l 1

l n~ ~ _ --

m w ===u ,

,, g;f.,

I E J .

i 1.0 SUSARY AND REr0ft9E90ATIONe '

1.1 Introduction On March 22, 1975, a fire was experienced at the Brow,s Ferry Muclear Plant near Decatur. Alabama. (

The Special Review Group was estabitshed by the Executive Director for Operations of the Nuclear '

Regulatory Comission (NRC) soon after the fire tc identify the lessons learned from this event and tu mako recomendations for the future in the light of thest IJssons. Unless further developments indicate a need to reconvene the Review Group, its task is considered complete with .ij the publication of this report.

1 The Review Group's recomendations cover a variety of subjects. The responsibility for implemen.

tation of the various recommendations belongs to the Nuclear Regu13 tory Comission gene-slly, and to appropriate offices within the NRC specifically.

Althosgh reconsnendations are offered on a variety of specific itir:$ WFere improvementi could be l

u:eful, the Review Grtsp does not believe th3t action is needed in every plant in response to each of these coments.  ; i degree of protection fromThe overall objective of the recorriendations is to achieve ce acceptable fires. A balanced approach must be used in the application of the i recommendations to Joecific facilities, with due consideration for the details of the design an't construction of each specific plant. ,

The Review Group has not duplicated the investigation into the incident conducted by the Office of Inspection and Enforcement or these the safety review conducted j ]

by the Office of .:velear Reactos Regulation, both reported alsewhere. However, reports, as well as input from the Tenness ,

Valley Authority and other sources, were used by the Review Group in its evaluation.

t The Group's recomendations are necessarily based on today's knowledge and understanding. The Browns Ferry Cont.truction Pemit was issued in 1966, and its issuance based on the state of knowledge at thet time. Simliarly, the Operating Licease review in 1970-72 was based on the technology of that period. Many things that are now deemed evident as a result of the incident and its analysis were not evident previously. The recomendations of the Review Group reflect -

the increase in knowledge and understanding ouring recent years.

1.2 Sequence of Events in the Fire, e The Browns Ferry plant consiste of three boiling water reactors, each designed to produce 1067 megawatts of electrical power. Units 1 and 2 were both operating at the time Jf the fire. Unit 3 is still under construction. -

.j - .

Units 1 and 2 Share a comon control room with a cable spreading room located benesth the control row. Cables carrying electrical signals between the control room and various pieces cf equip-ment in the plant pass through the cable spreading room.

The imediate cause of the fire was the ignition of polyurethane foam which wa: being used to i seal air leaks in cable penetrations between the Unit I reactor building and a cable spreading i i roon located beneath the control roort of Units 1 and 2. The material ignited when a candle j flame, which was being bsed to test the penetration for leakage. Was drawn into the foam by air flow through the leaking penetration.

• a Following ignition of the oolyurethane foam, the fire propagated through the penetration in the

• wall between the cable spreading room and the Unit I reactor building. In the cable spreading roca, the extent of turning was limited and the fire was controlled by a crebination of tne 8 installed carbon dioxide extinguishing systeri and manual fire fighting efforts. Damage to the cables in this area was limited to about 5 feet next to the penetratica where the fire started.

The major damage occurred in the Unit i reactor building adjacent to the cable preading room, in an area roughly 40 feet by 20 feet. wher2 there is a high concentration of electrical cables.

About 1600 cables were daaaged. There was very little other equiocent in the fire trea, an1 the only damage, other than tFat to cables, trays, and condui;s, was the reiting of a soldered joint on an air line and sore spalling of concrete. ,

The electrical cables, af ter !nsulation had been burned off, shcrted t0gether ard groundeo to their supporting trays or to the conduits with the result that control pcwer was Ic ,t fer much of the installed equiprent such as valves, Dunos, and blowers. Suf ficient equipre"* 7"ai101 1

I

.g m.w w -i.

., .y

.1

. l-

} operational threughout the event to shut cown the reactors and maintain the reactor cores in a coolsd and sare condittoa. even though all of the emergency core cooling systeca for Unit I were rendered inoperable, and portions of the Unit 2 systers were ilkewise afretted. No release of radioactive er 4 rial above the levels hssociated with normal plant 3peration resulted from the event.

In addition to the cable d E ge, the burning insulation created a dense soot which was deposited throughout, the Unit I re m or ouilding and in some small areas in the Unit 2 reactor building.

The estimated 4.000 por nds of polyvinyl chloride insulated cable which burned also released an ,

estimateJ 1400 pounds o' chloride to the reactor building. Following cleaning all exposed surfaces of pipitg. condult and other equiVent 9ere examined for evidente of damage. Piping surf aces where soot or other deposits were noted were examined by dye penetrant procedures.

With the exception af small (3 and 4 inch diameter) uninsulated carbon steel piping, one aun of aluminum piping hLating and ventilation ducts. and copper instrument lines in or naar the fire zone, no evidence of significant chloride corrosion was found. Where sucn evidence ris found, the material affected will be replaced. For some stainless steel instrument lir.es, an accelerated '

inspection progrim has been established to determine if effects of chloride may later appear.

.. 1.3 How Safe was the Publie?

The Review Group has studied the consider &ble evMence now available on the Browns Ferry fire and has considered the possibility that the consequences of the eveit could have been more severe, even though in fact they were rather easily forestalled. it is certain'y true that, in principle, negraded conditions that did not occur could have occurred. Some core cooling systems were. or became. unavailable to cool the coret others were, or became available and some of these were used to cool the core. Much attentien was drawn to the uhavailability of Emergency Core Cooling Systems. While it is certainly true that the availability of these systems wound have been CCuforting. they were not required during the Browns Ferry fire. In the absence of a loss of coolant accident. systems other than those designated as emergency core cooHng systems are capable of maintaining an adequate supply of water 13 ths core. This was indeed the case during the fire at Browns Ferry.

/ 'One way of locking at public safety during this event is to inventory the subsystems that were available at various times during the course of the fire and to assess their redundar.cy, and to consider what actions were potentially available to increase the redundancy. This is considered in Section 4.1.1. Such an inventory shows that thero was a great deal of redundant equipment available or potentially available during most of the incident. N rariods of lir'ited redundancy were:

1. The period (about one-half hour) before Unit I was depresnrized at 1:30 p.m. During this period, the operating high pressure cumps had insufficient capacity to inject additional water to rtake up for stea:n loss, but could have been surented in several ways. Alterna.

tively, the system cou1J have been depressurized to allow utilization of redundant low pressure pumps, and this ads done.

2. The period (about four hours) during which remte manual control of the Unit i relief valves and thus the capebility to depressurire the reactor, was Icat. During this period, only nigh-pressure pumping could be effective; there remained available three control-rod drive pumps, any one of which could keep the core covered and cooled, provided that a steam drain valve was opened (this was done sane hours later) or a bypass valve opened. In addition, two standby liquid control system pumus were also available, which together could keep the core covered with the steam drain valve open, and eith>r of which, added to any one control-rod drive pymp, could keep the core covered even rithout a drain or bypass

- valve being opened. Other actions were available which could have oeer taken to augment high pressure capability or to restore low press.are cacability.

Actually, the remote manual control of the relief valves wcs restored and the added r%ndancy

• of the three available condensate booster pumps made the other optiens academic. These other options are discussed in Section 4.1.1.

A probabilistic assessment of public safety or rin in quantitative terms is given in the Reactor

. SafetyStudy(1). As the result of a calculation cased on the Browns Ferry fire. the study concludes that tre potential for a signi'icant release of radioactivity from such a fire is

- about 20% of that calculated from all o mer causes analyzed. This indicates that predicted pctential accident risks from di causes were not greatly affected by consideration of the Browns Ferry fire. This is cne of the reasons that urgent action ir regard to recucing risks due to potential fires is not required. The study also points out that "rather straightforward re35ures, such as rnay already exist at other nuclear plants. can mprove fire preventi,n and b 6 e.- matg O h h C.-+ m w - w&#9 w % M.,cM 1 *w " h w ' wiW "'1M s -

->tw cw---

- t 9

l N

m l

S fire-fighting capability and can significantly reduce the like11haod of a potential core melt I accident that might result from a large fire." The Review Group agrees.

l c Fires occur.rather frequently; however, fires involving equipment unavailability comparable to '

the Browns Ferry fire are quite infrequent (see Section 3.3). The Review Group believes that steps already taken since March 1975 (see Section 3.3.2) have reduced this frequency significantly.

1,4 Perspective The Browns Ferry fire and its aftermath have revealed sme significant inadequacies in design and procedures related to fires at that plant. In addition to the direct fire damage, there were several kinds of failures. Some equipment did not function correctly, and, in hindsight, some people's actions were incorrect or at least not as effective as they should have been. The fire, although limited principally to a 20'x40' interior space in the plant, caused extensive damage to electric power and control systems, impeded the functioning of normal and standby cooling systems, degraded the capability to monitor the status of the plant, and caused both units to be out of service for many months. The history of previous small fires that had occurred at this plant, the apparent ease with which the fire started and cable insulation burned, and the many hours that the fire burned..all indicate weaknesses in fire prevention and fire fighting.

, The inoperability of redundant equipment for core and plant cool.cown shows that the present separation and isolation requirements should be reexamined. Deficiencies in quality assurance programs were also revealed.

There is another way of 1 coking at the lessons of the Browns Ferry fire. The outccme with regard to the protection of public health and safety was successful. In spite of the da.nage to the plant as a result of the fire, and the inoperable safety equipment, the reactors were shut down and cooled down successfully. No one on site was seriously injured. No radioactivity above normal operating amounts was released; thus there was no radiological impact on the pubite as a result of the fire. The nuclear fuel was not affected by the fire and the damage to the i

. plant is being repaired. Based on its evaluation of the incident, the Review Group believes '

that even if a fire such as the one at Browns Ferry occurred in another existing plant, the most i probable outcome would not involve adverse effxts on the public health and safety, i The question naturally arises: 1:ow can a serious fire that involved inoperability of so many important systems result in no adverse effect on the public realth and safety? The answer is to be found in the defense-in-depth used to provide safety in nuclear power plants today. It provides for achieving the required high degree of safety assucance by echelons of safety features.

The defense-in-depth afforded in this way does not depend on the acnievement of perfection in any single system or component, but the overall safety is high.

The lessors o.* Browns Ferry show that defense against fires had gaps, and yet the outcome of the fire shows that the overall defense-in-depth was adequate to protect the public safety.

The Reviev Group suggests that this principle be epplied in defense against fires. This defense-in depth principle would be aimed at acnieving safety through an adequ3te balance in: f

1. Preventing fires frtn getting started.

2. Detecting and extinguishing quickly such fires as do get started and limitirg t5eir camage.

3. Designing the plant to minimize the effect of fires on essential fw. tic.tr i i No one of these echelt.ns can be perfect or complete. Strengthenir.g ar.y 01.1 car, compensato in ,

j some measure for deficiencies in the others. ,.

1.5 General Conclusions I Bas:d on its review of the events transpirir.g be'ere, ducir.g and af ter the Browns Ferry f f re, 5 l the Review Group concludes that the probability of disruptive fires of the magnitude of the  : i Browns Ferry event is srall, and that there is no need to restrict operation of nuclear power '

) plants for public safety. Powever, it is clear that much can and should be done to reduce even l further the likelihood of disabling fires and to improve assurance of rapid extinguishment of J

]

fires that occur. Consideration should be given also to features that would increase fur ther . i the ability of nuclear facilities to withstand large fires without loss of important functions should such fires occur. The Review Group believes that improvements, especially in the areas 4 of fire prevention and fire control, can and should be made in most existing facilit'es The Office of Nelear Reacter pegulation in its evaluation of individual plants must weigh al'.

of the factors involved in fire prevention, detection, extinguishing, and system dJsign to l

h_,n_ .m# ----t'%. m .m- . _ . . _ _,m _m a.__. 3 t..,j 1

i

.- _ - ,- .~_+ .-.

4 i l l

~

, assure that an acceptable balancing of these factors is achieved. For each plant. the actual measures to be taken will depend on the plant design and the nature of whatever in$rovement may ,

i be ed. The various alternatives available in each case should be evaluated consistent with s thes actors.

1.6 Principal Recomendations In the following subsections, the Review Group's principal recommendations are sunnarized. For -

further information regarding a recommendation, the reader is referred to the place in the body of this report where the reconnendation and its basis are discussed in detail.

As indicated in the discussions of several specific topics in this report. there is presently a notable lack of definitive criteria, codes. or standards related to fire prevention or fire protection in nuclear power plants. Likewise, the existing criteria covering separation of i redunvant control circuits and power cables need revision. The review group reconmends that development or revision of the needed standards and criteria receive a high priority. The group ,

also recomends that the regulatory guidance regarding the proper balancing of the three factors identified as defense-in-depth principles for fires in Section 1.4 of this report be augmented.

The reader should be reminded that not every reconmendation applies to every nuclear power plant. For each plant, a compreheasive evaluation sheuld be conducted using the perspective in Section 1.4 and the echelons of safety discussed therein. The design of that plant. together with its operating and emergency procedures, should be reviewed to determine whether changes are needed to achieve adequate defense in depth for fires at that facility. Each echelon of safety should be sufficiently effective; the overall safety anJ the balance among the echelons should also b* considered.

The Review Group's reconnendations can therefore be regarded to sone extent as representing i alternatives to the designer or evaluator. Other alternatives besides those recomended by the Review Group my be equally acceptable. From among the various alternatives, those appropriate and sufficient should be chosen for a given plant. For different plants. it.will quite likely be found that different choices are appropriate and sufficient.

1.6.1 Fire prevention .

The first line of defense with regard to fires is an effective fire prevention program. The Review Group's recommendations for fire prevention are discussed in detail in Sections 3.3 and 3.4 ,

An undesirable combination of a highly combustible material (not included in the design) and an unnecessary ignition source (the candle's use as a led detector) represent the specific cause of the Browns Ferry fire. Once the fire was started. other ccmbustible materials primarily I I

cable insulation and penetration sealant, enabled the fire to spread. The ease with which the fire was started and the rapid ignition of these other materials indicates a deficiency in the fire prevention provisions for Browns Ferry.

Information obtilned from licensees and from special inspecticns performed at other reactor

- sites by the NRC indicate that similar types of deficiencies also exist to some degree at other facilities. None of the facilities, however, was found to have the combination of highly com-bustible flexible foam. unfinished penetrations, and inccmplete work control procedures which existed at Browns Ferry. Several facilities had open penetrations between the cable spreading ,

room and the control roon or between the cable spreading room and othe.' plant areas. Since some ,

facilities had no reference to fire stops or penetration seals in their Safety Analysis Reports. i and since the NRC had placed no emphasis in these areas. 4Ctual conditions vary widely. NRC and I licensee programs are underway to upgrade those plants that need it.

The Seview Group recomerds that greater attention be given to fire prevention measures generally in nuclear plants. and that they should be reviewed and upgraded as appropriate in this respect. 1 Consideration snould be given to limiting the amount and nature of combustible material used in nuclear plants. to use of flame retardant coatings for combustibie nterial where appropriate.

and to the use of measures to control potential ignition sources such as opan flames or welding equipment. ,

1 In implementing this recomendation guidance in the forn of standards or Regulatory Guides is needed and shculd be developed. Such guidance must strike a reasonable balance among the factors l invohed. For example, if the fire zone approach (section 4 of this report) is used, the flama.

> bi'elty of r4terials my not have the same degree of icortance as in other designs; if small I amounts of c7bustible material are present in a given area. the need for fire retardant coatings l

l

• ~'

i .

t l

I r

l l

s n

4 s 5

. a y is reduced.

Standard qualification tests should be developed to assure that acceptable materials and configurations are used for items such as cable insulation and penetration seals. Some researth will be needed to develop improved tests to characterize the flaneability and the nature t f the products of combustion of potentially flammable materials.

L g

e The flexitle polyurethane foam that caught fire in Browns Ferry was not part of the original j design. N t wcs being used to stuff into holes to stop leaks. Recent tests have shown that

. seals containing this material are highly flammable, the Review Group recorsnends that seals

• containing this material should be removed and replaced where possible; where this is not I possible, other measures, shou 1J be taken as needed to assure safety. Other types of polyure.

thane foam. Including that used in the original Browns Ferry design. are less flessable; the potential improvement in safety from their replacement should be balanced against the potential h4Za-d of disturbing a 17rge number of cables and seals.

j 1.6.2 Fire Fiohting It must be anticipated that fires will occasionally be initiated in spite of fire prevention measures.

guished promptly.Any fire that does get started should be detected, confined in extent. and extin-Section 3.5. Discussion of the Review Graup's reconenendations in this area is given in There was smoke in the Browns Ferry spreading room, but the smoke detectors did not alarm, possibly because the normal flow of air from the spreading room to the reactor building drew the smoke of the fire away from the installed detector in the spreading room. The smoke also penetrated the control roort (through the unsealed cable entryways) but the fire detectors installed in the control room were of the ionization type w*ich did not detect the products of combustion generated by the cable fire and did not alarm. There was a great deal of srd e in the reactor area. building in the vicinity of the fire, but detectors had not been installed in that Detectors should be designed to detect the products of comtustion of the combustible materials actually or potentially present in an area and should be properly located.

The use offirewater.

in the Browns Ferry cable spreading rocn was controlled and '.stinguished without the By contrast, the fire in the reactor building was fought unsuccessfully for several hours with portable carbon dioxide and dry chemical extinguishers; however, once water was used it was put out in a few minutes.

gressive increases in the unavailability of equipment important to safety.During the long period cf burni It is obvious that the longer a fire burns. the more damage it will do. The Browns Ferry fire i shows that prompt extinguishing of a fire is, in most circumstances, also the way to limit the consequences of a fire on public safety. Fire experts consulted by the Review Group and the ,'

experience at Browns Ferry suggest that if initial atte-pts to put out a cable fire without the use of water are unsuccessful, water will be needed. Many pecole have been taught. " Don't use water on electrical fires." The Group is concerned that widespread cpinion and practice empha-site the reasons for not using water as compared to those for its prompt use. Procedures and fire training should give the use of water appropriate emphasis in the light of the feregoing considerations. .

The Review Group recommends that serious consideration te given to installing or upgrading fixed i water sprinkler systems, and to making them automatic. This is especially important in areas containing a high density of cables or other flan.nable caterials, where there is a combination I

?

of flearnable materials and redundant safety equipment or where safety equipment is located and where access for fire fighting would be difficult. Acecuate fire hoses should also be provided, 3 and access for manual fire fighting should be considered in the design and in procedures.

Capability for the control of ventilation systems to deal with fire and s oke should be provided.

but such provisions must be compatible with requirements for the containrent of radioactivity.

These provisions and requirements may not be mutually corpatible and in sone cases may be in direct conflict with each other. For example, operating ventilating blote0 to remove smoke may ,

fan the fire; the same action may also result in a release of radioactivity, eitner oirectly by ,

transport of radioactive particles with the smoke or by decreasing the effectiveness of filters whose purpose it is to aid in containing the radioactivit/. It is obvicus that some ccmpromise will be necessary and that flexibility of operation may be needed, depending on the nature of .

any event that ray occur. The pros cnd cons of each provision and requirement should be con-sidered in the development of detailed guidance.

The gases. centrol room should be protected as well, both frcn radioactivity and fecm smke or tcxic Adequate breathing apparatus and recharging e w irent should be available fce c;erators.

fire fighters, inciden t. and dan ge control crews unich may be wor,ing simultaneously during a prolonged 4

pm- - - _ _ _ _ _ .

gh M _

-- a, s eu a .M+ ws, M + **

'M' 4

, m ae , + w es %$%h b9WM " * ' '

m_ - -

i4 i

6 t i

in addition to adequate equipment design. successful fire fighting requires testing and main-tenance of the equipment and training and practice as teams under realistic conditions for the onsite and offsite personnel who must fight 'he fire. Onsite and offsite equipment should be comoatible. Eme gency plens should recognite the need for fire fighting concurrent with other activities. They should provide fer division of available personnel into preassigned, trained teams responsible for the verlous activities needed, with proper utilization of offsite fire.

fighters.

1.6.3 Provisions to Maintain !Mortant Functions in Spite of a Fire The public safety importance of a fire in a nuclear power plant arises from its potential conse-quences to the reactor core and the public. During the course of the Browns Ferry fire, numerous systems became unavailable as a result of the cable damage. By a combination of alternative switching, meual manipulation of valves. remote controls, and terJorary wiring, the opercting staff kept enough equipment operating to shut down and ccol down the reactor cores. Redundancy was avellable at all times in case additional outages had occurred.

Redundancy is introduced into system design so that one or more unavailable comoonents or sub-systems will not make the system function unavailable. The effectiveness of redundancy depends on the independence of the redundant equipment. The Browns Ferry fire induced failures of some of the redundant devices that were provided, thus negating the redundancy and falling the system.

It is now known that the independence was negated by two errors: (1) wires connecting indicator lamps in the control room to control circuits for redundant safety equipment were not separated from ecch other; the fire damaged some of these wires in such a way as to cause unavailability of the redi.ndant equipment, and (2) wires of redundant subsystems were routed in the same area in the mistaken belief (embodied in design criter'a) t t putting one set of such wires in electrical conduit (a lightweight pipe) would protect it. In the fire. the conduit got too hot and the wires in it short circuited. This caused concurrent unavailability of the redundant safety equipment. part of which was fed from failed electrical circuits in the burning trays, and the other part. fed from the failed wires in the condait.

The Review Group has concluded that existing separation and isolation criteria need improvement.

A suitable combination of electrical isolation, physical distance, barriers, resistance to l combustion and sprinkler systems should ce applied to maintain adequately effective independence of redundant safety eqJiperent, and therefore the availability of safety functions, in spite of postulated fires. Cetailed discussions of the independence of redundant subsystems, separation criteria, and other systems considerations are given in Chapter 4.

The Review Group notes that while some rathods of improving separation are practicable only on new designs, others are feasible and practical on existing plants. Examples of the latter type ,

are additten of barriers, fire-retardant coatings, and sprinkler systems. which contribute to I improvement of fire fighting as well as to maintenance of irportant functions in spite of postu- }

lated fires.

I 1.6.4 Quality Assurance . i t

I Cality assurance (QA) programs are intended to catch errors in design, construction, and opera.

tion. and to rectify such errors; QA is en essential component of defense-in-depth. Many asper J g of the Browns Ferry fire can be considered as lapses in QA. Examples are unfinished fire sten .  ;

inadequate separation of cables containirg indicator lamp circuits, testing operations with a 6 candlc. use of highly fla.vnable material to plug leaks in firs stops. and f ailure to pay U. ten. ,

tion to earlier small candle-induced fires.

The Review Group believes that the causes, course. and consequences of the Browns Ferry fire are evidence of substantial inadequacies in the Browns Ferry OA program. A revised QA program has Leen adopted by TVA; the Group has not evaluated the details cf the new progran. It shoul:f M

- evaluated in the Il-ht of experience. The Review Group notes that URC (and fortnerly AEC) licens;N review and inspection also failed to uncover these lapses in QA.

The extensive CA recuirements of the NRC are applied to systees and components designated as

• irrortant to reactor ar.d public safety. Before the Browns Ferry fire, this did not include such items as fire protection systems or sealing of penetrations in walls, floors, and other barriers aside from radioactivity containment structures. The O reutrenents cf the NRC are being revtsed consistent with increased attention to fire protection in all NRC liceesing, standards, and inspection activities.

The OA progra-s of all ruclear power pla9t Itcensees should te reviewed. QA programs in scce everating plants that are known not to cW;rn to currect stardards should be agraded ;rorptly.

The NRC resten of Itce,see QA progres sno le te correspncingly upgraced, in ;artitular to l - .- -

R' l' 1 / '

l 7 j t i

?

include explicitly fire protection. fire fighting, and provisions to maintain important functions )

in spite a fire. Detailed discus:fon of QA is given in Sections 5.1 and 5.2 fer TVA actions. ,

and Secti 6.3.2. for h:C action. '

u ,

1.6.5 Response of other Governmental Acencies l

} if the Browns Ferry fire had deve10peo into a situation where action by other governmental  :

agencies would have been required to protect people located offsite, effective action would have  !

depended on effective costuunication betweea TVA personnel and the cognizant Federal. State, and .

local govermental agencies; see the discussion in Chapter 7. In accordance with emergency i ,

plans. TVA personnel notified radiation control supervisors of the States of Alabama and Tennessee i and raaintained consnunication with them until the fire was out. These States attempted to notify '

additional agencies as indicated in their radiclogical emergency plans, even thougie a raitological '

emergency did not exist. These attempts at notification revealed that elements of the Alabama

. i plan had weaknesses. More frequent esercises and drills to check the response of goverrutental i energency organizations are needed in order to maintain an effective response posture of these

.' organtrations. The Review Group has not studied the question whether drills involving the >

general public should be instituted and has no reconnendation on this subject.

1.6.6 Reewinendations for the Nec The NRC must also consider the Browns Ferry lessons for improving its policies, procedures and criteria. The NRC is responsible for assuring the health and sat.ty of the public and the safe  !

operation of Browns Ferry and all other reactors. NRC provides this assurance of public safety through the establishment of safety standards, evaluation o'f the sefety of plants and inspection and enforcement programs. The licensee. TVA. has the responsibility for the safe  !

design. construction. and operation of its plant within the framework of the NRC regulatory  !

prog ram. If the NRC were to become too closely involved in the licensee's operations this '

i might have an adverse effect on the licensee's view of his safety responsibilities. In other words, it is the licensee's responsibility to optarate the reactor safely, and it is NRC's

. . responsibility to assure tnat he does n.

The Peview Group's evaluation of the events associated with the fire indicates that improvements I are needed in NRC licensing standards development, and inspection programs. NRC actions and '

related Raview Group recomendations are discussed in Chapter 6. The Review Group recomends that ongoing efforts to upgrade NRC programs in fire prevention and control and related QA be expanded as needed, and as reccanended elsewhere in this report, and coordinated to fonn a more coherent regulatory program in this area.

During the incident, troubles were experienced with corinunications among TVA. NRC, and other organizations. The Review Group believes that some corsnunications problems are inevitable but that improved comunications facilities are feasible and sMuld be provided. A systems study on .

comunication needs is at least as important as purcnase of new egulpmeet; both should be j undertaken. , .

Af ter the fire occurred and the initial evaluation indicated that public safety had been main.

tained. the division of responsibility within NRC between the Office of Inspection and Enforce-ment (IE) and the Office of Nuclear Reactor Regulations (NRR) resulted in an unnecessary delay Of several weeks in accomplishing a detailed technical evaluation by 'iRC of the safety of the pltnt in the post fire configuration. While the Review Group finds no evidence that there was l any ! mediate hazard during this period of time, certain aspects of the plant status were improved follcwing the detailed technical evaluation performed in May 1975. by NRR. Specifically, i the minnum crew site was increased to provide for required manual valving operations, and added I cooling sy; ten redundaney for e itical components such as the diesel generators was provided.

• The Review Group reconmends that the procedures followed by NRR and IE in evaluating the safety I of the Browns Ferry plant be revised to ersure that detailed safety review of such an occurrence ,.

will be more timely in the future.

The Review Group has consulted with cogr.itant NRC management during its review, and is aware that programs to implement recorrnendations contained in this report are being developed in several areas.

l i

1 I k I

_.....e..i,.m - ---a=*** * * - -

w

^"

(

.4 I .

I i \

2.0 INTRODUCTION

2.1 Objective and Plan of this Reoort 2.1.1 Objectiv_a i

in this evaluation of the Browns Ferry fire incident, the Special Review Group has reviewed the  ;

design and design criteria of the equipment involved, and the actions of persons and organiza-tions before, during, and after the incident. tnt objective, as stated in the Group's Charter g.

(2).*wass

" ..te review the circumstances of the incident ami to evaluate its origins'and

,, consequences from both technical and procedural viewpoints.

"The Group's review is not intended to duplicate, or substitute for. the necessary i'vestigations by the licensee and the staff of NRC I&E Region !!. Rather the Group is charged with marshalling the facts from these investigations and evaluating them to derive appropriate proposed improvements in NRC policies, procedures, and technical requirements."

In accordance with this charter. the Review Group has tried to distill from the available information those lessons that should be learned for the future. Some of these lessons apply to operating groups, others to designers. Standards developers. State and local authorities, and the NRC.

2.1.2 Plan of this Report i l

The sumary of this report is presented in Chapter 1, including the major recomendations.

Followinehe introduction of Chapter 2. Chapter 3 deals with the fire, including fire prevention  !

i and fire fighting, and also materials combustibility considerations. Chapter 4 includes systems considerations. It covers the availability and non. availability of plant subsystens during the l event, and considers criteria for the separation of redundant subsystems, including their - -

associated electrical cattes. Chapters 5. 6. and 7 deal with people's actions and procedures l-for such actions, for TVA. NRC, arJ other government bodiss, respectively.

2.2 L urces of Infomation '

t The Review Group did not attempt to duplicate other fact. finding investigations into the incident.

pather, these were used as sources of information for our evaluation, as discussed in the  !

tollowing paragraphs. This infomation was supplemented as needed from other sources.

Where information from puolished sources is essential to understanding the Review Group's l t

conclusions and recomendations. It has been briefly sumarized. Otherwise, the report relies heavily on referencing this material.- ,

The licensee. Tennessee Valley Authority. is conducting an extensive engineering and administra. I tive program related to the incident. The TVA Recovery Plan (3) includes the report of the TVA Preliminary Investigatinn Comittee, investigations into chemical. structural, and electrical de. age and a program to restore the plant to operation. The Group has obtained much useful infomation from the Recovery Plan (a much revised and expanded document now approaching 1000 pages) and from detailed supporting inforriation (4) furnished by the licensee. ,

With the issuance of its investigation Report (5), the NRC Office of Inspection and Enforcement

' completed its investigation of the proximate causes. course, and consecuences uf the fire. The conclusions and +1ndings in that report are presented in a detailed reconstruction of the events of the incident. which in turn is based on extensive witness interrogation and technical a na lys is . This constituted a principal s'urce of information for the Review Group's evaluation, t

As a rtsu ' nf the IE.Pegion 11 investigetton of the Browns Ferry fire, an enforcerent letter ws sent to TVA itemi.ing infractions, areas of concern, conclusions and findings of f acts as perceived h/ the inves.iCating team (6). TVA has replied to the letter (7). taking issue with Reproduced as Appendix

• 1 i

Y " ' ' ~ ' " -

• w- - __-_;_--___.___-

p . ~ . . . -.. ,_,,._, y ~ g

( - 6 td-I 1

9 )

t J

i N 1 some of the items and agreeing with others. A teply was sent from the Region II Office (8) f k

acknowledging one error of fact in the enforcement letter aad commenting on the TVA response to it. There are several areas where differences of opinion still exist. Some of the differences i i involve conflicting statements by different people interviewed by the investigators, some <

{

revesent philosophical differing views as to the interpretation of requirements, and some represent opposir,g .

views, 1- '

it is evident from this correspondence and from testimony presented at the JCAE hearing that differing viewpoints will persist with regard to interpretation and 0 <

philosophy, and that the conflicting statements can never be fully reconciled. The Review Group has considered these different views, and has also sought expert guidance from outside sources, in reaching the conclusions presented in this report. i  !

pj in pursuit of its licensing responsibilities. the NRC Office of Nuclear Reactor Regulation >

(NRR) formed a Task Force to evaluate the safety of the Browns Ferry reactors following the .

incident and during reconstruction and return to operation. Several rwports, technical specifica.

tion changes and safety evaluations are available (9). They sumarize referenced technical  !

information supplied by the licensee and evaluate the safSty of the ratctors in the post-fire

. configuration and during the proposed restoration or operational phase. The Review Group has j used this material as an important source of information in its study.

The licensee's Pestoration Plan is still under development and includes 35 revisions received by the time of writing (3). Much additional information regarding proposed design features I remains to be developed by TVA along with its analysis of the safety of the plant as restored.

Each step in the restoration program, and each change in plant configuration, must be authorized by the NRC. fach authorization is based on an NRC safety evaluation, which in turn depends .

primar *1y on information and analysis furnished by TVA. Future steps not yet authorized will be covered by future NRC safety evaluations.  !

After the fire, the Nuclear Energy Liability and Property Insurance Association (NEL-P!A) visited the Browns Ferry plant. This investigation report (65) and other documents (20) contain recomendations plants (20). for Browns Ferry that are also stated to be generally applicable to other NRC comments on the NEL-p!A recomendations as they apply to Browns Ferry have alreadybeenpublished(67). The Review Group has considered all of the fiEL-P!A reports and

• recomendations in its evaluation. Discussion by the Review Group of the various subjects treated by NEL PIA will be found in the appropriate sections of this report.

2.3 Scope of Review in view of the objective of the Review Group as delineated in Section 2.1, and of the wther NRC activities described in Section 2.2.. the purview of this report is limited to the lessons to  !

be learned from the Browns Ferry incident. The viewpoint is toward application of these lessons. I Where appropriate, back-fitting of operating plants is considered as well as plants under construction and those not yet designed, but these considerations are general and not specific to any single plant. In particular, while the lessons surely pertain to the Browns Ferry reactcrs, the application of these lessens to Browns Ferry, as to all specific reactors. is lef t to the tegnizant NRC organizations. The special circumstances of removing and restoring the damaged portions of the Browns Ferry plant, and the safety requirements for these operations , ,

end the redesign involved, are, as noted in Section 2.2.3, the purview of a special NRR Task Force. ,

2.4 Note on Changes with the Passane of Time i

{

The 1975/76. Group's review is necessarily based on knowledge and understanding at the time of writing--

' }

The reader must. however understand that safety technology continues to develop as new knowledge and experience is gained and that safety evaluation is a growing and evolving art.

The Browns Ferry application was originally filed on July 7.1966, and the construction permit was issued on May 10. 1967 for Units I and 2; July 31. 1968 for Unit 3. The design and the review were governed by the state of the art at that time. The coerating license review during 1970-72 used the technology of that period, modified as needed to account for the ear'ier

~

construction permit aoproval, i

Otfferences to the Group's inconclusion.

safety technology and evaluation criteria from then to now are highly significant These changes are considered in the separate discussions of each topic in Chapters 3-7 of this report. ,

It is a truism that everyone should learn from eiperience. The quantum of experience represented j in this incident has been analyzed here for thit purpose. But it is also true that hindsight vision is 20/20. Many things are now evident to the Peview Group, as a result of the incident i

, ~-

w ~ ~-, w n n ~ , ns w . - n a ~ n - - , , . -w . + - -m-.

no

d

~ ~ "~" "" ~ ~ " " - "

" T C Z,~_i* 7 ""**.*.**T "*~

n a

.l .' 2 I  !, l -

l 10 ]'

1 and its anakis, that provinusly were not evident. This is the increment in knowledge  ;

attributable to the present effort. The discussions in this report of shortcomings in people and hardw6re have been included as deemed necessary to learning the lessons. Since the gesup f believes these lessons to be useful and significant, their value is believed te outweigh any chagrin on the part of those who are criticized.

2.5 Perspective on Reactor Safety: Defense in Geoth The principal goal of the NRC, and the primary concern of the Review Group, is the assurance of ,

adeouate protection of the health and safety of the public, and the maintenance at an acceptably a low value of the risk due to nuclear power technology. This means, principally, the containment i.

of the radioactive materials, and the prevention of their release in significant quantities.  !

The provision of multiple barriers for such contalmuent, and the concept of defense-in-depth.

are the means for prtviding the needed safety assurance.

The echelons of safety enhedied in defense-in-depth can be viewed as the following:

1 High gaelity in the plant. Including design. matertsla, fabrication, installation, and operation tn-oughout plant life, with a cowprehensive quality assurance program.

Provisison'of protuthe systems to deal with off-nomal operations and failures of equirment  !

2.

that say occur.  !

3. Provision in addition, of safety systers to prevent or mitigate severe potential accidents ,

that are assumed to occur in spite of the noans employed to prevent the and the protective  !

systems provided.

J No one of these echelons of safety can be perfect, since humans are fallibie and equipment is breakable. It is their multiplicity, and the depth thus afforded, that provide the required  ;

I high degree of safety in spite of the lack of perfection in any given systes. The goal is a ,

suitable balance of the multiple echelons; increased strength, redundancy, perfomance, or I

rettatrility of one echelon can compensate in some measure for deficiencies in the others. ,

As applied to fires in nuclear power plants. defense-in-depth can be interpreted as follows?

1. Preventing fires from getting started.

2. Detecting and extinguishing quickly such fires as do get started and limiting their damage.

3. Designing the plant to minimite the effect of fires on essential functions.

At Browns Ferry, a fire did get started, and burned for several hours in spite of efforts to extinguish it. The darage to electrical cables disabled a substantial amount of core cooling equipment including all the energency core cooling system puming capability for Unit 1. In 3  :

the absence of a loss-of-coolant accident, this equipment was not needed for its intended function. 1he reactors were successfully shut down and their cores kept covered with water. I In spite of the plant damage. the burned cables and the inoperabic equipment, no radioactivity release greater than rormal occurred and the safety of the public was preserved. Thus, the i overall defense-in-depth was successful.

Given this success, why write the present repo-t? The answer is that the apparent ease with '

which the fire started, the hours that elapsed before it was out out, and the unavailability of .

redundant equipment as a result of the fire all point to serie inadequacies in each of the l

- echelons of defense. The Peview Group has poirted out the inadequacies and presented reconnenda- ,

tions for improvement, not all of which need to be applied for each reactor. A suitable cmbination should be ieplmented to achieve an adequate balance of fire protection, appropriate to the specific circumstances involved. .i The Review Grwp feels impelled to make one other observation that is peehaos beyond its purview of public safety, its fire at Browns Ferry inyt1ved principally cables 'or Unit 1 functions. f yet Unit 2 systems were in some cases affected. As a result of this Unit 1 cable fire. Unit 2 i will be out of service for most of a year and the startup of Unit 3 is likely to have been  !

delayed. 1hus, the interconnections ind intera:tions between cnf ts designed into this multi.

unit generating station resulted in unavailability of two 1100 'tw units tMt could nave teen avoided at least in part by a different desion ac;rcach. The wasted rescurces and extra power costs have no direct safety $1gnificance, but stould be con elcered by designers and operators.

.t 4

k

'_.- _ n n.-n.~ ~ - - .

- ~ ~

s - --

11 l

l l i 3.0 FlpE PREVENTION AND CONTROL I

{ ,

I In this chapter, the Review Group considers all aspects of the fire that can be divorced from j plant systems considerations, which are the subject of Chapter 4. Following a brief sumary of the fire event as it occurred (Section 3.1), the chapter treats fire prevention (Section 3.2), }'

combustidlity of materials (Section 3.3), and fire fighting (Sections 3.4 and J.5).  !

I t

3.1 Details of the Fire j l

3.1.1 Secuence of Events A report detailing the sequence of eunts associated with the fire and with operational actions required to place the Browns Ferry reactors in a safe shutdown condition has been issued by the -

NRC Office of Inspection and inforcement (5). hA has also prepared a sumery of significant i j operational events (10). l l '

The imediate cause of the fire was the ignition of polyurethane foam which was being used to l seal leaks in cable penetrations between the Unit I reactor bulliling and the cable spreading room. A candle flame was being used to detect air leakage at the renetration. When the candle was brought close to recently installed polyurethane foam, the flame was drawn into the feem by air flow through the penetration which was still leaking. A pressurs differential which is normally uaintaired between the cable spreading room and the reactor building, created a draft through the leak, thus making possible the leak detection but also fanning the fire once  ;

ignition had taken place.

Imediately after the polyurethane foam ignited, the workman who had been using the candle to '

check for leiks attempted to extinguish the fire using first a flashlight to beat out the flames, and then attempting to smother it with rags. Efforts were ther made to extinguish the fire from within the cable spreading roca using portable CO2 extinguishers, followed by attempts with portat,le dry chemical extinguishers. The fire was fought in this manner for about 15 minutes, af ter which an evacuation alarm associated with the CO2 fire-fighting syste'n sour.ded ,

in the cable spreading room. The CO2 (Cardox) system wat discharged into the cable spreading room about 12:45 to 1:00 p.m. ,

The fire started at about 12:20 p.m. CITI on March 22, 1775. At 12:35 p.m., the fire was reported to the control room of Unit 1. THs call resuHed in initiation of the fire alarm.

Additionally, announcements of the fke were made over the public address system.

By this time, it was determined that the fire had progrened throu@ the cable penetration and was burning on the reactor building side of the wall. Starde.g is..aediately af ter the fire alari was sounded, fire fighting efforts were initiated on the reactor building side of the wall, where both C07 and dry chemical extinguishers were used. Because of tne inaccessibility of the burning cables, this ef fort was sporad c and tedious. The cable trays are located about 20 to 30 feet above the floor and accessible only ti ladder. The dense smoke and limited j availability of breathing apparatus was cited by several individuals as materially hampering j fire fighting efforts. .

At 1:09 p.m., the Athens, Alabama fire department was called. At some time between about 1*00 and 1:10 p.m., fire fighting efforts in the reactor building appear to have been greatly '

reduced, with no organi2ed fire fightint, efforts being vesumed unTil about 4:30 p.m. There was reluctance to use water to fight the fire, but dry chemical and CO2 were used intemittently.

At some time between 5:30 and E:00 p.m., use of water was authorized. At about 7:00 p.m., two  ;

en, using the fire hose located near tr.e fire area, directed water on the fire.

P.ecause of diffiulty with the breathing appratus, the water hose nn221e was wedged into a position where it would continue to pour water on the fire and the men left the fire trea. At 7:15 p.m., two men returned and found no evidence of continued burning. The area .as sprayed again, and the fire was declared "out" at 7:45 p.m. .

The rentrol room was occupied throughout the event; however, there were minor problems with s oke and CO2 entering tne control roon through unsealed floor penetrations when t*e CO2 i

(

i i

1- - . . ~ - ._.& - __

_ a - -

. . . . . . _, 3 i

\

12

}

system was discharged into the cable spreading room.

3.1.2 Extent of Fire Danaat The fire originated in a cable tray penetration between the cable spreading room and the reactor building. Figure 1 shows the extent of the fire damage. Cables and raceways were 1 damaged for a distance of about five feet inside the spreading room. The major damage occurred on the reactor building side of the penetration. Visible damage was observed in the cables in a double stack of three trays south as far as a fire stop about 28 feet from the penetration and west along the double stack of five trays for a distance of about 38 feet. Cables in four vertical trays were also damaged downwards for a distance of about 10 feet.

- TVA has identified and tatulated 111 conduits. 8 conduit boxes. 26 cable trays and a total of 1611 cables routed in these trays and conduits that are damaged or assuned damage (11).

Evaluation of Temperatures Reached and Duration A program has been developad by TVA for evaluating temperature effects on structures and ccuponents. This program is described in Section Vill of the TVA Browns Ferry Recovery Plan (3). Temperatures as high as 1500*F based on concrete discoloration and melted aluminum were reached in the most intense area of the fire in the reactor building just outside the penetra.

tion. This area was roughly 10' by 8'. A second area just beyond the 1500*F area was esti-mated to have reached temperatures of about 1200*F based on melted aluminum. This area 1 &

g cluded some areas of high cable density and the ares above the burned cable trays from the top horizontal tray to an elevation (encompassing all of the evidences of melted aluminum.) within a few feet of the ceiling.

Other zones of lower temperatures were identified. All these areas are depicted in Reference *

(12). i Fire Damage to Structures and Equiceent l In the following paragraphs is suninarized the damage to the plant besides the burned cables.

An extensive TVA investigation program was undertaken to identify all dama.e. Plars have been i made to replace or repair all damaged s terial and equipment, j {

Trays and Conduits. Darage to trays and conduits includes some corrosien caused by the cor- l l rostve atmosphere created by the burnint cable jackets and insulnion. Some aluminum conduit '

l located above the burning trays was reited by the intense heat, and some cracking was noted in some of the steel conduits.

Damage to Pipino Systems. The only direct damage of pipe was the reiting of a sewed joint  :

in an air supply line which passed through the fire area. This air line .upplied s trol air to valves % the Unit 1 Reactor Water Cleanup Seminera11rer System, and tae line frto the y

reruding floor to the $tandby Gas Treatment fystem. >

i

$tructural Demace. There is no evidence of significant structural damage except to trays, tray supports. condaits. conduit supports and perhaps sore piping supports in the fire area, j

Smoke and Scott Chlorides. Extensive deposition of soot occurred on all equipmert located in .

the reactor building telow the refueling floor. It appears that no permanent damage resulted. 4 but extensive cleaning requiring disassembly of many instruments and other equipment was

) i required.

{

Following cleaning of all exposed surfaces of piping, conduit, and other Wpment, examination for evidence of da4 ge was conducted. Piping surfaces where soot or rWer deposits were noted

( ctre examined '.y d,-+ 0 metrant procedures. With the exception of call (3 and 4 inch diameter) 4 i

l uninsulateu c.roon steel piping one run of alu.:inum piping, heaing and ventilation ducts and <

copper instrur ent lines a or near De fire rene, no evidence cf ognificant chloride corrosion was found. 7n the cases mentioned, the c.aterial affected will be replaced. In the case of scme stainless steel instrument lines. an accelerated inspection program nas been established '

to determine if delayeu effects of chloride may later appear.

Wter. The>e has been no evidence of any damage resulting from water used in fighting the Tire-a h

i *

.m.-,,,.-vw.e---e--* ~ ~ ~ ~ " +

m m ,- - - m O

I

\

I 1170 I L 95 g M

t5L ROOM RM YS W -

CONTR N5TRA

- ONOUITS T2 REA CK OF YS TA

~ C2"yUCNI ES 3TRA DOU8t WALL OF

., RU CK TH i M ~ ONOUlf STA E \l 4* C FIR o ..- x~

o DOUBLE OF CE ,

4 E ' e.U \

ZONUEN 0 6) 0 oz  !

INFL L6 .

4. ,JA M(E % oWo.o AL

)#.4 GROO RU TH SPREAD IN a nT.S oD)

ON a

UI s

_M: __,

/

3" C OND Ul TS CF R

4T ~A YS

,\

AILE 2" C ICAL ~~ CK C- <

's (T

YP

"- ~~ ES TA w.

~ " _ _TICAL . __ -

i,

\

'k\.

.$2 NGL THR UWALL

'. o

=__a____

- VER YS u

\'

_2TRA

~_~ e . ""g* f*~ .!

fi

. ,.- g. -

w

y. \

- /

d C!N

1. ~

/

- BU!L - /

- =__._

k ACTOR 4

\

\

"**=,c,.s=__ ,

ITRE)

UN 593 0 . ,

=

' g' -

/,

k-;.g-(E

/

L

/

/

!VING t

RE'E CKWASH Mg BA ROO NUP K EA TAN .

e.: j CL

,, Er4%s 'Rp  ?

y /

[

• a;

/

__j

y -w-m 1

• 14 . t 4

i Damage Due to Electrical Shorts. Overloads, etc. Except for cables conduits, cable trays, and '

cable ladders, there is no evidence of significant enulprent damage to electrical equipment.  :

Randomly selected panels in several systems have been closely inspccted. Nothing abnormal has been found that would indicate overheating, arcing, or flashovers. It has been r.oted that l l

several fuses had been replaced in various panels. based on the ntsnber of old fuses found *ying '

in the bottom of the panels. It is not known how many such replacements were made before. ,

during, or immediately following the fire. In the clean-up work and retesting ' completed to date. no electrical components have failed or been found to be damaged in sch a way as to j indicate shorting or arcing had occurred.

Some items. such as molded-case circuit breakers, for which cleaning costs would be excessive. <

are being replaced. Complete inspecticn and testing during pre-mrational testing will be the final arbiter. Based on the inspections and testing completed thus far gross or extensive damage to electrical equipment is not believed to be a problem.

3.2 Criteric for Fire Prevention and Control Criterion 3 of the General Design Criteria for Nuclear Power plants (Appendix A to 10 CFR 50) reads as follows:

' Fire protection. Structures, systems and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and txplosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and fighting systems of appro-priate capacity and capability shall be provided and designed to minimize the edverse effects of fires on structures, systems, and ccaponents important to safety. Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components.'

This criterian imple: tents the defense-in-depth concept used in the design gl' nuclear power plants and discussed in Sectica 2.5. In general, a methodology that can be used in applying this concept to fires is describeJ es follows:

Prevention During the design, steps are taken to minimiae the use of combustible material where it is practical to do 50, and to protect it where it is used. During operation, the use of com-bustible materials and ignition sources is controlled by procedures.

Control, In spite of these steps to minimite the probability of a fire, it is assumed that a fire can happen. and means are provided to detect. control and extinguish a fire. This is done by providing installed fire detection systems and fire extinguishing systers of appropriate 1

capacity and capability in areas of high concer.traLion of combustible materials. difficult access, or where fire damage could have*a significant safety impact. Fire barriers are pro. l vided to limit the spread of a fire. A backup capat'ility is provided in areas of high fire risk and in the plant in general to I!mit the extent of a fire and extinguish it if other measures fail by use of ranual fire-fighting ecuiprent consisting of hoses, conrectors, nozzles and air breathing equipment by properly trained fire fignting personnel.

Limiting Cor. sequences i

Provisices are made to limit the consequences cf such a fire by providing ' solation in the form l Of barriers or suitable separaticn between redundant syste s and components provided to carry {

l out each safety function. This separation is emarceu if tre plant is divided into suitable .

l fire zones since redundant safety equipment can then be placed in separate zones. Provisions l are also race to facilitate fire fighting and Id-it the consequences of a fire by suitable I design of the ve itilation systems 50 that the sl:*ead of the fire and products of cor'bustion to  : .

Other areas of the plant is prevented. I Presently there is no regulatory guide er indsstry standard available to provide detailed guidance in now to meet the recuirements of G reaal Oesign Criterion 3. An industry standard.

ANSI N18.10, was pubitsted for trial use and co rent in Se::te-oer 190 but the cuidance given is so general that it is of limited use to the :esigner. actwithstanding its limitations. it does recJire an analysis of potential fire and eclesion hazards in order to provide a basis for the destgr. of fire protection systems.

b 4

t

, ,, a m ww

4 p._._.._____.... 3 - .- -m- -.. - - - - N w"M " Q T " WW9NEU%R pp

!N i W 15 9 X

Tc4 International Guidelines for the Fire Protection of Nuclear Power Plants (13) provides a l step-by-step appraadh to ess'Jssing the fire risk in a nuclear power plant and describes pro.

3 tective measures to be taken as a part of the fire protection of these plants. It provides the 9' best guidance available to date in this important area.

The NRC staff in April 1975 issued Section 9.5.1 of the Standard Revi?w Plar. (14). This provides for the review and evaluation of the fire potential (to be described in the appit- ~~4 cant's SAR) and an analysis of the amounts of combustibles located ansite and the effects of the hazards on safety-related equipment located nearby. ,

^)

j The Review Group concludes that more comprehensive regulatory guidance which provides fire j protection design criterin to implement the requirements of General Design Criterion 3 is y needed. A body of standarde should be developed which will present acceptable design metho-dology to be used in fulfilling specific requirements of prevention, detection, and exting-ulshing of fires at nuclear power plants.

d.

3.3 Fire Prevention i Fire prevention is discussed in Section 2.! as one of the three echelons of safety important to 5 l

defense-in-depth. The initiation of the Browns Ferry fire shows lapses in fire prevention. s The combination of the open flame on the candle and the highly flammable flexible foam used in the seal repairs had caused nany small fires prior to the large fire which fir. ally 0: curred.

Failure to take corrective action as a result of the smaller fires reveals a disregard of fire ,

dangers and points to the need for a stronger fire prevention program. j Fire prevention begins sith design and must be carried through during all phases of construc- 4 tion and operation. References (15 *S) give a history of fires in U.S. and se-e foreign a

a nuclear power plants. A substaitial fraction (14 out of 46 in the U.S.) were associated with r

{

construction or major maintenance. The Browns Ferry fire was also partly of this class.

{

Including Browns Ferry, the 32 non-construction fires in the U.:. so far in operating reactors gives an incidence rate of the order of one fire per 10 reactor years. Their consequences ranged from trivial to serious. Based on this history, 3 nuclear power plant can on the '

.I' average be expected tr. experience about three fires during its lifetime. Most of these fires will not be very seriuus* based on past experience. Fire prevention efforts are aimed at decreasing these rates. They cannot be reduced to zero. '

3.3.1 Fire Prevention in Desion Each design should include measures to avoid potential problems with areas containing a high density of combustible raterial. There should be a methodical investigation of how to limit . -

the amount of combustible material in areas containing safety-related equipment. Good practice  ! J would dictate a system for maintaining an inventory of combustible material included in the -

design in order to:

1

a. limit such material to applications where they are necessary

b. provide the bases for establishing fire zones i d, c, guide in the development of fire protection design requirements. '

j l ,

l The design of Browns Ferry incorporated crovisions for sealing the openings between najcr j

. structural divisions such as the reactor building, the cable spreading roon and the contra r l'

room. However, in the case of the Browns Ferry fire, one such seal between the cable spreadino room and the reactor building was not only ineffective in limiting the spread of the fire but  ! i was the primary cause of the fire. The lack of other seals, such as those between the cable

• l spreading room and the control room, impeded plant operation during the fire. "

There does not appear to have been an adeouate understanding of the magnitude of the potential .

hazard from the use of the flexible polyurethane in the cable seals. From coabustibility test  !

data developed af ter the Browns Ferry fire by ths Marshall Space 'clight Center using the tyces i of polyurethane material found in the Browns Ferry seal (17), it is apparent that the specified '

Flamemastic coating would have generally reduced the hazard associated with the highly fle:% l mable flexible foam. .

l l

• Based on tne T cT That one fire of the Browns Ferry severity has occurred in several hundred reactor-years to date the incidence rate of such fires 15 estimat?d at between 10-3 and 10 2 per reactor year. J

, .s .J

_ _, w.m . -.- . --

l _

_ . . - .m , _ . .

.m

, 16 l

b it does not appear that the combustibility of the densely packed cables in the reactor building adjacent to the cable spreading room was understood adequately by TVA or NRC. since cables lg serving redundant safety equipment were p?rmitted by the design in this area witnout fire-retardant coatings or sprinkler protection, and without adequate separation in the absence of 3 other protective me6sures. l a

)'

I In reviewing the overall effort for fire prevention during design the Review voupe concludes that more attention must be paid to this area. An assessment of the amount of combustible material in each safety-related area should be accomplished. An appropriate combination of the following measures should be taken where needed:

i a. Limitation or replacement of combustible material i

j f

b. use of fire retardant coating c

c. suitable barriers and seals to reduce the exposure of remaining combustible material.

For future plants. an ar.ditior:sl alternative is available: establishnent of fire zones based upon the amount of combustible material present and selection of a suitable design basis fire.

arrangwd so that adequate isolation can be provided for redundant safety-related systems and e equipment.

j 3.3.2 Ope atino Consi<lerations in Fire prevention Fire prevention during operation is a collection of actions by people to make the chance of a fire being started low. By can'.rast to the preceding discussion of design considerations, the plant design is here taken to be fixed.

{ A fire rceires a combustible material, oxygen, and an ignition source. A power plant has i pipes containing water or steam that are het enough to ignite some hydrocarbo9s. Indeed, References (1516) incit:1e a number of fires involving oil in nuclear power plants. In other i j

plant areas, there would nomally be no ignition sources. But experience indicates that the t occasional cigarette butt or electrical spark or welding torch can be present. The measures available for fire protection are therefore to minimize the combustibles under the operator's l control, to recognize the co*stibles he can't control (like cable insulation), and to main- )

tain strict control of ignition sources. These measures should be embodied in written pro-cedures. .

A fire prevention program can be looked on as a part of the plant operating quality assurance prcgram. The fire prevention procedures involve inspections (for stray combustibles), permits and precautions (for welding) and prohibitions (smoking in fire hazardous areas). They gener- -

ally involve written information (inspection reports, welding perrits) that can be audited.  !

Especially 1;nportant is the control and limitation of ocen flame: (forexample,duringwelding)  !

and the taking of adequate precautions when their use is essential.

A principal lesson of Browns Ferry is the failure of fire Irevention. The candle flame was an obvious ignition sou.ce. The foam actua'ly used is highly combustible, far more so than the material specified in the design. The small fires actually experienced did not induce a fire

,*eventive resp 3nse.

Following the Browns Ferry fire, the NRC sent out Bulletins to licen ees (18) pointing out some of these facts and calling for a re-evaluation of their fire preven' m procedures. Almost all licensees in replying cited systems of work permits and management i afew that should prevent suca obvious lapses. The Review Group, however, retains a certain saepticism. It is the  !

expe'ient.e of the group's members, and that of the experts the grou9 has talked to, borne out '

ty the tone of many of the licensee's replies to the Bulletin. that only a continuing attention  !

by the operatir' staff can achieve a satisfactory degree of fire prevention, and that many such 1 staffs remain ccmplacent about fire prevention in their plants. This complarency M s until (

recer,tly been mirrcred by the absence of fire-related matters in the NRC licensing and in- I specticn programs. That has now been partially re-adied. The Review Group believes that better regulatory guidance and greater NRC inspection attention should be directtd toward fire prevention and control in general, with particular ettention to fire prevention. This will require develornent of suitable regulatory guides and also allotment of review anc inspectier.

resources for this purpose.

0

^ ^

9 e - -- -

w -- n

17 1 3.4 Criteria for Cnmbustibility of Materials I

Most fire prevention programs deal with solvents, oils, oily rags and waste. wooden structure!. I and electric sparks. The 3rowns Ferry fire, on the other hand involved cable insulation and the seals installed around cables at wall and floor penetrations to contrei air movement and act as fire stops. The following sections deal with the combustibility of these two categories of materials. For neither application are there adequate criteria for the selection of materials or stanoardized test methods. The Review Group's recommandation must therefere be for more develoonent work on materials and testing methods and develor, ment of selection cri.

teria rather than for present adoption of a particular standardized and tested material. The ,

Review Group believes that materials less combustible than those that burned at Browns Ferry j can and snould be developed and qualified using improved standardized tests for application in '

future plants and that means are available and should be used in existing plants to decrease the combustibiliiy of present materials found to need protection.

3.4.1 Cable Insulation Criteria The Browns Ferry F5AR contains no criteria w'.ich specifically address the combustibility of the insulated cablM. The statement is made, however that the cables were telected to minimize

. excessive deterioration due to temparature humidity, and radtatien during'the design life of the plant. There were 16 basic combinations of cable construction materia s involved in the fire. A list of the cable materials is given in Table 1.

TABLE 1 CABLE MATERIAL $

insulation Materials Jacketina Materials Polyethylene Nylon Cross linked polyethylene Polyvinyl-chloride High density polyethylene . High density polyethylene Nylon backed rubber tape Polyvinyl Irradiated blend of polyolefins Aluminum foil and polyethylene Chlorosulfated polyethylene Fiberglass reinforced silicone tape Neoprene Cross-linked polyethylene

• i TVA cable specifications for polyethylene insulated and cross-linked polyethylene insulated I wire and cable require number 8 AWG and larger sizes to pass the vertical flame test found in 1 IPCEA* S-19-B1 Section 6.19.6 and number 9 AWG and smaller sizts to pass the horizontal flame }

test found in Section 6.13.2 of the same document. No flame testing was required for nylon Jacketed single conductor or multi-conductor caoles. The vertical and horizontal flame tests

}{

a in IPCEA S-19-al are single cable flame tests. I 1

At the time of the approval of the Browns Ferry design there were no specific regulatory i requirements cor.cerning the flame retardant properties of electric cables. No consensus  ;

existed as to what test should be used and exactly what could ae inferred from the test results. +

Cable flame tests found in the various stsndards at the time were single cable tests. Pre-dictions of the spread of fires in cable trays based on the results of the single cable flame .

tests were not available, ,

The NRC requirerents for flame retardancy of cables have been changed since the Browns Ferry I; safety reviews t/ the NRC. degulatory Guide 1.75 (66) endorses IEEE Standard 384-1974. "!EEE Trial Use Standard Criteria for Separation of Class IE Equipment and Circuits." IEEE 3B4-1r,74 recuires that flame retardant cable be used as a crerequisite to the applicability of the cable separation critaria specified in the standard. " flare retardant" is defined in the standard as *

" capable of preventing the propagation nf a fire beyond the area of irfluence of the energy '

source that initiated the fire." but ;EEE 384 1974 contains no further guidance for the selec-tien or testing of flame retardant cable. This is given in IEEE Standard 3?3-1974. "lEEE -

Standard for Ty:e Test for Class IE Electric Cables. Field Splices, and Cunnections for Nuclesr k!nsulated Pcwer Cable Engineers Association .

N$#'~~"'

g. .e" [*_ b _ NN $(N b NNM 'b" . M- -C dSh N 1 M h" U ~ ' * * .

a 18

-4 Power Centrating Stations," which is presently used in NRC constructfra rarmit evaluations and is under consideration for endorsement in a future Regulatory Guide. IEEE 3831974 specifies a method for testing of a vertical tray containing a number of cables to determine their relative .,

abilitytoresistfire. Unfortunately, the flame test of IEEE 383-1974 does not simulate the ,

normal csble tray installations very well. The test arrangement calls for several lengths of cable to be arranged in a single layer in the bottom of a cable tray with approximately 1/2 cable diameter spacing between the cables. By contrast typical cable trays in plants contain i several layers of cables with no space deliberately left between individual cables, j Although NRC criteria presently require cables to be " flame retardant" (but not yet specifying .

i

?ven the IEEE-383 test) and some flame tests are now available, the effect of a fire ignited in '

a typical cable tray configuration with flame retardant cable is still not well-known. Prior i to the Browns Ferry fire, NRC had signed a contract with Sandla Laboratories to perform experiments in which cables in typical cable tray configurations are ignited. but results of l this work are not yet available. * .

. Since the Browns Ferry fire, fire experts have expressed reservations similar to those dis- +

cutsed above about the adequacy of the cable configuration in the IEEE 383 cable costustibility test 9 9 320). They have also recomended that higher energy ignition sources than that specirled in IEEE 383 be used in performing flame tests. A Nuclear Energy Liability and

- Property Insurance Aspciation (NELP!A) sponsor 2d cable testing program is being conducted at Underwriters' Laboratory to determine the relative perform:nce of cables when subjected to the IEEE 383 vertical flame tests, but using 20.000. 210.000, and 400.000 Btu per hour gas burners to investigate the effect of varying the energy of the ignition source (20). Various control cable constructions will be tested vertically and horizontally in multi-tiered groups cf trays to deter'nine the effects of the ignition source intensity and cable geometry on flame propa.

gation and circuit integrity.

Reference (65) contains a recomendation that mineral insulated retal sheathed cable or equiva- i lent fire resistant cable should be used in one of the safety divisions. (For a discussion of j

" safety divisions." see Section 4.3.3.1.) The objective of the recormendation appears to be to j

, provide one safety division capable of surviving a fire that envelopes all safety divisions and j l

destroys all other safety divisions. Although this approach may have merit in particuldr~ -. +

l situations, requirement.the There Review Group are other waysqcstions of accomplishing its utilitythe and believes objective of adequate it is not divisional needed asiso-a universaP* N * -s lation. (See Sections 4.3.4.4 and 4.3.4.5). -

lN 1

Consideration of cable (and perhaps coating) materials is involved in all three components of '

defense in depth. Proper selection of cable materials can reduce the probability that a fire . .

will start. Cable ' installations of good flame retardancy characteristics will limit the i spreading of a fire and thus aid in the control of a fire. Good flare retardancy in conjunc-  ;

tion with auquate separation and isolation of redundant safety divisions is 10portant in i maintiining avialability of safety functions in the event a fire occurs. -

The Sandia and NELP!A-UL programs are efforts to fill the gap in present knowledge. The NRC l l staf' should follow these programs closely and encourage their prompt completion. If the  ;

results of these programs indicate that additional investigation is required, such investiga-tion should also proceed in a timely manner. If the results of these programs indicate that significant improvement in safety can be a;hieved by changes in existing plants, such changes should be implemented if needed. Improved criteria for flane retardancy of cables with or without flame retardant coatings should also result from these investigations, f.- -

An associated problem at Browns Ferry was the corrosive and toxic gases and dense smoke given off by burning cable mais ials. The Review Group recomends that ingestigations into flam-mability include study of the airborne products bf heating and combustion, and that these be considered in selecting cable insulation materials.

It is not possible at the present time to forsee whether new cable insulating raterials should be developed. Certainly materialf less ficmable than tnose now comonly used are available; they have drawbacks in cost. electrical and mechanical characteristics, availability, and otter properties and have not been widely used. Decisions regarding their adoption should be based on assessment of the defense-in-depth components at each plant.

l It should also be pointed out that fire retardant coating raterials are available for use with existing cable materials. They can be applied to areas in operating plants ttat might be deemed to need additional fire resistance, without the necessity for disturbing the present cables or trays. Tests of these coating materials by their manufactarers, reactor vendors and others. the results of which are now being collected and evaluated by the NRC. Indicate that m

- 'M

. u a _ mm E . $ - . a _,s a .

-- - __a i.

n

. -w - - .,,-

m_-__m____ _ _ _ _ - _ _ . __ _ _ _ . - _ . -- __ __ _ _ - _ _ _ _ _ _ _ _ _ __ _ - _ . _ . _ _ _ _ . _ . _ -. _ __ _ - _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ - _ _ _ _ _ _ _ _ - _

p 19 proper applicatten of these materials can provide considerable fire protection. The Review  ;

Group believes that judicious use of such coatings in areas of high cable density or high fire l vulnerability has the potential for significantly reducing the risk from extensive cable fires '

in operating and future reactors. It reccarnends that research ano testing be conducted as i needed to evaluate where and how such coatings can be used to decrease the cable fire hazard. ,

i 3.4.2 Criteria for Fire Stops and Seals j

The Browns Ferry FSAR provided design criteria for fire stops and seals. It states that any I openings in the floors for vertical cable trays carrying redundant cables of cable Divisions ! <

or II are to be sealed and the cables coited with a fire retardant material (Flamemastic 71 A*  ;

or equal). Likewise. openings in walls .or horizontal cable trays between buildings (reactor  ;

and control) are sealed. Although the regulatory staff was concerned with fire prevention 3 techniques, there were no regulatory requirements concerning fire stops pel Le e at the time of j

. approval of the Browns Ferry design. General Desiga Criterion 3. however. states that non- ,

combustible and heat resistant materials shall be used wherever practical throughout the unit. i particularly in the containment and the control room.

i

- The design of the cable penetration where the fire started called for a 1/2-inch thick steel plate bulkhead, slightly smaller than the dimensions of the penetration in the center of an opening in a concrete wall. Openings were cut in the bulkhead plate and steel sieeves welded into the openings. The trays stop short of the opening and only the cables extend through the wall penetration. The sleeves were to be filled with polyurethane foam after the cables were installed to limit air leakage. The design called for pouratie polyurethane foam to be applied over and around the installed cables, tfpon hardening of the pourable polybrethane foam, spray- f i able polyurethane was to be used to finish filling the sleeve. The pourable foam was specified  ! ,

because it mure completely fills the voids between the cables. A fire retardant coating.  ;

Flaremastic, was then to be applied 1/8 to 1/4 inch thick over the fcan and the cables on both ,

sides of the bulkhead for a distance of 12 inches. l  ;

TVA reported (21) on testing of a typical fire stop penetration in June 1973. and etJneluded }

fron. the results that this fire step design would provide a good Darrier. The report further  ;

stated that the Flamemastic manufacturer recomendation that the cables should be coated for 6 I to 8 feet on both sides of the penetratiosewas not valid; the one foot distance used in the  !

test was stated to be sufficient.

It is ivyortant to note the ways in which the seal that caught fire differed from the seal as designed and tested. A principal difference was the use of the flexible foam for stuffing into {

Ieaks. While sealing the penetrations, a dam was recuired in some cases to prevent the liquid -

foam from flowing out of the sleeves. One solution for this problem was the use of a flexible, i' resilient polyurethane foam (quite different in properties frcm the "polyurethane" discussed in the preceding paragraph) cut to site for insertion into the sleeve openings tn fom a dam.

Although it goes by the same "polyurethane" nane as the pour and spray foam "polyurethane." its properties are different. In particular, it is far more easily set afire and burns in a dif-ferent way. (See just below and Peference ('7)). It is not known whether a piece of the flexible material was used for a dam on the seal tested in 1973. It is known that the seal that caught fire had a hole through it (2 by 4 inches in cross section) and that a piece of the flexible foas had been stuffed into that hole. Moreover, that piece of flexible foam had.

of course, no fire retardant coating.

Another dif ference ray have been in the fire retardant coating. The Review Group has been {

unable to find out whether the seal being repaired, that is, the one that caught fire, was originally coated with Flaremastic. Sore seals at Browns Ferry were not coated in accordance . j with the design (21a). , ,

A third dif ference was that the seal that was tested did not have a pressure dif ferential across it, which would have induced drafts thrcugh any leaks. Such a pressure differential at ,

. Browns Ferry In accordance with the design of their containment, contributed to Goth the initiation and the spread of the fire.

Followirg the fire. the NRC had an independent set of tests performed on the materials found in the table penetration area. The following excerpt presents some findings from those tests (17):

• Tha FWee.1 ster OrrnotM.11120 sher-an Way, Sun Valley, California 91352 e

e, .~=ne\-

.m. -~ . -amm y.--.p, rw r --t- 1' - , - T-g ve 3 t - --q. + . , ym- --

---

w ---u' - -

m - -------* - - - - -- - - - - - - - - - - - -

i

/

-t ,

4 20 l's k .

" Experimental tests clearly verified the ease of ignition of the foam rubber stuffing by '

the candle. (In fact, actual contact with the flame is not required.) The resulting very rapid. almott flash, burning combined with release of burning droplets constitutes not '

only an intense local source of ignition but also a means of propagation of fire over a

• much larger area, leading easily to a general conflagration with other local combustible i materials. especially in an air draf t as acutally occurred. l i

" Initial cursory tests on materials collected in the cable sprender room confirmed that-readily combustible materials were in the vicinity: rags. pour foaat and cable ties.

q

" Interpretation of the ASTM test results must be done with caution. These are intended to be relative tests only and are done in a draft-free environment in a strictly empirical  ;

test procedure.

"For example, the manufacturer's claim that the "instafo.m" is "self-extinguishing" was j

. experimentally substantiated by testing in accordance with the referenced ASTM spect. ,

fication (0-1962). However, the data on both the spray and pour foam samples show that - =

the materials do very barely meet the requirements to be rated as "self-extinguishing" by this test. Specifically, the requirement is that in this horizontal test no specia. ens burn p_ast a 5-lech gauge mark from the ignited end. Inspection of the data shows burn lengths of 5". 3* and 5" for the pour foam and 5". 41/2 and 5" for the spray foam. One ,

could infer from these data that the 5-inch limit may have been derived from these type g materials, and thus the test was designed to accept such materials. The same inference l

could be dawn from the ASTM vertical burning test (D-3014) in unich a 10-inch long i specimen is specified. The data show burn lengths of 8 to 10 inches.

l "However, the lead para 'This metho1 should not be used solely to estab$raph 1sh relative of bothburning ASTM characteristics specifications states: and should no' te considered f or used as a fire hazard classification' and further therein ' Correlation with flam- 9 g C mability under use conditions is not implied.' I i

" Clearly, both materials are readily ignited, support combustion, and exposed surfaces would contribute significantly to a general conflagration.

"The data do show that the polyurethane foam rubber burns much faster than the pour or '

spray foams, and releases burning droplets. Further, these samples of pour foam burn  !

considerably faster than the spray foam. In addition, coating exposed surfaces with j Flamemastic' was extremely beneficial. In fact. coated pour and spray foam samples did not ,

burn under the test conditions."

It can be concluded frem the results of the two indepe , dent tests that Flanemastic 71 A provides considerable fire protection when utilized properly. however, more recently. TVA inferred NRC (22) that tests on a seal of the origiral design including the Flamenastic coating gave unsatisfactory results, in one such test (Test 1.2.3 - External Flame Test) an explosion occurred in the cold side of the test ballding. The explosion apparently resulted from the ignition of f!ammable gases by

• flame passing through the cable tray Seal. Additionally, there  ;

was some damage to cables on the Cold side of the seal up to approximately four feet from the t ,

seal. These cables were somewhat charred and showed evidence thst cable jackets melted. These j tests were considerably more severe than tr.e s973 TVA tests and used a much hotter ignition

• source than the candle that started the actual fire. Nevertheless. TVA has subsequently '

decided (57) to remove such polyurethane fedm seals as is practicable and to replace them with a material found by testing to be nore fire-resistant.

The Browns Ferry fire experience indicates that the materials of construction for fire stops requires close examination. This is tr e in spite of the fact that the 1973 TVA tests indicate that a properly made fire stop of the Browns Ferry desion (with Flamemastic and without flex-  ;

ible foam) would protsely not have initiated the fire (21) from the candle. The tests also  ;

indicate that even if a fire had started. a fire stop made in accordance with the original * '

design rsy n11 have prevented its spread outside of the room where it started.

~

Inspections of all c:erating nuclear gererating stations (23) revealed a nu-ber of deficiercies associated with fire steps at a nu-ber cf plants, although many plants had no deficiencies or only trivfal ones. We of the deficiencies found were:

l'. Required fire st:ps had never been installed.

2. Fire stops had teen opened to irstall additional cables and had not been repaired.

~ _ . . _ . . .- . - . . . ~ , - . . . . . - . . . - . . - - - - .a l

4

\

w- ~ m.~ ..e .- . . - ..*w..-. ~w ---. . .

, - . . , . , , ,, - , - , - - - , ,-w - - - , ,y,. w - u g-v m - .,nvnr .,e-w nvx ,,,---n-, .,ev.--,,- ,-n. , - , - ,-e-.-.n

, .w 3 . e-remsm+

M 4}

• ~

4 h .

21

% .m -

a-.~

3. grestupshadbeenimnroperlyconstructed.

4 Fire stops had been repaired with improper materials (including flamable ones).

5.

pullropes). Fire stops contained combustible materials left from construction (such as foam dams and 6.

. Fire stops had deteriorated (crumbling concre.te or shrunken and cracked coatings).

l These deficiencies are being repaired.

improved attention to fire prevention and control by both licensees and the NRC.The experience.i 5

, There are suitable materials availab!e (24-28) that are less flamable than the type of polyure-

- e thane in which Browns Ferry fire started. Tests run by one utility (24) were stated to stow that the polyurethane sfgnificant degradation.tested in their case would not burn. but blackened and charred without i <

. have different flansubility properties.This is additional indication that different types of "polyurethane" l '

• materials have not been cornpared by coninon ttsts.Unfortunately, the flamability characteristics of the  !

from promotional literature. The claims for some of the materials come i

The Review Grop recomends that a standard qualification test be developed to resolve the probleG of performance acceptable the uccertainties ofstops.

of fire flammability of fire stop materials and designs and to assure Qualification tests of the separate materials of construc-tion are needed as well as tests of the assembled fire stop, to give a measure of the performance  ;

of fire stops with deteriorated or faulty fire retardant coating. It would be preferable to t3 have the qualification testing perfomed by a qualified testing laboratory. This would not i j

only eliminate any potential conflict of interest but would also permit the testing organization ,

to develop a high level of competency in fire testing and qualification. The Review Group

{

understands that Underwriters' Laboratory and Factory Mutual Insurance Company are currently listing and approving devices and construction configurations for wall openings (20).

9 The possibility of providing fire stops at specified intervals in long cable trays has been suggested (65). Such fire stopt have the potential for further limiting the spread of a cable j tray fire and may offer a significant improvement in safety in certain installations. I A suggestion has been made that unapproved foam plastic seals be removed from existing plants i and that they be replaced with suitable items (CS).- Although this suggestion has merit, the Peview Group does not believe that this should be a blanket recomendation. Because there is a l potential for damaging safety related cables in the removal of fire stops and seals, the Review Group believes that this should be considered on a case by-case basis with the ease and safety of renovel ment considered of seal material. along with the potential improvement in safety achievable with the replace.

the vold space will be filled Realistically, with newnot all of the old materials will be removed and not all material.

to offset the inability to remove and replace existing flamable seal material.Use The improve. of a flame-retardant coating co ment would, to a degree, be a function of the original seal design. '

t j

Although tests of some fire stops containing "polyurethane" show apparently acceptable results, y tests of fire stops that contain roterial such as the flexible polyurethane foam used as dams and plugs at Browns Ferry show that they are extremely flamable. Fire stops which contain or j ;

a '

are believed to contain these types of highly combustible material should be replaced or demonstrated to be acceptable on some other basis.

q Cable penetrations are not the only places where fire seals and stops may be appropriate.

. is important that the habitability of the control room be protected in the event of a fire. It It '{

7.

is important, thereforc. that all openings in the control room be sealed to prevent the entry  ;}

of smoke or other substances that might cause evacuation to be necessary.

]

. Consideration should be given to the addition of stops and seals in existing plants where they '

can significantly reduce the probability of the spread of fire, smoke, and toxic cr corrosive gases. .

3.5 Fire Fiohtina A e

The detection, control, and extinguishing of fires that get started (in spite of fire prevention progrars) involve both equipment and people. In the following sections are discussed the Browns Ferry lessons related to fire fighting.

Q i

t t

1 e y--. , . . . - .

V'l, 22

~' ~

3.5.1 Fire Detection and Ala'rms Systems A fire must be detected before it can be fought. At Browns Ferry. the workman with the candle detected the fire innediately. The installed smoke detectors did not elarm, so there are fire detection lessons that have become evident.

Browns Ferry had smoke detectors in 7 areas inclu' ding the cable spreading room and rate-of-rise temperature detectors in other areas.

The fire started ic the cable spreading room; yet the fire detectors in the cable spreading '

room were not effective in signaling the start of the fire. It is the opinion of TVA that i because of the air pressure differertial between the cable spreading room and the reactor '

building. the flow of air drew the smoke from the fire in the cable spreading room away from

• the detectors. That there was ssoke in the cable spreading room is demonstrated by its later  !

~ displacement into the control room through the unsealed penetrations in the floor by the CO2 'I

the Cardox System when it was actuated. ,

The fire detectors installed in the control room did not alarm either. These detectors were of

, the ionization type, and did not detect the products of combustion from the burning cable insulation. / 'g There was a great deal of smoke in the reactor building in the vicinity of the fire. but detectors had not been installed in that area. ) ,

NELp!A and other fire prevention engineers are of the opinion that the effectiveness of a detector is stongly dependent on its location and the type used for a particular product of combustion. During the design of a fire detection system, assurance should be provided. ,

including testing if needed, of the compatibility of the detector at a particular location with the products of combustion that would result from a fire in the materials occupying the area where the detector is to be installed, and such adjacent areas as are appropriate.

Little regulatory guidance is available regarding fire detectors. The available draft standard 3 (Ah51-N18.10) provides little guidance. The National Fire Protection Association Standard on . <

Automatic Fire Detectors (NFPA No. 72E-1974) provides some information on the location, maintenance and testing of detectors, but the guidance is incomplete. The Review Group believes that more and better guidance should be provided preferably by a suitable standard based on I experiments with existing cables and detectors. The standard should be augmented when improved .

materials become available.

It is the recomendation of the Review Group that the fire detection systems for all plants be reviewed to assure that suitable detectors are installed at the proper locations. This review should include verification of the effectiveness of the installed detectors for fires in the materiils present. The detection systems at operating plants should be upgraded as necestery based upon this review. I Another lessor learned as a result of the Browns Terry fire is that there may be areas within other plants whien contain significant amounts of combustible material where a detection system is not provided. At Browns Ferry, the areas within the reactor building where a high density  !

of cables existed did not contain fire detection systems because these cables were net con. I sidered to be a fire hazard. Horizontal cable tray configurations were assumed to be self  ;

( extinguishing and vertical tray runs of cabling were considered to present an acceptable hazard .

l based on the assumed vertical fire propagating properties of these cables.

i 3.5.2 Design of Fire Extinguishino Systems  ;

The objective of fire extinguishing systems is to provide automatic fire protection for areas '

or equipment where it is needed and to provide adequate manually actuated fixed and portable l fire extinguishing systems for the entire plant. +

The Browns Ferry FSAR describes three f.re extinguishing systems:

, ' 1. A high pressure water system which supplies water for fixed water spray or fog systems for selected equipment and to fire hoses and hydrants throughout th* turbine building, reactor building, service building, radioactive waste building, office b.ilding, and yard.

l- Automatic ' fog systems are provided for the following:

l '

1

\ - l i

e b

__.~n.

u . ..w- - , n ~wa-- - , , ,e J , ,n. ,., n ,, g --- ..w ,m- r-

p f

23 I

a. Main turbine oil tanks

}

l b. Reactor feed pwp turbine cil tanks

[ c. Turbine head ends

d. Hydrogen seal oil units

! e. HPCI pur.p turbine oil tanks

, Automatic spray systems are provided in the service building for the carpenter shop.

, oxygen-acetylene storage room and oil storage room.

2. Low pressure carbon dioxide with manual initiation is provSded in th* following areas:

l

a. Cable spread 1rg rooms

. ab. Auxiliary instrument rooms .

c. Computer rooms l

Carbon dicxide from this system, with automatic control, is supplied to :he four diesel j generator rooms, the lube oil purification room of the turbine building, and the pat . .

shop.

3. Fire Extinguishing Portable Equipment portable extinguishees to be used on Type A. B ano C fires (as defined by NFPA Standard .

10-1967) are installed at various locations throughout the plant. The predominant type is a dry-chemical type filled wit % potassium bi-carbonate and a gas propellant. 3 Neither the FSAR nor the SER for Browns Ferry covers the basis for the selection of the types of fire extinguishing systems and the locations where these systems are installed. of considers '

the type and amount of combustible material nresent in each area.

At Browns Ferry, areas containing a high density of electrical cables did not have installed ,

water sprinkler systems. This of course included the fire :rea in the reactor building. Fire .

hoses and no221es connected to hydrants were however, available in the vicinity of the fire.

Although the f*re in the cable spreading room was controlled and extinguished without the use of water, the fire in the reactor building bar9ed on for reveral hours in spite of nut.2rous i atterpts to put it out with portable CO2 and dry chemical extinguishers. However, once water  ;

was used, it was put out in a few minutes, j  ;

I. -

The use of water to fight the fire was recomended t.y the Athens. Alabama, fire chief early  !

during the fire (32). The plant superintendent's decision to use wat.r was taken late and i reluctantly, af ter consultation with TVA management. Although TVA and drowns Ferry written

• procedures do not forbid use of water to fight fires in elect'*fcal

. cables. TVA has defended the ,

long delay in deciding to use it.  :

Replies by licensees to the NRC 3ulletir (18) have revealed a widespread reluctance to use water on a fire in electrical cables. Much fire control training includes a prohibition of '

'using water on electrical fires " .

i TVA riaintains (29) that the plant superintendent made a conscious and correct decision not to use water because of the pessibility of shorting circuits ar.d thus inducing further degradation of the plants to a condition that would nave been more difficult to control. TVA stated their s

strong opinion thut reactor safety concerns should take precedence over extinguishing a local

• fire, and that only af ter a stable plant condition had been reached srould water have been ]

used.

The Review Group agrees in principle that reactor safety comes first, but does not agree tnat this principle mitigates agair't the ute of water on cabic fires. The sequence of events in Browns Ferry shcws that the fire caused successive failures, as detailed in Reference (5). The .

initial series of failures occurred in the first half hour, up to about 1:00 p.m. At 1:15 p.m.. more coulpment became unavailable. As late as about 6:00 p.m.. remote manual control of the relief valves was lost as a result of the progression of the fire (56). greatly reducing the available redundancy.

l l

l l

t 1

. . ~ - - .~

q

, 24 lioreover, if the fire had been quickly extinguished and the smoke cleared, the efforts ko restore equiSent and make temporary repairs would probably have been successful more cuickly.

For example, the effort to manually align the RHR system valves was thwarted by the smoke from the fire. Therefore, promptly extinguishing the fire, which tne Review Group believes could have been accomplished by the earlier use of water, would not only have prevented the failurt of equipment, but would have aided in the prompt restoration of the equipment which had been disabled. ,

i Of less merit, in the Group's opinion. is the TVA argument (30) that personnel safety considena-tions also mitigated against tte use of water. A special nozzle for use on " electrical fires" was available and was finally used to put out the fire without hurting anyone (31). Whatever  ;

personnel danger was present earlier was not likely to be significantly less at 7:00 p.n.

Clearly there is a balancing of pros and cons to be made in cases like this. The Group's concern is that widespread opinion and practice emphasize the reasons for not using water as compared to those in favor of prompt water use. The Group certainly coet not intend that wster

• shall bv used immediately on all fires, and acknowledges the reasons against using water.

• Nevertheless, the Group wishes to emphasize the nee.1 for quickly putting out all fires, especia*-

ly in situations whero the unexpected 13 occurring. For this reason. in view of the Browns Ferry experience, fire procedures and fire training should include these coesiderations in the balancing of alternatives that all hazard control operations inevitably. involve.

It has already been noted (32) that the Athens fire chier was of the same opinion as the Review Group. The group has discussed this question with a variety of fire experts, who all favor the early use of water in most circumstances. The experience at Brow 9s Ferry, as well as exper; .

opinion, suggests that if initial attempts to put out a cable fire with non-water means are un-successful, water will be needed. .

Fire fighting--by all methods--was impeded by the inaccessibility of the fire site. For areas of high cable density ~or high denssty of any flammable material--fixed extinguishing systems should be installed. especially where access is difficust. Assessment of access should consider fireilghting conditions including vision impairment (smoke, lights out) and the need for wearing j breathing apparstus. Consideration should be given to making such a System automatic. which is preferred if feasible, especially where access is difficult. The arount of water to be handled {

can be minimized by .juolcious placement of sprinkler heads and using directional sprais where appropriate. l TVA has also stated (33) that the limited number of air-breathing sets available forced tne plant staff to make priority decisions to favor valve and control manipulation in the smoke.

filled area over firefighting a6tivities, and that this decision accounts for the lack of fire.

fighting in the raector building between 1:10 p.m. and 4:30 p.m. (58). The Review Group accepts this explanation, but believes it has only limited relevance to the wacer-no water question.

The Group also points out tha* this difficulty experienced at Browns Ferry is another reason for automatic initiation of firefighting systems. Putting out the fire would cut off the generation of smoke and allow use of breathing apparatus for other purposes.

In prirciple, a C02 or Halon gas system could be effective in fighting a fire in a closed space where oxygen could be excludeo. The asphyxiation nazard to personnel b greater with such a system than with water. Initiation vf the C07 system in the Browns Ferry cable spreading room was properly delayed to ensure personnel safety. This was also the stated reason for leaving the metal plates installed. preventing local manual actuation of tt.< system (see Section 3.5.5). l t

NELP!A and a number of fire protection consultants have questioned the ability of carben dioxide or dry chemicals to extinTulsh 6 deep seated cable fire. They ergue that if a means is not

. Drovided to remove the neat generated by the fire, the material will re-ignite once t'.e oxygen is readmitted to the hot corbustible material.  !

.t Due care must be exercised in the design Ed installation of water systems. There must be a  ! l drain for the water. Ecui:rtent that could be damaged by water should be chielded or relocated l elsewhere away from the fire hazard and the water. Ic is riso good practice to separate redun- { I g

d3nt equiprent so water applied to put 09t a fire in one division will not affect the others. i General Design Criterion 3 requires that fire fighticq systems be designed to assure that their [ j

, rupture or indvertent oLeration do not significantly trpair the safety capability of structures.

I systeas and components 17Crtant to safety. With the incretsed e-:phasis on the use of installed 1

wattr sprinkler systers fer the fire protectirn of electricsl tablas in *.uclear power plants. '

this specific reculcement of General Design Criterion 3 tases on ad: led sienificance. The Peview Grou; believes that guidance shuld te developed f ar the srecificatien of cuality and design requirencats in or:er to assure that installed water spr:rAler systers will have adequate integrity and reliability caring the 11fe of the plant.

{

l J

1

~

- - . . . - . . . - . - ~ - + - -

-- -- ep ----q vy-v g ,-pr-pe3 -

e W y w

m. . _ _ __ _ .__

_.. --~~-~-~ -~- w "~~~ " ~ ' '

24 25 .

For each plant, the Group recomends a detailed review of fire hazards and the instsllation or upgrading of such systems as are needed. . This assessment should be in conjunction with the review of fire prevention measures and flamability recomended in Section 3.3. The Review f Group recomends that serious consideration be given to fully automatic directional sprinkler 'f  ;'

t or spray systems in areas containing high concentrations cf combustible materials including  !

specifica1.ly cables used for safety.related equipment, and in areas where access for fire fighting would be difficult.  !

It is further recomende.1 that the design of all future plants should continue to provide for a [\t reliable high-pressure water syste:n including appropriate hoses, nozzles, and hydrants, in all areas of the plant includit1 those protected by sprinkler or spray systems.

3.5.3 htilation Systems and Smoke control At notBrowns reestablished Ferry, ventilation until 4:00 p.m. was lost at 12:45 p.m., shortly after the fire started, and was Even if venting we smoke through the installed ventilation system bility ofhad the been system.planned in the design, it would not ? ave been possible because of the inopera.

The loss of the ventilation Srstem was brought about because of loss of power to the ventilation systam and loss of power to its control subsystem. Control and power caples of a ventilation system important to fire control should not be routed through areas the system must ventilate in the event of a fire. j The RevW Group recognends that ventilation systems in all operating plants be reviewed and  !

upgraded as appropriate to a*sure their continued functior.ing if needed during a f're. It is .

i further use recomended of cutout valves or that dampers. present designs be provided with the capability of isolating fires Dy - l ,

Capability for the control of ventilatian systems to deal with fire and smoke should be provided.

but such provisions must be compatib** with requirements for the containment of radioactivity. l These provisions and requirements may r.et be matually compatible and in some cases may be in ,

I direct conflict with each other. For example, coerating ventitating blowers to remove smoke riay fan the first the same action may also result in a release of radioactivity, either directl.y, by transport of radioactive particles with the smoke or by decreasing the effectiveness of the filters provided to contain the radioactivity. . It is obvious that some compromise will be recessary and that flexibility of operation may be needed, depending on the nature of any event  ;

that may occur. The pros and cons of each provision and reouirement should be considered in the development of detailed guidance.

At Browns Ferry, there was no attempt made to Ilmit the transport of smoke to other areas of the plant by closing vent dampers and valves. After actuation of the CO <

between the conteol room and the cable spreading room had to be ph.vg.:' j smoke and CO 2 f.m the control room. Some of these openings were in the to 2stop system, the entry openings of floor of the control room at the points where the cables entered tne control room. This appears to violate the .

design provision that these cable entryways would be sealed. In the event of a serious fire ir. ,

the cable spreading room the control roce might have become uninhabitable because of smoke and j i toxic fumes. Actuation of the C03 system in the cable spreading room made the situation worse, y ,

driving the smoke into the control room. g 3 .;

3.5.4 -Fire Fightinq  ? \' >

4 Fire fighting encompasses the ability to extinguish a fire and to prevent re. ignition. The i equipment design aspects of fire fighting were discussed in the preceding section; here we 4 treat the personnel aspects. ' '

1 l

One aspect of fire fighting which is important is the access to and egress from a potentially  !

hazardous area. The emergency plans for all plants should lay out access ac.d escape routes to i

- cover the event of a fire in the reactor building and other critical areas of the plant. -

Consideration should be given in the design of future plants to providing access and escape routes for each fire zone and in particular, areas containing a potential fire hazard.

There are areas within the plant where access for the purpose of fighting fires is especially important, in particular, the cable tray area and the seals between the reactor compartment . +

and the cable tpreading room were important in the Brcwns Ferry fire. Access to the seals and

• the cable trays was extremely limited. Moreover, the design provision for centering the seals ,

1 in the wall between the cable spreading room and the reactor building was not carried out, with b e result that the seal areas were extre-ely difficult to reach from the cable spreading room. ,

After the fire had spread to the cables in the trays in the reacter building, fire fighting efforts were harpered by lack of access to the affected areas (sore 33' above the flocr) even [

though tempurary wooden ladders were available in these areas.

1 rl  ;

a .

, , . *- ~

~. .

T d*4-9NeRFr==-we e-Ny*C m-vmae yc g*wtt-eA= st Se=es' w up 4g4-ee+ r + gyr s- w seus. y- sr--nep p g

• ww .awfg' eev ses og wayp+ *ees->q' . pep r gg

• y sw~~sy agrwe', yar &1gv y er 4 g w---+ -t y e' -@JMe'- n *--r--'+

r--- _ n_ n . - n y I ,

e,-. - ~ + - -  % 1_ t 9

i 26 ' -

During the Browns Ferry fire certain pieces of onsite Wre extinguishing equipment were found to have threaded connect 1ons which were not compatible with equipment used by the Athens Firo Department. i Such a 4f tuation cov1d lead to decreased ef rectiveness of offstte fire fighting 1 units in a serious fi+e at a nuclear power plant. The I tview Group recomends that all plants should assuro compatibility of fire fighting equipment w th offsite fire fighting units which may be called'upon in an emergency.

Another 1 portant factor in fighting a fire is the equipmer?. available to support life while <

fighting the fire. At Browns Ferry the breathing apparatus capacity was not sufficient to support all reactor system manipulation, electrical repair, and needed fire fighting activities (33). The breathing apparatus available at Brown's Ferry had a design capacity of one-half hour. Even assuming a well-trained operator and goert access to the fire area, the 30-minute

- capacity of the equipment presently aparoved for toxic atmospheres causes difficulties for an operator at the scape fighting the fire (or doing anything else important) without having to leave to get another fully charged unit.

s

• There are two principal types of breathing apparatus--positive pressure and racirculating type, To date the Occupational Safety and Health Administration (OSHA) approves only the positive h -

pressure type for toxic atmospheres.

The largest positive pressure standard equipment currently anitable is rated at 30 minutes. A representative of the Montgomery County, hryland, Fire D:partment Training Academy stated that although these units are rated for 30 minutes, fire departments in general recomend limiting use to 20 minutes. If the mask does not fit properly, a considerable fraction of the air is lost, and the service Pfe may be less than 20 minutes.

1 Recirculation, or closed loop breathing apparatus is available Vth considerably larger usage life. In one such type, exhaled air, rather than exhausting to atmosphere, is recirculated through a pu*ification canister, then a metered amount of pure oxygen is added to return the air to 20% oxygen. There are three disadvantages to this type apparatus: (1) potential inleak- ,

age of toxic fumes; (2) once a canister has been activated it must be discarded, even if not {

used at all; and (3) the oxygen bottles must be returned to a supplier for recharge. The i obvious advantage is longer usage life. A second recircula* ion type uses the purification 3 conister without oxygen.

Browns Ferry personnel made limited use of the latter type of breathino apparatus, with generally acceptable results. Some individuals experienced difficulty in breathing with these units.

This or is a fairlyunder operating comon complaint, significant especially when the user is engaged in heavy physical activity stress.

Los Alamos Scientific Laboratory is doing a considerable amount of work on protective equipment for NRC. This work is directed toward the use of protective equipment in the presence of ,

airborne radioactivity. However, the typt of equipment available for use is the same, regard-less of the type of atmospheric contaminant.

The method used by TVA to recharge their t'reathing equipment (cascading method) resulted in .

excessive charging times and below capacity charges. It is recomended that all operating '

plants review and upgrade es necessary the breathing equiprent available as well as the capacity ano method of charging of breathing equipment, and that future designs include adequate recharg-ing equipment.

3.5.5 prevention and Readiness Efforts During Construction and Operation M. .

The Browns Ferry FSA2 specifically statas that no special test of the fire protection and detection system is required and that routine visual inspection of the system components.

• Instrumentation and trouble alarms is adequate to verify systen operability. This approach was

- demonstrably not adequate to assure the ccmp12te availability cf the CO2 system in the cable spreading room for this incident. During the early stage of t*e fire, the operation of this system installed in the cable spreading room was impeded and slightly delayed (59) because metal plates had been installeo over all the local control buttons in order to protect workmen

and prevent release of the CO2 during the period of Browns Ferry Unit 3 construction.

An effective licensee inspection program by persons knowledgeable in fire protection and effec-tive NRC audit of this program would have corrected this situation or, if the inhibition was necessary, everyone would have been informed and alternative procedures developed. A plan should be dn* Mad which provides for the required periodic tests and lists the responsible l

,,w.6g-4 see

' - * *

• w e- ww-- ~

W - ---y gr

_7A ~

- ~

. c

}1

~

27 t ,

individuals and their responsibilities in connection with adequate testing and inspection of these systems. The requirements for operability and testing for th* fire extinguishing systems--that is, the Limiting Conditions for Operation and the Sun.elllance Requirements--

should be included in the Technical Specifications to assure that these necessa:y systems are available and in proper working condition.

Fire extinguishing systems must be disabled at times for maintenance on the systems. In certain cases, automatic fire extinguishing systems mult be disabled to avoid risk to personnel, working in a confined area, from inadvertent actuation. In such cases, temporary measures' must be provided for fire protection in arcas covered by the disabled equipment. Such measures should include fire watches equipped with manual extinguishers, appropriate for the area protected.

standby personnel at hose stations, capability for manual restoration and/or actuation of the <

disabled system or other acceptable substitute for the temporarily disabled system. This also holds where fire seals must be breached. They should be restored promptly or, if this is not practical, adequate tempc,rary measures should be taken.

The NRC Mspection report of the Browns Ferry fire (5) contains a number of examples where the l actions taken by the plant operating staff during the fire are stated not to be indicative of a i I

high state of training of plant personnel in fire fighting operations.

l TVA has statto in reply (34) that training in fire fighting techniques was carried out prior to l the March 22 fire and that this training was effective. Since 1970, approximately 325 employees j i have attended the Fire Brigade Leader Training Course and four safsty professionals have attended 1 the Texas Firemen's Training School 6t Texas A & M yniver$1ty.  ;

While tre Review Group believes that such basic training is a necer,$ary element in effective preparation for fire fighting, such training alone does not assure smooth operation of fire ,

fighting personnel during a fire. Emergency plans chould recognize the need for fire fighting concurrent with other activities. There must be a clear understanding of the duties of the onsite personnel, with preassigned and trained teams for each needed function. The degree of dependency upcn trained onsite fire fighting personnel must be related to the availability of support personnel from professional fire fighting units (city or county fire departments.

military fire control units, etc.) or trained personnel in the licensee's organization who are available for such emergency service. In general', the onsite personnel should have sufficient trsining and practice to handle all small fires, and to contain lerger fires until the offsite units arrive. When it is deemed prudent to call in the offsite units, their capabilities should t,e used to the greatest extent possible. Pericdic drills, involving all onsite and offsite organi ations which may be expected to respond to a fire, should be held *.o enable the groups to train' as a team, permit the offsite personnel to become familiar with the plant layout, and to permit evaluation of the effectiveness of comunication among all those involved. '

These drills sha'uld include Cperations personnel, those specifically assigned to fire fighting,  ;

any offsite emergency control centers involved in the plan, and all those other organiza*. ions a that would normally respond to such emergencies.

I e

e 4

t k

A 4 l

}

..)

i p-%i -- u-

.. ,. _ _ , h n p"*"-*uW

~ __ .a . . _ _ , _ . _ -

y,(q  ? -

ls I. 1 28 '

.}

'l 4.0 SYSTDiS CONSIDERAT!0NS 1

i'

, The importance of a fire in a nuclear power station to public safety arises fm its potential '

consequences to the reactor core and the public. This importance. discussed briefly in Sections 's 2.5 and 3.5.2. is the subject of the present chapter. Systems availaoility during and after the fire is the subject of Section 4.1. The concepts of redundancy and the separation of '

redundant equipment are treated in Section 4.2. Section 4.3 treats the application of these  :

concepts to electrical power and control systems. how the Browns Ferry fire in the cables of ',

, these systems led to the failures experienced, and the lessons to be learned. Section 4.4 discusses the relatcd subject of instrumentation needed during an event such as a fire.

4.1 Availability of Systems bring the Evert 1 The detailed history of availability of system as a function of time during and citer the fire isgiveninReference(35).

During the course of the fire, numerous instruments and other equipment gave indications of I unavailability. Restoration to service was accomplished in some cases by alternate switching. l i

and in some cases by installation of temporary cabling. both during and after the fire, it ' i very difficult, therefore, to establish with accuracy which aquipnent was serviceable at what  !

time. It is known that power was lost to all Unit 1 Emergency Core Cooling System (ECCS) equipment. including valve and pump mctor controls. Addittor. ally, many instrument, alarm, and indicating circuits were affected by short circuits and grounds when the fire burned the insulation off their cables. creating false and conflicting indications of equignent operatien.

i ,

Starting about 12:40 p.m. or about 5 minutes after the first notification about the fire to the l control room, alarms began to be received on the Unit I control panel that contains the con. d trols and instrumentation (cr much of the ECCS. Comparison between the indicatters (alarms) i revealed discrepancies. For example, one panel indicated all the ECCS pumps were coerating, ,

whereas another indicated normal reactor parameters with no need for such emergency operation. -

Intermit *'nt and apparently spurious alaming continued at a lesser rate. At 12:51 p.m.. the recirculadng pumps tripped and the operator manually scramed the reactor, that is, inserted a the control rods to shut off the power generation. Control rod position indication was still 'q operating at this time, and all rods were verified to be fully inserted. '

The Unit 1 scram was initiated af ter many spurious alarms; the reacter power had by this tire decreased from 1100 MWe to almost 700 MWe due to a decrease in recirculating pump speed from W cause unknown to the operator. The Unit 2 reactor was scramed at 1:00 p.m., ten minutes af ter Unit 1 was scraerned and after spurious alarms had occurred on Unit 2. j 1

At the time, the operators did not know the extent of the fire and its location was only gen. ,

erally defined. The operators did verify that there was no imediate threat to the safety of a tne reactors, but that the fire was affecting the emergency core cooling systems. } j The operators did not appear to have any specific conditiens in mind which would require the  !

reactort to be scramed. In fact, the reactors were scramed only after the spurious signals had essentially preventeo further operatic %

The Review Group recognizes that no hard and fast rules can be laid dcwn in adverce covering ,

all possible contingencies, because of the enormus number of possible corbinaticns of events. 1 In fact. this is one argu ent for the need to have highly trained c:erators. Although scram is J automatically initiated #ce most of the potentially hazardous conditiens foreseen by the designers. the conditions at Browns Ferry were obviously not anticisated. This will t,e the case for -any events. The operator has a dif ficult decision t) rake t,nder these coMitions.

He must Psve a certain amunt of reluctance to initiate a scram or *e would scran the reactor needless 1/ every time an off.noru l signal was indicated. Then again, one of his i+portant

• functices is to initiate e scram in situations that have not been a9ticipated by the designer ar.d rewire the operator's thought and aM f on.

All this efng the case, the time it took t'.e cDerators tc scram is not unexpected. In fact, the reg;1 story staff has generally apNied a " rule-of-tnumb" to coerator actions: The desigi does not require operaters tn respond in less than ten minutes. A;to atic controls are required ' <

d i

e--- "

m..ww--- ,4 we - +

- a,pu- - wm - - - - ~ - - - - , n.

7

'i J

s if the reouf red response time is less than ten minutes. The events at Browr.s Ferry seem to contirt that operators need a significant amount of time to receive infonaation, evaluate its significance, e.ake a decision, and put the decision foto action. The Review Group has no recennendation to make in this area. This discussion is included in the report because of

• earlier criticism by others of the reactor's operators (62); the Review Group does net join in this criticism. -

Normal cooldown was interrupted when the main steam line isolation valves closed on Unit I less than fifteen minutes af ter scram and on Unit 2 less than ten minutes af ter scram. Although .

Isolated from the main condenser, the plants could remain at operating pressure, but Zero puwer, by using the standby Reactor Core Isolation Cooling System (RCIC) provided for this situation. Each unit has a steam driven centrifugal pump which injects water into the reactor to matntain water level. Eleven relief valves are available to contrc1 the reactor pressure by venting steam from the reactor to the suppression pool. The relief valves are self actuating on high steam pressure, but can also be poetanatically actuated with manual control from the

' control room. This RCIC syste;a requires only d.c control power, which is supplied from the energency power system. The system can operate several hours by itself before the water ir the suppression pool would get too hot; normally, a pool cooling system dumps the energy and the RCIC can then cool the reactor indefinitely.

Operation of the RCIC system was initiated on Untt 2, but the system on Unit I was disabled by the fire. The Unit 1 RCIC had started automatically earlier, but was not needed then and was l shutdown. When required later it could not be restarted, because of power failure to the ,

isolation valve in the RCIC steam line which prevented opening it to admit reactor steam to the ,

Pf!C turbine. However, the RCIC can also ba driven by steam from the plant auxiliary boiler. .

The system is not normally connected to the boiler and this connection must be accomplished by inserting a special piece of pipe (spool piece) between the RCIC turbine steam admission line and the auxiliary boiler. The piece of pipe had been used for startup tests and was available to bolt on in an hour or less. With this capability in mind, the operators started the auxil- (

tary boiler, ano it was ready for use by 1:30 p.m. (36). However, the spool piece was not  ? _

installed as discussed later.

The High Pressure Coolant injection System (HPCI) is similar to the RCIC but nas a larger steam  ; 4 turbine driven purr.p. and is a part of the CCCS. The HPCI systems in Units ! and 2 were disabled i f by fire damage to control cables. (

Both units also have auxiliary systems, which as a necessary part of their normal function can

{

y,'g prcvide water and thus cooling to the core when the reactor is at cny pressure. These systems

• include the Control Rod Drive (CRO) pumps and the Standby Liquid Control (SLC) Pumps. These -

systems can be supplied with electrical power from the diesel generators through the emergency buses as well as from offsite power. f $

At 1:30 p.m., forty minutes af ter scram, an operator stated that he knew that the Unit I reactor water level could not be maintained with the CR0 pump then operating and that the only other available pumps could not inject water into the reactor at reactor pressures above 350 j

j psig. After realigning the necessary valves in the feedwater train, and determining that two -

of the three condensate pumps and one of the three condensate booster pumps were running, the .

four Unit I relief valves that could be manually operated from the control room were opened and e the steam released to IWer the reactor pressure. During the blowdown the water level dropped , d to about 48 inches above the top of the core and then began to rise as the pressure fell below  %

. 353 psig. and the condensate booster p ro started injecting water into the reactor. Within two j nours af ter scram, conditions in Unit I had stabillied with water level F.aintained with a 1 condensate boaster pump and steas. vcated to the suppression pool through the manually actuated relief valves. "Y

- ) i Unit 2 during this period following scram was under control, using the PCIC to maintain water *3' level and ventfrg steam through the relief valves even though tranual operation of these valves was lost for nearly an hour. However, one hour af ter scram (2:10 p.m.), a relief valve appar. j eitly stuck oper. and the reactor pressure began to fall. The operatcrs then decided to con. t tinue to depressurize the reactor, with tne water level being ratntaineo with a condensate tcoster pump as in Unit 1.

b Although the conditinn of both reactors was stable at this time (3:00 p.m.), two hour, after . T I

stra , ceither reactor was in the normal long term shutdown cooling reds. The Unit 1 reactor "

was venting steam to its sucpression pool, which contains over a nillica gallens of water.

Tre Unit 2 reactor was venting steam to its main condenser and cooling ui its suporession cool i b

! . a

.-,_-m.ww. ~ w... - -----~w

l 30 had been established while the reactor was being blown down (2:30 p.m.).

however, was to establish both reactor and sappression pool normal shutdown cooling en bothThe operato reactors using the Residual Heat Removal (RHR) systems.

The Unit 1 suppression pool cooling using the RHR system was established twelve hours after scram (1:30 a.m. March 23) and normal Unit I reactor shutdown cooling using the RHR system was established 15 hoars af ter scram (4:10 a.m. March 23).

The Unit 2 suppression pool cooling using the RHR :ystem was, as noted previously, established one-half hour (1:30 p.m.) after scram while the reacter was still being blown down. The Unit 2 reactor shutdown cooling using the RHR system was established nine hoe p.m.). after scram (10:45 4.1.1 Redundancy of Reactor Core tuolino Quipment Reference reactor core (35) givesand during a detailed analysis after the of' cooling capability and redundancy for the Unit I fire. The periods of significant concern were before the reactor was depressurized at 1:30 p.m. and between 6:

was lost to open the relief valves to reduce the reactor pressure and utilize the redundant> 00 p.m. an low pressure pumps to add reactor' water.

The rate cf water addition needed d~ creases as the reactor core decay heat decreases with time.

The decay water must be heat putboils in tothe water replace it. in the core, and as the steam generated leaves the reactor, Before the Unit I relief valves were opened at 1:30 p.m. to depressurize the reactor, ad after 6:00 p.m.. when the relief valves could not be opened. the steam generated in the reactor core caused the reactor pressure to rise slowly. When the pressure was above 350 psi the condensate water l'nto the reactor.b aster pump, although operable. c.ould not pump at such a high pressure and so co water as the pressure rose.That lef t a single CR0 pump injecting somewhat more than 100 gpm of At high reactor pressure, the automatic mkeup is norir. ally provided by the feedwater system backeo up with either the steam driven HPCI or RCIC systers.

RCIC were available folicwing their anneeded operation at the Gart of the fire.On Unit 1. neither the HPCI or Besides the CR0 1rp on Unit 1. other installed sources of high pressure rakeup were the CRD purip on Unit 2. a shared spare CR0 pu p and standby licsid control (SLC) hmps.

while performing their nor tal functions associated with the control rod drive syste . alsoThe CRD pumps.

provide water to the vessel at high or low pressure. One CRD pump per un t is norrally in operation and the pump for Unit 1 operated continuously throughout the course of the incident.

In Addition the SLC p:aps are each capable of providing approximately 56 gpm of water at pressures up to re:ctcr coolant system design pressure.

backup reactivity shutdown system since the control rods functionedAn normally.De analysis of SLC pumps we*e not re the available evidence suggests that there was a period of up to shree hoJrs following the initiation of the fire during which the SLC pumps were not available due to inss of powert houver, the power for at least one pump is known to have been available at 000 p.m.. and the other either was easily available or could have been made available, if needed, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, t

l The pumps.CR0 pump in operat'on was part of a system for Units 1 and 2 which consisted of three CRD

One pump normally operates for each unit and the third pump can be used en either unit.

t Subsequent align the Unit 2 examination pumo to provide of the actus) water piping to Unit 1. configuration confirred that it is also cossible to CR0 pump by valving in a puro test bypass line which provides an additforal It is flow path.Means also ex estimated that by opening this single valve it would have been possiole to nave provioed sufficient the incident.water, approximately 225 gpm. to raintain the core covered througnout the course of

. No other systems would have beee required to provide water to raintain an adequste neces sa ry. inventory of water in the reactor vessel and depressurization weuld not have been addi* tonal CR0 ;urs.This flow (225 som) could have been increased to in excess of 300 spm with an t ,

l An addtional fire damage wassource the Unitof1 hig5 RCIC pressure system. water rentioned prev m1y as being unaallable due to It would have been canable of providing sufficient flow (fCC gom) for raktJo water re:uirements throughout the entire course of the incident if the decisico had been to 9ake it available It appears that this .ystem could have been mace availabl.s .

decision. witOn an hour af ter raking this The source of ste3m for the RCIC system would have been the aut 11ary boiler wnich h ,

l 3 l _ _ . _ , . _ . . - - - - - ~ - ~ ~ '

l

l I

)

l

/

31 1

was used for testing the RCic prior- to plant operatten. T c procedures are necessary to provide the steam path. First. the auxiliary boiler evsL be put into cperation. Full steam '

pressure from this source can bw obtained in less than one to r. The operators actually put '

the auxiliary boiler into operation by 1:30 p.m. (36), and it was available during the time the relief valv s could not be opened. The second procedure is tiie installation of a piping piece l j

to make up the flow path from the auxiliary boiler to the RCIC turbine. This could have been  ;

accomplished in less than one hour. The operation of the RCIC would then have been possible from the backup control room; however, the system was not actuated. Instead. the action to g

restore relief valve operability was accomplished in approximately 3-1/2 hours following which a time the reactor vessel pressure was once again reduced within the capability of the condensate i 3 booster pump to inject water. .

l

• There were other courses of action which might have been taken by the operatc* in the event l that remote manual operability of the relief valves was lost. No inuradiate proUem existed since the pressure would have increased un to the setpoints of the relief valves in their j i  ;

overpressure protection mode with subsequent steam relief to the suppression pool. The CRD l

• pump was providing a source of makeup water. With the auch reduced decay feat. con *iderable I 1 time was available for other operator action: two hours at 1:30 p.m.; at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> at 6:00 p.m. l The alternative sources of high pressure makeup water were still available if control air to the relief valvos could not be reestablished.

Calculations hewever, indicate (35) that after 7:00 p.m. no augmentation of CRD pep flow was i

necessary to maintain the plant in a safe condition. This is stue to the availability of a depressurization and heat removal path via tie Q in stess lire m in valves to the condenser.

Both of these valves were inoperable by electrical mears 4s a <*4 ult of fire damage. The i

operators, however, decided to return draining capability to the main steam line and this was achieved at approximately 7:00 p.m. It is calculated trat the quantity of steam being removed from the pressure vessel through the main steam drain line was great enough that the reactor pressure would have leveled off at a safe value prior to reeching the relief valve setpoint.

An equilibrium condition would then have been maintained with the reduced reactor pressure reducing the head on the operating CRD pump such that the pump would provide sufficient makeup , .

flow to maintain the core covered throughout the remainder of the incident. ~

4.1.2 Role of Nomal Cooling Systems By ccetrast to the safety systems provided to cool the reac'.or cere in a postulated accident, the systems used to cool the reactor in normal operation are not required to meet safety '

criteria. Components of these systems-CR0 pumps, condensate and condensate booster N95 and asiociated valves--were used successfully to cool the reactor during and following the Browns Ferry fire. Redundant safety systems designed to cool the reactor in the event of failure of the normal systems became unavailable as a result of the fire. (See Section 4.3.1 for details). j The survival of normal cooling systems when safety systees failed seems to have been the -

result of the particular location of the fire rather than diffe:ences in their design criteria.

The fact tt.at normal cooling systems kept the reactor cooled and safe during and following the Browns Ferry fire, leads one to consider whether they should be designated as safety-related systems. The most obvious question to ask is whether safety criteria should be applies to some or all of the normal cooling sy stems. In general, the st-der of systens and components 6 required to meet safety criteria la feliberately limited in number. It is generally believed -

that a safer design results when an intensive safety Osign effort can thus be concentrated on I these relatively few devices.  :

1 The number of systems and coeponents designed to safety criteria would considerably increase if I nomal cooling systems were so designes. The flexibility of the designer to design the most ef ficient and economical systems for power generation would probably be limited. It is possible that if nomal cooling systers were recaired to meet safe *y requirenents. designers might have a tendency tc reduce the attention given to the safety systees which back up the normal cooling i systems. Normal cooling systems tend to be large high ca:acity systeas, and the cost of upgrading their designs to meet safety criteria would, therefore, tend to be large. The k view Group believes that the increased cost of designing nor al cooling systems to safety criteria ,

would not be balanced by :. large increase in safety. Tae :eview Group has tnerefore, cen-c!vded that upgrading nor*al cooling syste-s to meet safety criteria is not reovired and is not .

necessarily desirable. Any recuired leprovements in safety can be accorolished more ef fec. -

tively and at less :ost in other areas.

De independence of the normal cooling systems from the syste-s that could cool the reactor in the event of failure of the norN1 Cooling systems failed s*ould be considered. In particular.

• g .g :

• a ' , a e

• ""ggdWh N **M M b# ' -

~'

-- ~ '~

_ _ _ _ ~- -

~ a,-,

y ---

+ - - - -- ee v -- ,, w -- - * . , -+,-er - - t--> - s - -w. y

. m 32 -

i-y i the safety systems provided to cool the reactor should be located and protected so as not to be af fected by fires (or other events) that could make the normal cooling systems unavailable.

4.2 Redundancy and Separation - General Considerations l

4 Redundancy is a design feature universally employed in systems that perform safety functions in ' i nuclear power plants. It is defined as the provision of more than one component or subsystem, , )

arranged so that the system function is not halted upon the failure of a single component or {

subsystem. The multiple devices are said to be redundant devices, and the " single failure criterion" is used to govern the system design.

}

. The reason for employing redundancy is the need for highly reliable safety functions in the real world of pumps. valves, and other components known to be subject to failures. Perfect components are unattainable. Improvements in the reliability of components can be achieved for a cost, but there is a practical limit on what can be accomplished in this way. Given reasonably e reliable components, redundacey is generally far more effective in achieving highly reliable systems than further efforts toward improvements in component reliability.

{

The large improvement predicted in system reliability as a consequence of redundancy is, I however, contingent on the independence of any failure affecting the redundant elements. That }

15. the beneff ts of redundancy would be negated for any type of event that would induce con- f current failures in more than or,e of the redundant devices. Such events are called " common >

mode failures." They can arise in various ways, the most obvious of which are the following: 1 l

1. An adverse " environment" af fects the redundant devices-fire, flooding with water, high or low temperatures, ear:hquake.

i j

i

2. An auxiliary function or device necessary to operation fails and the failure affects the i redundant devlces--electric power. lubrication, cooling. I j

3. A human action or series of actions affects the redundant devices ~adjusNent, manipulation of controls, sabotage. 1 The Browns r erry fire induced common-mode failures of redundant core cooling subsystems. The  ;

damage to power and control cables by the fire caused the equipment served by these cables to '

I become unavailable for cooling the reactor core. Even during the fire. availability cf some I i eoulpment was restored. by switching actions to avoid using the damaged cables and by running l  ?

new wires to essential equipment via routes cway from the fire.

• j i i One design feature which can and did lessen the operational consequences of the comen mode

• failures in the Browns Ferry electrical system was the capability to operate equiprent manually, principally valves, using handwheels. By contrast. the inability of the operators to open manually the (single, non-redundant) air supply valve af ter it f ailed closed contributed to the '

long inoperability time of the relief valves. The air supply was made operable and relief  ;

valve operation restored by temporarily bypassing the air around the supply valve with some  !

cepper tubing. As a result of this experience. TVA is now providing the caoability to coen 6 most fluid lines manually, in the case of the air supply for the relief valves by the addition 4 cf a manual valve in parallel with the solenoid operated air supply valve. The Deview Group i  ;

recomends that in general the capability to manipulate valves manually be a design censideration , l In all plants. The operability of this manual capability sSuuld be periodically checked to l

assure that such valves arc manually operable and handwheels are not missing.

The Browns Ferry designers did not intend their design to be vulnerable to common mode failures; l the results were unexpected and contributed to the dif ficulties experienced during the event.

( In the following sections, these conon mode failures are examined for the lessons that can be .

l , learned from them. ,

It should be pointed out that isolation of redundant safety devices and their cables is an +

ideal not fully achievable in real life. The goal of.Isolatica and sep6 rat'on requirements is I that an adeouate degree of isolation be provided. 'he control room and the c3ble spreading j roon have already been toentified as areas where iselation is difficult. Others are inside the i centainnent in the vicinity of the reactor, and ir. the main electrical switchyard. The I redundant subsystems and their cables are associated with a single reactor, a single contain- l

ment. a single turbine. generator, and a single control room. As witii other echelons of safety. '

perfection is neither recuired nor achievable, and the safety goal is a balanced defense-in-deptn rather than perfect isolation and separation.

l i

I l

__ .n u_ _ ..-Y_~=..----- -

-- - A

- +-.

- . , . . , w -n.,3 y

r,  !

33 l TABLE 2 AS$1GNMENT OF DAMAGED CABLES TJ REDUNDANT DIVISIONS J Plant Usage Number Safety Classification Channel or Division

• I l

Comon 20 Engineered Safeguard - ECCS I Units !-!!-!!!

20 Engineered Safeguard - ECCS  !!

! 13 Engineered Safeguard - Diesel A IA 33 Engineered Safeguard - Diesel C  !!C 5 Engineered Safeguard - Diesel D  !!D 7 Load Shedding - Diesel A A1 9 Load Shedding - Diesel C B1 7 Support Auxillaries - Electrical IE

. Subtotal 114 Unit 1 6 Engineered Safeguard - ECCS  !

182 Engineered Safeguard - ECCS  !!

4 Load Shedding - Diesel A A1 5 Load Shedding - Diesel C B1 1 Load Shedding - Diesel D B2 52 Neutron Ponitoring (also activates RPS) IA 52 Neutron Ponitoring " " "

18 52 Neutron lionitoring " "

!!A 52 Neutron Ponitoring " *

!!B 14 Primary Containment Isolation  !

39 Primary Containment Isolation  !!

2 Reactor Protection (control rod scram) IA 2 Reactor Protectior. !B 2 Reactor Protection  !!A 2 Reactor Protection " "

!!B 3 Reactor Protection "

I!!B 12 Supporting Auxiliaries - Electrical IE Subtotal 482 Unit 2 15 Engineered Safeguard - ECCS I 3 Engineered Safeguard - ECCS  !!

(, 4 Supporting Auxiliaries - Electrical IE Subtotal 22 Unit 3 4 Engineered Safeguards - ECCS I I

{}

3 Engineered Safeguards - ECCS  !!

3 Supporting Auxiliaries - Electrical IE g

Subtotal 10 j

. TOTAL 628 3

t

• See Legend (following page) for channel or division definitions.  ! i

\.

e e

r Q

1

_ -- --. -- " ^ -

1 i

'~"

. . - _ _ _ . . . . . ~ -

r y r y . ~

us .--

~._ a ~ . ..-. -. -. . ~ .- _ . ~. . - -. .- - . .

1 34 '

TABLE 2 - LEGEkD l I

The following apply to all cables: '

! I Division I engineering safeguard or Primary Containment Isolation cables ,

Division 11 engineering safcguard or' Primary Containment Isolation cables IA -

DieselgeneratorAshutdownlogiccables.(mayberoutedin cable tray with Division I cables)

IB -

Diesel generator B shutdown logic (routed in conduit) '

IE -

Supporting auxiliaries needed for safe shutdown of plant '

i

!!C -

Diesel generator C shutdown lot t ic'(may be routed in cable tray '

with Division 11 cables) '

!!D -

Diesel generator D shutdown logic cables (routed in conduit) '

l The following apply to Lead Shedding Cables: '

Al -

480V load shedding logic channel A1: (routed with IA-Diesel '

A)

A2 -

480V load shedding logic channel A2: (routed with IB Diesel B) 81 -

480V load shedding logic channel 81: (routed with IIC-Diesel C) 82 -

~ ' 480V-load shedding-logic channel B2: (Routed with !! M iesel '

D) 9 The following apply to Reactor Protection and fleutron Monitoring caliles:

IA - RPS logic chancel Al IIA - RPS logic channel A2 IB - RPS logic channel B1

,  !!B -

RPS logic channel B2 The following apply to Peactor Protection cables:

,  !!!A - RPS manual and back-up scram solenoid channel A

!!!B - RPS manual and back up scram solenoid channel B A -

i 1207 a-c RPS cndenets A1, A2, and A3 supply (RPS '4G set A)

B -

120V a-c RPS channels 61, 62, and 83 supply (RPS MG et B) t e

v

-l__

% %w,. .. .-.e e.,- s ka we e .ae'as*- de*'--" * * * * " ' ' #

eg gmg.,n * *

~ - _. -

1 l

. r.m 35 9

4.3 Separation of Redundant Electric Circuits 4.3.1 Comon Mode Failures Caused by the Fire '

The chronicle of the Browns Ferry fire includes many examples of unavailability of redundant equipment. Evidently the independence prcvided between redundant subsystems and equipment was not sufficient to protect against comon mode failures. Therefore, although the system function--

cooling the reactor core--was in fact successful (see Section 4.1.1). the multiple unavail-abilities need investigatin .

Reference '17) contains a detailed accounting of the cables damaged by the fire. A sumary listing is given here in Table 2, which is taken from Reference (37).

Separation of redundant subsyst' ems is accomplished by dividing the safety equipment into redun-

. dant divisions. As can be seen from Table 2, on Browns Ferry the engineered safeguards are in two divisions, the reactor protection instrumentation is four. Power sources are also sepa-rated into divisions. The distribution of power sources and essential equipment (power loads) is arranged so that no failure of a single divison can interrupt essential functions.

The Browns Ferry design was intended to embody the principles of separated redundant divisions.

Yet Table 2 makn it obvious that the fire damaged cables belonging to both major divisions, thereby inducing comon iaode failures. This is torne out by the chronology (35) wherein it is recorded that redundant subsystems were unavailable. Some of the more notable exampiss for Unit 1 are sumarized in Table 3. In addition many redundant instruments were inoperative, including all res sor neutron monitoring.

TABLE 3 UNIT 1 REDUNWIT SUBSYSTEM NOT AVAILABLE System Number of Subsystems ,

Core Spray 2 Residual Heat 2 Relief Valves, Removal 11(4 restored)

HighPressureCoolantinjectiog a y ,

} ,

i Reactor Core Isolation Cooling 1 Standby Liquid Control '

2 This result is surprising in view cf the redundancy and separation that were part of the plant design basis. TVA has conducted an extensive review of the reasons for these inoperable i multiple redundant subsystems (37). The two principal causes of the comon-mode failures that occurred are discussed in the followir1 sections. Tney are (1) feedback through indicator light connections, and (2) proximity of conduit to cable trays. Following technical discussions of these two principal causes, a survey of separation criteria is given along with recomenda-tion for leprovement. i 1

l 4.3.2 Common Mode Failures Attr6 table t: Indicator Licht Connections Equipment status indicators are essential to corract operation. The operator must have avail- '

]

able to him enough information to assess the status of his plant and to supervise its operation. i I A complex installation like a Browns Ferry unit--like any nuclear power unit--contains dozens j of systems and hundreds of devices. Tre arrangement of indicators and controls must facilitate t supervision of the operation by one or two people. The indicators are grouped and arranged to j enhance visual comprehension of the information patterns likely to be important. .

I c

Lights are used extensively to indicate the status of etuipment. Their small site and easy .

recognition when lit comend them to 16e designer and operator. The Browns Ferry control i panels, like most panels of tneir tyce, are liberally provided with them. One use of such lights is to monitor the status of the olant's electric power syste. This is especially important during off-normal operation, and should have been helpful during the fire. Unfortu- +

nately, the damaged cables included tee wires leading from the various power distribution panels to the indicator lights that were supposed to tell the cperator where he could find power available for important systems. Additional da aged cables connected other indicator lights to tne control cubicles for motor-operated valves.

l

• 1 a

l For supplying water with the reactor at high pressure, these systems are redundant alternatives; the relief valves must be coupled with low-pressure nmping. ,

4

- - . . t

- . . l.

- - - - - ~

..,_y ,,,,,,,.. a .. _r m. .e.W- * * 'eg--

n - .- - . . - ~ _ _ . --. .--

.l l7 l

" { ,

It is indeed ironic that provision of indicator. lights to aid the operator in doing the correct thing during an emergency led to unavailab'lity o' multiple redundant devices. The light i h

circuits were thought to be isolated from the Awar sources and safety circuits by series 3 resistors. These resistors were ineffective because the cirreit designers did not consider the i types of short circuits that actually occurrel during the bre. When the cable insulation had -  :

burned away, the resulting short circ 9its among the wires N the trays fed power backwards from I the lights toward the power and contrM panels in spite of the series resistors, causing .

breaker trip coils to remain energizeo thereby keeping breakers open. Tripping the breakers removed power frees safety eculpment and made normal breaker control impossible. This was discovered during the first stee power and control circuits were restored by physically dis-

• connecting the light cirevits at the control or power panel, then replacing blown fuses and realigning t*1pped breakert (3). This operation had in many cases to be carried out in dense smoke by a craf tsman wearbf breathing apparatus, while the panel he worked on was energized by n'ormal power and l'y the short circuits.

~

Because these circuits were not recognized as potential sources of failure of safety equipment. i their cables were not separated into divisions and segregated away from non-safety cables.

Rather. they were treated as non safety cables whose routing and tray companions were of no moment. Therefere, when failures occurred, there was no divisional separation and the equip.

ment unavailability thus induced was not confined to one division in accordance with the plant design objectives.

Today there are better criteria for this type of circuit (see Section 4.3.4.2). Circuits of this sort would either (1) be designated as " associated circuits" and be Equired to meet the same separation criteria as safety circuits or (2) be isolated adequately from the safety i-circuits. The Review Group recomends that where there are interconnections between safety equipment W ponsafety circuits such as indicator light circuits, the adequacy of the isolation should be sssured.

4.3.3 Proximity of C6bles of Redundant Divisions 4.3.3.1 Trays and Conduit A nuclear power unit includes many thousands of electrical cables, some with multiple circuits.

Neerly all the control power, and much of the motive power. for the motors and pumps and valves I

in the plant are electrical. The 1600 cables damaged by the Browns Ferry fire are in fact a small fraction of the total. These cables are connections; the things they interconn?ct are I located throughout the plant. Therefore, there must be a system of " highways" along which are routed groups of cables going the same way. In the Browns Ferry plant. as in most, this function is performed principally by steel cable trays typically 18 inches wide and a few ,

inches deep. i Separation of redundant equipment requires separation of their associated cables, therefore separation of the trays for these cables. Grruping equipment into divisions naturally results to grouping cable trays into divisions. The Browns Ferry fire started in one of a group of ten ,

trays, all of Division !! (see Table 2). In principle. then in accordance with design criteria, i only Division Il equipment sould have lost availability. This was evidently not the case. l i One of the reasons was the presence of Division I Cables in the fire Zone, in spite of the '

{

supposed separation. Upon examination (TVA has reported an extensive study in Reference (37)). '

it turns out that the damaged Division ! cables were in " electrical conduit"--pipes of aluminum  ?

or steel also used as " highways" for electriedl wires and cables. '

TVA in their " Restoration Plan" (37) identified 68 places in the Browns Ferry plant where l '

cables of one division are now deemed to be too close to tray! containing cables of a redundant

' division. The Group has been informed that there may be more such places. TVA has now develop.

ed proposed criteria to define "too close." to be considered later in Section 4.3.4.5. They are proposing to ameliorate these 68 situations with suitable ccmbinations, relocation, improved barriers, sprinkler protectlan. or other FNrst %e details of the corrections are not within the scope of the Review Group, but are'to be rev.ewed in connection with other aspects of  ;

Crowns Ferry Licensing.

The areas of proximity were designed, reviewed. inspected, and approved that way. P.unning cables in conduit is considered , My good practice. The conduit was provided to solve routing problems that would othemse call for too close proximity of divisional traysi the conduit was to isolate the cables from their redundant counterparts.

, This lesson of Browns Ferry is that the conduit in the fire zone did not protect ali cables adequately. Improved criteria regarding the use of conduit are needed in the light of this 1

lessoni recomendations are given later in Section 4.3.4 k.

a-._.----------L -' - ' " ~ ~ ~ ~ ~ ~ ~ ~ ~ ' ~ ~

~_ _ __ . _ _ - - _ - _ . . .-- _ _ _ _ . _ _ . . _ _ . _ . . _ .

_ :rl ,

l 37 0 i s 'I l 4.3.3.2 Non-Divisional Cables I It is worth noting that many cables are not safety-related and therefore belong to no division. J At first thought, it might be believed that the routing of such cables has no safety signiff-cance. This is true only if the non-safety cables never come into proximity with any safety cables. If they do, then the potential for intaraction of the non-safety cables with those of a safety division suggests that the same non safety cables should not come into prox:mity with the other safety division (s). This concept is elaborated as " associated circuits" in present-day cable separation criterie, as discussed later in Section 4:3.4.2.

4.3.3.3 Cable Spreadino Room it should also be noted that in present designs of cable spreading rooms.. including Browns -I Ferry--it has been found necessary to provide less separation of divisional cables than in (

other parts of the plant. The problem arises in the layout of the control panels for ease ih i operator comprehension--an essential--rather than separation of redundant divisions. In '

addition. the routing problem in the cable spreading room is severe. Cables from every part of the control room must be routed in many different directions to their destinations in the' rest of the plant. The result is congestion in most cable spreading rooms, ard Erowns Ferry is no exception. In view of the obvious concentration of cables and circuits, and the reduced divi-sional separation, cable spreading rooms deserve, and receive, special attention in design and procedures for fire prevention and fire fighting.

The installed CO, system was successful In conjunction with repeated manual appitcations of dry chemicals in minimizing the fire damage in the cable spreading room in the Browns Ferry fire.

The control of more than one generating unit from a single control room increases the potential vulnerability of the cable spreading room, but has advantages in economy and operational coordi-nation. Criteria for cable spreading rooms need further attention and improvenent, in the Review Group's opinion. Also needed are some varied design approaches to seek improvement in i divisional (and, when applicable, multi-unit) separation. Improved access for fire-fighting.

Should also be sought. Criteria for cable spreading rooms are discussed further in Section 4.3.4.4.

4.3.4 physical Separation Criteria fee Cables , I 4.3.4.1 Browns Ferry Criteria for physical Separation and isola cion of Fedundant Circuits The Browns Ferry design provided redundant safety equipment and circuits to prevent the failure of any single component or circuit from causing the loss of a safety function. The FSAR states that the overall objective of the Browns Ferry separation criteria is to preclude loss of redundant equipment by a single credible r; vent. These criteria are sumarized in Table 4 along with more recent improved criteria.

)

TVA and NRC have conducted extensive evaluations of cable separation in the as-built Browns {

Ferry plant. The results, and the Review G.*oup's review of cable tray and conduit layout I drawings and inspection of the physical installation, showed general compliance with the I physical separation criteria documented in the FSAR. There were, however, a number of areas in d which the objective of the separation criteria appear to have been compromised. 3 i

( The Browns Ferry FSAR stated that routing of safety related cable through rooms or spaces where t

fire hazards exist were generally avoided. The FSAR further states that in cases where it was  !

impossible to provide other routing, only one division of redundant cables was permitted in any

. Such areas. It is clear from the catle tray and conduit routing that TVA did not consider the .

reactor building in the vicinity of the fire to be an area where significant fire hazard existed. . i The events of tne fire show that under the conditions existing at the time a fire hazard did i exist. The potential hazard would have been lower if the seals between rooms had been in their y design condition. The non-fireproofed seal, the highly flamable flexible fom. and the candle i created the hazard and the fire resulted.

l The philosophy used by TVA in the design of the Browns Ferry electric system cade the actual ,

assignment of circuits to redundant divisions and the implecentation of their physical separa-

• tion difficult. It was TVA's philosophy to provide considerable versatility in the design which resulted in many interconnections between redundant power scurces. These interconnections really pertain to both divisions. A separate and redundant system, with no i.nterconnections between redundant divisions, would be easily divided into a minimum number of divisions. Each component or cable would be clearly identifiable as belonging to its division. In laying out

• • y g * "% 4 m .-w 8

~ ~'

• l __ _

9 38 4

TABLE 4 COMPARIS9N OF BROWNS FERRY FSAR 4

5EPARAT10N REQUIREMENT W REGULATOM GUIDE 1.75

1. Requireinent for use of flame retardant cable '

RG 1.75 - Required Browns Ferry criteria - No requirements specified in F54R. Some cable specifications require IPCEA flame

, tests.

2. Associated circuits must meet same criteria as safety circuitt up 1 to an isolating device 3

RG 1.75 - Required i

Browns Ferry Criteria - None except minor restrictions on e associated circuits. '

3. Separation of safety circuits from .non-safety circuits

-4 RG 1.75 - Same separation required as between redundant safety divisions.

Browns Ferry Criteria - None 4 Methods of separation RG 1.75 - Separate Class I structures. distance, barriers -

4 (RG 1.75 states preference for separate Class I structure)

Browns Ferry Criteria - Not discussed

5. Ofstance separation 5.1 Hazardous Areas (fire, missiles. pipe whip)

RG 1.75 - By ad hoc analysis Browns Ferry Criteria - Avoid. Where not possible to avoid route only one safety division.

5.2 Non hazardous areas RG 1.75 3 feet horizontal l 5 feet vertical  !

Browns Ferry Criteria - 3 feet horizontal. Vertical stacking

- N avoided where possible. Where r.ot possible 5 feet vertical separation.* 18 inches permitted where redundant divisions cross.*

l

• With solid metal bottoms on upper tray and solid rietal top on lower tray.

/ a a

.me-y - ,.

a , -

y

I 4 5

39 I

I i

5.3 Cable spreading room RG 1.75 - Where feasible redundant cable spreading areas should be utilized. Otherwise provide 1 foot horizontal. 3 feet vertical. i ,

Browns Ferry Criteria - 3 feet horizontal and 18 inches vertical. Conduit where separation cannot be maintained.

, j 5.4 With use of barriers a

RG 1.75 - 1 inch herirontal 1 inch vertical Browns ferry Criteria - 18 indres vertical Horizontal not specified

6. Barrier material requirements RG 1.75 - Metal (type not specified)

Csble tray tovers approved by example.

Browns Ferry Criteria - Steel cable tray covers i

7. Barrier configuration 4

RG 1.75 - 6 inches to 1 foot overlap depending on configuration -

but metal covers with no overlap are permitted.

Browns Ferry Criteria - Not discussed

{

i

8. Separation within safety divisions RG 1.75 - No requirements Browns Ferry Criteria - 4 inch horirental I 9 inches (tray bottom to tray bottom) vertical

9. Conduits 9.1 Use of conduits RG 1.75 - Same requirements as for cable trays. Not specified i as to whether they qualify as barriers.

{

m Browns Ferry Criteria - permitted as barriers in cable spreading j room where adequate spacing cannot be i maintained. Reactor protection and con-

. tainment isolation systems in condaits. j 9.2 Conduit Materials RG 1.75 - hot specified Browns Ferry Crf teria - Not specified l

l

• l -

9 g._ - , , . . - . .

- , - - . n. - ,em , ,

' ~

. _. L ._

4 40 =

equipment locations and cable routings the designer would need only be concerned with keeping 3 one division separated and isolated from the other(s) and with avoiding areas where both divisions are subject to failure from a comon cause such as missiles, pipe whip, high energy )

fluids, flooding, or fires. With interconnected systems, the designer has to decide whether he i must keep an interconnection separated from both dtvisions or only one. If he decides that -

separation of all interconnections is not required he must perform a careful analysis to deter- i seine which interconnections can be routed together and develop an orderly method to assure that i I the separation and isolation is properly implemented.

l j The separation criteria for these interconnections were not clearly stated in the Browns Ferry l' f FSAR. It is possible that the large number of interconnections was partially responsible for J the fact that conduits for one division were run quite close to cable trays of the other divi- J

' Sion. The complexity of the interconnected design was probably responsible for errors being N made that resulted in the normal power supply to power distribution panels in one division  !

being electrically connected to the alternate supply to panels in another division. For example, .;

the normal supply to 480 volt shutdown board IB was electrically connected to the alternate wpply to 480 volt shutdown board 18. This lack of electrical isolation introduced by inter-connections provided to give increased flexibility appears to have decreased system availability in the browns Ferry fire. ,

The complexity of the Browns Ferry interconnections probably resulted in errors made in the d c l controls for the 4kV shutdown boards that resulted in a power interruption on 4kV shutdown i board D (37). Each 4kV shutdown board is provided with a normal, an alternate, and an emergency l supply of d c control voltage. The availability of any two of these three control voltage s' sources was designed to be sufficient. In the actual installation, however, failure of a single d c cable made the board . inoperative. TVA is redesigning the boards so that each is j fully functional with a single d-c supply; alternate supplies are also beirg provided.  !

1 There were violations of the intent of the Browns Ferry separation and isolation criteria in  ; i the indicator light circuits as discussed previously in Section 4.3.2. It is often desirable '

i to provide connections between safety circuits and non-safety circuits. Examples are con. ""

l nections from safety circuits to indicator lights and meters in the control roam and to the  !

plant computer to permit the operator to monitor the performance of safety systems. Where this 8 i's done, present NRC criteria require that adequate isolating devices be provided in the safety equipment so that credible faults in the non-safety monitoring circuits will not affect the safety circuits. '

1 Although the Browns Ferry criteria do not mention conduit except for the cable spreading rocos, '

the principles of physical separation and fire barriers were violated in the lack of adequate separation of conduit containing cables of one division from cable trays of another division, , j as discussed in Section 4.3.3.1. The Browns Ferry criteria require an 18 inch separation in j i conjunction with steel cable tray covers in congested areas. At least one aluminum conduit l 1 containing Division I cables was run parallel to and only 2 or 3 inches above a cable tray containing Division !! cables. In addition to violating the separation distance criterion, the aluminum condi;it proved to be an inadequate fire barrier. Based en the Review Group's dis- ,

cussions with fire experts (19), the steel cable tray covers permitted by the criteria also appear to be inadequate fire barriers.

4. L 4. 2 Comparison of Browns ferry Separation Criteria with Current i

. hRC Separa tion Criteria .

Section 5,.55a of Title 10. Code of Federal Regulations, requires that erotection systems rieet the reau.rements set forth in the Institute of Electrical and Electreales Engineers Stancard, "Criter'a for Protection Systems for Nuclear Power Generating Statior.s," (IEEE 279). Section 4.6 of CEE 279 requires, in part, that the channels that provide signals for the same protective functioi be independent and physically separated. General Desisn Criterion 3, " Fire Protection" a of Appe. dix A to 10 CFR Part 50 requires, in part, that the structures, systems, and cor'ponents '

4" ports' t to safety be designed and located to minimite, consistent with otf er safety recairements the pro, ability and effect of fires, e,eneral Design Criterion 17 recJires, in part, that the '

onsite electric power supplies, including the batteries and the onsite electric distribution system, have suf ficient indenendence to perform their safety functions assu-ing a single failure.

General Design Criterion 21 requires, in part, that the independence designed into protection systefrs be sufficient to insure that no single failure results in loss of the protection function.

Pegulatory Guide 1.75 (66) documents separation requirements tnat have been found to be acceot-able by the I RC staff. It endorses Institute of Electrical and Electronics Engineers Standard IEEE 384-1974, but in addition modifies certain requirements of IEEE 284-1974 and provides .

additional restrictions. I J

[j 41  ; .

l

? '

E $, j Table 4 provides a sunmary comparison of the Browns Ferry separation criteria as documented in '

the FSAR with those of Regulatory Guide 1.75. In most significant areas the Browns Ferry FSAR } j criteria compare quite favorably with Regulatory Guide 1.75 The comparison is particularly 1 J

. favorable when one considers that the criteria documented in Regulatory Guide 1.75 were developed [

over the 7 years after the construction permits for Browns Ferry 1 and 2 were issued in 1967.

• Regulatory Guide 1.75 requires the use of flame retardant cable as a basis for using the sepa- -

' ration distances specified in the guide. The standard endorsed by the guide defines the term 5 flare retardant

• as capable of preventing the propagation of a fire beyond the area of influence '

6f the anergy source that initiated the fire. The standard, however, provides no guidance for testing to determine whether a specific cable qualifies as being flame retardant. The Browns

. Fer.ry FSAR contains no criteria with regard to the flame retardancy of the cable to be used.

This subject is treated in Section 3.4.1 of this report.

The concept of associated circuits as documented in Regulatory Guide 1.75 is a recent refine-ment. Associated circuits are defined as non-safety circuits that share power supplies, enclosures, or raceways with safety circuits or are not physically separated from safety cir-cuits by acceptable separation distance or barriers. The guide specifies that associated circuits meet the same separation requirements as th; safety division with which they are associated, up to and including an isolation device. Beyond the isolation device the associated circuit -is not subject to safety circuit separation requirements. The guide defines an isola-tion device as a d3vice which prevents malfunctions in one saction of a circuit from causing unacceptable influences in other sections of the cir uics or other circuits. If isolation devices meeting this definition had been provided at Browns Ferry between circuit breaker control circuits and cables to control room indicating lights (see Section 4.3.2), the system unavailability es a result of the fire would probably have been decreased.

Regulatory Guldt 1.75 contains provisions for isolating safety cables from non-safety cables in the same way safcty divisions are isolated from each other. The Review Group believes that this represents a significant improvement over the Browns Ferry criteria. Much of the cable insulation that contributed to the extent of the Prowns Ferry firu belonged to non-safety cables. Isolation of that cable from safety cables would tend to reduce the fuel involved in a safety cable fire. In addition it would tend to eliminate faults in non-safety cables as a "

potential source of a fire in safety related cables. Such isolation could be provideo in  ;

several ways, such as physical separation, solid barriers, or fire-retardant coatings.

The Browns Ferry FSAR criteria for running cables in hazardous areas--areas subject to fire,,

missiles, pipe break, etc.--are more specific than those contained in the Regulatory Guide.

The guids indicates that the routing of cables in such areas are to be justified by analysis.

The Browns Ferry FSAR criteria require these areas to be avoided where possible, and where not '

possible only one safety division is to te routed through suh an area.

The guide and Browns Ferry FSAR criteria for routing cables in non-hazardous areas and in the cable spreading ruom are quite similar although the separation distances permitted by the Beowns Ferry FSAR criteria are somewhat less.

The guide, and the Browns Ferry FSAR criteria both permit the use of barriers in areas where the ,

required physical separation cannot bs maintained. The Browns Ferry FSAR criteria are scmewhat 'l more stringent than those of the guide. Neither the guide nor the Browns Ferry FSAR criteria 1 are very specific with regard to barrier material requirements. Regulatory Guide 1.75 contains

no restrictions with regard to the type of cetal permitted as cable tray cover barriers. The Browns ferry FSAR criteria permit cable tray covers to be used as barrier:. The use of conouit ];

as barriers is vague in both the guide and the Browns Ferry criteria. The guide indicates that a the same requirements apply to conduit as apply to cable trays but the use of conduit as bar-riers is not mentioned. The Browns Ferry FSAR criteria permit conduit in the cable spreading  ;

room .here adequate spacing cannot be provided. Neither the guide nor the Browns Ferry FSAR < *'

cr!ierta provide any restriction with regard to the conduit r:aterials.

Re.ently. the TVA has oroposed (37) modifitd separation criteria to be used for design modifica-tions dee~ed to be needeo for rebuilding Browns Ferry. The Review Group has not evaluated these criteria, which are evidently still being developed.

Regulatory Guide 1.6. " Independence Between Redundant Standby (Onsite) Power Sources and

• Between heir Distribution Systems" describes an acceptable system consisting of redundant, independm power sources and load groups. Restrictions are placed on interconnections between -

Icad groups. Although Regulatory Guide 1.6 does not specifically discuss physical separation. '

it describes a dPsign that is conducive to good physical separation. A System designed in accordance with Regulatory Guide 1.6 would not contain the ntanerous interconnections contained

• O..I

.,.- -- +-

l

, T- - , . "F y

_ _ - - '- ~ ~ - - ~ -'

42, ~,

in the Browns Ferry design. and the proper identification and separation of redundant circuits could be more easily achieved.

There was no specific regulatory guidance concerning the sharing of onsite electric systems '

3 between units and the electrical interconnections between units at the time of the Browns Ferry "

safety evaluation. In the Browns Ferry plant. such *, haring and interconnections are more  !

extensive than in most plants. The staff hu more recently issued Regulatory Guide 1.81 to 1 provide a more orderly approach to minimizing interactions of onsite electric systeets. The regulatory position for new plants cantained in Regulatory Guld.1.81 is that each unit should

. have separate and independent onsite emergeucy and shutdown electric systems. 1 4.3.4.3 Adequacy of Existina NRC Seoaration Criteria I y

~;

%e basis for the present NRC separatiota criteria described in the previous section is that the cables are run in a non-hazardous area and the only flannable material considered in the design is the cable insulation. Although the Crowns Ferry fire was started in flammable material external to the cable insulation the fire propagatten in the cable trays suggests to the q q

Review Group that the flamability of cable insulation was underestimated in the development of these criteria, which were based on a review of the consequences of past cable tray fires. The i j

results of the two cable tray fires that occurred at San Onofre Unit 1 in 1968 and the 1965 j fire that occurred during the construction of Peach Bottom Unit 1 were reviewed (24.38). The results of cable tray fires in non-nuclear unite were also considered (39.40). During the 3 j

development of the IEEE-334 separation criteria, fire experts of the Nuclear Energy Liability and Property Insurance Association (NELPIA) were consulted. Jther technical experts experienced g in cable manufacture and nuclear power plant design and cooration were also consulted at IEEE  ;

working group meetings. Later, the results of construction nres experienced more recently at nuclear plants were evaluated to determine whether the crittria required modification (41-43). }

18 was the opinion of the MC staff that the existing NRC quldance (IEEE-384 modified and Y i

expanded) took into account the fire experience to date and :he best expert advice available.

The Browns Ferry fire has provided additional information that must be considered in a reevalu-ation of NRC separation and isolation criteria.

.j As discussed in Section 3.1.2. TVA evaluated the temperatures reached during the fire and 6eveloped a zone of influence (Figure 2) showing the area around a group of cable trays within j which cables of another division might be subject to fire damage. Such a zone of influence could bc used as a basis for improving the separation and isolation criteria 49d guidance, c Figure 2 shows that the T7A study did not establish a distance above the fire where it would be safe to run redundant cable. Therefore, criteria based on the Browns Ferry fire data would ,

have to preclude vertical stacking of cable trays of redundant safety divisions or of conduit -

containing redundant safety circuits above trays. A single specified minimum distarce for horizontal separation would also not be an acequate requirement. because the width of the zone j of influence (Figure 2) varies with the distance above the reference trays. -

I Another point brought out by the fire concerns the concept of an area that is "non-hazardous" with regard to fire. The existing 'IRC guidance specifies that the minimum separation distances <

aro permitted only in nondazardous areas. A non-hazardous area is defined as one in which the '

only fire threat to safety circuits is the cable insulation. The specified minimum separation a distances would not necessarily be adequate if appreciable amounts of f 1mable materials in 1 addition to the cable insulation were present. The Browns Ferry fire has shown that an area intended to be non-hazardous with regard to fires will not necessarily remain non-hazardous fer the life of the plant. Although the Browns Ferry fire seals in their design condition might not have constituted a sigaf ficant fire hazard. the hazard was increased by removing the fire j'

regardant coating to install additional cables. Such a condition could result from deter

. ioration with time, construction operations plant modifications, or poor housekeeping.

.1 Deficiencies observed during the inspections of the fire seals of a number of other plants (see d Section 3.4.2) 111ustrate that improvements in construction and operation quality assurance J programs will be required if areas designed to be non-hazardous are to be maintained non-hazardous.

Another cor.cern wi+.h the present NRC separation and isolation criteria involves the definition 4 of flame retardancy of cable insulation. IEEE 384 req. ires as a condition for utilizing the specified mini'tum separatici distances that the cable insulation be flame retardant. The y subject of cable insulation and the difficulties in d2monstrating flame retardancy are discus- '

sed in detail in Section 3.4.1.

4.3.4.4 Criteria for the Future l

4

' The Review Group has concluded that the existing NRC separation and isolation criteria require j improvement. The Browns Ferry fire has shown a number of areas in which improvement is needed

• l l

__. _ _m _

i

)

l l

- m .

-s, l I

f I

s, 1

. i  %.,.

I 1 / /

/

. - . t i i .

• . U i P iP

. P . ,,. g; -

- *- o o -  :,- s

. o. .

3 I a a m' l j l------

p tg CEILING a cr i I n l 1 e a I . i

\ i

\

\ / l

\ !n = / l o

\ l

\ 8,l J

\

\ \ ll1 ,

,1 Q 340' F I I 340' F

\ 5g__  % g ,ia i >

p-Jao j y

~t

\  ; i

,!;L y ___' i I ,15 #

\

i' Il F CABLE TRAY c

, I

- - - - , , , 3 h- ph I L,<ZONEBOUNDARY 4

'~a b

I l

i o

3 j e l'

l m 4 .,

s j -- - - ..

o

'. .h;y .

l $ *h p

.a

.  ?:

ke ;

FIGURE 2 REGION OF INFLUE.f!CII OF FIRE IN CABLE TRAY d

. c.a

. h.r I

.i

'k

. 43 + .%

t

.- . ---~+--. --

- a-a

.q 1

Thes) includ7 the assumptions underlying isolation criteria, the ways in which the requirements are stated inclusion of cunduit, and the role of fire barriers and fire retardant coatings. .

i The fact that operating plants and those under construction are in mny respects similar in design to Browns Ferry. Indicate that a .eevaluation is needed. Either of two possible basic ,'

apprcaches appears to have the potentist for providing the necessary improvenent. One would be  ?

' to use a suitable region of influence and the other would be to locate the redundant safety I equipment in separate fire zones. A third possibility--the bunkered syste% -is also perhaps j worth exploring.

g l In developing improved isolation and separation criteria. NRC and associated organizations i should bear in =16d the role of isolation in defense-in-depth, and the impossibility of achieving .

complete isolation. Emphasis should be on the establishment of goals and criteria, plus methods l of implementation known to be acceptabie. The ?eview Group views the methods discussed below .

as accsptable alternative candidate: for implerentation. Other acceptable methods will prob j ably be devised. j i

s Practical limitations will narrow the choice of acceptable isolation eethods for existing

• plants, whereas for future plants, new and different design approaches are likely to ** more 4 cost effective in achieving the desired degree of isolation. i for i,4ch plant, a suitabic combination of electrical isolation, physical distance, barriers. .

resistance to combustion. and sprinkler systems should be applied to maintain adequately ef-fective independence of redundant safety equipment in spite of postulated fires. The Review 4 Group notes that physical separation and physical barriers also offer a measure of protection 2 against common mde ft.ilures from acverse conditions other than fires.

l Region of Influence Approach This approach is to revise the mintmtsn cable separation distance criteria to take into account a suitable specified "regica of inf h.ence." To establish this refereace region, the validity, conservatism, and applicability of the TVA "rone of influence" should be investigated. A suitable region of influence should oe developed and used to evaluate physical separation and isolation. Where safety-related cables of one division are found to fall within the region of influence of another safety division or where more than one safety division falls within the region of influerce of non-safaty cable consideratica should be given to cable relocation, frsta11ation of fire barriers, or other measures such as provision of fixed automatic directional sprinkler systems. Fire retardant coatings for the cables could also be considered. Where barriers are used they should be shown to provide the necessary insulating qualities. The ,

Browns Feery fire indicates, and discussions with fire experts reaf firm (19), that uninsulated thin metal such as conduits or sheet retal tray covers are of questionsible value as fire bar-riers, fire Zone Acoreach The second approach would be to abandon the concepts of "non-ha:ardous areas" and minimum l separation distances. Regulatory Guide 1.75 states. "In general, locating redundant circuits and equipment in s?parate safety class structures affords a greater degree of assurance that a single event will not affect redundant systems. This nethod of separation should be used

[ whenever practical and where it does not conflict with other tafety objectives.* A fire in one l division would not affect the redundant division because of the safety class wa31s and floors separating the divtsions. These barriers could also be capable of withstanding fires, explosions, missiles, steam and water jets, and pipe whip. Such a concept could provide protection against other events in addition to fires.

Tne International Guidelines for the Fire Protection of Nuclear Power Plantt (13) reccmends

uodivision of nuclear generating stations into fire zon s to prevent tna stread of fire. The identification of fire renes, witu the requirer 6II*at equipment, including cableb of no more than one safety division be located in any fire zone, would provide an orderly and effective means of providing physical separation. The International Guidelines recomend that an inventory of combustible ma*erial be rade for each fire 2cne and that the apprcpriate fire resistance rating be designed into the walls, floors, coors and penetratiwi seals to prevent the spread -

of fire from one fire zone to another.

l l

,l ~

l

- , _ ~ -

--9r- --

y e- ,-- -=-- w e e-, ww-' 9-

~

r q 45 There are advantages and disadvantages to the fire zone concept. A disadvantage is that it is probably imrractical to implement it to any great extent in operating plants or those under I construction. For nearly completed designs even though construction has not begun, the cost  !

of implementing the fire zone concept (see Appendix D) would probably outweigh the advantages. '

To be most effective, provision of independent fire zones would have to be a design objective {

from the start of the design effort.

Another disadvantage is that independence of fire zones cannot be implemented completely.

Because the redundant systems are provide:f foi the safety of a single reactor, the concept is mere difficult to implement close to the reactor. This is probably not a serious disadvantage bec ase most safety related cabling is located outside the containment where fire zones can be I implemented. Inside the containment other techniques such as physical separation, barriers and j minimizing combustible materials can be used. -

l An advantage of the fire zone concept is that it is not necessw/ to place reliance on "non-fire harard areas" and the administrative procedures needed to maintain them. Another advant-age of fire zones is that sprinklers can be used without fear of the water disabling redt.ndant safety equipment. The reluctance to use water to put out a fire involving electrical equipment has been a recurring theme of the Browns Ferry fire investigation. In present designs the decision of whether to use water and when water must be used is often left to the operator who may have to make the decision under conditions involving considerable stress. The fire zone .

design approach would make the decision easier by eliminating the consideration of water induced i failure of redundant safety equipment. It also simplifies the design of automatic systems  ;

using water.

The fire zone concept has the additional advantage that it can strengthen all three levels of the defense-in-depth. It strengthens fire prevention by providing an o-derly way to control and minimize combustible materials in important areas of the plant. It strengthens fire fighting 'In that it limits the spread of fire and permits water to be used without the concern of disabling redundant safety equipment. It minimizes the effects of a fire by limiting it to a single safety division.

Implicit in the concept of locatin'g redundant circuits in separate fire zones is a regnirement for separate cable spreading rooms for redundant divistens. Although it has not been the practice in the nuclear industry to provide separate cable spreading rooms, the Review Group believes that providing separate cable spreading rooms can be a practical approach in future __ _

plants. The increased cost could be kept relatively smaT1 f f the concept were adopted at the t initiation of the design. The fact that at least one U.S. architect-engineering group has a i

design including sep3 rate cable spreading rooms that is incorp%dted into a nuclear power plant presently under construction (44) is one indication of the practicality of this approach. }

{

Reference (45) also describes a design incorporattag separate cable spreading rooms, one above  !

the control room and one below the control room.

• The NELp!A report (65) recommended that each unit have a separate cable spreading room. This recomendation has the merit that it would tend to avoid a multi-unit outage as the result of a i single fire. "4st of the advantages would, therefore, be in areas of power cost and reliability. .

It is however, noted that trouble in one or more additioni! units as a consequence cf trouble in one unit couli be of safety ccacern. Where possible, safety problems and hazards, and

• i safety related incidents like fires, should be confined to a single unit. The Feview Group 1 l does not believe that the increment in safety is large enough to make separate cable spreading 1 rooms a mandatery requirement. even for future plants. For existing plants, changeover to separate cable spreading rec,ms is impractical and unnecessary, in view of other alternatives.

Bunkered System Approach A different approach has been suggested that involves the addition of a system for shutdown cooling totally separate from other systems. The system would have the following characteris. -

tics: (1) isolation from all other systems in the plant; (2) fully protected against fire, flooding, missiles, high energy line breaks, etc., in other parts of the plant; (3) self-sufficient in that it would contain dedicated power and water sources, heat sink and fluid and electrical systens; (4) relatively low capacity capat,le of supplying shutdown cooling with normal (or tech spec maximum) primary system leakage. Because of the high degree of isolation and protection envisioned for such a system. it has been re' erred to as a " bunkered" system. }

An advantage of such a system is that it would be a small system with a limited number of i components and limited esposure to damage and therefore could be relatively easily isolated and

• protected. There mcy be another advantage in application to some existing designs. If as the ,

result of evaluating an existing design, the required cha9ges such as cable tray relocation or installation of barriers between existing cables are found to be expensive or require extensive down time, installation of such a separate new isolated system may have merit. A major dis- 3 1

I

{l *. * '~"

i i

I

~

~

46 ' .

1 4

advantage is that the concept is not fully developed. and therefore may involve unforeseen 1 problems. There may also be unforeseen advantages of such a system. Because of this, the ,

Review Group has no specific reconnendations regarding the relative merit of such a system, and suggests that a modest engineering evaluation of the concept might be useful. I O

Control Room Consider $tions i Improved isolation and separation requirements would probably place additional requirements on the design of the control room. Because redundant safety equipment is controlled from the control room, it is a natural confluence of redunda it circuits. Generally, the indicators and controls for the redundant safety divisions are moJnted in separate panels. To implement the fire zone concept, the panels of each safety division would have to qualify as a fire zone, as would the general control room operating area. Because of the relatively small amount of a I

conbustible material in the panels and the control room, qualification as separate fire zones would not be expected to retult in a significant increase in cost. An additional cost could also result from extra cooling equipment for panels in the control room to allow them to be thermally isolated from the control room.

i There is one area where redundant circuits are presently permitted to be located in the same  !

panel. Where there is an advantage for ease of operation, manual control switches may now be i mounted on the same control board provided certain separation requirements within

• panel are ,

met. Such redundant manual control switches should be separated by suitable fire barriers. '

Where location in septote panels has the potential for inducing operating problems, other fire <

barriers should be provided. '

1 4.4 Instrumentation Required for Operator Action Thss section discusses the instrumentation that provides information needed ty the operator in performing manual safety functions and in monitoring the operation of safety equipment. The instrumentation discussed in this section provides a direct readout, such as analog and digital indicators, or a graphical record, such as analog charts and printouts.

To the best of the Group's knowledge, the instrumentation that gave erroneous indications, erratic indications or otherwise failed did not result in any incorrect operator actions at Browns Ferry. The effect of the instrumentation failures was that (1) the operators had to use indirect and inferred methods to obtain needed information and (2) desired confinnatory information was missing. There are a number of examples where indirect or inferred methods were used to obtain needed information. In order to confirm that the control rods remained inserted after the rod position f r.dicators became inoperative, it was necessary for the opera-tor to place the rod mode switch in the " Refueling" position and observe that the perriissive ,

light for rod withdrawal came on. Another example is that it was necessary to take grab samples e and perform a laboratory analysis to measure radiation releases because portions of the on-line radiation monitoring system were inoperative.

The loss of all neutron monitoring for a period of time is an example of desirable confirmatory information not being available. In this case, neutron monitoring had been available at the time of the scram to confirm the expected decrease in reactor power. Process instrumentation measuring orimary system and containment conditions was availahla from which the inference could be made that the core power was approximately at decay heat 19 vel, as expected. However, the spuriots indication of high dry well temperature led to sea concern during the fire but later evidence showed te.?eraturcs tu h3ve been acceptably low.

Existing safety criteria. standards and guides deal primarily with the instrumentation used as a part of automatically actuated safety systems. The NRC staff, howeer, has applied the relevant portions of the criteMr developed for automatic safety systems to instrumentation used by the operator attrr . 'i ircident or accident to perform manual safety functier.s.

Historically, in standaros, criteria, and safety evaluations, electrical and instrumentation systen and equipment have l,een divided into two classifications: safety grade and non-safety grade. Equipment and systems required to be safety grade are required to meet a number of

- stringent standards. There are criteria for determining which equipment and systems must be safety grade and whlon may be non-safe? grade. A great deal of latitude is left to the industry in the design. manufacture and installation of non-safety grade systems and equipment.

The regulatory philosophy has been to class lfy as safety grade only those systems and equipment essential to s.afety. The expectation has been that by minimiting the a*ount of safety grade eoulpment much more attention cot.ld be focused on high quality dssign, ranufacture, installation and maintenance of the equipment that is truly important to safety.

Q@kf&f4fspnud$1" %ar,gt) hare"~- = ~~ wieow * "~_ zAm m wt ~ - - -A"kNHMtwA rmm <

p

?

"I

?

I 1 l

The approach t'o mechanical equipment has been somewhat different.

cations are defined. A number of safefy classiff.

i

{ The difference in approach between mechanical equipment and electrica

.t equipment has been discussed at length in industry standards groups and within the woc staff

1. 6 f and requirements for other, safety categories been slow, for instrte@tation.The Unfortunately, progress has l IEEE N1

i l

j j

j '

+

- i l The Review Group urges the NRC staff and industry standards action.

I An additional category should be considered to cover this instrumentation; the con.

cept of defining a minimun of sy*tems ar.d equipment as safety equipment should not be abandon

+

1 l <

l I

I i

l i

i l

1 d

t i

_ _ _ _ . -- - -^ ,,,

~

. 7 O

d l

. 7 '

. . 4 5.0 TVA ACTIONS AFFECTING THE INCIDENT I In this chapter the Review Group considers how the licensee's actions before. during and after the fire affected the result, and what lessons can Se learned from these actions. Confronted by unexpected and (at the time) inexplicable plant si'.uation; and forced to work in dense smoke, the TVA operating staff is believed by the Review Group to have behaved in exenciary fashion. i' As has been noted many times and places, the rescurs were shut down and cooled down without damage from the fire, nobody was seriously injured, and the public health and safety were not jeopardized in any way. I The TVA organfration for des'gn, construction, operation, and QA is discussed in Section 5.1.

Section 5.2 considers how QA lapses contributed to the fire and its consequences. Actions of }

the operating staff are the subject of Section 5.3.

5.1 TVA Organization 5.1.1 General The Tennessee Valley Authority, a corporate agency of the Fed Government. has fifteen offices 1 and divisions of which one has overall responsibility and operates the plant, one designed and t constructed the plant and te provide support services to the plant (47). The overall responsi- I bility for the TVA power nrogram, including the operation of Browns Ferry and other power '

plants is assigned to the Office of Power. However, the plant security and radiological hygiene support services are provided through the Division of Reservoir Properties and the Division of ,

Environmental Planning ressectively. The design and construction of major TVA projects.

including Browns Ferry, is the respnsiblity of the Office of Engineering Design and Construction.

1 The primary responsibility and authority for reactor operation and safety is vested in the Plant Superintendent and the piant operating staff. The Plant Superintendent assures that construction has been satisfactorily co@leted and that plant systems and coeponents meet the established acceptance criteria before operation. He also verifies that modifications or revisionc are correctly made and do not degrade plant performance or design objectives. He certifies and implements operating prucedures. work instructions and checklists. He is also responsible for ,

the adequacy and completeness of the operating and maintenance logs and the training and quali-fication of plant personnel. The Plant Superintendent reports to the Chief of the Nuclear  ;

Generator Branch in th6 Division of Power Production. >

The Office of Engineering Design and Coastruc' 7erforms the design and construct %n functions that an outside architect-engineering firm us j does for most electric utility ct.mpanies, a I

5.1.2 Quality Assurance Organizatica , reeram .

In addition to th3 responsibilities described in the preceding section. the various TVA organi- 1 rational units have the respor.sibility to assure that Browns ferry is designed, constructed.  !

operated and maintained to adequate standards of quality. The MC requires applicants to i establish at the earliest practicable time. consistent with the schedule for accet@lishing the activities. a quality assurance (GA) program which complies with the requirements of Appendix B l to 10 CFR part 50. (For a discussion of hRC activities and procedures in this area see Section ~

6.2.4.) '

e 5.1.2.1 i

Desf on and Construction

The quality assurance functions for the design and construction of the Browns Ferry plant are  ;

i perfomed by three organizational elements. The Manager of the Office of Engir.cering Design and l Construction has the overall responsibility for ovality assurance during design and construction.

Reporting of rectly to him is a QA Manager and QA staff, which is responsible for the development.

coordination. imalementation, monitoring. and me.intenance of the CA program and for auditing ,

all OA progres var design and construction. Quality assurtnce in design is executed by the QA staff reporting to the Director of Er.gineering Design. This staff also audits SL;: pliers and the Design branches and projects-4 f

.j.

' 3

] i l

l

n l

49 QA in condruction is executeh by the Director of Construction. The Construction Engineer for each project, who reports to the Project Manager, is assigned primary responsibility for quality ,

assurance g his project. He is assisted by the Quality Control Comittee which consists of the constructid engineer, unit supervisors, and other project supervisors.

The quality assurance program for the operation, maintenance and modification of nuclear power l- plants is supervised by the QA Manager and QA staff within the Office of Power. A QA coordi-l nator resident at each . nuclear plant site eports to the Office of Power QA Manager, independent -

of plant management.-

l I

The Plant Superintendent has the line responsibility for QA at an operating plant, subject to audit through the QA coordinator. He executes this responsibility through the plant QA staff. '

and is advised by the Plant Operating Review Committee. '

The regulations pertaining to quality assurance (10 CFR Part 50. Appendix B) were made effective in July 1970. long after the construction of Browns Ferry had begun. TVA then developed a QA i program which was intended to meet these regulations. That QA program was in effect during the major portion of construction and included a QA program to be followed during operation.  ;

, The description of the Browns Ferry QA program for operations is on psges 24-30 of Appendix 0 FSAR. It was judged to be acceptable then; it would not be acceptable by today's stancards.

In August 1974. TVA agreed (3) to implement an improved plan, recently developed for another TVA fac111ty, at Browns Ferry at least 90 days before fuel loading of Unit 3. More recently, implementation was promised (1) in conjunction with the Restoration Plan which includes its own '

extensive QA program stated by the licensee to conform to current requirements.

]

5.2 La2ses in Quality Assurance at Browns Ferry Investigation of the Browns Ferry fire has revealed lapses in QA in design, construction. and operation. Listed below are some of the items which should have been prevented or revealed and rectified. by an effective QA program:

1. The design of the fire seals was inadequate, because it was based on inadequate testing. .

2. The design for the indicating lamp circuits did not provide adequate isolation.

3. The construction of some of the fire seals was not completed in accordance with the design.

1  ;

4. Some openings between the control room and the cable spreading room were not sealed at all.. '

5. The teating and restaling operation (with the candle and the flexible foam) was not recog.

nized to be hazardous and performed witn proper precautionary measures.

6. The occurrence of several mall fires did not elicit improved precautions.

7. Operation of the C0psystem in the cable spreading room was known to be impaired without adequate compensating precautions being taken.

y Quality Assurance programs, provided to catch and rectify imperfections, are inevitably themselves k imperfect. There were many errors that the QA programs that did not catch and rectify. In a j review like this one no mention is made of all the things that were designed, constructed, or operated correctly, ? whose errors were caught and rectified by the QA programs being assessed. ,I Lacking this information. It has not been possible to be quantitative about the errors or how good the Browns Ferry QA program was. Similarly, it is not possible to say quantitatively how good the QA program ought to have been. It is also worth noting that the NRC (and predecessor ,

AEC) licensing and inspection program was not effective in catching and rectifying these errors. .

either. This is discussed further in Section 6.J. The Review Group nonetheless believes that t the causes, course, and consequences of the fire are cidence of substantial inadequacies in the  ?

Browns Ferry QA program befere the fire. ';

Reference (49) states that a revised QA program will be used by TVA for the restoration program. 1 The Review Group has not evaluated the ac*eptability of the revised QA program, but recomends -

that it be reevaluated by TVA and NRC in the light of Je experience of the Browns Ferry fire. -

{

1 It would be well for TVA and MC to examine the QA lapses revealed uy the fire and consider I whether the revised progean is likely to have led to catching and fixing of these errors.

l 1

4

- - ok k

n.w- - ~

._.~~m i a .

50 ~N The Review Group believes stron ly in the necessity for an effect've i QA program at each plant.

The QA program should be a camp ete system and a management tool.

emphasis on reccrds associated with QA programs. Such records areThere tends to be exces.lve worth while only to the extent that they facilitate and assure quality in the actual design of the plant, in the equip- d ment as constructed, and in the actual operating functions. 1 This lesson under from the construction. andB.proposed.

owns Ferry fire is applicable to all plants, including those operating, should be reviewed in this light. Operating Licensees. QA programs, and NRC evaluation of these programs.

QA programs in older reactors, known not to conform 5 for the kinds of lapses revealed at Browns Ferry.to current standards, should be upgraded promptly. A fire (18) initiated this review. The NRC inspection program should be upgraded the Section 6.3).

also.The NRC bulletins sen In particular. the licensee QA programs and the NRC licensing and inspection y programs should all include explicit reference to fire prevention. fire fighting, and consequence

! mitigation ness, in their written procedures, and these procedures should be implemented with effective-5.3 Plant Operatinc Staff <

d

~

Some of the lessons learned from the actions of the operating staff are discussed in other parts I of this review. These include fire fi 3.5.5). reactor scran (Section 4.1.1),ghting (Section 3.5), fire prevention and readiness (Section '

and operating QA (Section 5.2). The Review Group's '

1 Chapter 5.overall evaluation of the operating staff's response to the fire is given in the introduction ts

i In thethe how following sections,staff plant operating the Review coped withGroup it. has found some other lessons from the incident and The Plant Superintendent has the primary responsiblity and authority for the operation and i safety of the plant. {

the Operations Section is responsible for all plant cperations including pre-operationalAlthou 1 testing, fuel loading, startup, and operational testing. It also provides the nucleus of emergency teams such as*the plant rescue and fire fighting organizations. J The minimum shift complement required by the Technical Specifications for operation of two Browns Ferry units is a crew of ten. The crew consists of a Shift Engineera. two Assistant Shift Engineers, two Unit Operators. four Assistant Unit Operators, and a Health Physics Technician.

The Shift Engineer and at least one Assistant Shift Engineer have Senior Reactor Operator li-censes.

licenes. The other Assistant Shift Engineer and the two Unit Operators have Reactor Operator of the Technical Specifications,At the time of the fire the onsite operations organization exceeded these requirements ~

i

i A call-in system can augment the staff with off-duty staff merters, including craf tsme specialists as needed.

Outside help. such as the Athens Fire Department is also available.

1 The Review Group suggests that available personnel--specifically the Athens Fire Department-- '

}

were not used as effectively as they could have been during the Browns Ferry fire. Efficient j  ;

use of this manpower would likely have freed some operations personnel for use in restoration of i -

}

assist the outside firefighters.some systems, although it is recognized that plant personnel would be required to guid i i

4 5.3.1 Radioloolcal Monitoring 5.3.1.1 Onsite 1

Measurecents activity above the small made onsite amount and with associated offsite nomalconfirmed shutdown. that there was no abnormal release of radio- i During limitt.

cation the fire. radionuclides released to the environs were below the plant technical specifi-j personnel occurred as a result of the fire.No radiologicai overexposures to plant personnel or Athens Fire Departme b

changes that would indicate increased or excessive fuel leakages. Reactor water isotopic analysis did not sho J

Additionally. reactor building ventilation systems were 45inoperable p.m.

from approxim until w00 p.m,; however, some flow through the vents During the was induced by 9atur  !

I j

.- b

}

. l I

04 51 5 j

' out of service, " grab" (quick collection) samples were taken approximately every hour and analyzed to determine the concentrations of any radioactive material being released from the d reactor hulldings. Gama spectrum analyses of samples taken inside the plant and the reactor D building ventilation ducts indicated that the only radioactive isotope of significance wcs

• y rubidium-88, for which the maximum level measured was 35% of Maximtsn Permissible Concentration 4 ,

(MPC). This decreased to less than 51 of MPC wnen ventilation was restored after the fire was '

extinguished, j J

Utilizing reactor building ventilation grab sample results, coupled with data from other opera- s ble building vent monitors and stack monitoring data, dose estimates were calculated. The j maximum dose in any one sector surrounding the plant was estimated conservatively to be 1.8 y millirem at the site boundary. No abnormal contamination levvis were found. a

5. 3.1.2 Offsite  :

p The TVA Radiological Emergency Plan (63) states trat the TVA Environs Emergency Staff shall q assist the Alabama Department of Public Health in evaluating the extent of a radiological ]-

emergency if one should occur and its effect on the population and the enviror.eent.

The TVA Environs Emergency Director is responsible for evaluating the infomation obtained to ,

determine whether a hazard exists to the public or the environment, ensuring coordination of j activities with the Alabama Department of Public Health NRC and other appropriate agencies, '

and ent,uring comprehensive monitoring throughout the emergency. a i

The Supervisor of the Health Physics staff for TVA (who is also the Environs Emergency Director) was notified about the plant emergency at 3:00 p.m. on the day of the fire. Environmental air I particulate samples in the environt around the plant were taken by TVA radiological assessment 1 personnel connencing at about F:00 p.m. until shortly before midnight the same day. Some of ,

these were grab samples while others were taken from fixed sampling devices that had been in q place since March 14, 1975. Radioactivity values obtained from these samples did not differ greatly from routine environmental sample results and approximate background levels. -j 1

Alternate, or emergency (battery) power supplies were not provided for the fixed in-plant radio-logical monitoring equipment whose normal power supply was rendered inoperable by the fire. ){

Consideration should be given to providing alternate or emergency power supplies. Alternatively, j if portable monitors are to be used, the manpower required for this function must be included in .

minimum shif t complements.

TVA radiological assessment personnel in the field, conducting offsite environmental surveillance, J responded well to centralized control from the TVA Environs Emergency Centor. Sample collection q and evaluation appeared to be well coordinated and efficiently carried out because of this centralized control. However, tardiness on the part of plant personnel in notifying the Environs -

Emergency Director contributed to a delay in commencing offsite radiological renitoring activities, d which had no significance because radioactivity releases were within normal limits. Apparently, 3 because the fire did not fall into one of the four incident classification categories (all associated with postulated radiological releases) in the TVA and Alabama emergency plans, a  ; 9 delay of over two hours in notifying the Environs Emergency Director occurred, which in turn 1 delayed the start of offsite radiological monitoring activities. A " standby" classification '

appears to be necest ry to cover those incidents (like the fire) with potential for later trig- ,[ i gering one of the four major incident classification categories.

Prompt radiological assessment in the surrounding environment is often important. In this case, the importance was accentuated because one of the State of Alabama local air sarplers at Decatur. )

l Alabama (downwind at the time) was inoperative and not available. Prompt radiological assessment i i in the surrounding environment by TVA could also have been important because the Alabama Depart- j ment o? Public Health did not field a radiological assessment team in the imediate vicinity of 4 ,

the plant site (see Section 7.2.1). -

i l

.}

I N

N l

i n

4 1

,e.m , .

• _ v. mm -

.. v. .

$2 i

• r y '

6.0 ROLE OF U.5, NUCLEAR REGULATORY COMMISSION 6.1 Introduction '

'^

The Nuclear Regulatory Comission (NRC) must consider the extent to which its own policies.  :

procedures, criteria, contributed to the Browns Fef ry incident. In this chapter, the Review  !

Group evaluates the actions of the NRC before, during, and after the fire and recommends some  ;

improvements for the future.

t The Review Group has consulted with cognizant NRC management during its review, and is awafe '

that programs to implement recommendations contained in this report are being developed 6 in several areas, '

6.1.1 Responsibility for Safety 8 The NRC is responsible for assuring the health and safety of the public and the safe operation of Browns Ferry and all other reactors. NRC provides this assurance of public safety through the establishment of safety standards, evaluation of the safety of plants, and inspection and enforcement programs. The licensee, TVA*, has the responsibility for the safe design, con. _

struction, and operation of its plant within the framework of the NRC regulatory program, if the NRC were to become too closely involved in the licensee's operations, this might have an adverse effect on the licensee's view of his safety responsibilities. In other words, it is ~

the Itcenste's responsibility to operate the reactor safely, and it is NRC's responsibility to assure that he does so.

6.2 Organization An organization chart of the NpC is shown in Figure 3. As fas as the Browns Ferry fire is concerned, the relevant parts of the agency are the Office of Inspection and Enforcement (IE) and the Office of Nuclear Reactor Regulation (NRR); the Office of Standards Development has the lead in developing standards in all art;as, including those affecting the fire.

6.2.1 I E.

This organization's inspection program provides most of the onsite contact between the licensee and the NRC. Infomation from inspections, routine and non routine, announced and unannounced, is fed back to IE and NRR in Pethesda Headquarters as well as to the licensee canagement. IE i-is also responsible for enforcement actions and other functions not relevant to this report.

6.2.2 fjRR This organization's mission is to make licensing decisions; its output is the licenses issued, together with their Technical Specifications and the NRC Safety Evaluation Reports (SER) that set forth the safety assessment behind them. These licensing decisions are based on a large g body of technical information. Information regarding the design and evaluation of the particular A j facility and operation under consideration is furnished by the licensee and its contractors and 2 ,

suppliers in the Safety Analysis Report (SAR). This is underlain by industry and NRR knowledge f; '

and experience with other relevant applications and analyses, together with IE confirmation of onsite infomation. Research information and the technology available are the fundamental basis

• for all safety evaluation.

] 1 6 ?.3 NRC Organization - Application to Unusual Events and incidents 4 While the licensee has prire responsibility for the safety of the plant and makes the necessary ]

decisions during and following an incident, the NRC has an overall responsibility to assure l

l l

4 The fact that TVA is a U.S. Government agency in no way affects its status as an NRC licensee. f

?

i 1

_- .~. - - .

t k $

r i

NUCLEAR REGULATORY COMMISSION Itti

((MutMNPd o

l g .. ...-

1

. .~,

-:. : ~ - - ;. r.,;.

g J

'> er oem a.

I I I I

..ee-I

..a . ..

. - 9 I. -- .

• ,*-s

=,.,... - . . . . ;*, . , ,a==. l

.. -- l

" . ~ .

I t-

,  :~.'

^

l E I E E E E I E

..'.i.!"..' .

s."

E,.

"4. '..I.1.'.* '.: *!*!."

. c- -" * .7e"*.*A*"*'** a ,

. 1 W

t l E E E t

~

. ;: : y .. . . . .::.: -

~. .. . ~. _a'.;~.-

. . . _ , . , . . . I u.

.t.._-

. . . . ~ -- .

t i I I  :

I l i I I I I I I E

. .....::._.  ::c.ne::'.:s:-  ::.- . -

.-- m. -  ;- . .. . . ,_.. , c.

. . . . ." W .'  ;;2_* i h l

, ,+-

.... .c=..z- .:: .a,;, .=;r;.

_: "..'.U '

he* m+4.Dee e e. .

t.

h FIGURE 3 4

4.

. _. ,_,.s.

A

_ ...m*h sM

. - . - - - ~ - , ,_ _._.,._.._ - - ~ -

~

54 that the licensee is fulfilling its responsibility.

of tafety-related unusual events and incidents that may occur in operating reactors.Both IE and 'NRR participate IE personnel describe their role as making sure that all requirements are complied with. IE

'esponses to energencies are governed by written procedures. During an incident, inspectors icnsite or in the Regional Of fice, as appropriate) pay special attention to the licensee's need i for internal safety review and approval, as appropriate, of special operations and configura-ticas. '

Additionally, the entite inspector must make judgments based on personal observations, actions taken by the Ifcensee to assure that adequate safety is maintained. augmented as appro NRR parsonnel view their role in an emergency as providing help to IE, and through IE to the licensee, as needed and requested, in the form of information and evaluation of the licensee's

• response to the emergency and plant safety.

NRR is viewed by both NRR and IE personnel as bein responsible for resolution of safety problems on the plant involved and recognition and resolu g tion of generic safety problems raised by the incident.

!r. tie event of an incident, the IE inspector contacts the licensee and investigates. He assures '

that the initial and continuing safety evaluation made by the licensee is complete and co. rect.

Office and NRC Headquarters.Ha may request aid from both IE and NRR managerent and technical l support personnel ficant desi If the cause of the incident is understood and there are no signi-operation. gn or operational inadequscies, IE will authorize'the plant to return to or continue If there are unresolved safety questions, or if changes in the Technical Specifica-tio9s or the FSAR are required, NRR evaluates the necessary changes, j

As can be seen, the functions of NRR and lE during incidents follows the general division of functions described in Sections 6.2.1 and 6.2,2. t lE inspects, determines compliance with, and enforces regulations, license conditions, and Technical Specifications, and reviews operating procedures and data. )

Technical Specification changes that may be needed or operation outside previously reviewed orNRR decides on Licen licensed conditions.

Norr: ally, this division of functions requires no formal direction and the actions of both groups are levels.coorcinated through telephone conversations, meetings and memns .st the various working (

However. in the past, some confusion has arisen and the need to formally define the IE and hRR '

responsibilities for an incident was perceived. As a result, the division of responsibilities be'oeen the two organizations and the designation of a " lead responsibility" were set forth ty .%

the then Director of Regulation, in a memoranduct which is included in Appendix B. As discussed in Section 6.4.2, the division and delegation of responsibility in the Browns Ferry fire led to a dela/ in an independent safety evaluaticn, by MRC.

for inproved NRC procedures for the safety review of incidents.This indicates to the Review Group a need 6.2.4 NRC Organtration for Quality Atsurance y

Since quality assurance (QA) lapses played an important role in the conditions that led to the Browns QA ferrytoday.

programs fire, it is instructive to set forth the promfure used by NRC to evaluate licensees' $;

discussed in Section 6.3.2.The NRC review of the Browns Ferry QA program predated this procedure and is

• k Appendix B to 10 CFR Part 50 contains the NRC QA criteria; it is supplemented by a number of 9

- Regulatory Guices ANSI Str.ndards, and NRC Standard Review plans. f f

Present-day QA review x for a construction permitsctivity (CP). b/ NRL begins approximately one year before application is made i

applicant and discuss QA requirements,At that time, representatives of IE and hRR visit a prospective When the Preliminary Safety Analysis Report (PSAR) is

]*

t su5mitted for review for docketing, an intensive 9 day review by NRp of the CA program for activities already under way (design and procurement, mostly) is followed irriediately by an IE inspection of the actual implementation of the program. Acceptability of the application for 5 docketing is not adjudged unless and until the QA program is satisfactory. The reason for this t~

early attention is the applicant's need to design and purchase long lead items long before actual onsite construction begins.

, 3 NER review of the PSAR includes the QA Program described and the IE inspection record of CA perforrance of the applicant and his vendors and contractors on other plants. IE again inspects the CA procedures and implementation as applied to or. going work before a CP is granted.

k ._

' dm m ____ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - _ _ _ _ _ _ _ _ - . _ _ _ .____mm__._._m

___m . . ,- . - - - , . - - -

u.

I 55 i During construc9on. IE inspections it.clude QA aspects of major activities. Chapter 17 of each applicant's Final Safety Analysis Report (FSAR) is required to set forth the proposed QA progres '

for station operatien including operation, maintenance, repair refueling and modification. .

This proposed program is reviewed in NRR for como11ance with rules and acceptability as a fraaework. IE inspectorf review the program details and assess its it.:plementation, both by I

auditing and spot-checking the procedures and other paperwork and by reviewing its application 4 3 .

to other reactors owned by the licensee at the plant being reviewed and at other plants, and to  !

the reactor under review during preoperational testing. '

The Review Group believes that license ; QA is central to implementing licensee responsibility for the safe operation cf his reactors. The efficacy of the operating QA program in actually achieving safety in operation depends not on the quantity of paper produced by the program but on whether it is actually used to perform its functions. ,

i l

6. 2. 5 Evolution of Reoulatory Reovirements 5 The preceding discussions of orgaa12ation and procedure are based on practice at the time of writing (Tall 1975). The NRC procedures described differ somewhat from those earlier applied to Browns Ferry, but the differences are not significant to the lessons to be learned from the incident. By contrast, differences in safety technology and acceptance criteria of the present day from those used for review of Browns Ferry are highly significant. 4 In general, knowledge and understanding increase with experience. The experience obtained from '

the design, construction, and operation of numerous reactors between 1966 and today has led to j-the changes in criteria. This review and the changes resulting from implementation of its 4 recomendations will be another step in the learning process.

For each increment of new knowledge, it is necessary to decide whether it must be apolied to earlier plants. Guidance is provided by the Comission's regulations 10 CFR 50.109:

{w (a) The Comission may. in accordance with the procedures specified in this chapter.

I L require the backfitting of a facility if it finds that such action will provide sub-

S stantial, additional protection which is required for the public health and safety or l the comon defense and security. As used in this section. "backfitting" of a pro- I r-duction or utilization facility means the addition, elimiration or modification of '

M structures. syster::s or components of the facility after the construction permit has  !

j been issued. -

(b) Nothing in this section shall be deemed to relieve a holder of a construction permit e or a license from compliance with the rules. regulations or orders of the Comission.

[

(c) The Comission may at any time require a holder of a construction permit or a license Y to submit such information concerning the addition or proposed addition, the elimi-nation or proposed eliminstion, or the nodification or proposed rodification of f structures systems or co V eer.ts cf a facility as it deems appropriate." p

- d In the following discussions, therefore, and in its recommendations, the Review Group has been E 3

mindful of changing criteria and has tried to explain clearly the time frame for each considera- ,E tion where this is relevant. #

7 Each of the Review Group's recomendations that is relevant to existing plants is evidently a [

recommendation for backfitting, implementing such a recomendation must be decided plant-by-  ! A plant, using the criteria just cited. The actual measures taken on each plant will depend on the plant design as it exists, and also on the nature of the improvements that are deemed to be  %-

3 needed. In each case it would be expected that there exist alternative means of achieving the i d desired results. The Review Group's recomendations are not intended to specify or foreclose ,j any alternative, but rather to delineate the need for changes and their objectives. }

4 ;1 6.3 NRC Action Defore the Fire i h3 The licensing history of the Browns Ferry Nuclear Station is given in Reference (48). As with y(I -

1 all power reactors the Browns Ferry units underwent detailed safety assessments before the i i construction pemits (CP) were issued and again before the operating licenses (OL) were issued. C i

Units 1 and 2 received OLs on June 26. 1973. and June 28.1974; Unit 3 is not yet licensed to operate. , }

., 7 t

q L

E k n  ;

i i

i

.g,,,c. a~_ee$.w wwn,a e ed e*'hM"#

+ &  :

p. n

._- - . . . . . _ ~ . _

56 The OL review process includes detailed review of Licensee furnished information and analysis by -

the NRR staff and by the independent Advisory Committee on Reactor Safeguards. The results of this assessment are given in the SER (43). Development of Technical Specifications and their

• bases proceeds during this time. The Technical Specifications establish the Ilmiting conditions and parameters governing the entire operation of the plant, plus reporting requirements.

Reference (60) is a collection of NRC inspection documents that constitutes an inspection history.

Periodic inspections covered the Browns Ferry construction. operation, and QA program. As each unit neared completion IE inspections additional to those associated with plant design and ,

construction were directed to the operating QA program. audit and review of the operating proce-dures including emergency procedures, review of the preoperational and hot functional tests. '

culminating in a finding by IE that the unit had been constructed in accordance with the FSAR.

that the ready foroperating organization and procedures were in order, and that the plant was technically operation. This finding by IE plus the favorable safety evaluation by NRR bere the basis of cach OL.

Since some aspects of the facility design, the QA program, the operations by the licensee, and the execution of the Emergency Plan have been found wanting (see earlier chapters and th? IE Investigation Report). It is instructive to consider how this took place. and whether future improvements in NRC activities could decrease the liability to such lapses in the future.

A discussion of NRC criteria related to fire prevention and control is given in Section 3.2. At theguidance.

or time of the Browns Ferry licensing reviews. Very little was available in the way of Criteria '

This was mirrored by the absence of significant attention to fire prevention and control in both licensing review and inspection programs until more recently. Thus although some attention was paid to mitigating the consequences of fires, the NRC program in fire pre-vention and control was essentially zero.  ;

/

More recently, too late for the Browns Ferry design, the NRC program has made some progress, and still more improvement is planned for the future. Information regarding fire prevention and control is now called for in SARs; Regulatory Guide 1.70, issued in Scotember 1975. sets forth ,

this information requirement. Guidance for regulatory review of fire prevention and control is now given in Standard Review Plan 9.5.1. " Fire Protection System." (April 1975) which includes l y

detection. extinguishing bystems, assistance from offsite fire departments structural design of i f fire prevention systems, control of combustible materials. and operaWI considerations.

Criteria for separation of redundant electrical cables. to mitigate the effects of any fire that might occur, are under development as discussed in Section 4.3.4. Some research programs related to fires in electrical cables are discussed in Section 3.4. In addition to the Bulletins and -

inspections (18. 23. 52) after the fire.1E nas revised inspection plans to include prevention I and control in the NRC inspection program.

At the present time. therefore. NRC has programs in fire prevention and control research, stan-dards and criteria, licensing, and inspection. The Review Group believes that these efforts should be continued. expanded as needed and as recormended in various sections of this report.

and coordinated to form a more coherent regulation program for fire related ntters in a timely manner. ,

6.3.1 Desinn and Operatino crite-ia The facility apparently conformed to applicable criteria and guides when it was approved. yet design deficiencies are now apparent. Some criteria and guides are now known to need improve-ment, and also the conformar.:e was not complete in some cases. ,

2 The need for improvement of design and operating criteria and guides in various areas is dis-  !

cussed at some icngth in the technical parts of this report. A list of the areas is as follows:  ; e 1.

Fire prevention: establishment of design basis fire; application to fire zone rating and '

f protection requirecents (Sections 3.3.1 and 3.3.2). *

2. Comprehensive standard for fire trotection design criteria (Section 3.2).

i n'

3. Developrent of standard combustiollity tests for cables seals; acceptance criteria (Sections 3.4. 3.4.1 and 3.4.2). "

l 4 J Developrent of tests for effectivaness of coating materials to decrease cable fire hazard (Section 3.4.1). E g

5. Development of standard tests and acceptance criteria for fire (etectors (Section 3.5.1).

l h S

d - -v

M.

' 57 6.

Development of standards for fire protection and other aspects of ventilation systems -

(Section3.5.3).

7. Developnent of standards for conduct and evaluation of fire fighting drills (Section 3.5.5).

8. Improved criteria for physical separation of redundant cables (Section 4.3.4); region of fire influence, fire zones. .

9. d Standards for intersediate quality class of instruments (between non safety and IEEE 279) for post-accident monitoring (Section 4.4).

4 6.3.2 Quality Assurance The Browns Ferry QA program for operations is on page 24-30 of Appendix 0, FSAR. It was bdged to be acceptable thent it would not be acceptable by today's standards. In one sentence, the SER (48) finds it " meets all the requirements" of 10 CFR Part 50, Appendix B, the only guidance then ayallable. ,

As described in Section 5.1.2.1, the TVA program for QA at Browns Ferry is being upgraded. It 2akes time to write, staff, and implement a substantially improved QA plan. But the length of time NRC has allowed TVA for development and implementation of the upgraded program seems excessive to the Review Group. In view of the great importance of operating CA to the main-tenance of safety. the Group recomends that NRC p oceed promptly with any remaining QA upgrading needed now in operating reactors.

6.3.3 Inspection of Licensee Operations  :

The fire revealed operating deficiencies. Examples cited in the PRC Investigation keport (5) incisde failure to coordinate adequately the fire-fighting activities, the efforts to *estore <

equipment operability, the activities construction and operating personnel performed during the fire. These deficiencies, of course, could not have been specifically evaluated by NRC in sper* ors prior to the fire. Other deficiencies included inadequate comunication and manageeent response to several previous small fires. To the extent that these deficiencies might have been .

reflected in written procedures, routine operating activities, or poor operating practices, they should have been observed and evaluated by NRC inspectors.

For many of the items cited above, there are no clear cut requirements or regulations against '

which the inspector can compare the licensee's performance. The statements that operators should "do a good job" or that activities involving various parts of site organizations should j-be "well coordinated" are general and provide no specific basis for inspection. Additionally, <

.7 individual items which might indicate departure from good practice or :afe operation may not cf '

q i Gemselves be of sufficien'. importance to require strong remedial action. On the other hand. '

=

inspectors can and do identify general areas of poor performance or marginally safe practices. '

but without specific require w nts, enforcement actions are very difficult to justify.

Reference (60). the inspection history of Browns Ferry contains a number of examples of an NRC inspector pointing out areas that he considered to be poor practice. Although most of the , 3 examples of poor practice did not contribute to the Browns Ferry fire or its consequences, they - '

do illustrate an inspection difficulty. In many of these cases there were no applic'nt com.  !

nitments, NRC requirements, or applicable industry standards to support the inspector's con- 1 tentions. In these cases, the NRC inspector requested guidance from NRC Headquarters. The j y documented response to the inspector's requests contained in Reference (60) is undoubtedly not 4T as specific as the inspector would have desired. i j ge The Review Group understands that additional oral guidance was provided. In many of the areas

! discussed by the inspector, and many others, enforceable, decumented guidance on " good practice" f.

is still generally unavailable. It is stated by IE to be present practice to resolve issues i 'Qi raised by inspectors and to document the resciution. i "

w l

Inspectors are more effective when there are enforceable criteria and re:.uirements against which I to inspect. Industry standards have been developed and adopted by the NRC staff covering areas . .

of good practice that were not available for Erowns Ferry. The peview Group recognizes how- . S,8 ever, that inspectors will continue to have difficulties because enforceable standards of go9d practice wi)) not be available in all areas. Inspectors will continue to identify instances they consider to be poor practice. Although there are procedures for these issues to be resolved M by NRC ra9agement. these procedures should be reevaluated. In the reevaluation. the NRC staff q  %

M should determine whether the procedures are ef fective in providing prompt incorporation of good M suggestions into the inspection and enforcement progran and into the licensing review.

g n Y i

= p a gm ,,m '%.-

m. _ w y 3e.9,... 6

w....

' ~

The Review Group believes the inspectirs' f ack of attention to' fire protection reflected a sf-11ar lack in the licensing saf;ty svaluation. . Construction permit safety evaluations now being performed in accordance with the Standard Review Plan include much greater emphasis on fire protection than was the case in the Browns Ferry safety evaluation. Efforts are now under-

', way to modify the Standard Review Plan to take the Browns Ferry, fire experience into account.

Present and future safety evelaations provide more specific fire protection reqJirements and criteria for the inspector to inspect against. The inspection program is being expanded to reflect the improved Itcensing review of fire protection.

6.4 NRC Action Durina and After the Fire Much of the inforration on which this section is based came from personal com mications from the NRC personnel involved to one or more sembers of the Review Group.

6.4.1 Durino the Fire and the First 24 Hours Afterwards The IE Region !! duty officer was notified at 4:00 p.m. by 'he licensee and .. *ectors were dispatched to the site. Tt ey arrived late that evening. Tne NRC Region Of/ ice in Atlanta is relatively close to Browns Ferry. Other offices, especially in the West. are f*rther from some

. of the reactor sites. Therefore, even using the fastest transportation available, several hours -

will. in general, be the miniewn time required for inspectors to reach a site af ter being notified.

It would be desirable to develop alternate modes of transportation for emergency use to ensure that undue delays are not encountered. '

As far as the Review Group was able to judge, the NRC Inspectors at the site and in the Region

!! Office carried out their mission during and innediately following the incidect in an exempla-ry fashion. ,

The group of IE and NRR management and technical personnel gathered at NRC Headquarters had a mission principally precautionary and informational in nature. They quite properly believed that their role was to stay knowled;eable as the incident ran its course, to consider various alternatives available for various possible contingencies. to act as a source of information to government people. and to be helpful to Regiog !! or the licensee if weded, e.g., for technical consultation. Reference material was quickly assembled accessible to a Headquarters emergency center. to be ready in the unlikely event that Headquarters action would be needed. In this incident, since no need was indicated. the only consideration for the Review Grous is the test that was performed of the system by the event.

The Group believes that the Radquarterr. cadre actually assembled on March 22 23 was knowledgeable and functioned well. It is not clear that qualified tack-up personrel would have been available in the unlikely event the energency had beer. signif 4antly prolonged. The Group suggests that some attention be given to assuring that enough management and technical talent are available so that unexpected prolongation of an incident will not find the Headquarters cadre too tired to function as well as it could.

The use by NRC inspectors of coernercial public telephone comunication from the site to Region Headquarters was not always satisfactory in this incident; telephone lines were in short supply.

At other sites, there may not be any phone lines available to hRC inspectors during an incident or emergency.

There Is no ideal solution for the connunication problem. The onsite staff is stragg'.ing with the fire or other incident bit there are many people who need current infomation for readiness and/or action. On paper the chains for information look great. (Twosuchchainsara (1) Plant operators - TVA Central Emergency Control Center (which has parts in three different locations) -

press and local governments; O) Plant operators - onsite hkt inspectors - Region 11 Office -

NRC Headquarters - government officials.) The well-known game of " password" shows how poorly information is transmitted through such chains.Section IV of the NRC Inspection P.eport tells of some specific shortconings. The Review Group was informed of one instarte where two *tople at Region !! Headquarters were receiving contradictory information on telephones, cnt t t the

, NRC inspector at tre site. tre other from the TVA center.

~

The Review Group telieves that improved comunications facilities are feasible and should be provided. The Group has been told that transportable (suitcase) two-way radios are being con-l- sidered for purchase. The Gr:up recomends that the problem deserves a deeper studf and more i expertise than it is able to tring to bear on it. and that a systems study (who shoJ1d comuni- 4 cate with whom, when and how?) is at least as important as purchase of equipment to supplement 9

the demonstrated problems of relying on pubile telephone lines.

l

)

= .

i ge w+, ,e --g- p- e--- r m - ---yw ~ v - - , -y -

. ~

, '9  ;

9 i

During the i cloent. the saf1ty decisions were maw by the plant operating staff, as is proper.

Presumably, ]

i felt the nee f the NRC onsite inspectors. Region !! Office staff, or the Headquarters cadre had of questioning any decision, this would have been comunicated to the operating staff with w :tever j force or urgency would have been appropriate. The Review Group is not aware  ;

of any such covunications during this incident. The Group has no recomendations for any j change (exceptiimproved canunications) in this NRC approach to safety during the course of an incident. Distance. inevitable comunication and inforination difficulties, and the unexpected j things that occar. 9ardate the ad hoc responsive, admonitory NRC stance. One does the best one -

can in the cirtwstances; the GRiupTelieves that the NRC groups did very well.

\ ]

6.4.2 lAej March 23. 1975 '

~

During the first 6 weeks of this period. ![ had the lead responsibility for NRC action on Browns Ferry. i A group of NRC inspectors were detailed to the site throughout this periodi during critical times, around the-clock inspection coverage was maintained. j

\

The role of the onsite inspectors, as perceived by them and their management. is to stay know- l I

ledgeable 08fice about and NRC whati f s going on-to watch and comunicate with tne licensee and with Region !!

Headquarters.

The inspector should be as helpful as his judgment and his primary  ?]

responsibility allow.\without infringing the licensee's safety responsibility. The Review Group i understands that a certain amount of admonishment of licensee staff by the inspector is par for '

• the course. The inspectors also feel a responsibility to have an informed opinion about the 3 saiety of the plant and to comunicate this view to their management. 4

\

Af ter tLe Browns ferry i'f re. an important and time-consuming job for the inspectors was to '

conduct the NRC investigation, which was started imediately. The Investigation Report includes the reports of 171 interviews with participants in the incident. Another job was keeping Head. 3 quarters infortned regarding the still-changing status of the plant, and relaying inforination e  !

about the incident (as it was uncovered and pieced together) to the concerned and curious. '

)

\

It is the Review Group's impression that the onsite inspectors were very concerned with plant safety, and took pains to stay informed. As temporary repairs were made and safety readiness was improved, the inspectors expressed increasing concern that procedures should be implemented l j for jeveloping, reviewing, approving, and documenting any changes. Concern was also expressed  !

i regarding the potential for unreviewe.1 " improvements" to decrease the overall safety of the facility. The inspection team at the site included technical specialists (operators. electri- l 3 cal, instrurrentation) as r.eeded. -

}

However. en IE rianagement individual has stated that the inspection function needs the 3dded 3 technical evaluation capability of NRR as part of the NRC effort in an emergency and its after- l math. For this reason, even during the first few hectic days. the inspectors at the site con-f l

sulted with NRR staff regarding plant safety and the acceptability of some proposed changes. In i l this view. IE does not have the ability to do a complete technical review of plant safety. The l continuous infomal consultation between IE and hRR staffs is needed 50 the inspection and the  ! 1 itcensing staffs can each perfom its function. (See Section 6.2.3).  ;

Beginning with the NRC inspectors at thh site on the evening of March 22. the NRC evaluation of $

the safety of Browns Ferry changed with time in accordance with the needs for safety assessment and decisions. The onsite inspectors and the cadres at both the Region Office and the NRC 3l ]

Headquarters followed closely the safety problems of the fire and its early af termath. NRC Headquarters personnel visited the site for firsthand briefing on March 24. Other visits followed ] 1 for investigation and safety review. j

• a L

The evaluation and 4%oring of both the safety of the plant and the response of the licensee {

continued with IE tung the lead responsibility. I '

MRR staf f members consulted viewed their role as' helping IE who "had the lead responsibility." ,

In the view of most everyone the Review Group talted with, NRR was indeed helpful to IE during '

. this period, but was most careful not to "take the lead." Although IE was generally aware of l the safety of the plant, neither IE nor NRR conduct 9d anything like a complete technical review '

of the safety of Browns Ferry during this interval.

On April 15. TVA requested changes in plant technical specifications stated to be necessary because of the fire. Hinor changes were proposed to toe Limiting Conditions for Operation and an associated section of the Surveillance Requirements. and were ganerally intended to describe core properly the actual plant status and capabilities. 'scraally request for changes in Technical Specifications would be reviewed by NRR and acte:ted, rejected or modified. However, in this case, hRR took no in*ediate action.

5 4

3 The prevailing view 12 NRR appe'ared to be that none should be taken until IE transfirred the l i " lead rIsponsibility' or identiffev the portions of the problem to be handled by NRR in accor-  !

f dance with* the previously discussed memo concerning lead responsibility. (See Section 6.2.3). '

1 Although NRR took no action relative to the imediate status of the plant, on April 17. the

, Acting Director of NRR sent a letter to TVA. setting forth information requirements and con-ditions t3t would have to be fulfilled before TVA would be permitted to begin the various steps of reconstructing the plant. These information requirements included TVA design information and safety analysis for the proposed changes involved in each step. The amendments to the license ,

and the technical specifications. their TVA safety analyses (3), and their NRR safety evaluations (9), are the results 50 far of this effort.

A decision to turn over lead responsibility was made and firally accomplished on May 5.1975.

Just prior to and in anticipation of the turnover. NRR personnel went to the plant with the purpose of reviewing the safety of the plant in detail. As a result, numerous changes were made to the Technical Specifications just after the turnover of lead responsibility. These changes were not trivial. They included the following:

1. Testing of Unit 3 equipment was stopped until the evaluation of the effect of such testing on Units 1 and 2 could be made.

2. Certain changes needed to improve plant safety were required to be implemented promptly.

3. Routine maintenance proposed by TVA for core cooling equipment to take advantage of the forced outage was not allowed.

4. Requirements fer monitoring instrumentation and periodic surveillance were revised to be consistent with the plant configuration.

5. Requirements for availability of safety equipment and energy sources were revised consistent with safety needs of the shut down reactors and with the plant configuration.

]

6. The required shift operating complement was increased to account for the many remote manual '

Safety operations made necessary by the fire damage. '

These revised technical specifica ons deemed by NRR to be needed would have been just as valid before the " transfer of lead respon bility" as af ter. Although some of the information which formed the basis for the Technical Sp ification changes was developed over a period of time 4 after the fire, most was certainly avai ble well before the changes were made. Thus, the Review Group believes that there was an u ecessary delay during the six weeks of March 22 -

May 5 before t'e detailed safety review of he post-fire configuration and the concomitant specification changes were accomolished, _

g l

. n '

After NRR accepted " lead responsibility." the NRR licensing and inspection functions and inter-rfaces caused no unusual problems. The Review Group has not evaluated the TVA proposals and NRR {4 evaluations that constitute part of the still incomplete licensing process for restoration of g

Browns Ferry. Neither has it probed any further into the concomitant inspection program. <

It is evident to the Review Group that the division of responsibility between NRR and IE did not function adequately during the period just after the Browns Ferry fire. Whether the failure occurred because of or in spite of the management directive regarding lead responsibility is

{

unclear. In any case, someone should have seen to it that a complete evaluation of the safety I of the plant was performed no matter who may have been designated as having " lead responsibility." , l The Review Group recomends that the procedure followed by.NRR and IE in evaluating the safety of the Browas Ferry plant from March 22 to May 5 be revised so as to ensure more tinely, com- "

prehensive arid detailed safety evaluation of a plant in difficulties. The concept of " lead i responsibility" should be clarified, to delineate how the ongoing licensing, inspection and /

reporting responsibilities are to be coordinated and where the decision making lies. Considera- (:

. tion should be l veni to designating a named individual to be in charge of an incident review.

For the Browns Ferry incident. there was an i~ Chief Investigator, an NRR Project Manaeer, an -

NRR Task Force Leader, and an NRR Task Force Coordinator- plus a Review Group Chairran, ,

+

1 1

i L-

\ .

l l

\ } l t

l f

~~" "

,,.,n. ...e -w < '

e

61 7.0 RESPONSE OF OTHER GOVERNMENT AGENCIES 7.1 Sunnary .

The TVA Radiation Emergency Plan was implemented at 3:20 ps.. March 22. 1975, to the extent that i' A notified designated State agencies. which in turn stified local government personnel and princts a cupoort agenices. Several individuals could not be contacted, particularly at the tecN W. .. nd the States' attempt to notify these local officials was stopped in less '

than ore .m .f

• t it cormenced.

No as U',a vis r,uired of any one except for initiatio's of environmental air sampling around ,

the sit '.; ., ', tale of Alabama Environmental Health Laboratory. TVA radiological assessment persemel corducted radiological monitoring in th6 imediate vicinity of the plant environs.

The State of Alabama conducted air sampling by devices located several miles from the plant i site. No radiation emergency existed.

7.2 State Governments 7.2.1 Alabama Acct,rdingtotheAlabamaRadiationEmergencyPlan(64).theStateHealthDepartmentwilldeter-mine the classification of an incident in one of four categories, all based upon varying degrees of radiological release from the facility. The Alabama Department of Public Health, located in Montgomery has the re'sponsittlity to maintain liaison with the Browns Ferry operators and to l' keep the State of Alabama Civil Defense Department informed of planning and emergency conditions.

The Health Department is responsible for all radiological and health espects pertaining to an incident. The Civil Defense Department coordinates all activities of other supporting State ar.d County agencies involving actual operations (evacuation, etc.). 3, i

On March 22.1975 at 3:40 p.m. (over 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> af ter the start of the fire), the Director of Radiological Health for the State of Alabama Department of Public Health (DRH) was notified by 1 j g the TVA Environs Emergency Director located at Hussel Shoals, Alabama that the Brown's Ferry nuclear plant had a fire in the cable spreading room and that both operating reactor units.had l 1 1

scramed. An attempt was made to notify the State Health Offices at 3:40 p.m. without success. .

4 j At 3: 45 p.m. the Alabama DRH notified the Alabama Civil Definse Department and subsequent to I 1 that the "Tri. County" Health Officer, of the fire and also that there had been no release of radioactive materials. The tri. counties consist of L W stone. Lawrence and Morgan Counties. {

The State Civil Defense Department was advised t%t radiation levels were not above permissible I

l

]

levels but that the Civil Defense Department emergency plan notification procedures should be ', 1 carried out. Th? " duty" representative attempted to cor. tact the State Civil Defense Director or his assistant ad the threc local governrent (county) Civil Defense representatives and j sheriffs. He was only partially successful and the "daty" representative discontinued all notification attempts af ter less than ore hour from having been t'.otified. Alabama and the 'j i, involved local governments should reassess and strengthen notification rethods and procedures between State and local government agencies who may be called upon to respond to an emergency. 1 ]

a Periodic contact with exchanges of infornation was mait.tained between the Alabama DRH and the '

TVA Director of the Central Emergency Control Center (CECC) during and subscouent to the fire.

Sometime between 4:45 and 9:45 p.m., the Governor of Alabama was notified by the State Health *

/ l Officer. The Governor's main concerns were: (1) whether or not additional State resources i were needed, especially the National Guard; (2) availability of adequate electrical power in 1 l northern Alabama; and (3) whether or not sabotage was involved. The Governor was infomed that [

no additional resources were required; electrical power was adequate and that the cause of the )

fire had not been determined as of that time. }

The AlaDama Highway Patrol was not officially notified by the Department of Public Health or by TVA, A representative of the Highway Patrol did becoce aware of the fire via local police j  ;

radio and offered his assistance to socurity guards at the sito but no action was requested.

1 4

5 1

1

~<

f brm.a r' - *a6% s_ _,,.m___ . __ . ,,

r __- o m g ....-. ,_ % % ..m_

l l

l l

~ - - - , - - . . ~ . , _ . .

n w & M e-- ~ Y

I I gg M Since there was no release obradioactivity and the incident was not of a type clearly classifiert in the TVA support and agencies. State emergency plans. standby action was not required of many of the offsite The Alabama DRH did perceive that the core cooling system was degraded and that it must be watched the ability to monitor plant leakage was questionable. and that confirma- I tion was needed that the main steam isolation valves had indeed been closed.

A " standby" classification appears to be desirable to cover incidents like the fire that have e potential for emergency triggering one of the radiological accident classification categories in the plans. I This " standby" classification would require that the licensee notify the principal State or local agency of the plant status, and would reconnend that the pertinent l I

offsite agencies who would be required to respond to a particalar emergency be contacted.  !

appraised of the situatic3, and directed to assume an alert condition until further notice. l They would remain in this condition until either the plant waa verified to be in a quiescent 1

condition or one of the radiological accident classification categories was realized. requiring further action by offsite emergency response personnel. l

(

Response on the part of the State Department of Public Health (specifically the DRH) appears to have been basically in accordance with the provisions of the State Radiation Emergency Plan. -

However, environmental air surveillance around the plant site by a s State did not comence i '

until sometime shortly before 5:45 p.m. when the Alabama Health La%ratory Director reported '

that environrental air sampling was beirg conducted at the Athens Water Treatment Plant, the Athens Sewage Treatment Plant in Hillsboro, and in Rogersville. Alabama. These locations are ( l several miles from the plant site. An air sampler owned by the State had become inoperative '

I and was removed for repair from the Decatur. Alabama air sampling station, which was in the downwind sector from the plant. No replacement sampler was imediately available but at about  !'

g:00 p.m. on the day of the fire, air sampling was instituted at this station using an air sampler fron another State agency (Air Pollution Control Comissien). On March 24th, the State collected water samples and milk samples from areas surrounding the site. Thermoluminescent dosimeters located at fixed monitoring stations around the plant site were collected and analyze.d. )

7.2.2 Tennessee The Tennessee Departrient of Public Health (Assistant Of rector of Radiological Health . ADRH) was notified of the Browns Ferry fire at 8:15 p.m., March 22 from the CECC. He was told by the CECC representative that a fire in the cable tray room had " wiped-out Units 1 & 2." The CECC representative aise advised the Tennessee ADRH that the first and second alternates for core cooling were "gone" and the third alternate was considered. The Tennessee ADRH was also told 3 i

that one alternate for the core cooling system left was to pump river water through the reactors T and circulate it to and from some ditches for cooling. He was also told that smoke was everywhere. J The Tennessee DRH notified the Tennessee Civil Defense Department concerning existence of the fire. The Tennessee ADRH centacted the Alabama DRH at 8:35 p.m. and exchanged information concerning the fire.

Tennessee Department of Public Health officials were unduly alarmed by the unfortunate language 3 used by a CECC representative to describe the 1:cident. CCCC spokesmen need to use more care- 5 ful pnraseology in comunicating the facts surrounding any incident without inciting undue alarm or apprenension on the part of offsite agencies.

Neither the NRC or any other Federal agency has any legal authority to require that State and local governments develop or improve Radiological Emergency Response Plans in support of fixed ig nuclear facilities. NRC regulations require that the nuclear facility licensee prepare an emergency plan and that an e ergency preparedness interface be developed amo 2 the nuclear ,

facility and of State and local officials and agencies. -

However, the regulations stoo short of requiring plans of the States and local governments t tnemselves. The approach of hRC and other Federal agencies toward solving this prcblem has been to provide training, puolish emergency planning guidance and persuade the States and local y f

, governments to accept and follow the emergency planning guidance.

A Federal interagency group with responsibilities for nuclear incident emergency planning conducts training programs for State and local government personnel.

The NRC. which has lead agency responsibility for helping States develop radiological emergency response plans, can neither require States to prepare adecuate plans nor provide conetary

• incentives to States; instead tne HRC must use persuasion to get voluntary cooperation. Since j 2

e

- - ~ -- -- - -

e

..gw%J.

a 63 i

intensifying'its efforts in this area in mid-1974, the.NRC has made progress in developing revised guidelines for radiological emergency planning, developing training programs, and in evaluating State plans.

However, it is not yet clear whether the NRC approach of working with States the public on ahealth

$1untary basis will result in improved radiological emergency plans for protecting and safety. '

The Review Group is concerned about this problem, but does not have the knowledge or resources to pursue it. Lapses in notification and response were revealed by the Browns Ferry fire. but no response was really needed in most cases. The Group can only recommend continued efforts to overcome the organizational, financial, and Constitutional problems involved.

7.3 Local Governments 7.3.1 Limestone County. Alabama

• The Limestone County Civil Defense Coordinator on the day of the fire could not be located by the Alabama Civil Defense duty officer. He received information concerning the fire nearly 2 Jays later. He also indicated that his copy of the Alabama Radiation Emergency Plan was not up-to-date and he had not received any infonnation concerning the plan in several years.

The Limestone County Sheriff was not officially notified of the fire except that he did receive some infonnation af ter the fire was extinguished. The State of Alabama Civil Defense Department i Jid attempt to notify him at 4:08 p.m. on the day of the fire but no answer was received. The  !

Sneriff did not hate a copy of the Alabama Radiation Emergency Pla. and had received very little information concerning his emergency, responsibilities in the past two years.

7.3.4 Lawrence County. Alabama Tae Lawrecce County Civil Defense Coordinator was officially notified by the Alabama CD at 4:10 p.m. Pertinent information concerning the fire was forwarded to the coordinator, but no specific action was requested of the Coordinator. An attempt to notify the Lawrence County ,

• Snerif f by Alabama Civil Defense Department was made at 4:08 p.m. but no answer was received.  ;

The Sheriff was not reached and no further attempts to contact him were made. 1 7.3.3 Morgan County, Alabama The Morgan County Civil Defense Coordinator was officially notified by the Alabama Civil Defense -

Jepartment at 4:05 p.m. However, the Coordinator was already at the Browns Ferry plant site when he received official notification because he had learned of the fire approximately 30

.ninutes after it had started from a local police radio system. No action was taken by the Coordinator to contact the Alabama Civil Cefense Department nor was any action apparently requested of him. '

The Morgan County Sheriff was officially notified by the Alabama Civil Defense Department at 4:05 p.m. Ho specific actie was requested of the Shariff except that he not inform the public in order to avoid' alarming the population. The Sheriff was newly elected (January 20th, 1975) and had not been briefed on the Alabams Radiation Emergency Plan, nor did he have a copy of it. '

He recommended that the principal support agencies in Morgan County should meet with the State of Alabama Department of Pubite Health and define the emergency responsibilities and update the i plan, j 1

7.3.4 Athens Fire Department s 1

The Athens Fire Capartment was contacted b/ TVA at 1:09 p.m. The Fire Department arrived at .

the site at 1:30 p.m., were issued film badges and dosimeters and were ready to assist by 1:45 i

. p.m. The Athens Fire Chief examined the fire area and about 2:00 p.m. he recomended the use  ;

of water to fight the fire. The Fire Department crew remained at the plant and was helpful to l' the operating staff. In particular. Athens Fire Department equipment was used to recharge air breathing apparatus.

The fire was extinguished at about 7:45 p.m. The Athens Fire Department departed the plant at 9:50 p.m.

/.3.5 Tri-County Health Department The Tri-County Health Officer was notified by the Alabama CRH at 3:55 p.m. ORH informed the officer of the si.atus of the reactor and of his opinion of the situation. *io action was taken by or required of the Tri-County Health Oe;artment.

e.e n%-.%w --*nn- w*

64 8

7.3.0 D 4 111s and Exercise tl With respect to drills and exercises. NRC reyulations merely levy upon the licensee the requirement for providing an opportunity for participation in the drills by "other persons h I

whose assistance may be needed in the event of an emergency." y HRC's Regional IE Of fices require that an emergency preparedness exercise, requiring implementa. E tion of the licenaces' emergency plan, be conducted by the licensee prior to obtaining an 2 operating license. As a part of this exercise, the interface indicating the capability for emergency response support on the part of the State

• and local governments is checked by IE [?

inspectors. Howeve", the IE inspectors do not insract State and local government emergency i response capabilities since they have no legal authority to do so. URC regulatiya (10 CFR '

1 Part 50, Appendix E) merely require that a supportive interface between the utility and the j State and local governments exists. i -

- 3 Although drills have been conducted involving TVA Browns Ferry personnel and the State over the 1 -

past several years, the drills apparently did not involve extensive local government participa- '

1 tion, if any. This can be gleaned from remarks made by two separate county officials that they 4 had not received any information concerning the Alabama Radiation Emergency Plan in several i years. The local governments' capability to respond appears to be extremely weak and is in i t need of improvement. ,

i k

The Pcview Group reconnends that drills and exercises to test the emergency interface between [

TVA, tne State of Alabama and its local governments should bc instituted on a regular basis, at 7 least annually. Where needed, other licensees should also institute adequate regular exercises -

to promote maintenance of emergency response capability by local governments. The Review Croup C has not studied the question whether drills involving the general public should be instituted and has no recomendation on this subject. 1

?

7.4 Federal Acencies I 7.4.1 Eneroy Research and Development Administration (ERDA) i ERDA has prime responsibility for 1mplementing its Radiological Assistance plan cnd the Federal Interagency Radiological Assistance Plan _. These plans provide for radiological assistance responses to incicents occurring in Feoeral agency or contractor operations, NRC licensed  ;

i operations, operations of State and local government agencies, and in the activities of private r users or hodlers of radioactive materials. ... . _.  ;

F At 7:00 p.n. On March 22nd, ERDA received a call from hRC requesting that the ERDA Emergency {

Action Coordination Team (EACT) activate the ERDA Emergency Operations Center (EOC) in Gerrantown,  ?

Maryland in connection with the incident at Browns Ferry. Specifically, NRC requested that i ERDA notify its radiological assistance teams to be alerted in the event that assistance was  ;

needed. P The EOC was activated at 8:10 p.m. by ERDA representatives. The ERDA Oak Ridge and Savannah  ;

River Operations Of fices wero ;nformed of the incident and asked to alert their radiological f assistence teams. The EOC was secured at 4:00 a.m. af ter it had been determined that the C situatic,n at Browns Ferry was under control, j 7.4.4 Other Federal Agencies Several Federal agencies, including the !.RC, have nuclear incident emergency planning respon.

sibilities assigneo in a Federal Register flotice dated January 24, 1973 (54). Two of these agencies also have radiological emergency response capabilities for responding to a radiological incident. g a

t The Environmental Protection Agency (EPA) and the Department of Health, Education and Welfare's +

Bureau of Radiological Health (Food a'id OrJg Administration) (FDA GRH) can field radiological l assistance teams to assist in radiolagical incidents. Tne Defense Civil Preparedness Agency -

(DCPA) can provide extensive resources to cope with disaster situations and possesses large quantities of radblo;ical survey instruments. EPA was the cnly ager,sy to be notified of the tirowns Ferry fire at or near the tir:e it occurred. This notification was received frcm the Health Lepartrent of the State of Alabama. Since no radiological release affecting ot' site aress occurred, tnere was no action required of these agencies.

n 5

3

- x j

~~ ~ ' ~ ~ ~

65 noecs, because of (he nature of 1.he fire at Browns Ferry with its potential for creating a radiological release affecting offsite areas. It would also have been prudent for the State of  ;

Alabama to notify FDA BRH and OCFA Regional Offices to alert them in case their assistance was required (short of implementLig the Interagency Radiological Assistance Plan - IRAP). If the )

1 RAP was implemented by ERDA. 'hese notifi n tlu s to these agencies would in all likelihood 1

have automatically occurred since all three are signatories to the IRAP, and have comitted their resources to the IRAP. 1 l

9 i

l I O!

3 y

?

, u y

+ x

.i

• i ,f

• f 5 1 7g f.

a

'f' X

J 1

e

• 6mee...

weaqs cow _ e,,a%-.s m., g -._

f 57 Preceding page blank e

REFERENCES The Joint Committee on Atomic Energy has published " Browns Ferry Nuclear Plant Fire, Part 1" containing testimony given September 16, 1975, and backup material including the entire text of ,

tne f,RC Investigation Report and license amendments with their Safety Evaluation Reports. This will De referenced as JCAE, p. xxx.

Tne I,RC Investigation Report is JCAE, pp. 218-685.

\

TVA nas submitted to NRC its " Plan for Evaluation, Repair, and Return to Service of Browns Ferry Units I and 2 (March 22, 1975 Fire)," dated April 13, 1975, with 35 amendments to date.

. This will be refe.. aced as TVA olan, p. xxx.

Tne TVA " Final Report of Preliminary Investigating Committee," May 7, 1975, is given in JCAE pp. 686-809 and also in TVA Plan, Part !!!, Section A.

1. " Reactor Safety Study," WASH - 1400, October 1975, Main Report pp. 6-56, Appendix XI, -

Section 3.2.1, pp. XI 3-:il thru 62. A

2. " Appointment of Special Review Croup," NRC Announcerent No. 45, March 26,1975 (reproduced as Appendix A to this report).

3. TVA Plan

4. Some of these are given in JCAE pp.98-117; others were in the form of construction drawings.

3. Reproduced in JCAE, pp. 218 685.

o. Jg . pp. 210-217.

7. JM , pp. 918 936. h 9

c. {CAE,pp.845-851.

9. Tne ones issued so far are given in M , pp. 963-1183. F

10. JCAE, pp. 686-809.

11. TVA Plan, Parts V-VI!!. E

12. TVA Plan, Part Vlll, Section C.

13. " International Guidelines for the Fire Protection of % clear Power Plants " Swiss Pool for the Insurance of Atomic Risks. Mythenquai 60, Zurich, February 1974 k

g at 1

14. " Fire Protection Systen," 'IRC 5tandard Review Plan 9.5.1, April 1975.

15. EJ, pp. 1189 93.

16. " Fires at U.S. and Foreign Nuclear Power Plants," NRC Memo T. Ippolito to 5. Hantuer,

'f7 hovember 3, 1975. This reference is more comprenensive tnan Ref (15), which is included in it, but less widely available. s a

17. " Interim Report - Materials Flanrability Testing for NRC." W. A. Rienl, Marshall Space i Flignt center, April 13. 1975 Appendix A-6 in IE Investigating Report, Jg pp. 502-23. .

Id. [CAE,pp. 194-l % .

19. " Report of Meeting Ir; roved Fire Protection and Prever. tion at :iuclear Power Plants." NRC T

• ema 1. 'n'. Panciera to All Meeting Attendees, August 27, 1975.

Y 4

4 2

,_.w- *

• n ,

. n ~~ r

!L 68 . '

s

. o o

to. NEL-PIA Inter' ffice Coninunication. John J. Carney to Engineers-in-Charge " Proposed Meeting on Fire Protection for Cable Systems." with attachments. May 23,1975 '

21. JCAE. pp. 476-478. ,

dia. JCAE. pp. 479 501.

22. " Watts Bar Nuclear Plant - Browns ferry Nuclear Plant Units 1-3 Cable Sleeve Penetration Test." TVA Memorandus J. C. Killian to F. W. Chandler. July 22. 1975, transm;cted in letter J. C. Killian. TVA to V. L. Brownlee. NRC. August 18,1975.

23. "$pecial Fire Stop Inspections." NRC Memos. 8. H. Grier to K. R. Goller. July : .1975. and October 24,197:i. .;

24. " Test Report on Cable Tray Fire Stop With a Polyurethane Ventilation Seal." Philadelphia Electric Company. April 3.1975: "Results of the Investigation and Testing to Establish o

Criteria for Fire Resistant Cables." F. W. Myers. February 17. 1970; " Peach Bottom Fire ,

Spurs Improved Cable Design." John Foren sik. Philadelphia Electric Company,

25. Letter Ms. Cornelius Hall. Chemtree Corporation, to Dr. Herbert Kouts. NRC March 26 l 1975. l

26. " Fiberglass sheet Blocks Cable Fire in Detroit Edison Test." Electric Licht and Power.

! June 23, 1975, p. 61. ~~'

27. Letter, R. G. Tiffany. Dow-Corning Corporation, to Dr. S. ll. Hanauer. NRC June 20. 1975.

,28. Technical and sales literature. Brand Industrial Services. Inc.

l

29. JCAE. pp. 137-8, 157. 927, 932.

30. JCAE. p. 927. i

31. JCAE. p.157. l 31, JCAE. p. 448, t

33. JCAE. p. 137.

M. JCAE. p. 927.

35. LCAF,,pp. 147-8. 257-277. 937 962.

1

36. Private Comunication from H. J. Green. i

.k

37. TVA Plan Part X. ,

38. " San Onofre Nuclear Generating Station Unit 1. Report on Cable Failures 1968." Southern '

California Edison Comany and San Diego Gas and Electric Company, NRC Docket 50-206.

39. " Fire Hazard Study-Grouped Electrical Cables." Fire Record Bulletin HS-6. National Fire '

Protection Association.

40. Private Comunications from L. Horn. Underwriters Laboratories to T. A. Ippolito. NRC. ,

41. Letter from William E. Caldwell. Jr., Consolidated Edison Company of New York. Inc... to Peter A. Morris. AEC. concerning November 4.1971 fire at Indian Point Unit 2. November,14 Qg 1971. NRC Docket 50-247.

g

42. Letter for William A. Conwell. Duquesne Light Company to Lawrence E. Low, AEC Bea'ver "

valley Station Unit 1. Fire at Motor control Center. October 31, 1971 NRC Docket 50-334. j}

• 3. Letter from F. A. Palmer. Comonwealth Edison Company to J. F. O' Leary. AEC. Quad-Cities unit 2 Fire. July 24. 1972 NRC Docket 50-265.

4 44 "Sumary of Meeting with General Public Utility Services Corporation." Ignacio Villaiva.

March 7. 1975. NRC Memo. Docket 50 363.

~

1. l a

l

1.' ,

6e

45. " Arrangement of Control Building Complex." P. J. Corcoran, in Proceedinos of the Specialists '

f Meeting a Control Room Destan. July 22 24, 1975. IEEE 75 CH 1065-2. --

46. " Qualification of Safety - Related Olsplay Instrumentation for Post -Accident Condition Y Monitoring and Safe Shutdown." Branch Technical Position E!CSB 23; Standard Review Plan 7.4.

g

47. FSAR for Sequota Nuclear Plant. TVA. Chapter 17. NRC Docket 50-327 contains the TVA organi. E

-zation and "new" QA information. Letters to NRC from TVA dated June 11 and August 5 t 1975, apply Section 17.2 of the Sequota FSAR. as amended by Amendment 22 in that docket, -

to Browns Ferry, Dockets 50-259, 2604 and 296. '-

48. " Safety Evaluation of the Tennessee Valley Authority Browns Ferry Nuclear Plant Units 1 ~

2. and 3 " AEC. June 26, 1972 NRC Occkets 50-259, 260, 296 p. 122.

49. TVA Plan. Part XIII. 1 1

1

50. "The Atomic Energy Act of 1954." particularly Sec. 101-110, Public Law 83-703, as amended. *

51. " Lead Responsibility Resolution Between R0 and L." AEC Memo L. Manning Muntzing to J. F. w O' Leary and F. E. Kreusi. December 29,1972. This is reproduced in Appendix 8. -

52. Every Licenses eith an operating reactor has filed an answer to the IE Bulletins; these 4 were followed up with IE inspections and in some cases with additional information from -

the licensee. All these papers are available in the NRC dockets.

f

53. JCAE, pp. 964-1037.

N 54, 38 FR 2356, January 24, 1973. r-

55. " Transfer of Lead Responsibility. Serial No. IE-C&O-75-7." NRC' Hemorandum to K. R. Goller, May 5. 1975.

p

36. Letter, H. J. Green, TVA. to S. H. Hanauer. NRC, October 10. 1975

57. " Summary of Meeting held on October 1,1975, at NRC Offices to Discuss the New Electrical 1 Penetration Seal and Fire Stop Design " NRC Memorandam Docket Hos. 50-250/260, October 10 .

1975. i

'I

58. JCAE. p. 230. Finding No. 18. a k E

39. LCA,E.p.153. y ..

60. " Browns Ferry Inspection History." NRC Memo Norman C. liosely to John G. Davis, May 30, 1975. 4p

61. JCAE. p. 18. '

4

+

62. JCAE.p.226. Item 2(c)(fromNRCInvestigatingReport). j I_

o3. "TVA Radiological Emergency Plan." December 20, 1971 Tennessee Valley Authority. i j i*  %

64 " Alabama Radiation Emerger.cy Plan - Annex B." January 19, 1972, Alabama Department of 'A

[ Health. E o5. "Ir.vestigation Report by the Nuclear Energy Liability and Property Insurance Association $

(NEL-PIA) " JCAE, pp. 810-842.  ;

e

66. " Physical Independence of Electrical Systems." Regulatory Guide 1.75. U.S.N.R.C.. February j ]

l 1974 2 l s I o?. JCAE. pp. 64 68. --

h i

l l

i e

h t

. .,* . E h

7/ ' '

Preceding page blank _

^

0 5  :

I a--

b

_E f

e I 1 1

l .

l

,s ,

I 1

i APPENDIXES  !

i -

I I

! I

- )

s  :,-

w a

1

=

1

?_

m A

m C

Xi

^

. u 4

+

4

. 1 e

it

, 1 E

l r

t i

a l's J

i =

1:

16 R2

?

. c

=r I

f I

t i

r

. 'l s

4 s

Y t;

3 2

c.

4

. , , . . . . . . , , ,g. .-me

-w weg-w- a w iwvy g -

y --

9%-- tgee.g-. -

g-

p

• • • • n Preceding page blant  ;

APPENDIX A .

N UNITED STATES l

R l C NUCLEAR REGULATdRY COMMISSION l ANNOUNCEMENT NO. 45 DATE: March 26, 1975 TO: All NRC Employees

SUBJECT:

APPOINTMENT OF SPECIAL REVIEW GROUP The following Special Review Group is appointed to review the Browns Ferry fire incident of March 22, 1975: ,

S. H. Hanauer, Chairman S. Levine W. Minners V. A. Moore V. Panciera K. V. Seyfrit The group will be assisted by consultatica from inside end outside the NRC staff as appropriate.

The objective of the Group is to review the circumstances of the incident  ; i and to evaluate its origins and consequences from both technical and i 4

procedural viewpoints. t  !

i i Technical considerations include the design criteria of the affected i equipment, its materials of manufacture, its installation and maintenance, I

and its degree of vulnerability to the conditions involved in the incident.  ;

In addition, the review will cover the information available during the y incident and the response of the instrumentation used to determine the j state of the plant. _,

Procedural considerations include the response of licensee and NRC staff groups to the incident as it progressed, communications among the people ,

involved, the measurements made and interpretations of them, and the support needed by, and available to, the operating personnel. ,

u..

NOTE: iv.Collinswasappointedlater.

)b. ,

M g

'M

/

" "~~ ~

-._-y- a N -'

. 74 2-The Group's review is not intended to duplicate, or substitute for, the necessary investigations by the licensee and the staff of NRC - -

I&E Region II. Rather, the Group is charged with marshalling the -

facts from these investigations and evaluating them to derivs appropriate }

proposed improvements in NRC policies. procedures, and technical l

requirements.

! l The Group should also identify promptly any other actions or investigations

! I that it believes should be undertaken for the safety of the Browns -

~* Ferry reactors or 17e obtaining additional infomation and insight regarding the incident.

t n

! b- . : $ '

e V. Gossick Executive Director for Operations i I

e r

gg

.W ma y 7,

J g

Of~l 11 m

s hk - u.

b5$'

2 gh u:

W~

s

-Y

mesmwre. - A 1

\ ,-

. APPENDDC B

. -s s' . UNITED STATES ATOMIC ENERGY COMMISSION I( [.Q..yf_f . .M. ,

weinovo .o.c. sosas

\ '.'j}  ;-._

" December 29, 197. '

LC F. O' Leary, Director .

irectorate of Licensing l F. E. Kruesi, Director j

. Directorate of Regulatory

- Opetations LEAD RESPONSIBILITY RESOLUTION BETWEEN RO AND L The Directorates of Licensing and Regulatory Operatiens both -

interact directly with licensees in matters encompassing the construction and operation of nuclear power plants and i processing facilities. There are certain functions which

• clear 1v ars the responsibility of one or the other of these i Directorates but also a spectrum of activities in which both have responsibi?.ities. The purpose of this directive is to i further clarify lead responsibilities where interfaces or overlaps exist in the functions of the respective organi:a- '

tions.

r Directorate of Licensing is responsible for:

_. Review and evaluation of proposed amendments to licenses and changes in Technical Specifications.

i

2. Applying and incorporating new regulations or safety i i guides. 1 4

3.

Providing interpretations of license conditions, Techni- ,

cal Specifications, FSAR's, and regulations. )

l

4. Reviewing and making decisions concerning modes of opera- )

tion which are different from licensing conditions, FSAR's, i or Technical Specifications.

5. Evaluating unreviewed safety questions. - -

.s The Directorate of Regulatory Operations is responsible for: .

1. Inspecting facility operations for compliance with regula- '

tions, license conditions, and Technical Specifications.

75 -

. t $5 s #

i 7=5 . t 1

,o 9

J. F. O' Leary December 29, 1972 F. E. Kruesi ..

1 ,

2. Reviewing facility operating procedures.

[

3. Verifying operating data submitted by licensees, j

4. Making component and system reliability studies. '

5. Sys, watic evaluation of licensee performance, Lead Responsibility - - -

t 1

The Directorate of Regulatory Operations has the lead respon-sibility for initial investigation and contact with licensees with respect to abnormal occurrences and operating difficulties during cons truction and operation of nuclear facilities. In cases where the licensee's operation can be returned to pre-occurrence status, the cause of the difficulty is understood, 1 and no significant design or operational adequacy problem?

appear unresolved, RO will retain lead responsibility. d_ -

Where, during its investigation, RO determines that problems i 1' j

have arisen which may involve changes in Tec.'4nical Specifica- i tions, modes of operation different from FSAR's, or unresolved I safety questions, RO will so notify L by memo, as described  ! ,'

in the attached procedure, and request L to assume lead  ;

responsibility. ,

s Interface Activities s

4 <;

Attached are a spectrum of activities which have be'en con::idered )

in discussions on interface problems in nectings between you 3 or your representatives with E. J. Bloch together with your -3 consensus on resolution of these problems as to lead responsi- -

~^j bility. The bases for these determinations are stated briefly .

where this is not obvious. The Directorates of Licensing and i

Regulatory Operations should assume lead responsibility I -

accordingly.

)

'5 s

L. Manning .untring s i j

- Director of Regulation

;f

Enclosures:

As Stated #

?

, t

,  : I e

s l{L Y Y+ $ N'5TA7e WC$N WbbYWW Yf??Y p

l

~

or V.

l PROCEDURE FOR DETERMINATION OF LEAD RESPONSIBILITY FOR ACTEPTABILITY OF VARIATIONS IN PLANT CONSTRUCTION AND PERFORMANCE AND EVALUATION OF ABNORMAL OCCURRENCES The Directorate of Regulatory Operations has the lead responsi-bility for initial investigation and contact with licensees -

with respect to abnormal occurrences and operating difficulties during construction and operation of nuclear facilities. In cases.where the licensee's operations can be returned to the pre-occurrence status, the cause of the difficulty is under- -

. stood, and no significant design or operational adequacy pro-blems appear unresolved, RO will retain lead responsibility.

Where, during its inve.stigation, RO determines that problems have arisen which =sy involve changes in Technical Specifica-tions, modes of operation diiferent fron FSAR's, or unresolved safety questions, RO will so notify L by memo, as described further below, and request L to assume lead responsibility.

In cases where it is not clear whether Technical Specification g changes, modes of operation different from FSAR's, or unresolved I safety questions are involved the following modus operandi will apply:

1. Problem Identification and Notification Norna11y, because of its surveillance of licensee opera-tions and the immediate reporting obligation of licensees to RO, RO would expect to be the first informed of an {

occurrence. RO will make inquiries, inspections, perform I independent measurements, if needed, and take such other '

fact gathering actions as are necessary. This collection of facts and identification of problem areas will be y; communicated promptly to L by RO:HQ. In case's where L *Ag has first knowledge of a significant occurrence,that j e

. organization will inform RO, thereby initiating the inspec- , ,

tion process'. ( ,

2. Preliminary Assessment Based on the inspection findings, evaluation with respect  ;

to license requirements, and the import of the safety -

y$

issues involved, the RO A/D for Inspection and Enforcement 4

. will outline in a memorandum to L a proposed course of -

action and designation of lead responsibility. This might (%

include: p s

. ? ,

e 0

M " ?!$2TMMhTMTM3^Wd@%%tutY#SM5MW ' Writ?@MMk

%. m .. ..-. _ , , .- , ._. - _ , , . _ - - -_ _ _ _ . . . _ -

2-

a. Retention of lead responsibility by RO. j.

b. Transfer of lead responsibility to L for resolution l of the requirements on the licensee. ,

c. Identification of some portions of the total problem -

to be handled respectively by RO and L by mutual agreement and designation of overall lead responsi- -

bility. ,

The memorandum from R0 to L, or vice versa, would be  !

serially numbered for followup and Icgging purposes. i.

Signature lines would include both the A/D for Inspection '

, and Enforcement,and the appropriate A/D for Reactors in l Licensing. The respective A/D's signatures would attest to agreement on responsibilities. No new memorandum is needed;'this represents further formalization of the exist-ing one. RO will render such assistance in the areas of l inspection and enforcement as L may request to meet their responsibility.

I

3. Resolution ,

Where agreement is not reached on a timely basis by the A/D's, resolution of lead responsibility would be escalated to the Directors or their deputies or to the Assistant Director of Regulation.

4. RO will issue periodic summaries cf outstanding problem areas for the purpose of prompting resolution and to help assure adequate followup actions.

I i

4 t

n 8

P1

'.*d 4;9 h.b 3.N s

e.4m3m - - e - mmw .ww-w w----

~&mbb L __. . _. __ _

LTCENSIr0 - RFIRJIKIDlIY OPERATIOrlS ACTIVITIFS ri lead Activity g Assigned Reason Review an1 evaluate applications for a L A licensirg action.

license I

i Review and evaluate proposed amerdrnents to L A licensirg action.

license and chaiges to Technical

, Spec 1rications

+ -

Apply an1 incorporate new regulations ard L 'the position being taken by Regulation in all cases i

Safety Guidec is 1:nown. L is aware of conpensating factors ard i

possibic alternatives. Timirs can be coon 11nated with amerdnent anVor change actions.

Provide interpretations of regulations ard 10/1. Both 10 ard L personnel tre frequerkly asked for I Intent of the license (includirs Technical interpretations of provisions in the regulations Specifications) and FSAR ard license. Such infonnation should be freely given provided that the resporder is certain that the infonnation is correct, as would be the case if supplanental guidance or precedent ande the answer clear.

l [ L Where it is necessary to establish an interpretatics:

l r

and when a given interpretation is challenged, as the unit that ig=wved ard issued the license, will provide the 'nterpretation. L will, when appropriate, obtain CJC agreercent. Even licensee i

l doctanenta, such as the SAR, art subject to L interpretation in that L ascribed a certain neanirg.

duriru the licensing process ard that neaning should be anintained.

i

- - - - - - - - -~..---- - -

.. j. _ _ _ _ ,_

i.

i

Icad gttvity, Asstrned Reason 4

In:tpect fac*11ty crerution for conpliance with IO hequently visit site and say readily observe Ngulation ani license (including 'lVctutical operation and inspect reconts. Well es'..ablished Spect ricattoru) responsibility.

Review the adequacy or facility operation 10 Procedures ar not part or subuittal for racility p:vcedures licensing. Well s tablished tysponsibility.

VerIrication or data suledttal by licensee TO htquently visit site end troy readily obse.ve aint possibly prxide supplementary operation and inspect reconis. Well est.ablidsed information responsibility.

Administer enforci ent program RO A najor objective in the ID inspection pro 6 ram

+ ", is evaluation of the sarcty of licensee operations, '

including detetuining ir violations of regulations and license conditions have occdrred. If so, 8 subsoluent enforcement action by 10 is well-f established responsibility. In such enforcenent, 10 should ascertain that the violations will not ~

recur; this ibnction nay entail trquesting inrow h nation from the licensee trganling the physical i layout an1 nonagerent of the racility, measures taken to prevent recurrence, measurrments or tests performal or similar inforsution. In enfortement actions, L should be advised in a tirrely manrw of all enforomnt actions, and stould concur in ones sent, fttm 20-19Q3. .

L Rcquests for des 1En analyses and modifications slos be nede by L even though recoEpition or their need noy arise in connection with an enrottement matter.

4 TIJ?d %"3'~.C 2Yf M W M <

. ,g,

! l l

tcad Activity Assigned i 1 lleason i

i e

' Detennines acceptability or variations in IO/L plant perfonnance, includits mies of Procedum for estab11ahlrg and transferrirg lead '

operation dirrerent from the FSAll respons1h111ty is attached. +

l Evaluation of abnorral occurrence h0/L Same as above.

License operatora a .d evaluate operator L L perronns operator licensirs includfrg evaluet%

. performance g of conpetence ard issuance ~ and renewal of 11ces. ..:

Well established responsibility, 10, during the ~ '

inspection program, provides infonnation relative to the cospetence of licensed personnel for L to factor into its evaluation. IiO also verifles that i the initial ard rwtrainirs prvgrarrn have been corducted ln acconiance with the

• regulations ard ,

the licensecs' coninitments.

em Corduct Managem-c.t Systems Inspection ID ~

10 cocducts inspection as with all inspections.

L should have opportunity to provide irput ard

- discuss 10 conclusions prior to final interview

{ with licensee management and agy participate in this sneetirg.

I I

i t

t b

t f

-o . r p ; , ._ u ,_o - -- -

.1) 1.g g- . ) h

7--

82 I E

n

-F APPENDIX C

'C ai FEAS! Bit!TY OF RETROFITTING EXISTING DESIGNS TO PROVIDE E REDUNDAhTJ ABLE SPREADI M ROOM 5 l i

(

+

Section 4.3.4.4 of this report discusses the fire zone approach which the Review Group recommends I for consideration for new designs. Redundant cable spreading rtoms are a part of the fire zone approach.

NELPIA(Reference 65)recommendsthateachunithaveaseparatespreadingroom. 7 Both the 14ELP!A recomendation and the fire zone approach involve additional ceble spreading * -

• rooms that do not exist in many present designs. The NELP!A reconnendation was discussed at -

the first session of hearings on the Browns Ferry fire conducted by the Joint Comaittee on y Atomic Energy on September 16, 1975 (61). Interest was expressed at the hearing in the cost to 'i

, retrofit nuclear power plants with separate cable spreading rooms for each reactor unit. 1 f 7 The Review Group concluded that although the adoption of the fire zone approach would ertail

{

additional cost, the increased cost would not t:e prohibitive if the approach were adopted at  ;  ;

the beginning of the design effort. The cost of adopting the NELPIA recomendation 4)so would ,

s pr'obably not be prohibitive provided it were factored into the design early. The purpose of this Appendix is to consider the feasibility and cost of retrofitting existing designs to $

provide additional cable spreading rooms. T Estimating the cost of retrofitting to provide additional cable spreadiag rooms in existing -

designs involves a number of difficulties. Because of differences in errangement and design. 4 q detailed design and cost study of each operating plant would be required for an accurote cost estimate. Tne cost for plants under construction would vary considerably with the state of h[

construction. Similarly with plants being designr b the cost would vary depending on the 1 degree of completion of the design. g

?

In the design of nuclear power plants, a design and arran ement approach is developed that considers many interacting and overlapping requirements. major change in approach such as providing additional cable spreading rooms which would involve structural c6anges to existing $

Seismic Class I structures, massive rerouting of cables, and control room redesign would require  %

careful investigation of all design requirements previously considered. The risk of overlooning

• requirements previously incorporated in the design is very real. The chance of mistakes and h oversights seems to be greater when making major design changes and facility modifications than 4 in the original design effort and construction. R w

The HRC staf f requested TVA to justify why they did not consider total independence of redundant k systems in their restoration plan. Although this request extends beyond provisions for additional 7 cable spreading rooms. TVA's response is of interest when considering retrofitting for additional 6?

spreading rooms. TVA's response of August 21.1975. (attached) estimates the capital cost i associated with retrofitting to complete separation to be $100 to $300 million. In considera- .-Z tion of plant down time which might be required to accomplish such major changes. TVA estimates an additional 500 million to 1.3 billion for replacement energy costs.

g g

5:

The Review Group recognizes that the TVA study was approximate and included separation concepts Q other than provisions for additional Cable spreading rooms and also irvolved a Complex three Q

' unit plant. Even arbitrarily scaling the TVA estimates down by a factor of 10. however, would .y yield large costs. S

~

Altnough no detailed design and cost study was mada, the Review Group concludes that a require-ment to retrofit to provide additional cable spreading rooms would result in large costs, long I

outages, and long delays in plants now in design and construction. If additional cable spread- y ing rooms were the only way to provide an adegaate level of safety, the costs. power unasail- i ability, and delays would have to be borne by the utilities and ultimately by the electricity p users. The Review Group has concluded. however, that as discussed in Chapter 4 there are other y more practical ways to provide the desired imprevement in fire protection for operating plants. ,1 plants under construction, and plants partially designed. L

=

a Y

y 1

o' f

t y

pwnom

• l 83

- 6 831 Power Building

• TENNESSEE VALLEY AUTHORITY g ' CHATTANOOGA. TrNNESsEE 374ot

?g . n*,&

J '

August 21,1975 c: l ATTACitiENT TO APPENDIX C

%,_*'"' ~,

• o,", .*%

Mr. Benard C. Rusche, Director, -8 office of Nuclear Reactor Regulation ' .,'

,~~

U.S. Nuclear Regulatory Commission **

a Washington, DC 20555 '

Dear Mr. Ruscher In the Matter of ) Docket Nos. 50-259 Tennessee Valley Authority ) 50-260 on Jcly 3,1975, members of your staff requested by telephone l that we justify why TVA did not consider total independence of l a redundant systems to the point that a fire could burn indefinitely i ,

I without any reliance on fire-fighting activitics. The following * '

constitutes our response.

j j ,

Since the fire that occurred in March 1975 TVA has been engaged in a major effort directed toward reducing the prehbility of  !

'I occurrence of fires at Browns Ferry, toward limitics the extent  !

of propagation of fires, and toward minimizing the effect of fires to ensure safe plant shutdown vader any credible circum-stances. We believe that the 14k=14Wd of a fire that could jeopardize the safety of the plant is of sufficiently low prob-ability that public safety is assured.

Beyond those changes currently being undertaken to minimize the probability of occurrence and to =4 infre the effects associated with a major fire T7A has consider,ed various drastic schemes by '

which we might significantly modify the Browns Ferry Nuclear Plant i to accommodste a fire under the assumptions that no fire-fighting 1 action is taken and thet a fira at any location where fires are ,i possible is allowed to burn to extinction. Sche =es which we have  :

considered include enclosing all cables in conduits, use of armored cable throughout the plant, and complete zonal separation such that ]

1 complete destruction of all equipment in any given zone would not prevent safe plant shutdown. Such investigations raise nu=erous -} '

J difficult questions regarding the definition of a design basis event ',

and regsicding the criteria under which the design changes would be s important to recognize that such a design basis event j I

) Mc4 e\ a3,

'r ey' g 'O y

o (

kr y .. ,% "w h '

> ,,;;., , u ew an ,w, e,,,,, 9063 If i 5

35 w .. .

l .

I e =

l

\ __. . . . .

-. . . - , - . . . . - ~ - - - - -

r j .:

84 . .

f.

Mr. Benard C. Rasche August 21, 1975 has not been previously defined and that one of the major uncertain- '

-ties is the applicability of various regulatory requirements and regn1 story guides to such an undefined event. After considering '

various possible alternatives, we have concluded that it any not be possible to redesiga sad reconsecuct the Browns Ferry plant to - '

accommodate such a proposed design basis event, particularily in view of the fact that in addition to the event itself having not =

a been defined, the ground rules under which such an event would be ac-eted have not been defined. .

On the basis of a general consideration of the probles and on the basis of our knowledge of past history in designing for major new concepts of this comp 1ssity, we have concluded that it would require  ;

two to three years of very determined effort by TVA sad NRC to adequately defing the requirements and to receive regulatory concur-rence for the basis f a major new design concept such as this.

If it were deternised on 'he t basis of the preliminary study and definition that it were possible to make such modifications, we are -

convinced, on the basis of our knowledge of the plant and the natura l

of such a change, that a major reconstruction of the plant would _ _ _ ,

require an additional three to four years to complete. Thus, the total overall schedule for such a major change would approach that required for design and construction of a new plant.

The capital costs, not including costs of outage time for such an effort directed at the Browns Ferry plant or any other plant under construction, would be in the range of hundreds of millions of dollars, perhaps $100 to $300 million.

The plant outage time to accommodata such a redesign and reconstruction ,

would be from three to seven years, depending en whether we were per- I mitted to proceed with operation of the plant during the design and )

i

[ licensing phase of such an offort. l l

An outage of this duration would place a sem economic burden on  ! I TVA's customers and would seriously jeopardize our ability to serve the region's power requirements. The current outage at Browns Ferry ,

costs our consumers about $4 to $5 million per unit per month. We 4

f, l

~"

..-~,. wen- .. --

W-_ ee-etu+ m em--e - +ww=e=e- T-P-- ewe' er-e-&-e ce*ee-o-p--m---o-e-e.w+e-e==+ves--**t-*+ge med--i-r-ew-e wem ewe-'m?-e- d wr-hs Tw+r en F r+ t- c1-'-*W-*GP- -V '-"4 7

85

~ ) '

Mr. Benard C. Rusche August 21, 1975 estiasta that an additional plant outage of three to seven years would result in an economic burden to our customers ranging from $500 milliot. )

to $1.3 billion for higher replacement energy costs with our coal-fired ..

units and purchase power, if available. In addition, a three to seven l year outage of the Browns Ferry plant would reduce our reserve margia far below those desired sad in moes peak periods reemits in sero or negative reserves. This could require the addition of additional

• capacity such as gas turbines which would add another economic. burden to our consumers. Thus, the total costs of thi"-* modification would probabyw exceed the $600 million co-$1.6'hlbiit"mentinned above.

q.a;.1rg We reaffirm that the Browns Terry Nuclear Plant \. madffled following the fire which occurred in March 1975, is safe and that the current design precludes the necessity of redesigning the plant to withstand a major fire that is allowed to burn to extinction. Se also point out that, contrary to industry practice and over and beyond NRC require-ments, the Browns Ferzy Nuclear Plant was designed and constructed at great expense to accommodnte major damage from fire in the spreading room or in the control room without jeopardizing safe plant shutdown.

Furthermore, we point out that the Browns Ferry plant successfully withstood the effects of a fire in a critical location. In addition, the plant design and plant construction and operating procedures have been modified extensively bott to further reduce the probabilities of a fire recurring and to minir'.za the adverse effects in the extremely unlikely event that a major fire were to occur in a critical location.

In conclusion, we feel very strongly that such a redesign is not  ;

necessary to ensure plant safety, and that the cost of such a redesign '

would far outweigh the beaefit. If such a change was contemplated, an extensive and careful cost-benefit study should precede any decision to proceed.

l  ! -

Very truly p urs, )

3 Y -

J. E. C111 eland -

Assistant Manager of Power l

5 m,

g e

U

.y' w e.

)

2

- - - , . , - - . . v-., , - - - . , +,----,e. -.e.--,-.------w.------.,.,--,--e.- ,-.-----.,.-,----"-t+M- +v -,--i-t-cer si---- -m--+-t n--r-e- --rw--*. e ---+-'m+--**+-T'-Y Y"

- . . . . ; 3

.=- --- . . . _ . . -

+ ,

! , 6. \ , f

• 4sc. ,. 4r.

j *

. 's, . - , , . . . .

g ; . # .

m

.,.;,.* r- ' .

. ' f ', ;,'.

e.f

]*- g;~;, L,, ey

_ j~f((?:;: }:( ' , ' *

.w , y;. x

.;,. c . m: . . . w*- n k x ,:sp y ,*, . w[. , . . . . ; . m. .; .. .,.4 ,. x .;.,p.s . w ...m., 1 :

.' Q . '*. M ,

gb. 4 .- JS .%f .s.- * *j .

.t.

",,y t "?- f ,[~ I

Q%[. . ..

^

,. $<i;^~,.

&Q sh l 3 --

g f, f.jfe ;m.

_3s *& k y

a ($g.T

. & sff[fIf < yp s%' .J&\ .

\,

^'; ;

~

, .b Ih D -

'J~ . .

., + A[.pp &c sM um~w;- .e+

s w intsn y.pn i

'wq m x y..+, -: . .,

%n . e r; , ' . ,. v:=

.o

. ,y .: .a e w ,0. .... 2 Y. ',[ 4' .' 7'I ; t #[Q ' ,' T 'l i'"

• fM E

,..' 4, ~ *.i. . i. ,jsY. .f-- ."',O.'~

u. -- *,, .

. .: ,""f.. * -

-e . .

.4, . .

. _ v ;; ., ;- >..-  ;,. .

--)

4,,. -M .

- .g-

' r +

. ' , '-' .F 'f .- '

t - -

i

_* , / . 4_ -

..- - M. * . . .; . .. g

, , ' f !:- .

l-T3 y- 't , p',,,_ .

. , ~ 'g y, , " .

jg

") .' .-

, Y * .

I4 "I', -

e' 1 8], f , 'd- 4 l1 ^M: jg,. . }y,,: ej Q. *q Q.fc=;.;, y.;

'fj 9*k n fs. lmlC

• b';

.w .a.

-- g p, . ,

n .

'.p 4- Q~-

Q ~- ' '

_ , y $ 4- 4:y* ,=. Q_, L ,'" ,

4_

. f k ftf

~

.Q .

.3 (

M i

ec =.wwmam..

hv3 wga%n# we x.

.q.

. : :y e. ..,~ ...,.;.r ..:

-w 5.

v. . r..m . . , m. . ..c . ..

.. .+ g.,. .. ,. . n. . -w . . , . .

v&

4, . $h.p;N

. Y . a .i '

-;p ?, '^ y "

'.d C% h, p l)

' ' x[p '*N. fai.$

14 ch: n. -

DJM-:-  %; , -g

.> zy y

.y.y . ,

.y

• 1 - w y ,y.g ~ :. k. '

l 6 ) m. .s

. . - : c 4

.. . A, 9 ,q n a 4- '"

4 . ,_p . .

.A I  ?. * /*

II l _

.- x4 '.

_ k"WW L. ..-:En  ; M. .~ .2 l' ,4 A ,

, .x  % ,

j .U N

. a , .

.*** $ eg

n. .k .

W

$y

$$5

.yy* es- .?

^

r d _ f* 4 l L;A q,.

vc '. _ _ -

e n

.i* ' cr [g i s.i . ?

I

-W

,J :r c,444r "- 4 %4 -.USQ, e %_

Y^N hj k' h~

.W @@

i d'

% s T "

!4 W$s4M ,

DdM g 3@ 49

[ h, ,, . ~yy.y . ,, g -

tL  %

1 . 'T @(~w  % . n k $ gg.g n;

x6l@B&.s L k M '

M%

lg x & %we fn 2@e a

m m% r.:"jj %:UW.

w, m c:n nx .MMi ' '"  ;% w* t '&A .

v -

i.

U C,.

$w%we

.w m j1..

ac g.

1 v MM,M

~

, s;;.7 %%@h f..a '.W + 3 ?. - MW

? ..

% ,. %m "  ::.M .,

\ . .-

W . .-

m--. - . - . _ . . -.

- . - - . _ _ . . . _ _ - . . _ - _ _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ .