ML20128H194

NRC Staff Rept on Union of Concerned Scientists Petition for Emergency & Remedial Action

ML20128H194
Person / Time
Issue date:	12/15/1977
From:	NRC
To:
Shared Package
ML20128H138	List: IA-92-296, NRC Staff Rept on Union of Concerned Scientists Petition for Emergency & Remedial Action ML20128H135 ML20128H152 ML20128H194
References
FOIA-92-296 NUDOCS 9302160298
Download: ML20128H194 (189)

Text

_ - _ - _ _ _ _ _ _ _

~

e ico S 'ETc" l -

S

$- w--t, . DEC 1 ' 1977 >f c33, e ,.

NRC STAFF REPORT l E UNION OF CONCERNED SCIENTISTS' PETITION FOR EMERGENCY AND REMEDIAL ACTION December 15, 1977 M

i 93021g298921001 PDR QRYER9h,^-296-

"~~" * * -'" CC " *." 5SION

' U.S. M"c't

IXPw* .,<45

" "~~~.~.~I'w'N'

- n C.:T T CF

• T ; . ;* ?, W C g. ..... c Et, s... . . . ,

4/,4 0 $ 9efd9O$

CA' 'J.T.07.! '1!! A kC1

^

poi,t.r,-? r . .., _

Cop' ; _.

(, __

--Add > a .

Specb;L...iu..a.: C.k b] $ .dk

~

\ -..

N

+ .. .. . ~ . - , -

6 .

u

-. l i

_ . . - Table of Contents

(

,Pace ,

I. Introduction . . . ... . . . . . . . . . . . .-, _

.3.- :11 A. UCS Petition . . . . ._. . . . . . . . .:. . . ~ _l -

B. Commission Actions . . . . . . . . . . . ..7 3 C. Summary of Safety Aspects of Petition -. . . . -.- :4 II. Staff Response to UCS Petition . . . . . . . . -.= . . f6- -

III. ' Safety Considerations . . . . . - . . . . . . < . < . . 14 A. Fire Protection in Nuclear Power Plants , _. . .: .- 14-  : -

1. NRC Fire' Protection Requirements c. . . . . 14

2. NRC Fire Protection. Actions Following .- ,

Browns Ferry Fire _...=....s. . .-. . . --15 : ,

-3. -NRC Fire Protection Guidelines =Since -  ;

, Browns Ferry Fire . ..---,.......;....- 19

4. Plant Fire Protection' Staff Evaluation E -

Program ...........:.,1.y. .

. .- . . - 23-

5. Sandia Fire Protection Research Program: . . 27c 7

a. Cable Tray Fires --Test _ Description' . - 127--

b. Role of Cable' Flame Retardancy and Safety Divisional Physical / Separation _ .

1 Requirements -in Plant: Fire Protection. . . L31 "b

-6. Basis for; Continuationiof Plant Operation-

• and Licensing: _.z..- . o . t . x . _. . - . . - . . . . . . ; .

33 -

7.

Public Comments on:UCS Petition Relative t -

to. Fire Protection . .m. . :- . = . ,. . ..: . .'. . 13 8 .

B. -Qualification of Connectors, Penetrations.: and: .

Other' Electric Equipment Required -for. Safety .: 48

1. Introduction . . . . . . .= _ .

. . . . .. . . ;48'

2. Connectors.. .:. .... . . .:. .._._.,. . , ..._ 49:

3. Electrical Penetrations ' , l .s . . . '. L .1. .

57?

4. 10ther: Electrical Equipment'.j.;. ... . .-.:. '60L

5. Summary of Public responses to UCS Petition -

Concerning_ Qualification: Tests:. . 7 ._. _ 67E

-q, f- .

k; =-._ '

b y.

'f u

4

~

hic Page

-IV. --Cenformance-Wit"-fommission Regulations .:.' . . . . 67 -

A.. General Background on Relationship Between-.

Regulations and Staff Guides . . . . . . .. .

. . -. 1 67.

~

L B. - General- Design Criterion 3 <. -

_.- -. . - . . . . . --. - . . :69

, _ C. General Design Criterion 4 . . , = - . . . . . . . . --

72 D. Single Failu're Requirements . . . . . . . . . .s.- 74"-- -

E. Available Remedial Actions . - . . . . . . . . . . .- . -

h Appendix A - Detailed Chronology of Correspondence Related ,"

to UCS Petition l

Appendix B - Staff Report on Environmental Qualification of: '

. Safety-Related Electrical Equipment,: Dec, c15,L1977c Appendix C - List.of Public' Responses ,

Appendix 0 - Information-Report by the:0ffice of Nuclear Reactor. .;

Regulation on the Single Failure Criterion- '

August 17 1977

..i.'

g 2

.'f J N

isc l ii.

2 -

-n y -(- g h -r gi g y , '

m'y ( 6 a --

• w

1 __. INTRODUCTION A. UCS Petition Cn November 4,1977, the Union of Concerned Scientists a (UCS) fi petition with the Commission alleging certain safety deff-ciencies in connection with the design of nuclear power plants and requesting the Commission to take certain emergency and rem actions.

The alleged deficiencies involved the environmental qualifi -

cation of electrical connectors and fire protection requirements . The bases stated in the petition are the results of certain rece t n testing work from the Commission's Qualification Testing Evaluatio n Program and-Fire Protection Research Program, both of which e are conduct d f or NRC by Sandia Laboratories in New Mexico.-

The UCS petition alleges that electrical connectors ype of the t used in nuclear power plants failed in the Sandia tests under environmental conditions similar to those that would occ =

of containments in the event of a loss-of-coolant accident (LOCA).

Further, the petition asserts that the tests revealed deficiencies regarding the flammability of electrical cables and the separation of redundant divisions of cables required by current NRC regulations.

In particular,- the petition alleges that-there is a failure to meet (a) the Commission's General Design-Criterion 4, the single failure criterion of Appendix A to 10 CFR Part 50 and 10 CFR Part 50.55a(h), with regard' to equipment qualification; and (b) Gene _ral Design Criterion 3 ,

the single failure criterion of Appendix A to 10 CFR art P

50 and Part 50.55a(h), with regard to fire protection .

p 4 I

The UCS petition requested the following actions:

"a. The Commission shall direct the Staff to .i accelerate a testing program to determine the i type of physical separation between electrical cables l necessary to maintain the independence and_to' meet '

the single failure criterion for redundant safety systems.

"b. The Commission shall direct the Staff to accelerate a testing program for environmental qualification of connectors.

"c. The Commission shall direct the Staff _ to' independently verify the environmental qualifications of all safety-related systems, components and structures, -

"d. All Licensing and Appeal Boards should immediately be notified that no further construction pennits or operating licenses can be issued until such times as ,

Applicants can demonstrate compliance with the appli-cable regulations, including specifically General t Design Criterion 3 and 4 of Appendix A to 10 CFR Part 50,=

10 CFR Section 50.55a(h), and the single failure criterion of Appendix A to 10 CFR Part 50. ,

"e. All holders of construction permits shall immediately be notified to cease all construction activities +

involving the connectors identified as defective:and '

all activities relating to electrical- cables.

" f. All operating reactors shall immediately be ordered to shut down until such time as the operators can demonstrate compliance.with .the applicable regu-lations, including specifically General Design Criteria 3 and 4 of Appendix A to 10 CFR Part 50, 10 CFR Section 50.55(h), and the- single failure -

criterion of Appendix A to 10 CFR Part 50."

A supplemental affidavit was filed by the UCS onLNovember-10, 1977 which contained additional comments regarding: electrical connectors-and fire protection. A second supplemental affidavit-was filed by UCS on November 17, 1977 responding to the Staff's comments made at the Commission's November 11 public briefing. -

These supplemental affidavits also expressed concern-regarding ,

the qualification of other electrical equipment, including electri -

cal penetrations, cables = and cable tenninations, for aLLOCA environ--

ment.

L

+

B. ' Commission Actions-

~ ~

As 'a result of': the November 4,1977- UCS petition the Comesion

-4 directed the Staff on Ncvember 7,1977. to-report on' the neeo for immediate action in response to the petition'. The! Staff's report on this aspect of.the petition was transmitted to the" Commission on November'9, 1977.

On November 9,1977, the Commission issued an Order, pubilshed in the . >

Federal Register on November 11, 1977 (42 FR 5880?), soliciting views; from licensees and members of the public by November 25,1977 on' the UCS -

petition.* On November 10, 1977 the Commission's:0ffices of Generali Counsel and Policy Evaluation developed a number of written . questions _-  !

concerning the Staff's November 9,1977_ report. An open brieflog of the Commission by the staff on the emergency aspects of the UCS petition:wasD held on November 11, 1977. .

The eafter the Staff filed additional reports to the_ Commission 1

on the UCS petition on November -18,- 22, and 25,1977 and '

December 6,1977. These reports address the matters raised-in the UCS petition and provide-updated information on: ongoing l

t staff actions to obtain information on the use of electrical:

1 connectors and penetrations in operating. reactors. 'The d November 22, 1977 report.also included staff responses;to the questions raised by;the NRCL0f fice of z the General Counsel l and the-NRC Office'of Policy Evaluation'. All' of these l

-reports and the UCS petition are on file in the-NRC public Document' Room.

• To date 44 comments have been received. 'None of these-4 responses identifie.d 'any new safety inf6rmation that

- bad 'not' already been covered by the' UCS petition or -

-.the ( Sta f f' s ' reports . -The commentsbareladdressed

-m

1 On December 8,1977 the Commission held a second open meeting on the UCS petition. Both the staff and the UCS made presentations' at that meeting.

A chronology of correspondence related to the UCS petition is given in Appendix A.

C. Summary of Safety Ascects of Petition In this report and in the previous staff reports on the UCS petition, the Staff has addressed the safety aspects of the UCS petition. Specifically, the Staff views are as follows:

1. Fire Protection

a. The information presented in the UCS petitions, the public comments, and fire test data available from Sandia do not warrant acceleration of the fire protection research program now underway at Sandia;-

b. There is no need to revise the current NRC ar" 7tance criteria for fire protection of nuclear power plants; and

c. Actions taken and underway by the staff, licensees and applicants prior to and after devlopment of the current fire protection criteria for nuclear power plants provide adequate protection to the public health and safety, pending full implementation of the ce" rent criteria.

2. Electrical Components

a. On the basis of information and actions to date the Staff has concluded there is reasonable assurance that electrical con-nectors and containment electrical penetrations will perform their .equired functions in the LOCA environment, t

i

b. - The Staff is continuing to review the responses to IE Bul'etins 77-05/05A/06 in regard to the performance of electrical connectors and penetrations under pos -

tulated accident conditions other than LOCA.

c. The Staff will review the entire topic of electrical equipment qualification as the first topic of the Systematic Evaluation Program for Operating Reactors.

-S-

)

11. STAFF RESPONSE TO UCS PETITION This section addresses the actions requested by the UCS in its November 4,1977 petition. On the basis of the information in this report and the previous staff reports filed with the Commission, the Staff concludes that this petition should not be granted for the reasons stated below.

"(a) The Commission shall direct the Staff to accelerate a testing program to determine the type of physical separation between electrical cables necessary to maintain the independence and to meet the single failure criterion for redundant safety systems."

RESPONSE

The Staff does not believe that the Fire Protection Research Program should be accelerated.

The Fire Protection Research Program is intended to provide a data base for use in evaluating design standards and regulatory guides for fire protection and control. At the present time, the major emphasis is directed toward the study of the effects of cable tray spacing on fire propagation; however, the program includes other aspects of fire research, such as the effects of materials, coatings, barriers, detection and suppression.

For the reasons outlined in Section IIIA of this report, physical

, separation is not the only significant consideration relied upon-in providing adequate fire protection.

w....... _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ . _ . . _ _ _ _ _ _ . _ _ _ _ . _ . _

Separation requirements alone are not being emphasized in this program at this time. The Staff sees no immediate need to devote resources to physical sepaiation tests beyond those presently in the test program.

The Staff is concentrating its efforts in the area of overall fire protection to ensure that adequate fire protection measures are available for safe plant shutdown in the event of a major fire.

Section IIIA of this report dibcusses the NRC Fire Protection Action -

Plan for assuring safe operation of nuclear power plants.

"( b) The Commission shall direct the Staff to accelerate a testing program for environmental- qualification of connectors."

RESPONSE

The Staff does not believe that the Qualification Testing Evaluation Program should be accelerated.

The present NRC-sponsored Qualification Testing Evaluation Program at Sandia was specifically developed to obtain data to examine current standards and regulatory guides for the environmental quaiification testing of safety-related equipment required to operate in a LOCA envir".. ment. In view of this objective, the Sandia tests were per-

• formed to evaluate the adequacy of a testing methodology and not to verify the qualifications of any particular electrical component to withstand a LOCA event. The recent connector tests resulting in failures were specifically performed to determine if there are syner-gistic effects with these materials resulting from simultaneous radiation and LOCA steam exposure, as compared with the method in IEEE-323 of sequentially applying radiation followed by the LOCA environment. We believe the program schedule is appropriate for this goal.

, t

-The failure-of the connectors in the Sandia-trsts was associated with the ~ inadvertent use of unqualified components that_were. thought-to have been properly qualified for the-test environment.

A proper response to concerns regarding -the qualification of connectors-in nuclear power plants is accelerated identification of instances where connectors are used in safety systems and the detennination of the adequacy of qualification of such connectors. This is the-course of action taken by the Staff starting on November 8,1977.

The results of this effort and additional staff plans for future action are discussed in Section III.B and Appendix- B of this report.: -

"(c) The Commission shall direct the Staf f to independently -

verify the environmental qualification of all safety-related systems, components and structures."

RESPONSE

To the extent that this request proposes that the NRC undertake the environmental qualification test work- we. do not agree.- That is a responsibility of licensees.

' The Staff has been investigating -the development _ and evaluation of.

qualification test procedures, test methods and test results with regard to environmental qualification of safety-related equipment-since before 1968. The-Staff's concernsand recommendations. >

have'been reflected in both the 1968 and 1971, versions of .

IEEE Std. 279-1971, " Criteria for Protection Systems for Nuclear '

Power Generating Stations," and the 1971 and 1974 versions of IEEE Std, 323. " Standard for Qualifying Class-IE-Equipment for 1

Nuclear Power Plants." The Staff further undertook the Sandia -

. Qualification Test Program as a logical extension _of its standards -

2 '

~

development efforts to evaluate the adequacy of the qualification test-ing methodology. In concert with the standards development and the testing methodology verification program at Sandia, the Staff has been activelyinvestigating and evaluating specific equipment qualification tests performed by licensees. A generic task action plan ( A-24) has been developed which will include comparisons of the Sandia test program results with tests of safety equipment by the responsible licensees or their equipment suppliers. Moreover, the Staff has undertaken a comprehensive review of the qualification work done in connection with connectors and penetrations. This review is still in progress. We are ch.'efully assessing the environmental qualification method used by the licensees to independent 1v assess the adequacy of these methods in demonstrating qualification. Staff plans for further action are discussed in Section III.B and Appendix B of this report. We see no need for further action by the Commission with respect to this matter.

.g.

[

"(d) All--Licensing and Appeal Boards should immediately be notified that no further construction permits or operating-licenses can.be-issued until such time as Applicants can-demonstrate. compliance with the applicable regulations,-

including specifically General Design Criteria:3 and 4 of Appendix A to 10 CFR Part 50,10 CFR- 50.55a( h) L and-the single failure criterion of Appendix ' A to 10 CFR Part 50."

RESPONSE

For the reasons discussed at length .in Section III A of this report, we believe that all ruth facilities have adequate ,

programs for implementation of fire pretection.to satisfy the requirements of the GDC-3. Starting in 1978, the staff-willassure that fire protection program-reviews conducted in accordance with current guidance in the Standard Review Plan are completed before operating licenses are issued.- -

We believe that present requirements for environmental quali-fications satisfy the requirements-of GDC-4. In any instance in which items or components are-identified for which sufficient; basis' can not be demonstrated _ to _ assure qualification, such information will be brought to the' attention of any licensing-board that may be considering an application-for such facility. This would be rare in construction permit cases,:

since the details. of final system designs- and . environmental-qualification programs.-are not usually a;part of a can- ,

struction permit application. .

"( e) All holders of construction permits shall immediately be notified to cease' all . construction activities involving'the-connectors identified as defective.and all activities-relating to electrical cables."

RESPONSE

All holders of construction. permits were directed by-IAE bull _etins 77-05 and 77-05a to (1) identify all connectors utilized in safety-systems wnich are required to function to mitigate an accident where the accident itself-could adversely affect the ability of thei system to perfonn its safety function, amd (2) indicate the status of' the qualification of sbch connectors. )

J In any instance in which unqualified or:-inadequately qualified com-ponents are identified, the Staff will'take appropriate action to assure'-

that cualified components are provided before operating licenses are-issued.

Similarly, as indicated in Section III A, starting in 1978 fi_re protection reviews in accordance with the current _ guidance of the Standard Review Plan will be completed before oper_ating licenses: '

are issued. All present holders of. construction permits. have d been notified of-- the requirement to assure' that:any application-for an operating' license includes specific' consideration of fire protection in accordance with that guidance.

1 4

6 l

"( f) All operating- reactors shall immediately be ordered to shut-

.down until such time as the operators can demonstrate compliance with the applicable regulations, including specifically General Design Criteria 3 and 4 of Appendix. A to 10 CFR Part .

50,10 CFR 50.55(h), and the single failure criterion of Appendix A to 10 CFR Part 50."

RESPONSE

As discussed in detail in Section III A, with the additional . ,

improvements of fire safety made in operating plants since the Browns Ferry fire and with the current program for the review t

and implementation of current guidance for operating plants, trose plants can continue to operate safely.

The overall fire protection programs in such plants provide adequate implementation of the goals of GDC-3, until full implemen--

tation of the new guidance can be completed for these plants.

As discussed in Section III B, the Staff has already undertaken a review of the qualifications of connectors and penetrations to detennine the adequacy of environmental qualification of th0se items. In general, eqtripment qualification has eventually been demonstrated, despite some early inadequacies in informa-tion supporting such qualification. The Staff has, where appropriate, taken prompt action to obtain proper qualification or replacement of unqualified items.

Section IIIB and Appendix B also discuss the staff program for future actions concerning environmental qualification of other-

I safety-related electrical components. 'During this program,. the Staff' will assure that prompt appropriate action'is taken in the cvent-that items of doubtful qualification are identified.

The single failure criterion requirements of Appendix; A to 10 CFR Part 50 and 50.55a(h) applicable to fire p;otection and environ-mental qualification requirements do not establish a' set of design basis events. Rather, they establith standards. for. design and' performance.

of electrical systems to assure that such systems are capable.of performing as required. The staff reviews-discussed in detail in-Section III show that plants meet the requirements and that the-:

Sandia . tests do not bear upon consideration of " single -failure"'

requirements, but rather upon the basic question.of conformance-with overall design goals. .

The staff concludes that no additional Commission action is required-with respect to these matters.

q lI'II. ~ SAFETY CONSIDERATIONS:

A. Fire Protection in Nuclear Power Plants .

1. NRC Fire Protection Requirements The Commission's _ basic requirements for fire' protection for nuclear power plants are set forth in General Design.CriteHon.

(GDC) 3. Prior to October,1972, the: Staff had not developed-  ;

guidelinec for implementing GDC 3. Detenninations of the adequacy of fire protection were made on a case-by-case basis in the review-of individual applications. Subsequently the Staff provided guidance for implementing GDC 3 in Section 9.5.1 of the October, 1972 issue of the " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants" and in the initial issue.(September.-

1975) of the Standard Review Plan, Section 9.5.1. This guidance-was general in nature, and did not provide acceptance criteria for fire protection programs and systems for' specific . safety-related areas in nuclear power plants. Overall fire protection '

acceptance criteria referred .in a general manner, to industry standards, such as those of the National Fire Protection- Association, Underwriters Laboratories, and the National Electrical Manufacturers:

Association.

Following the fire at the Browns _ Ferry Nuclear Power Station on-March 2?,1975, the Nuclear Regulatory Commission established a Special Review Group to identify the lessons learned from this -

event and to make recommendations concerning fire protection at.

nuclear' power plants'in light of these lessons. The results of- -

this study. were publi_shed-in NUREG-0050, " Recommendations- Related to;the. Browns Ferry Fire," February 1976.

.i The Special Review Group recommended improvements in four broad categories:- (1) guidance to applicants and licensees; (2)- evaluation,-

inspection, and enforcement procedures; and (3) the fire protection programs at licensed facilities; and (4) local governments' emergency procedures. To implement these recommendations, the NRC established an agency wide action plan-called the Fire Protection Action Plan - +

which involves the major program offices, i.e., Nuclear Reactor Regulation, Inspection and Enforcement, Standards Development, .

Nuclear Regulatory Research, Nuclear Materials Safety-and Safeguards, '

and State Programs. Brookhaven National Laboratory and Sandia National Laboratory have been engaged to provide technical assistance to this program. This action plan brings all NRC activities regarding the implementation of the- Review Group's recommendations together into'a-single integrated plan. NRC management periodically reviews .the progress of this program via_ the; Status Summary Report for the Fire Protection Action Plan and monthly reports to the Commission regarding MBO VII . - In May 1976, as part of this plan, the NRC Staff revised section 9.5.1 of the Standard Review Plan to issue new fire protection p- . guidelines for the implementation of GDC 3.

2. NRC Fire Protection Actions Following Browns Ferry Fire The following-is a summary of- actions taken by the NRC as a result-of the Browns Ferry fire:

q ,

(a) Promptly after the fire, the Office oflInspection_8 Enforcement sent special_ bulletins _ to all licensees of operating power reactors-on March 24, 1975 and April 3,1975 directing certain controls over-ignition sources, a review of procedures for controlling plant' maintenance and modifications that might affect safety, a review of emergency procedures for alternate shutdown and cooling methods, and a review of flammability of materials used in floor and wall pene-tration seals. Some of the changes and improvements at operating p! ants whch have come about as a result of these bulletins are:

(1) modifications of work procedures to assure consideration of -the safety significance of electrical cables 'and piping 1 in the work area; (2) incorporation of the control of combustible materials -

into plant procedures; (3) . improved plant- procedures-.for -the control- of ignition sources; (4) development of new procedures and guidelines covering L the use. of water on electrical cable; I -

l (5) study and development'of procedures :for a variety of means_ to provide decay heat removal; ,

(6) addition, upgrading and repair of cable penetration

-firestops; and (7)- addition of fire suppression equipment.

L v

i

~ . . .

-l

, I I

( b) Promptly .af ter the fire, special inspections by _ the NRC' Of fice of Inspection and Enforcement were completed at all_ operating power reactors in April and May 1975 covering the~ installation of-fire stops on electrical cables and ' penetration seals. Inspection findings which reflected noncompliance with current NRC requirements resulted in requiring corrective action by licensees. - Follow-up inspections have confirmed that licensees took required corrective actions and that administrative control procedures-were in place.

( c) More detailed procedures for inspection of fire prevention and protection measures have been incorporated in the NRC Operating Reactor Inspection Program. Since September 9, _1975 the Of fice of Inspection and Enforcement has been conducting Jetailed annual.

inspections of licensees' fire protection programs as one'of the routine I&E inspection modules. Additionally, a plant tour is conducted quarterly, during which the inspector looks for conditions that might contribute to fires. These-inspec-tions include-review of fire insurance inspection reports.

( d) Partly in response to the Browns Ferry fire, quality assurance inspection procedures have been improved steadily over those:in effect at the time of preoperational QA inspections of Browns Ferry Units'l and 2. Specifically in respor.se to the fire, inspection procedures for plants under construction and in the preoperational testing phase were revised to include increased focus on verifying conformance with ' regulations on installation of electrical cables and penetration seals.

I

( e) When the results of the review and evaluation of plant modifications for the Browns Ferry plant became available, they were used as an example for the development of new guidelines on fire protection for inclusion in the Standard Review Plan, appli-cable to all nuclear plants.

( f) Factory Mutual Research Corporation--an expert and independent fire protection development and testing organization--

was engaged by NRC to provide technical consultation on fire protection and to identify alternate fire protection methods and e systems for NRC consideration. ,

(g) As a result of the Special Review Group's work on the Browns

~

Ferry fire, a number of areas were identified in which improvements were needed in standards. Since a number of organizations have relevant expertise, the Executive Committee of the Nuclear Standards Management Board of the Anerican National Standards Institute ( ANSI) has provided a coordinating Steering 9

Committee to direct and coordinate standards improvements.

The NRC Staff has prepared an outline of possible additional or improved standards needed to provide supplemental guidance for implementing the Staff's fire protection-guidelines set forth in the Standard Review Plan. The Brookhaven Nationa'l. Laboratory is' nrovidir.g. techhical support to the NRC staff in this effort. 4

( h) Sandia Laboratory is conducting.NRC-sponsored research' to investigate standards for electrical cable separation at nuclear plants, and, in addition,- has augmented:its fire protection research program to include such areas as the effect of exposure fires, testing of the effects of cable tray separation, and testing of electrical-cables in conduits and with fire barriers. High priority has been placed on the testing of fire retardant .

coating materials for cables.. Future programs will' include upgrading of flame tests- for_ individual cables; evaluation - ,

of cable fire propagation characteristics of aged cables

_and coating. materials; evaluation of early warning fire detection. systems; and evaluation of fire extinguishing..

mechanisms.

3. NRC Fire Protection Guidelines Since Browns Ferry Fire As indicated above,_ in May 1976,. NRC issued new fire protection guidelines for nuclear power-plants.- -These guidelines are largely based on the lessons . learned from the Browns Ferry fire and recommendations from

NUREG-0050 and the NELPIA and the Factory Mutual System.

The guidelines for construction pemit applications j docketed after July 1,1976 are contained in Standard  ;

Review Plan Jection 9.5.1 dated May 1,1976. These guidelines were also issued for public comment as Regulatory Guide 1.120 in June 1976, and a revision to the Guide was reissued for comment in November 1977.

Among the more significant features of the guidelines in Standard Review Plan Branch Technical Position 9.5-1 are: '

(1) early involvement and assigned responsibility' of upper licensee management in the fire protection program throughout plant life, 6nd a management system for imple-menting fire protection administrative controls,. quality assurance measures, fire brigade training and fire protection system testing and maintenance; (2) early coordination of plant building-and systems design and layout with fire protection requirements, more of fective separation and isolation--by use of .

fire barriers--of redundant safety systems, guidance on acceptable fire resistant' building and system P

construction materials; and (3) specific NRC guidance-for each major safety related plant area with respect to acceptable fire' detection and suppression, fire barrier separation.

and fire protection support requirements for venti.la--

tion, emergency lightingland communication. ,

m. ..

Significant details of the new guidelines for fire protection programs can be summarized functionally as requiring the applicant or licensee to:

(1) provide separation (by fire barrier or distance) between redundant safety-related systems to assure that a safety function will not be lost; (2) litait the amounts of combustibles, inherent or transient, in safety-related areas; (3) control the deliberate movement of combustibles and ignition sources; (4) prnvide fire detection systems in all safety-related areas; (6) provide a supplemental hierarchy of fire suppression systems for all safety-related areas that will be adequate to suppress both small and large fires involving the expected combusticles in a manner that does not introduce an adverse affect on safety capability; (7) provide arrangements to supplement the fire brigade; (8) provide plant Technical Specifications to assure the availability of the fire detection and suppression systems during plant operation and shutdown: and (9) provide operating procedures for achieving safe shutdown conditio'es under a spectrum of fire conditions.

Appendix A issued in August,1976, to Branch Technical 4

Position 9,5-1 modifies, as appropriate, the guidelines in the Branch Technical Position for those nuclear power plants for which applications for construction permits i

i l

J l

were docketed prior to July 1,1976. ' Although the guidelines of i

-the Branch Technical Position provide preferred guidance for fire  ;

protection programs, alternative fire protection guidelines are >

identified in the Appendix. The alternatives apply for areas where, [.

depending on the construction or operational status of a given plant,

]

application of the guidelines could have significant impact, e.g'.,  !

where the building and system designs are elready complete.and con- l struction is in progress, or where the' plant is in operation.: These '!

alternative guidelines are intended to provide adequate and acceptable. l fire protection consistent with safe plant shutdown. requirements.' -!

l As is true with all Staff regulatory guides (as distinguished from; Commission regulattens), alternatives may be proposed by applicants and [

ifcensees. These alternatives are evaluated by the NRC staff on a: _

1 r

case-by-case basis where such departures are justified. ' Among the ,

alternatives that may be considered is the provision of. a " dedicated" - {

system or alternative method- for assuring. continued safe shutdown of. .l j

1 the plant in the event of; a fire. This dedicated: system must be completely independent of other plant systems, including the' power source; however, for fire protectiondit may not be necessary forithe -

system to be designed to seismic Category I criteriador. meet single-failure criteria because it serves only as a system of last: resort J

~

when other safety; systems have ' failed.[ Manual : fire fighting capability to protect other. safety-related systems _ is still required even when -

~

the dedicated system alternate is chosen. ,

j

~22- l m

, . , ,~....-,r~.,4- , v. m ~ ,- ,, , ,4 , w m , . ,, %

m, -  %~.- , , ~ , - . ~ , ~ - - . _ <m_2 .,%4'.~ . . .

i i

Regulatory Guide 1.120 was issued for public comment in June 1976. It was revised and issued again for public comment on November 7,1977, j clarifying areas addressed in the public comments. The Standard Review Plan Section 9.5.1 is being modified again, to be consistent with Revision 1 to Regulatory Guide 1.120. Among the more significant technical changes in the revised Guide are improved guidance on  !

evaluating postulated fires as part of fire hazards analysis required for each plant; improved guidance on applying the single failure criterion (for both active and passive components)-to the fire suppres-sion systems; and' improved guidance for fire protection of cable-trays outside cable spreading rooms.

1

4. Pla: t Fire Protection Staff Evaluation program When the 'ew fire protection guidelines were promulgated in May 1976, all licensees were requested to compare their fire protection programs with the new guidelines and to propose modifications for compliance,  ;

or. to justify non-compliance. As information came.in from operating reactors additional guidelines were developed for specific areas:

of concern and additional information was requested from licensees, including requests to provide fire hazards analyses and' Technical Specifications for fire protection systems. -These analyses-were to be performed by persons expert in nuclear safety and fire protection. .

to consider the consequences of a postulated fire in each. plant area.

to consider electrical cable insulation as combustible material, and to consider the effects of the loss of cables due to a fire when

~

redundant cables are routed in close proximity to one another.

4

. . = , * , , - -

, + , , a - _ _ - , . _ , , re , ~ . . .

The licensees began submitting their comparisons with the new guide.

lines in July 1976, and the staff reviews of these reports are con -  ;

tinuing. As of November 7,1977, the guideline comparisons, the fire  ;

hazards analyses and the proposed Technical Specifications had been received from licensees for all but one operating power plant.* The.

staff has established multi-disciplinary review teams with expertise in nuclear safety, fire protectim, and fire fighting. A team visits i each plant to review the complete fire protection program. During this visit, the team considers the qualifications of site personnel responsible for fire protection and suppression, unique situations that may hinder manual fire fighting, and arrangements for supple-menting the fire brigade.

The staff evaluates _the plant features;related to fire protection, as well as the analysis of consequences of a postulated fire in each area of the plant designated as a fire area. We assume that any combustibles may burn and estimate the effects of an unmitigated fire on safety and on the capability for safe shutdown. We evaluate the various- alterna-tives proposed by licensees on a case-by-case basis. Because the primary objective of our action plan is to improve fire protection at nuclear power plants, our objectives and acceptance criteria are designed to reduce the' probability that a major . fire will occur in any plant and to increase each plant's capability to achieve and maintain a safe shutdown condition should a fire occur.

• Arkansas 1 has indicated that some additional information' will be submitted in February 1978.

1. s e fy Ia Simply stated, the objectives of the fire protection program in a i

nuclear power plant are to (a) reduce the likelihood of occurrence of fires; (b) promptly detect and extinguish fires, when they occur; (c) maintain the capability to shut down the plant safely when fires occur; and (d) prevent the release of a significant amount of radioactive material, when fires occur.

The results of our evaluations will be published in safety evaluation reports which accompany amendments to the Plant Technical Specifications related to the Fire Protection Program. Our review of the fire protection programs for operating facilities has been in progress since May 1976. Except for Arkansas Unit 1, all of the operating facilities have submitted their fire protection programs for our review. Oraf t Safety Evaluation Reports, which reflect the results of our review, are in preparation for fifteen plants. We expect to issue these fif teen Safety Evaluation Reports by February,1978, which is one month behind the schedule he NRC Fire Protection Action Pl an. We expect to complete all of our reviews of operating plants by December,1978 as currently scheduled in the action plan.

We have also completed interim reviews of the current fire protection capability of each operating plant and.have issued safety evaluations and proposed interim Technical Spt.:1fications regarding fire protection to govern the period until we complete the full evaluation of plans to achieve conformance with the Appendix A guidance.

In addition to the fire protection review of individual plants, teams also conduct generic studies of fire protection prob-lems, and 'guideli-es. These generit studies have considered sever al areas of ;ncern in the conduct of fire hazards analyses.

For example, we have compared data obtained from several fire testing methods with fire damage experienced in actual fires to estimate how such test data can be used in predicting fire damage. We have made our own estimates of design basis fire conditions in postulated configurations that are representative of certain areas of licensed facilities. We have studied the data available on oil fires in power plants to estimate the magnitude of such hazards. We have collected data appropriate for estimating the size of fires that may be associated with selected combustible configurations found in licensed facilities.

It is against this background of staff effort to assure adequate fire protection in nuclear power plants that the Sandia tests can be placed in proper perspective.

n e

5. Sandia Fire Protection Research Program

a. Cable Tray Fires - Test Descriptions The cable tray fire tests referenced in the UCS petition were a series of tests conducted as part of the NRC I Fire Protection Research Program. The purpose of this program is to provide a data base to be used in evaluat-ing design standards and regulatory guides for fire pro-

-tection and control. The particular tests discussed in  ;

the UCS petition were performed to study the effect of electrical cable tray spacing.on fire propagation.

Tne tests were conducted in a building 60 f t long,19 ft high, and 24 f t wide, simulating an open plant configura-tion where the effects of reflected heat: from walls and ceiling are minimized. Fully loaded (40% volume fill),  !

horizontally oriented, steel ladder cable trays eighteen inches wide were used. Cables meeting the flame retardant standards of IEEE 383-74 were used in all of the tests. ,

l

Fire propagation tests were first conducted b. initiating [

the fire with simulated electrical overloads and short circuits in a single tray. Cable tray spacing was varied from 5 f t vertical and 3 f t horizontal separation to 10.5 in. vertical and 8 in. horizontal separation with no propagation or cable  !

damage in any tray, except the ignition (donor) tray.

The next phase of propagation tests investigated the resistance to fire propagation in fourteen closely packed horizontal cable trays (2 rows - 7 trays high) identical to the cable trays described above. The fourteen cable  ;

trays were arranged in two stacks Nith each tray spaced 10.5 in, vertically with 8 in, norizontal. separation between stacks. These cable trays simulated a single fully stacked -

safety division. Three additional identical and fully loaded ,

cable trays, representing a redundant safety division,- were arranged with one located 5 f t above the 14-tray stacked-safety division, the second located 3 f t to the side, and the third located 5 f t above the second. The' vertical- and a

horizontal separation distances between safety divisions correspond to those listed in Regulatory Guide l'.75 for open plant areas. Propagation tests'were-conducted'using the!

electrical initiation method employed in the previous tests and there was no propagation or cable damage in any tray.

except the ignition (donor) tray.- .

a The next series of tests conducted on July 6,1977 utilized an exposure fire to study the current regulatory position that calls for consideration of exposure fires in design .

of fire protection systems. The tests did not include the use of any fire suppression system, nor were they designed to detennine the effectiveness of such a system. Since there is no single exposure fire that could be considered typical, the objective of the test was to develop the severest fire possible in an ignition (donor) tray without the ignitiori source itself influencing any of the adjacent cable trays.

For the type of cable utilized, experiments showed that a fully developed cable tray- fire' (in terms of near maximum-cable bundle and flame temperatures) could be obtained if -

the cable tray fire involved an area of cable-about 18 in.

by 36 in, and that two 70,000 Btu /hr capacity burners placed ,

beneath the cable tray would usually produce such.a fully developed cable tray fire. ,It was also determined that at least five minutes were required before the near maximum steady state cable bundle and flame temperatures were reached.

~

Therefore, an insulation barrier was placed 'above.the ignition (donor) tray that kept the' temperature' rise in the adjacent trays negligible while the fire in-the-ignition tray was brought to the fully developed state.

Af ter the predetermined time of five minutes, the burners were shut off and the insulating barrier removed. In this manner.. cable tray propagation could be studied for a fully developed cable ,

tray fire started by an exposure fire without the exposure fire itself burning or contributing to the propagation from tray to tray. Two tests were conducted. In the first test a fully developed cable tray fire in the ignition tray was not obtained. Af ter deter-mining that the temperature rise in the adjacent cable trays was-still negligible, the insulating fire barrier was replaced above the donor tray and the cable in the ignition tray was repositioned to .

allow for a more optimum air fuel mixture to support combustion. The testing to date indicates that the most important factor in determin-ing if a cable tray fire will develop is the spacing between cables.

^

In both exposure fire tests, optimum spacing with a random fill pattern was sought. Usually in power plant cable trays the cables-are in a more uniform pattern, making it more' difficult to start a fire.

After repositioning the cable for a second: test, the propane burners.were reignited with the insulating fire barrier in place. ' After five minutes.

- the burners were turned off and the insulating fire barrier removed.

This second test resulted in a fully developed fire in .the ignition tray with subsequent propagation to the tray above it in about ten minutes. Propagation proceeded up to the two seven tray stacks and caused ignition of the simulated redandant safety division above this stacked safety division in about twenty-five minutes.' Five a

l i

r minutes later, the supportstructure collapsed and the test was terminated. Ignition of the simulated redundant safety division five feet above the safety division was verified prior to termination of the test. Before terminating the test, no attempt was made to extinguish the fire. After terminating-the test, complete suppression of the fire required 75 gallons of water and was accomplished in 15 minutes. It should be pointed out that the ignition tray fire burned out shortly after the fire propagated to the-tray above.

Even with allowances for the fuel consumed in the ignition tray for the first. test, it would appear that a fire barrier with a relatively low rating (about 15 minutes) would.

have prevented the fire propagation. Again, it should be emphasized that no suppression systems such as barriers, coatings, or sprinklers were in use.

b. Role of Cable Flame Retardancy and Safety Division Physical Separation Requirements in Plant Fire Protection The.UCS Petition of tbvember 4,1977 .(page 5) alleges that

-the Sandia cable fire tests demonstrateLthat the cable flame retardancy provisions-of IEEE-383 and'the physical separation

provisions of Regulatory Guide 1.75 and IEEE-384 are not effective in minimizing the effects of fires. In his Supplemental Affidavit submitted by the UCS letter of November 10, 1977 Mr. Pollard states his belief (page 3) that the cable flame retardancy and separation standards are not adequate, even when used together with other fire detection and suppression standards (such as those of Regulatory Guide 1.120) as part of the defense-in-depth principle.*

Simply !,tated, the Staff disagrees with these allegations and Mr. Pollard's second supniemental affidavit, dated November 17, 1977. As we indicated in our repon of November 9,1977 (pp. 6-7), the Sandia tests confinned the Staff position taken since the Browns Ferry fire; namely, that the Regulatory Guide 1.75 and IEEE-383 requiremerts, by themselves, are not sufficient to protect against exposure fires. Thus, additional fire protection measures are required by NRC. These additional measures include fire barriers between redundant safety division cable trays; fire retardant coatings on cabling; automatic fire detection systems; automatic fire extinguishing systems, such as sprinklers in plant areas of high cable density; backup fire suppression capability ( fire hoses and portable extinguishers); administrative procedures and con-trols to minimize fire hazards due to poor housekeeping or to plant maintenance activities; and fire brigade training and drills to assure adequate response to fire emergencies.

O It is unclear whether this renains the position of UCS in light of Mr. Pollard's oral presentation concerning the adequacy of current

'RC fire protection guidelines to the Commission on December 8,1977.

db

As we indicated in enclosure 1 of the Staff report of November 22, 1977 (pp. 2-7), additional fire protection measures contained in Branch Technical Position 9,5-1 and its Appendix A, and in Regulatory Guide 1.120 do not suggest that no protection is afforded by use of the IEEE-383 and Regulatory-Guide 1.75 guidance. Rather, they serve to supplement and diversify pro-tection against exposure fires, and to provide ample margin for assuring a high degree of fire protection safety at nuclear plants.

6. Basis for Continuation of Plant Operation and Licensing The staff has previously indicated its basis for the continued opertion of licensed plants pending completion of the full implementation of our current fire protection guidance in the November 9,1977 report (pp. 8-9). and the November 22, 1977 report ( pp.12-18) . This basis includes, 1) the actions taken as a result of the IAE inspections and-subsequent follow-up actions by licensees; 2) the conclusion of the-Browns Ferry Fire Special Review-Group Report (NUREG-0050) that the probability of fires of a large'and disruptive nature of the magnitude of the Browns Ferry fire is small and that "there is no need to restrict operation of nuclear power plants for public safety", and 5) improvements made since that time by. licensees-in fire prevention measures and fire brigade capability and training that have been notec in the plants visited to date and are expected to exist'in.

the remaining plants, which further reduce the probability and consequences of fires.

l The petitioners' technical arguments for the shutdown of operating reactors can be characterized as: If in an operating plant a single failure can render redundant safety systems inoperable, the operation of the plant presents an undue risk to public health and safety. A public comment on the UCS peti-tion from Mr. Myron J. Miller, of Factory Mutual Research, dated November 22, 1977, raised a related question, "Does there presently exist in any operating nuclear plants a situation in which a fire could disable redundant safety systems?"

The staff has recognized since the Brown's Ferry fire that there are certain locations in some operating plants in which an unmitigated fire could affect redundant systems. Several sections of-the report of the Special Review Group NUREG-0050 address this point and place the safety significance of such events in perspective. Briefly, the Special Review Group recognized that:

(1) The Browns Ferry fire induced common mode' failures or redcndant core cooling systems.

(2) Manual actions can restore the operability of cooling systems.

Isolation of redundant safety equipment and' associated-

~

(3) cables is not fully achievable in real life.

2

(4) An area intended to be non-hazardous with regard to fires will not necessarily remain non-hazardous for the life of the plant.

(5) Operating plants and those under construction are in many respects similar in design to Browns Ferry and a re-evaluation is needed.

(6) For each plant, a suitable combination of measures such as electrical isolation, phy9 cal distance, barriers, resistance to combustion, and sprinkler systems should be applied.

(7) The independence of normal cooling systems from emergency cooling systems should be considered.

(8) Each of the Review Group's recommendations that is relevant to existing plants must be considered as a recommendation for possible backfitting. Whether to implement such recommendations must be decided on a plant-by-plant basis.

(9) At Browns Ferry, a fire disabled a substantial amount of core cooling equipment. However, in the absence of a loss-of-coolant accident, this equipment was not required to function. The reactors were safely shutdown and cooled.

(10) There was no radioactivity release greater than normal occurrence, and the health and safety of the public were not affected.

As part of the reviews which are being conducted under BTP 9.5-1 and Appendix A the safety consequences of those few instances where a fire can disable redundant systems are specifically being-evaluated plant-by-plant. The licensee's fire hazards analysis evaluates the consequences of a postulated non-nechanistic fire in each fire area of the plant. Both mitigated and unmitigated.

%l l

I fires are postulated and the effect of postulated fire damage on the capability to achieve and maintain safe shutdown is assessed. The goal  !

of this evaluation is to determine whether there is reasonable l assurance that at least one method of achieving and maintaining safe shutdown is independent of the influence of the postulated fires.

Where such assurance can not be shown, the staff requires modifications to achieve that goal,.

In areas of plants containing safety-related equipment, the pro-cedures for strict control of combustible and potential ignition.

sources and the ability to detect and mitigate fires by suppression are being evaluated. The evaluations to date show that-in most- fire areas only one safety system may be affected-by an unmitigated fire.

They also show that in a few fire areas, such fires may affect cables i

of either division of redundant systems, cables of both ' divisions of some redundant safety systems, or cables of all' systems used to-  :

achieve safe shutdown conditions. Mitigated fires in the same fire areas may affect, at most, a single division of safety systems.

In those 'few instances where a fire could still affect the cables of all systems used to achieve safe shutdown, an alternative shutdown -

method may be-required, as explained above. ,

While our evaluations are ongoing, the continued' operation of plants-is acceptable since-the probability of a fire which1would threaten public health and safety is low as concluded in' the. Browns Ferry Special Review Group Report (November 9,.1977 Report,. -

p. 8). In addition, as shown in the instance of the fire lat

'l

--e >_. ,_m,5, w- - , , - y, -+

Browns Ferry, time is available for manual actions and emergency ,

modifications to restore the cooling system.

Moreover, there has been substantial progress since the Browns Ferry fire in reducing the potential for severe damaging fires including:

a. strict administrative controls over the handling and storage of combustibles and ignition sources in areas that contain safety-related systems;

b. modifications which have been and continue to be made to provide fire retarding, fire detection, and fire fighting capability;

c. operating procedures that have been developed by licensees to i assure safe shutdown in the event of a fire; and

d. the additional modifications now being made to the operat--

ing plants to decrease the severity of a fire av increase the plant's capability to cope with an unmitigated fire.-

In addition Interim Fire Protection Technical Specifications have already been proposed for all operating plants. We expect them to be in effect shortly. . There interim Technical Specifications will cover the availebility of existing fire protection systems and administrative controls, including fire brigade strength and training, and control of com-bustibles and ignition sources.

?, n

-Consequently, for continued operation of operating plants t'ne risk to public health and safety is-acceptably low, and suspension of operation is not required. .

For plants currently under licensing review, and for.those

-f plants now under construction, the staff fire protection.

reviews based on the guidelines of BTP 9.5-1 and Appendix A; l thereto, will be complete before operati_ng licenses'for-such plants are issued, starting in' 1978, and implementation-schedules will be specified for any fire protection improve-ments-that may be required.

7. Public Comments on UCS Petition Relative to Fire Protection On November 11,1977, the Commission pub 1'ished a notice in the Federal Register (42 FR' 58803) soliciting the views of licensaes and the public with _. respect to the.UCS petition. .

and requesting comments by November = 28,1977. - To-date, forty-four- responses have- been received.. ' A' list of, those:

responding. is provided as Appendix C.; None of the' responses -

identified any new safetyLinfonnationithat had not already been covered by the UCS petition' and the _ subsequent: supple-=

mental affidavits of Mr. Pollard or not previously considerCdi n

.by:the staff. Our review of: the coments~ presented in these submittalstiddicates: a) twenty-four responses recommend; deni.a1 of the petition, of these. one is' from an architect- >

w.

lMa

engineering firm, one is from a state agency, and the remainder 6re from utilities with nuclear power plants or law firms reoresenting such utilities; b) fourteen responses recommend that the petition be granted; of these, nine are trom environ-mental or public interest organizstions and six are from privato citizens; and c) five responses contain general state- "

ner.cs or a request for additional tN to prepare further comments without an accompanying recommendation on the petition. . The bases presenteo in these public comments to support the recommendations 1

they contain range in scope from a single statement and conclusion to a detailed discussion of the Sandia tests, with resulting ,

positions as to their applicability to nuclear power plants.

The staff has reviewed the public comments. , Specific comments pertaining to fire protection and the Sandia fire tests generally fell into four categories.

1) Discussion of what the tests demonstrated regarding cable-separation and flammability criteria and the adequacy of such criteria.

2) Comparison of the test conditions with actual nuclear power.-

plant conditions, cable tray arrangements, and credible.

fire sources. .

3) Defense-in-depth in fire protection; degree of protection at each level, other fire protection capability in addition to cable separation and flammability limits.

I

i s q

l

4) Adequacy of NRC fire protection program; evaluation of. ,

i operating plants under construction, current NRC ' fire -

protection guidance.

The comments in each of these categories are discussed below'.

1.) Cable Separation and Flammability' Criteria:

Fourteen utilities commented on the NRC cable' separation and-flammability criteria as related to =the Sandia Test results.-.

Basically, it was stated thatt exposure fires were'not con-sidered to be a credible event; the Sandia test fire because of its severity,-was not_ representative of any exposure fire:

expected to occur in a nuclear plant cable ~~' area;: and the-IEEE-384 separation criteria used in the Sandia test were valid with respect to internal (electrical) fires only.,

Previous staff comments.on these points are: contained on'page-15 to the Staff report of' November 9,31977 and on.pagesL3, 4 and 7 of enclosure 1 and-pagesl22-23 off enclosuro-2 to

the Staff report.of November 22,1977.: Briefly- stated,~ '

exposure fires are considered by the staff to beia--low:

probability, yet credible, event.and theyfare presumedlini fire protection' reviews. The exposure fire;a'ssumption;is :

lspecifically stated in theifire hazard analysis section.off Reg Guide _1.120.- lIn any event.c as stressed on; page 3 Eof; 6 = ' -

,},

Enclosure 1 of the staff report of Ibvemoer 22, 1977, compliance with Regulatory Guide 1.75 (IEEE-384) and IEEE-383 alone are not sufficient to protect against fires. Additional fire protection measures are required as identified and discussed in this report. .;

The severity of the Sandia fire test is addressed in this report and in pages 22-23 of the staff report of November 22, 1977, in which the  !

staff concluded that Sandia test configuration is considered to be a ,

conservative but not " worst case" representation of high cable concentrations at plants applying Regulatory Guide 1.75.

Several utilities stated that IEEE-383 was a good standard for performing a relative " screening" of cables for fire hazard classi-fication and served' to eliminate undesirable cables. The NRC staff concurs with this comment on IEEE-383. Footnote 2 on page 6 of Staff report-of November 9,1977 points out that Regulatory Guides 1.120 and 1.131 state that cables passing the IEEE-383 test provisions are not exe: opt from additional fire protection measures or considered to be qualified for any installed cabie. system configuration.. '

2) Actual Plant- Conditions vs Test Conditions Several utilities identified actual conditions in their plants L!

that tend to prevent fires or mitigate the consequences of cable fires compared to the Sandia test conditions. These con'ditions include the following:

't 4 - " ~ < - c - -+ ,_ . _ _ - . , . . , - . . - . , , . ..;.

i

a. Administrative controls on the handling and storage of combustibles and ignition sources are such that the conditions required to produce an exposure fire in an area of high cable concentration are unlikely. .

b. The circuit protection and capacity of electrical cables are such that occurrence of conditions requirt:d to electrically initiate a fire in cable concentrations is unlikely.

c. The test fire was more severe than the exposure-fire-that might result from a failure of the administrative controls on combustibles and ignition sources.

d. If a fire occurs in an. area of high cable concentration,.

existing fire detection and wppression methods would mitigate the consequences o' such a fire.

e. If-a fire-occurs in areas of high cable concentrations, the- '

propagation of such a fire would'be significantly reduced 1 becante of a variety of plant specific features, including:.

(1) cable configurations within. trays significantly '

different from the test configurations; (2) cable trays- t covered by _ steel covers- or bottoms, flame retardant coat- '

ings, or mineral wool. blankets; (3)~ 1ess cable tray fill;.

(4) less air space between cables; (5) significantly different cable types;- (6) steel cable tray supports,-

rather than aluminum,-preventing change in ~ geometry due to collapse of supports;,and (7) fire barriers separat-ing redundant divisions.

g $

T f

I l

y

f. The results of the ~ tests are consistent with the assump- 't tions utilized by NRC in' formulating <:urrently appli- s cable fire protection requirements. ,

The staff agrees with the above comments except for c., e.3 and e 4.'. l For these comments, the staff notes that, while proper plant'admini-: ,

strative controls reduce the probability of exposure fires and any such fire that might occur would likely be less-severe ~than the Sandia exposure. test fire, it is appropriately conservative to:

consider exposure fires in the plant fire hazards analysis because - 4 I

they cannot he discounted. The cable tray volume percent fill' and air space between cables varies significantly-within a _ plant _andl from plant to plant; therefore, the Sandia test is' reasonably represen. f tative of some plant cable installations.

1

3) Defense-in-Depth Thirteen respondents to the UCS petition have_ commented on- thei .

a tRC concept of defense-in-depth.= The comments. fall. into three i j categories.' i

a. The respondents disagree with th'e UCS interpretation.that: ,

each level of defense-in-depth must stand'alone' and'be" "compl ete ." The_ respondents ~ agree that each level mustj

. be strong, but.they do notl agree thAt ,each: level need; (or even can) bel perfect.. For instance,' to absolutely; ,h

- prevent fires, all combustible materials and possible; i ignition source:, would have'to be-' eliminated -La condition; that ~is' not possible in the real/world.

I u- . -4 3 -' -

i # r - ... - - - , . , , ,

- . + , - ,. -, , _ . . - - , - _ , , , , - , . - - .

s

b. The respondents state that use~of physical separation and flame retardant cables are not the only methods available or used for controlling fire camage and assuring capability for safe shutdown of the plant.

c. The respondents state that installed automatic and manual fire detection and suppression capability is adequate to control and extinguish cable fires that may reasonably be expected in a nuclear power plant.

The staff addressed item a above on pages 6-8 of

Enclosure:

1 of the Staff report of November 22, 1977. The Staff position remains unchanged. To reiterate and emphasize that position, we quote the second paragraph of the discussion of defense-inidepth from Regulatory Guide 1.120 - Fire Protection Guidelines for Nucleg Power Plants namely, "tb one of these echelons can be perfect or complete by itself. Strengthening any;one can compensate in some measure for weaknesses, known, or unknown, in the others."

This clearly indicates- that defense-in-depth is achieved by an adequate balance between three defense levels.-

The staff has already responded to item-b in the staff response-regarding cable separation and flammability criteria- above.

Regulator.y Guide 1.120 clearly states ~ that compliance with-Regulatory Guide 1.75 -(IEEE 384). ar.d' Regulatory Guide 1.131

'IEEE 383) alone are not sufficient to protect against fire, niditional fire protection measures are required.

f l

l With respect to item c, the staff agreees that ;he fire detec" i tion and suppression capability presently available in operating nuclear power plants is adequate to assure safe ,

plant shutdown in the event of fires that may be reasonably expected in nuclear power plants. However, further improve-ments of the fire protection program may be necessary as {

determined by the continuing fire protection evaluation program .

for operating plants described in Section III.A.4 above.

4) NRC Fire Protection Program

a. Several comments were received from organizations recommend- ,

ing that operating reactors be shut down until full com- -,

.pliance with thf regulations had been demonstrated. A nt',nber of licensees cc.?mented that they had upgraded tha fire protection measures in their plants since the Browns Ferry fire and were taking additional actions f to comply with the NRC Staff's review of operating plants. Other organizations commented that the NRC Staff has already initiated a systematic review 'of fire protection at operating plants and that this' review is pro-ceeding in a sufficient and timely manner.

I f

i i

b. Regarding plants under construction, or under review for - '

construction peraits, comments were received recommending  !

that construction and *: censing activities'be suspended .

until new guidelines incorporating the results of the  !

Sandia-tests were developed and applicants had demonstrated compliance with those guidelines. A number 'of commentators- -

said that the current NRC staff guidance'was adequate and the evaluation of plants in the licensing process was ,

proceeding in a timely manner. Several applicants conenented

{

that they had submitted their_ fire protection evaluations' to ]

the staff and would incorporate additional fire protection measures, as necessary. . prior to operation of -their plants. . 7, .

c. Severa1 ' organizations cornnented that current'staf f guidance (Branch Technical position 9.5-1 and Regulatory Guide 1.120) required fire _barrie'r separation of redundant cable divisions, j

' Other comments ' stated that_ the: Branch Technical -Positioni j and the Regulatory Guide contained adequate guidance for-- p separation and defense-in-depth.- , , ,

The staff position on the fire protection for plants {in_ operation

- and under construction -(response to items a and b'above) is-treated in'SectionqIII.A.6 of this~ report.-

-46 .

r i

i For item c, the staff _ agrees. Branch Technical Position-9.5-1 and Regulatory Guide 1.120 present guidelines for a fire-i' protection program; acceptable to the NRC Staff for new plants.

4 Appendix A to Branch Technical Position 9.5-1 presents fire protection program guidance for operating reactors and plants under construction. The content'and adequacy of this current staff guidance are summarized and discussed in .

detail in Section III.A.3 of this report.

4 E

h

-i 9

-4 t

. z.  ;

r d

B. Qualification of Connectors, Penetrations, and Other Electrical E quipment Required for Safety

1. I ntroduction The UCS petition and Supplemental Affidavits

• allege that the results of tests of electrical connectors at Sandia and the electrical penetration failures that occurred at Millstone Unit 2, indicate (1) a generic applicability.

to other similar electrical equipment and (2) doubt as-to whether the quality assurance documentation audit con-ducted by the staff is effective for these components- and other similar equipment.  !

The staff discussion that follows provides a summary of staff actions regarding electrical connectors and electrical penetrations, and discusses the-qualification of other similar electrical equipment. Public comments on the environ-mental qualification aspects of the UCS petition are dis-cussed at the end of Sectiot, III.-

• The staff in its recent actions has gone beyond the. concerns: initially .

expressed in 'the UCS petition with connectors and penetration 1 assemblies . -

required to function in the LOCA. environment -This expansion of the scope of-interest had several facets: IE Bulletin 77-05A required licensees to look-at all- connectors ;in . safety-relatedLsystems requiredito function in~ the environment of any: accident they, are' designed .to mitigate;,IE Bulletin 77-06 required licensees to' examine:the qualifications of electrical penetrations in- -

addition- to considering the' implications of the Millstone failures; and the. '

NRR staff has addressed the state of knowledge of environmental qualifications

of ~ all - safety-related electrical equipment. :

-A ,

l-

2. Connectors The bases for the UCS petition are certain test results described in a trip report written by Mr. Ron Feit of RES, dated August 5,1977 concerning the Commission's Quali-fication Testing Evaluation Program and Fire Protection Research Programs, both of which are conducted for NRC by Sandia Laboratories located in New Mexico.*

The purpose of the Qualification Testing Evaluation Program is to obtain data to examine the suitability of current standards and regulatory guides-.for the environmental qualification testing of safety-related equipment required to operate in a loss-of-coolant accident (LOCA) environment. The tests in this pro-gram were conducted to evaluate the adequacy cf test-ing methodology, and not to verify the qualification-

• Three interim Quick Look Reports describing the results of the ongoing qualification testing program were provided by Sandia to NRC in January, March, and July 1977, and routinely sent to the NRC Public Document Room at that time. The preliminary results of the tests were also provided to the NRC staff in the August:5,1977 trip report, and in a memorandum dated August 26,1977_ f rom S. Levine (RES) to E. G. Case (NRR), et al .

1 of specific safety-related equipment. One specific objective is to look for synergistic effects, i.e.,

effects of simultaneous application of.all environ-mental parameters, i

The Sandia program on component qualification testing-methodnlogy involves testing in simulated LOCA environ-ment, including combinations of steam, radiation, water, high pressure and temperature, and chemical additives.-

The equipment used in the tests was intended to be quali-fied according to the IEEE-323 Standard

• which describes 1 1

the basic principles, procedures,- and methods ~ of..qualifi-cation of Class 1E-(f.e., safety; grade) equipment. -

4 The electrical connectors of interest in the petition -

were selected- for testing.early in the pr_ogram because-their physical size was.such .that they_ could.be accom-modated in the available test facility.and not because-i.-

they were known to be.used in nuclear. power. plant 1 safety a

systems.

L- * - IEEE Standard for QJalifying Class-lE Equipment for Nuclear Power. .

Generating--Stations, endorsed by NRC Regulatory Guide 1.89.- 1 J

', d u

Three suppliers of electrical connector assemblies were contacted by Sandia and requested to-provide LOCA-t qualified test specimens that could be accomt ated in the test facility. The electrical connector assemblies included qualified cables provided by Sandia that were attached to the connectors by the suppliers.

Sequential and simultaneous tests involving radiation, aging ,

and LOCA thermodynamic conditions were conducted on a total of twelve connector assemblies. The test procedures  !

1 called for a five-day aging cycle at 130*C to simulate a 40-year plant life followed by a 200 megarad exposure.

The environmental conditions of a postulated LOCA trans,ient were then simulated by raising the temperature and pressure to 157'C and 70 psig, respectively. These conditions were maintained for three . hours with chemical cdditives' and j

'I saturated steam. Af ter- return to ambie'nt conditions, a second identical LOCA environment was simulated and main' -

tained for an additionaltthree hours. This second LOCA transient was added-.for conservatism. The test continued for 14 days af ter .the secono LOCA transient: to. simulate a -

return to normal ambient conditions.

=j

7 .

1 The connectors under test were checked before and during the test by making electrical measurements that are indi--

cative of the ability of the connectors to ~ perform in safety.

system circuits. All twelve of the connectors tested failed-at some time during the test.- Seven connectors _ failed early in the first LOCA transient, but the other five continued.

to function through the first LOCA transient.

As a result of the electrical connector tests at Sandia Laboratory, ~ the staff made preliminary ' efforts to detennine the extent of the use of connectors in safety systans. Although it -

was originally believed that electrical connectors were not -

generally in use in safety systems inside containment, as a' result of discussions in mid-August between IE, NRR, and-RES. ;IEL contacted Sandia, connector suppliers and reactor vendors.in September to' obtain further information on the qualification of.

the connectors used in the -Sandia . tests and their use in- nuclear power plant service.

i ii l

_- d

' From these inquiries it was established that the con-nector assemblies used in the Sandia tests had not been.

properly'qualifi~i to IEEE Std. 323-1974 and that con-sequently the failures of the Sandia test connectors did--

not demonstrate a deficiency in.the Staff's qualification criteria. It was further concluded from these inquiries that these connectors were not generally used in safety-systems required to be environmentally qualified. Nonethe-less, in Or tober IE initiated the preparation of Bulletin 77-05 " Electrical Connector Assemblies" 'to obtain documen-ted infomation regarding connectors presently i_n use in safety systems. The bulletin,-issued on November 8,'1977, directed licensees and permit holders to provide informa-tion on connectors used in safety related systems located inside containment, subject to a LOCA environment, and-required to be operable during a LOCA. A supplemental bulletin 77-05A~, issued November 14, 1977, directed licensees also to provide information on-all connectors-in safety _ systems inside or 'outside containment, and required to function to mitigate an accident (not limited to LOCA's) .where the accident itself could adversely affect-the ability. of. the system to perform its safety function. ,

The UCS Petition was received on Ibvember 4,1977, while Bulletin-77-05 was being prepared. Af ter receipt of the UCS Petition, and prior to the issuance of the Bulletin, the Staff initiated a telephone survey to obtain early preliminary information from architect-engineering firms and nuclear steam suppliers on the extent to which connectors are being used in nuclear power plants, the type of connectors in use, and the bases available to support that, where necessary, the connectors had been qualified for an accident environment.*

The results of the staff follow-up meetings with licensees identified during the telephone survey as utilizing connectors indicated that some licensees did not have complete quality assurance data immediately available. The Office of Inspection and Enforcement has this matter under consideration and will take whatever enforcement action may'be indicated , shim the review is -

compl eted.

• The initial results of the telephone survey were reported to the Commission in the Staff's November 9,1977 report and discussed-further at the tbvember 11, 1977 Commission meeting. Additional information was reported to the Commission on ' November 18, 1977, November 22, 1977, November 25,-1977, December 6,:1977 and was discussed at _the December 8,1977 Commission meeting.

s

In addition to the preliminary telephone-survey, the- 4 Staff has reviewed responses to Bulletins 77-05 and-- - 77-05A,._ received from the licensees of the 65 operating nuclear power plants.

Table B-1 summarizes actions taken and the current status of the nineteen plants identified in,the staff survey and in response to the Bulletins as using connectors in safety-related systems inside containments. Table B-1 is different from the table shown by the ,

staff at the December 8,1977 briefing for the Conaission as a result of additional information received from licensees in response to the bulletins. All identified connectors ~ that are inside containment and required to function in the LOCA environment have been qualified as set forth in the Table. The responses to: ,

the bulletins have confirmed the staff's understanding that electrical connectors are also used in various safety-related systems that are not required to function in a LOCA environ-ment. The staff is continuing to review the responses as part of its review of the entire subject of electrical equipment qualifica-tion discussed in Appendix B to this report.

w

TABLE B-1

-ACTIONS TAKEN AND CURRENT STATUS OF 19 PLANTS-HAVING SAFETY-RELATED ELECTRICAL CONNECTORS INSIDE CONTAIN E NT-AND RE0 VIP 10 -TO FUNCTION IN LOCA ENVIRONIENT-December 15, 1977 PLANT INITIAL ACTION CURRENT CONNECTOR STATUS D. C. Cook 1 Nov.18 shutdown and con- Replaced with splices quali-firmatory order fled by tests--restart Dec. Browns Ferry 1, 2, Nov.18 letter Qualified by .testsLand analy .-

and 3 10-day response sis--confirmatory tests ongoing Nine Mile Point 1 Nov.18 letter Qualified by analysis and com-10-day response parison--confirmatory tests ongoing Oyster Creek Nov. 23 letter Qualified by analysis and com-9-day response parison--additional' supporting-information requested Maine Yankee Nov.18 letter and Pa rti al ly - Qu al i fi ed-- awai ti ng; docu-I&E 77-05 mentation of full qualification Surry 1, 2 Nov.18 letter and Partially Qualified--awaiting docu-I&E 77-05 mentation of full qualification Oconee 1, 2r 3 Nov.18 letter and Qualified by tests--awaiting I&E 77-05 formal" documentation Hatch 1 Nov.18 letter and Qualified by tests--awaiting I&E 77-05 - formal documentation' Ft. St. Vrain Nov.- 18-letter and -Qualified by tests--awaiting I&E 77-05 formal documentation Pilgrim 1 I&E 77-05 Qualified by tests--awaiting for-mal . documentation -

-Peach Bottom 2, 3 I&E 77-05 Qualified by tests--awa.iting.-

formal documentation Palisades I&E 77 Identical - to Oconee Connectors -

--awaiting formal documentation 1 Connecticut Yankee I&E 77-05

~

Four-connectors-replaced by2

-terminal blocks inside' qualified junction boxes

\

m- .

m. -

3. Electrical Penetrations Although the Sandia tests did not involve electrical pene-trations, the supplementary UCS affidavits of November 10,1977 and November 17, 1977 questioned the qualification of penetrations lon ,

the basis of the Sandia tests, and noted recent experience with penetrations at-Millstone-Unit 2.

IE Bulletin 77-06 " Potential Problems with Containment Electrical bnetration Assemblies" was issued on-November 22, 1977. _That N11etin was issued as the result of the electrical shorts that had-occurred in penetrations at the Millstone Unit 2 facility-durin'g nonnal operation. The Bulletin required licensees of operating-reactors to provide oral and written information regarding the use and qualification of certain containment electrical penetration assemblies.

The oral responses to the Bulletin on-penetrations'were reported to the Commission on December 6,1977. Written responses' tol IE Bulletin 77-06 have been received'from all of the1 operating.-

light water reactors. (The bulletin was not issued to Ft. St.

Vrain, a gas cooled reactor, because it had earlier been detennined that the types of penetrations of concern were.not-installed in that plant).

=

r

- The written: responses 1have been consistent with the information:

• obtained fromltheloral responses and the: follow-up~conversa-tions related to those responses. The written responses provide no hew-information _ ofJsignificance :but. do reinforce the conclusions drawn-from the oral ;responsesf and indicate a need >for the staff to pursue certain specific qualification information in greater detail with individual licensees.

As reported previously, the: responses show.differencesiin' operating procedures:with regard to maintaining nitrogen pressure on those:

penetrations having: nitrogen addition . fittings. zSince :the penetrations:

have been qualified both with~ and1dithout nitrogen pressure,'

this difference -is not surprising._ However, 'in: view of the experience with unpressurized-penetrations, the staff inten'ds to. pursue _thisi matter wi th -individual licensees. Thirty. of the sixty-fourf facilities report that nitrogen pressure is maintained:on .the penetrations, whiles eighteen _ report.that. normal operation 1does notLinclude<the nitrogenn

-pressurization. Six ofithe remainder have;a penetrationTdesign thatL does not accommodate: nitrogen: pressurization. ~The- remainder were -

not' clear as to stheir operating practice in Lthis' regard, with

-three-of_them-reporting nitrogen was'used for pressurization 1forLleak:

testing but indicating.that- pressure:was. not. maintained.duringLnormal

. operation.

5 4

-Our review' indicates that three facilities, at two power stations, I experienced significant penetration failures in the past. Surry Units 1 and 2 reported several failures in 1972 due to undersize transition-pins. These penetrations'were replaced. The third failure was at.

Millstone Unit 2, which was the event that led to NRC's concerns in this area. The failed. penetrations at Millstone Unit 2-are being replacco. Some licensees have indicated, and the staff is 'also aware of such events, that there have been instances of malfunctions due to leakage; however, in no case has this leit to a loss of function of the penetration.

The Of fice of Inspection and Enforcement has requested copies of qualification test data from all of the penetration vendors, either directly or through licensees. -(in some cases, the original' manufac-turer no longer makes these devices). This infonnation will be reviewed when received, and any remaining questkrs .c.11 De resolvad.-

Since it has.been detennined that qualification tests have. been performed for.all penetration types,' the major remaining questions -

relate to specific test conditions.

In the December 6,1977 report, the Staff indicated that there were three plants (Dresden 1, Yankee. Rowe, and Connecticut Yankee) for which we were awaiting additional infonaation on the qualification.of their penetrations.

These licensees have-reported to the staff and indicated that sufficient qualification information exists to allow con-tinued plant operation. The staff agrees.

4. - Other Electrical Equipment

.During the course of the surveys on electrical connectors-and penetrations, the Staff ~found that there were a number ,

of operating plants for which complete documentation 'of the t

environmental qualification tests of the electrical equip-ment in question was not immediately available, although other types of information were made available to the staff to provide assurance that the equipment would perform its safety function under accident conditions. The staff review of the documentation of the capabilities of these two electrical components is continuing. The ~ surveys con-ducted by the staff constitute a preliminary audit _of the adequacy and qualification of certain safety-related electrical equipment in operating plants, and it is.the staff's~

belief that the findings would be similar' for other. electrical components in safety systems located inside. containment in these plants. Further, we believe that the results of the sur-veys indicate that the commitments made by the licensees in their !

applications to qualify safety.-related equipment.have generally been satisfied and support our overall: position that.no immediate action with regard to the question of. environmental qualifications of other safety-related electrical- equipmentnin-operating reactors is warranted..

Beyond the question of immediate action, the staff has. con--

u L sidered whether the recently' completed preliminary surveys

- regarding electrical connectors and containment electrical-

l. penetrations in operating plants should be expanded to

consider, on a longer term basis, the' safety adequacy _and environmental qualification of other electrical equipment tin these plants. The Systematic Evaluation Program for Operating Reactors recently approved by the Commission provides a suitable framework for such an expanded effort ~since it already includes " Environmental Qualification of Safety-Related Equipment" as one of the topics of safety. significance (Topic III-12) and further provides that topics considered. to be of special safety significance may_ be considered on= a case-by-case basis in advance of completing the overall program.

The staff has detennined that it is appropriate to' complete _ its review of _ this subject as the first topic of the Systematic-Evaluation Program (SEP). The licensees of the eleven SEP facilities will be required to evaluate the environmental qualification of all electrical- equipment they deem r.ece'ssary to mitigate the. consequences of design basis events. It is expected that in about three months, the staff review effort will be sufficient to assess any safety ' implications in sufficient .

detail to decide-whether or not additional review of facilities other than those included in the SEP. is required. The results of this. staff review will be-used to determine whether it is-

-necessary to expa'nd the effort from the eleven SEP' facilities.

to other operating nuclear power plants. The staff's bases for this approach-are set forth in its report, titled,

" Staff Report on Environmental Qualification of Safety--

0, elated Electrical Equipment" dated December 15,:1977_ attached as Appendix _B.

l 1

5. Summary of Public Responses to UCS Petition Concerning Qualification Tests Forty-four letters were submitted in response to the Nuclear Regula^-

tory Commission's request for public comments on the Union of Con-cerned Scientists' Petition for Emergency and Remedial Action, noticed in the Federal Register (42 FR 58803) on November 11,1977. These letters did not provide any new information not previously considered by the NRC staff in the evaluation of the UCS petition. The comments made with respect to the environmental qualification of safety-related-electrical cable connectors can be categorized into the following four:

general areas:

a. Comments Concerning the Applicability of Sandia Tests lhe comments in support of the petition are general in nature and reiterate the statements made in the petition without presenting new information.

The comments in opposition to granting the petition made the following specific comments:

i

1

1) The majority of the plants in operation and under con-struction do not use connectors in safety-related systens inside reactor containment that must function in the LOCA environment. In some instances connectors are used in safety-related systems required to function in the LOCA environment; however, in most cases the connectors used 2

are of a different design than those tested at Sandia.

The NRC staff agrees with this comment on the basis of the results to date of the survey on the use of electrical connectors in safety systems inside containment in operating pl ants. The results are contained in memos from E. Case, Acting Director, NRR to the Commissioners, dated November 18, 1977, November 25, 1977, and December 6, 1977, and are summarized in Section III.B.2 above.

2) The connectors tested by Sandia had not been previously qualified to withstand the LOCA environment in accordance with the test procedures specified by IEEE-323-1974 and required for safety-related systems that must remain operable in a LOCA environment.

l

. - - - - - _ _ - - - _ - - _ _ _ _ _ - ~ _ _ _ _ _ _ _ _ _ _ . . _ - - _ _ _ _ . . - _ _

The NRC staff addressed this point regarding the qualift- +

cation of the connectors tested by Sandia :in Enclosure (2) to the memo from E. G. Case,: Acting Dir'ector,' NRR to the Com-missioners dated November 22,1977. -The staff concluded that the Sandia tested connectors were not qualified to IEEE-323-1974 as required for the LOCA environment.*

3) The improper assembly of the connectors (i.e., the mating of the connector to the cable) was a significant factor-in the inability of the cable / connector assembly to withstand the Sandia qualifica; ion environment The RRC staff notes that the Trip. Report of R. Fait dated August 5,1977, did in fact indicate that there.wereiome problems in the assembly of the connectors that could have led to the failure of the tested cable / connector assemblies..

b. Comments Concerning the Necessity for Connectors to.

Function in the LOCA Environment -

The comments in support of-the petition tend to view the failure of.the electrical cable connectors:in -the Sandia tests as indicative. that'all nuclear power -

• A response to the Commission's request for comments cn 'the'UCS petition-from ITT-Cannon Electric Division, dated December 13,.1977 confirms that the Cannon connectors usd in the Sandia test were not qualified and

. states, " At no time.was it stated that Class IE qualification status was necessary for components. in tnis test program.- In addition,-no Q.A..docu-mentation-was requested either . verbally orin writing to' support qualifi-cation status. As Ta result,-we shipped Sandia .of f-the-shelf connectors -

designed and-qualified to Military: Specification MIL-C-837231(a non-nuclear aerospace specification) ., These connectors were.not qualified .taL IEEE 323 -

by Cannon. There are no' design:or fabrication problems with these connectors:

when used in accordance with!the Military Specifications to which they were designed. The connectors / cable assemblies' subsequently failed the: test, as E 'did assemblies from'other manufacturers."

64 -

plants are unsafe inlthat the safety-related accident mitigating systems would not function due to failure 6*

electrical cable connectors.

i Comnents in opposition to the_ petition note that the use of electrical cable connectors is plant specific and must ,

be evaluated on an individual case-hy-case basis.

The NRC staff believes that blanket extension of the Sandia test results to all safety-related accident mitigating systems.

in all power. plants is not appropriate because the Sandia connectors were not properly qualified for use in: nuclear plants. The staff has evaluated the use of electricalz cable connectors on a case-by-case basis.

c. Comments Concernino the Qualification of Electrical _jiable _ i Connectors in Operating Plants and Plants Under__ Construction Commentators in support'of the petition 1 raised a' question as; r.

to whether electrical cable connectors that were used inside contairment for applications where such components'must function in a LOCA environment were properly qualified in presently operating plants and plants under construction.

4

r

_ d 4

4 i

, , - The: qualification of ~ electrical cable connectors in:the  :

~ c; 65 operating plants has been addressed by thejNRC surveye on use of electrical connectors--in safetyisystems--_insidei q containment in operating plants, asLdiscussed.above. -

The' qualification data for plants under construction will--  :

be reviewed in accordance with the staff's Standard Review:: 3 Plan as part of the reviews for operating licenses.-

a

d. Comments Concerning the Validity _of Oualification:of Class lE; Equipment to IEEE-323 , . :

a 1 _ Comments in-support of the petition indicated that the: failure - s i

of the electrical cable connectorsithought toibe qu'alified to >

J IEEE-323 was11ndicative- of- a deficiency in thel iEEE-323;qu'ali-fication standard.~

Commentators opposed to the(petition indicated that;the Sandia

-tests do not-reflect on the IEEE-323- document- since' the con ' - I nectors -tested were not qualified to the IEEE-323; Standard -

S forLthe LOCA environment. ,

v The NRC staff-'does not consider the results off the.;Sandia:: i E tests:on . electrical cable connector's:to be11ndicative': of?

Lany inadequacies _.in the:IEEE-323 qualification; document sincei  ;

the equipment 1 tested was-.not qualifiedito' the1IEEE-3234 h

Data sufficient to demon '

' ~

Standard-for-the:LOCA environment. - !

strate . environmental qualification are required for.all: safety-related equipment that must be functionalfin>the LOCA environment.-

~ .

IV. CONFORMANCE WITH COMMISSION REGULATIONS The UCS petition, and the supplemental materials filed by UCS', assert ,

that the Sandia tests demonstrate that nuclear power plants now operating-or under construction do not meet applicable Commission regulations.

Specifically UCS asserts that such plants do not conform to GDC-3 which deals with fire protection, GDC-4 which deals with environmental-qualification, with 10 CFR 50;55a(h) as it reletes to single failure requirements and with other " single failure"' requirement provisions of the General Design Criteria.

A. General Background on Relationship Between Regulations '

and Staff Guides The basic Commission regulations establishing design and performance goals for nuclear power plant safety are contained, in the main, in the General Design Criteria in 10-CFR Part 50, Appendix A.-

These- performance standards are generally cast in broad general terms as to the goal to be satisfied by various structures, . systems and components important to safety.

Specific methods for implementing the GDC requirements have.been developed over the course of time as the licensing process has progressed from its early years. For older plants, the design and perfonnance standards- were evaluated in all. instanc'es on an ad hoc case-by-case basis

• Starting in 1969, the. Staff began development of

• Although the GDC were promulgated as part of 10 CFR Part 50 in 1971-the basic safety considerations embodied in the GDC had been in general use from the early 1960's.

Regulatory Guides (originally called Safety Guides). Today, there is-a panoply of regulatory guides, standard format and content guides, and ,

Standard Review Plan provisions, along with associated Branch Technical Positions (BTP's),allaimedatprovidingspecificguidanceasto acceptable methods of implementing various facets of the general design and performance goals of the GDC. .

These guidelines describe acceptable methods for implementing the General Orsign Criteria. Applicants are permitted to propose other methods _(e.g.,

by design, tests and administrative procedures), of demonstrating acceptable compliance with the General Design Criteria. As new guidelines and staff-positions have evolved, however, there has been a . general trend for them to address more topics and be more comprehensive. A result is that new applicants find the staff is looking deeper and imposing more specific limitations and more specific functional requirements than-it did previously.

The regulatory guides and staff positions are _ intended to establish -

reasonable and uniform methods which will . satisfy specific' aspects of the particular requirements. _However, they'are not-directed:toward

. identifying minimum methods to achieve compliance with the regulatory g-requirement. Rather, a system or component designed to satisfy an ' applicable regulatory guide or staff position wi11' satisfy:the related aspect 'ofithe-GDC with margin. The Staff-prefers the use of methods. described in. regulatory L guides and staff positions to achieve a more' effective and efficient review 1

process which also provides a degree of uniformity in attention given-

.by industry to specific safety considerations. :There is generally a margin, and in some cases a wide margin, between the methods that satisfy a regulatory guide that is generally applicabic to all plants or to a class of plants and those methods which could be considered the minimum needed to satisfy a GDC requirement for a specific plant.-

Thus, while compliance with regulatory guides is not mandatory. such compliance provides safety margins above the minimum requirements of --

the applicable GDC. As a corro11ary, non-conformance with regulatory-guides does not necessarily result in failure to meet applicable regula-tions or inadequate safety.

B, General Design Criterion 3 The Commission's basic requirement for fire protection for nuclear power -

facilities is set forth in General Design Criterion 3. In sumary, General Design Criterion 3 requires:

1, Structures, systems and compnents important to. safety shall be designed and located to minimize, consistent with other safety requirements ... the probability and effect of fires and explosions;

2. Non-combustible and heat resistant materials shall be used wherever practicable throughout the unit ...;

3. Fire detection and fighting systems of appropriate capacity and capability shall be provided and_shall bc. designed to minimize adverse effects of fires ...;

4. Fire fighting systems shall-be designed to assure tnat their rupture or inadvertent oferation does not significantly ' impair the safety capability of these structures, systems and components.

- 69 1

s

-i Prior to the Browns Ferry fire, these safety objectives of General- '

Design Criterion.3 were implemented on a case-by-case basis. No systematic or comprehensive consideration of fire protection was given by the staff in its safety review of facility applications comparable to present practices. In general, the basic fire resistant characteristics-inherent in the concrete and steel structures-of nuclear power facilities,

~

when considered together with the use of electrical systems confonning to Underwriters Laboratory and National Electric Manufacturer's Association requirements, were generally believed to provide a degree of intrinsic fire resistance sucli that no additional or special fire protection _ requirements were necessary for nuclear power facilities.- The staff safety review consisted principally of verifying information given in SAR's that good industrial fire protection and fire fighting practices and equipment were available at nuclear power facilities. This followed the general require-ments given in the Standard Format Section 9.5.1.

The experience of the Browns Ferry fire _in 1975, however, unquestionably ,

changed the direction of the staff review. Following:the Special Review Group study of the Browns Ferry fire, the staff developed a comprehensive plan for review of nuclear power facilities -to assure the capability of detecting, preventing, fighting, and withstanding effects of serious-fires-so that the experience of Browns Ferry would.not be repeated. These: actions have already been discussed at length in Section _III.A of this report.

The Staff believes that the_ general goals expressed in General Design Criterion 3 must properly be read in light of. the available 'nowledge

- 70'-

1 at that time. After the Browns Ferry fire, the Cormiission might have-modified the regulations-to improve more specific fire protection requirements. We believe, however, that this was not necessary; the staff developed a program to substantially enhance-fire protection at nuclear plants based on Branch Technical-Position 9.5-1 and its Appendix A. This program includes requirements on fire protection systems to assure that no more than one electrical division in the plant can be lost as a result of fire and details of administrative control. We believe that this program provides substantial protec-tion beyond the minimum that might be deemed to satisfy GDC-3. As noted in Section III.A, the NRC has embarked upon a program-to, assure that fire protection programs at nuclear power plants will conform to this guidance at the earliest practicable date.

For the period until these comprehensive fire protection programs can be implemented, the NRC staff has worked closely with licensees to reduce substantially the potential _ for serious fire by assuring careful control of combustible materials and sources.of flame and by improving the capability of fire fighting equipment and personnel.

For the interim period -in which they will- be applicable, these measures will satisfy in a minimum fashion _the general goals'of GDC-3, particularly in light of the very careful attention presently being given -to administra-;

tive control providing for good " house-keeping" to elimir, ate potential- fire:

sources and to control sources of flame (e.g., welding and cutting practices).

For the long term, however, the sta#f position is that there be an appro-priate combination of permanent " built-in" features providing fire retardancy, barriers, fire detection and fire suspension, as called for by Branch Technical Position 9.5-1 and its Appendix A.

In sumary, the NRC's program for implementation of fire protection at nuclear power facilities has two phases: an interim period with an adequate degree of fire protection based on careful administrative controls over potential sources of fire, followed, as pitmptly as practicable, by the implementation of a comprehensive program of fire protection with extensive use of permanent " built-in" fire prevention and fire suppression systems.

The cable fire test results at Sandia do not significantly affect current knowledge on needed fire protection measures for nuclear plants for the reasons given in Section III.A. Indeed, the ongoing Sandia test program may well provide additional infonnation, that may enable us to develop a wider range of alternative methods to achieve the goals of General Design -

Criterion 3; that is, to assure that fires at nuclear power facilities do not become a source of radiological danger to public health and safety as a result of adverse effects.

C. General Design Criterion 4 The basic Commission requirement concerning capability of safety systems to accommodate the environmental offects of postulated acciden.s is GDC-4 which requires that structures, systems, and components be:

__ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - - - - - _ - _ - - _ _ _ - - - - - - - - _ - _ _ _ - _ _ - - - =

h ,

.i h

-l

, -- designed -to accomodate "... the environmental: conditions  :

associated with normal operation, maintenance ' testing, Land .

postulated accidents,' including loss-of-coolant accidents." t appropriately protected against dynamic effects, includinge _

the effects of missiles, ~ pipe whipping and discharging-fluids, that may: result from equipment failures 'and- from events and conditions outside the nuclear power unit. J'

~

, This requirement is. complemented by the ' general provision of Criterion;1 ,

that such systems be designed and tested to quality standards commen - I surate with their importance to safety.

The general standards of. Criterion 1 have been comprehensively imple . .

I mented by Appendix .B to .10 CFR Part 50 which sp_ecifies with_ particula'rity i the characteristics of QA programs required: to assure that systems important to safety have indeed been designed.. fabricated.'~ erected,7 and tested to high quality standards. Together.ihesetrequirements. form-the-basis for a comprehensive program to assure adequate. performance; of-safety evstems under conditions of-normal. operation . maintenance, testing: '

and postulated accidents.

To the extent' that a system or component important -to safety .is not capable.of accomodating the effects of postulated accidents. it does-not confonn to GDC-4. 0n the other hand, there may be. components-capable of accommodating such effects whose. ability. to withstand environmental conditions under which.they a're intended to operate has not.been: adequately?

demonstrated lby methods conforming to the requirements of1 Appendix B.- j This.wo'uld' demonstrate, not- a= failure to satisfy GDC-4, butia failure to conform to the quality assurance requirements of GDC-1, or. a . failure 4 to conform with a particular provision of Appendix B (e.g.,j III,;VI,-and-XI).. ..

o 1-n ., . , . - . .-

. - l'

-If the connectors tested at Sandia were representative of. components in actual use in safety systems in a nuclear power plant, and if the test conditions were actually representative of the conditions associated with normal operation, maintenance, testing or postulated accidents, including loss-of-coolant accidents, then the failure reported by the tests would-appear to be a deviation from GDC-4. The word " appear" is used to indicate it would be necessary to ascertain whether the system was in fact capable of performing its function before the failure occurred and to consider the extent of margin, if any, which exists.

The staff reviews of operating plants conducted.in the course of responding.

to this petition have indicated that-qualified electrica1 ' components, capable of functioning when required during accidents, apparently are in use. Thus, no failure to conf 6rm with GDC-4-has been found. Followup.

actions are in progress, as described elsewhere in this report, .to' confirm these indications. However, there have been.some cases of inadequate documentary support and some other questionab1'e quality assurance practices -

with respect to matters of qualification of equipment. These :aatters are being evaluated for appropriate enforcement. action, if-indicated, 'such .

as whether additional effort should be required in the area of quality assurance practices by specific licensees.

D. Single Failure Reouirements-The UCS petition asserts. that the exposure cable fire in the Sandia-test was able to propagate across redundant divisions and indicates'not only a failure to conform to the General Design Criterion 3 but also a s

failure to. satisfy the single failure criterion of =10 CFR 50.55a(h) requirements for electrical systems contained in IEEE-279. This standard i: incorporated by reference into the Commission's regulations in 10CFR50.55a(h). The petition also refers to the_ single failure require-ments of General Design Criteria 17 and 21. With regard to the concern-on equipment qualification, the UCS petition contends that connector and penetrations could fail if not properly qualified. The petition asserts that this muld also constitute a failure to satisfy the single failure criterion of 10 CFR 50.55a(h). The thrust of .the UCS assertion appears to be that these single failure requirements for electrical systems constitute a basis separate from GDC 3 and GDC 4 for imposition of fire protection and environmental qualification requirements. .

The single failure requirements for electrical systems do not establish' an independent set of design basis events. Rather, they' establish standards for design and performance of electrical systems to assure that such systems are capable of responding'if various design bases events should occur.

In order to determine the adequacy of an electrical system, one must first establish the various _overall postulated design basis events to which'such systems must respond. Guidance as to-the selection-of._these design basis events _ is contained in the overall requirements of, inter alia, GDC-5 of 10 CFR Part 50. The. application of this guidance results

-in the selection of various design basis events customarily used in PSARs-and_FSARs: e.g., design basis earthquakes,' floods, tornadoes and hurricanes; 2 _

loss of coolant accidents; main steam line breaks; rod ejection and rod withdrawal accidents as well as anticipated operational transients.

After the various design basis events are selected, protection systems must be provided to assure capability to respond safely under the various postulated conditions that may result from the design basis events.

In the analysis to determine if a particular electrical, instrumentation or control system meets single failure requirements.the particular design basis event or accident is postulated to occur, along with any related consequential failure that could result from it. Then, the analysis assumes the presence of all. identifiable failures that 'cannot be detected or tested, or which are not in fact subject to surveillance tests as set forth-in the Technical Specifications. Finally, the presence of a most adverse single additional failure is assumed in assessing the capability of the system to provide the necessary pretection for the design basis event. It is the last of those P eps that is mandated by the various

" single failure" requirements.* The first of these steps is mandated by GDC-1-5.

For fires, the requirements to minimize potential for end effects of fires is established by GDC-3. The credible occurrence of cross-divisional fires must be minimized by appropriate combinations or separation, re-tardancy, barriers, fire suppression and fire fighting capability, i.e..-

defense-in-depth.. In instances ~where cross-divisional, fires remain a :

I For a more complete discussion of the single failure criteria see Appendix D.

, , ,. +- -. . ..-,._w _ _.

[

concern, alternative safa shutdown methods or system must be provided which are not subject to damage by any single fire sequence. These are set forth in Appendix A to BTP 9.5-1.

The single failure requirements do not require the postulation of, or protection against, a fire threat more severe than those encompassed by the general fire protection goals of GDC-3.

For electrical equipment qualification, GDC-4 imposes the requirement-that such equipment be designed to accormiodate the environmental conditions associated with the postulated design basis accident conditions under which it must function. The single failure requirements do not require the imposition of standards more severe than those mandated by GDC-4. Rather, they require that the equipment provided to respond to such events have- ,

sufficient redundancy to be capable of providing the. required responses despite the occurrence of another single failure. As discussed above, the surveys conducted by the Staff-indicate that equipment- cap'able of withstanding such environment is generally in use.

The Sandia tests do not bear upon consideration of " single failure" requirements but rather on the basic question:of conformance with overall design goals of GDC-3 and GDC-4. The Staff believes, for the reasons discussed above, that operating facilities satisfy these- requirements.- e and that staff review requirements for plants under construction and those underlicens.ing review will assure that such facilities are ~ designed to conform to these requirments.

l o

77 - ,

E. Available Remedial Actions The Staff report to the Comission of November 18, 1977 contained a  ;

substantial legal discussion 6f the remedies available to the Comission ,

should a violation of Comission regulations be discovered. UCS responded to the Staff's legal position in a memorandum dated November 23, 1977.

The Staff believes that in the third filing by UCS, its prior assertions have become tempered and are, in general, now consistent with respect' to legal principles with that expressed by the Staff: viz, violation of a regulation does not_ ipso facto result in a requirement that a license or construction permit be suspended; but if there is reason to believe that the public health and safety is threatened as a result of a discovered violation of a regulation, remedial action must be taken. A wide range of remedial actions are available to the Comission, including the shutdown of a' reactor, if necessary.

Two areas of controversy remain. First, UCS and the Staff disagree as to whether reactor licensees are currently in non-compliance with Comission regulations. The' Staff has addressed this question above, and has concluded that the Comission regulations cited by UCS have not been violated. (Q uestions concerning possible' violation of quality-assurance requirments are currently being evaluated). Secondly,.and we think-much more basic to UCS' petition, is a factual dispute'with the Staff as to whether the fire protection program now being implemented by the Staff, and the methodology used for environmental qualification-

of reactor components, are sufficient to safeguard the public health and safety. These factual disagreements are really the crux of UCS' petition, and have been fully addressed by the Staff, both in previous submissions to the Comission, and in previous sections of this report.

i l

! -5

'l i

~

l l

l APPENDIX A DETAILED CHRONOLOGY OF CORRESPONDENCE-

• RELATED TO UC$ PETITION November 4,1977 Letter from Ellyn R. Weiss, Attorney for the '

Union of Concerned Scientists (UCS) to the NRC Commissioners containing a filing of a' Petition  ;

for Emergency and Remedial Action by< the. Union of Concerned Scientists. Petition alleges .that-information from recent Sandia tests, which was.

withheld from Licensing Boards, establishesL that safety equipment may fail toioperate' because (1). certain connectors in safety related systems cannot withstand a LOCA environment, and (11) fires can destroy redundant electrical cables. Four .

attachments to the UC5 Petition and an= affidavitT of Robert Pollard are submitted as -the~ basis- to -

support the allegation that NRC regulations are-being violated and, the public' health:and safety cannot be assured until all reactors are shutdown, all plant construction. is ceased. and.research-

- programs are accelerated.

November 8,1977 - Memorandum from.N. Moseley, Director, Division of Reactor Construction Inspection Office:-of Inspec-tion and Enforcement to the' five 'RC Regional

- Di rectors' requesting 11EL Bu11etinL tb. 77-05. .

Electrical . Connector Assemblies, be dispAtchst to' all facilities with an operating. license or construction permit. Bulletin requests informa-tion be submitted.to NRC indicating the use.of

-connectors:affected byfa-LOCA and'theLdocumen--

tation' supporting _ their _ qualification.1 Attach ~

- ments to- Bulletin 77-05 ' contain;a = description of-connector test-equipment,~ test scope and-test results of- the .Sandia ~ tests.

- A1 4 m w w,e- y , o n t ~ v er - ,cp4 m ,wc. = "'

i

w; -- - _ _ _ _ _ _

I November 9, 1977- Memorandum from-E. Case to NRC Commissioners q~

stating that UCS request- for immediate suspen--

sion of issuance of all licensing And the '

shutting down and stopping of construction on all J plants is not warranted. Attachment."lRC Staf f Report On the Question of Whether the Petition-of the Union of Concerned Scientists Raises i Matters that Require immediate Commission Mtion" dated 11/9/77, contains staff evaluation of ~ ,

Sandia tests and staff basis for rejecting UCS ~

- Petition. j November 10, 1977 Letter from Ellyn R.. Weiss of the Union of Con --  ;

cerned Scientists to the NRC Commissioners res - i

miding tJ t'ie staff's November 9 report to the Commissioners. An enclosure entitled " Supple-r mental Affidavit of Robert D. Pollard !n Support--

i of the Union of Concerned Scientists' Petition-for Emergency and Remedial Ation" provides La '

-i refutation of the staff's evaluation of.the -

-safety significance._ of the cable: fire and con-nector tests and expands the concern to contain. l 1

ment electrical penetration asssemblies.- ,

November 10, 1977 . Memorandum from K. Pedersen, OPE, J. Nelson, 'Or# i to the 'RC Commissioners containing a list of; -!

questions which the; Commission might-want to pur- '

sue with the-staff 'at the meeting scheduled ' -

for !bvember 11 with Mspect to~ electrical con.- '

nectors and cable fires.

tbvedber 11,1977- Staf f Briefing of the_ Commission in open meeting.

November 14, 1977 IE Bulletin 77-05A extends the scope of lE

)

Bulletin-77 05A to-include all connectors in safety systems which could be ~affected by acci- o

' dents. other than t,0CAs .and toilocations out-side containment. ,

A-2 4 q

q

[

q g li 1

7 p(1 1 _

November 17, 1977 Letter from Ellyn R. Weiss of the Union of Concerned Scientists to the NRC Commissioners with an enclosure "Second Supplemental Af fidavit of Robert D. Pollard in Support of the Union of Concerned Scientists peti-tion for Emergency and Remedial Action" that responds in particular to the Staff's comments made at the Commission's Ibvember 11 public briefing. UCS requested that Mr. Pollard be pemitted to participate on an equal basis with the staff at future Commission briefings, and stated again that equipment such as electrical penetrations, cables and cable terminations would fail in a LOCA.

November 18, 1977 Memorandum from E. Case, NRR.to the NRC Commissioners responding to the Commission's request for (1) the results of the latest surveys on the use of electrical connectors, (ii) OELD's position on UCS's letter of Ibvember 10, 1977 and (iii) staff's responses to the ibvember 10 memorandum from OGC and OPE. Enclosures to this memorandum include a Commission order to D. C. Cook Unit 1 to shut down until unqualified con -

nectors are replaced, a summary of the connector survey-and OELD's discussion on the inter)retation of the Commission's responsibility with t1e law.

November 22, 1977 IE Bulletin 77-06, " Potential Problems with Containment Electrical Penetration Assemblies" requests information be submitted to NRC on a) whether .GE Series 100 type containment electrical penetrations or similar type are used in safety-related equipnent, b)- have electrical failures been experienced and c) whether a nitrogen pressure is maintained.-

November 22, 1977 Memorandum from E. Case, NRR, _to the NRC Commissioners containing the staff's responses to UCS's letter of Ibvember 10, 1977, and to the questions raised'in the November 10,1977 - memorandum - from OGC and OPE.-

Copies of letters to' selected licensees requested further connector infomation are enclosed. Memo-randum indicates that additional plants e.g. BWR's-having Target Rock valves have been found to con-tain conaectors since the staff's tbvember 18 pre-liminary survey was_ issued.

A-3 o 1 m

November 23, 1977 Letter from Ellyn R. Weiss of the Union of Concerned Scientists to the NRC Commissioners enclosing a legal memorandum in response to the DELD memorandum of November 18, 1977.

r November 25, 1977 Memorandum from E. Case to the NRC Commissioners supplements the staff's November 18, 1977 report -

relating to the use of electrical connectors at 0yster Creek, and BWRs with Target Rock Valves.

Enclosure contains IE Bulletin 77-06 which requests information from operating reactors by 12/5/77 on the use of electrical penetration assemblies.

December 6,1977 Memorandum from C. Case to the NRC Commissioners L 1977 supplements the Staff's reports, specifically November addressing a)18 and 25, s pre.

staff liminary survey on the use of connectors. in operating pl ants, b) staf f's preliminary survey on the use of containment electrical penetrations in operat-in c) public comments on the UCS petition, d)g plants,R. Pollard's second supplemental affidavit, and e) summary of staff present and future actions with regard to equipment qualification.

December 8,1977 Staff briefing of the Commission in.open meeting.

Mr. R. Pollard of the Union of Concerned Scientists, and Mr. K. Ellis of Conner-Moore also made presen-tations to the Commission.

A-4 h

l-

I'

)

APPENDIX B-f STAFF REPORT ON THE ENVIRONMENTAL OUALIFICATION OF SAFETY-RELATED ELECTRICAL

• =

EOUIPMENT- ,

i l

December 15,--1977-5 -

N

_- (

i J

1

m- __

i -.

E<

TABLE OF CONTENTS Page Number 1.0 Introduction 1 2.0 Eeuipment Qualification - Older Plants 3 2.1 Technical Safety issue 3 2.2 Operating Experience 5 2.2.1 Boiling Water Reactors 6 7

2.2.2 Pressurized Water Reactors 9

2.3 Cualification of Equipment in Older Plants 9-2.3.. Background 2.3.2 Previous Backfitting 10 14 2.3.3 Connectors and Penetrations

~15-2.3.4 Cabling.

18!

2.4 Other Considerations 18 2.4.1 Timing Considerations

20 2.4.2 Eauipment Response 21 2.4.3 IE inspection Program ,

22

, 2.4.4 Doutine Experience Review 23 3.0 Adecuacy of Qualification Program 25 4.0 NRC Confirmatory Research Program -

25 4.1 ' Synergistic Testing 25 '

4.2 Aging Effects Source Term' Equivalences 128

~4.3 1

T_ABLEOFCONTENTS(CONT! fly _ED1 ED Page Number _

'i 31  ;

- 5.0 SEP Program 31 5.1_ Scope of Technical Review -r

.32 [

I,--

5.2-- Extent of Present Program 6.0 Conclusion 2 4 Appendix A Appendix B ,

t

+

1

}

. e-T

. t I

t h

,"~'

w.a .. --

ENVIRCNMENTAL QUALIFICAT10ti 0F SAFETY-RELATED ELECTRICAL EQUIPMENT ___

1.0 In'troduction The current NRC safety review process for nuclear power plants includes criteria related to the qualification of certain electrical equipment.

These criteria require that electrical equipment important to safety must te cualified to function in the environment that might result frem various accident conditions. Although such criteria have teen aDolied since the early days of c mmercial nuclear ocwer, the details of inese criteria nave teen changed over tne years. The evolution of environmental qualification of safety-related electrical equipment is described in Appendix A.

Chances to these criteria have raised scme questions as to:-

(1} the degree to wnich electrical equipment used in older olant designs (these coerating) is cacaole of withstanding the-environmental conditions (pressure, temoerature, humicity, steam, cnemicals, vibration, 3nd radiation) of various accident conci-tions under which it must functi0n (i.e., the " qualification of equipment" in these older plants), and the adecuacy of tests or analyses conoucted for ecuipment usec :f (2) in newer plants to "cualify" sucn equiement as esoable of with-standing the conditions of the environment created by various accicents during wnien the ecuipment must function (i.e., tne "adecuacy" of cualification tests).

f

.t.

As noted in Appendix A both of these items are the subjects of ongoing generic prograns of the NRR staff. The first subject, the " qualification, of equipment review", and the safety of operating plants is the principal-subject of this status report. This subject will be discussed in

- Section 2.0.

' The second item, the " adequacy" of qualification' tests 'is the subject-of two-NRR Category A Technical Activities. An allied concern. ~whether tests for certain parameters (temperature, pressure, humidity, steam -

and chemicals) and radiation which are conducted sequentially-accurately reflect electrical comuonent -performance under accident ccnditions in which all conditions would be imposed simultaneously. Lis the subject of an ongoing NRC confirmatory research program. These subjects 1will be discussed in Sections 3.0 and 4.0, For both the "cualification" and the "adecuacy" issues, itLis our conclusion that there is reasonaole assurance?that'public nealth andlsafetyf

~

is adecuately protected during tne period-of Ltimeinecessary .to acnieve-their systematic, comalete resolution and that.no additional 1immediate action is warranted at this time.

1 The bases for .this conclusion. . supporting .information, ano our-estabitshed programs for the' resolution of these issues are cescribed lin;1ater.sectionsofthisreport.

,-1$J

. c m - - m m _ m , ,. ._

y 3

2.0 Eouioment Qualification . Older plants _

2.1 Technical Safety Con g Despitt the conservative design, construction and operating _

practices and quality assurance measures required-for nuclear pcwer plants, safety systems are installed at nuclear olants to mitigate the consecuenses of postulated accidents. -!t-is the equipment associated with these safety systems that is of princi--

a1 concern with respect to the environmental cualification issue.-

Equipment needed for normal operation and eouipment needed to resoond to plant -transients is not of primary' concern. This is:

because past operating experience, especially that from frequent testing requirements, has shown that safety.celated eouipment can-

erform in a normal operating environment._ When problems are -

encountered during normal operati n they are easily' identified and corrected. Ad:litionally, the crincioal safety systems required to function during anticipated transients ~(those events that are likely to occur during a clant's lifetime) would not be '

subjected to environmental conditions'_as severe as those of.

postulated accidents before cerforming their-safety function.

'h The postulated accidents that have been identified as creating-severe environmental conditions inside.of containmentiare breaks-of high energy pioes. - The most limiting of these accidents!are

4 the loss of coolant accident (LOCA) and main steam line break (MSLB). In each of these cases, het pressurized water and steam can create a high temperature environment (250 to 400'F) at high humidity (including steam) and pressure (as high as about 50 psig);

For some applications, chemicals are included in sprays that are used to reduce the pressure -in the- containment. Additionally, some-electrical equipment is predicted to be submerged fo11cwing the l

postulated accident. Therefore, for these soplications, chemicals and submergence are included in the environmental qualification in addition to the tamoerature, radiation, humidity and oressure- .

conditions.

While such accidents are judged to have a low like'lihood of occur- ,

rence, less than once per thousand reacter years for smaller pipe breaks, and much less for the:large design basis breaks,.the 'IRC'- ,

has recuired that safety systems, princi:aily thejECCS and containment-  :

isolation and cleanup systems, be environmentally qualified to.

mitigate these accidents. For PWRs, the' ECCS is often supplemented q with additional instrumentation and controls to isolate:a steam __

generator with-broken pipes to mitigate the censequences of'ae l

costulated MSLB, To assure that'these systems would perfonn __

their required function,_ the NRC has' required not only redundancy; in this equipment. but that it be designed with the. capabilityD t

~

to perform in:the _ environment associated with such -an accident. -?

)

The electrical equipment of concern during-postulated accident conditions includes (1) the instrumentation needed to initiate the safety systems and provide diagnostic information to the plant operators (e.g. electrical penetrations into containment, _

any electrical connectors to cabling which transmits signals, and .

the instruments themselves), and (2) control oower to motor -

operators for certain valves (e.g., ECCS and containment isolation -

valves located inside containment). Because of the Comission!s requirements for redundancy of electrical equiement.and " active" comoonents (e.g.. those valves - that must chan'ge position) . -nuclear =

1 power plants have backup instruments, penetrations, connectors, cables, control devices and valves in addition to the primary safety -

system comconents. Therefere, to prevent 4-safety system from adequate:y performing its function._ a- substantial amount of eobio-ment, both the ortmary and bariuo must fait due to environmental-

~

conditions.- In scme cases the redundant eouipment is'outside containment and not_ subject to the same hostile environmental-

- conditions as the_ primary- ecuipment- (e.g. centainment isolation s valves).-

2.2 Ooeratino Experience _

Several events have occurred a_t oceratinginuclear power olants' which provided a level of independent verification.of. the environmental cualification of safety related equicment.: ' Eacn.'

-i

q t

6 n

of these svents involved a release of steam to the contairw4nt.

Although the radiological releases were negligible, sufficient ,

t t

steam was released to create adverse enviornmental conditions within containment. The most severe event'of this type involved an inadvertent discharge of steam through primary system' safety

~

valves directly into containment at Cresden Nuclear Power Station.

.- a 2.2.1 Boiling Water Reactors

.i On June 5,1970 an unexpected reactor-scram at Dresden.

Unit 2 was followed by-a main steam line~ safety valve discharge to the containment. About 250,000 pounds of

~

primary coolant were released to containment caus.ng i an' e

+

increase in the primary containment -(drywell) pressure .to ,

an estimated maximum value of120' psig at .320*F. Although' some equioment damage did occur during =theJevent; the ;j ECCS and' containment-isolation;;ystems functioned procerly.

On December 8.1971~, a similar event occurred at Dresden-o Unit-3. In this~ case t5e containment reached a maximum pressure of,20 psig and a_ maximum temperature of 295?F.

Some equipment damage occurred, although much.less than:

at the earlier Dresden Unit 2'ev.ent,- Agains-all systems)

- necessary for _ safety' remained coerable.-  ;

i s < ,

M.s , - ~, - 1 , i ,, ,.e #,m ,, - # , .._,. , . - .--4 -

4 Steam disen6tge events of less severe consequences have In these occurred at several other BWA facilities.

occurrences the containment was only. slightly pressurized  ;

and temperatures remained below 200'F._ No damage te any.

electrical systems was reported for any of these events.

2.2.2 Pressurized Water ' Reactors Several events have also occurred at PWR facilities which resulted in steam release to containment. 1 On September 24, 1977, an event occurred at Davis.Besse.  ;

Unit 1 which _resulted in a partial = depressuri:ation of the primary-system and the release of about 11,000 gallons of ,

water _ in _the fonn of steam into containment ' through- the cressuri:er= quench tank rupture disk. The. steam release-began about 4.5. minutes after thej reactor was tricced,and-- f was Lterminated about 20-minutes after the1 trio, The-only  ;

eouicment damage occurred within the vicinity off ste6m_

discharge. No_ equipment damage occurred-in safety systems t

needed to. mitigate the event.

On Novemoer 13.1973, following a reactor, trip;at Indian y i

Point Unit 2,' d. break occurred in-the feedwatercline.to la ,

Y

- f3f,' s

_ _- ___.._._4_.. -, 4 u--

. 8 Steam generator. The break was attributed to water-harner. During the event, containment' temperature reached a maximum of 110'F and relative hu'nidity reached a maximum of about 50%, No containment pressuritation was reported. One cable tray was partially subtrerged.in.

water. Howevere the cable within this tray was designed-and tested for submersion. No adverse effects on this cable or on any other electrical equipment in containment were found.

On May 1.1975, while H. B. Robinson Unit 2 was in het shutdown condition, a failure of-a' reactor' coolant.'pumo seal resulted in discharge of about 130.000lga11cns of -

reactor coolant to the containment floor. The containment.-

.was' pressurized .to a maximum of 3 psig with the: maximum temperature estimated to be' about 140' to 150'F. = High--

humidity ' conditions'within containment- remained for seversla hours. No-adverse effects on. electrical.Lequiement were reported.

Other releases of high or moderate energy ceolantlinto containment have occurred'at other PWRs, However, no pressure-rise or equipment ~ damage t'esulting- from' an adverse environ .

~

ment were - reported.

-- ._. -_._-___-_a_.-__-____.----__.,_.2_.___ .._.m..m._.~__.t._._ __.... ._

.g.

2.3 Qualification-of Ecutement in Older Plan,t,,s, 2.3.1 .Backgroung For older nuclear power plants (th' a licensed for opera-tion prior to about 1967) specific nuclear environmental qualificatien requirements had not been estabHshed in-the industry or by the Commission. Licensing conclusions at the time were based upon overall knowledge of the nature of systems and comocnents used and on the types:

of accidents of interest, and upon the awareness that-nuclear components, including electrical system comcon-ents were, and are, of high industrial quality. At_the time, design- ano curchase specifications for electrical equipment adhered to applicable industry standards, such.

as the National Electrical '4anufacturers- Association Standarcs and existing IEEE Standards (e.g., !!EE- Std.

98-1957). In addition, acclicants referenced'vaHous -

testing programs, such as those conducted'at.the Franklin institute Researen Laboratories and'those c:nducted in the AEC's Naval Reactors Program in support of their plant designs.-

'4hile' these- standards are not uniformly ccmoarable; to the more specific critoria currently' used fer nuclear facilities,. they nonetheless are of high cuality.

+} b i

• 10-r 2.3.2 PreviousBackfittj,,n2 The staff has continuad to review-the _ degree to which licensed ,

operating reactors comoly with NRC regulations as.significant ' .

a new safety information becemes available or new regulations are established. This effort, generally ten *ed upgrading j.

or 'backfitting", has had tne' effect of increasing tne degree to which older operating reactors have improved the documentation of envirwnmental qualificatien of safety systems. Generally._ this is accomp11shed by .

staff discussions convincing licensees of the: desirability -

of plant upgrading. However. the_ NRC has directed - .

licensees to upgrade systems in:the past. In ene' case.

that of Dresden Unit.-1, on June 23, 1976.-the staff.

ordered that'the reactor protection system 'ce . upgraded to .

meet IEEE Std. 279-1968 and that other safety?r:1sted equipment not previously~ environmentally' qualifind be qualified or replaced. Dresden' unit 1 is the oldest' O. 5.

operating reactor. (lleensed-in 1959)fand_ for that.

~

reason documentation.of conformance to current licensing' requirements including lo CFR Pert 50, Appendix A (fiDCl4)-

Land Appendix B which were' issued in 1971Lis iackingi , -

- A second, more estensive-effort Linvolved the review of-operating reactors to the1new ECCS requirements 21ssued T.

i 11 in1974-(10 CFR Part 50.46 and Appendir X). - In conducting a

these reviews the staff audited the degree to _wnich- ]

certain operating reactors- met requirements for environ.

U mental qualification of ECC$ equipment.- For those plants-reviewed in detail, certain areas were discovered as not y reeting licensing criteria for eouipment qualification.

Most of the'se deficiencies involved those plants _ licensed -

prior to the introduction of the General Cesign Criter_ia. .

( Appendix : A to 10 CFR Part 60).,; These plants were licensed- .

before systems to mitigate the consequences of a LOCA.were -

required. As would be expected; seme =of.the safety-t related equipment in these older facilities wastfound--

not be cualified for LOCA environmental .' conditions.-

Environmental qualification can be established by either. . l

-s .uitable analyses er tests on equionent to substantiate-1 that the equioment can-witnstand the. oostulated environ .:

mental conditions'.1 / Licensees were-required to upgrsde ~ h existing systems.and ccmoonents in their ECC5 in: order:

to ensure reliable perfctmance if. subjected tof adverse-  :

LOCA envircnmental conditions. 2Several examles of! thesef staff reviews are discussed below.s 2

a

- - . . - _ _ - - ;1 .. _ _ , ,

-12 A case in point is the 1.aCrosse boiling water reactor which was licensed in 1967. Extensive modifications were required to satisfy the ECCS requirements. An integral part of the staf f :

review was the environmental qualification of Safety related equipment. Solenoid operated valves in the ECCS were provided ,

with uninterruptible power sources, the solenoids were housed _

in water free junction boxes connected by sealed mineral insulated cables. Environmentally qualified valves were added in series.to existing valves where Qualification had not been established. Analyses were performed and tests were conducted to verify that electrical equi;; ment'inside..contain-ment would operate in an accident environment.- Containment-electrical penetrations were reviewed and found to be capable of withstanding temoerature, pressure,- radiation. chemical- attack, ano submer ence in excess of that which is- postulated for_ the -

Design Basis-Event; In May 1976. Consumers Power Company was granted, by. Order--

from the NRC, an exemptien to.a' portion of!the FCCS.criterialset a forth in-10 CFR 50.46 Appendix K for Big Rock : Point'(licensed in 1962). The oroer set forth severa1Tconditions which had.

to be satisfied prior to' the Big Rock toint f acility's return

- to operation.. Condition 2.(iii) stated tnat pr.ior .to further -

' cperation of-3ig Rock Point, Consumers Power Company! shall_:

=-= ,_ _ __ _ _- __ --

13=

Protect the centrols.. indication and annunciation-circuitry associated with the ECCS including the core spray valve $, against the consequences of.

flooding following a LOCA which affect:-the ability:

of the ECCS or plant operat,or to take corrective s- action during the course of a LOCA.

During the course of the exemption review the staff and licensee identified other areas where environmental qualifica.:

tion including submergence was suspect. Corrective measures (relocation of equipment, augmented procedures, etc.) sto.

posed for environmental qualification were found acceptable.-

San Onofre (licensed in 1967) ins:alled a new onsite pcwer system in ceder :s comply witn the ECCS requirements.- This- modifica-.

tion incluced diesel generstorsi circuitry, and associateo switch gear, All of which kere cesigned and' implemented in.

accordance with-the IEEE-279 standard and are reouired toc te -

environmentally qualified. In addition. to these major modifications,Jin 1974 San.Onofre preposed an environmental!

Qualification' program.which has been imD1emented and-approved by the NRC staff. ECC3 reviews presently engoing:

7- -at- San Onofre invol've again the- environmental-

-cualifications of equipment,rslated te safety,-

2' 1

i

-t J

r 14 2.3.3 Connectors and Penetrations As a result of the recent staff surveys of environmental qualificationi for electrical connectors and penetration assemblies, the staff has concluded that operating plants are safe but questions related to docum.Jntation retrain. In the case of electrical connectors, as part'of the staff's followuo ,

of experimental results, a staff survey showed that thery were several cases in which a licensee asserted that compon-ents were qualified but adequate documentation of qualifica.

In only one caseM was there an absence tion was unavailable.

of both documentation and other evidence of capability to' perfom in the LOCA environmental conditions.

As a result.of.certain operating experience with electrical pene-trations, the staff conducted a survey of all licensees since-In this case, all coe.ratin'g

~

all plants have these cceponents.

facilities could provide some' assurance that their penetrations had the capability to perform in- the LOCA environment, although saveral did-not have adequate documentation of qualifica-tion. Our. esperience in folicwing througn with. these instances :

of questionable qualification indicates that M'In the one facility (D. C. Cook Unit 1) where connectors were used. -

. without adeounte . documentation'of cualification.: tnere was .a.

temporary period during which the licensee could'not assure:itself--

and the NRC that there was reason'able-basis for concluding that-the systems could nevertheless safely. function. Because of this:

uncertainty, and after discussf onsTwith the NRC, the licensee agreed to shut dcwn the facility while cennsctors could be replaced with qualified solices..

L.

t 4

q

• 15- [

there are sufficient alternatives to assure safety while.  !

the qualifications of the components are' established. .

It is noteworthy +, hat. although these surveys addressed only two types of components that need to function in _,

accident environn.ents, the survey results do not indicste a that unqualified components are in widespread ~use in

, 3 op,erating reactors.

o 2.3.4 -Cablino Wire and cable manufacturers have been aware for many years of ,

the potentially. harsh and extreme environments to wnich electri-u cal' circuits may be exposed.- Cable has been developed and-

'E classified not only on the basis _ of its electrical capabilities but also for its mecnanical : integrity, i.e.. onysical: strength and ability to survive' extreme . temperature . moisture. steam, harsh chemicals,'and to varying degrees, fires. Of course the- a adequacy of. cabling for a particular environment is1 predicated 4 upon the selection of cab.le witn'the procerties required:to ,

When cable;is manufactured' not 'all' ,

survive that environnent. .

t Y

+

i L

12 . _.

16-electrical and mechanical attributes can be practically

< incorporated into one cable design. For example, the very best in electrical properties may not allow the ultimato in mechanical strength or fire resistant .-

properties to be attained. Ccmpromises are made and ,

designs include the important design features and properties:

to ensure a hign reliability electrical insulation resistance system for a given installation.

IEEE Std. 98 1957 outlines the prep'aration of test procedures'for determining experimentally the probabi'e-life of insulating materials and systems. LTest; procedures; for specific materials 'and systems incorocratingninsulating material

• are given in a numoer of other older and updated versions "of !EEE publications. Insulation life;

" ' test procedures are a:part of ASTM (American: Society for Testing. Materials) and NEMA-(Nattenal! Electrical Manufac turers Ass'ociation) standards .and proposed procedures 1and

- constitute a frequent and continuing part of: current technical literature.

m _

p

i J

Military and comercial nue. lear apolications of cabling have lS required the additional consideration of the effects of exposure to radiation as well as other environmental cenditions.

Thase environmental affects were studied on insulating .;

materials, as well as insulating systems which are a combina-tion of insulation materials used in the manufacturing of ,.

cadle, during the early portion of the research and develop-ment phase of nuclear energy applications. both military and comercial . Several professional societies, some of _which .;

are mentioned above, participated in the studies and developed indastry standards for guidance on radiation effects. .;

t IEEE Std. 279-1968.- which was begun in 1964, contained inoustry thinking that tyoe-test data or_ reasonable engineering extrapolation' based on type test data snou1d be; available to verify that safety related components or equio- =!

ment 'would perfem their function during an- accident-cendi-l 3 tion in nuclear oower plant' designs. These early standards-provided documentation of what was existing industry practice ,

I and' provide reasonable assurance that' the cable used insthe--

.olderinuclear power olants was carefully specified and pro-cured for the service conditions ~ to:which it would be exoosed.

One purpose of the Systematic Evaluation Program,-' discussed in .  ;

Section. 5, is to. determine wnether cabling built to. these -

-earlier standards provides sufficient safety margin or whether uograding, discussed in_' Section 2.3.2. :is 'needed.

/

, 2.

y 4

2.4 Other' Considerations 2.4.1 Timing Considerations b

4 In considering the potential effects of.u re LOCA conditions on performance of electrical systems, it is impcrtant to consider the equipment in two separate classes - that which must function essentially instan-taneously to transmit a protective signal in the event _.

of an accident and that which must function for an-extended time.

For those systems and components whose primary purpose is to promptly transmit a signal in the event of an accident.2_( there is a high likelihoo'd thatl.they _will, successfully perform their function well before the' onset. of environmental conditions (temperature, pressure.

etc.) which could cause- deteriorationDof L the equipment-and, thereby, Linterfere _with their- fu'nction, ; Typically

- ich signals are' transmitted in less than a_ few seconds,:

oftim in fractions -of a second after the event-(e.g.,l scram .

signals which actuate control-rods and permit their~inser-l tion). It is.unlikely that exposure to -accidentalE  !

environmental conditions would cause equipmentLdeteriora -

~

tion in'such a limited period of time. . ,

1

- These' include such items as the reactor control rods,: sensors. that -

indicate reactor- parameters such as flow. rate and neutron flux,-

. associated cables connectors and penetrations.

9

x

.-w

-In-any event, once a signal is generatedL(even'if only by the environmental conditions themselves),-the initiation-of

~

the remaining safety-related equipment is- accomplished tnd the signal i .a ly is " sealed ir" and maintained even:if: '

the equipment providing the actuation s'gnal--were to sus -

sequently fail, Once tne safety systems are -initiated, few; components.

located inside the containment are required to function; Sucn components include: ' valves that change position, usually within the first minute. to align the flow patns of the safety systems; isolation . valves that quickly_

close to seal the containoant from leakage; and.the few instrument signals and valves that would normally be!requiret to diagnose the type of accident _ and -institute long term

- actions -(usually required several: hours after an; a:cident). -

Given the reouirements for~ redundance for all " active" comoorcnts in safety-related systems!and their quickfacting-nature (fractions of a second to several tens of seconds), we' would expect that the adverse environmental conditions 'would -

not prevent the essential functioning of the safety-relatsd 1

- equi pment. However,.because this a potential common cause for-

- eouioment failure, the staff reouires : environmental:qualifica- 1 tion of:safet-j equicment. In, clace of equiement that s

<.g , ,

would need to function as long as several hours after an accident, other equipment can of ten be used to perfom I many of the same functions.

2,4.2 Eouiement Resoonse Analyses of postulated design basis accidents inside the reactor containment have identified transient conditions in the containment atmosphere that may be severe but are often of short duration. Generally, the' licensing approach of the NRC requires that a conservative determination of containment atmosphere parameters (e.g., temperature) be calculated and that these conservative parameters then be used as the basis for qualification of electrical equipment' located inside centainment. Historically, equipment was qualified to the conditions predicted to exist during and' subsequent to a large LOCA since they were celieved to be limiting. As discussed in Appendix A, the staff has .

detemired that a postulated main steam line break (MSLB) in PWR type plants with dry containments could result in predicted temperatures higher than tnat of a LOCA, but only for a short 4

- ~- --- __ _ ~ - - ~ - - - - - - - . _ . _ _ . _

period of time (i .e. , 60 to 100 seconds). In order to better understand the thermal response of selected typical electrical equipment inside containment, the staff has performed "best estimate" evaluations of typical components to determine the surface temperature of such components for a particular calculated temoerature in the containment that might result frem a MSLB. This evaluationU ndicates i that because of the short duration of the predicted MSLB environmental conditions that exceed typical predicted LOCA conditions, the thermal response of the type of.

equipment in cuestion would generally not exceed the conditions under whicn the equipment was originally qualified.

2.4.3 IE Insoec:fon Prooram 4 Another program in the NRC that provides additional confidence in the environmental qualification of electrical equipment, is the inspection program of the Office of Inspection and Enforcement. The Office of Inspection and Enforcement in its routine inspection program has amphasi:ed review of environmental qualification test results for engineered safety systems. The emphasis has been placed primarily on the larger comoonents, such as motors,. switchgear, breakers, controls, transmitters, cables, and emergency diesels.

i These activities have been carried out by review of documentation at the licensee's facilities and by insce: tors acccmeanyino the licensee at inspection of vender facilities or..

E emoranoum M to R. Boyd, V. Stello and R. Mattson from R;' Tedesco dated Decemoer 2, 1977. l c__ _ - _ - - -

z,

~ 22

+

testing laboratories. These IE practices, add to the with engineered safety systems will perform -their required!

functions in the accident environments for which they were.

. l designed.

2.4.4 Routine Excerience Review As the number of nuclear power facilities licensed to

~

operate continues to' grow (67 at present), the amount ofc operating experience at these facilities also: increases.

The NRC has' a. thorough mechanism for the reporting of -

operating experience. Over the past year there have been -

about- 2000 Licensee Event 1 Reports -(LERs) submitteditoithe NRC.

These -LERs: are routinely reviewed"by IEsand :the'Divisionfoff

- Operating ; Reactors .

A complete:: file -is ' maintained by the Office. of Management Information'and: Program Control

-(OMIPC).

The NRC's ~ review:of LERs he.lps to identify, first, whether-any electrical equipment is' degrading:under q

- normal operation' andL secondly.- whether :cperational: transients -

• 1 and occurrences.haveLdegraded performance of' electrical; equipment uncer these conditions.

4

[- --

23

-3.0 Adecuacy of Oualification Tests The second issue identified in Section 1,0 relates to the " adequacy" of present environmental qualification _ testing. The question is:

basically one of whether qualification tests that have been and are being performed are adequate to demonstrate that safety-related' electrical equipment will perform in accident environments. One-aspect of this question is whether successive exposure to certain-  ;

parameters (temperature, humidity, pressure, ~etc.) and radiation -is ,

adequate to reflect performance of electrical components under accident conditions in which the exposure to these conditions f s cencurrent. The present industry standard, IEEE Std 323-1974 and its predecessors- are based on the assumption.that sequential testing is adequate. At-the present time, the staff believes- ,

that the successful- Qualification of electrical equipment' for  ;

these conditions, albeit secuentially,- nonetheless provides a-reasonable assurance that such equipment will be able to perfom successfully under ccmbined accident ' conditions. However.

-there is an absence cf rigorous testing under concurrent exposure conditions, and while it is .likely that : sequentially tested components will successfully-perform.under accident conditions, the staff believes it- prudent to confirm this - .

judgment. The confirmatory researen efforts in this regard are discussed in Section 2.0 f a f y f

j l

NRR has a Technical Activities Program involving generic technical-activities judged by the staff to warrant priority attention in terms of resources to attain early resolution. These:

are designated as Category A Technical Activities. . The-Technical-Activities Program was developed to provide a_ basic-framework of policy organizational structure, priority, and procedures'for the- -

effective management of the major technical activities within NRR. '

Two activities ~in this program are _directly related to the environ-mental qualification of safety-related mechanical and. electrical )

equipment. These activities, designated' A-21_ and A-24,Eare related to main steam line break considerations inside containment andJto qualification of safety-related equipment _respectively. These efforts are describad in Appendix'A.

w T

f J

-2 5-4.0- NRC Confirmatory Research Procrams The current NRC Qualification Testing Evaluation Program is.

directed toward providing a confirmatory assessment of current-environmental qualification testing procedures for.LOCA conditions and includes the following specific program elements:

1. An assessment to determine if sequential (as opposec to simultaneous) environmental qualification testing. is conservative, i.e. an investigation of synergistic effects..

2. Confirmation that accelerated aging methodology can be utili:ed.

for qualification testing of safety-related equipment.

3.. Definition of the-nuclear' radiation source based on the Regulatory Guide 1.89 accident assumptions and evaluation of the adecuacy of radiation simulators. 3 s

J.1 Syneraistic Testino The tests were to confirm that the sequential test secuence

-recommended in IEEE Std 323-1974 conservatively simulates the ecmbined radiation ana-steam environment- to whien safety-related ,

equipment would be exposed in the' unlikely' event of a LOCA.: ' A research crogram to investigate potential synergistic effects was ,

initiated at Sandia Laboratories in FY 1975. LOCA' qualification tests are being conducted using the same exoerimental test- chamber and. identical test'samoles (1) -sequentially

" s

+

as recommended in IEEE-Std-323-74, with radiation exposure preceding  :

exposure to steam and chemical environments and (2) simultaneously with radiation, steam, and chemical environments imposed together, A qualitative comparison of the performance of the test specimens in both tests will be made, using on-line measurements:and post-test . ,

evaluation.

Preliminary evaluation of the Sandia tests completed to date does not indicate a significant functional synergism for electrical cables; however, with respect to connectors, it was not possible to determine whether synergism exists-because of the failures that occurred.

4.2- Acing Effects Considerations of aging in. environmental qualification test programs are important' because of the potential. to create a weakened condition in:a safety-related component through some aging mechanism that may not be detected through routine ,

periodic testing.~ A research program to develop.a methodology -

that can be utill:ed for simulation of the natural aging. process:

l

E< '

m s _

4

'27-of safety-related materials on an accelerated-basis was initiated in FY 1976 and'is continuing. The current effortfincludes the following elenents:

a. Single environment aging tests on polymeric electric cable .

materials are being conducted to obtain-data from the separate effects of radiation, temperature and humidity. From these tests, single environment acceleration functions of damage versus time will be obtained at' relatively low stress levels using a test cycle of .about one year. Cable:elongationLis being-used as a relative damage indicator to verify the aging methodology and for comparison with naturally aged cable.

sampl es,

b. Combined environment aging tests will be. conducted toJohtain data on the synergistic aging effect of temperature and ra'd iation.

Synergisms with other aging parameters are planned later in thei program.

c. Tests to determine rate effects are underway. -Of particular-interest are the ratefeffects associated.with~ oxygen diffusion. .J>

-and radiation.

. d. A study of alternate damage indicators.is underway that could be-utilized in addition to the material-elongation criterien whichi

-is. currently being used as the reference damafie:indicater for aging' damage ta electrical cable.

e. flaturally aged-samples are being collected so that the aging-methodology being developed can be checked with naturally.

aged material.

4.3 Source Term Ecuivalences One of the exceptjens taken to IEEE Std-323-1974 by the NRC is the requireo radiation environment to be utilized for environmental-qualification testing. LOCA radiation releases are defined in Regulatory Guide 1.89 which is to be used by an applicant in d

establishing the nuclear radiation environment for type testing.

The accident conditions are defined in terms of the percentage-of. halogens and solid fission products contained in the coolant, the percentage of noble gases and halogens released to.the

-i.

. containment atnosphere and the percentage of halogens. plated out on surfaces inside containment.

The adequacy of currently used radiation simulators to duplicate the accident radiation environment requires ' additional experimental evaluation. A research program to assist in this evaluation was initiated in FY 1976 and is continuing. Progress to date has; consisted of analysis to determine the time relationship follcwing . ]

q a LOCA of dese,l dose rate,-energy spectra and particle ~ type. These data show that current industry practice with regard to radiation

c. )

'l l

A i

simulation testing may be significantly different in tems of dose rate, spectrum and particle type than that described in Regulatory Guide 1.89. The ongoing work in this area is aimed at detemining the importance of these differences in tems of

. damage to safety related equipment. The current effort consists of the following three tasks:

a. Additional source term calculations will be made, based on Regulatory Guide 1.39 assumptions, taking into account new codes and test data developed in other programs. Also, calculations based on proposed regulatory guide modifications will be performed. These calculations will be based on the proposed revision to Regulatory Guide 1.89 which allows for reduced release assumptions for certain classes of safety-related equipment. In addition, source term calculations will be made with best estimate LCCA release ass =ptions as requirec.

b. An evaluation is being made of the adecuacy of currently utilized radiation simulators to duplicate the hypothetical enviroment following the radioactive release postulated in Regulatory Guide 1.89. An initial assessment will be made comoaring dose rates and energy soectra resulting from the conservat e accident assumptions in Regulatory Guide 1.39 to the dose rates and energy spectra cotainable with ors.ctical simula tors.

1

~ i

c. Studies will'be conducted to determine.the damage' to safety-related equipment materials as a function of the gama and-beta-dose-rates and to determine how close the dose-rate profiles resulting' from!-

the Regulatory Guide 1.89 assumptions must be simulated dufing qualification testing. Materials studies will be conducted-utilizing radiation damage data available, and additional:

axperimental data will be obtained as needed.-

T h

r

?

L '- _

1 i5

" J a

F

.31 5.0 SEP Procram ,

5.1 Scoce of Technical Review -

Very recently NRR embarked on a . program to re-evaluate selected' safety considerations for eleven older operating facilities, t That program called the Systematic Evaluation Program is described in a recently issued NRC report.'

One ef. the topics included in this -program, which is< directed at a determination and documentation of -the .degre- to which these older facilities meet ' current licensing requirements,. concerns the environmental qualification of safety-related equipment.

The objective of the SEP's review of this topic is to evaluate the degree to which- the mech. ,ical and Class IE electrical-equipment of safety-related systems has been oualified forLthe environments associated with design basis events. As such. the SEP will. be directed toward the determination.off existing safety margins and~ the evaluation cf the1 adequacy of such' safety margins-to . determine if any backfitting:orffacility upgrading is necessary.

s-Because of recent operational occurrences at the Milestone clant, and in view of the results of the recent surveys- regarding connec t .

tors anc cenetrations, this review topic will be'comoleted-

• Repor: on tne " Systematic Evaluation of Operating Reactors", cated November 25, 1977.

~

if .,'

32-

-I

)

1 as th'e first topic of the SEP, While' the overall- Systematic. i Evaluation Program is scheduled to be completed in about three years, the review of this topic will be accelerated,-

It is expected that within about 90 days the- review effort will be sufficient to assess any safety implications.in sufficient detail to decide whether or not additional review of facilities other than those included in the SEP is required'. The. adequacy!

of the environmental qualification of mechanical equipment will follow that of the electrical equipment. The review plan for this effort for-the eleven SEP facilities is set forth in Appendix B.

5.2 Extent of Present Procram_

The'present Systematic Evaluation Program. includes;the review of eleven of. the older operating nuclear reactors.- - These .

eleven include plants licensed before 1969 and those_

facilities ~ which require a review for conversion of a Provisional!

.0perating License (POL) to a. Full-Tenn Operating t.icense-(FTOL)..

Following the 90. day review of. the environmental qualification =

of electrical equipment' for these eleven older fasilities, the q staff'wi11Ldetennine whether any plant modifications or followuo actions' are recuired for those facilities.and will also consider.

w q

l

^

m _ . . .]

W

)

1 i

x233-- ]

o.

whether the environmental _ qualification review shedld be i extended to' include the remainder of the: operating lfacili ties.-

We have concluded- that the eleven older facilitiesLcan be .

used as ~ a basis .to make such a decision:because:as noted in - ,

Aopendix A, they represent afgrouping of-plants;that would ,

likely have a'lesserf degree of environmental-qualification; for the safety-related electrical equipment;than more recent <

'r plant designs. -

1 1

q' f

i "

L(

i  ;

34 6.0 Conclusions

~

The NRC staff has concluded that no immediate action Commission is needed!o the question of environmental cualification of safetyrrelated electri-cal equipment in operating reactors is warranted.

Beyond the question of immediate action, the staff has considered whether the recently completed preliminary surveys regarding electrical.-

connectors and containment electrical penetrations in operating plants should be expanded to consider, on a longer term basis, the safety-adequacy and environmental qualification of other electrical equipmentc in these clants. The systematic Evaluation Program;for Operating Reactors recently approved by the Comission provides a suitable-framewcrk for such an expanded effort since it already-includes

" Environmental Qualfication of _ Safety-Relatec Equipment" ras lone cf The-SEP further provides that topics the tocics cansidertd.

idered

. considered to be of special safety -. significance lmay be- cons 4

on a case-by-case basis in advance of-comcleting the everall; program, The staff has L determined tnat'it is- appropriate to. complete t?,e review of this-subject as the first topic-of'the Systemacic Evaluation Program.--

It tis expected that -within'about 90. days' the review effort will be sufficient to assess any; safety Limolications Lin. sufficient detail; 1 ,

to decide wnether cr not additional review of facili:ies otherthan those included in the"SEP'is required, L

i i

.y

V The results of the detailed staff review of these topics for. these facilities, the eleven of the older rea'ctors, will indicate whether ,

further action is needed on the other operating _ reactors.- i In reaching the judgment that no imediate action is required on operating reactors, the staff, as discussed elsewhere in this report, considered the following:

1. Nuclear power plants include provistens,.- such as redundancy and J

' diversity, to cope with equipment- failures withou't :affecting the public health and safety,

2. Operating experience indicates that electrical equipment has =

I

erformed adequately under both normal coerating' environmental c ncitions and on the few occasions where severe environmental l c

ncitions nave existed.

3. fven the older ocerating reactors useo conservative design inc; construction practices and many impro_vements nave been mace in the area of environmental qualification, 4._ A-preliminary audit of:the environmental qualification of .

electrical connectors and: penetrations in operating ' reactors .

has indicated that there is; reasonable assurance that this-

~

equipment would perforsits safety function unde 6 accident -

conoitions even thougn complete documentation is not readily available in all cases. It is the' staff's-telief that :neseJ findings would be essentially the same for other safety-related equipment.

y -- -

ms - --- -- _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ - - - - - - - - _ _ _ _ _ _ _

1

5. The likelihood that essential safety-related equipment or other non-safety equipment would not perform the necessary safety function prior to failure due to environmental reasonsO coupled with the likelihood of a major accident requiring the perfonnance of this equipment is very low,

6. The regulations have included requirements for environmental qualification and a comorehensive quality assurance program since 1971. The requirement for environmental qualification was included in initial versicns of these regulations in the mid 1960s. The NRC como11ance effort my the Office of :nspection and Enforcement has emphasized review of environmental quali-fication test results for safety systems in its routine inspection program.

4/ It should be noted- that even in the Sandia tests, uncer the

~

conditions of 49. Guide 1.89, whicn enveloce DBA conditions and are thus ccuservative, particularly- as to radiation and steam temperature conditions, a number of unqualified connectors, survivec for- ceriods in excess of several hour:.

i,

- . _ ~~ - - ~ - - - - . _ _ _ _ ,

u

.ri 4

. Appen' dix A .

I w

REPORT CN'THE HISTORICAL EVOLUTION-0F ENVIRONMENTAL QUALIFICATION REQUIREMENTS.FOR SAFETY-RELATED.

ELECTRICAL EQUIPMENT q

i

?;

. December 15, 1977 c-  ;

s

- F

-[; :

+-

i k

Y v

s a I I

y --

9 ,

r f P

C TABLE OF CONTENTS PAGE-ABSTRACT i

1 1.0 ~ INTRODUCTION _

1:

2.0 EYOLUTION.0F OVERALL'NRC LICENSING CRITERIA q 5

- 3.0 EVOLUTION OF NRC ENVIRONMENTAL QUALIFICA - 9 TION REQUIREMENTS 5  ;

3.1 EVOLUTION OF APPLICABLE INDUSTRY

-STANDARDS-10-3.2 EVOLUTION OF NRC (ONRR) LICENSING REQUIREMENTS

'18 3r

-3.3 EVOLUTION:CF O!aE INSPECTION PRACTICES:

20 <

4.0 CURRENT ~ ACTIVITIES 21 4.1 SYSTEMATIC EVALUATION PROGRAM 22 4.2 NRR CATEGORY A TECHNICAL ACTIV! TIES 24 4.3 CONFIRMATORY RESEARCH PROGRANS-27 4.4 - STANDARDS OEVELOPMENT P90 GRAMS

" 28' 5.0- REFERENCES-

-- LISTING OF TABLCS Table 1L- Deve1coment of- Standards for' ClassTIE Ecuipment-0 Table 2 - Facility Groupings by the Evolutionary -Stage;of NRC Licensing: ...

'  ; Requirements -for Environmentalc0ualification of T 'ety-Related' 10

-Electrical Equipment : C Tablei3' - Develocment of AEC/NRC ERequirenents and/or-Guidance;- for_ the-

Enviromantal OualificationLof-Safety-Related Electrical Equi; ment l.

t 6 i-y N I J ) -

c- _ , , i , , , -

e 4

t 1

' 1 ABSTR ACT_ --

' Since the early days of the comercial nuclear power industry .- the r NRC (formerly AEC) criteria for the licensing of nuclear facilities - -

have undergone' an evolutionary process. This' document' traces. the develop-ment of Commission and industry requirements for environmental ,

qualifications of saf ety-related electrical equipment from the -late 1950s to the .present time. It also addresses the expanding role of-related Inspection:and Enforcement activities over this ceriod-of time.

1 L

r

?

L

~)

?

4

\

1.0 .IN11000CTION The purpose of this report is to describe the evolution of NRC licensing requirements for the env'ronmental qualification of ,

safety-related electrical equipment. The scope.of the report has been limited to criteria which relate to normal, abnormal, _

accident, and post-accident environmental conditions. .i.e. ,

temperature, pressure, relative humidity, steam, radiation, chemicals, and vibration.

As has been-the case with virtually all NRC licensing criteria, the 11 censing criteria for the envicenmental qualification of safety-related electrical equipment have evolved over the years as the design of reactoc systems _has changed and as regulatory and operating exoerience have accumulated. The evolution of NRC licensing criteria for-environmental cualification

-1 of safety elated electrical equipment has occurred simultaneously-and at essentially the same pace as Lthe evolution of the overall. ,

HRC licensing criteria, as summarized belcw.

2.0< EVOLUTION OF OVERALL HRC LICENSING CRITERIA In the early days of the civilian nuclear oower industry,:the:

Ccomission's ;1icensing review of the acceptability of pecoosed

. nuclear plant designs was ' based on much less documentea design information than is presently required.by the NRC Liicensing process. In addition,- as early reactor designs. evolved, the.

l

-Conmission's " standards of acceptability" were established on an ad hoc basis unique to each-new licensing review. _Many of these

" standards of acceptability" were not formalizedl-rather they

~

evolved dur'ng plant specific licensing reviews, thereby estab--

lishing precedents for subsequent reviews. As the number of applications for Construction Permits-(cps) submitted to the _

Commission began to-grow, it became evident that more. uniform and consistent guidelines (" standards' for acceptability") were necessary . In 1966, the Commission issued a " Guide to the Organi:a-tion and Contents of Safety Analysis Reports."l/ Historically, from this time on, the amount of documentation requireo by the-Ccmmission's licensing process began to significantly increase.

That guide identified the areas of NRC staff safety concern and =

identified the_ degree of detailed information and analyses required from apolicants to pernit the staff. to complete its review.

In a further effort to provide guidance to the industry and to incraase staff review efficiency and effectiveness, the Commis-sion began _ issuing Safety _ Guides in 1970. These guides aresent methods acceptable to the Commission for implementing specific parts of -the Regulations, including the General Design Criteria of 10 CFR Part 50 Appendix A. In 1971, The Ccmmission '.becan issuing-Information Guides to list needed information wnich was frequently.

cmitted _from applications. In 1972 the Safety and Information. Guides-were replaced by the broader based NRC Regulatory Guide crogram whien

,- _. - - . _ _ _ _ _ ~a

i) 3 continues today. Regulatory Guides are not substitutes for Regulations and compliance with-them is not in itself a legal requirement. Methods and solutions different from those set forth in the Guides may be,. and have been found to be, acceptable by the NRC staff.

The next major improvement in guidance to apolicants was provided i

in a document entitled " Standard Format and Content of. Safety Analysis Reports for Nuclear Power 91 ants",2f initially. issued' in 1972 and suDsequently revised in 1975. These documents reflect the increased scope and detail of information recuired to suoport Itcense acclications.

!n a similar way, the licensing criteria and requirements used by the NRC staff to determine acceptability have evolved over the ,

years. In 1965, the Comission puolished, for public comment, .

27 proposed Generri Design Criteria (GDC) for: nuclear. cewerL plants. 'Those criteria established minimum recuirements for the princioal design criteria for ccmerical ' nuclear plants.

These GDC were refined and fornally adopted in the Regulations, as Aopendix A to 10 CFR Part 50 in 1971 in the form of 55 -

General Design Criteria. - These GDC have been used by the Comission as guidance in reviewing plant applications since they'were -

origina11y' draf ted. The GDC were specifically written in general?

.ar ns such that ' a ' variety of alternative design tecnniaues may- be '

-y utilized to satisfy them. -

As the snowledge of reactor designs . increased .anc coerating excer-ience accumulated additional licensing recuirements were also-- _;

j develooed. In an effort > to document such recuirements and thusi j H

c .

i

• .4 fincrease regulatory ef fectiveness, efficiency _ and predictability, the Commission developed and published-the Standard Review Plan

($RP) in 1975.3_/ _ That document provides guidance" for staff re- .

It viewers to improve the quality and uniformity of staff reviews.

also improves comunication and. understanding.of the staff review pro-  :

cess with interested members of the public and the nuclear power ,

ess.

industry and helps to standardize-the licensing per In general, the detailed acceptance criteria published in the SRP did-not represent new licensing requirements; rather, .they _ reflected. current staff review practices and standards 'of acceptability which had' evolved ,

curing previous licensing reviews. However, in many cases, these criter had not previously been published in any regulatory dccument. The-SRP be periodically revised to incorporate.new or modified requirements asithey are deveicoed and-approved.

Because of the continual evolution of. reactor cesignsiand asso-ciated licensing requirements, operating 1 nuclear power plants-that were reviewed and approved in;the past have^ a broad spectrun of design characteristics. Each. of these reactors was found' to-be in conformance with the licensing " requirements" in effect at the time of licensing. As-noted above,_he:Gyer, these Conse-requirements have_become more detailed over.the years.

i cuently,.if some older licensed facilities were reevaluated us ng

' current licensing procedures, they would 1%ely be 'at variance-in some respects; the older the plant the more at variance 1it is IRely to be. Although such variances may not necessarily

,. - . ~ . .

i 5- -

represent significant safety deficiencies. -the current Syste .

matic Evaluation Program (SEP), which is described in Section 4.1 of. this report, is directed toward the determination of existing safety margins at older operating reactors and the evaluation of such safety margins to determine if any backfitting or facility upgrading for safety.is necessary.

3.0 EVOLUTION OF NRC ENVIRONMENTAL 00ALIFICATION REOUIREMENTS 3.1 Evolution of Aeolicable National Standards Over the past ten years, many national Standards have been prepared te describe the methods commonly used to demonstrate the environmental cualification of safety-related electrical equipment utilized in nuclear power generating stations. 't ,

These Standarcs reflect the elements of good engineering cractice-which have evolved in the deveicoment of reactor system cesiens and regulatory licensing recuirements. ~~he NRC staff .nas, for many years, particioated witn representatives offindustry dn-

~

the development Lof these Standards and', after indeoendent review,- has.often incorporated these StandardsLinto its Regula-tions and Regulatory Guides with aoprcoriate suoplemental- material .-

Each of the pertinent Standards is described' in the following sections of this report. A grapnical _ presentation of' the '

r secuence aof the development.cf these Standards is provided' in Taole 1..

As -noted. orevicusly, however, these _ Standards ,as endorsed by ?tRC 9egul atory n-,ani

7e; e

a Guides, are not substitutes for Regulations. Consequently , .

compliance with these _ Standards (with the exception ~ of IEEE Standard 279 which is incorporated by reference in 10 CFR Part 50,-

150.55a) =is not a legal requirement. During the course of_the t licensing _ review for a particular facility, methods or solutions' different from those' set forth in these Standards may be.found'to ,

J be acceptable by the staff,;but usually on some basis?of _comoarability with the provisions of the Standards.

3.1.1 Section 4.4 of IEEE Standard 279-1968, " Proposed _!EEE- .

Criteria for Nuclear Power Plant. Protection Systems,"

-and its revision aated 1971, require that ~eithar. type

' test data or reasontable extrapol,ations- based on test data be available to demonstrate the_ environmental.

quali fication of protection: system eouipment _at _ nuclear power plants. This-Standard has been incor orated as-part of the Commission's regulations by reference in 10 -

CFR Part 50.55a, " Codes;and Standards".

.c More detailed qualification guidance for electrical-equipment has been developed in several later IEEE Stancards and, wnere aopropriate, these Standards have been endorsed -by NRC Regulatory Guides (sometimes with supplementary material) s acceptable methods-

-for qualifying electric equipment in general or:

specific kinds of electric equipment.

E y -

-o ,

i

-7  ;

<?

4 3.1.2 !!E! Standard 3231971, " General Guide for Qualifying q Class l' Electrical Couipment for Nuclear Power Generating Stations," and its revision dated 1974, describe the basic require-  :

ments for qualifying Class IE equipment and interfacet .that.

are to be used in nuclear power generating sta' ns, in partial support of th6 reouirements of GDC 4 and 21 (Apoendix A to 10 CFR Part 501 and Sections 4.4 and 4.5 of IEEE Standard 279-1971. The 1974 Revision of this Standard included criteria wnich establish requirements for qualification precedures, methods,and documentation land incoroorated new or improved' guidelittes related to- aging, testing margins, andihe sequence for testing of different environmental parameters. inis Standard:

recoonizes that environnental cualification'of safety-related electrical equirment can be accomolished by seversi different; nethods (e.9. . tyoe testing, operating exoerience, snalysi s'.

utilized separately orLin combination; Furthermore. this H Itandard recognizes that, while' falfillment of its recuirements:

does not necessarily' fully establish the_adecuacy of the environ-mental. qualification of electrical equipment, omission, of: any_ ofiits . requirements will., gin most-instances. de

. sn . indication lof inaceouate cualification...

mh

g- -, n ., , ,. - -- ,w ; - - - - - - - - - .

8 1EEE 323-1974, nas been endorsed by NRC Regulatory Guide 1.89. The Standard and Regulatory Guide 1.89 have been written such that they can be followed by successive ancillary $tandards and Guides which reference the parent documents for common qualification technioues and specify =

the additional requirements pertinent to a specific component.--

For example, IEEE 334-1974 (motor qualification) is--

ancillary to lEEE 323-19/4 Respective endorsement guides have the same relationship. A listing of applicableicualifica-tion Standards, including ancillary Standards, follows:

a. -!EEE Standard 383-1974, " Type _ Test of Class !E Elec.-

tric Cables, Field Splices, and Connections for Nuclear Power Generating Stations," provides direction for establishing . type tests which may be used _in Qualifying .

Class !E electric cables, field spitees, and.

connections for service in nuclear power generating:

stations in conjunction-with;of the general guidelines -for~.

qualification which are given in IEEE.Std. 323-1974 and in GDC 3. legulatory Guide 1.131 endorsing. this ancillary lEEE Standard, was.-issued for- public coment in

. August 1977.

b. IEEE Standard.317-1971, " Standard for Elec*rical Penetts--

tion Assemblies in Centainment Structures for Nuclear Fueled Power Generating Stations," and its revisions.. dated-

-9 1972 and 1976, provide guidance for cualifying electrical penetrations and include testing requirements. The 1976 version of this Standard includes additional design and testing requirements and is ancillary to the 1974 version s! IEEE Standard 323.

Revision I to NPC Regulatory Guide 1.63, in turn, endorses this Standard.

c. IEEE Standard 334-1971, " Type Tests of Continuous Duty Class ! Motors insta11eo Inside the Containment of tluclear Power Generating Stations," and its revision dated 1974, specify acceptable methods for cualifying electric motors. The 1974 version of the Standard re-flects the 1974 update of !EEE Standard 323 and will be endorsed by 9evision 1 to NRC Regulatory Guide 1.20.

Regulatory %ide 1.40 endortec IEEE Stancard 334 1971.

c. IEEE Standard 382-1972 " Type Tests of Class 1 Electric Valve Operators for 'luclear Pcwer Generatino Statiens* soeci-fies acceptable methods for qualifying electric valve operators. NRC Regulatory Guide 1.73, in turn, endorses .this Standard. (This is not an ancillary Standard),

e. IEEE Standard 381-1977, " Type Tests of Class II Mcdules Used in Nuclear Pcwer Generating Stations," is an ancillary Standard which s;ecifies acceotaole netnods for cualifying I

electric modules. An NRC Regulatory Guide endorsina this Standard is being considered for cevelopment.

F 9

1972 and 1976, provide guidance for cualifying

-electrical penetrations and ' include testing -

requirements. The 1976 version of this Standard includes additional design and testing requirements and is ancillary to the 1974 version ofzIEEE' Standard 323.

Revision 1 to NRC Regulatory Guide 1.63, in turn, endorses this Standard.

c. IEEE Standard 334-1971. "Tyce Tests of- Continuous' Duty Class 1 Motors Installed Inside the Containment of Nuclear Power Generatint Stations " and its revision-dated 1974, specify accepta01e methods for cualifying

' electric motors. The 1974 version.of the' Standard re-flects the 1974 update of !EEE Standard 323land wi11 be endorsed by Revision 1.to NRC Regulatory Guide 11.40.

Regulatory Guide 1.40 endorsec !EEE Standard 33A 1971. .

d. IEEE Standard 382-1972,:"Typefiests.of Class ! Electric Vilve; Operators - for Nuclear Power Generatinq1 Stations",scect-i fies acceptable methoos for qualifying electric;valveL 6 operators. NRC Regulatory Guide-1.73, in turn, endorses this- Standard. (Thistis' not an ancillary- Standardh

e. !EEE Standard 381-1977, "TypeLTests of 01assil!LModu.les:

'Used in Nuclear Power Generating Stations " is an-ancillary Standard which specifies acceotable netnods forlaualifyingl 4

electric modules.- An NRC' Regul atory; Guide 'encorsings this Standard is-;being-considered for[ development.

I L

• y-  % ,

3.2 Evolution of NRC (ONRR) Licensing Reauirements The NRC's licensing requirements for the environmental cualification of safety-related electrical equipment have evolved over the years as the design of reactor systems has changed, as operating and regulatory experience have been accum-ulated, and as testing f scility capabilities and testing technioues .

have expanded and improved. In a very general sense, the evolution of these uC licensing requirenents can be characterized by three stages: the evaluation of f acilities licensed prior to 1967, f acilities Itcensed af ter 1967 up to f acilities with Construction Pemit (CP) applications tendered prior to July 1974, and f acilities aith CP appitcations tendered after July 1974 A listing of the f acilities which f all within each A grschical of these three groupings is provided in Table 2.

presentation of the secuence of develocrent of licensing require-ments and/or guidance for the environmental cualification of safety-related electrical touipment is provided in Table 3.

For all plants in the first two of the above-mentionec three groupings, the licensing review included an evaluation of the environmental qualification of safety-related electrical equipment As noted, tne scope and ceoth of such located inside containment.

In addition, equipment environ-reviews have increaseo with time.

mental qualification has been considered by the staff for subseouent plant cesign modifications proposed by licensees of these f acilities and for mooifications recuired by changes in the Regulations; e.g.,

modifications associated with the demonstration of como11ance witn Acpendix < of 10 CR Part 50.

11 The staff review of plants f alling within each of the three above-mentioned groupings is characteri:ed in the follwing subsections.

3.2.1 PRICR TO 1967_

For facilities licensed prior to 1967, the information initially submitted to the regulatory staff for review of the environmental cualification of safety-related electrical equirment included, as 4 minimum, design specifit M w, ad demonstration of the adherence of such design specifichtions to aDoropriate industry standards, such as the National Electrical *Aanuf acturers AssoCittien Standards, existitg IEEE Standarcs which were not specifically developed for application oy the nuclear industry (e.g., IEEE Standard 117-1956, "IEEE Standard Test Procedures for Evalua.

t'.cn of Systems of Insulating Materials for Random-Wound AC Electrical Machinery"), and other !EEE Standarcs under deveicoment. In addition, soplicants referenced various environmental testing orogrus such as those conducted at the Franklin Institute Researen Laboratories and those conducted in the Naval Reactors Program.

3.2.2 1967 - 1974 The staff's review of the second grouping of f acilities utili:ed tne initial criteria of IEEE Standard 279-1968 and IEEE Standarc 323-1971. These criteria, and others that became available suosecuent have been utili:ed, as they became available, for sucsequent evalua-tions. It should be noted tnat several of the test programs to tem-onstrate the qualification of safety-related electrical ecuis-ment were initiated during tne development of the criteria

l I

established in IEEE Standard 323-1971 prior to its issuance.

In some cases during the course of its reviews, the staff determined that the test plan procedures or other available documentation for particular f acilities did not meet all of the IEEE 323-1971 guidelines. In such cases, the staff re-cuired confirmatory programs to be implenented, additional analyses to be performed, and/or additional documentation related to previous environmental testing programs to be supplied. Consideration of the plant specific design and site conditions were included in the staff's evaluation of the adecuacy of equipment to perform its safety-reltted functions during nomal, abnormal, accident, and post accident These evaluations were perfomed environmental conditions.

on a selected component basis, i.e., the review treated ccm.

conents judged by the staff to oe reoresentative of all saf ety-related comoonents in the f acility.

As indicated in Section 3.1, the IEEE Standards continued to evolve during this time frame and, consequently, the licensing reviews of the plants that oreceded the imolemen-tation of IEEE Standard 323-1971 and other Standards that because 3vailability subsecuently had varying degrees of qualification, testing, analysis, and associated documentation. The evolution of the NRC and AEC Regulatory process and the Standards develocment process have markedly increased the anount of documentation ano the scooe and deoth of the reviews cerforced by the staff since 1971.

-m , ; -_ _ _ _ - , . - ___

)

-13 Appendix X to the " Reactor Safety Study"i/ provides a detailed summary of the environmental qualification of -

safety-related equipment installed in four'of the facilia ties within this grouping, i.e., Surry Units 1 and 2 and

' Peach Bottem Units-2~and 3.

3.2.3 cps Tendered- After July 197a The staff's. reviews of the environmental cualification._of safety-related electrical equipment for plants tendering cps after July 1974 reflect the more comprehensive ' guidelines specified in IEEE Standard 323-1974 and the~ successive.

ancillary Standards. As discussed in Section 4.2.2 of this.

report, the staff is- currently reviewing the conceots, methods, test procedures, and acceptance criteria -

proposed by the major NS5$-vendors and Salance-of Plant equipment suppliers to meet the guidelines for environ-mental cualification of safety related electrical. ecujo-1

~

cent provided in IEEE Standard 323-1974 and its ancil_1ary The staff has not completed its review of _these

~

Standards.

programs.-

The methods and procedures which are reviewed: for f acilities.

E within' this grouping are documented in Section 3.11 of; the <

nandard Review Plan (SRP) which was issued in Sectameer 1975.

The Standard Review Plan:is written so as to cover ajariety; of site conditions and plant designs. For any givenfnooli.

l 4

3 l

cat. ion, the staff selects and emphasizes particular. aspects of the Standard Review Plan as is appropriate for that ,

In some Cases, a plant feature may be suffi. .

application.

ciently similar to that of a previous plant so that a detailed re-review is not needed. Therefore, the staff has not and does not expect to perform in detail all of the review steps >

~

listed in the Standard Review. Plan' for the review of each application. This approach is typical for most other.. review

. areas.

The SRP-type environmental qualification review includes an infomation audit review to determine if the following informa-tion is included in the application:

a. All. safety-related mechanical and electrical ecuipment must be identified. The eauipment tabulations provided should be checked fr,r. completeness against the descrip -

tions of safety-relate'd systems. 0efinitions' of the three' categories of safety related systems are contained

.in Section 7.1 of. the SRP.

b. The-location of each item of safety related eouipment. .

~

both.inside and cutside .the . containment, must be iden-

~

tified. l.ocation of the ecuipment is-: required-in order to establish accurate . definitions of both the normalf,-

" abnormal, and accident environments.

_'. .m

?

15 a

c. Both the normal, abnomal, and accident' environmental , con-ditions must be explicitly defined for each item of eauip-ment. These definitions must include the following parameters:

temperature, pressure, relative humidity, steam, .radia-tion, chemicals, and vibration. For the nonnal environ.

ment, specific values should be provided. For the abnormal and accident environments these parameters'should be presented 'as functions of time for the carticular cause of the postulated :

envircnment, (e.g. . pipe break, or otheri..

d. The length of time that each item of ecuipment .is .reouired to operate in 6n abnormal' or accioent environment must be provided. ..

e. The cualificataon report should contain i cenolete description.of_ the design cases and envirorcentall cualification tests and/or analyses that ave been perfomed on each item of. safety-related eaui; ment.-

This should include qualification. forl the accident environments, qualification- for- extreme normal .coera-ting environments.:and qualification to assure that loss of environmental control-systems that are note classifieo as safety-related wil.1: notLadversely affect-the operability of safety-related eouioment, particularly-electrical equi; ment located in the controliroon or: other -

roons housing contro11 coui: ment..

p m _

i The staff review involves an evaluation of the completeness.

and adequacy Of the information presented to arsurt-that an adequate demonstration of the required environ.'

mental capabilities of saMy-related equipment' has been provided. This phase of the review is performed after it has been established (by means of the infomation audit -

phase of the review previously described) that the infoma-tion content requirements for_ Section 3.11 uf the Standard .

An essential part of Review Plan have been satisfied.

this evaluation is the formulation of ouestions by the licen.-

sing reviewers and responses by applicants to document their.

aualification programs. Typical of these reques'.s;for-additional infomation aret

a. A statement that' the staff reouires that the fol-icwing qualification test program infomation te provided for 'a specified list of Class IE equi: ment:

(1)1 equipment cesign. specification recuirements.

(2) ' test plan. (3) testLset;ue, -(4) test procedures.

(5) acceptability goals and recuirements, and-(6) test:

resul ts. -

D. A- recuirement that the applicant. demonstrate ' that the -

secuence of t: ; environmental conditions wnten were-imposed'during the qualification: testing-is .at Iristas severe as the ' actual environment sequence durino at postulated accident.

17-

c. A recuirement that the applicant provide supporting analyses, operating experience, or other information that demonstrates the adequacy of specific ecuipment to perform its recuired safety function in normal, abnormal, accident, and post-accident environments.

The Regulations, current IEEE Standards, and the 'IRC Regulatory Guides which are identified in Section 3.11 in the Standard Review Plan are used as cuidelines and as the acceptance criteria for the staff reviews to provide assurance that the equipment can perform its safety-related function. The staff reviews the proposed concepts, methocs, and test procedures that will be utilized to demonstrate conoliance with the current criteria and evaluates the aesults of analyses, tests, e.tcerience, or otner methods (including combinations of the above) for ac:ectaoility when they are suDmitted at the ~5AR stage of the licensing

rocess.

3.2.4 O ther Consideratiens Further evidence of the evolutionary nature of the licensing considerations for environmental qualification of safety-related electrical ecui:nent has teen the recent recoanition

c.

i.

f I

that the environment associated with a postulated main steam line break (MSLB) accident in PWR f acilities_ may, in some respects, be, more demanding on electrical equipment installed ~inside containment-than the environmental conditions associated with the design' basis loss of coolant accident (LOCA). Prior to 1976, the accident environment against whien safety-related electrica1' equipment located inside containment was qualified was bounded by the environment F

produced by the loss of coolant accident.. However, in 1976,- information becane available that indicated that -

i the calculated temperature inside the containment-associated

^

with the MSLB accident-could be as much as 100 - 150'F higher, for a short time duration (i.e. ,60-100 seconds), than- that

~

associated with a LOCA. As indicated in Section14.2.1 of'this-report, further ef forts' are presently underday ' to _ establish,

~

environmental enveloce reouirements for MSLS accidents linside containment.

3.3 Evolution of OI AE Insoection Practices :

. The NRC _ Office of Inspection &- Enforcement's involvementiin the' environmental oualification testing of , safety-related electrical-equipment has evolved in step 'with-the1NRCElicensing (CNRR) re :

P

~

-19 quirements. During the late 1960's and early 1970's, the Office of Inspection & Enforcement's inspectors periodically visited equipment vendors for the purpose of auditing vendor practices with respect to qualification testing. Inadequacies identified during such inspections _were brought to the attention of. appro-priate HRC licensing personnel. In a' number of instances, ceneric problems and/or design deficiencies were identified and corrected.

Since'the early.1970's the involvement of the Office of Inspection and Enforcement's inspectors in this area has increased substan-ti a11y . In the 1972-1973 time frame, the current _0ffice of Inspec- T tion and Enforcement's licensee contractor and vendor inspection program was initiated. Included in- that program are provisions for the inspection, on. a _ sampling basis, of sucoliers of all types gof :

eautpment (including electrical ano instrumentation components).

While that program focuses on the review of vendor cuality' assurance programs and f abrication activities. witnessing of actual cualifica -

tion tests is occasionally performed.

At the. reactor construction sites, inspectors review selecteo cualifi-cation test results for_ safety-related _ components.and systems. These reviews are' based ons scecified-reouf rements.ano/or test conditions.

Ouring the early 1970'sfinscectors reviewed testing and cuality-L1

,. n , g - , _ _ , ,

control requirements, material certification, and test resu)ts. Since about 1975, the inspection requirements have been expanded and have been further clarified in areas re-lating to equipment qualification tests. For example, existing .

Office of Inspection (nd Enforcement inspection procedures .

provide for (1) reviews of selected vendor supplied documents .

which identify the environmental Qualification testing perforned-for safety-related electrical equipment, and (2) inspections to assess the adecuacy of the licensee's or aoolicant's 'ouality assurance programs which are desioned to assure that safety.

related electrical equipment installed at the ficility have been -

qualified in accordance with the vendor's testing programs.

Additionally,-increased emphasis has. been placed on the inspec.

tor's involvement in the pre-operational testing phase' of f acility~

systems. The inspectors witness- an increased number of testing activities and perform a more thorough _ review'of, safety-related' test results.

4.0 CURRENT. ACTIVITIES The nuclear ; industry and the NRC have various orograms currently;in;

~

progress relateo to the environmental qualification of_ safety-related.

electrical ecatement.: Act'vities of each of these crograns are:

discussed in 4.he following sectiens.

a

L 21-4.1 Systematic Evaluation Prooram (NRC/0NRR)

The Division of Operating Reactors, ONRR, presently has underway Phase 11 of the Systematic Evaluation Program (SEP). This Pro-gram consists of the systematic review of eleven older nuclear power facilities (plants licensed for coeration before-1969 and those '

which require a review for conversion of a Pro isional Operatina 1 License to a Full-Term Operating License) to determine and document . '  ;

the degree to which they meet current licensing requirements for  ;

new plants. Phase II of the SEP was approved by the Ccmmission on Novemoer 9, 1977. "The results of this systematic evaluation, which is scheduled for completion within the next three years, will be considered by the-Commission in deciding whether the program should be extended to include other coerating facilities.'

[

One of the specific review topics included in this- program is titled " Environmental Qualification of Safety-Related Eauip-ment," (SEP Topic List No. !!I-12).

The objective of the SEP review of. this tooic is to evaluate-the degree to wnien the mechanical and Class IE: electrical-equipment of safety-related systems have been qualified for. the.

, most severe environment (1,.e., tempera _ture, pressure, humidity, steam, chemistry...and radiation) of' design basis accidents.15 such,-the SEP will be directed toward the determination- of -

existing safety margins and the evaluation of the adecuacy.of--

such safety margins to dete-mine if any oackff tting .or f acility._

upgracing is necessary.-

_ _ . . _ _ - . __ . - ~ . . ,

m v_ -

(

L 22 4.2 NRR,Ca,tecory A Technical ~ Activities As part of NRR's Technical Activities Program,'which was devel-oped to provide a basic framework of. policy, organizational structure, priority, and procedures for the effective management of the major technical activities within NRR, those generic technical activities judged by the staff to warrsnt priority attention in terms of resources to attsin early resolution were .

designated as Category A Priority Activities._ Of those  ;

so designated. two are directly related to the environmental-oualification of safety-related mechanical and electrical,.

eouipment. A brief description of the applicable portions ,

of each of these generic technical activities is provided ,

below.

4.2.1 Cateoory A Technical Activity No. A-21.fMain- Steam e Line Break Insice Containment' t One of the subtasks'of this technical activity <is to

.i perform an evaluation:of.the procedures and content of analyses performed to' estabitsh. environmental enve- .

lope recuirements'for main steam line break accidents-inside containment.- These environmental. envelope ,

reouirements will then te utilized-to assess the adecuacy of- the environmental cualification of safety-related b

" e A

p i

k i

23-1 equipment inside containment. In addition, criteria for iethodology of environmental simulation will be.

1

<aluated to determine if the important environmental--

parameters have been properly simulated during testing _

The targe't date for completion of- this task is December 1978. i 4.2,2 Cateoory_A Technical Activity No. , A-24, "Oualification of' Class IE SaTety Related Ecutoment' The cbjective of this technical activity is to perform a generic review and evaluation cf methods developed by industry to qualify saf6(y-related equipment to the  :

323 1974, "!EEE requirements established in IEEE Standard Standard for Qualifying Class IE Equipment for fluelear Power Generating Stations." Certain concepts and methods procosed by industry in addressing ecuipment cualification,

~

sucn as testing. margins, aging effects on materials and '

equipment, and adequacy .of ' testing >1mulators -(wnich'sim-ulate the worst case environment' for the testing _ of-

equipment); have yet to be reviewed and accepted'by~ the-staff.

n order to expedita- the review 'of the _ adecuacy ;

l of the crocosed qualification r.ethocs,- a generic review -

~

W

h

. 24 _

of the qualification methodology and associated acceptance criteria used by the major NSSS vendors and Balance-of-Plant-equipment suppliers will be conducted. The Target Date for completion of this task is early 1979, 4.3 Confirmatory Research Programs (NRC/RES)'

The current NRC Qualification Testing Evaluation Program is directed towards providing a confirmatory assessment of current environmental qualification testing procedures for LOCA ' conditions-ano includes the following specific program elements: .

1. Assessment to determine if-sequential (as opposed to simultaneous) environmental cualification testing is.

conservative. i.e., an investigation of synergistic ,

effects.

2. Confirmation that accelerated aging methodolgy can be ,

utilized for qualification testing of safety.related equipment. '

3. Definition of the nuclear raciation source based on the-Regulatory Guide 1.89 accident assumptions and-evaluation of the adequacy. of' radiation simulators.

4.3.1 Synergistic Tests-The tests were to confirm that the secuential' test; sequence:

recommended in IEEE Std. 1323 1974 conservatively simulates ~

the combined radiation and steam ' environment.to' which. safety.

related equipment would 'be exposed inL the unlikely; event of n:

a N f w e- y

l LOCA. A research program to investigate potential synergistic

' effects was initiated at Sandia Laboratories in FY 1975.-

Preliminary evaluation of the Sandia tests which have been completed to date 40es not indicate a significant

~

functional synergism for electrical cables: however, with. ,

respect to connectors, it was c.ot possible to determine.

whether synergism exists because of the failures that occurred.

4.3.2 Aging Effects Considerations of aging in enviremental qualification test programs are important because of the potential to' create a weakened condition in a safety-related ccmoonent:tnrougn' ,

some aging mechanism that may not be detected through routine pe* iodic testing. A.research' program to ceveloo a methodology:

that can be utilized for simulation of the natural aaing process of safety t elated materials on an accelerated-basis was initiated in FY 1976 and is continuing.

4 me.> .#_ , . . y

4.3.3 40urce Term Ecuivalences_

One of the exceptions taken to IEEE Std 323-1974 by.the NRC~

is the required radiation environment to be utilized for a enviremental qualificatien testing. LOCA radiation releases to be used by an aoplicant in establishing the nuclear radiation environment for type testing are define'd'in 2

Regulatory Guide 1.89. ,

An assessment of the adequacy of currently used radiation simulators to duplicate the accident radiation environnent recuires additional experimental evaluation. A research--

program to assist in this evaluation was initiated in.-

FY 1976 and is continuing. Progress to date' has consisted -

of analysis to determine the post-LOCA time relationsnio-of dose, dose rate, energy spectra and partidle tyee._ These data show that current industry practice.with regard th.

radiation simulation testing nay be significantly different in terms of dose rate, spectrum and particle. type than that described in Regulatory Guide 1,89. . The ongoing wort'in this' area is aimed at determining the importance of these: differences in terms of camage to:saf 6ty_ related ecuiement.-

~

27 4.4 Standards Deve1ooment Procrans IEEE Standards related to the environnental qualification of the following specific safety-related electrical equipment are currently under development:

(a) Fire stops (b) Fire breaks (c) Storage batteries (d) SwitchGear '

(e) Circuit breakers (f) Battery chargers (g) Transformers (h) Motor control centers A general $tandard addressing the environnental cualification of -

safety-related mechanical and electrical ecuipment is teino developed jointly by !!EE and ASME.

It is anticipated that NRC Regulatory Guides endorsing-the above-mentioned Stancards will--de develooed through FY 1979.

NRC Regulatory Guide 1.40 is currently Deing revised t:

reflect the updated requirements off!!!! Standard 334-1974 MRC Regulatory Guides' 1.39' and.1.131- are being revised sub--

~

secuent to their issuance for puolic comment -

num mu p u i s pu'sa

t p.

28-

5.0 REFERENCES

I. " Guide to the Organization and Contents of Safety Analysis Reports," U.S. Atomic Energy Commission, June 30, 1976.

2. " Standard Format and Content of Safety Analysis Reoorts for Nuclear Power Plants," Regulatory Guide -1.70, Revision 1. U.S. Atomic Energy- Commission. October 19721 Revision 2, NUREG 75/094. U.S. Nuclear Regulatory Commis-sien, September, 1975.

3. " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Pcwer Plants," NUREG-75-087. U.S..

Nuclear Regulatory ' Commission,-September 1975,=

4. " Reactor Safety Study: An Assessment of Accident Risks In U.S. Commerical Nuclear Power Plants," WASH-1400-(NUREG-75/014), U.S. Nuclear Regulatory Ccmmission. October 1975.

m

-a w e

. c=

N O =

ee t

N "3

. N N

m M P.e

• W s W **

W C3 mM T@

@ wN N m@

.,O,,,.

= LaJ f WN W c'*

>= M N

Ol

• • I

% ag A ,

.- v Q C

• y % G ..C

• me Qjw j * *

- w _q er "3 e M v ..

dN

g. w erl '.'3.N es N SM Nt WO O@ WO-g ..Q e m ~**-

m {~ m- ca -

Qw W 8 W f W~'

m@ w q W ={ WM We WM

-Q@ W a== . wN Wm ~ w CC -

'mM

> y .e. en .a e.o M we M U L q C 7 .% +W= g m  % e* .6 U sC 4 *e Y, W .O 3Va M a ee = + C= G . k

- .m Q

w aom Cm WL ---

2 en *D ",

1:* 2 CU,  ;

C 1* e-

• • • y ad ;.,  ; .

AA 3. 9 6

,- 7NN . ".3 NN "J ~~ C 4

,O W b 2. gy M@ M m .-

Ni c.- -

ww e N. y e W e numne > D f"" ,s N hee N 2 .h*= (J ~l s.s Wc e f*)-

Q Alt == W %' 7.

e= b a asse M - ,.

j -

>= - 4L j MC I 6 . . . .

888 - M -

-Y.s N .s N .s w 'ee N NM@~ M@-.MO ;d@

m m m ca. . e=

m W.i W e W=t W 8 W@ WM' WN We W 'r -

WM WN WN

- was N me M .. o.e M === M 4

Cl

. . - @l.

N i.e t

I i

1 4'

m) '.O,a w:C 4,

..- A .7

eA.Wt

.4..6O'

, == N

~O

- c

,p.

.==*

~

a _

TABLE 2 Facility Groupings by the Evolutionary Stage of NRC Licensing Requirements For Environmental Qualification of Safety Related. Electrical Equipment A. Pre-1967_

Operating License-Construction Femit Facility Name Issued _

issued Dresden Unit No.1 5/56 9/59 Yankee-Rowe 11/57 7/60.

Humboldt Bay Unit No. .$- 11/60 8/62 8/62 Big Rock Point 5/60 Indian Point Unit No.1 5/56 3/52 3/54 3/67 San Onofre Unit No. 1 5/64 6/67 Connecticut Yankee (Haddam Neck) 3/63 7/67-tacrosse

3. 1967-1974 Oyster-Creek- 12/64- a/69-Nine Mile Point Unit No, 1 :4/66 3/69i

'1/66 12/69-Dresden Unit-No. 2-Gfnna 24/66- -9/69:

5/66- 10/70:

Millstone Unit-.No..I 10/66" 11/71'

.Dresden: Unit NoL 33 Indian! Point: Uni t ;No,- _2 10/66 ,

=10/71 2/671 (10/71/3/72 Quad Cities. Units Mos. 1 & 2'

' P ali dades -- 3/67 :3/71 Robinson' Unit No. 2l a/67- 7/70l 1-

V- I s.

o 1 Construction Pemit Operating 1,1 cense -

i

-Facility Name Issued -!ssued -l Turkey Point Units Hos. 3 & 4- 4/67 7/72/4/73 .

Browns Ferry Units Nos.1 & 2 5/67 6/63/6/74 Monticello 6/67- 9/70 Point Beach Unit -No.1 .

7/67- 10/70:

Ocenee Units 1, 2 & 3 11/67 -2/73/10/73/7/74 Verment Yankee 12/67 3/72 j Peach Bottom Units 2 & 3 1/68 S/73/7/74 4/58 Diablo Canyon Unit 1 Three Mile Island Un h 1, 5/68 4/74 Coccer -6/58' 1/74 Ft. Calhcun 6/68 $/73 ,

Prairie island-Units 15 2 5/68 8/73/10/74 Surry Units 1 12 6/68. 5/72/1/73 Point Beacn Unit .io'. 2 7/6e #1/71:

Br:wns Fer*y Uni t -No. 3 7/68 7/76-- .

Kawaunee  : 8/68 - 12/72 Pilgrim Unit No.1 3/68 6/72- .r Ft. -St. Vrain 9/68- 12/73: ,

Crystal Ri.ver Unit No. 3

-9/68-  : 12/76 -' ,

5 Salem ynit Nos. -1 1'2 - 9/68-:. 8/ .'G -.

Rancno Seco .10/68:

-3/74)

.)

Maine Yanree '10/68 9/72-Arkansas i- 12/68' 5/74 ,

ion Un_its Nos; 1 1.2 12/68 14/73/11/73 1

1-

~

,p.

t , , .- j :) ,

w -w-?<.w 4 w J

h .;

c 8 3._

Construction Permit _ Operating License. 1 Facility Name issued Issued l J '

D. C. Cook Units 1 & 2 3/69 10/74-7/74/8/76. I Calvert Cliffs Units 1 & 2 7/69 Indian Point Unit 3 '8/69 12/75 ,

-g Hatch Unit 1 9/69 < :8/74 Three Mile Island 2 11/69 \

Brunswick Units 1 &'2' 2/70- 9/76/12/74 .;

Fit: patrick 5/70 .10/74 L Secuoyan 1 & 2 5/70 Quane Arnold- 6/70 2/74- ,

leaver Valley Unit 1 6/70 1/76 l

- - Diablo Canyon 2 12/70 ,

3/76 j St. Lucie Unit 1-- 7/70'

- Millstone Unit 2 12/70 3/75:

Trojan '2/71 111/75

.)

Jorth Anna l~& 2- 2/71, l 4/77..

Davis-Besse -3/71-d Farley - 1_'& 2 8/72 6/77 ~

Fermi 2- 9/72l S

e Zimmer'l 10/77'

-ArkansasL2 12/72' ,

i . .'41 diana ?)J$ 2 - ,12/72- 1

'Haten'2; ;12/72 o

~

/atts .Sar"li1 2'- '1/73

.~4.

'l I -

_. . ::L d_- .

i b

4 ,

Construction Pennit Operating License  !

issued issued Facility Name_

McGuire 1 & 2 3/73 Washington Nuclear 2 3/73 Summer 1 3/73

.i Shoreham 4/73 Forked River 7/73- .

LaSalle 1 & 2 7/73 San Onofre 2 & 3 10/73 Suscuenanna 1 1 2 11/73 Bailly 1 5/74 Beaver Valley 2 5/74

. 4

'f

.g Limerick 1 & 2 6/74 .

..s Mine Mile Point 2 6/74 a

Vogtle.1 & 2 6/74 ..

C, Post-July 197a y

.c borthAnna3&4 7/74 ,

Millst0ne 3 8/74 Grand Gulf'l & 2 9/74 Hope Creek 1 & 2 11/74' . .

~ Waterford 3 11/74:

Comanene Peak 1 & 2. '12/74 o Surry~3 &'A 12/74

~Bellefonte-1 & 2- -

12/7 Catawea-i 5 2 3/75

.-'f Y

,  ?

f". 4 .a y y e- g -g p 4 a.r-.r y r y

4 W

5-Co struction Permit Operating License-Facility Namt Issued _

Issued r

South Texas 1.& 2 8/75 <

Washingtin fluclear 1 12/75 Syron 1 & 2 12/75- ,

Braidwood 1 & 2 12/75 Clinton'1 & 2 2/76 Seacrook-l & 2 2/76 Callaway 1 & 2 4/76 .

Palo Verce'1, 2 & 3 5/76 Hartsville 1, 2, 3, & 4 5/77-Perry 1 &:2 5/77 ,

'4olf Creek 1 ~5/77 River Bend 1 5 2 3/77 St. Lucie 2 .5/77 LSterling 1 9/77-And all other C? applications- currently, uncer staff review f '.h 4'

- , g .-

~

+

TABLE 3 Tine 1% sing of the Development-of AEC/NRC Hequirements and/or Guidance for the

- [nvirorsnental djualification of Safety-Related

[lectrical Equigment 1971 1972 1973 1974 1975 1976 1977 1966 1961 1968 1969 1970

.1965 Revised General Gesteral Draft General- De. sign Design Criteria Design Criteria Published for ' Published'for Criteria

- Consuent 7/67 incorporated Conment 11/65 into Regula-(GDC-16) '

(GDC-4,23) tions, Appen-dix A to 10 CfR Part 50 S/71 (GDC-4 23)

Hevision to 10 CIR 50.5Sa 10 CfR Part 50 " Codes and Stan-( s 50.55a) . -~ ~ Codes .

. dards," incorporated cand Standards," into Regulations 7/71 Published for (Endorsed IEEE amment 11/69 Std. 279)

AEC R.G. 1.89-(Endorsed IEEE Std.'323-1974) 11/71

' AEC R.G, 1.70 Rev. 1 R.G. 1~.70 -NRC R.G.

AEC Published a-- Rev. 2 1.131 Guide for Prepara _. (Standard format and (endorsing-

~

t?oriLoi Safety Analysis Content. of Safety : 9/75' Analysis Reports) ' IEEE .Std.

Reports!6/66 - NRC Stan . 383-1974)'

10/72' dard Review PublishedJ Plan 9/75 for conment"

- 8/77_:

s_-@

, e r .,--l < .y'- r- w - # , ,

1974 1975 1976 1977 1970 1971 1972 1973 1966 1967 1968 1969 196'3 AEC 1.G.2 Published 10/71 AEC R.G. Revision 1 to 1.63 R.G. 1.63 (endorsing (endorsing.

IEEE Std. 317- IEEE Std. 317-1972) 10/73. 1976) published for-comment S/??

AEC R.G.

1.40 l (endorsin9 IEEE Std. 334-1971) 3/73 AEC R.G.

1.73 (endorsing ifEE Std.

382-1972) 1/74 I

I i

- - J:- _. _

-.- ~

- - ~- _.

.i Aopendix-B.

PROCEDUP" FOR'EVALVATION OF ENVIRONMENTAL OUALIFICATION . .

T

. i-OF SAFETY-RELATED ELECTRICAL EOUIPMENT AND COMPONENTS The staff has determined that it is appropriate to complete- the review of; this subject as the first topic of the Systematic Evaluation Program. u The. ,

licensees of the eleven SEP facilities will be required to evaluate-the environmental qualification of all electrical equipment they deem necessary; to mitigate the consequences of Design Basis Events. It is expected that--

within about 90 days the review effort will be sufficient to assess any; safety implications in sufficient detail to decide whether or not additional review of facilities other than those included in the SEP is- y required. The results of this staff review will be used to make' a determination of whether it is necessary to expand this effort from the-eleven SEP facilities to other operating nuclear pcwer plants. . The staff's bases for this accroach are set forth in its report, titled, ,

" Staff Recort on Environmental- Qualificatien of Safety-Related Electrical Ecui; ment" dated Decemoer 15, 1977.

The evaluation of these cleven older operating reactor facilities- <

will be conoucted in accordance with the following crocedures:

1. Objective of Evaluatien To confirm that electrical equipment necessary to mitigate the

. consequences of DEE-have been demonstrated, by test, analysis, er coerating ex:crience, to have the capability to cerform its ' design: 7 l

r t -

1 l

)

2-safety function under the environmental conditions of Design Basis Events.

To determine actions that need to be taken to qualify appropriate equipment in accordance with current requirements.

2. Information To Be Provided By Licensees Licensees will be requested to provide the following infor .ation:

A. Icentification of safety-related systems and associated electrical equi ment located both inside and outside con-tainment which are recuired to ;;erform a safety functicn under the envircemental conditions resulting from each DBE. Briefly describe the safety function provided by each

- item of equipment identified. Describe the location of the ecuipment. Identify any non-safety system, equipment or comoonents, which, if subjected to the environmental conditions associated with a CBE, could affect the safety function of any safety relatec system. Identify non-safety grace systems which could perform the ' unction of safety systems oy ameliorating the consequences of a DBE and specify electrical ecmconents rkquirec to assure function of such non-safety grade systs.s.

~ ~^ - - ____.__ ' - - , _ _ . _ _ _ _ _ , _

+

.e 3

B. Definition 'of the limiting' service environmental conditions for operation of- the equipment.and components identified above.

The environmental paramet_ers to be included are pressure, temperature, radiation, submergence. steam, humidity. : chemicals, vibration or any combination of the above'(seismic.condittons are not included in this evaluation but will' he considered elsewhere in the SEP). These environmental parame'ters should be presented as a function of -time and'the OBE producing then conditions should be identified. The: time :eriod curing which each item of ecuipmenthould be required to operate.

i in a DBE environment should also be. identified, C. Determination of the current status of environmental qualifica-tion for safety-related electrical equi: ment and; identification.

of the succorting documentation. Any evidence of environmental:

R_ "

qualification-for any ' environmental con:ition'should be considered:

and crovided.

3. Staff Review of Previously Documented Envirer.: ental Oualification' The staff will re-examine any environmental qualifications previously acccmplished on these facilities, such as the informationLsubmitted ..

by licensees on modifications" performed to demonstrate c:moliance with A0;endix X of 10 CFR Part 50.-

i......... .. .. ... -..._-_n_

E

. 4

4. Staff Determination of Plant Environmental Conditions The staff will review and verify the environmental conditions provided by li:ensees for main steam line breaks inside con-tainment, for tne liniting loss of coolant accident, and for other OBEs.

Site Visit by Staff Review Tean 5.

Early in the review process, staff members will visit the facility to discuss with the licensee the status of his response and to discuss alternatives considered by the licensee for satisfying the environmental qualification acceptance criteria.

5. Identification of Sicnificant Safety Problers.

Following tne site visit, the staff will determine if there is inadecuate evidence of environmental qualification for any safety-related electrical equipment which must function in a severe environment to mitigate the consecuences of a DBE. If such inade-cuacies are found, accropriate action will be taken to assure no undue risk to the health and safety of the ;ublic.

7. Staf f Evaluation The staff will evaluate tne information submitted by the licensee in accorcance with Item 2. If necessary, ancther site visit may be made at this time to clarify or amplify the licensee's submittal.

5-In the event that docunentation of environmental testing does not exist, or is insufficient to assure environmental qualification, the following alternatives will be considered:

A. Evidence of qualification of identical or similar equipment, either in another nuclear facility or by another industry. -_

B. Importance of the safety function associated with any questionable equipment will be considered. Cenonstratien of adequate facility response to all DBEs without credit for the function of an unqualified component may be justification for not recuiring environmental qualification of a specific component.

C. If important safety equipment is not environmentally qualified, consideration will be given to alternate ways of performing the safety function by using different systems, including the use of non-safety grade systems.

3. Consideration will be given to possible-means of protecting components from adverse environmental conditions, such as by enclosing it, coating it or providing other protective features.

E. Other alternatives that may be proposed by the licensee will be considered.

8. Staff Recor; A staff report will document the evaluation of this safety tcpic for each facility. The associated information will be providec

in a format that =is compatible with.= the' SEP evaluation procedure, such that the evaluation results can easily be incorporated into-the integrated SEP evaluation report for each facility.

,.7._

APPENDIX C December 15, 1977 LIST OF PUBLIC RESPONSES RECOMiENDATION

&_ RESPCNDING ORGANI2ATION South Carolina Nuclear Advisory Council Deny.

1

1. Youngheir Approve 2

Conner, Moore & Corber. Deny 3

Leboeuf, Lamb, Leiby & MacRae De ny*

4 Natural Resources Defense Council Approve-5 Arthur L. Reuter, Attorney at Law Approve 6

Commonwealth Edison Company De ny -

7 Consumers Power Company- Deny 8

North Anna Environmental' Coal 1 tion Approve 9

North Anna Environmental Coalition Approve 10 Power Authority of the State of New York- Deny 11 12 Ca rboline (Protective . Coatings) No Position Commonweath of Vi rginia'. - Req.~ Adde Time 13 Center -for- Law in -the; Public . Interest. ' Approve 14 Farm Legal . Service Approve 15-Zelia M. Jensen R. N. Approve.

16-Deny 17 SNUPPS Baltimore Gas and- Electric Company- Deny 18 Offshore Power. Systems Deny 19'

- Aquidneck Island Ecology  : Approve 20 21 Factory Mutual Research No Position

• Also requested additional 1 time to file additional information.

C-1

b 22 Louise Grenflo No Position 23 Debevoise & Liberman .De ny 24 Debevoise & Liberman Deny 25 Portland General Electric Company Deny 26 Thomas M. Dallito, Attorney at Law Approve 27 Minnesota Public Interest Research Group Approve 28 GPU Service Corporation Deny 29 Concerned Citizens of Tennessee Approve 30 Sacramento Municipal Utility District De ny 31 ConscHdated Edison Company Deny 32 Yankee Atomic Electric Company Deny 33 Tennessee Valley Authority Req.. Add. Time 34 Mid-America Coalition for Energy -Approve Al ternatives 35 Toledo Edison Deny 36 David Winship Approve 4 37 Commonwealth Ecison Company Deny 38 Day, Berry & Howard Deny 39 Arizona Public' Service Company Deny 40 Al abama Power Co. Deny 41 Gibbs & Hill, Inc. - De ny 42 Gulf States Utilities Company Deny 43 Rochester Gas & Electric Corp. Deny 44 ITT - Cannon Electric Division - !b position C-2

- _________._m________._______________._._____._..__._m _ . . _ _ _ .

Appendix 0 August 17.-1977 INFORMATION REPOST BY THE OFFICE OF NUCLEAR REACTOR - REGULATION ON THE SINGLE FAILURE CRITERICN

1. INTRODUCTION The Single Failure Criterion is just one of several tools applied in systems design and analysis to precote reliability of the systems which are needed in a nuclear power plant Tec safe shutdown and cooling, and for mitigation of the consequences of postulated accidents. It is not sufficient by itself. Rules of good design practice, suen as those required by the ASME Soller and Pressure Code, IEEE standards, quality assurance requirements and conservatively stipulated design conditions must also be utill:ed to ensure that hign quality and hignty reliable systems, components and structures are previded.

The Single Failure Criterion, as a design.ind analysis tool, has the direct objective of promoting reliability through the enforced. provision-of redundancy in those systems which sust perform a safety-related function.

Simply stated, application of the Single Failure Criterion ~requirec that a system which is designed to perform a defined safety function must be capable of :eeting its objectives assu=ing the failure of any =ajor-co=ponent within the system or in an associated syste:'which suppcrts its oceration.

Tra Single failure Criterien was developed without the tenefit Of nu:erical-assessments en the probabilities of coe;cnent or system failure. However, in applying the Criterion, it is not assumed tnat any conceivable failure cculd cccur. Fcr example, reactor vessels or certain types of structural elements within systems, when comoined witn etner unlikely events, are not assumed to fall because the probabilities of.the resulting scenarios of events are deemed to be sufficiently small that they need not be considered. In general only those systems or components which are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterien is applied. Such failures would include, for exa:ple, tne failure of a valve to open er close on demand, the failure of.an e:Crgency diesel generator to start er tt e failure of an instrument channel to functi0n. A single failure car. also be a short' circult- in an electrical bus that results in the failure of several electrically.

operated coeponents to function.

= 1

-2.

The Single Failure Criterien, through enforced provision of, redundancy, does not give absolute assurance of reliability. The Reactor Safety

~

Study (WASH-1300) indicates that application of the Single Failure-Criterion to the. plants that were studied did provide an acceptable-degree of hardware redundancy for most systems.- ^ However, ' the Reactor Safety Study also pointed out that factors such as systems interactions, ,

multiple human errors, -and saintenance and testing requirements also have an influence on reliability. Such factors fall outside the' scope.

of the Single Failure Criterion, and supplementary =ethods sust te.

utill:ed in their study.

At the'present time, the Single Failure Criterion is codified in Appendix A' to 10 CFR 50 (General Design Criteria) and in Appendix K (ECCS Evaluation-Models); in addition, 10 CFR 50.55a (Codes and Standards) makes andatory the use of the ASME Code and of.IEEE Std 279 which contains the Single Failure Criterion. Further interpretation and guidance on. the application of the Single Failure Criterion is given in the Standard Review Plan and Regulatory Guides (e.g., Standard Review Plan Section 3.6.1 describe its application in the eventLof postulated piping failures.outside containmenc, , ,

and Regulatory Guide 1.53. endorses IEEE Std 379 which describes in detail.

how the Single Failure Criterion defined in IEEE Std 279 is appliedJto electrical and instru=entation- systems) .

s 2. !MPORTANT ELEMENTS OF THE SINGLE FAILURE CRITERICN A. The Conceet ,

'In principle, the Single Failure Criterion is straigntforsard. Simply stated it is a require =ent that a syste which is, designed"to carry'out a defined safety fancti n (e.g. , an Emergency Core Cooling.Systes) must .

be capable of carrying out its mission 'in spite of the failure of any; $ ingle component within-the systes or in an associate'd system whleh' supports;its-eperation.. Applicati:n of tne_ concept isLeo: plicated by the interrelati:n-snips- between the 'various fluid and electrical ' systems and their ' supporting.

auxiliaries in a nuclear'pewer plant. Furthermore,-there is a need'to stipulate the events = and associated assumptions which zust be1censidered during application of the Single Failure Criterion.

Applicatien- of the Single . Failure Criterien involves a systematic ' search for potential 1 single failure points and their= effects on prescribed.cissions (i.e., Failure Modes and Effect: Analysis). Such a search is required- '

by cur Standard Review Plan and .the ' Standard Format for =the Content of Safety Analysis Reports for specified safety systems- and components. The objective is to search f:r ' design weaknesses.whl=h cculd te1 overcome ty, increased redundancy, use of alternate systems or use of alternate prececures.

k i

{

3 .-

3. Definikten of Sincie Failure Single failure ~ is defined in 10 'CFR 50' Appendix A As folicws:

"A single' failure means an occurrence which results in the loss of capability of a component to perform its intended safety. functions. Multiple failures resulting from a' single occurrence-are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if,neither (1) a single failureEoff any. active component (assucing passive components function ~

properly) nor (2) a single failure of a passive com-ponent (assuming active components-function properly),

results in a loss of capabi2Lty of the system to perform its safety functions. "

A footnote to this definition states that " single failures of passive cceponents in electric, systems snould be' assumed in. designing assinst a single failure." This means that for electric systems' no distinction -

is made between failures of active'and passive' components and all such- o f ailures must te considered in' applying tne Single Failure ' Criterion,

' For example, short circuits'in electrical cables must be considered even though a short circuit could be. regarded as a failure of a passive component.

With regard to passive components in fluid systems, the footnote further states,."The conditions under which a single failure of a passive.com-ponent in a fluid system should be: considered-in designing the system. '

against a single f ailure are under development."

While considerable progress has been made in idefining the nature if passive.

cc ponent f ailures'which :should be considered !in the licensing ' review process, no enange to the regulation has been made since 1969 In application lof the5 a' Single Failure Criterien to fluid systems,'Section 6.3 of the Standard Re-- ,

vieu Plan requires considet ation of passive failures in _the Emergency Core ,

Ccoling System'during the recirculation cooling mode follcwing emergencyJ f

coolant injection,- out does not define the nature. of such f ailures. Other-interpretations of the Criterien for passive -components have been cade 'on the basis of detailed engineering'evaluationsEconducted during licensing reviews, but Nith_some; staff disagreement, .For example,1NUBEG-3136.

j 4

(Issue ?) has: a detailed discussionior ;assive failures follcwing a Loss of<0colant Accident, and- NUREG-0153 (Issue 17) has fa detailed' discussion l, of passive . type _ valve failures. This- tuh ject is also summari:ed in' Section 4 below and tne status'of.standardsEdevelopment ;ertir.ent-to this subject 'is scamarized in Sectien 6. - The -following definitions L:f. single-active and passive failures in fluid systems important to safety are q pertinent to tne discussion cf the Single Failure Criterion.

b

4 4.

i C. Active Failure in a Fluid System An active failure = in a fluid system means (1) the failure of a component which relles on mechanical-movement for its operation- to ccmplete its:

~

intended function on demand, or (2) an unintended movement-of.tne component.

Examples include the failure of a motor- or air-operated valve to =ove or to assume its correct position en demand,' spurious opening or closing of a motor- or air-operated valve, or the failure of,a pump to start or-to stop on demand. In some instances such failures can be induced by operator error.

D. Passive Fs(Aure in a Fluid System A passive failure in a fluid system means a breach in the fluid _ pressure coundary or a mechanical " allure whien adversely affects a flow path. .

Examples include the failure of a simple check valve to_ move to its correct position when required, the leakage of fluid from failed components, such.

as pipes and valves--particularly through a f ailed seal at a valve or. pu=p--

or line blockage. Moter-operated valves which have tne source of power.

locked out are allowed-to be treated as passive-components. .

In the study of- passive failures it is current practice to assume fluid leakage owing_ to ' gross failure of a pump _ or valve seal during the :long-term cooling mode following a LCCA (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater lafter the? event) but not pipe breaks. . JNo other passive failures _are required to be assumed

~

tecause it is judged tnat ecepcunding of probabilities . associated with other types of passive failures, following the pipe break assoc!ated with a LOCA, results in probabilities-sufficiently_small that they can be reasonably _

discounted without substantially affecting overall' systems reliability.

It sneuld beinoted that coeponents i=portant to safety are designed to withstand hazardous events suen as earthquakes.- Nevertheless, in keeping with the defense lin depth approach,- the staff doesl consider the effects:

of- certain passive f ailures' (e.g. , uheck valve failure, Lmedium or, high-energy pipe failure, valve stem or bonnet; failure)-as-potential-accident._

initiating events.

3 AFPLICATICN OF THE SINGLE TAILUPE CRITERION As _ notec 'previously, the events and associated _ assumptions which are ncon- -

sidered la connection s ith application'or the Single Failure. Criterion?

must be defined fer specific _ systems. The basic eventsJandLassumptions-4: are defined _in the Ganeral Oesign Criteria.

s

.s.

A variety of design basis events which initiate a requirement for safety syste: action cust be considered in the overall safety evaluation of a plant. In general, each of these initiating events requires an assess-sent of the equip ent da: age that could occur as a direct consequence of the event. The Single Failure Criterion is applied to those syste:s wnich cust function after consequential equip ent failures have been taken into account.

The General Oesign Criteria sake it clear that for electrical, instrumentation and entrol syste s, application of the Single Failure Criterion to syste:s evaluation depends not cnly on the initiating event that invokes safety action of these syste:s, together with consequential failures, but also on active or passive electrical failures which can occur independent of tne event. Thus, evaluation proceeds en the proposition that single failures can occur at any time.

In :ontrast, for varicus fluid syste=s the Oeneral Design Criteria require that the safety function be accc=plished in the f ace of certain conservative assu=pti:ns in additi:n to application of the Single Tallure Criterien. la general, these assumptions involve (1) the unavailacility of offsite or

r. site power and (2) the postulated initiating failure. In the case of a 1:ss of coolant accident, for exa:ple, it as first assu=ed that a primary syste: pipe rupture occurs with consequential blowdown of primary coolant.

Si=ultaneous with the pipe rupture, it is assumed that only the Q{faite r

cwer source or the onsite emergency power scurce is available. ' ' These assumpti

ns are applied in addition to the Single Failure Criterion whien is appliec to the aggregate of systems required to fulfill eacn specifi:

safety function.

The ranner in which the Single Failure Criterien is currently applied t vari:us specific classes of safety related syste:s is outlined below.

A. Ele c t r_ic a l . Instr nentatten and Centrcl Svstems The general interpretation and application of the Single Failure Criterion to electri:al, instrucentation and control syste:s is stated in IEEE Std 379 as follows:

"The system shall be capable of performing the pro ;1ve acti:ns required to accomplish a protective functier. in the cresence of any single detectable failure within the syste: [tn's is the " single failure"' concurrent witt all identifiabl., but non-detectable failures, all failures occurring as a result of the single failure, and all failures wnl:n wcul: te caused by the design basis event requiring tne protective function."

(1) Successful e ergency syste:s perf0r ance cust te de=cnst rated witn eitner Offsite Or ensite ;cwer, assu=ing a single f ailure.

- 6-' .

L Therefore, in the analysis to determine-if a particular electrical, instrumentation or control system meets the Single Failure Criterion  ;

the following' postulates are mades (1)l First, the particular design basis event or accident is postulated to occur, along with any related or consequential-l failures that could result from it.

(2) Then, the analysis assumes the presence of all identifiable failures which cannot be detected or tested in the design-or which are not.(n fact subject to surveillance tests as set forth in the Technical Specifications. ,

(3) Finally, the presence of a single additional' detectable failure is assumed in assessing the capability of the system-to provide the-necessary' protection for the design basis event.  ;

Analyses are performed in this manner to demonstrate the: adequacy of the electrical, instrumentati:n and- control . systems design over the full range of postulated. design ~ basis events or accidents and worst.csse single failures?

.There is a special interpretation of the CriterionL(Section 4.7 of IEEE Std 279) which specifically addresses designs. in which safety-related instrumentation er controls are also used'to provide. inputs to'non-safety related plant control systems. In-such-a design it is required that where.

a single random failure in the safety-related system _can cause s ocntrol system action that -results in a generating statica conditionf requiring protective action and can'also prevent;prcper actlon off a protection

. system channel'cesigned to protect.against:the: condition, the remaining redundant protection channels shall.be" capable of providing:the' protective action'even when degraded by a second random' failure. LThis special1 interpretation of' the Single Failure CriterionLis specificsfor the design cited above', and'it is not. applied to' safety-related electric power systems..

The general interpretation of the' Single. Failure Criterion is' applicable to.

safety-related electric power' systems. However,Lthe offsite power system-is an exception. The specific requiremer,ts.ef General Design 1 Criterion-17 take precedence .over the ; rigorous " application of. the Single: Failure 'Ori-' -

terion; 1.e.,'an'offsite' power sys*em comprisedLof one-delayed: access ,

circuit and one ismediate access circuit is;deemedracceptable.z The basis.

for this position is that a second immediate access circuitLwould not' significantly improve :the availability cf. offsite power at- the emergency-Ouses. This has been established -by: an analysis ~ using reliability _ data:

and net. the Single Ta11ure Criterion.

(

s

~ -

7 4

B. Emergency Core Cooline Syste=s In applying the Single Failure Criterion to Emergency Core Cooling Systems which must function following postulatec loss ~of coolant accidents, the requirements of Cencral Desl An Critorion 35 - Emergency' Core Cooling - are followed. Therein it is stipulated that following a postulatso loss of coolant accident, suitable redundancy in equipment shall be provided to assure 'thap for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the ECCS ssfety function can be accomp1.ished, assuming the most limiting additional single failure.

Appendix s to 10 CFR 50 requires that the only ECCS subsystems to be assumed availabls are those operable after the most damaging additional' single failure of ECCS equipment has taken place. Selection of the single failure to be applied to the emergency core cooling system is-made independent of the si:e or location of the postulated pipe break in the reactor coolant' system. Thus, for each postulated pipe break, that single failure whicn results in mini =um emergency core cooling performance is considered in judging the adequacy of tne system. Ter example, tnis could be failure-of a component in a redundant ECCS subsystem or le loss of an emergency.

diesel generator in addition to the loss of all effsite power.

During the short-term ECCS coolant injection mode immediately following a loss of coolant accident, the most limiting. single active failure is considerec in evaluating systems performance capability.

During the long-term ECCS recirculation cooling mode the_ cost limiting active failure, or a single passive failure equal to the leskage that would occur from a valve er pump seal failure, is assumed. The basis for not including other passive failures durin6 the long term is cased on engineering judgment that such failures (pipe or valve breaks) have an acceptably-law likelihood of occurrence during the long-term phase of a loss-of-ccciant accident. Analyses of ECCS performance in WASH-1400 indicate that passive f ailures of valves and piping are relatively small centributors to ECCS unavailability during both the injection and recir-culation modes of Operation.

C. . Containment Heat Removal and Cleanuo Systees General Design Criterion 33 - Containment Heat Removal - requires- the

~

provisica of a system to rapidly reduce containment pressure and tempera-ture foll: wing any LOCA. While current practice is to apply only an active component failure to the evaluati:ncor the performance of'these systems, ccaponent redundancy ensures'their availability even in the presence of some possible passive'fa11ures.

a 8_ .

- General = Design' Criterion 41 - Containment Atmosphere Cleanup req'uires a systems to control fission products, hydrogen, oxygen, and other substances .

which may,be released into containment. .These systems must be, capable. f of functioning with either onsite or offsite power. Contaminants can enter the centainment due to.a variety of events, such as a 10CA. The Single F.

Failure Criterion is applied subsequent to the' postulated event and, in evaluating these systess, only active failures are. considered, except in instances where components may be shared with ECCS systems.' In such cases, the possibility of seal leakage is considered in the long-term ECCS recirculation code. ,

D. Sesidual Heat,Removat System The capability fer_ residual nest re= oval must be available using onsite or offsite power, assuming an additional single failure. To accommodate' certain single failures, for the older class of plants, the staff has accepted use of the auxiliary feedwater syste= as a backup to the' residual-heat removal system. For current designs, the residual heat removal- system has been modified to. include additional piping and valves such that-the-system now has additional flexibility to perf:r: its functico even after a wide _ range of possible single failures. Also, as part of' current staff-reviews, certain' initiating events h?.ve been postulated which-are~related-to the Single Failure Criterion. These events involve application of the pipe break criteria for moderate energy lines located cutside cf containment' as described in Standard Review Plan 3 6.1. .Thus, the staff applies:a' 11 cited passive failure as'an initiating event for-the residual heat re- a moval system. For this event, no additional' single failureLis applied j' to tne Residual Heat Removal System.

E. Ultimate Meat Sink General Design Criterion'44 - Cooling b'ater -Leequires a system to transfer.

neat from systems, structures, and co=ponents11:pertant-;to: safety to,an-ultimate heat sink under normal' operating and accident conditions. ~The syste ~must be capable of-carrying:out its; function.using either onsiteg or-offsite power assuming any-single: failure. The requirements of the:

Single Failure Criterion are applied in a sanner.similar-to that:which 1si aoplied to: residual _ heat; removal systems. ,

F. Containment Ploine Penetrations i Eequirements for-isolation valves'on containment penetrati ns are defined' in-the 3eneral Cesign-Criteria. The requirements-anticipate the possiti'lity, of single active failure of isolati:n' valves'in each line by requiring couble '

barriers. The Single Failure Criterion is also'ap' plied to the plant pro-i l tection devices wnien initiate autccatic closure 'of- such isolation: devices, j k s

9 4 PROBLEMS THAT HAVE BEEN ENCCUNTERED IN THE APPLICATIO:1 0F THE SIN 0(E FAILUBE CRITERICN A. Additional Passive Failures As stated previously, there is a footnote in the. General Design Criteria that the conditions under which single passive failures should be con-sidered in applying the Single Failure Criterion to fluid systems are under development. That' footnote was included when the Criteria were published in 1969 During subsequent years staff _ assumptions regarding the nature of passive failures wnien should be considered have not :4en completely consistent and there has been some disagreement. However, on the basis of the licensing review experience accumulated in the. period since 1969, it has been judged in most instances that'the probability of most types of passive failures in fluid systems is suf ficiently . small that they need not be assumed.in additien to tne initiating failure in application of the Single Failure Criterien to assure safety of a nuclear power. plant.

This opinion appears to have been verified by- the Reactor Safety Study. 'l Nevertheless, it is receiving further study. i in some licensing review areas, the staff does impose a passive f ailure D in addition to the initiating event, while.in others it does not._ As pre--

viously mentioned, an example of the-application of a passive failure requirement is the approach to long-term recovery subsequent to a less-of-ecolant accident. Applicants are required to- consider jegradation of a pump or valve seal and resulting leakages in ade.iti:n to the:1.11tisting ,

failure (LOCA). The rationale for applying this type of failure is'a; recognition of the relatively extended. periods of required operati:n of systems that are expected to'be on_a standby status throughout the plant life. The likelihood of accelerated wear of fsuch Ocmponents as pump and valve seals would te increased after the adverse cenditions following a LOCA. Extended cperation curing the long ter: (up to conths) requires that these types of failures be considered in designing the plant. The

~

i basis for excluding additicnal passive piping failures is elaborated--in detail in NUREG-0138, :ssue ?. Other examples of passive failure con--

siderations are presented in Section 4.B.

B. Valve Failures A variety of valve functions and valve types exist in each nuclear' plant.

Valve functions include isolating ficw, controlling flow, admitting ficw, L

and preventing flow reversal. Valve types include those that are electri- d cally controlled and Operated,' electrically controlled and air operated, L

' manually controlled and Operated, manually controlled and electrically .  ;

l; Operated, spring operated, andfself actuated (Check valves).

l a

2

-=. ____ __ _

i I

f Accordingly, a variety of failure modes can be postulated for valves within-the application of the Single Failure Criterion. Certain passive-type valve failure modes have occurred (for example, dropping of a valve disc).

This has resulted in a reevaluation of postulated valve failures. NUREG-0153 (Issue 17) concludes that while the staff does not consider that changes in safety criteria are warranted at this time, ongoing efforts regarding the probability and effects of various valve failure modes will seek to compile a more rigorous data base and will apply such information to plant safety analyses. This effort has been classed as a Category B generic task.

C. Electrical Failures.

In ceder to previde an electrical, instru:entation and control system design to satisfy the Single Failure Criterien, redundancy is included.

The degree of redundancy (i.e. , the number of " independent" divisions of equipment) depends on many design considerations. Provisions are typically included to prevent the initiating event from affecting the electrical, instrumentation and control systems.

If it is postulated that tne failure of a portion of the safety-related electrical, instrumentation and control systems is the initiater of a design basis event, then the general interpretation of the Single Failure Criterion, discussed in Section 3.A. is not applicable to the remaining portions cf the system. In such cases supplementary analyses are relied upon to evaluate the reliability of the systems in question.

In the case of the current issue on the reliability of the safety-related direct current power systems as raised by an ACES censultant, the postulated Hew-initiating event is failure of ore division of a two division system.

ever, this DC pcwer system design does meet the general interpretation of the Single Failure Criterion, but it is not covered by the special inter-pretati:n.noted in Section 3.A for specific safety-related instrumentation and control systems. Therefore, the staff evaluation of this issue,_ summa-rised in NUREG-0305, was based upon reliability data and not the Single Failure Criterion. It was concluded that the likelihood of cecurrence of tne pestulated sequence of events is lcw enough t o permit continued opera-tien and licensing of plants pending further assessments. It is possible that new requirements to assure greater reilability of DC power systems may result from the engoing study. It is a Category A generic task.

\

D. Classification of Events Recent staff work related to issues raised in dissent or pertaining to reactor transient event classifications and consequence criteria has disclosed some confusion on how to handle certain infrequent transients which do not have public consequences as severe as "scoidents". Tha non-fusion ste=s primarily from the differences in event classification from vender to vendor, among standards writing bodies and witbin NRC. A study is underway 'within the Reactor Systems Branch to develop a " unified" event classification scheme. It is expected to be completed in early 1978. While this study is not alced at application of the Single Failure Criterion, it is expected that for some events it will bring into sharper definition the circumstances under which the Criterion should or should not be applied.

For example, a moderate frequency transient such as a feedwater =alfunction is routinely analyzed in Safety Analysis Reports. An additional single failure concurrent with the feedwater talfunction may result in a compound event which, because of the multiple failures, has a lower probability and therefore a different classification. Less stringent acceptance criteria cay tnen be appropriate. The above study will examine such additional single failures as they apply to acceptance criteria for transients and accidents. This study has been classed as a Category B generic task.

E. Orarator Errer_

An operator error could cause an active single failure, such as an inad-vertent valve closure. In nany instances consideration of such single operator errors is given in licensing reviews; however, the degree to which any given operator error is considered reasonably equivalent to the likeilhood of a single active failure is based on judgments race concerning the situaticn. For example, in studying the effects of an operator error of "cmission" (failure to perfers an acticn), if there is time to bring a system on line through remedial operator action, reliance on suen action is pe rmi tt ed . On the other hand, in cases where rapid actuation cf engineered safety systems is required, the actuation is required to be autczatic and operatcr independent.

Increasing attention is being given to human reliability in an effort to adopt more definitive criteria for the role of the operator in miti-gating the consequences of transients or accidents. A Regulatcry Guide is currently being developed in conjunction with staff review of the proposed Standard ANSI-N660, " Proposed ANS Criteria for Safety-Relatel Operater Actions." Increasing activities in human reliability will assist the staff in developing a more rigorous basis for assessing cperater involvement in plant safety.

I

5. :NS!GHTS OF THE RE ACTOR SAFETY STUDY PELATIVE TO THE SINGLE FAILUPE CRITERIOR The Reactor- Safety Study (WASH-1400) assessed a pressurited water and a boiling water reactor design. The Single Failure Criterion had been applied; in the design and Regulatory review processes for these plants, generally:

as outlined _in the preceding sections. Although the Single ~ Failure Criterion is not-a quantitative design and analysis tool, the numerical assessments i in the Reactor. Safety Study indicate that its application, through enforced--

provision of component and systems redundancy, has made-an important! and-necessary contribution to the overall reliability of nuclear plant safety l systems. The assessments in the Reactor Safety Study also-indicate that supplementary methods of analysis must-be utill:ed to study effects on cellaoility which are beyond the scope cf the Single Failure Criterion.

The principal insights gained from this study are briefly .9ummarized telow:

(1) Application of the Single. Failure Criterion has ind to a suitable level of hardware redundancy in most systems. The level of redundancy thus provided has, for many~ safety systems, resulted-in systems reliability bein6 controlled byf such ractors as human and operational interactions (i.e., human errors, test and naintenance downtL=es,' test intervals) rather yhan potential single design failures as defined.in the Single Failure Criterien.

Quantitative- optimiertion of reliability in terms of such none hardware factors would require the review of.infor:3 tion beyond that now considered in the licensing-process.

(2) The Single Failure Criterion.must;be supplementedLby methods and criteria in the area of ec= mon code assessments if improved-rellaellity characteristics for safety systems are necessary.

Although the effects of: common mode failure'are not new quanti-tatively considered in licensing safety reviews,Leonsiderable attention is given to reducing the-potential'forfthe cccurrence of common mode failures-through stringent. application of high-quality.

design and quality assurance. requirements to various components.

For example, considerable attention is given to. reducing the.

potential for multiple electrical relay failures such as might arise from a generic design defect.in components supplied byLa-single manufacturer.

13 - -

(3). The probability of accident sequences'resultin6 in core melt-

~

down were found by.the RSS to_be importantly influenced by. system-to system interactions ?nd by functional dependencies between systees. These functional dependencies can be considered as.

t class of intersctions where the functiening_of one system depends

.. ...ier. 4cer t.in,4 l.nln , er .p ther .v,t.3, p.4m p,ne, or components witnin systems, aanuated by the dingle r'a11..rr tritorien, does not ameliorate the functional _ dependence. Thus, application of the Single Failure Criterien requires supplemental methods and use of an integrated systems approach to identify such func-tional dependencies if it is desired to further reduce accident risk.

6. ACT!VITIES RELATED TO CLARIFYING AND LMPROVING APPLICATION OF THE SINGLE FAILORE CRITERION

-A. number-of technical activities by various nuclear industry groups'and by the Offices of Standards Development and Nuclear Reactor-Regulation are underway, which will have an effect on system reliability. requirements and the use of the Single Failure Criterion. These are-summarized in this section.

In late 1971 the American Nuclear Society initiated a standards writing effort with the objective of setting forth a clear, detailed set of criteriaz for application of the Single Failure Criterion to fluid systems._ In 1975' the resulting Standard was_ issued as " ANSI N658 - Single Failure Criteria for FWR Fluid Systems." In November of 1976, the Of fice of1 Standards =

Oevelopment _ initiated a' task to draft a: Regulatory Guide endorsing the Standard, with-appropriate exceptions,-for.both:PWRs and BWRs. The' staff-review of this Standard disclosed.several deficiencies- which relate 'primarily to inconsistencies with current regulatory' practice and tc areas in which staff application of'the Single Failure Criterion is not-yet fully. defined.

For example: (1) literally applied _to " postulated-pipe tresks'outside containment," the Standard would make no exception for c rtain dual' purpose moderate _ energy systems-(e.g., service water. systems)Las presently'provided-in- Standard Review Plan 3.6.1;-(2) some. passive failures would ce treated as active failures-(e.g. , check valves) contrary to staff practice; _ and, (3) event categorization is not consistent with~ current staff interpretation.-

Nevertheless, ANSI-N6SB represents a significant step.toward achieving-satisfactory criteria for application ofJthe Single Failure Criterion to fluid systems, and it is expected that a Regulatory Guide.could;be issued in mid-1979.

1:

. 14 .

IEEE -Std 379 was issued in 1972 as a Trial-Use Guide fo'r the Application of the Single Failure Criterion to Electrical. Instrumentation and Control Systems and its application was endorsed in Regulatory Guide 1.53 IEEE Std 379 was recently updated and reissued. The subcommittee which prepared the Standard is currently working to develop definitive guidance on application of the Single Failure Criterion to shared systems and to single operator errors. When this work is completed it is expected that Regulatory Guide 1.53 will be revised to endorse these added require-ments.

Earlier this year, the Office of Nuclear Reactor Regulation initiatad a formal system providing for continuing management oversight and attention '[

to generic safety-related technical activities. A number of these generic l activities may include clarification of the conditions under which the Single Failure Criterion snould be applied. The Category A activities expected to include single failure considerations are:

(1) Anticipated Transients 'dithout Scram; (2) Non-Safety Loads on Class IE Power Supplies; (3) Adequacy of Safety-Related d.c. Power Supplies; (4) Reactor Vessel Pressure Transient Protection; (5) Steam Line Breaks; (6) RHR Shutdown Requirements; (7) Systems' Interaction; and (8) Generic Accident Risk Study 1 (9) Snubbers The Category 3 activities expected to include single failure considerations are:

(1) Event Categorization; (2) ECCS Reliability; (3) Locking Cut of ECCS Power Operated Valves; (4) Protection Against Postulated Piping Failures in Fluid Systems Cutside Containment; (5) Criteria for Safety-Related Operator Actions; (6) Passive Mechanical Failures; and (7) Allowable ECCS Equipment Outage Perieds

- - _ _ _ - - - _ - - - -- =

1 l-

. In some cases these activities are being conducted to evaluate adequacy of previous staff positions, while in others some new provisions may result. -The single failure _ aspects of these activities will be utilized as appropriate in connection with improving application of the Single Failure Criterion.

The NRR staff is developing a plan for. incorporating risk assessment methodology into the licensing process. Because of manpower limitations, and the need to train an initial cadre in risk assessment methodology and to carefully weigh impacts of its application, it is expected that appli-  ;

cation of risk assessment methodology to the licensing process would neces- -

sarily increase gradually over a period of several years. It is .not expected that risk assessment methodology will come into large-scalu systematic use in the near future as a replacement for the Single Failure Criterion as it is now app!!ed. It is expected, however, that reliability en61neering l

i and probabilistic sethodologies, together with an expanding data base on

. component and systems failure rates, will be applied to specific. studies pertaining to reliability requirements and evaluations that go beyond the -

Single Failure Criterion. The current study of the adequacy of DC power supplies is an example of such an application. .

7. SUHMARY CONCLUSIONS Application of the Single Failure Criterion as it is presently defined-y in the regulations, Standard Review Plan, and various Regulatory Guides f and industry _ standards has led to a generally acceptable level of hardware redundancy in most electrical, control and instrumentation systems and -

in fluid systems important to safety. As-indicated by the Reactor Safety Study, systems unavailabilities are controlled to a large extent by factors  ;

such as cperator errors, systems interactions, and- maintenance and testing requirements, rather than by ' inadequate hardware redundancy. Some problems exist in-specific. interpretations _and applications of the Single Failure Criterion and these are receiving staff. attention. It is the considered ,

judgment of the staff that _the Single Failure Criterion should continue '

to be applied subject to resolution of specific problem areas currently defined and under study, pending .any long-term wide-scale incorporation of reliability and risk assessment methodology into the licensing process.

I av l

--- - - - - - - _ _ _ _ _ _ _ _ _