ML20237C107
| ML20237C107 | |
| Person / Time | |
|---|---|
| Issue date: | 08/03/1998 |
| From: | Callan L NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| References | |
| SECY-98-187, SECY-98-187-01, SECY-98-187-1, SECY-98-187-R, NUDOCS 9808200203 | |
| Download: ML20237C107 (26) | |
Text
-
...........ea..........*
RELEASED TO THE POR
^
da ir
,,.....j a
POLICY ISSUE Auaust 3.1998 SECY-98-187 EQB:
The Commissioners EBQM L. Joseph Callan Executive Director for Operations
SUBJECT:
INTERIM STATUS REPORT-FIRE PROTECTION FUNCTIONAL INSPECTION PROGRAM PURPOSE:
To inform the Commission of the status of the pilot fire protection functionalinspection (FPFI) program and of the staffs plans to complete the program.
BACKGROUND:
The staff sent the Commission information leading up to the FPFI program in memoranda of August 25,1992; September 20,1995; and April 3,1996, and in SECY-93-143, "NRC Staff Actions to Address the Recommendations in the Report on the Reassessment of the NRC Fire Protection Program," dated May 21,1993; and SECY-95-034, " Status of Recommendations Resulting from the Reassessment of the NRC Fire Protection Program " dated February 13,1995. In SECY-96-267, " Fire Protection Functional Inspection Program,"
CONTACTS:
Leon Whitney, SPLB/DSSA/NRR (301) 415-3081 c.
Steven West, SPLB/DSSA/NRR (301) 415-1220 Y
a(+w 9808200203 980803
&R Y
-18 PDR v ofw c, c8mi i
The Commissioners 2
dated December 24,1996, the staff documented the complete background and description of the FPFI program and informed the Commission of its plans for implementing the program. In brief, the FPFI program was based on the following staff commitments to the Commission:
(1) to inspect the Thermo-Lag corrective actions at all plants, (2) to assess the NRC reactor fire protection program to determine if it had appropriately addressed all fire safety issues, (3) to determine if licensees are maintaining compliance with NRC fire protection requirements, (4) to identif the strengths and weaknesses of the reactor fire protection program, (5) to reevaluate f
the scope of the reactor fire protection inspection program, and (6) to develop a coordinated approach for reactor fire protection and systems inspections.
In a Staff Requirements Memorandum of February 7,1997, the Commission informed the staff that it did not object to the staff's plans for the FPFI program, and of its interest in strategies that would shorten the time for the benefits of the program to become available to all licensees.
The Commission requested that the staff send a report to the Commission at the end of the pilot program that discusses the FPFI program and possible plans for accelerating the benefits of the program. On the basis of the schedule given in SECY-96-267, the staff was to have produced its final report during June 1998 (WITS 9700021). However, because of the program delays discussed under " Schedule," below, the staff will not complete the FPFI pilot program within the schedule given in SECY-96-267. Therefore, rather than the final report, the staff is sending the Commission this interim report. This interim report describes the inspection results to date, the plans to complete the pilot program, and adjustments made to the pilot program since SECY-96-267. The staff plans to submit its final report to the Commission by the end of calendar year 1998.
DISCUSSION:
The staff has completed three of the four pilot FPFis: Region I (Susquehanna Steam Electric Station), Region 11 (St. Lucie Plant), and Region IV (River Bend Station). To complete the pilot program described in SECY-96-267, the staff must perform the fourth and final pilot inspection in Region 111 (Prairie Island), conduct a workshop to obtain public and industry comment on the FPFI program, prepare a final version of the FPFI procedure, and report to the Commission the results of the FPFI pilot program and the staff's recommendations for the future of the program.
Pilot insoection Process The Office of Nuclear Reactor Regulation (NRR) led the three pilot FPFis completed to date using inspectors from NRR, the regional offices, and Brookhaven National Laboratory. NRR coordinated plant selection and inspection schedules with the regional offices. The staff performed the inspections in accordance with the approach described in SECY-96-267 (2 weeks of preparation,1 week inspecting on site,1 week reviewing in office, and a final week inspecting on site) using the FPFl procedure that it had sent to the Commission by memorandum dated June 23,1997. This procedure is much broader in scope than the existing fire protection core inspection procedure (IP 64704," Fire Protection Program"). For example, 4
fL-
f The Commissioners 3
although the objective of IP 64704 is to evaluate the overall adequacy of the licensee's fire protection program, it does not address post-fire safe-shutdown capability, nor does it thoroughly evaluate fire protection program management and configuration control. The FPFI procedure also differs from the core fire protection inspection procedure in that it provides guidance to the inspectors for using risk insights to help focus on areas most important to safety. NRR risk analysts are assisting the FPFI team in obtaining fire risk insights for the plant-specific inspection plans. The staff will present additionalinformation on the use of risk insights in its final report on the FPFI pilot program.
NRR prepared the FPFI reports and sent them to the licensees after the appropriate regional office reviewed the reports. Like other NRR-led team inspections, and as described in SECY-96-267, the regional offices are responsible for any inspection followup and enforcement actions resulting from the FPFl. After NRR issued each FPFI report to the licensees, it made recommendations for inspection followup and enforcement to the regional office and gave follo'N up support.
The staff <uill modify its approach for the final pilot FPFl as described under " Prairie Island" below.
Insoection Results to Date The findings from the pilot FPFis for the River Bend, Susquehanna, and St. Lucie plants are summarized below. The executive summaries from the FPFI reports for these plants, which contain detailed summaries of each inspection finding, are attached (Attachments 1,2, and 3, respectively). The staff will prepare an analysis of the FPFI findings in its final report on the FPFI pilot program.
River Bend Station The inspection team reported the following findings: (1) there was a weakness in how transient combustibles are controlled; (2) smoke detection and fire suppression system designs did not meet industry standards; (3) there was a weakness in the analysis and testing of fire doors; (4) engineering evaluations of certain fire barrier designs did not demonstrate that the barriers protected adequately against the fire hazards; (5) fire brigade performance was weak; (6) compensatory measures for the lack of certain fire barriers did not provide an equivalent level of safety; and (7) certain Individual Plant Examination of Extemal Events (IPEEE) assumptions were weak. The inspection team also found that the licensee's post-fire safe-shutdown circuit failure analysis methodology did not consider multiple circuit faults and, therefore, did not identify certain conditions that could prevent the operation or cause the maloperation of post-fire safe-shutdown capability (e.g., a potential fire-induced reactor transient may not have been properly analyzed and bounded). As part of its Thermo-Lag corrective action program, the licensee reanalyzed its post fire safe shutdown methodology.
The objective of the reanalysis was to reduce reliance on Thermo-Lag fire barriers and to upgrade required Thermo-Lag barriers. The inspection team did not identify any problems with i
the licensee's Thermo-Lag corrective action program.
The Commissioners 4
Susquehanna Steam Electric Station The inspection team reported the following findings: (1) transient combustibles were not controlled in accordance with plant procedures; (2) the fire brigade drill revealed response and firefighting technique problems; (3) fire detection and suppression system designs did not meet fire protection industry codes and standards; (4) the post-fire safe shutdown method for certain fire areas used the automatic depressurization and core spray systems and could allow core uncovery; (5) off-normal post-fire safe-shutdown procedures did not fully !Jentify all required manual actions or did not identify'the preferred instrumentation to be used to monitor reactor j
performance; and (6) emergency lighting was not provided for certain safe-shutdown operations. The inspection team noted that licensee personnel exhibited good knowledge of the Susquehanna fire protection features and post-fire safe-shutdown capability, that the scope and depth of operator training was good, that the licensee had been pro-active in addressing Kaowool fire barrier concems, and that modifications had been implemented to prevent fire-induced spurious actuations of motor-operated valves (MOVs). During the inspection the licensee was in the process of confirming the design attributes of the installed Thermo-Lag fire barriers and evaluating required barrier upgrades. The inspection team did not identify any problems with the licensee's Thermo-Lag corrective action program.
St. Lucie The inspection team reported the following findings: (1) fire detection and suppression system l
designs did not meet fire protection industry codes and standards; (2) transient combustibles l
were not controlled in accordance with plant procedures; (3) the fire brigade drill performance l
revealed response and firefichting technique problems; (4) the safr,-shutdown analysis did not
[
consider the fire-induced anects of multiple high-impedance electrical faults associated with the power distribution system; (5) weaknesses were associated with tne fuse breaker coordination control program; (6) there were no fire isolation measures to protect against fire-induced spurious operation of high/ low reactor pressure boundary valves; (7) there was no fire barrier to
(-
separate post-fire safe-shutdown charging function; (8) there was no analysis of fire-induced affects on instrument sensing lines; (9) there was a potential for fire-induced circuit failures leading to spurious operation of required post-fire safe shutdow '. MOVs; and (10) there was no emergency lighting for certain post-fire safe-shutdown operatior s. The teer.1 also found that there was a general lack of fire protection and post-fire safe-shu'dov;a program ownership by the engineering department, and that the licensee's response to negative quality assurance findings was slow. With respect to the licensee's Thermo-Lag fire barrier upgrade program, the l
inspection team found that certain wall upgrades and designs were not sufficient to provide the fire resistance needed to contain the fire hazards in the areas of concern and that adequate fire resistive protection was not provided for thermal shorts that penetrate Thermo-Lag raceway fire barriers.
Prairie Island (Insoection of Licensee Self-assessment) l Prairie Island will be the fourth and final pilot FPFl. The inspection, which will be conducted during August 1998, will differ from the three previous pilot inspections in two significant ways.
f
The Commissioners 5
First, it will be a reduced-scope inspection of a licensee self-assessment instead of a full-scope FPFl. Second, it will be led by the region rather than by NRR. NRR will provide staff and contractor support to the region.
In SECY-96-267, the staff stated that licensee self-assessments could be an important element of the permanent FPFI program and that it would consider the role of self-assessments after it completed the pilot FPFI program, in the SRM of February 7,1997, the Commission stated that it was interested in the use of licensee self-assessments as a strategy to relieve some of the staff inspection burden to the extent that the NRC can be assured that the self-assessments are of good quality and accurately reflect the strengths and weaknesses of the program. The
)
Commission noted that staff review of the self-assessments would be warranted to gain this I
assurance. After the staff announced the FPFI pilot program, Northern States Power Company conducted a self-assessment of the Prairie Island fire protection and post-fire safe-shutdown programs in anticipation of receiving a pilot FPFl. This gave the staff an opportunity to test an inspection strategy involving licensee self-assessments as part of the FPFI pilot program.
1 In contrast to a full FPFI, the self-assessment inspection will be a one-week inspection. The NRC inspection team will evaluate the licensee's self-assessment effort and determine whether I
or not the scope and depth of the effort were equivalent to an FPFI, or if the licensee had an acceptable basis for reducing the scope or depth. The team will review the licensee's organization, the technical qualifications of the licensee's assessment team, the completeness I
of the assessment, the corrective actions proposed by the licensee for the more significant assessment findings, and the licensee's handling of any operability concems. The staff will consider this exercise in formulating its recommendations for future reactor fire protection inspections.
j Clinton and Quad Cities The staff did not conduct FPFis at either Clinton Power Station or Quad Cities. However, as discussed in the following sections, recent experiences with these plants provided insights into possible weaknesses with the core fire protection inspection program, the potential benefits of more comprehensive fire protection inspections (like FPFis), and the use of licensee self-
]
assessments.
t l
Clinton The staff had scheduled a pilot FPFI at Clinton Power Station. In preparation for the FPFI, the licensee performed an augmented fire protection program quality assurance audit and found that a program breakdown existed. The licensee issued 16 condition reports,11 of which were i
attributed to inadequate post-fire safe-shutdown analyses. Before the staff could perform the pilot FPFI, it was canceled due to the licensee's commitment to perform an Independent Safety Assessment (ISA) and the NRC's oversight of this effort with a Special Evaluation Team (SET).
]
Because of the significance of the licensee's fire protection audit findings, the SET performed j
an in-depth, vertical-slice inspection of the Clinton fire protection program. The SET noted that j
the licensee could not demonstrate the ability of the post-fire safe-shutdown analysis, equipment, and procedures to ensure that the plant could achieve and maintain safe-shutdown following a fire.
l l
I I
L I
The Commissioners 6
This experience demonstrated how one of the proposed benefits of the FPFI program, to gain renewed industry attention to nuclear power plant fire safety, is to be achieved. That is, implementation of the FPFI program led the licensee to assess its fire protection program, revealing significant programmatic and fire safety issues. The staff also notes that routine fire protection core inspections had not and would not have uncovered many of the issues that the licensee identified in preparation for the FPFI, but an FPFI-type inspection would have done so.
This experience also produced insights into the possible benefits and uses of licensee self-assessments as a reactor fire protection inspection strategy.
f Quad Cities in September 1997, the licensee found problems with the Quad Cities post-fire safe-shutdown procedures and declared all safe-shutdown paths inoperable. In December 1997, after significant effort to correct these and other fire protection problems, the licensee was unable to demonstrate to the staff that the Quad Cities safe-shutdown analysis and procedures were adequate to assure that a fire in any plant area would not prevent the performance of necessary post-fire safe-shutdown functions. Ultimately, the licensee shut down both units to address these problems. Later, after a fire protection-related restart team inspection, the units l
restarted. This experience is another example in which the core inspection had not and would not have revealed significant fire safety issues, but an FPFI would have. It also provided insights into the possible benefits and use of licensee self-assessments as a reactor fire protection inspection strategy.
Plans for a Post-Pilot Proaram Public and Industry Workshoo The staff will conduct a FPFI workshop after it completes the final pilot inspection. The FPFI L
inspection process and pilot FPFI Inspection results to date will be made publicly available prior to the workshop. At the workshop the inspection results will be discussed, and public and industry input and feedback on the FPFI program will be solicited.
Schedule i
The staff has extended the schedule for the FPFI pilot program by about six months for the following reasons. First, at the request of the licensee for River Bend, the staff delayed the original piht FPFI by three months so that the inspectors could inspect a revised safe-shutdown analysis. Second, the staff canceled the Clinton pilot FPFI late in the inspection preparation i
period in favor of the SET discussed above. A replacement pilot FPFI could not be scheduled i
on such short notice. Therefore, FPFI contractor resources were reassigned to non-FPFI fire protection and post-fire safe-shutdown inspection activity in support of the Millstone Project Office. Third, the Prairie Island pilot FPFI was postponed to use FPFI inspectors to conduct the i
emergent, fire protection-related restart team inspection at Quad Cities.
I i
l With respect to the remaining pilot program activities, the staff plans to do the following:
(1) perform the final pilot inspection at Prairie Island c'uring August 1998, (2) conduct the FPFI workshop during November 1998, and (3) submit its f nal report to the Commission by the end of calendar year 1998. In its final report, the staff will do thc following: (1) present an analysis
The Commissioners 7
of the FPFI findings, regional FPFI inspection follow-up activities, and enforcement actions arising from the pilot FPFis; (2) present information on the use of risk insights for fire protection inspections; (3) discuss and evaluate the types of NRC fire protection inspections that it has conducted since the fire protection regulation was issued in 1981; (4) address the strategies that the Commission expressed interest in (SRM of February 7,1997); and (5) recommend the type and level of reactor fire protection inspection that would be appropriate for the future.
L.J<s h Callan Exec ive Director for Operations Attachments: (1) River Bend Inspection Findings Summary (2) Susquehanna inspection Findings Summary (3) St. Lucie inspection Findings Summary DISTRIBUTION:
Commissioners OGC OCAA OIG OPA OCA ACRS CIO CFO EDO REGIONS I
SECY i
ATTACHMENT 1 2
EXECUTIVE
SUMMARY
River Bend Station Fire Protection Functional Inspection Report 50-458/97-201 River Bend Station Unit 1 (RBS) is a General Electric 991 megawatt electric (MWe) boiling water reactor (BWR) with a Mark lli containment. The plant entered commercial operation in Jur,e 1986. During the weeks of June 16 - 20 and June 30 - July 3,1997, a team of Nuclear Regdatory Commission (NRC) and Brookhaven National Laboratory (BNL) engineers conducted a Fire Protection Functional inspection (FPFI) at the River Bend Station. In a letter dated July 29,1997, the NRC requested additional information to support its review of issues found during the fire protection functionalinspection. During a meeting of August 19,1997, representatives of Ertergy Operations incorporated (EOl), the licensee for RBS, met with the NRC to discuss their responses to the request for additienal information (RAl). During this meeting, the NRC staff informed the licensee that its responses did not fully resolve the inspection issues and requested that it provide a written response to the RAI of July 29,1997.
The licensee informed the staff that it would submit its written response to the RAI after it receives the FPFI report. The staff informed the licensee that this was acceptable. The inspectors presented the inspection results to members of licensee management at the conclusion of the inspection on July 3,1997. The inspection team conducted an interim final exit meeting with the licensee on January 20,1998. The final exit meeting was March 5,1998. The licensee acknowledged the findings presented.
Title 10, Section 50.48, of the Code of Federal Reaulation (10 CFR 50.48) requires that all operating nuclear power plants have a fire protection plan that satisfies Criterion 3 of Appendix A of this part. Operating License NPF-47, Condition 2.C.10 specifies that the licensee shall comply with the requirements of the fire protection program as specified in f,ttachment 4 to the license, which specifies that the licensee shall implement and maintain in affect all of the provisions of the approved program as approved in the NRC Safety Evaluation Report (SER) dated May 1984 snd its Supplement 3 dated August 1985. The NRC based its approval of the RBS fire protection program on the licensee's commitment to follow the guidance of Appendix A to Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, %uidelines for Fire Protection for Nuclear Power Plants," and the licensee's commitment to meet Sections Ill.G, Ill.J., and Ill.L of Appendix R to 10 CFR Part 50.
To reduce the quantity of Thermo-Lag fire barrier material installed at RBS, the licensee has performed a complete revision oi ?he post-fire safe-shutdown analysis methodology that was developed by the former licensee of dBS, Gulf States Utilities (GSU). This revised approach represents a significant difference in the manner in which components and cables were evaluated and dis-positioned to ensure that at least one train of the systems necessary to achieve and maintain post-fire safe-shutdown capability would remain free of fire damage.
Specifically, in lieu of performL ;, detailed circuit analyses, the former approach (240.201 A, dated i
l November 24,1993) provided fire protective features (fire barrier wrap, fire suppression systems, and fire detection systems) to protect cat.Ms, equipment, and associated non-safety circuits from fire damage. In the recently revised approach (240.201 A, Revision 2, undated),
EOl placed greater emphasis on analytical techniques to evaluate the specific effects of fire damage to a particular component, cable, or circuit. While either approach may provide an l
3 acceptable means of demonstrating that a postulated fire will not affect the analyzed post-fire safe-shutdown capability of the plant, reliance on detailed electrical circuit analyses places greater importance on the assumptions and evaluation criteria that form the basis of the analysis.
The inspection consisted of a comprehensive evaluation of the fire protection program, fire safety features, and post-fire safe-shutdown capability developed by EOs for RBS Unit 1.
Specific areas reviewed by the FPFI team included:
Compliance with Sections Ill.G, Ill.J, and Ill.L of Appendix R to 10 CFR Part 50 and the plant's ability to achieve, maintain, and implement the post-fire safe-shutdown capability.
subsequent cold shutdown from inside and outside the control room in the event of fire in any plant area.
The adequacy of separation and/or protection provided for redundant trains of equipment and cables required to achieve and maintain safe-shutdown conditions in the event of fire.
The scope of the analysis performed and the adequacy of protection provided for non-essential associated circuits of concern to the plant's post-fire safe-shutdown capability.
The post-fire alternative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
The plant fire protection program to determine if it has been fully implemented and maintained in accordance with the guidance of Appendix A to BTP APCSB 9.5-1.
l l
The 10 CFR 50.59 change process as applied to the fire protection program and how the l
process assures the NRC-approved fire protection program is maintained.
j l
The ability to mitigate the consequence of a fire resulting from a plant event.
I In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection program and licensee initiatives taken to implement improvements in " state-of-the-art" fire l
detection, control, ad extinguishment technology.
Summarv of Findinas The following items in the area of fire protection engineering and program implementation were identified during this inspection:
l The licensee's implementation of its procedure to control combustibles and plant l
operational practices were not consistent with NRC fire protection program guidance in that transient combustibles resulting from work activities were not removed at the completion of each shift. (See Report Section F1.1.)
t I
.______A
4 l
At the time of initial licensing for operation, the licensee established onsite the minimum level of fire brigade equipment specified in the approved fire protection program. The licensee has maintained this minimum level of equipment and has not upgraded the equipment in response to technological advances in manual fire fighting. The fire fighting l
equipment provided to the brigade, which is used to cope with onsite fire emergencies, does not provide the level of personnel safety (to both the plant fire brigade and the off site fire department) that is needed to efficiently handle onsite fire emergencies. (See l
Report Section F2.1.1.)
Smoke detectors are required by the NRC approved fire protection program as referenced by operating License Condition 2.C.10 to provide early warning fire detection in fire area C-24, which contains safety-related and post-fire safe-shutdown equipment and cables. The placement of detectors in this fire area deviated from the codes and standards specified by the updated safety analysis report (USAR) and, therefore, may not provide sufficient early warning of a fire. (See Report Section F2.3.1.)
)
NRC Generic Letter (GL) 86-10 " Implementation of Fire Protection Requirements,"
Question 8.9, stated that deviations from National fire Protection Association (NFPA) standards should be identified and justified in the final safety analysis report (FSAR) or fire hazard analysis report (FHAR). The licensee did not evaluate and justify deviations from the NFPA standards for the RBS fire detection and sprinkler systems. (See Report Sections F2.3.1 and F2.3.3.)
The licensee did not have test procedures to demonstrate the operability of the service water system (SWS) seismic water source interface with the fire protection water supply system. Specifically, the licensee's test program did not verify the operability of the fire protection seismic check valves that provide fire protection system and SWS integrity following a safe-shutdown earthquake. (See Report Section F2.3.4.)
As a case in point, RBS USAR, Section 9A.3.5.1.10, " Fire Area Enclosures," stated that separate fire areas are enclosed with minimum 3-hour rated fire walls and floors, or have been evaluated to be adequate using the guidance of GL 86-10. The licensee was unable to locate any of the engineering evaluations of deviations of fire barrier designs from tested configuration. The installed configuration of fire door CB 116-14 deviated from the commitments described in the USAR. The licensee did not perform an engineering evaluation to justify the adequacy esf this door configuration. (See Report Section F2.3.5.)
The licensee utilizes a fire door "GO-NO-GO" gauce to check the fire door gap clearances specified in procedure STP-000-3602. NFPA 80 (1983) specifies that the maximum clearance between the bottom of a fire door and the floor is 3/4 inch, and the maximum clearance between the door and its door frame is 1/8 inch. The dimensions of l
the check blocks on the gauge were specified as 1-inch and 1/4-inch thicknesses, respectively. The procedure states that if the gauge completely fits into the door gap (i.e., the gap is greater than 1 inch or greater than 1/4 inch), then the door gap is unacceptable. Thus, the procedural acceptance criteria can exceed the maximum door-to-door frame aad door-to-floor clearances specified by NFPA 80. This practice for l
1
1 5
l I
determining fire door clearancrss does not confirm that the door installations are being maintained in accordance with the conditions of their fire endurance qualification tests i
and their UL listing. (See Report Section F2.3.5.)
f l
The team observed an unannounced fire brigade drill and found that fire brigade exhibited performance weaknesses. During the drill, the inspectors observed that one security force fire brigade member was delayed in responding by approximately 10 minutes because it vlas necessary to relieve that member of an assigned security post.
1 In the event of a fire, effective and timely fire suppression activities would have been hampered by equipment and fire brigade performance problems. (See Report Sections F3.1 and F4.3.)
i h
The licensee's fire protection operability assessments are too narrowly focused on satisfying the definition of operability as specified in the RBS technical requirements manual. As a result, the effect that a postulated fire may have on the plant's capability to
{
achieve and maintain safe-shutdewn conditions does not appear to have been fully evaluated for cases where passive fire barriers have been intentionally removed from service and redundant (two) trains of safe-shutdown capability can be exposed to a common fire and may both be damaged. Under these conditions, the use of an hourly fire watch appears insufficient as an adequate compensatory measure for missing or removed post-fire safe-shutdown raceway fire barrier, and the fire watch did not provide l
the fire safety margin needed to assure that the designated post-fire shutdown equipment can perform their intended post-fire safe shutdown functions if they were called upon. (See Report Section F7.3.4.)
l The fire conditions modeled by the RBS Individual Plant Examination of Dternal Events I
(IPEEE) fire analysis were non-conservative. Limited insights were gained from this analysis regarding how the plant and operators would responded to a challenging fire.
This is attributed to the methodological weakness of the RBS IPEEE fire analysis process which does not constitute an in-depth fire analysis of compartments that present 1
high consequence to reactor safety. (See Report Section F7.8.)
The following items in the area of post-fire safe-shutdown were identified during this inspection:
1 A fire in areas requiring implementation of the alternative shutdown capability and accomplishment of safe-shutdown conditions from outside the main control room (fire I
areas C-17 and C-25) could result in all 16 safety relief valves (SRVs) spuriously opening. Review of the licensee's current technical basis has raised issues pertaining to the ability of the operators to implement safe-shutdown requirements within the time-frame dictated by the thermal hydraulic plant changes this transient would induce.
Additionally, calculations and documentation obtained from the licensee and reviewed by l
the team did not demonstrate that this capability would exist if the SRVs opened. The l
potential fire-induced spurious actuation of 16 SRVs caused by a postulated main control room fire could adversely impact the design of the alternative safe shutdown capability in that it could not meet the reactor performance goals specified in Section Ill.L of Appendix R. Specifically, the alternative shutdown system could not meet Appendix R Section Ill.L.1 in that it is not sufficient capacity and capability to l
\\
6 mitigate the design basis transient conditions discussed in Generic Letter (GL) 86-10, the staff's Appendix R implementation guidance. Therefore, the RBS alternative shutdown capability was not capable of mitigating one worst-case spurious actuation transient that may be initiated by the fire (i.e. fire-induced spurious actuation of SRVs and concurrent loss of all automatic functions (e.g., no automatic initiation of EECS). Applying the GL 86-10 design basis transient performance criteria to the RBS alternative shutdown system design, the RBS design is not capable of meeting Section Ill.L.1 of Appendix R by maintaining reactor coolant inventory, achieving and maintaining hot shutdown, and maintaining the process variables within those predicted for a normalloss of a.c. power.
In addition, the alternative shutdown capability deign was not capable of meeting Appendix R Section Ill.L.2 by maintaining the reactor coolant level above the top of the core. The associated SRV circuits of concern were not isolated from the affects of fire as specified by Appendix R Section Ill.L.7 such that a postulated fire would not prevent safe shutdown. (See Report Section F7.4, F7.6 and 7.7.)
The licensee's method for identifying and protecting spurious equipment operations that may be induced by fire was found to differ significantly from that which was previously reviewed and inspected by the NRC in 1993 (
Reference:
NRC Inspection Report No. 93-09). Where the former approach relied on fire protection features (e.g., fire barrier wrap) to provide assurance that associated circuits of concern would remain free of fire damage, the licensee's revised approach relies on the performance of detailed analytical evaluations of potential cable damage and circuit faults that may be caused by fire. The inspection team noted weaknesses in the licensee's application of existing staff guidance regarding the performance of analytical evaluations of fire damage to unprotected cables. (See Report Section F7.6.)
The licensee's evaluation criteria and methods for analyzing circuits of equipment for which spurious actuation could adversely affect post-fire safe-shutdown capability did not conform to the staff's Appendix R implementation guidance in GL 86-10, which specifies consideration of multiple circuit failures or faults such as hot shorts, open circuits, and shorts to ground. Consequently, the licensee's methodology for identifying circuits that can adversely affect post-fire safe shutdown capability may not provide the level of protection needed satisfy the licensee's commitment to meet Appendix R, Section Ill.G.2.
(See Report Section F7.6.)
For fire areas C2 and C6, a fire can cause the spurious operation of the SRVs and a demand for emergency core cooling system (ECCS). For fire areas C2 and C6, only one standby service water pump (SWP*P2A) is available to support safe-shutdown, and it is started by the ECCS signal. If the SRVs and a demand for ECCS happen before isolating or throttling non-safe-shutdown loads, such as reactor plant closed cooling water (RPCCW) heat exchangers, dry well coolers, containment unit coolers, and before l
flow is throttled to the residual heat remover (RHR) heat exchanger, in accordance with Abnormal Operating Procedure (AOP) 52, the standby service water pump may be damaged due to pump run out. In addition, the loss of this pump would cause the cascading loss of RHR pump A, emergency diesel generators (EDGs), and low-pressure core spray (LPCS) room coolers. This is an example of inadequate circuit analysis and its potentialimpact on the ability to achieve and maintain post-fire safe shutdown.
i{.
7 Additionally, calculations and documentation obtained from the licensee and reviewed by the team did not adequately demonstrate that service water capability existed. (See Shutdown Report Section F7.7.)
i l
l I
1 1
l l
l
{
t
)
ATTACHMENT 2 2
EXECUTIVE
SUMMARY
Susquehanna Steam Electric Station Fire Protection Functional inspection Report 50-387/97-201 and 50-388/97-201 Susquehanna Steam Electric Station (SSES) is a dual unit station consisting of two General Electric boiling-water reactors (BWR Type 4) having Mark ll coritainments. The rated output of Unit 1 is 1050 MWe and Unit 2 is rated at 1168 MWe. Unit i entered commercial operation in June 1983 and Unit 2 started in February 1985. During the weeks of October 20-24 and November 3-7,1997, a team of Nuclear. Regulatory Commission (NRC) and Brookhaven National Laboratory (BNL) engineers conducted a Fire Protection Functional Inspection (FPFI) at SSES. The NRC staff held the FPFI exit meeting with the licensee on November 7,1997.
Section 50.48 of Title 10 of the Code of FederalRegulations (10 CFR 50.48) requires that all operating nuclear power plants have a fire protection plan that satisfies General Design Criterion (GDC) 3 of Appendix A of this part. Operating License NPF-14 (Unit 1) Condition 2.C (6) and NPF-22 (Unit 2) Condition 2.C(3) specify that the licensee implement and maintain in effect all
- provisions of the approved fire protection program as described in the Fire Protection Review Report (FPRR) for the facilities and as approved by the NRC Safety Evaluation Report (SER) dated August 9,1989. The NRC based its approval of the SSES fire protection program on the licensee's commitment to follow the guidance of Appendix A to Branch Technical Position (BTP)
Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, " Guide!ines for Fire Protection for Nuclear Power Plants," and the licensee's commitment to meet Sections Ill.G, Ill.J., and Ill.L of Appendix R to 10 CFR Part 50.
While this inspection included a comprehensive risk-informed evaluation of the fire protection program developed by the licensee, Pennsylvania Power and Light (PP&L), inspection focused on assessing the fire safety factors at SSES Units 1 and 2 and the ability of each unit to achieve and maintain safe-shutdown conditions in the event of fire in any area of the plant.
Specific areas reviewed by the Fire Protection Functional Inspection team included:
o Compliance with Sections Ill.G, Ill.J, and Ill.L of Appe*, dix R to 10 CFR Part 50 and the
- plant's ability to achieve, maintain, and implement the post-fire safe-shutdown capability.
o The adequacy of separation and/or protection provided for redundant trains of eqdpment l
and cables required to achieve and maintain safe-shutdown conditions in the eveat of
- fire, e
The scope of the analysis performed and the adequacy of protection provided for non-essential associated circuits of the plant's post-fire safe-shutdown capability.
e' The post-fire alternative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
l 4
l 3
Whether the plant fire protection program has been fully implemented and maintained in I
e accordance with the guidance of Appendix A to BTP APCSB 9.5-1.
The 10 CFR 50.59 change process as applied to the fire protection program and how the e
process assures the NRC-approved fire protection pcogram is maintained.
l The ability to mitigate the consequence of a fire resulting fam a plant event.
e In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection j
program and licensee initiatives to implement improvements in state-of-the-art fire detection, control, and extinguishment technology.
)
Summarv of Findings The following items in the area of fire protection engineering and program implementation were identified during this ir spection:
j i
1 During a plant walkdown, in the essential safeguards service water (ESSW) pump i
e house, the team found that procedures NDAP-QA-0440, Rev. 2, " Control of Transient
{
Combustible / Hazardous Materials," and NDAP-QA-0552, Rev.1, " Transient Equipment
)
Controls," were not fully implemented in that plant personnel failed to adequately control transient combustible materials and to perform the appropriate engineering evaluation on I
securing transient equipment to plant components or structures (see Report Section F1.1).
1 The tean) found the fire brigade equipment disorganized and not ready to be rapidly transported to the fire scene and promptly deployed. Problems with equipment logistics and deployment could affect the fire brigade's ability to control and extir.guish a fire in a timely manner. The team also noted that the licensee has prohibited the use of fire fighting foam on site and considers this a weakness. In the event of a fire involving l
flammable or combustible liquids, the use of fire fighting foam can improve manual fire control and extinguishment effectiveness and at the same time provide re-flash l
protection to fire brigade personnel (see Report Section F2.1.1).
l The team observed a fire brigade unannounced drill. This drill scenario was a fire in the B diesel generator room. Since the diesel generators are accessed from the outdoors, the fire brigade van was used to provide support equipment. It took the brigade 23 minutes to get ready and into position with a hose line to enter the diesel generator i
room. A critique was held immediately after the drill. The most significant issue identified during the critique was that the brigade leader couldn't understand the transmissions from personnel wearing self-contained breathing apparatus (SCBAs).
After the critique, the team noted the extensive amount of time required for the first hose l
team to reach the fire area and the general apathetic attitude exhibited by the brigade members (see Report Section F3.3).
i I
I
4 The team noted that the Nuclear Training Department does not track the physical e
(medical) examinations of the fire brigade members. However, if a physicalis overdue, the member's name appears on the monthly fire brigade report. Operations Department had changed over to biennial physicals for fire brigade members in 1995. The entire operations fire brigade complement received their first biennial physicals in 1996. The team pointed out that the NDAP-QA-0445 requirements still called for annual physicals and the basis for this change was questioned. The change to biennial fire brigade physical examinations does not satisfy the medical criteria established by industry standards and NRC fire protection program guidelines or requirements for the fire brigade members to have annual physical examinations, as established by plant procedure NDAP-QA-0445 (see Report Section F4.1).
j The team's review of the depth and scope of the fire protection program audits e
determined that they did not fully assess compliance with Appendix R. The 1994,1995, and 1996 fire protection program audits did not perform audit samples in the fellowing j
areas: design basis reverification of plant fire protection features; reverification of the l
fire-induced electrical fault evaluation and the electrical-engineering aspects of l
Appendix R (e.g., fuse breaker coordination, common enclosure, spurious equipment l
operations); reverification of systems and logic used to support the safe-shutdown l
methodology and the fire protection features for those systems; reverification and j
evaluation of operationalimplementation of the safe-shutdown analysis; evaluation of major plant modifications for potential impact on the plant fire protection program and/or the plant safe-shutdown analysis (see Report Section F5.2).
j The licensee's off-normal procedure ON-037-001 states that the condensate transfer e
system (CTS) or other method of maintaining keepfill is required for high-pressure core injection (HPCI), reactor core isolation cooling (RCIC), the core spray system (CSS), and l
residual heat removal (RHR) to prevent water hammer in the discharge piping. The CTS and the cross-tie to the demineralized water system alternative keepfill scheme are not powered from a 1E bus, which would make them unavailable during a fire event that causes the loss of offsite power (LOOP). Since normal methods of maintaining keepfill were not credited by SSES for post-fire safe shutdown, the team noted that the loss of this capability may result in excessive water hammer in required shutdown systems. To 1
preclude such an occurrence, PP&L has developed an alternate keepfill scheme which i
involves the installation of a temporary cross-tie, using a hose to supply water from the i
fire water system to the CTS. Since this scheme involved manual actions with staged equipment, the licensee was asked to demonstrate the scheme's feasibility. During the team's walkthrough of the procedure, tools and equipment required to make the connection between the CTS and the fire water system were not available. Additionally, the team noted that the emergency lighting in the area where actions were to be performed did not appear to be sufficient (see Report Section F6.1.1).
e The licensee was granted an exemption to use an automatic depressurization system / core spray (ADS /CS) shutdown methodology in lieu of an RCIC/HPCI high-pressure methodology. The acceptance of this method was based on the licensee's claim that this low-pressure methodology did not to allow the reactor pressure vessel (RPV) water level to go below top of active fuel (TAF). In EC-013-0843 (pg. 70),
l l
l
5
' the licensee stated that spurious safety relief valve (SRV) opening from fire-related damage could cause the RPV water level to go below TAF. Additionally, in calculation EC-013-0509, " Minimum Reactor Water Level Under Spurious SRV Operation During a Control Room Fire," Rev.1, dated July 7,1994, the licensee did a thermal hydraulic-analysis and found that of the spuriously opening one or two SRVs would cause the RPV water level to go below TAF (see Report Section F6.1.1).
The licensee's off-normal procedures (ONs) for post-fire safe shutdown are symptom e
based. These procedures direct the operators to use other off-normal and emergency operating procedures (EOPs), depending on the availability of plant equipment.
However, these other procedures do not take into account the impact of fire damage, including the potential for fire-induced spurious signals on shutdown systems. For example, the normal shutdown procedures would not contain cautions on the possibility that hot shorts could change valve positions or give the operators false instrumentation readings. In reviewing the licensee's procedures for implementing a safe shutdown of the plant following a fire in plant areas not requiring main control room (MCR) evacuation, the team found that preferred instrumentation and equipment that would be free of fire damage was not identified by the safe-shutdown procedures by fire area or
. fire zone, although this information was available in the licensee's safe-shutdown
{
analysis (SSA). These procedures did not provide guidance regarding the manual l
operator actions which may have to be performed for specific fire area or zones in order
)
to implement post-fire safe shutdown. Depending on the location of the fire, the licensee's SSA requires different post-fire safe shutdown manual actions to be performed for different fire areas (see Report Section F6.2.1).
e Team verified that RPV level and temperature instruments identified in EOP are not necessary to satisfy a literal interpretation of Appendix R requirements and staff guidance and that failure to perform repair activities specified in procedure would not preclude the ability to achieve and maintain post-fire safe shutdown (PFSSD). However, from discussions with plant operators it appears that the availability of these instruments would significantly enhance the shutdown capability. As a result it is expected that during a fire event operators would request plant instrumentation and control (l&C) techniciar;s to perform the repair activities as specified in the procedure. Based on a walkdown of procedural actions necessary to perform the repairs, it was determined that actions necessary to install the temporary RPV temperature indication were not feasible;
' technicians would need to erect scaffolding, and work in a high-radiation area (straddling l
a resolved heat removal (RHR) line that is approximately 20' off the floor). In addition, L
there was no emergency lighting, and equipment and tools necessary to perform repairs l
were not dedicated for use (see Report Section F6.2.2).
l e
The team identified issues associated with the installed fire detection system and its ability to meet the minimum installation criteria established by the applicable National Fire Protection Association (NFPA) code of record (COR). High ceilings, deep beam pockets, and detector spacing limitations should be considered simultaneously in establishing the limiting parameters of the system design. Evaluating one parameter, without considering the others, will give a false impression of the design. The licensee could not adequately demonstrate that the fire detection system in the areas inspected I
6 met minimum industry fire protection codes. Specifically, the licensee could not demonstrate that the design considered all environmental and physical aspects of the installation including, but not limited to high ceilings, effects of the ventilation system on smoke movement, obstructions, and beam pocket ceiling construction (see Report 4
Section F6.4.1).
The team identified plant conditions that affected the ability of the sprinkler system to react to a fire and could result in the system performing ineffectively. The team concluded that certain sprinklers systems installed at SSES exhibited weaknesses in l
meeting the NFPA COR, specifically, the COR guidance pertaining to the placement of I
sprinkler heads, sprinkler head coverage, cod obstructions to the area of coverage (see Report Section F6.4.3).
From its review of CO suppression systems installed at SSES, the team concluded that 2
these systems, because of the lack of appropriate pre-operational system discharge testing, might not be capable of performing their intended fire control function. In addition, because of the licensee's concern about thermal shock to electrical equipment, the team concluded that the application of these systems might not meet the intent of GDC 3, " Fire Protection," of Appendix A to 10 CFR Part 50 (see Report Section F6.4.4).
The team performed a walkdown on the standpipe hose stations in the control building.
l SSES uses a Class il system as defined by the NFPA COR. The NFPA COR states:
"The number of hose stations for Class ll service in each building and each section of a building divided by fire walls shall be such that all portions of each sto:y of the building are within 30 feet of a nozzle when attached to not more than 100 feet of hose." During the week of October 27,1997, PP&L personal walked down additional hose stations and discovered standpipe hose stations did not meet their licensing and design basis.
Therefore, they could not provide the required area of coverage with the allotted 100' of hose (see Report Section F6.4.5).
During the team's walkdown of emergency lighting, the licensee could not demonstrate e
that adequate emergency lighting existed for supporting the following post-fire safe shutdown operations: (1) checking the reactor water cleanup system (RWCU) equipment for leakage, (2) opening breaker 1Y219-018 to stop RWCU leakage or diverting reactor water to radwaste or the condenser via RWCU, and (3) closing flow control valve HV-243-F023A at motor control center 2B237043. In addition, the required emergency lighting units (ELUs) in the E diesel generator building were not receiving appropriate testing and maintenance (see Report Section F6.5.1).
e The team identified several weaknesses with the Individual Plant Examination of External Events (IPEEE) fire analysis and its assumptions: (1) large fires due to combustibles allowed by administrative limits are not modeled, (2) the cable spreading room has been omitted from the analysis as lacking combustibles even though cables in the cable spreading room are combustible and transient combustibles are allowed in the room by procedure, and (3) cabinet 1C601, the emergency core cooling system (ECCS) cabinet in the control room, has penetrations between cabinet sections and can potentially be damaged in a single fire (see Report Section F6.6).
{
l
l l
l 7
Strenaths / Positive Observations The PP&L technical personnel supporting the inspection exhibited a great deal of interest e
in and knowledge of the fire protection features and post-fire safe shutdown capability of l
SSES. Additiona!Iy, the team found licensee representatives to be candid, clear, and informative. They were professional and knowledgeable of NRC fire protection 1
regulations and guidance and the corporate history of the development of the SSES fire
)
protection progrr.m. The plant's fire protection features and post-fire safe-shutdown capability. The high quality of the licensee's technical, operations, and management organizations responsible for ensuring the post-fire safe-shutdown capability of
)
Susquehanna Steam Electric Station was viewed as a major strength by the team.
)
l The scope and depth of the training program for operators at SESS was observed to be e
good. This observation was supported by the simulator demonstration that was carried out by the " shift in training" for an MCR fire scenario.
I i
The techniqu; a developed for aiming the emergency lighting units and maintaining the e
proper aim were good. The aiming markings on the units and their lamp receptacles were easily identifiable and supported the ready verification of proper aim.
PP&L identified the fire-resistive limitations of its Kaowcol raceway fire barrier systems and initiated a proactive response to the technical concerns (e.g., thermal performance limitations). PP&L has included these barrier systems in the scope of its Thermo-Lag resolution program.
The licensee implemented the necessary plant modifications to its essential post-fire safe-shutdown-related motor-operated valves (MOV) eliminating the fire-induced spurious actuation and the resulting valve control and functional operation concerns.
l l
I 1
l l
I l
l
ATTACHMENT 3 a
2 EXECUTIVE
SUMMARY
St. Lucie Units 1 and 2 Fire Protection Functionalin.spection Report 50 335/98-201 and 50-389/98-201 St. Lucie Units 1 and 2 are two separate nuclear power plants of a similar design that share a common site. Both units are Combustion Engineering pressurized-water reactors and each unit has a rated output of 890 MWe. St. Lucie Unit 1 began commercial operation in December 1976 and Unit 2 in August 1983. During the weeks of March 9-13 and March 30-April 4,1998, a team cf U.S. Nuclear Regulatory Commission (NRC) inspectors and Brookhaven National Laboratory engineers conducted a Fire Protection Functional inspection (FPFI) at the St. Lucie Plant (PSL).
In February 19E7, the NRC informed the licensee, Florida Power and Light (FPL) Company, of its intent to perform an FPFI at Unit 1. In a letter dated December 15,1998, FPL requested the NRC to delay the FPFI planned for March of 1998 and reschedule it to the June-July 1998 time frame. The NRC denied this request and, in a letter dated January 14,1998, advised FPL that it would conduct the FPFI as scheduled. Subsequent to the February 1997 notification, as documented in licensee-identified condition reports (CRs) reviewed during the inspection, FPL had initiated a comprehensive re-evaluation of its fire protection program for both units and a revalidation of the Unit 1 SSA (Document No. 8770-B-048, Revision 3, dated February 13,1986) and Volume 9.!". of the UFSAR. This effort resulted in the generation of a significant number of CRs related to the fire protection program and post-fire safe-shutdowns. In response to these various fire protection / post-fire safe shutdown program weaknesses, FPL instituted compensatory measures.
Although this inspection included a risk-informed evaluation of the fire protection program developed by FPL, the inspection team focused on assessing the fire protection defense-in-depth at Unit 1 and the plant's ability to achieve and maintain post-fire safe-shutdown conditions in the event of a fire in any area of the plant. This inspection consisted of a comprehensive evaluation of the fire protection program, fire safety features, and the post-fire safe-shutdown capability developed by FPL for Unit 1 as required by Section 50.48 of Title 10 of the Code of Federal Regulations (10 CFR 50.48).
q Section 50.48 requires that all operating nuclear power plants have a fire protection plan that satisfies General Design Criterion (GDC) 3 of Appendix A to Part 50. The PSL fire protection
)
program requirements are established by Unit i Operating License DPR-67, Condition 2.C(3),
i and Unit 2 Operating License NPF-16, Condition 2.C.20. These operating license conditions specify that FPL irn/sment and maintain in effect all provisions of the NRC approved fire l ~
protection program as described in the Updated Final Safety Analysis Report (UFSAR) for the l
facilities and as approved by various NRC Safety Evaluation Reports (SERs). Since Unit 1 was
{
l licensed to operate prior to January 1,1979, it is required to meet Sections Ill.G, Ill.J and 111.0 of Appendix R to 10 CFR Part 50 i
3 Specific areas reviewed by the FPFl team included the following:
The licensee's compliance with Sections Ill.G, Ill.J, and 111.0 of Appendix R to 10 CFR Part 50.
The adequacy of the licensee's separation and/or protection provided for redundant trains of equipment and cables required to achieve and maintain safe shutdown conditions in the event of fire.
The scope of the analysis performed by the licensee and the adequacy of the protection provided for non-essential associated circuits that can prevent the operation or cause the mal-operation of the plant's post-fire safe-shutdown capability.
The licensee's post fire altemative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
Whether the plant's fire protection program has been fully implemented and maintained in accordance with the plant's Operating License.
The 10 CFR 50.59 change process as applied to the fire protection program and how the process ensures that the NRC-approved fire protection program is maintained.
In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection program and the licensee's initiatives to implement improvements in state-of-the-art fire detection, control, and extinguishment technology.
Summary of Findinos The licensee's administrative combustible control procedures adequately implemented the approved fire protection program. Implementation of the fire inspection program by the Protection Services Department was good; however, the various plant departments had not consistently implemented their responsibilities, as specified by these procedures, for the control of combustible fire hazards. The plant departments' implementation of the combustible control procedures and operational practices were not consistent with the PSL fire protection program in that plant personnel failed to follow combustible control procedures used to manage temporary l
storage of transient combustibles in safety-related areas. This failure to follow the combustible l
control procedures which manages the use and temporary storage of transient combustibles in safety-related areas was identified as an unresolved item (see Section F1.1).
Backup (emergency) lighting was not provided by the licensee for the fire brigade equipment and dressout lockers. This situation, under certain conditions, could delay the response of the fire brigade and the logistics for deployment of its equipment. This was considered an area requiring licensee attention. The licensee evaluated this situation during the inspection and took corrective actions to establish backup lighting in these areas. Also, during the fire brigade drill, I
the team noted that the personal protective firefighting equipment provided to the brigade and used to cope with onsite fire emergencies did not provide the level of safety needed to protect fire brigade members from being exposed directly to the hazards associated with interior firefig' Mg (see Section F2.1.1).
~
4 Generally, the licensee's fire protection surveillance and inspection requirements (for fire protection systems selected by the temm) were found to be satisfactory and properly implemented. However, two examples of fire protection surveillance program problems were identified during the inspection: (1) the failure to include any administrative requirements goveming surveillance testing, operability, and compensatory measures for the Appendix R post-fire safe-shutdown equipment and features in the fire protection program, and (2) the failure of the fire hose station surveillance program to confirm coverage in accordance with requirements of the UFSAR. These examples are considered to be failures of the licenses's fire hose station surveillance program to confirm hose station coverage in accordance with the UFSAR and have been identified as an unresolved item (see Section F2.2).
The licensee has developed firefighting strategies for all Unit 1 and Unit 2 fire areas. However, these strategies, which provide important fire and smoke controlinformation to the fire brigade,
- do not reflect (1) manual actions to ensure ventilation requirements as specified by the SSA, (2) radiological contnfs for firefighting water runoff, and (3) manual smoke removal methods for maintaining the post-fire operator habitability of shutdown-related spaces adjacent to the fire area of concem. These are examples of a failure to update the firefighting strategies to reflect the requirements of the approved fire protection plan and Appendix R. This has been identified as an unresolved item (see Section F3.1).
1 I
The team noted that the fire brigade did not fully use the self-contained breathing apparatus i
(SCBA) during the drill. The partial use of the SCBA did not expose the fire brigade personr.el to the stresses and limitations created by its full use. The team concluded that the importance of the full use of the SCBA was not recognized. This has been identified as a failure to perform fire brigade drill in accordance with the requirements of the approved fire protection progrrm and Appendix R. This has been identified as an unresolved item (see Section F3.3).
On the basis of a review of the PSL Fire Protection Plan and its referenced procedures, the team determined that no specific criteria or guidelines had been established for determining when either the plant fire protection or the post-fire safe-shutdown features are inoperable or outside i
their design basis. In addition, the plan does not establish controls that govem the operability or availability of post-fire safe-shutdown equipment such that power operations can be conducted l
with the assurance that a train of systems needed for safe-shutdown will be free of fire damage,
{
or when conditions of inoperability exist, the plan does not ensure that appropriate measures l
l have been established to compensate for the post ' ire safe-shutdown system deficiency. The fire protection plan failed to address Appendix R post-fire safe-shutdown capability and govem its operability. This has been identified as an unresolved item (see Section F5.1).
On the basis of a review of the PSL Fire Protection Plan and the licensee's identified j
weaknesses associated with the SSA and its translation into post-fire safe-shutdown procedures l
and operator actions, it was not clear who was fundamentally responsible for overall compliance with fire protection requirements. This lack of program ownership was viewed by the inspection team as a significant contributor to the fire protection and post-fire safe-shutdown program weaknesses identified by the PSL reevaluation (see Section F6.2).
The Quality Assurance Department at PSL has been conducting detailed, critical, and insightful quality assurance audits in the fire protection and post-fire safe-shutdown areas. On the basis of Nuclear Quality Assurance Report 98-0141, PSL mad 3 a change to its procedures to ensure proper characterization of probier' s (as findings rather than technical recommendations) and automatic entry of those probierr.s into a system structured to result in timely corrective action.
5 The inspection team recognized that the effort of the PSL Quality Assurance Department since 1995, to identify problems in the fire protection / post-fire safe-shutdown area is a notable strength. However, this strength has been diminished by slow corrective action on the part of the PSL Engineering Department. Failure to conduct timely corrective actions for identified post-fire safe-shutdown procedural deficiencies has been identified as an unresolved item (see Section F6.3).
The lack of onsite Appendix R fire protection engineering expertise in the PSL Engineering Department has become apparent to the team. This was supported by the identified concems in the modification review process to focus on maintaining the post-fire safe shutdown design. This was identified as an area where further program performance improvements could be made (see Section F6.4).
j i
Section Ill.L of Appendix R to 10 CFR Part 50 states that support functions shall be capable of providing the process cooling necessary to permit the operation of equipment used for safe-shutdown functions and that attemative shutdown capability shall accommodate post-fire l
l conditions when offsite power is and is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Not including heating, ventilation, and air conditioning for the hot-shutdown control panel room represents a lack of incorporation of Appendix R fire effects in the safe-shutdown required analyses This is an example of a failure of the fire protection program and post-fire safe shutdown analysis to i
demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.1).
~
For the sample of circuits selected by the team for review during the inspection, the FPFI team found that the level of protection provided for redundant trains of post-fire shutdown systems did not satisfy the technical requirements of Sections Ill.G and Ill.L of Appendix R to 10 CFR Part 50.
Specifically, a fire in Fire Zones 57 (the cable spreading room), 70 (control room), 55W, or 27 may initiate spurious valve operations that could adversely affect the post fire safe-shutdown capability. The FPL/PSL safe-shutdown reevaluation has identified instances in which equipment relied on to achieve and maintain safe-shutdown conditions may not have been capable of
(
performing its intended post-fire safe-shutdown function due to (1) inadequate fire protection (charging pump 1 A, and lack of radiant energy shields in containment), (2) inadequate separation distances (cables in containment), or (3) SSA deficiencies (Fire Area J and the effect of fire on non-credited equipment). This is another example of a failure of the fire protection program and post-fire nafe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as are unresolved item (see Section F7.1.2).
On the basis of a sample of circuits, the team concluded that the FPL evaluation of circuit breaker, relay, and fuse coordination for low-impedance faults satisfied Section lil.G of Appendix R to 10 CFR Part 50. However, the licensee had not developed a controlled procedure to govem the replacement of fuses. Additionally, the licensee's reliance on generic procedural guidance that directed operators to restore operability of power sources that may be lost as a result of fire-induced high-impedance faults did not satisfy Section Ill.G of Appendix R or the guidance contained in Generic Letter 86-10. In response to the team's findings regarding " time critical" attemative shutdown loads, the licensee has developed operator actions to prevent the loss of power sources whose operation is immediately required to support the accomplishment of attemative shutdown from outside the main control room. This is another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.5).
e 6
The licensee's analysis and method of protection for fire induced spurious equipment operations does not satisfy 10 CFR Part 50, Appendix R, Section Ill.G or Ill.L. Spec.fic deficiencies include (1) an analysis methodology that assumed only one spurious operation would occur as a result of fire in any area without any further consideration of the number, type, or specific location of potentially affected cables and circuits; (2) a potential for fire to cause a breach of pressurizer power-operated relief valve and reactor coolant system gas vent system high/ low-pressure interface boundaries; (3) lack of an analysis of the effect of fire on instrument sense lines; and (4) inadequate evaluation of the potential for fire to cause damage to motor-operated valves relied on to accomplish post-fire safe-shutdown functions as described in information Notice 92-18. These are additional examples of failures of the fire protection program and post fire safe j
shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.5).
l Post-fire safe-shutdown procedures 1-ONOP-100.01 and 1-ONOP-100.02 exhibited omissions in i
that they did not properly address isolation of the main feedwater system and its regulating valves, the main steam bypass valves, and the reactor head vent valves. This was identified as an area where procedure enhancements could decrease the likelihood that fire induced electrical failures could affect shutdown implementation (see Section F7.2.1).
I FPL Thermo-Lag fire testing demonstrated that the upgraded fire wall would provide a fire-resistive rating 3r 1-hour and 48 minutes. However, this qualification rating may be questionable considering the failed hose stream testing. The FPL engineering evaluation of the l
cable loft wall could not adequately demonstrate to the team that it could protect one train of I
post-fire safe-shutdown capability and keep it free from fire damage. In the case of the Unit 1 cable loft, the evaluation was further weakened by the lack of any automatic fire suppression.
This issue was considered significant since the Thermo-Lag fire wall was not designed or rated t
to bound the in situ fire loading and the lack of diverse fire protection (i.e., no automatic sprinklers installed in the area). These fire barriers walls are not qualified to meet the plant's licensing basis and the requirements. This has been identified as an unresolved item (see Section F7.3.1).
FPL's identification of detection system design errors and deficiencies was appropriate. Before l
this identification was made, the team noted numerous missed opportunities (e.g., main control room ceiling tiles, annunciator level) to recognize problems associated with the detection system.
In addition, it was not clear that the licensee has demone' rated that the system @ sign l
deficiencies will not have an impact on the system's defense-in-depth ability to rapidly detet a fire. This is an example of design condition where a fire mitigation system design does not meet plant licensing basis requirements or commitments to minimum industry codes and standards and is identified as an unresolved item (see Section F7.4.1).
FPL's procedures for testing the preaction sprinkler system's deluge valve do not meet the l
National Fire Protection Association Standard 25 or the vendor's requirements for testing the automatic water-based fire suppression systems. This is an example of a design condition where a fire mitigation system does not meet plant licensing basis requirements or commitments to minimum industry codes and standards for system testing. This has been identified as an unresolved item (see Section F7.4.3).
The results of the licensee's recent self-assessment identified problems with the Unit 1 cable spreading room Halon 1301 system. However, the question of the minimum required concentration and the minimum soak time has not been addressed by the licensee. The licensee
e 7
considers the system to be " operable;" however, the licensee could not produce design-basis tests for the concentrations and soak times of the system, nor could it demonstrate operability to the inspectors. This issue was considered significant since the system was not designed to extinguish the expected hazard (i.e., a " deep-seated" cable fire). This is another example of a design condition where a fire mitigation system design does not meet plant licensing basis requirements or commitments to minimum industry codes and standards and has been identified as an unresolved item (see Section F7.4.4).
Problems were discovered by FPL with the standpipe and hose stations. All areas of the plant are required to have a minimum of two hose stations accessible to them. These problems have s
not been addressed by the licensee and was considered significant since the " primary protection" hose stations have been determined to possess certain design weaknesses. This issue brings into question the ability of the " backup" hose station (i.e., second hose station) to provide adequate coverage. This is another example of a condition where a fire mitigation system design i
does not meet plant licensing basis requirements or commitments to minimum industry codes l
and standards. This has been identified as an unresolved item (see Section F7.4.5).
l l
The licensee found that the oil collection system for the reactor coolant pumps was not catching and collecting oilleaking from the reactor coolant pump motor's lubrication system as required by 10 CFR Part 50, Appendix R, Section Ill.O. This is another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.4.7).
As part of its ongoing safe-shutdown analysis revalidation effort, FPL has identified deficiencies l
in Appendix R emergency lighting and the post-fire safe-shutdown communications system. This is identified as another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.5).
As result of the fire protection program and post-fire safe shutdown discrepancies identified by the FPL re-evaluation program, FPL established compensatory measures in the Reactor Auxiliary Building (RAB). A 30-minute roving fire watch patrol was established throughout the RAB. At the time of this inspection, the licensee was in the analysis and discovery mode of its l
re-evaluation and had not fully determined the scnoe of the corrective actions needed to resolve the fire protection program and post-fire safe shutdown discrepancies. The compensatory measures and thei:.idequacy to compensate for the known program discrepancies will be routinely reviewed by the licensee and revised as necessary to assure an adequate level of fire safety is being maintained.
In response to the fire protection issues or concems arising from this inspection and FPL's re-assessment program, the licensee implemented compensatory measures in addition to those that it had established prior to the FPFl. The purpose of the compensatory measures was to further reduce the likelihood of potential fire hazard conditions and to provide reasonable assurance that prompt fire mitigation measures could be taken in the event of a fire. On the basis of all the fire protection issues, the licensee implemented the following additional compensatory measures for the Unit 1 "A" cable loft penetration room:
I
v e
8
- 1. Fire doors for the "A" cable loft penetration room extension were closed.
- 2. Direction was given to PSL Construction Depadment to halt further removal of Thermo Lag I
panels pending approval by the Engineering Department.
3 Fire Protection and Operations directed that no new fire breach impairments be implemented without engineering approval.
- 4. FPL temporarily installed additional firefighting equipment at strategic locations to enhance firefighting capabilities for the cable loft.
- 5. PSL Engineering Department provided a drawing depicting Thermo-Lag fire barriers and gave the location of supplemental firefighting equipment to the Nuclear Plant Supervisor to enhance fire brigade awareness.
- 6. A continuous roving fire watch will be established in the area where work is being performed.
- 7. Fire barrier breach permits have been placed under control of the Engineering Department.
The team concluded that these additional cornpensatory actions, in addition to those FPL had implemented prior to the FPFI, were adequate and provide the assurance needed to further reduce the likelihood that a potential fire hazard conditions will exist or that prompt fire mitigation measures could be taken in the event a fire were to occur in the various RAB fire areas of concem.
i i
_ _ _ _ _ - _ - - - _ _ _ - _ _ _ _ _ _ _ _ _ _ - - _ _ _ - _ _ _ _ -