ML20248M142

Draft NRC Insp Manual Temporary Instruction 2515/XXX Fire Protection Functional Insp (Fpfi)

ML20248M142
Person / Time
Site:	Prairie Island
Issue date:	04/06/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20248L358	List: ML20248L357 ML20248M142
References
PROC-980406, SECY-96-267-C, NUDOCS 9806150066
Download: ML20248M142 (105)

Text

!- 4

[

[Akhsove 2 DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6. 1998 NRC INSPECTION MANUAL SPLB TEMPORARY INST RUCTION 2515/XXX FIRE PROTECTION FUNCTIONAL INSPECTION (FPFI)

SALP FUNCTIONAL AREA: PLANT SUPPORT (SOPLTSUP) 2515/###-01 OBJECTIVES 01.01 The primary objectives of a Fire Protection Functional Inspection (FPFI) are to assess the capability of the licensee's fire protection programs or fire protection plan to:

a. Prevent fires from starting, ,

b. Detect, rapidly control, and promptly extinguish fires that do occur,

c. Ensure that fires will not prevent essential plant functions from being performed (e.g., achieve and maintain post-fire safe shutdown),

d. Conduct effective post-fire safe shutdown and fire protection program configuration management activities. j 01.02 Secondary objectives of an FPFI are to assess the potentialfor and the likely effects of:

a. Event initiated fires,

b. Fire induced reactor transients,

c. Seismic fire interaction,

d. Fire induced release of radioactive materials.

9806150066 930604 e l PDn a ADOCK O N l van y$  !

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 2515/###-02 BACKGROUND During the 1980s, the U.S. Nuclear Regulatory Commission (NRC) staff inspected certain aspects of reactor fire protection programs using IP 64100, "Postfire Safe Shutdown, Emergency Lighting and Oil Collection Capability at Operating and Near-Term Operating Reactor Facilities." These inspections are commonly called the original " Appendix R" inspections. Since the 1980s, the regional offices have used IP 64704, " Fire Protection Program,"to conduct 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> of fire protection and fire prevention capabilities inspection at each plant every other SALP cycle. IP 64150, " Triennial Postfire Safe Shutdown Capability Reverification," was issued in 1987. However, such inspections have usually not been conducted due to NRC staff resource constraints.

To resolve Thermo-Lag fire barrier issues, many licensees reassessed their fire protection programs to eliminate as much as possible the need for fire barriers. Typical outcomes of these reassessment programs included redefined fire area boundaries, new or relocated safe shutdown components, and new operator actions and procedures. Many licensees also performed evaluations to justify either eliminating certain Thermo-Lag barriers or keeping them as they were (i.e., without upgrades), in some cases, the licensees used such evaluations to justify exemptions from the NRC fire protection regulations. In its response to the Thermo-Lag experience, the NRC staff reassessed the NRC reactor fire protection program and decided to (1) develop a coordinated approach for the fire protection and systems inspections and (2) reevaluate the scope of the fire protection inspection program. To do so, the staff considered fire events, licensee reports of deficiencies, previous NRC inspection findings, the scope and adequacy of the existing NRC fire protection inspection program, and the need to inspect other plant fire protection features in response to ongoing NRC programs (e.g., Thermo-Lag fire barriers, self-induced station blackout, fire barrier penetration seals, turbine building assessments, and individual plant evaluations of external events). The staff concluded that additional fire protection inspection effort was warranted and initiated the Fire Protection Functional Inspection (FPFI) program.

The principalfocus of the inspectionswill be on the plant fire protection and post-fire safe shutdown design and licensing bases and those fire protection program elements that are covered by existing NRC regulations and guidelines. These include, for example, safe shutdown performance objectives, safe shutdown systems and equipment, fire protection i systems and barriers, emergency lighting, reactor coolant pump oil collection systems,

quality control and quality assurance, configuration control including change control process, administrativecontrols and procedures,and training. These aspects of the FPFI program will satisfy the program objective of ensuring continued licensee compliance with NRC fire protection regulations and commitments. In addition, the pilot inspections will 1

l l

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6. 1998 include a review of fire safety considerations that are not expressly addressed by the fire protection regulation, but by other regulatory programs. This includes, principally,'the Individual Plant Examinations of External Events (IPEEE) for severe accident vulnerabilities. Such inspection areas include, for example, event initiated fires, fire .

induced reactor transients, and potential seismic fire interactions. This feature of the FPFI program will provide usefulinformation regarding broader aspects of nuclear power plant fire safety. The staff will use this information to identify the strengths and weaknesses of the overall NRC reactor fire protection program and to develop and support L recommendations for program improvement, where appropriate.

The staff will use risk insights to help focus the FPFis on those areas most important to safety. This includes, for example:

e Assessing the capability of fire protection features, administrative controls, systems, equipment, personnel, and procedures to mitigate the adverse effects of fires on structures, systems and components important to safety; e Evaluating the capabilityto achieve and maintain safe shutdown conditions during and after a fire; e Evaluating how the defense-in-depth principles were applied to plant-specific configurationsand identify fire event sequences (vulnerabilities) of potentially high safety significance; and e Verifying that the fire protection plan conforms to the NRC-approved licensing and design basis, and that suitable design controls are in place to ensure that the approved configuration is maintained over the life of the plant.

The FPFI uses a multWisciplined team of inspectors including a fire protection engineer, an electrical systems engineer, a reactor systems / mechanical systems engineer, a probabilistic risk assessment (PRA) analyst, and regional inspectors, each having experience in one or more of the following disciplines: fire protection; fire-risk assessment plant operations; design and operation of normal and emergency plant shutdown systems; post-fire attemative and dedicated shutdown methodologies; abnormal and emergency

. operating procedures; fire response procedures; electrical distribution system design; instrumentation and control; quality assurance; and configuration control.

2515/W##-03 INSPECTION REQUIREMENTS 03.01 FPFI inspection Requirements Overview 3-1

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

a. Fire Protection Program

1. Fire Protection Program Administration (a) Licensing and Design Bases (b) Organization and Management Oversight (c) Fire Protection Procedures (d) Administrative Controls (e) General Employee and Fire Watch Training (f) Fire Brigade and Fire Response

1. Fire Brigade Composition, Notification and Availability, and Shift Staffing for Fire Events

2. Fire Brigade Training and Equipment

3. Offsite Agreements .,

2. Fire Protection Systems and Features  ;

(a) Licensing and Design Bases (b) Fire Detection and Alarm Systems (c) Fixed and Automatic Fire Suppression Equipment and Systems (d) Manual Fire Suppression Equipment and Systems (e) Fire Barriers (f) Reactor Coolant Pump Oil Collection Systems

3. Post-fire Safe Shutdown Capability

. _ _L . . . , -. .. ,, ,, .

.j

i I

i DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 (a) Licensing and Design Bases

. (b) Fire Hazards Analysis

- (c) Safe Shutdown Analysis (d) Post-fire Safe Shutdown Areas and Systems Selection (e) Hot and Cold Shutdown Procedures and Equipment, Cold Shutdown Repairs, and Shutdown Safety (f) Electrical System Protection

1. Power, Control and Indication Cable Separation and Protection

2. Attemative/DedicatedSafe Shutdown Panel Electrical Independence and Isolation

3. Associated Circuits Analyses j (g) Post-fire Safe Shutdown Capability implementation

1. Methods of Redundant Train and Altemative/ Dedicated Safe Shutdown implementation

2. Electrical Loads Management

3. Human Factors and Manning

4. Control System Interactions / Control Location Transfers

b. Fire Protection and Post-fire Safe Shutdown Program Management and Configuration Control

1. Fire Protection and Post-fire Safe Shutdown Management Processes (a) Quality Assurance / Quality Control Audits (b) Surveillance Testing and Maintenance Program o__---_--.--__.__=.____ _ _____-_-_:

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6. 1998 (c) Operability Assessments and Compensatory Measures

2. Fire Protection and Post-fire Safe Shutdown Configuration Control (a) 50.59 Process (b) Design Reviews and Modification Packages (c) Review Committee Actions (d) FSAR Updates

c. Potential Fire Related Vulnerabilities

1. Event Based Fires

2. Fire Induced Plant Transients

3. Seismic / Fire Interactions

4. Fire Induced Release of Radioactive Materials 03.02 FPFI Inspection Requirements

a. Fire Protection Program Administration. Inspection requirements for this topical area are located in Appendix A.

b. Fire Protection Systems and Features. Inspection requirementsfor this topical area are located in Appendix B.

c. Post-fire Safe Shutdown Capability. Inspection requirements for this topical area are located in Appendix C.

d. Fire Protection and Post-fire Safe Shutdown Program Management Process.

Inspection requirements for this topical area are located in Appendix D. 1

e. Fire Protection and Post-fire Safe Shutdown Configuration Control. Inspection l

requirements for this topical area are located in Appendix E.  !

f. Potential Fire Related Vulnerabilities. Inspection requirements for this topical area 6-1

1 DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

are located in Appendix F.

2515/###-04 GUIDANCE 04.01 General Guidance

a. The inspection conduct process is detailed in Appendix H.

b. The inspection will be guided by the results of the analysis of available PRA information conducted prior to the inspection. This analysis will develop risk sensitive systems, locations, and scenarios for the subject reactor plant.

04.02 Specific Guidance

a. Insoection Requirement Aooendix A. 6. (a)

1. Section 50.54(m) of 10 CFR Part 50 addresses minimum staffing levels of licensed personnel, but does not address minimum personnel availability during reactor events.

2. Generic Letter (GL) 77-02," Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," addressed plant fire brigade positions by providing guidance supplemental to Appendix A to Branch Technical Position 9.5-1 (sections A.1, B and C) and Regulatory Guide (RG) 1.120 (Sections C.1, C.2 and C.3). The supplementalinformation provided in GL 77-02 was that:

• Fire brigade positions should be responsible for fighting fires. The authority and responsibility of each fire brigade position relative to fire protection should be clearly defined.

• These responsibilities of each fire brigade position should correspond with the actions required by the fire fighting procedures.

• The responsibilities of the fire brigade members under normal plant conditions should not conflict with their responsibilities during a fire emergency.

• The minimum number of trained fire brigade members available onsite for each operating shift should be consistent with the activities required to o

DRAFT FOR PRAIRIE ISt.AND INSPECTION April 6, 1998 combatthe most significantfire. The siza of the fire brigade should be based -

upon the functions required to fight fires with adequate allowance for injuries.

e NFPA 600 (formerly NFPA 27) and the publications it references provide appropriate criteria for organizing, training and operating a plant fire brigade.

3. Section H, " Fire Brigade," of Appendix R to 10 CFR Part 50, (not backfit to plants licensed prior to January 1,1979,'to the extent that fire protection features proposed or implemented by the licensee had been accepted by the -

staff), contained the following requirements:

i

• Adequate manual fire fighting capability shall be provided.

e The fire brigade shall be at least 5 members on each shift e ' The shift supervisor shall not be a member of the fire brigade.

Appendix R was silent on conflicting duties of fire brigade members other than the shift supervisor. Reactors not subject to Appendix R received licensing reviews against similar criteria.

l

4. NRC Information Notice (IN) 91-77, " Shift Staffing at Nuclear Power Plants,"

addressed adequate shift staffing following any event (not necessarily a fire).

IN 91-77 stated that:

l The number of staff on each shift is expected to be sufficient to accomplish all necessary actions to ensure a safe shutdown of the reactor following an event. Those actions include implementing emergency operating

- procedures, performing required notifications, establishing and maintaining communications with the NRC and plant management, and any additional duties assigned by the licensee's administrative controls.

5. An August 30, 1991, memorandum from William T. Russell, Associate Director for inspection and Technical Assessment, Office of Nuclear Reactor Regulation (NRR), to Thomas T. Martin, Regional Administrator, Region I, reiterated the above IN 91-77 guidance ' and . provided the following amplification regarding event response:

4 Licensees should document actual staffing needs in administrative

~

procedures based on plant specific analyses to account for potential m

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 emergency situation at any time, including the backshift... the staff considers those licensee's practice of using the STA (Shift Technical Advisor) to man the fire brigade or to provide support for other special occurrences to degrade the licensee's ability to adequately respond to an event.

6. IN 95-48,"Results of Shift Staffing Study," provided licensees with findings 4 resulting from extensive interviews with site personnel. Licensees were asked to consider these insights when considering their capabilities to accomplish safety functions following an event.

{

7. It should be noted that the NRC does not require dedicated fire brigades (fire fighting personnel who have no event related operational responsibilities).

However, licensees are responsible for establishing controls to ensure shift staffing is sufficient to accomplish all necessary functions required by an event.

b. Insoection Requirement Aooendix B Section 3.8.1 of GL 86-10 discusses the applicability of NFPA codes.

I

c. Insoection Requirement Anoendix B. 5. Fire barriers include penetration seals, wraps, walls, structural member fire resistance, doors, dampers, etc. Fire barriers are used to prevent the spread of fire and to protect redundant safe shutdown equipment. Laboratory testing of fire barrier materials is done only on a limited range of test assemblies. However, in-plant installations can vary from the tested configurations. Under the provisions of GL 86-10, licensees are permitted to develop engineering evaluations justifying such deviations. In-plant fire barrier installations should reviewed to establish that they represert reasonable variations l

of tested configurations. (Appendix G provides staff positions on fire endurance rating tests.) Problems with the qualification of fire barrier materials include: in-complete or indeterminate fire test results; questionable cable wrap ampacity derating test results; a wide range of documented ampacity derating factors for the same material; barriers not installed in accordance with vendor-recommended installation procedures; incomplete installation procedures; and as-built fire barrier configurations that may not have been qualified by valid fire endurance tests or ,

evaluated in accordance with guidance of GL 86-10. l 1

The results of this inspection should confirm that the licensee has established an acceptable design basis for fire barriers used to separate safe shutdown functions DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998' within the same fire area. The inspectors should be able to draw conclusions regarding:

e o The ability of fire' barriers to perform their specified fire resistive function and provide an adequate level of fire safety to electrical components; e The adequacy of the electrical design with respect.to ampacity derating of cables protected by fire barrier systems; e The potential for fire barrier system weight to affect raceway response to a seismic event; e The degree to which the design basis for fire barriers, the drawings, specifications, calculations, fire test documentation and, installation procedures are consistent, technically adequate, reflect a conservative approach that provide an adequate margin of fire safety, and reflect"as-built" plant conditions; e The degree to which .the "as-built" fire barrier configurations have been constructed and installed in accordance with the basis established by the fire endurance qualification testing documentation and the completeness of the licensee's engineering evaluations of fire barrier conditions that vary from the tested configurations; e The degree to which fire barrier configurations comply with regulatory requirements and licensing commitments. ,

d. Insoection Requirement Anoendix B. 5. The following types of documents associated with the use of fire barriers to protect the safe shutdown capability and the fire barrier installations should be available on-site for review by the inspectors:

e Lists of raceways, components,and. equipment protected by fire barriers within the same fire area. The lists should identify type of cables and percent cable fill, raceway material and dimensions, location in the plant, and safe shutdown function protected.

• Procurement, receipt inspection, and material storage specifications and procedures.

e . Procurement and receipt inspection records for fire barrier materials.

L l

i i

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 o Fire endurance and ampacity derating test reports.

• Design details and criteria.

• Fire barrier design specifications and design drawings.

• Engineering evaluations for fire barrier configurations that deviate from tested configurations.

e Installation specifications and procedures.

e QA and QC inspection and audit procedures e QA and QC installation records e QA records associated with the installation process e Course outline, lesson plans, and training records for installer training, and installer training records e Seismic analyses for raceway systems protected by fire barrier materials e Ampacity derating test reports and calculations for cables enclosed in fire barriers

e. Insoection Requirement Anoendix B. 5. (a) 7. GL 86-10, and Enclosure 1 to GL 86-10, Supplement 1, provide detailed guidance on fire endurance test methods and acceptance criteria. GL 86-10, Supplement 1, also provides detailed guidance on acceptable methods for determining cable functionality after fire tests.

f. Insoection Requirement Anoendix B. 5. (b) 5. In July,1996, the staff published NUREG-1552 " Fire Barrier Penetration Seals in Nuclear Power Plants." The inspectorshould read this documentin detail. The staff made the following salient points and conclusions:

e - The general condition of penetration seal programs in the nuclear industry was satisfactory. Industry awareness had resulted in more thorough surveillance, maintenance and corrective actions. No safety significant problems or potentially generic problems were found.

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 e The ability of a particular penetration seal design to achieve a specific fire rating is configuration dependent.

• Fire endurance tests have established the fire-resistive capabilities of the penetration seal materials, designs and configurations typically installed in nuclear power plants. (Question 3.2.2 of " Appendix R Questions and Answers", Enclosure 2 to GL 86-10 addressed deviations from tested configurations.)

• NRC fire protection regulations do not cover either fire endurance testing or fire test laboratories. There is no regulatory requirement that fire tests be conducted by a nationally recognized testing laboratory.

• Historically, during licensing reviews, the staff had accepted the use of fire barriers without reviewing the fire test results if the barriers were tested and approved by UL (Underwriter'slaboratory)or FM (Factory Mutual). The staff had also accepted barriers that were tested by organizations other than UL and FM. In such cases, the staff may have reviewed the fire test results.

• Proper installation, surveillance, maintenance and repair are important to the ability of penetration seals to perform their intended fire protection design function. Potential problems include:

e incomplete or inadequate fire test documentation.

e in-plant penetration seal configurations not bounded by fire tests, l

e Seals not installed where required.

e Seals not installed properly.

• Seals not repaired or not repaired properly.

• Seals modified without a supporting engineering evaluation.

. Seals not inspected in accordance with plant surveillance procedures.

g. Insoection Requirement Anoendix B. 5. (b) 6. IN 94-58, " Reactor Coolant Pump Lube Oil Fire," discussed a Haddam Neck reactor coolant pump (RCP) lube oil fire event and a Millstone Unit 2 RCP lube oil leak which was not collected by the oil 1

L

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 collection system. Approved exemptions in this technical area almost exclusively deal with collection tank capacity (sizirig for complete leakage from one RCP, with (Iow probability) multiple RCP leakage overflow going to a non-hazardous location in containment).

h. jpsoection Requirement Anoendix C. 4. The FSAR,50.59 analyses, Section 7.4,

" Safe Shutdown Systems," of the SRP, licensee submittals and safety evaluations provide important information regarding the purposes and capabilities of specific plant systems.

i, insoection Requirement Anoendix C. 7. In May 1992, Section 6.10 of NUREG 1449," Shutdown and Low-Power Operation at Commercial Nuclear Power Plants  ;

in the United States," described typical licensee practices with regard to fire I protection during shutdown and refueling. This section concluded that (for the limited number of reactor sites visited):

e A postulated fire could potentially damage the operable train or trains of decay heat removal systems during shutdown conditions, e increased transient combustibles and ignition sources during outage activities present additional fire risks, e Fire prevention administrative control procedures did not provide enhanced controls or comoensato'y measures during shutc'own conditions in those plant areas critical to supporting RCS makeup and decay heat removal, and e A majority of the fires at the facilities occurred during refueling outages.

J. Insoection Requirement Anoendix C. 8 (a) 4. Ampacity can be defined as the current in amperes that a conductor can carry continuously under the conditions of use without exceeding its temperature rating. Cables enclosed in electrical raceways protected with fire barrier materials are derated (as to the current they should carry) because of the insulating effect of the fire barrier material. Other factors that affect ampacity include cable fill, cable loading, cable type, raceway

. construction, and ambient temperature. The National Electrical Code, insulated Cable Engineers Association publications, and other industry standards provide 9eneral ampacity derating factors, but do not include derating factors for fire barrier systems. Although a national standard ampacity derating test method has not been established,' ampacity derating factors for raceways enclosed with fire barrier material have been determined for specific installation configurations by testing.

L L

I f

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 Most cables used in nuclear power plant electrical systems are rated for 40 years of life at a continuous conductor temperature of 90 *C. Cables that have continuous conductor temperatures 10 over this temperature rating will have half the rated life (20 years). Cable insulation will begin to degrade (embrittle or melt)  !

as higher conductor temperatures are encountered. Cracking in cable insiilation due to long-term degradation can lead to conductor-to-conductor arcing, and eventually a fire.

Inspectors should verify that ampacity test rerAts are reasonable and represent good engineering practices. For example, power cables supplying current to a motor-operated valve (MOV) would be energized for short and infrequent durations.

An assessment of the worst case (continuously energized, high ambient temperature) ampacity derating factor for the installed fire barrier configuration, based upon eithertest results or bounding analysis,would represent a conservative determination of current carrying capacity degradation.

Ampacity derating tests are conducted according to IEEE standards and include the testing of cables in various configurations (conduits and cable trays). Test samples (cables) are broughtto a steady state conductor temperature of 90 *C and current flow through the conductors is recorded. The cables are then enclosed in a fire barrier system, and the configuration is once again brought to a steady state conductortemperature of 90 *C. The currentis recorded and then compared to the current recorded without the barrier ,ystem in place. The difference between these two recorded currents is the ders, ting factor that must be used for this barrier configuration.

The general industry practices for ampacity derating tests should be observed.

Institute of Electrical and Electronic Engineers (IEEE) Standard 848-1996,

" Procedure for the Determination of the Ampacity Derating of Fire Protected Cables," issued on December 6,1996, was the latest industry document on this subject as of the date of this procedure.

Thermo-Lag specific ampacity derating background information is contained in i Appendix K.  !

k. Insoection Requirement Aooendix C. 8. (d) 3. (d) IN 92-18, Question 5.3.10 of i GL 86-10, and Director, NRR letter to the Nuclear Energy Institute dated March 11, 1997, (Collins to Beedle) provide background information on spurious signals. Note that the allowance to address each non-high/ low pressure interface spurious actuation or signal resulting from a fire individually (one at a time) is limited to the DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 engineering process of specifying design capacity and capability of the altemative or dedicated shutdown system. That is, during an attemative post-fire safe shutdown, can the licensee overcome any one fire induced failure with pump or tank size, identification of attemative flowpaths, specific manual actions, or combinations -

thereof? Outside of the engineering design process, multiple, simultaneousfailures from hot shorts caused by a postulated fire can be considered by the inspector.

l. Insoection Requirement Anoendix C. 9. (a) 1. By definition, redundant (normal shutdown) train post-fire safe shutdown procedures should be identical to normal plant shutdown procedures. However, when fire zones exist (without floor to ceiling walls for separation of zones), such that heat and combustion products could affect access into adjacent zones, the inspector may determine that a walk-through simulation of a redundanttrain (normal shutdown equipment) shutdown should be observed.

m. Insoection Requirement Anoendix C. 9. (a) 2. Assign spcific sections of the shutdown procedure to participating team members. The procedure walk-through should be carried out to the point where the plant operating staff have demonstrated that a stable controlled cooldown has been established.

in a memorandum of June 15,1990, to Region IV, NRR stated that the agency position on testing of remote shutdown panels was to require no testing on plants licensed before 1979, and to require a one time test for plants licensed after January 1979 (see Regulatory Guide 1.68.2). The expectation (not requirement) was that licensees would periodically walk through the procedures for remote shutdown. The memorandum stated that NRR encourages inspectors from time to time to ask licensees to conduct walk-through simulations of its remote shutdown procedures, particularlyin cases where it is obvious that a licensee is not doing so under its own initiative. GL 81-12 (and a clarification containing a rewrite of the request for additional information in the original February 20,1981, GL 81-12) discussed important alternative safe shutdown system design issues which the inspector can review in advance and consider during the alternative safe shutdown walkdown.

The scope of 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," included remote post-fire safe shutdown panels and control stations. Regulatory Guide 1.160 and NUMARC 93-01 provided implementation guidance for 10 CFR 50.65.

n. Insoection Requirement Anoendix C. 9. (b) 1. -Several U.S reactor plants have altemative post-fire safe shutdown methodologies which may result in loss of all L

DRAFT - FOR PRAIRIE ISl_AND INSPECTION April 6,1998 A.C. power (station blackout). Some of these voluntarilyenter station blackoeL The remainder appear to have procedures which may cause a SBO condition to be created as a result of fire effects (such as procedures which direct operators to manually trip the credited emergency diesel generator (EDG) in the event of fire damage to circuits of vital EDG support systems).

o. Insoection Requirement Anoendix D. 3. GL 91-18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability,"contains specific guidance regarding operability and the resolution of degraded and nonconforming conditions.

p. Inspection Requirement Anoendix E.1. NRC inspection Manual, Part 9900,"10 CFR 50.59, interim Guidance on the Requirements Related to Changes to Facilities, Procedures and Tests (or Experiment)," addresses NRC Inspection Manual, Part 9900, "10 CFR 50.59, . Changes to Facilities, Procedures and Tests (or i Experiments). 'Although this interim guidance does not represent a change in policy, it does clarify the scope covered by 50.59 and the thresholds for determining if an Unreviewed Safety Question (USQ) exists.

NRC Inspection Manual Chapter 37000, " Design Changes t.nd Modifications,"

provides further guidance to the inspector regarding 10 CFR 50.59.

SECY-97-035(dated February 12,1997) proposed regulatory guidance related to the implementation of 10 CFR 50.59 (Changes, Tests and Experiments). This document and its Attachment 1 (" Proposed Regulatory Guidance Related to implementation of 10 CFR 50.59") provide regulatory positions on a number of issues related to the implementation of 10 CFR 50.59.

, q. JnsoectionReauirementAnoendixF GeneralDesign Criterion (GDC)3 of Appendix A to 10 CFR Part 50 states that structures, systems and components (SSCs) of water cooled nuclear power plants important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effects of fires and explosions. Therefore, inspector review of potential, non-post-fire safe shutdown related, fire vulnerabilitiesdo not fall outside the scope of NRC regulatory programs and safety responsibilities. There are four categories of potential fire L'

related vulnerabilities:

e Evaluation of the potential for mechanical failure events to cause a fire, rad evaluation of the capability of the licensee to suppress the fire and cop with (non-transient) fire effects such as heat, smoke and suppression runoff,

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 e Evaluation of the potential for postulated fires to cause plant transients, and evaluation of the capability of the licensee to both suppress the fire and control the reactor plant, o Evaluation of the potential for the occurrence of seismic / fire interactions, and o Evaluation of the potential for fire induced release of radioactive materials.

r. Insoection Requirement Anoendix F 1. Event based fires are caused by equipment malfunctions or failures. These failures may result in an unanticipated sequence of events that initiates a fire, which in turn may also result in a degradation of plant safety and challenge the reactor plant's fire barriers and smoke, heat and suppression agent control features, and the licensee's fire fighting.

s. Insoection Requirement Anoendix F. 2. Fire-induced plant transients are defined as plant transients (e.g., inadvertent safety injection actuation, loss of off site power, over cooling and over and subsequent over filling of steam generators, spurious closure of containment isolation valves, significant loss of safety systems, station blackout, rapid cooldown) that initiate as a result of fire-induced circuit failures such as hot shorts, shorts to ground, or open circuits.

t. Insoection Requirement Anoendix F. 3. Seismic damage is generally caused by movement or falling debris. Section 7 of GL 86-10 is a dis.:ussion of fire protection and seismic events. The Sandia Laboratories Fire Risk Scoping Study (NUREGER 5088) and RG 1.29 address seismic damage. Fire suppression and detection systems are typically not qualified to the same level of seismic protection as safety related equipment. Fire protection systems must meet the design guidelines stated in paragraph C. 2. of RG 1.29.

u. Inspection Requirement Anoendix F. 3. (b) Carbon dioxide is approximately seven times heavier than air. In some suppression system designs, one large low pressme tank of carbon dioxide is fed through timer pilot valves to a number of rooms in various fire areas. Seismic damage could cause the inadvertent release of much more than the intended volume of carbon dioxide. The resultant overpress'ure could damage fire doors, fire dampers and other fire barrier features.

v. Inspection Requirement Anoendix F. 4. Although there are no regulations addressing the spread due to fire of radioactive materials which apply to operating reactor plants, on July 29,1996, the NRC published an amendment to 10 CFR )

50.48 which required licensees who were terminating their licenses (and therefore l

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 undergoing' reactor' decommissioning) under 10 CFR 50.82 "to maintain a fire protection program for fires which could cause the release or spread of radioactive -

materials (i.e. which could result in a radiological hazard)." In May,1997 a draft RG (DRG-1069)for 10 CFR 50.48 (f) was being considered for issuance. The inspector should obtain a copy of the draft or final issue regulatory guide and review it as background information on radioactive material fire hazards and fire protection.

2515/###-05 REPORTING REQUIREMENTS l Inspection findings will be documented in a routine inspection report normally issued by NRC Headquarters.

2515/### INSPECTION RESOURCES 06.01 Team Comoositiort See Appendix G for a detailed discussion of team makeup and qualifications.

06.02 Insoection Duration. A complete FPFI team inspection will be comprised of three weeks of activity: one week onsite, one week of in-office review of findings, and a second week onsite. See Appendix H for a detailed discussion of the team inspection process .

from plant selection and inspection announcement to inspection report writing and inspection finding followup.

06.03 Insoection Schedule. The events expected to occur during the two onsite inspection weeks are discussed in Appendix H.

2515/###-07 COMPLETlON SCHEDULE Four pilot FPFI inspections are planned to be completed by summer,1998. Thereafter, at least four team inspections will be conducted each fiscal year.

2515/###-08 EXPIRATION This temporary instruction (TI) will remain in effect until the completion of the pilot FPFI inspection program.

2515/###-09 NRR TECHNICAL CONTACTS Any questions regarding this Tl should be addressed to Leon Whitney, (301) 415-3081, Pat

. Madden (301) 415-2854, or Steven West (301) 415-1220.

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 2515/###-10 STATISTICAL DATA REPORTING For RITS input, the actual inspection effort should be recorded against 2515/###. At regional management discretion, and with the concurrence of the Chief, Fire Protection Engineering Section, NRR, may take credit for completing appropriate core procedures on the basis of efforts expended under this TI.

2515/###-11 ORIGINATING ORGANIZATION / RESOURCES 11.01 Organizational Responsibilities. The Fire Protection Engineering Section, Plant Systems Branch, Division of Systems Safety and Analysis ( DSSA), NRR will manage the FPFI program.

11.02 Estimated ResouIcaa. The inspection process described in Appendix H will take 7 to 10 weeks (excluding inspection finding followup). With the exception of the PRA analyst, all team members will be involved for the entire duration of the inspection process.

Therefore, each inspection will require about 1,225 staff hours of effort (approximately 0.6 J FTE). For MIPS planning purposes,there will be about 350 hours0.00405 days <br />0.0972 hours <br />5.787037e-4 weeks <br />1.33175e-4 months <br /> of direct inspection effort (DIE) expended during the two onsite weeks (assuming no usage of contractor personnel).

2515/###-12 INSPECTION IMPLEMENTATION LATITUDE / CREDIT FOR SELF ASSESSMENT 12.01 Insoection Implementation Latitude i The expectation is that this inspection will be conducted at every site over the next 10 to 15 years.

On a case-by-case basis, an evaluation, that has been approved by the Chief, Fire Protection Engineering Section, NRR, and concurred in the by the Director, DSSA, NRR, may conclude that the inspection scope can be reduced. This option is envisioned for situations in which in-depth inspections have recently been performed in specific areas addressed by this Tl.

12.02 Self Assessment

a. Credit for Self Assessment. NUREG/BR-0195 is the NRC Enforcement Manual.

Section 8.1.7 of that document provides general policy on enforcement actions involving fire protection. NUREG 1600 is the NRC Enforcement Policy. Section Vil B. 3. of that document discusses licensee identified violations. Inspection Manual i

l

t I

l i

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 1

Chapter 0610, Section 05.02, provides guidance regarding violations identified as part oflicensee self assessments.

b. FPFI Use to Review Licensee Fire Protection Self Assessments. This Tl may be i

used to review licensee self assessments that are equivalent in whole or in part to FPFis. The results of such a review will be documented in a routine inspection report. Review inspection findings will be processed in the normal manner, but taking into account the self assessment credit guidance discussed in Section 12.02 a.above.

APPENDICES A. Fire Protection Program Administration Inspection Requirements B. Fire Protection Systems and Features Inspection Requirements C. Post-fire Safe Shutdown Capability Inspection Requirements  !

l D. Fire Protection and Post-fire Safe Shutdown Management Process inspection Requirements E. Fire Protection and Post-fire Safe Shutdown Configuration Control Inspection Requirements F. Potential Fire Related Vulnerabilities inspection Requirements G. Team Makeup and Qualifications H. Team inspection Process

1. PRA Process Technical Guidance l

J. Fire Protection Regulatory Background Information K. Thermo-Lag Ampacity Derating Background information I L. Staff Position on Fire Endurance Rating Tests  !

M. Fire Protection FunctionalInspection Assesment Tree Y 2M

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6. 1998 N. Definitions O. References END 1

l t

ht 1_

DRAFT - FOR PRAIRIE ISLAND INSPECTION- April 6, 1998 APPENDIX A i

FIRE PROTECTION PROGRAM ADMINISTRATION INSPECTION REQUIREMENTS

1. Licensing and Design Bases (licensing commitments, standards, technical specifications, exemptions, safety evaluations (SERs), FSAR, 50.59 evaluations)

2. Organization and Management Oversight

- (a) Organization and Operating Responsibilities (b) Management Review and Audit Responsibilities and Programs

.3. Fire Protection Procedures (a) Maintenance Procedures and Records

1. Review the extent of any backlog of fire protection system maintenance items, and the out-of-service duration of fire protection equipment.

2. Identify any spurious actuations of fire suppression systems and associated root cause analyses and long term corrective actions.

(b) Surveillance Procedures and Records Relating to Fire Protection Features.

(c) Fire Watch Procedures: Verify that fire watch procedures call for the establishment of fire watches for hot work and when fire protection equipment is declared inoperable.

4. ' Administrative Controls (a) Control of Combustibles

1. Considerpotentialvulnerabilitiesassociatedwithlargequantitiesof combustible material being temporarily or permanently stored in or adjacent to critical plant areas (e.g., ion exchange resins, lubrication oil, wooden scaffolding, anti- ,

. contamination clothing). l 2.- Consider plant practices with respect to the control of combustibles in operating .

modes other than full power.

l A-1 q

._:---__ - _ . _ __ . _ _ _ _ _- ._-_________--___________________-______=____a

DRAFT _FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

(b) Control of ignition Sources (e.g. welding, brazing, flame cutting) 1 (c) Fire Barrier Integrity Control During Plant Operation (d) Compensatory Measures for Inoperable / degraded fire protection features.

5. General Employee and Fire Watch Training (a) General Employee Fire Training (b) Fire Watch Training (including annotation of fire watch tour and work control logs, control of work in accordance with work permits, plant area specific combustible control, fire reporting, proper use of extinguishing agents, and knowledge of fire hazards associated with activities such as welding, grinding and cutting)

6. ' Fire Brigade and Fire Response (a) Fire Brigade Composition, Availability and Notification, and Shift Staffing for Fire Events

-1. Verify tbst the fire brigade composition (as specified in reactor plant administrativecontrolprocedures)provides an adequate number of trained fire fighting personnel (at least five) whose expected responsibilities during a fire event do not conflict with their fire brigade duties. Determine if alternative brigade members are available if the primary response team is injured or incapacitated by the event.

2. Verify that the number of staff on each shift is sufficient to accomplish all necessary actions to ensure a safe shutdown of the reactor following a fire.

Those actions include implementing emergency operating procedures,-

performing required notifications, establishing and maintaining communications with the NRC and plant management, and any additionalduties assigned by the licensee's administrative controls.

3. Verify that the licensee has documented actual fire event staffing needs in

-administrative procedures based on plant specific analyses for all times (including the backshift) and plant conditions.

1 i

l A-2 l

R

l l

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

l 4. Review the procedures for notifying the fire brigade. Evaluate potential vulnerabilities to the notification process during a fire or seismic / fire event.

Determine if a backup means of notification is available.

(b) Fire Brigade Training and Equipment

1. Fire Event Training (plant and equipment layout, fire effects, selection of suppression agents, pre-plans, drills / simulations, practical use of suppression agents)

(a) Veri'y tnat drills make effective use of the pre-fire plans, and that the pre-fire . i pans accurately depict the conditions in the identified risk critical fire areas.

(b) Evaluate the adequacy of training given to the control room operators to recognize electrical faults and related scenarios as potentially incipient fires.

(c) Determine if the fire brigade training program places adequate emphasis on conducting drills in the identified risk critical plant areas, and that the brigade members are aware of precautionary fire fighting practices near vital nuclear equipment.

(d) Observe a fire drillin one of the risk critical areas. Include unannounced obstructions to access paths and/or inoperable hose stations to simulate potential seismic / fire interactions. Verify that the fire brigade response is satisfactorily demonstrated, including fire brigade leader command and control, teamwork, communications techniques, utilization of support from other resource groups, and proper selection of suppressant. Review the adequacy of' the fire brigade's capability to locally control HVAC systems /dampersin the fire area. Review the licensee planning for post-fire habitability of important operating spaces (ventilation, room cooling).

(e) Communications. Determinewhethercommunications between the control l room, alternative shutdown stations, remote operating stations and fire j brigade are. adequate to both fight the fire and conduct post-fire safe shutdown. ]

. (f) Fire Brigade / Security /HealthPhysicsinterface. Ensurefire brigade members j can overcome potential security related access problems such as !ocked and electricallyfailed shut doors, and health physics access problems for fires in radiologically controlled /high radiation areas.

l A-3

- .--- _ _ --_-___ __ . u

L I

I April 6.1998

~

DRAFT FOR PRAIRIE ISLAND INSPECTION-

2. Fire Brigade Equipment Design and Function (a) Communications equipment

. (b) Environmentalequipment (e.g., protective equipment, breathing apparatus)

(c) Fire fighting equipment: determine if any specialized fire fighting equipment

is necessary for the identified risk critical areas. For example, determine whether sufficent quantities of dry chemical extinguishing agents are l

available relative to the flammable liquid fire hazards onsite.

3. Offsite Agreements. Reviewletters of agreementwith offsite organizations and consider:

(a) The training level of, and equipment possessed by, the personnel who. will be responding from the offsite organization. Specifically determine whether offsite organization personnel have, or will be provided with, equipment I compatible with onsite facilities (e.g. matching fire hose coupling threads or adapters)

(b) The adequacy of the expected response time of the offite organization.

(c) Whether the offsite training program places adequate emphasis on knowledge of the identified risk critical plant areas and familiarity with fire fighting and medical treatment considerations in radiologically controlled areas.

(d) The means of communications between the plant fire brigade and the offsite organization. Verify that sufficient radios on common frequencies are o provided. Verify that the radios are operable within the identified risk critical areas. j i

(e)Whether HP and security procedures are in place to enable the offsite organization personnelto access protected, vital and radiologicallycontrolled

- areas with minimal delay.

i (f) Whether clear lines of authority and responsibility have been set forth to facilitate command and control when offsite organization personnel respond to the site.

A-4

_ _ _ _ _ _ _ _ _ = _ __ _ - _ -

1 DRAFT FOR PRAIRIE ISLAND INSPECTION April 6. 1998-

! APPENDIX B l

FIRE PROTECTION SYSTEMS'AND FEATURES INSPECTION REQUIREMENTS'

1. Fire Protection Systems and Features Licensing and Design Bases (reference SERs,-

. licensing commitments, technical specifications,etc. and the licensee response to NRC 50.54 (f) letter dated October 9,1996)

2. Fire Detection and Alarm Systems (a) Fire Alarms and Automatic Backup Power Systems (designed, installed and maintained in accordance with NFPA 72)

(b) Fire Detector Positioning (designed, installed and maintained in accordance with NFPA 72)

(c) Appropriateness of Detector Type Selection (thermal, smoke ionization or photoelectric, light beam, ultraviolet, infrared, UV/lR, etc. in accordance with NFPA 72)

(e) Review plant procedures for testing detectors installed in remote, high ceiling or high radiation areas.

3. Fixed and Automatic Fire Suppression Equipment and Systems (includes Water Supplies, and other Liquid and Gaseous Agents)

(a) Fixed / Automatic Fire Suppression.

1. Verify that wet, dry pipe and pre-action sprinkler systems are designed, installed and maintained in accordance with NFPA 13 .q

2. Verify that deluge systems are designed, installed and maintained in accordance with NFPA 15

3. Verify that gaseous suppression systems (Halon, carbon dioxide and alternative clean agent systems) are designed, installed and maintained in accordance with -

NFPA 12, NFPA 12A and NFPA 2001.

- (a) Give consideration to required minimum concentrations and soak times (e.g., .

verify that the CO2 system is capable of achieving a 30 percent CO2 B-1

1 DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

concentration in the protected space within 1-minute and 50 percent within 7-minutes and is capable of maintaining this 50 percent concentrationfor 20 minutes).

(b) Verify that the dampers / doors close automatically (or there closure is otherwise assured) upon actuation of the gaseous system.

(c) Verify that the room penetration seals will minimize gas laakage. Review the adequacy of surveillance testing for room integrity

4. Verify that foam systems are designed, installed and maintained in accordance with NFPA 11 A.

5. Consider advertent and inadvertent fire suppression system actuation interactions (reference GSI-57 and NUREG-1472)

(a) Equipment Damage from flooding or spray.

(b) Personnel Hazards (c) Inadvertent Actuation Root Causes (e.g., dust caused actuation of smoke detectors after a seismic event)

6. Consider potential suppression system actuation problems:

(a) Extended Actuations (b) Failure to Actuate (e.g., loss of offsite power)

(c) Inadvertent Actuations. Could a fire, indirectly, through the production of l smoke, heat, or hot gases, potentially cause the activation of automaticwater fire suppression systems in other plant locations and damage redundant shutdown equipment?

(d) Verify that redundant trains of systems required for safe shutdown located in the same fire area are not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems (e.g., sprinkler caused flooding of other than the locally affected l train).

B-2 1 l

l 4

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

7. Consider protection of critical components from water spray and drippage, and the presence of water sealed cabling to critical electrical panels, where appropriate.

(b) Water Supplies

1. Biofouling and microbiologicallyinduced corrosion of tanks (designed, installed and maintained in accordance with NFPA 22), pumps, pipes, and valves (reference GL 89-13, Supplement 1, IE Bulletin 81-03, IN 89-76, and SECY 95-034)

2. Piping (including outdoor thermal protection)

3. Outdoor or underground piping and hydrants (designed, installed and maintained in accordance with NFPA 24)

4. Fire pump capacity, pressure head, testing, reliability and motive source diversity (e.g., diesel and electrically driven pumps) adequate for the largest-sprinkler demand and simultaneous extinguishment hosestreams in the same

- area (designed, installed and maintained in accordance with NFPA 20)

(c) Suppression and Detection System Related Modifications. Address whether selected modifications / equipment installations:

1. Changed the flow of heat, smoke or suppression agent, or the horizontal or verticallocation of combustibles.

2. Affected the threshold, response time, zoning or logic of automatic detection, alarm, or actuation devices (e.g., new walls, major structures, intermediate floors or horizontal surfaces can channel heat or smoke away from detectors, while ceilings with deep beams may act to collect heat and smoke and hasten detection.

3.- Required changes in nozzle, detector, floor drain, flammable / combustible liquid or water confinement /spillcontainment curb, or alarm / suppression activator box

(" pull station") horizontal or vertical locations, or in the number and pattern of detectors or nozzles.

4. Required changes in gaseous system pressures or volumes (e.g., flow rates

( may be affected by gaseous volume temperatures).

B-3

DRAFT - FOR PRAIRIE ISt.AND INSPECTION April 6, 1998

5. Required changes in HVAC flows, HVAC deenergization interlocks, equipment deenergization interlocks, or door closure / damper closure interlocks.

6. Required changes in suppression system or water curtain design to account for the presence of new or repositioned fixed or permanently positioned combustibles (e.g., plastic /PVC piping, treated lumber, anti-contamination suits, decontamination materials, combustible process gases).

7. Required the installation of new fire barriers based on the introduction or repositioning of fixed or permanently positioned combustible material in lieu of or along with changes to suppression and detection systems.

(d) Review detection and suppression related exemptions and deviations for areas of the plant which are designated as using redundant train safe shutdown. In addition to determining whether there are any detection and suppression features which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists, assess for granted exemptions or deviations whether.

1. The NRC reviewer correctly interpreted the licensee submitted information.

2. The licensee submitted information was correct and complete.  !

3. The granted exemption / deviation was correctly implemented by the licensee.

4. Manual Fire Suppression Equipment and Systems (hose stations and standpipes) j i

(a) Verify hose stations and standpipes are designed, installed and maintained in l accordance with NFPA 14, and provide adequate coverage for all plant areas.

(b) Verify that the utilization of manual fire-fighting systems by the fire brigade will not have an adverse affect on redundant trains within the fire area of concern, or cause water run-off that may have an affect on the redundant train located outside the fire area of concern.

5. Fire Barriers (a) General Fire Barrier inspection Methodology B-4

I L

DRAFT .FOR PRAIRIE ISI.AND INSPECTION April.6, 1998 l

1. Verification of the fire barrier system installations through the review of installation procedures and records.

(a) Procurement of Fire barrier materials l 1. Review the licensee's procurement documentation and verify that the materials used to construct the in-plant fire barriers are the same as those used to construct the test specimens.

2. Review of the procurement procedures and determine if the fire barrier materials and components were subject to receipt inspections.

3. Verify that the attributes required to be confirmed by the receipt inspection are the same as those identified by the procurement and' applicable design specifications and those identified by the fire test reports.

4. Determine the storage requirements for these materials and confirm that these materials are being properly stored.

(b) Review of plant specific installation procedures

1. Confirm that the construction attributes identified in the licensee's installation procedure for each type of fire barrier (e.g., small conduits, large conduits; junction boxes; small cable trays; large cable trays; air drops) are the same as those used in the construction of the test specimens

2. Determine how the licensee repairs fire barrier which had to be ooened, altered or modified (i.e. dismantled or opened for purposes of penetration seal verifications, junction or pull-box surveillance,etc). Verify that proper controls are established and maintained to implement compensatory measures during degraded conditions and that procedures are in place to fully restore the barrier to an operable condition at the completion of work that impacted the fire barrier system.

(c) Review the installation and design drawing details and determine that the configurations specified are consistent with the design details used in the construction of test specimens.

B-5

DRAFT .FOR PRAIRIE ISI.AND INSPECTION' April 6, 1998

'(d) QC installation records

1. Using the sample of the fire barrier configurations identified during the plant walkdown, request the QC installation records for these barriers assemblies.-

l 2. Verify that these records substantiate the construction of these barriers and confirm that the construction techniques used are consistentwith the

< techniques specified by the installation specifications and procedures and the fire and ampacity derating test reports

- (e) QA audits of the installation process. Evaluate the scope of these audits, the problems identified, and the effectiveness of the corrective actions.

(f) Fire barrier installer training program

1. Review the installer training program and verify that the lesson plans properlyinstruct the application of the fire barrier construction attributes for the various fire barrier system configurations identifisi by the installation specifications and procedures.

2. Using the sample of the fire barrier configurations systems identified during the plant walkdown, determine from the licensees records, which installers worked on the installation of these fire barrier systems. Request the training records for these installers and verify that they were properly trained prior to working on in-plant fire barriers.

2. Review fire barrier related exemptions and deviations for areas of the plant which are designated as using redundant train safe shutdown. In addition to determining whether there are any fire barrier features which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists, assess for granted exemptions or deviations whether:

(a) The NRC reviewer correctly interpreted the licensee submitted information. l (b) The licensee' submitted information was correct and complete.

. (c) The granted exemption /deviationwas correctlyimplemented by the licensee.

B-6

L DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

3. Inspection and walkdown of installed fire barrier systems. Review of fire barrier surveillance procedures and records.

4. Evaluation of the seismic analysis and calculations performed for fire barrier systems (the weight of which may affect the seismic response of the equipment / components on which the fire barrier material is installed).

5. Evaluation of ampacity derating affects on any cables protected by these fire barrier systems. Review plant related fire endurance and ampacity derating .

qualification test reports to determine the applicability of these test results to the plant specific fire barrier designs.

6. Evaluation of plant specific engineering evaluations which were performed to justify in-plant fire barrier installation conditions that vary from the tested configurations.

7. Fire Barrier Testing (a) Verify' that the fire barrier qualification testing shows that the average temperature rise of the thermocouple on the outer surface of the raceway i inside the test specimen (closest to the unexposed surface of the fire barrier material) was limited to 139 degrees C (250

• F.) above the initial temperature conditions, and that the maximum reading of any single thermocouple was limited to 181 degrees C. (325

• F.) above ambient.

(b) If these values were exceeded during the testing, verify that the licensee has an engineering evaluation showing that the specific types and sizes of cables used in the plant would remain free of fire damage (as defined in GL 86-10) and would fully function at rated voltage and current at the temperatures recorded during the qualification tests.

(c) Verify that, if cables were used in the test, that the cables were fiee of fire damage, regardless of what temperatures were recorded.

- (d) Verify that the fire barrier material did not exhibit any signs of burn-through during the test, regardless of what temperatures were recorded.

- (e) Verify that the fire barrier material was not breached by the post-fire test

hose stream test.

B-7

DRAFT 4 FOR PRAIRIE ISI.AND INSPECTION Apr il 6,1998 (f) Review the fire barrier system field installation instructions and compare L - them to the construction of the tested assembly. Verify that the construction of the test specimen was the same as the barriers installed in the plant.

Verify that the barrier thickness required for a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> rating, the weight per square foot of barrier material, the material properties of the stress skin (if used), and the material properties of fastening devices (banding, staples, wire ties, or bolts) used in the testing is the same as used in the plant. Verify that plant repair . procedures require equivalent construction methods for sealing opened raceways.

(g) Verify that the limited number of configurations tested bound the fire barriers installed in the plant. This includeo the sizes of conduits and cable trays, the

! cable tray and conduit materiais of construction (steel or aluminum), cable fill density, and the cable and cable jacket materials of construction.

i- (h) Review the plant procurement documentation to verify that the materials purchased and received at the plant were identical to those used to construd the test specimens. Ensure that receipt inspectionswere performed. Verify that the materialswere stored in accordance with the manufacturer's storage instructions prior to installation.

(i) Verify that appropriate QA & QC procedures were implemented and properly applied to the installation of the fire barriers. Verify the adequacy of the training given to installers and inspectors of the materials.

(j) Visually observe the condition of the plant fire barrier systems. Verify that the field installations comply with the tested configurations and installation instructions. Verify that all configurations that are outside of the test limits have been the subject of an engineering evaluation or exemption request.

Review the engineering evaluatons for technical adequacy and for conformance in accordance with the criteria in GL 86-10.

(k) Review modified fire barriers / fire area walls. Assess the significance of:

1. Structuralchanges to the supporting elements of the barrier / degradation of the fire resistive coating on structural members.

2. New penetrations in rated walls, floors or ceilings.

B-8

DRAFT '- FOR PRAIRIE ISLAND INSPECTION /pril 6, 1998

3. Additions, deletions or changes in the design of fire doors or fire dampers.

4. Removal of' cable wrap material on cable trays carrying redundant electrical circuits.

8. Fire Barrier Sunteillance. Verify that a surveillance program is implemented _for the fire barrier system. Ensure that the inspection procedures confirm the continued operability of the barrier system by checking the physical attributes specified in the field installation instructions,as well as checking for any potential damage. Verify that clear acceptance criteria are provided to decide if a barrier is inoperable. Determineif the time period that would elapse between the time a barrier is inspected and foend inoperable and when compensatory measures are implemented is acceptable. Verify the acceptability of the compensatory measures program.

(b) Type Specific Fire Barrier Inspection

1. Fire Doors (designed, installed and maintained in eccordance with NFPA 80)

(a) Consider the effects of fire brigade hoses being passed through fire doors.

, (b) Review the tested fire rating of the insta: led fire doors.

2. Ventilation Dampers. Review licensee resolution of concerns specified in IN 89-52 " Potential Fire Damper Operational Problems." Verify that fire dampers are tested under normal air flow conditions. Evaluate the potential for smoke and heat migration through the openings before operation of the protectives, and the potential effects on redundant equipment.

3. Cable / raceway Wraps. Verify that the added weight of the fire barrier system has been accounted for in the licensee's seismic analysis of the protected raceways.

4. Coatings for structural steel (ensure the coating provides a fire resistance equivalent to the barrier rating).

5. - Penetration Seals B-9

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 (a) Tour plant areas containing post-fire safe shutdown equipment or cables.

Determine whether any seals are missing from locations where they appear to be needed to complete a fire barrier, and determine that seals appear to be properly installed and in good condition.

(b) Select at least three seals for detailed review based on:

1. Seal type and material (e.g., silicone foam, silicone elastomer, silicone gel, mineral wool / cement /Flammastic combinations, mechanical compression).

2. Reallocation (e.g., whether the seal forms part of a significantfire barrier which either forms a fire area boundary or establishes separation between redundant post-fire safe shutdown components).

3. Historical repair or rework of the seal due to plant modifications.

(c) For the selected seals, determine whether they were designed, tested, installed, inspected (QA/QC) and maintained in accordance with licensee commitments, NRC fire protection requirements and guidance, and standard industry practice.

1. Examine procurement documentation for the penetration seal materials used and review the adequacy of the material for the application (e.g.,

pipe expansion or movement, radiation levels, flood potential).

2. Examine fire endurance tests and engineering evaluations associated ,

with the seal qualification design (with special attention to the applicability !

of the tested seal configurationto the actual configuration of the selected  !

seal in the reactor plant).

3. Review training programs for sealinstallers and inspectors. l

4. Review QC/QA programs relating to installation and maintenance of penetration seals.

5. Review seal maintenance / repair / rework records.

6. Review surveillance program and fire protection program requirements for penetration seals.

B-10 t

p :--

DRAFT - FOR PRAIRIE ISI.AND INSPECTION April 6, 1998

7. Partial and Full Height Fire Walls (between redundant components).

I

8. Miscellaneous / Unusual /UniqueFire Barriers'(e.g., floor drains, electrical bus ducts, intemal conduit seals, water curtains, etc.)

6. Reactor Coolant Pump Oil Collection Systems (a) Determine whether there are any RCP oil collection system features which would appear to require the granting of an exemption or deviation from the NRC staff.

(b) Review reactor coolant pump oil collection system related exemptions and deviations. Assess whether:

1. The NRC reviewer correctly interpreted the licensee submitted information.

2. The licensee submitted information was correct and complete.

3. The granted exemption / deviation was correctly implemented by the licensee.

B-11 l

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX C POST-FIRE SAFE SHUTDOWN CAPABILITY INSPECTION REQUIREMENTS

1. Establish the reactor plant's fire protection and post-fire safe shutdown licensing and design bases.

2. Review / study the most current version of the reactor plant's fire hazards analysis.

3. Review / study the most current version of the reactor plant's safe shutdown analysis.

' 4. Post-fire Safe Shutdown Areas and Systems Selection (a) Determine fire-risk significant areas of the plant to be evaluated by the inspection team. A minimum of three areas should be selected that contain components and/or cables associated with redundant trains of the and which are not provided with an aitemative or dedicated shutdown capability. Area selection criteria may include:

1. Plant areas for which the post-fire safe shutdown methodology may have been revised or replaced subsequent to the initial post-fire safe shutdown analysis.

2. The fire risk significance of the plant areas as indicated in the input received from the team PRA analyst.

3. The number of manual actions required to achieve post-fire safe shutdown for the subject plant areas. It would not be expected that numerous manual actions would be required for post-fire safe shutdowns using redundant trains of normal shutdown equipment.

4. The existence of a exemptions relating to post-fire safe shutdown capability.

5. The existence of post-fire safe shutdown related 50.59 evaluations and/or equipment modifications for the subject plant areas (see Generic Letter 86-10).

6. Plant areas for which compensatory measures are repeatedly and frequently implemented for conduct of maintenance, surveillance or other operational reasons.

C-1 1

)

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

t (b) Identify redundant safe shutdown trains of equipment. For the selected fire areas ,

designated for redundant train safe shutdown capability, verify that the licensee has identified systems and equipment that are capable of performing each of the following reactor shutdown functions:

1. Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions (K,,, < 0.99 and reactor coolant system (RCS) temperature less than l or equal to 200* F).

l 2. Reactorcoolantsysteminventory(makeup)controlcapableof maintainingwater level within the level indication of the pressurizer (PWR) or above the top of active fuel (BWR) at all times during shutdown operation.

3. RCS Pressure control capable of providing over-pressure protection and ensuring RCS pressure-temperature limits are not exceeded

4. - RCS decay heat removal

5. Process monitoring sufficient to control the above functions.

6. Supporting functions capable of providing process cooling, lubrication, electrical power, essential HVAC, etc. required to permit operation of the equipment used to achieve and maintain safe shutdown.

(c) Alternative Post-fire Safe Shutdown Fire Area and Systems identification. For the selected fire areas designated as requiring attemative and/or dedicated safe shutdown capability, verify that the licensee has identified systems and equipment that are capable of performing each of the following reactor shutdown functions:

1. Reactivitycontrolcapable of achieving and maintaining cold shutdown reactivity conditions (K,,, < 0.99 and reactor coolant system (RCS) temperature less than or equal to 200" F).

2. Reactorcoolantsysteminventory(makeup)controlcapableofmaintainingwater level within the level indication of the pressurizer (PWR) or above the top of active fuel (BWR) at all times during shutdown operation.

3. RCS Pressure control capable. of providing over-pressure protection and ensuring RCS pressure-temperature limits are not exceeded C-2

=___L _ - - _ _

i DRAFT - FOR PRAIRIE. ISLAND INSPECTION April.6, 1998

4. RCS decay heat removal

5. Process monitoring sufficient to control the above functions.

6. Supporting functions capable of providing process cooling, lubrication, electrical power, essential HVAC, etc. required to permit operation of the equipment used to achieve and maintain safe shutdown.

(d) Confirm the existing, as-installed, shutdown system configurations are as described in the plant's current licensing basis, as documented in the NRC staffs Safety i~ Evaluation Reports (SERs), the licensee's FSAR, and/or the licensee's Fire Hazard Analysis (FHA) and Safe Shutdown Analysis (SSA).

. 5. Alternative or Dedicated Shutdown Capability (a) Verify the adequacy of the attemative or dedicated shutdown methodology implemented in the event of fire requiring control room evacuation and achievement of safe shutdown conditions at remote shutdown panels and/or local control stations. Ensure this methodology is capable of accomplishing post-fire safe shutdown conditions with or without the availability of the normal offsite power sources (i.e.,where offsite power remains available and where offsite power may be

< lost as a result of fire damage).

(b) Verify the adequacy of abnormal / emergency operating procedures developed to implementthe alternative or dedicated shutdown capability. Confirm that the SSA results and conclusions have been accurately reflected in the procedure (s). For.

plants that have adopted the standard fire protection license condition (see Generic Letters 86-10 and 88-12), verify that changes made to the fire protection program under the provisions of 10 CFR 50.59 do not invalidate the shutdown methodology approved in the staffs SER, or institute a new, but potentially unsuccessful safe shutdown strategy / methodology.

(c) Conduct a step-by-stepwalk-through of operator actions with a knowledgeable plant operator.

(d) Assess analyses performed to demonstrate that operator actions can be accomplished and shutdown system functions made operable in a timely manner (i.e., time-line studies).

C-3

DRAFT FOR PTtAIRIE ISLAND INSPECTION April 6. 1998 (e) Evaluate the practicality of operator activities relied on to accomplish time critical shutdown functions from outside the main control room.

(f) Review alternative safe shutdown and emergency lighting related exemptions and deviations for areas of the plant which are designated as using alternative safe-shutdown. In addition to determining whether there are any alternative safe shutdown or emergency lighting characteristics which would appear to require the '

granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists, assess for granted exemptions or deviations whether.

1. The NRC reviewer correctly interpreted the licensee submitted information.

2. The licensee submitted information was correct and complete.

3. The granted exemption / deviation was correctly implemented by the licensee.

(g) Verify that the minimum shift staffing level specified in the plant's Technical i

Specifications, exclusive of the fire brigade, is sufficient to perform all activities specified in the alternative / dedicated shutdown procedures for achieving and maintaining hot shutdown conditions.

(h) Review operator training records for post-fire safe shutdown abnormal / emergency operating procedures, t

(i) Verify that repair activities are not required to accomplish hot-shutdown / hot-standby conditions unless such actions were specifically reviewed and accepted by the staff in its SER and an exemption was granted by the NRC.

(j)' Verify that no operator actions are required to be performed in the fire affected area prior to fire extinguishment.

(k) Verify that adequate time, tools, materials, safety equipment (e.g., protective clothing) lighting and manpower will be available to perform repair activities that may be necessary to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Confirm that any necessary replacement parts are dedicated to this activity and stored on site and that all repair activities are performed in accordance with approved procedures by personnel having appropriate knowledge and experience.

C-4 i

(

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6.1998 (1) Determine whetherthere are any features of the alternative safe shutdown process which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists.

, (m) Review maintenance records relating to monitoring the l performance /effectivenessof remote post-fire safe shutdown panels and control stations. Such records would be generated in accordance with a licensee Maintenance Rule Program meeting the requirements of 10 CIR 50.65.

6. For normal (redundant train) and alternative / dedicated post-fire safe shutdown, evaluate operator activities (manual actions both inside and outside the main control room) that are necessary to achieve safe shutdown conditions in the event of fire in the selected area (s). This evaluation should consider such characteristics as:

1. Accessibility (a) The need to interface with plant security, health physics, control room operator or fire brigade personnel (b)The need for prestaged devices to provide access, operator safety or mechanical leverage (e.g., keys, ladders, protective clothing, procedures, special tools (c) Required manual actions can be carried out without entry into the fire affected area

2. Habitability (a) Radiation (c) Heat (d) Smoke (e) Toxic gases

3. Normal and Emergency Lighting. Eight hour emergency lighting is required for operators to travel safe shutdown areas and to perform safe shutdown functions.  !

Verify that: j C-5

1 DRAFT J FOR PRAIRIE ISLAND INSPECTION Aprfl 6,1998 l

(a) Emergency lighting lamps are properly aimed to allow access, operation of safe l

1 shutdown equipment, performance of manual actions, and monitoring 'of safe shutdown indications; l (b) Batteries, charge rate indication (lamp or meter), and specific gravity indication is within specification; and (c) Through review of manufacturer's information, that battery power supplies are rated to at least an 8-hour capacity.

(d) Licensee maintenance and surveillance preventive maintenance / functionality check frequencies and procedures ara as specified by the manufacturer.

(e) There are no emergencylighting characteristics which would appear to require the granting of an ~ exemption or deviation from the NRC staff, and for which no such exemption or deviation exists. Further, assess for exemptions or deviations which have already been granted whether:

(a)The NRC reviewer. correctly interpreted the licensee submitted information.

(b) The licensee submitted information was correct and complete.

(c) The granted exemption / deviation was correctly implemented by the licensee.

4. Communications (a) Verify the availability, operability, and effectiveness of communication systems used during implementation of the alternative or dedicated shutdown capability.

This -valuation should consider the following:

1. Electrical powcr requirements of the selected system, including the operability of the system during a loss of normal offsite power 2.' Physicaland electricatindependence of the designated system from the fire j area (s) of concem 3, if portable radios are used, determine if the licensee has adequately

' identified areas of the plant where:

C-6

f DRAFT 1FOR PRAIRIE ISLAND INSPECTION April 6.-1998 (a) Use of portable radios may be prohibited or restricted due to the potential for radio interference with sensitive equipment; or,

. (b) Use of portable radios may not be effective (i.e., transmission / reception

" dead spots"); or,-

(c) Availability of the portable radio communication system may be jeopardized due to the physical location of the radio repeater, its power supply, the routing of connected power cables,~ and the potential effect of a loss of offsite power.

5. Timeliness (adequacy of manual action timeline)

6. Feasibility (of manual actions)

7. Procedural Adequacy (including cold shutdown repairs)

8. Operator familiarity with and training on safe shutdown actions.

]

9. Absence of Repairs to Achieve and Maintain Hot Shutdown

10. Cold Shutdown Repairs. For those plant areas where circuits or equipment are located which are needed to achieve and maintain cold shutdown, and the licensee's procedures call for. reliance on repairs to achieve post-fire cold shutdown, verify the following:

(a) The licensee's analysis clearly identify which cold shutdown equipment could be damaged in a postulated fire; (b) That the fire damage to control room or remote shutdown station cold shutdown equipment can be repaired and the needed equipment made operable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; (c) That the material required for cold shutdown equipment repair is dedicated and E . available on-site.

7.~ Shutdown Fire Safety. The inspector should review:

(a) The licensee's repair procedures, onsite resources, and timelines (relative to a reactor coolant saturation temperature condition) for shutdown or refueling plant C-7 u _-_:__--__ _ - _ _ _ - - - _ -___

G DRAFT - FOR PRAIRIE ISI.AND INSPECTION April 6, 1998 conditions for postulated fires which could damage both trains of decay heat removal capability..

.(b)The plant fire prevention administrative control procedures for transient combustibles and ignition sources for areas (and areas adjacent to such areas) which contain both trains of decay heat removal capability.

8. Electrical System Protection (a) Power, Control and instrumentation Cable Separation and Protection

1. Verify the licensee's Safe Shutdown Analysis (SSA) has adequately identified cables of required shutdown systems and equipment. Select a representative sample of components whose operation is required to accomplish the time critical shutdown functions. From a review of electrical echematics depicting the as-built plant configuration, identify cables required for operation, control and/or monitoring of this equipment and campare the results of this evaluation with the list of required cables listed or identified in the plant's SSA. It should be noted that this approach may also identify modifications made to the selected components since the original safe shutdown analysis was performed. If modifications were performed, verify they were appropriately reviewed and incorporated into the component cable selection documentation of the SSA.

2. For the selected post-fire safe shutdown redundantequipment and components with time critical shutdown functions, determine whether a single fire could cause common cause failure of their redundant shutdown system cables.

(a) For each component, identify power, instrumentation and/or control cables to be evaluated in-depth, and request the licensee to provide color-coded cable tray and conduit routing drawings depicting the routing of the selected cables throughout the plant, i

(b) Determine the adequacy of fire separation between the selected sets of redundant safe shutdownhequired system and support system components.

3. Determine whether the licensee has conducted adequate ampacity derating

. tests for safe shutdown related cables enclosed in fire barrier protective wrap materials (e.g., age-related cable insulation degradation due to trapped heat).

The licensee engineering documentation and supporting ampacity derating' test results should bound the raceway configurations protected by fire barriers.

C-8

}

---

e._ _ -- _ _ . _ _____ m__ ___________ _ _ _ _ _ _ _ _ _ _ _ _ _ _

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

4. For selected raceway fire barrier systems inspected during plant walkdown, review the licensee's cable ampacity derating calculations and _. test documentation for adequacy, reasonableness and good engineering practice.

(a) Assumptions used in the calculations should be supported by actual test results.

(b) Ampacity derating calculations and test specimen design should address the actual arrangement, construction' and installation practices, size, material properties, procurement practices, and current loadings of the selected plant-specific barrier and cable configurations. For safety-related. cable applications, the associated ampacity tests should conform to the requirements of 10 CFR Part 50 Appendix B including adequate disposition of test anomalies and material non-conformance.

(c) Determine if unique fire barrier / cable arrangement configurations are bounded by either ampacity derating test documentation or plant specific engineering evaluations.

(b) Review the licensee's response to GL g2-08, "Thermo-Lag 330-1 Fire Barriers."

Verify that the licensee has completed or is in the process of completing all commitments made with regard to potential ampacity derating due to heating of enclosed /wrappedelectrical cable. Review any studies done by the licensee on this subject for adequacy, reasonableness and good engineering practice.

(c) Alternative /dedicatedSafe Shutdown Panel Electricallndependence snd Isolation.

1. ' Review the availability and adequacy of electrical isolation schemes (e.g.,

isolation / transfer switches) used to isolate circuits of required shutdown equipment from the fire affected area (s) during implementation of the alternative shutdown capability.

2. Verify that a suitable isolation capability has been provided and the transfer switch design' scheme incorporates a redundant fusing capability, where necessary,to preclude the need for replacement of control power fuses following transfer.

C-9

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

3. Verify the availability and adequacy of fuse replacement control procedures.

Select a minimum of three fuse panels for, in-plant, field validation to ensure that the "as-installed" feses are as specified in design drawings and the licensee's coordination study.

(d) Associated Circuits of Concern

1. Verify the adequacy of electricalprotective/isolationmeasures provided for non-essentialassociated circuits which share a common source of electrical power (MCC, Switchgear,. Fuse Panel etc.) with circuits of required shutdown equipment, as defined in NRC Generic Letters 81-12 and 86-10. Note that suitable protection may be provided by conformance to established redundant train separation criteria (Section Ill G.2 of Appendix R) or coordination studies, or a combination of both (e.g., providing partial length barriers for cables to limit the potential fault current to within acceptable limits necessary to obtain

^

coordination). This evaluation should consider the occurrence of multiple high impedance faults for all associated circuits located in the fire area of concem.

2. Verify the adequacy of electrical fault protection provided for non-essential circuits which share a common enclosure (raceway, cable tray, conduit, 1

distribution panel,-etc.) with cables of required shutdown components, as defined in NRC Generic Letters 81-12 and 86-10. A minimum of three enclosures which contain a mix of non-essentim ciret!tn i and circuits of equipment required for post-fire safe shutdown should be selected for an in-depth breaker / fuse coordination review. \%ere circuit breaker and fuse coordination (selectivity) studies are credited, verify that suitable maintenance and surveillance test procedures are available to ensure circuit-breaker and relay coordination is maintained, and verify that performance of the protection devices is routinely verified. Select a minimum of three electrical protection devices and field verify their trip settings are as specified in the plant's design drawings and coordination study.

3. Verify the adequacy of the protection provided for circuits of equipment whose fire-induced spurious operation could adversely affect the plant's ability to achieve and maintain hot shutdown / hot standby conditions. This evaluation should consider:

(a) The validity of assumptions used in the performance of the analyses and suitability of evaluation methods.

C-10 i

o

~

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6,1998 (b'i Whether the spurious signal analysis addresses all components whose spurious operation or maloperation could adversely affect the plant's ability to achieve and maintain hot shutdown / hot standby conditions. The evaluation should address:

1. Components whose spurious actuation would have a direct affect on the operability of required (credited) shutdown systems, and i

-2. Components whose spurious actuation wculd cause non-essential systems to spuriously actuate in a way that could affect the' plant's shutdown capability. (Examples of this type of spurious actuations include: the potentialfor reactor overfill due to spurious injection of safety injection or feedwater systems; the potential for uncontrolled reduction in reactor coolant system pressure.

I (c) The adequacy of the licensee's analysis and method of protection provided for valves which form a high/ low pressure interface. Note that simultaneous spurious actuation of redundant (in this context, series) high/ low pressure interface valves should have been assumed in the licensee's analysis as discussed in Generic Letter 86-10 (d) Potential for loss of attemative shutdown capability during a control room fire due to hot shorts, open circuits and shorts to ground leading to single or multiple, simultaneous mechanical (irreversible) failures or other types of equipment or valve positioning problems.

(e) Verify the licensee has considered the potential for inaccurata instrument indications and/or spurious equipment actuations that may occur as a result of an instrument sensing line being exposed to a fire and increased temperatures.

i

9. Post-fire Safe Shutdown Capability implementation j (a) Methods of Redundant Train and Alternative / Dedicated Safe Shutdown implementation

1. Redundant Train Walk-through Simulation.

i I

C-11  !

I l

l

DRAFT J FOR PRAIRIE ISLAND INSPECTION April 6. 1998

2. Altemative/ dedicated Walk-through Simulation. Observe walk-through simulations of alternative / dedicated shutdowns for one or more fire areas.

Specific items to observe during the simulation include:

_ (a) The appropriateness and feasibility of operator actions (b) Operator knowledge and training as demonstrated by their performance and responses to questions posed by the inspection team (c) The availability and effectiveness of communications (d) The availability and effectiveness of emergency lighting (refer to IP 64100, Section 02.03 for inspection requirements).

(e) Observed areas of strength and weakness in licensee's consideration of human factors, including the potential for operator errors of commission and omission.

(f) Access and habitability oflocal control and monitoring stations (g) Effort necessary to perform required shutdown activities (h) Availability and dispersal of necessary tools, radios, flashlights, or other shutdown related equipment, and the administrative controls established to ensure these items will be available when needed, are periodically inventoried, maintained, and checked for proper function.

(b) Electrical Loads Management

1. Station Blackout (SBO). Prior to and during a post-fire safe shutdown walk-through simulation at a reactor plant that conducts full or partial station blackout procedures, the inspector should consider:

(a)The A.C. power drop and plant component realignment timeline logic, assumptions and bases, including control room abandonment and offsite power drop decision criteria and time requirements.

(b) The ability of plant operators to monitor and control plant parameters before, during and after SBO control room evacuation / abandonment.

C-12 l

L L-

l DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 I

(c) The ability of plant operators to monitor and control / align plant components after SBO control room abandonment.

(d)The practicality and reliability of EDG start and load (and restart, if applicable) under post-fire safe shutdown /SBO conditions.

(c) Human Factors and Manning (d) Control System Interactions / Control Location Transfers END l

i C-13. l 1

l l

i j DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 (c) The ability of plant operators to monitor and control / align plant components after SBO control room abandonment.

(d)The practicality- and reliability of EDG start and load-(and restart, if applicable) under post-fire safe shutdown /SBO conditions.

(c) Human Factors and Manning (d) Control System Interactions / Control Locrition Transfers END l

l l

1 l

i l i l

l C-13 I

DRAFT - FOR-PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDlX D FIRE PROTECTION AND POST-FIRE SAFE SHUTDOWN MANAGEMENT PROCESS INSPECTION REQUIREMENTS

1. Quality Assurance / Quality Control Audits l

2. Surveillance Testing and Maintenance Program l 3. OperabilityAssessmentsand CompensatoryMeasures. Evaluatethe effectiveness of plant administrative controls and procedures estab'ir,ed to reduce fire risk to plant

safety when' portions of one train of shutdown equipment are out of service or

. inoperable.

END D-1 V

DRAFT FOR PRAIRIE' ISLAND INSPECTION April 6, 1998 j APPENDIX E FIRE PROTECTION AND POST-FIRE SAFE SHUTDOWN CONFIGURATION CONTROL INSPECTION REQUIREMENTS

' 1. 50.59 Process. Review the licensee's 50.59 review process for conformance with the requirements of 10 CFR 50.59 (review of the application of the 50.59 process to fire protection and post-fire safe shutdown configurations is addressed below).

2.' Design Reviews and Modification Packages (a) Modifications L

1. Evaluate the impact of selected post-fire safe shutdown configuration modifications performed since the plant's fire protection program was originally reviewed and approved by the NRC staff and inspected under IP 64100. Ensure that fire protection and post-fire safe shutdown configurations have been maintained.

For plants that have adopted the standard fire protection license condition (see GL 86-10 and GL 88-12), verify that changes made to the fire protection program under the provisions of 10 CFR 50.59 do not adversely affect the level of separation and protection provided for redundant trains of shutdown equipment, invalidate the shutdown methodology approved in the staffs Fire Protection SER, or institute a new, but potentially unsuccessful safe shutdown strategy / methodology.

The inspector should specifically verify that:

l (a) Changes in the plant's mechanical and electrical design were appropriately l

evaluated for their potentialimpact on plant fire safety by qualified personnel, knowledgeable in the reactor plant's safe shutdown analysis, (b)The modifications do not compromise the plant's ability to achieve and maintain safe shutdown conditions, (c) The installed mechanical and electrical configuration corresponds to the modification design requirements and is in agreement with the facility documents, and E-1

I e q l

DRAFT FOR PRAIRIE. ISLAND INSPECTION April 6, 1998 (d) Appropriate physical _ separation and/or electrical isolation has been maintained between redundant divisions of equipment and cables required for post-fire safe shutdown.

2. Examplesof fire protectionconfigurationmanagementprogramimplementation lines ofinquiry include:

(a) New fire area boundaries or fire barrier penetrations.

1 (b) Changes to emergency lighting.-

(c) Changes in access for manual fire fighting.

(d) Chances in automatic fire suppression systems (e.g., changes from wet pipe i to dry pipe sprinkler system design). l

)

3. Verify that temporary modifications are tracked, controlled, and reviewed for their potential impact on fire safety and post-fire safe shutdown capability by qualified operations, engineering, and fire protection personnel knowledgeable in the plant's ' safe - shutdown and fire hazards analyses. Temporary modifications frequently involve the use of electrical jumpers in indication and control cabinets, and are typically tracked in control room log' books. The l inspector should consider whether:

(a) Potential fire hazards were or are being created due to the presence of electricaljumpers.

(b) The temporary modifications existed for the minimum duration practical.

(c) The temporary modifications potentially disabled the reactor plant's safe shutdown capability.

3. Review the activities of plant review committees with respect to fire protection anqi post-fire safe shutdown configuration management.

4. Review FSAR updates for selected plant modifications.

END j 1

E-2 I

e

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l'

l APPENDIX F POTENTIAL FIRE RELATED VULNERABILITIES INSPECTION REQUIREMENTS

1. Event Based Fires (a) Consider which plant events could cause a fire. Review plant specific Licensee Event Reports (LERs) -and the FSAR Chapter 15 accident analysis and the PRA/IPE/IPEEE to determine accident scenarios or sequences which could result in

- a fire. Specifically consider:

1. Turbine Generator Failure Events -

(a) Review the licensee's turbine generator inspection and maintenance program, focusing on operability history and problems associated with the design, and the techniques used by industry to monitor, inspect and resolve keyway SCC problems in turbine generator high pressure (HP) and low pressure (LP) rotors of either the shrunk-on (keyway) or monoblock (no keyway) wheel design;-

(b) Review and inspect the turbine generator lube oil system design (e.g.,

system logic, piping configuration, lube oil piping / bearing configuration);

(c) Review and inspect the hydrogen system and its ability to be promptly isolated in the event of a fire. The system was also reviewed to determine if an excess flow check valve was incorporated in the turbine hydrogen gas cooling system design; (d) Review the licensee's methods for coping with a lube oil fire in the lower levels of the turbine building. Included review of the availability of the licensee's fire brigade equipment and foam capability, methods of fire attack, .

methods of smoke venting, implementation of off sRe assistance, and the potential impact a turbine fire event may have on safety related/ safe shutdown equipment.

(e) Review and inspect the licensee's fire protection program and features provided for turbine building and specific turbine related fire hazards.

- (f) Evaluate the following: 1) fire protection provided for the turbine bearings,2) fire protection features provided for the turbine lube oil system,3) distribution of manual fire hose stations,4) manual fire fighting foam capabilities and F-1

r DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 access and egress to turbine building areas,5) communications available for fire fighting operations,6) distribution and logic of the turbine fire / smoke.

detection system, 7) smoke venting capabilities, 8) fire protection features

. provided for the turbine generator hydrogen system, and 9) fire protection l features provided for cable trays in the areas of significant turbine building l fire hazards.

(g) Evaluate the' potential for the postulated worst case fire in the turbine

. building to impact safety related plant areas and equipment was evaluated.

This evaluation should focused on determining;

1. Whether fire suppression activities could cause flooding and the potential affects flooding may have on safety related/ safe shutdown systems,

2. The potential for smoke migration into safety related areas,

3. The direct and indirect affect the postulated fire may have on any safety related system located in the turbine building.

2. Emergency Diesel Generator (EDG) failure events (a) Mechanicalfailure of an operating emergency diesel generatoris postulated.

Consider:

1. Whether the fire separation between the diesel generators and its associated circuits and support systems adequate to provide reasonable assurance that the redundant train is free of fire damage,

2. The licensee's smoke control measures and determine if they are adequate to preclude the smoke from entering the engine air intake or the redundant diesel engine,

3. The adequacy of the diesel generator compartment to confine a combustible liquid type fire, and

4. The adequacy of the automatic fire suppression system provided and determine its ability to control the fire and mitigate its consequences.

F-2

. q-

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 (b) Considerthis failure concurrentwith a loss of offsite power and/or a seismic event (a seismic event may have a severe impact on the operability on the fire detection system and the fire water system).

3. Recirculation pump MG set failure events. Evaluate:

(a)The fire separation between the MG sets and the remaining areas of the plant, (b) The licensee's smoke control measures and determine if they are adequate to preclude the smoke from entering adjacent safety related areas of the plant, (c) The adequacy of the area around the MG set to confine a combustible liquid type fire, and (d)The adequacy of the automatic fire suppression system provided and "

determine its ability to control the fire and mitigate its consequences.

4. Control Rod Drive MG Set Failure Events

5. Improper.. Electrical Grounding. Determine the nature and extent of the licensee's review of and possible actions in response to information Notice 97-01 on improper electrical grounding which may cause simultaneous fires.

6. High Energy Steam Line Breaks (b) Determine what plant equipment or systems are needed to suppress or control the effects of the postulated fire event. Review the cable routing and component locations for this equipment and determine whether the fire could prevent fire suppression or fire effects control.

2. Fire-Induced Plant Transients

.(a) Consider which plant fire events could cause a plant transient. Review plant specific Licensee Event Reports (LERs) the FSAR Chapter 15, Accident Analysis, emergency operating procedures (EOPs), and PRA/IPE/IPEEE to determine if any

- of the accident /transientscenarios or sequences discussed therein could be caused by a fire,; Specifically consider:

F-3

4 DRAFT i FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

'1. Intersystem LOCA and LOCAs '

(a) Evaluate the potential for fire initiated spurious actuation at high-low pressure interfaces that could cause an uncontrolled loss of reactor coolant inventory l

(e.g., spurious actuation of primary coolant interfaces such as at the reactor

. head _ vents, normal and excess letdown (PWR), pressurizer PORVs (PWR),

Residual Heat Removal (PWR), and Shutdown Cooling System (BWR)).'

(b) Evaluate the methods of protection provided by the licensee to prevent fire .

induced spurious signals from initiating an uncontrolled loss of coolant (e.g.,

controlled by procedure or administratively)

2. Station Blackout (a) Determine in which areas of the plant a fire can cause a Station Blackout (loss of all AC).

(b)From the station blackout procedures determine the licensee coping strategies and what equipmentit would rely on and determine if any of these -

components or their electrical circuits are routed through the fire areas of concem.

3. Rapid cooldown (a) Evaluate the licensee's EOPs that give guidance when responding to a fire induced failure of an automatic turbine trip signal without a demand for a reactor trip. Determine the plant locations where a fire may cause this type of transient.

(b) Consider whether a fire could cause a transient which overfeeds either the reactor or the steam generators.

(c) Evaluate the vulnerabilityof primary steam reliefs to fire-induced failure in the open position.

4. Significant loss or inadvertent actuation of safety functions (a) Evaluate the layout and cable routings for safety related systems and their support systems to determineif there are any plant areas where a fire could cause for example, spurious actuation of safety injection and/or containment F-4

__-__x_-_____________ . _ _ _ _ - _ _ _ _ _ _ _ _ _ - _-

>1 DRAFT - FOR PRAIRIE IStAND INSPECTION April 6. 1998 isolation actuation and make an operationalassessment of the impact it may '

have on reactor safety.

(b) Evaluate th gout and cable routings for safety related systems and their support systs ,ns to determine if there are any plant areas where a fire could cause a common mode failure of a significant portion of those systems -

needed to mitigate the consequence of certain plant accidents.

(b) Evaluate the defense-in-depthdiversity and survivability fire mitigation features for the transient related fire area.

(c) Consider the effects of heat, smoke, hot gases, products of combustion, and fire extinguishing agents on the operability of components and equipment needed to control the plant transient.

3. Seismic / Fire Interactions (a) Review the potential for seismic events to cause fires (e.g., through gas or flammable liquid line or tank ruptures, or electrical equipment derangement, or water impingement, leakage or runoff onto electrical equipment). Consider the potential for floor drain systems to spread flammable liquids to other critical plant areas.

(b) Review the potential for seismic damage to or inadvertent actuation of suppression systems wb5h could cause damage to other plant equipment or create personnel hazards.

(c) Review potential for seismic events to cause loss of personnel access (e.g. through stairway collapse, jammed doors, dislodged gratings, or release of water, flammable or combustibleliquids or gases, or large quantities of carbon dioxide) and thereby

reduce manual fire fighting capability.

(d) Consider the potential for seismic events to damage the reactor plant's fire pumps, fire mains and hose stations, portable fire extinguishers and their mounts, and fire brigade communication equipment or supporting power sources. Consider the potential for portable fire extinguishers to become missile hazards and possibly i damage safety related equipment. Consider the reliability of the backup or offsite water supply following a seismic event.

F-5 i'

t

l i

DRAFT LFOR PRAIRIE ISt.AND INSPECTION April 6, 1998 (e) Consider the potential for seismic events to cause direct damage to redundant equipment, cabling or electrical switchgear. Consider whether non-safety related equipment could fall during a seismic event and damage safety related equipment (f) Consider the potential for seismic events to damage fire area boundaries or other fire barriers.

(g) Consider the potential for seismic events to reduce suppression and detection system capabilities.

(h) Consider the effects of flooding or other equipmentdamage that may be caused by inadvertent actuation of fire suppression systems during a seismic event.

(i) Consider the potential for seismic events to damage reactor coolant pump oil collection systems.

4. Fire induced Release of Radioactive Materials.

END F-6

i DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX G TEAM MAKEUP AND QUALIFICATIONS The NRR team leader and regional representative shall be NRC employees. The PRA.

analyst, reactor systems / mechanical systems engineer, electrical engineer and fire protection engineer may be either NRC employees or NRR contractor personnel.

l TEAM l FADER (TL). The NRR team leader will manage team member activities and-interface with NRC and licensee management. The inspector's' qualifications should include:

e Fire protection engineering degree, or equivalent experience e inspection Team Leader certification e PRA familiarity (through formal training).

~ PRA ANALYST (PRA). The PRA analyst will participate almost exclusively during the preparation phase of the inspection. He will conduct the PRA analysis methodology (see Appendix C for PRA technical guidance). The analyst's qualifications should include: l e PRA expertise through education and experience e Familiarity with nuclear reactor design and operations

• Familiarity with U.S. regulatory / licensing process.

REACTOR SYSTEMS / MECHANICAL SYSTEMS ENGINEER (SE). The reactor systems /mechanicalsystems engineer will assess the capability of reactor and balance of plant systems, equipment, operating personnel, and procedures to achieve post-fire safe shutdown and minimize the release of radioactivityto the environment in the event of fire.

The inspector's qualifications should include: l e Knowledgeablein integrated plant operations, maintenance, testing, surveillance and quality assurance. 1 e Knowledgeable in reactor normal and off r.ormal operating procedures e Knowledgeable in BWR and/or PWR (as applicable) . nuclear and balance of plant systems design  ;

e PRA familiarity (through formal training). j l

ELECTRICAL ENGINEER (EE) The electrical engineer will identify electrical separation requirements, for power, control and indication cables (and, in conjunction with the inspection team fire protection engineer, will review the adequacy of the fire protection G-1  !

i i

I L

h DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 features providing that separation), will review alternate and dedicated shutdown panel electrical isolation and electrical independence from fire areas of concem, and review associated non-safety circuits of concern (including spurious signals, common enclosures, and fuse-breaker coordination). The EE verifies that the licensee has adequately demonstrated that fire-induced circuit faults (hot shorts, shorts to ground, open circuits) will not prevent safe shutdown operation. He also verifies circuit breaker coordination and fuse protection has been analyzed and provided, as necessary. The inspector's qualifications should include:

e Reactor plant electrical /l&C design

• PRA familiarity (through formal training) l e. Familiarity with industry ampacity derating standards.

FIRE PROTECTION ENGINEER (FPE). The fire protection engineer will review of fire protection features and procedures. The Fire Protection Engineer (FPE) assists other FPFI team members in determining the effectiveness of the plant fire barriers and systems which establish the post-fire safe shutdown configuration. He will determine whether suitable fire {

protection features (suppression, separation distance, barriers, wrap, etc.) are provided for redundant trains of cables required to ensure plant safety and accomplish safe shutdown conditions. The inspector's qualifications should include:

• Fire protection engineering degree, or equivalent experience e Knowledgeable in reactor plant fire protection.

REGIONAL INSPECTOR (RGI). The regional inspector will review surveillance, testing, maintenance and repair activities and procedures, the application of fire protection administrativecontrols, fire protection related QA/QC activities, and the practicality of fire event related procedures. The inspector's qualifications should include:

e Standard regional inspector qualifications e Familiarity with reactor plant and BOP system design and operating procedures e Familiarity with licensee design change processes and procedures e PRA familiarity (through formal training) e Familiarity with licensee fire protection programs, NRC fire protection inspection procedures and their use, and NRC fire protection regulations and licensing guidance e . Familiarity with licensee personnel and onsite organization (desirable).

END G-2

E DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

, APPENDIX H TEAM INSPECTION CONDUCT PROCESS

[ Note: Specific topics addressed in this procedure may be conducted on an individual (non-team) basis. If so, some of the information in this Appendix may not apply.]

Plant Selection and insoection Announcement. Selection of the pilot reactor plants and the four to eight reactor plants to be inspected per year will be conducted by SPLB/NRR in coordinationwith the four regional offices. The inspection should be announced to the licensee in writing between three and six months before the inspection start date. The NRR Licensing Project Manager should also be informed at this time.

Assignmentof Team Members. Assignmentof team memberswill be conducted by NRR (in consultation with the cognizant regional office) at least three months before the scheduled inspection. The team leader will ensure all selected team members have taken within the last nine months, or shortly will have taken the NRC's initial or refresher site access training course.

Initial Insoection Plan Outline. Approximately three months before the inspection start date, the inspection team leader will develop an initial inspection plan outline and provide it to each team member and the respective regional office. j i

Headquarters Announcement Letter to the Licensee. Approximately three months before the inspection start date, the inspection team leader will draft and issue (through tl a appropriate NRR reactor projects division, an inspection announcement letter to the licensee. This letter will discuss the scope of the inspection, request an information gathering visit to the licensee reactor site / engineering offices, discuss onsite document and licensee personnel availability needs during the two weeks of onsite inspection, and i discuss a pre-inspection conference call to discuss administrative matters (see below). A copy of the FPFI inspection procedure will be included in this letter.

Information Gatherino Visit to Reactor Site and/or Licensee Coroorate Headquarters and/or Engineering Offices. Approximately two and one half months before the inspection, the inspection team leader and selected team members will participate in a two day long information gathering visit to the reactor site and/or the licensee's corporate headquarters / engineering offices. The information will be sent to the applicable team members. The information gathered will support the " General Team Member Preparatiorf topical areas described below.

H-1

r DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

~ During this site visit the team leader make a request that the licensee prepare a brief presentation for delivery during the first onsite week entrance meeting addressing:

e Licensee organization, responsibilities and authorities (including managerial points of

. contact for specific topical areas) e ' Major or unique fire hazards as identified in the FHA l

e Post-fire safe shutdown analysis methodology and logic, and an outline of post-fire safe shutdown procedures and operator locations and responsibilities e Specific unique regulatory commitments in the areas of fire protection or post-fire safe shutdown e ~ Licens6a procedures for control of modifications and procedure changes e A listing of recentlicenseefire protection / post-firesafe shoidown self-assessments,and the salient results of these self-assessments.

PRA Process At least two and one half months before the inspection start date, the team leader will direct the PRA analyst to conduct the PRA process (Appendix C).

General Team Mamber Pranaration/Deve!anment of Individual Insoection Plan Inouts.

General topical areas requiring team member review are: the power plant's design, layout, and equipment configuration; the current licensing basis (i.e., fire protection regulatory framework); and the licensee's strategy / methodology for accomplishing post-fire safe shutdown conditions. Additionally, prior to the site visit (and using any modification packages obtained during the information gathering visit), the team members should become knowledgeable of plant design changes or modifications implemented since the plant's post-fire safe shutdown capabilitywas originally reviewed and approved by the staff.

The team members should determine the plant's current post-fire safe shutdown licensing basis through review of the staff's safety evaluation report (SER) on fire protection, the plant's operating license, Updated Final Safety Analysis Report (USAR), approved exemptions / deviations, and inspection reports and enforcement actions issued by the NRC.

The team members should also, before the inspection, examine the plant's methodology for accomplishhg post-fire safe shutdown conditions. This will be accomplished through a review of plant specific documents, calculations, and analyses including the Updated Final Safety Analysis Report (USAR), the latest version of the Fire Hazard Analysis (Fi; .),

the latest version of the Post-fire Safe Shutdown Analysis (SSA), fire protection / post-fire safe shutdown related 10 CFR 50.59 reviews, plant P&lDs, and emergency / abnormal operating procedures. This effort will determine:

H-2

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 e . The licensee's methodologyfor achieving safe shutdown conditionsin the event of fire in any area of the plant, i e The systems credited by the licensee (as surviving the fire and therefore available) for l accomplishing required shutdown functions (e.g., reactivity control, reactor coolant make-up, decay heat removal),

e . The support system requirements of each shutdown system, and

-* The licensee's approach for identifying and resolving associated circuits of concem.

This electrical review should consider the validity of assumptions and boundary conditions used in the performance of the analyses.

. Further, the team membem should select a minimum of three fire protection / post-fire safe

' shutdown modification packages implemented since the_ plant's initial fire protection validaticn inspection (IP 64100) for detailed review during the site visit. j And lastly, the team members should assess the historical record of plant-specific fire protechon issues through review of plant specific documents including: previous NRC inspection Reports, the results of intemal audits performed by the plant (e.g., self assessment including triennial inspections, Quality Assurance audits), Licensee Event Reports (LERs) submitted in accordance with 10 CFR 50.73, and Event Notifications submitted in accordance with 10 CFR 50.72.

The team members will develop individual inspection plan inputs.

Team Develoomentof a FinalInsoection Plan. Upon completion of the PRA analysis and receipt of the team member inspection plan inputs (approximately one month before the inspection start date), the team leader will organize a two day team meeting at NRC Headquarters or in the regional office to finalize the inspection plan.

The PRA analyst will present his analysis results. The regional inspector will discuss the fire protection regulatory history of the subject reactor plant / site, the licensee's engineering organization (and its working relationship to the operating organization), the engineering organization'sadministrativeprocedures, types of engineering and operationaldocuments

. used by the licensee, past fire protection inspection history, and a short synopsis of the fire

- protection licensing basis of the reactor plant.

H-3

DRAFT .FOR PRAIRIE ISl_AND INSPECTION April 6 '1998 Pre-insoection Conference Call with Licensee Staff. Upon completion of the in-office preparation team meeting, and in conjunction with the regional inspector and resident inspector, the team leader will conduct a conference call with the licensee staff discussing-

'o ' Inspection scope and schedule of onsite activities l~ * ~ Number of team members and preferred office space location

• Documents to be made available in the team office space during the inspection

, (including licensee staff organization charts and phone lists, station one-line and three-I line wiring diagrams, selected P&lDs, significant design change packages, Fire Hazards Analysis, Post-fire Safe Shutdown Analysis,10 CFR 50.59 evaluations, GL 86-10 evaluations, etc.)

.* Advance arrangements for reactor site access, including radiation protection training, security, safety and fitness for duty requirements.

• The availability of knowledgeable operating and engineering organization personnel to be available as technical points of contact / escorts during the inspection

• Arrangementsfor a fire event walk-through simulation or a drill. The team leader and plant representatives should discuss issues such as the selection of a fire scenario, the type of shutdown to be conducted (redundant train, attemative or dedicated), the facilities to be used (e.g., actual reactor plant, onsite simulator), the availability of qualified off-watch personnel, and the stationing of observers. Typically the scenario of the walk-through sirnulation or drill will be unannounced to plant personnel.

Site Access Letter. Approximately one month before the first onsite period the team leader's immediate SES supervisor will issue a site access request memorandum to the Administrative Management Branch of the regional office's Division of Resource Management and Administration. The letter will be issued in accordance with NRR Office Letter 904, Revision 1 " Unescorted Access at Nuclear Power Sites," and will specify which

- team members will and will not require escorted access within the reactor plant protected '

area (typically technical specialist contractor personnel will require escort).

Entrance Meetina/FirstWeek of Inspection / Debrief The first week of inspection will begin with an entrance meeting with licensee representatives, an plant layout /equipmentlocation familiarization tour, and up to four hours of plant-specific site access training for some or all team members, as needed to gain unescorted plant access. During the entrance meeting the team members will be introduced to the licensee staff / technical counterparts, and the team will describe the scope of the inspection (including systems and scenarios selected for special emphasis), the planned schedule of inspector activities (including expected working hours, pre-planned plant / system walkdowns, and exit meetings), and plant locations expected to be visited.

H-4 J

i DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 A possible division of activities between the first and second week of inspection could have the following structure:

First Week: Fire Protection Program Administration Fire Protection Systems and Features Post-fire Safe Shutdown Capability Fire Protection Program Management Processes Second Week: Follow-up Inspection from First Week l Post-fire Safe Shutdown Capability implementation (walk-through simulations)

Detailed Review of Fire Protection Feature and Post-fire Safe Shutdown Modification Packages (configuration management)

Potential Fire Related Vulnerabilities During both the first and second weeks of inspection the team leader should keep regional management informed of any potential operability concerns which are developed by the team. Normally a short debrief will be held with licensee representatives at the end of the first of two onsite inspection weeks (if it is decided to end the inspection after one week, the team will conduct a formal exit meeting). During this meeting the licensee will be briefed on the team's most important current issues and findings.. The licensee should be reminded that the findings are preliminary until reviewed by NRC management and the inspection report is issued. The licensee should be briefed regarding team information needs for the second week of inspection. The team leader will notify regional managers regarding any items which appear to require immediate followup.

In-office ReviewWeek. During an offsite week of in-office review, the team members will assess the first weeks results and prepare revised lines of inquiry for the second onsite week of inspection. These lines of inquiry will include the in-depth inspection elements for the primary objectives listed in Section 01 of this procedure, and reactive inspection of issues arising during the first week of inspection.

Second Week of Insoection/ExitMeeting. During the second week the team will come to final conclusions regarding the capability of the licensee / reactor plant to safely cope with fire events and associated reactor transients. Regional managers should be notified regarding any items which appear to require immediate followup. An exit meeting will be held with licensee representatives at the end of the second onsite inspection week.

However, as with all exit meetings, the licensee should be reminded that the findings are preliminary until reviewed by NRC management and the inspection report is issued.

H-5

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 Insoection Reoort Development. The inspection report will be developed over a two to three week period following the final exit meeting, and will normally be issued by SPLB/NRR. within 6 weeks of the exit meeting. The report should document what was reviewed, noted licensee strengths and weaknesses, the safety significance of any deficiencies,and the regulatory /licensirg basis of the findings. The report should include conclusions drawn, references and a list of person's contacted. For each finding, the report should identify each finding, describe the finding, related technical and regulatory requirements, safety significance and related references. IMC 0610, Inspection Reports" contains guidance on the preparation of inspection reports, and IMC 2901, " Team inspections"provides guidance on coordinating inspection report development within NRR and the regional offices.

Insoection Followuo. Inspection followup responsibilities will be assigned by FPES/SPLB on a case-by-case, issue-by-issue basis. Inspection followup activities will generally be conducted by the regional offices with support from the Fire Protection Engineering Section (FPES) of NRR, as required. Any unresolved findings identified during the inspection will be tracked by FPES/SPLB. Contractor personnel can be used to participate in the followup. A conference callinvolving regional management should be held by the team )

leader within one week following the exit meeting to identify followup items. I END l

1 l

i H-6 l

l c---_-m___- _ _ _ _ - -- - - _ - - - - - - - _ _ - - - - - - - - - - - - - - . - - - _ - - - - - - _ , - -

{

L L

l DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX l FPFI PRA PROCESS TECHNICAL GUIDANCE l

Obiective 1

The purpose of this appendix is to provide a consistent process of obtaining fire risk insights for nuclear power plants scheduled for Fire Protection Functional Inspections (FPFis). Based primarily on review of Individual Plant Examinations of External Events j (IPEEEs) conducted by nuclear power plant licensees, the inspection team PRA analyst l will use this process to develop risk insights which will guide and focus FPFI team inspection efforts on the risk significant aspects of reactor plant fire protection and post-fire safe shutdown.

Backoround The review of IPEEEs and NRC IPEEE Safety Evaluation Reports and Technical ,

Evaluation Reports can provide direct and comparative insights into nuclear power plant  !

safety. Insights include identification of fire risk significant plant structures, systems, )

components (SSCs) and areas (typically including the control room, cable spreading l rooms, switchgear rooms), operator actions inside and outside the control room to establish safe shutdown conditions, and discussion of major assumptions and analytical decisions that drive fire risk results (e.g. fire propagation and fire independence judgements). Many of the key assumptionsand judgements of an IPEEE (e.g. upper limits on transient combustibles, reliability of active fire barriers, credit given for suppression i systems) can be verified via inspection.

Usefulness of PRA Information The core damage frequency (CDF) is the typical risk measure used in IPEEEs. Ranking of plant fire areas or zones by their CDF contribution can be used by inspectors to focus their inspection activities on important fire mitigation features, and risk significant SSCs.

The PRA analyst will also review items identified as very low risk contributors in contrast to established PRA experience, and evaluate those items.

PRA Process Outout/PRA Analyst Deliverables The information extracted by the PRA analyst for use by the FPFI inspection team includes fire risk significant plant areas or zones, significantfire sequences (potentially highlighting

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6.1998 previously unidentified plant design or operational vulnerabilities), SSCs, and operator actions.

Discussions of major modeling and analysis decisions (such as fire screening criteria, underlying credit given to fire suppression systems, and analytical assumptions and omissions), and lists of risk related findings or assertionswhich should be verified, clarified, quantified or otherwise validated during the onsite inspection period will be developed.

PRA Analyst Activities The PRA analyst will conduct a general review of the reactor plant IPEEE and any NRC IPEEE review SERs. This review will address IPEEE completeness, identify any unique or potentially flawed methodologies utilized by the licensee, identify those parts of the IPEEE requiring detailed review or minor requantifications,and assess tb .' credibility of the IPEEE insights and conclusions.

Following the general review, the PRA analyst will conduct a detailed review of the selected portions of the plant IPEEE. The major steps of this review process will include:

• Identification of risk significant fire areas.

The AEOD fire database (see Resources for reference) identifies the control room, switchgear rooms, cable spreading rooms, diesel generator buildings, the turbine buildings, switchyard, the containment building, the reactor building, the auxiliary building, battery rooms and service water pumphouses as potentially risk significant areas. The IPEEE should not screen out these areas without properjustification. Such justification could be an extremely low core damage frequency associated with the area (below the industry's FIVE methodology screening value.) The analyst should compare the values of the IPEEE ignition frequencies with those of the AEOD fire database.

Low ignition frequencies will need to be justified by the licensee.

Particularly important are areas or zones with redundant cable pinchpoints and/or equipmentwhich could be affected by a single fire. The identification of "pinchpoints" requires detailed information regarding the routing cf important cables. The effectiveness of this analysis process could be the subject of onsite review.  !

i e Review of screening criteria.  !

l lPEEE studies screen areas or zones from consideration based on qualitative and l quantitative screening criteria. In the Fire induced Vulnerability Evaluation (FIVE) i 1-2 1

DRAFT - FOR PRAIRIE ISl_AND INSPECTION April 6,1998 methodology, areas can be qualitatively screened only if the areas (1) contain no equipment necessary for the conduct of post-fire safe shutdown or the mitigation of the consequences of a fire, and (2) contain no equipment whose fire induced failure would require a safe shutdown. Areas for screening must be determined on a plant specific basis. Containment buildings are often screened qualitatively, and the validity of this determination should be studied.

Turbine buildings are often erroneously screened out qualitatively based on their lack of safe shutdown equipment. It must be realized that the building is significant since a fire could cause a reactor trip or loss of offsite power (LOOP), and that fires or

. explosions of turbine related systems and components could cause fire propagation to other areas.

Fire areas or zones may be screened quantitatively.if their CDF contribution falls beneath the FIVE criteria of 1E-6/ reactor-year; however, the cumulative effect of the screened areas must be accounted for in the CDF, if this effect is above the screening value.

e Determination of the underlying basis of area or zone risk significance.

The PRA' analyst should determine the underlying basis of the risk significance of reactor plant areas or zones. Examples of factors driving risk significance are fire initiation frequencies, fire damage to equipment, fire effects on human actions, quantities and distributions of in situ or transient combustibl6s, assumed fire mitigation capability, separation through distance or establishment of fire barriers between equipment and cables that provide redundant or diverse means of safe shutdown, assumptions regarding the character of random equipment failures (e.g. human error associated with failure of attemative/ remote shutdown panel equipment), and safe shutdown equipment capabilities. The PRA analyst should study the important fire transients described in the IPEEE to verify that important safe shutdown equipment credited in the transient is free of fire effects, if this is the assumption in the IPEEE.

Logicalinconsistencies within event trees (such as operator actions in areas affected by functioning, oxygen displacement type gaseous fire suppression systems) should be noted and addressed during the IPEEE review process.

l The PRA analyst will review the descriptions of areas and related equipment to determine if scenarios unidentified by the licensee can occur. The PRA analyst will attempt to evaluate the significance of these potential scenarios.

i l-3 J _ __.

DRAFT FOR PRAIRIE ISt.AND INSPECTION April 6, 1998 Fire risk can be 'under estimated when 100% reliability and effectiveness is used for active fire barriers. Also,-many licensees take reduced or no regulatory credit for

- Thermo-Lag fire wrap fire protection. Any IPEEE credit for Thermo-Lag fire wrap success should be assessed for its validity.

The'PRA analyst should identify and characterize the leading fire sequences and extract the Conditional Core Damage Probability (CCDP) to help determine the importance of mitigating equipment and operator actions.

This in-office, pre-inspection review effort may result in questions requiring PRA analyst onsite verification and validation activities in company with the inspection team's fire protection engineer, electricalengineer, reactor systems /mechanicalsystems engineer, and/or regionalinspector.

o Fire Risk Scoping Study and Generic issue Review.

The IPEEE should be reviewed for detailed coverage F 'uding plant-specificanalyses) of the issues listed in the Fire Risk Scoping Study (NUREG/CR-5088) and GI-57 and USI A-45. Issues addressed in the Fire Risk Scoping Study include control system interactions, manual fire fighting effectiveness, adequacy of analytical fire tools, adequacy of fire barriers, seismic-fire interactions, and total environment equipment survival.

For several of these issues, specific review and inspection guidance follows:

e Actuation of autosuppression on safety equipment: Inadvertent actuation of suppression on safety equipment was shown dominate the risk significance in GI-57, " Effects of Fire Protection System Actuation on Safety-Related Equipment."

Review the analysis and/or discussions associated with GI-57.

e Control systems interactions: Slow switchover from the control room to remote shutdown panel for fires which damage control can cause equipment damage.

Inspect to determine how rapid switchoveris ensured after control room evacuation.

l Independence of the control room and remote shutdown panel should be discussed.

e Manual fire fighting effectiveness: Training, equipment, standpipes, hose stations, and smoke control methods are subject to inspection. Manual brigade assessments '

must include estimates of time to get set up at the fire area, to assess the fire situation, to identify the fire source, to initiate the attack on the fire, and bring the fire under control.

fl ,

I-4 L

l p

L L

w. ._

DRAFT FOR PRAIRIE IslAID INSPECTION April 6. 1998 e Seismic / fire: Review recommendations in Fire Risk. Scoping Study (FRSS).

Consult with FPFI team men:bers on necessity of implementing recommendations.

For additional information on FRSS issues, see IPEEE modeling assumptions.

• Study of IPEEE modeling assumptions.

The PRA analyst should make every effort to utilize the professional expertise of the inspection Team Leader, Fire Protection Engineer, Electrical Engineer, and Reactor Systems /Mect.anical Systems Engineer and Regional inspector during the in-office preparation and onsite inspection phases to validate iPEEE modeling assumptions.

in assessing IPEEE modeling assumptions, the PRA analyst should consider that:

e Equipment should not be credited unless the electrical power and control cehle routings for the equipment are known to be unaffected by a fire in the area or zone under consideration. If indication is needed, then indication cable routings must be known to be unaffected by the postulated fire, o Fire door and. ventilation fire damper performance is dependent upon numerous factors including component design and service ratings, variations in plant

~ environments, adherence to plant administrative procedures, maintenance, and fire barrier component testing quality and frequency. The 100% reliability ascribed to active fire barriers (standard and unique design fire doors, ventilation fire dampers, and water curtains)in most IPEEEs is too optimistic. The utility may be required to justify high' reliability for fire barriers separating important risk areas. These barriers may be inspected to ensure they are capable of preventing fire propagatiott e IPEEEs typically assume that plant administrative transient combustible limits are met. This assumptions subjectto possible on-site inspection. The IPEEE should assume transient combustible loading at plant administrativelimits. In many cases, the IPEEE may assume that the frequency of administrative limit sized transient combustible fires is low compared to the frequency of all fires from transient combustible and transient ignition sources. The PRA analyst should consider the validity of the amount of credit taken for such an assumption. In addition, some IPEEEs may ur esiisticallyassume that combustible materials are not concentrated

'(i.e. the combustible loading is averaged over the entire floor area of the subject room or zone), it is unlikely that the non concentrated loading assumption reflects typical plant conditions.

.1 -5

l t

I DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

e IPEEEs frequently omit analysis of fire induced LOCAs (e.g. single or multiple electrical short circuits leading to the opening of PORV or SRV valves), althoug h the possibilityof such design vulnerabilitieshas been observed during NRC inspections at some reactor plants. The PRA analyst should verify that the fire-induced LOCA is included in the IPEEE, and inspectors should inspect for the mechanisms which would produce it.

• Justification must be given if the IPEEE assumes survival of equipment or components within a fire affected cabinet.

IPEEEs may assume that a fire which originatesin a cabinet will not spread beyond the cabinet, or beyond the cabinet section if the section has no penetrations.

Cabinet construction should receive validation inspection during the onsite phase to identify common pathways between cabinets, including the adequacy of sealed cabinet-to-cabinet penetrations, and construction details of barriers between cabinets. Cabinet physical separation may also be inspected.

In keeping with SNL tests (NUREG/CR-4527), large cabinet fires should be modeled. Reduction in frequency for large fires (i.e. severity factor) is acceptable providing the data is reviewed to ensure that double credit is not given for early suppression (e.g. crediting suppression of fires prior to their becoming large, and also crediting a severity factor for large fires). On-site investigation of the impact of these large fires will be performed. If it is difficult to verify the absence of double credit, utilizing a heat release rate in the mid-range of the available SNL data (e.g.

550 KW) is acceptable (without the frequency reduction).

• Human error probabilities (HEPs) should be adjusted upward for the conduct of manual recovery actions near a fire (givsn that the operators may be conducting infrequently performed operations under stress, in darkened or smoky environments). For example, operatoractions at the remote shutdown panel (RSP) would be affected by the stress associated with a control room fire and the reduced reaction time available to the operators. For operator actions conducted in remote plant locations, the PRA analyst should consider speed of accomplishment, coordination ard communication between operators, physical accessibility of equipment and feasibility of actions.

• The quality of electrical cable jackets (e.g. IEEE-383 or other ratings) impact the susceptibility of the plant to fire ignition sources. lEEE-383 rated electrical cable Jacket is a combustible. However, rated cable is designed to ignite less easily than non-rated cable. Self-ignition of unqualified cable is a potentialfire threat. The PRA I-6

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 analyst should determine the type of electrical cable jackets used in the plant in order to review fire modeling in risk significant areas, and inspect to ensure such cable jackets exists. On-site investigation of proper fusing for unqualified cable may also be performed.

e Separation may be credited to prevent fire spread between important equipment or cabling, if so, on site inspection can ensure that limits on transient combustibles exist in these areas, and that these limits are oisjed.

e Automatic detection and suppression may be credited for fire spread control. On site inspection of automaticdetection and suppression systems may be performed to ensure they are installed properly and have been adequately tested. Manual suppression equipment and onsite (and offsite, as appropriate) fire brigade capabilities are subject to inspection. In addition, negative post-fire safe shutdown impacts from fire fighting activities (such as inadvertent wetting of equipment) should be taken into consideration when crediting manual suppression.

• Planned modificationsto hardware, cable routings, and procedures may be credited in the IPEEE. The completion of such modifications should be verified during onsite inspection.

Review Resources The PRA analyst may use a variety of references to support his review. Such references include:

e A plant specific lPEEE and associated NRC Safety Evaluation Reports (SERs) or NRC contractor prepared Technical Evaluation Reports (TERs)

• The EPRI sponsored Fire Induced Vulnerability Evaluation methodology (FIVE)

• NRC document "Special Study: Fire Events - Feedback of U.S. Operating Experience -

Final Report", in memo from Charles E. Rossi to NRC management, June 19,1997 a.k.a. AEOD fire database.

• Plant specific NUREG-1150 fire analyses (LaSalle, Peach Bottom, Surry) i * " Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150"(NUREG/CR-4840).

I-7 L

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6. 1998 e NRC prepared documents"PerspectivesGained from IPEEE Fire Review"and "lPEEE Program: Preliminary insights on Resultc. Plant improvements, and implementation Strengths and Weaknesses."

e Fire Risk Scoping Study (NUREG/CR-5088) e "The Use of PRA in Risk-informed Applications, Draft Report for Comment"(NUREG-1602).

e " Preliminary Perspectives Gained From 24 Individual Plant Examination of External Events Submittal Reviews," Dec.10,1997 (Draft NUREG) e Inspection Manual Chapter 2515 Appendix C e "An Experimentallnvestigation of Intemally Ignited Fires in Nuclear Power Plant Control Cabinets, Part 1: Cabinet Effects Tests; An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant control Cabinets, Part 2: Room Effects Tests" (NUREG/CR-4527 Vols.1 and 2) e " Evaluation of Generic issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment"(NUREG/CR-5580)

END I-8

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6,1998 APPENDIX J i

FIRE PROTECTION REGUI.ATORY BACKGROUND INFORMATION This information will aid the inspector in developing an understanding of hcw current regulatory requirements and staff guidance have evolved to form the fire protection licensing basis of the specific plant to be inspecti  ;

General Design Criterion 3 (GDC 3) of Appendix A to 10 CFR 50 requires that structures, systems, and components important to safety be designed and located to minimize the probability and adverse effects of fires and explosions, that noncombustible and heat  ;

resistant material be used wherever practical, and that fire detection and suppression systems be provided to minimize the effect of fire on structures, systems, and components important to safety. In the early 1970's evaluations of compliance to GDC 3 were typically deemed adequateif the plant complied with National Fire Protection Association (NFPA) standards and recommendations of the Nuclear Energy Property Insurance Association (NEPIA). At that time, fire safety features provided for commercial nuclear power stations were very similar to those employed by conventional, fossil-fueled, electric generating stations.

Fire protection continued to be evaluated on this basis until a major fire occurred at the Browns Ferry plant on March 22,1975. The fire occurred when workers, using a candle to test for air movement, accidentallyignited polyurethane foam material they had installed to plug air leaks in a wall separating the cable spreading room from the reactor building.

The fire spread to a large bank of cable trays in the reactor building. Due to the type and quantly of combustibles involved (a large number of PVC insulated cables), the location  ;

of the fire (cable trays near the ceiling of a room with a high ceiling), and operator j reluctance to use water to extinguish fires involving electrical equipment, the fire continued  !

to bum for several hours before it was completely extinguished. Although damage was limited to a relatively small area of the plant, more than 1600 cables routed in 117 conduits j and 26 cable trays were affected. Of those,628 cables were safety related and their j damage caused the loss of a significant number of plant safety systems. While there was I

no core damage or unusual release of radioactivity, the fire caused a loss of control of all .

Emergency Core Cooling Systems (ECCS) as well as control of other redundant safety systems.  ;

investigations of the.cause and possible consequences of the Brown's Ferry fire  !

demonstrated that the occupant safety and property protection concerns of the major fire i insurance underwriters did not sufficiently encompass nuclear safety issues, particularly with regard to the potential for fire to 'cause the failure of systems and components J-1 1 i e

DRAFT FOR PRAIRIE ISt.AND INSPECTION April 6,~1998 important to safe shutdown of the reactor. These investigations also revealed several significant fire protection vulnerabilitiesincluding: (a) the apparent ease with which the fire started,(b) the hours that elapsed before it was fully extinguished, and (c) the unavailability of redundant trains of plant safety equipment. The NRC concluded that additional specdic guidance for implementing the existing fire protection regulations (GDC 3 to 10 CFR 50) was necessary. In recognition of the potential consequences of fire, and to assure that an

= adequate level of fire safety is incorporated into the overall design and operation of all nuclear power plants operating in the United States, the NRC determined that established principles of defense-in-depth would be applied in defense against fires.

To achieve the high degree of safety required for nuclear power plants, the NRC adheres l to the application of a defense-in-depth philosophy of multiple levels of safety systems.

This concept is also applicable to nuclear power plant fire safety, where defense-in-depth protection is provided by a combination of design features (fire barriers, safe shutdown system separation, fire detection systems, fire suppression systems), trained personnel, equipment, administrative controls, and procedures directed at achieving an adequate balance in:

o Preventing fires from starting; e Detecting fires quickly, suppressing those fires that occur, and limiting their damage; and e Designing plant safety systems so that a fire that starts and bums for a considerable time will not prevent essential plant safety functions from being performed.

The multiple levels of protection that are embodied in the defense-in-depth philosophy assure fire safety throughout the life of the plant by minimizing both the probability and consequence of fires. A properly designed, implemented, and maintained nuclear plant fire protection program provides reasonable assurance, through a defense-in-depth approach, that the probability of fire is minimized, and that the effects of fire, should one occur, will not prevent the pen'ormance of necessary safe shutdown plant functions.

- To assist licensee's in preparing their fire protection programs, in .May 1976, the NRC issued Auxiliary and Power Conversion Systems Branch, Branch Technical Position 9.5-1 )

(BTP 9.5-1)" Guidelines for Fire Protection for Nuclear Power Plants," and requested each  ;

licensee to' provide an analysis that divides the plant into distinct fire areas and

.. demonstrates that redundant trains of equipment required to achieve and maintain cold  !

L ' shutdown conditions of the reactor were adequately protected from fire damage (post-fire l J-2 L

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6. 1998 safe shutdown). The guidance contained in BTP 9.5-1, however, was only relevant to plants which filed an application for construction after July 1,1976.

In an effort to. establish suitable defense-in-depth fire protection programs, without significantly affecting the design, construction, or operation of older plants that were either already operating or well past the design stage and into construction,in September of 1976 the NRC modified the guidelinesin BTP APCSB 9.5-1, and issued Appendix A to BTP 9.5-1 " Guidelines for Fire Protection for Nuclear Plants Docketed Prior to July 1,1976". This guidance proviided acceptable alternatives in areas where strict compliance with BTP 9.5-1 would require significant modifications. Additionally,the NRC informed each plant that the guidancein Appendix A would be used to analyz'e the consequences of a postulated fire within each area of the plant, and requested licensees to provide results of the fire hazards

' analysis performed foi each unit and the technical specifications for the present fire

. protection systems. The analyses submitted by each operating plant in response to this

, request, were then reviewed by the staff against the guidance contained in Appendix A to BTP 9.5-1. The staff also conducted plant visits to examine the relationship of structures, 1 systems and components importantto safety with fire hazards, the potential consequences I

of fire, and the associated fire protection features.

SupplementaryFireProtectionProgramManagementand AdministrationGuidelines: After reviewing a number of licensee responses to BTP 9.5-1 and Appendix A to BTP 9.5-1, the staff determined that additional guidance on the management and administration of fire protection programs was necessary, and in mid-1977, issued a document titled: " Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls, and Quality Assurance." as GL 77-002. This document presents specific criteria used by the staff in the review of specific aspects of a licensee's fire protection program including: fire protection organization, training of the fire brigade, control of combustibles and ignition sources, fire fighting procedures and quality assurance.

10 CFR 50.48 and Appendix R to 10 CFR 50: By the late 1970s, the majority of operating plants had completed their analyses and had implemented most of the fire protection program guidance of Appendix A to the BTP. In most cases, the modifications proposed by licensees as a result of these analyses were found to be acceptable by the NRC. In certain cases, however, technical disagreements developed between certain licensees and the' NRC staff, and several plants refused to adopt certain staff recommendations described in Appendix A. Even though a given issue might be contested by only a few plants, the NRC determined that the issues were a potential generic problem, and rulemaking was deemed the appropriate vehicle for resolving these issues and )

implementing Commission policy with respect to fire protection. Therefore, to resolve ,

areas of disagreement,the NRC amended its regulations, and in November 1980 issued l i

J-3  ;

......a...~... . . . - .. .

1 I

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 l

10 CFR 50.48, " Fire Protection" and Appendix R, " Fire Protection Program for Nuclear Power Plants Operating Prior to January 1,1979." Appendix R sets forth Commission policy with respect to fire protection requirements.

By letter dated November 24,1980, the Commission informed all power reactor licensees with plants licensed prior to January 1,1979, of new fire protection regulations contained l

in 10 CFR 50.48 (to ensure each plant had a fire protection program) and Appendix R to

10 CFR 50 (to ensure satisfactory resolution of disputed items).' Attached as enclosures -

to this letter were a copy of the Federal Reaister Notice 45 FR 76602 (Enclosure 1) and .

a summary of open BTP items concerning the facility (Enclosure 2), with each open item 4 described in terms of a corresponding section of Appendix R. In its letter the Commission stated that the provisions of Appendix R can be divided into two categories:

e : Those provisions of Appendix R that are required to be backfit in their entirety by the new rule, regardless of whether or not attemativesto the specific requirements of these sections have been omviously approved by the NRC staff under the BTP review-process. These requirements are set forth in Sections Ill.G, Fire Protection of Safe Shutdown Capability, Ill.J, Emergency Lighting, and lll.0, Oil Collection Systems for Reactor Coolant Pump.

e Requirements concerning the "open items" of previous NRC staff fire protection reviews. (An open item is defined as a fire protection feature that has not been previously approved by the staff as satisfying the provisions of Appendix A to Branch Technical Position 9.5-1, as reflected in a fire protection safety evalcation report).

Initial validation inspections for compliance to the requirements of Appendix R. revealed that certain licensees had not considered Section Ill.L (Altemative and Dedicated Shutdown Capability) when attempting to meet Section Ill.G. Specifically, where the protection of redundant trains of equipment necessary to achieve post-fire safe shutdown can not be assured, Section Ill.G.3 requires an alternative or dedicated shutdown capabilitywhich is independentof the cables, systems, or components in the fire affected area. The acceptance criteria for Section Ill.G.3 are listed in Section Ill.L. Although 10 CFR 50.48(b) does not specifically include Section Ill.L with Sections Ill.G, J, and O of Appendix R as (backfit) requirements applicable to all power reactors licensed to operate prior to January 1,1979, Appendix R, when read as a whole (as evidenced by a Court of Appeals Decision on Appendix R)does mean that Section Ill.L applies to the alternative safe shutdown opon: under Section Ill.G.

It is important to note that with the ev.ception of Sections Ill.G, J, O, and L, (which were backfit to all plants regardless of previous approvals granted by the staff), those portions J-4

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 of Appendix A to the BTP that were previously accepted by the staff remained valid.

Therefore, Appendix R does not, by itself, define the fire protection program of any plant.

For plants licensed before January 1,1979, (pre-1979 plants) the fire protection program is defined by Appendix A to the BTP, the aoolicable portions of Appendix R (i.e. Sections Ill.G, J, and O and open issues resulting from BTP 9.5.1 Sopendix A reviews), and any additional commitments made by the licensee, as states in conditions of its operating license.

Fire Protection Guidelines for Plants Licensed After January 1,1979,: Appendix R was not required to be implemented by plants that were licensed to operate after January 1,1979.

Rather, fire protection programs at these later plants were typically reviewed against the licensing review guidelines presented in NUREG-0800, " Standard Review Plan" (SRP)

Section 9.5.1," Fire Protection Program." This document consolidates the guidance of BTP

APCSB 9.5-1, Appendix A to BTP APCSB 9.5-1, the Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance (GL 77-002),

and the criteria of Appendix R to 10 CFR 50.

Since NUREG-0800, SRP 9.5.1 consolidates previous guidance issued by the staff, it may be considered as a single reference document which describes the fedures of an acceptable fire protection program. As such, while not a regulatory requirement, licensees of " older"(i.e., pre-1979) operating plants may also implement the guidance contained in Section 9.5.1 of the SRP as a means of establishing a fire protection program that complies with 10 CFR 50.48 and GDC 3.

Certain plants licensed to operate after January 1,1979, however, may have been required to implement specific sections of Appendix R (typically sections Ill.G., Ill.J. and Ill.O) as specified in their" Fire Protection" license condition. Additionally, note that with respect to the fire protection regulation (10 CFR 50.48), only paragraphs (a)(requiring plants to have a fire protection plan that satisfies Criterion 3 of Appendix A to 10 CFR 50) and (b)

- (requiring plants to complete all fire protection modifications needed to satisfy Criterion 3 of Appendix A to 10 CFR 50 in accordance with the provisions of their operating licenses) apply to plants licensed after January 1,1979.

Plant-specific conditions may preclude compliance with one or more of the provisions specifsd in the regulation.When the fire hazards analysis shows that adequate fire safety can be provided by an alternative approach (e.g., the use of a 1-hour fire rated barrier where a 3-hour barrier is specified) licensees that are required to meet Appendix R to 10 CFR Part 50 (i.e., those licensed prior to January 1,1979) may request NRC approval of an exemption from the technical requirements of Appendix R to 10 CFR Part 50.

Requests for exemption must include a sound technical basis that clearly demonstrates J-5 4

DRAFT < FOR PRAIRIE ISLAND INSPECTION April 6, 1998-that the fire protection defense-in-depthis appropriately maintained and that the exemption is technically justified (i.e., provides an equivalent level of safety).

Exemptionsfrom fire protection requirements may be requested under 10 CFR 50.12. As part of its exemption request the licensee must demonstrate, by means of a detailed fire hazards' analysis, that existing protection or existing protection in conjunction with proposed ' modifications will provide a level of safety equivalent to the technical requirements of the regulation. Generally,the staff will accept an alternate fire protection configuration on the basis of a detailed fire hazards analysis if:

e The alternate approach ensures that one train of equipment necessary to achieve hot shutdown from either the control room or emergency control stations is free of fire damage;

.e The alternate approach ensures that fire damage to equipment necessary to achieve cold shutdown is limited so that it can be repaired within a reasonable time (minor repair using components stored on the site);

e Fire-retardant coatings are not used as fire barriers; and e Modifications required to strictly meet the regulation would not enhance fire protection safety levels above that provided by either existing or proposed alternatives / modifications.

The staff has also accepted an alternative fire protection configuration when, on the basis of a detailed fire hazards analysis, the licensee can demonstrate that modifications required to strictly meet the regulation would be detrimental to overall facility safety, the altemate configuration satisfies the four criteria above, and the altemate configuraian provides an adequate level of fire safety.

Plants licensed after January 1,1979, have fire protection programs that were reviewed and' approved under the licensing review guidance contained in NUREG-0800, SRP Section 9.5.1, and, therefore, typically are not subject to the specific regulatory requirements of 10 CFR 50.48 and Appendix R. For these plants, a license amendment, or NRC staff approval of a deviation from a commitment to a specific NRC guideline, is necessary when an alternate approach (i.e., an approach different from that specified in the guidelines) is used to satisfy the requirements of GDC 3. As with an exemption, however, the licensee must submit a sound technical justification of equivalent safety for the attemate approach for NRC review and approval, along with its license amendment or

- deviation request.

J-6

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 it should be noted that exemptions and deviations provide a method of implementing altematives to fire safety features specified in. regulatory requirements (Appendix R) and staff licensing review guidance documents (NUREG 0800 SRP 9.5.1). Since approval is based on staff review of plant-specific configurations, the exemption process provides

[

licensees with a flexible means of satisfying the intent of certain requirements, without l reducing the overall level of protection that would be achieved through strict compliance with the regulation.

The operating licenses of plants licensed before January 1,1979, typically contain a condition requiring implementation of fire protection modifications committed to by the licensee as a result of reviews conducted under Appendix A to BTP APCSB 9.5-1. These license conditions were added by license amendments. The fire protection license conditions for plants licensed after January 1,1979, however, vary widely in scope and content. Some only list open items that must be resolved by a certain date or event (e.g.,

prior to start-up or prior to first refueling outage), some reference a commitment to meet sections of Appendix R, and some reference the Final Safety Analysis Report (FSAR) and/or the staff's fire protection safety evaluation report (SER).

License conditions do not specify when a licensee may make changes to the NRC approved program without requesting a license amendment. If the fire protection program committed to by the licensee is required by a specific license condition, or is not part of the FSAR for the facility, the provisions of 1J CFR 50.59 (Changes, Tests, and Experiments) may not be applied to make changes without prior NRC approval. Thus, licensees may be required to submit license amendment requests even for relatively minor changes to the fire protection program.

In GL 66-M and GL 88-12, the NRC requested licensees to adopt a standard license condite . Gr fire protection. In this manner, the fire protection program, including the systems, the administrative and technical controls, the organization, and other plant features associated with fire protection would be on a consistent status with other plant I features described in the FSAR. As part of this process, the NRC requested licensees to incorporate their fire protection program that had been approved by the NRC, including the fire hazard analysis and major commitments that form the basis for the fire protection "

. program, by reference into their FSAR. Once the process was completed, and the standard license condition implemented, the provisions of 10 CFR 50.59 would apply directly for changes that e licensee desired to make in the fire protection program. In this context, the determination of the involvement of an unreviewed safety question defined in 10 CFR 50.59 (a) (2), would be made based on the " accident...prevbusly evaluated" (i.e.,

the postulated fire in the Fire Hazard Analysis for the fire area affected by the change).

J-7

April 6, 1998 DRAFT FOR PRAIRIE ISLAND INSPECTION:

Licensees that have adopted the standard license condition for fire protection may make changes to the approved fire protection program without prior approval by the Commission, provided those changes do not adversely affect the ability to achieve and maintain safe I shutdown in the evant of a fire, or involve an unreviewed safety question. As with other changes implemented under 10 CFR 50.59, the licensee must maintain a current record of all such changes and report all changes to the approved program annually to NRC.

Additionally,if the operating license is amended to include this standard license condition, the licensee may request an amendment to delete the, now redundant, non-administrative control portions of the technicalspecifications. Also, under the standard license condition, l temporary changes to specific fire protection features, which may be necessary to accomplish maintenance or modifications,are acceptable provided interim compensatory

. measures (e.g., fire watches) are implemented.

Examples of issues which would require an exemption (from Appendix R) or deviation (from SRP Section 9.5.1, NUREG 0800) are modifications to:

e The level of separation and protection provided for redundant trains of SSD equipment; e Automatic detection systems; e Automatic suppression; and e The SSD methodology approved in the SER.

As stated above, to provide basic guidance for implementing the NRC's fire protection requirements the following documents were developed by the staff:

e Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants," - Applicable to plants docketed after July 1,1976, (May 1976).

e Appendix A to BTP APCSB 9.5-1, " Guidelines for Fire Protection for Nuclear Plants Docketed Prior to July 1,1976,"- Applicable to plants already operating or under construction before July 1,1976 (August 1976).

e Standard Review Plan, Section 9.5.1, " Guidelines for Fire Protection for Nuclear Power i Plants" (July,1981) - Used by the staff during the initial licensing review process for some plants. Incorporates the guidance of BTP APCSB 9.5-1, Appendix A to BTP ,

APCSB 9.5-1, and criteria of Appendix R to 10 CFR 50.  !

l l

J-8 1

E I

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 Staff reviews and inspections of licensee conformance to established criteria revealed cases where the licensees had misinterpreted certain requirements in a way that could result in unacceptable fire protection. Some of the more salient issues found to require further clarification include:

e Allowable repairs to achieve safe shutdown; e Protection of safe shutdown capability from fire damage to associated non-rafety circuits; e Alternative shutdown instrumentation;

• Alternative shutdown capability; e Fire barriers and penetration seals; e Use of partial area coverage detection and suppression systems; e Reactor coolant pump oil collection system capacity; e Use of low pressure injection systems (ADS /CS/LPCI) for alternative shutdown; e Allowable time to achieve safe shutdown; and e Adequacy of electrical isolation provided for remote shutdown panels.

To address these and other issues, and develop a common understanding between licensees and NRC reviewers and inspectors, a number of clarification and regulatory position documents were promulgated by the staff. Notable examples include:

e " Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," (issued as GL 77-002 in August 1977) provides supplemental guidance to Appendix A to BTP APCSB 9.5-1 regarding a licensee's fire protection organization, fire brigade training, control of combustibles and ignition sources, fire fighting procedures and quality assurance.

e GL 81-12 (February 20,1981) restated the requirement for each licensee to reassess areas of the plant where redundant trains of systems necessary to achieve and maintain hot shutdown. are located, defined the staff position on safe shutdown J-9

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 capability, and requested additional information concerning those areas of the plant requiring an alternative shutdown capability.

• Clarification GL 81-12 (March 22,1982) provided additional clarificatbn in response to staff review of licensee responses to GL 81-12, and defined associated circuits of-concern.

e NRC internal memorandum,from L.S. Rubenstein,to R.J. Mattson, December 3,1982, "Use of the Automatic Depressurization System (ADS) and Low Pressure injection (LPCI) to Meet Appendix R, Attemate Shutdown Goals," stated that licensee proposals to use' ADS and LPCl for alternate shutdown would be considered as a request for exemption from Section Ill.L of Appendix R, and that the staff intended to grant such exemptions.-

e NRC internal memorandum, from L'S. Rubenstein, to R.J. Mattson, March 16,1983,

" Revision Statement of Staff Position Regarding Source Range Flux, Reactor Coolant Temperature and Steam Generator Pressure Indication to Meet Appendix R," accepted the use of exit core thermocouple as an acceptable alternative to the use of hot-leg temperature RTDs.

e GL 83-33 provided the following staff positions on certain requirements of Appendix R to 10 CFR Part 50:

e Detection and automatic suppression; e Fire areas; e Structural steel related to fire barriers; l

i e Fixed suppression systems; e Intervening combustibles; e Transient fire hazards.

'e NRC internal memorandum from D.G. Eisenhut to John Olshinski, February 16,1984,

' " Oil Collection System Reactor Coolant Pumps, Florida Power and Light Company, St

• Lucie Unit 2, Docket No. 50-389,"provided the NRC position on the capacity of the oil collection system container required by Section 111.0 of Appendix R.

J-10 i

L. .: --

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 e IN 84-09," Lessons Learned From NRC Inspections of Fire Protection Safe Shutdown Systems (10 CFR 50, Appendix R)": provided information related to analyses and modifications for implementing the requirements of 10 CFR 50, Appendix R with respect to the following issues:

• Fire areas; e Fire barrier testing and configuration;

• Protection of equipment necessary to achieve hot shutdown; e Licensee reassessment for conformance with Appendix R; e Identification of safe shutdown systems and components; e Combustibility of electrical cable insulation; e Detection and automatic suppression; e Applicability of 10 CFR 50, Appendix R, Section Ill.L; e Instrumentation necessary for alternative shutdown; e Procedures for alternative shutdown capability; e Fire protection features for cold shutdown systems; e RCP oil collection systems.

e IN 85-09,"IsolationTransfer Switches and Post-Fire Safe Shutdown Capability," alerted licensee's of potential deficiencies in the electrical design of isolation / transfer switches which do not provide redundant fuses upon transfer.

• GL 86-10," Implementation of Fire Protection Requirements," April 24,1986. Certain ,

licensees disagreed with, or found it difficult to implement, the some of the ]

interpretations provided in GL 83-33. To pursue the matter with senior NRC l management, the industry formed the Nuclear Utility Fire Protection Group. l Subsequently, by direction of the Executive Director for Operations, the staff formed i l

the Steering Committee on Fire Protection Policy to "... examine all licensing, inspection i and technicalissues and to make policy recommendations for expediting Appendix R J-11  !

l DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998

)

implementation and for assuring consistent levels of fire protection at all plants." l i Disagreements in the implementation of interpretations provided in GL 83-33 were ultimately resolved by issuance of GL 86-10, which consists of the most complete interpretation of the fire protection regulatoryrequirements. It contains information on:

• Documentation required to demonstrate compliance

• Applicable quality assurance requirements

• NRC notification of deficiencies e incorporation of fire protection program into FSAR

• Standard fire protection license condition

• Interpretations of Appendix R, including:

• Process monitoring instrumentation

• Repair of cold shutdown equipment

• Fire damage

• Fire area boundaries

• Automatic detection and suppression

• Alternative or dedicated shutdown capability

• Appendix R questions and answers. To assist the industry in understanding NRC requirements, and improve the staff's understanding of the industry's concerns, a series of workshops were conducted in each NRC Region. The questions and answers presented NRC positions as responses to the questions posed by the industry during these workshops.

• GL 88-12, " Removal of Fire Protection Requirements from Technical Specifications,"

gave plants additional flexibility to make changes to their fire protection programs.

Through the implementation and adoption of a standard license condition, a licensee can make changes to its fire protection program without prior notification of the NRC ,

l in accordance with the provisions of 10 CFR 50.59, provided the changes do not J-12 I l

1

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 adversely affect the reactor plant's ability to achieve and maintain post-fire safe shutdown.

Both GL 86-10 (Section F) and GL 88-12 addressed the subject of removing certain fire l ~ protection requirements from the technical specifications and updating the FSAR to

! incorporate the fire protection' program. The intent of this guidance is to enable licensee's to evaluate and justify modifications to fire protection systems via the 10 CFR 50.59 process, as opposed to having the NRC provide specific review and approval for each fire protection change which impacts technical specifications or license commitments.

END

]

l

)

l l

4 J-13 I

l l

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX K THERMO-LAG AMPACITY DERATING BACKGROUND INFORMATION The Thermo-Lag vendor,TSI, has documented a wide range of ampacity derating factors that were determined by testing. For example, between 1981 and 1985, the vendor provided test reports to licensees that document ampacity derating factors for cable trays that range from 5.3 to 12.48 percent for 1-hour barriers and from 16.15 to 20.55 percent for 3-hour barriers. On October 26,1986, TSI informed the NRC and its customers by

Mailgram that, while conducting special investigation in September 1986, at the Underwriter Laboratories, incorporated (UL), it found that the ampacity derating factors for Thermo-Lag 330-1 barriers were greater than previous tests indicated (28.04 percent for 1-hour barriers and 31.15 percent for 3-hour barriers). The NRC leamed that UL performed duplicate cable tray baseline tests using a longer stabilization period after the final current adjustment and obtained higher derating factors (36.1 percent for 1-hour barriers and 38.9 percent for 3-hour barriers). UL gave these results to the vendor, but they were not submitted to the NRC or to licensees. While reviewing tests which had been conducted at Southwest Research Institute (SwRI) in 1986, the staff learned that the ampacity derating factor for the tested configuration was 37.4 percent for a 1-hour Thermo-Lag barrier. The test procedures and test configurations differ for each of the aforementioned tests. Therefore, the results from these different ampacity tests may not be directly comparable to each other, in IN 92-46 (Thermo-Lag Materials Report), the NRC informed licensees that a licensee also discovered a mathematicalerror in the calculation of the ampacity derating factor as published in a IndustrialTesting Laboratories (ITL) test report. A preliminary assessment of the use of a lower-than-actualampacity derating factorindicates thatThermo-Lag 330-1

- barrier installations may allow cables to reach temperatures that exceed their ratings, which could accelerate cable aging.

The staffis also concerned that some licensees have not adequately reviewed the results of ampacity derating test results to determine if the tests are valid and if the test results

-apply to their plant designs. The staff ampacity derating concerns apply to the use of L Thermo-Lag material on electrical raceways both as fire barriers to protect the safe shutdown capability and as barriers to create physical independence between electrical

- systems.

L On May 13,1994, the NRC issued IN 94-34,"Thermo-Lag 330-660 Flexi-BlanketAmpacity Derating Concerns"to inform licensees that no' ampacity derating testing or analysis had

been performed by the vendor, Thermal Science, Inc., (TSI) for the 330-660 Flexi-Blanket L

l K-1 h

l l

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998 fire barrier system. The staffis concerned that some licensees may not have adequately assessed or conducted appropriate tests to determine ampacity derating factors to apply to their plant designs, and as a result may have used non-conservative ampacity derating factors for the electrical raceway design.

NRR Electrical Engineering Branch (EELB) Safety Evaluation Reports or Technical Letter Reports, and licensee documents referenced therein, constitute the NRR review and approval of the licensee's ampacity derating tests or analyses for installed Thermo-Lag fire barrier configurations.

END i

K-2

r-)

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX L STAFF POSITION ON FIRE ENDURANCE RATING TESTS It is the staffs position that fire endurance ratings of building construction and materials are

- demonstrated by testing fire barrier assemblies in accordance with the provisions of the applicable sections of NFPA 251, " Standard Methods of Fire Tests of Building Construction -

and Materials," or ASTM E-119, " Fire Test of Building Construction and Materials."

Assemblies which meet specified acceptance criteria when exposed to a standard test fire for a specific period of time (e.g., unexposed side temperature rise, and hose stream-impingement) are considered to have a specific fire resistance rating.

Enclosure 1 to GL 86-10, interpretations of Appendix R, provided additional guidance with

' respect to the term " free from fire damage." Interpretation 3, " Fire Damage," states, "In promulgating Appendix R, the Commission has provided methods acceptable for assuring that necessary structures, systems, and components are free from fire damage (see Section Ill.G.2a, b, and c), that is, the structure, system or component under consideration is capable of perforrning its intended function during and after the postulated fire, as needed."

GL 86-10, Response 3.2.1, also stated that, "The resulting 325 *F cold side temperature criterion is used for cable tray wraps because they perform a fire barrier function to preserve the cables free from fire damage. It is clear that cable that beains to dearade at 450 *F is free from fire damage at 325 *F" (emphasis added). In addition, the staffs response stated that, "for newly identified conduit and cable trays requiring such wrapping new materials which meet the 325 'F criterion should be used, or justification should be provided for the use of material which does not meet the 325 *F criterion. This may be based on an analysis demonstrating that the maximum recorded temperature is sufficientiv below the cable insulation ignition temperature" (emphasis added).

In 1984 Appendix R workshops held with industry, and later in GL 86-10, the staff provided guidance related to fire barriertesting " Acceptance Criteria."and the cold side temperature

limits.' in GL 86-10 the staff stated that the acceptance criteria contained in Chapter 7 of l

NFPA 251, " Standard Methods'of Fire Tests of Bu!! ding Con'struction and Materials,"

pertaining to non-bearing fire barriers was applicable to cable tray fire barrier wraps.

' On March 25,1994, the NRC issued Supplement 1 to GL 86-10. Supplement 1 clarified fire endurance testing acceptance criteria and guidance for the fire barrier systems use to

- separate redundant safe shutdown equipment within the same fire area.

L-1 g

i _ ____._.___.________._____J

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 END I

L-2

T l

l DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 APPENDIX M The Fire Protection Functional Inspection Assessment Tree is included for the use of the inspection tearn leader. Thr purpose of the tree is to facilitate intra-team and team-management communication of plant fire protection performance status during the preparation, onsite inspection and inspection followup phases of the FPFl.

Although a basic four color coloration scheme is an integral part of the tree, no specific coloration hierarchy or rules for the tree are mandated within this Temporary Instruction.

This is left to the judgement of the team leader. For example, it should not be assumed that a red block under the Fire Protection Program Administration block automatically forces that block to also be red. Conversely,it is possible that a single red block under the Post-fire Safe Shutdown Capability block may result in the team leader displaying the Post-fire Safe Shutdown Capability block as red.

L-3

DRAFT FOR PRAIRIE ISLAND INSPECTION April f.1998 APPENDIX N DEFINITIONS I

Definitions for some of the terms commonly used in U.S. commercial nuclear power plant fire protection are provided below.

,[A large number of important U.S. reactor plant post-fire safe shutdown terms are not included below (e.g. fire zone, redundant, alternative shutdown, associated circuit). Their definitions reside in regulatory documents such as 10 CFR 50 Appendix R and various Generic Letters and Information Notices. These regulatory definitions can be lengthy and have a "by example" format, and are therefore better considered in the context of the original definition source document.]

Anoroved - tested and accepted for a specific purpose. or application by a nationally recognized testing laboratory.

Automatic - self-acting, operating by its own mechanism when actuated by some impersonal influence such as a change in current, pressure, temperature, or mechanical configuration.

Combustible Matenal - material that does not meet the definition of non-combustible.

Control Room Comolex - the zone served by the control room emergency ventilation system (see NUREG 0800, Section 6.4, " Habitability Systems").

Exoosure ~ ire - A fire in a given area that involves either in situ or transient combustibles and is extemal to any structures, systems, or components located in or adjacent to that same area. The effects of such fire (smoke, heat, or ignition) can adversely affect those structures, systems or componentsimportantto safety. Thus, a fire involving one train of safe shutdown equipment may constitub an exposure fire for the redundant train located in the same area, and a fire involving combustibles other than either redundant train may constitute and exposure fire to both redundant trains in the same area.

- Fire Area - an area sufficiently bounded to withstand the hazards associated with the area and, as necessary, to protect important equipment within the area from a fire outside the area.

I M-1

E l-DRAFT FOR PRAIRIE ISLAND INSPECTION -April 6, 1998 l

l Fire Barrier- those components of construction (walls, floors, and their supports), including beams, joists, columns, penetration seals or c losures, fire docrs, and fire dampers that are rated by approving laboratories in hours of resistance to fire and are used to prevent the spread of fire.

Fire Resistance Rating - The time that materials of a test assembly have withstood a standard ASTM E-119 fire exposure and have successfully met the established test acceptance criteria.

Fire Stoo - a feature of construction that prevents fire propagation along the length of

. cables or prevents spreading of fire to nearby combustibles within a given fire area or fire zone.

Fire Briaade - the team of plant personnel assigned to firefighting and who are equipped for and trained in the fighting of fires.

^

Fire Detector - a device designed to automatically detect the presence of fire and initiate an alarm systems and other appropriate action (see NFPA 72). Some typical fire detectors are classified as follows:

Heat Detector - a device that detects a predetermined (fixed) temperature or rate of temperature rise.

Smoke Detector- a device that detects the visible or invisible products of combustion.

Flame Detector - a device that detects the infrared, ultraviolet, or visible radiation produced by a fire.

Line-tvoe Detector - a device in which detection is continuous along a path, e.g., fixed-temperature, heat sensitive cable and rate-of-rise pneumatic tubing detectors.

Fire Protection Program - the integrated effort involving components, procedures, and personnel utilized in carrying out all activities of fire protection. It includes system and

. facility design, fire prevention, fire detection, annunciation, confinement, suppression, administrative controls, fire brigade organization, inspection and maintenance, training, quality assurance, and testing.

M-2 i

- j

i DRAFT.- FOR PRAIRIE ISLAND INSPECTION April 6, 1998 Fire Resistance Rating - the time that materials or assemblies have withstood a fire 1 exposure as establishedin accordar, e with the test procedures of " Standard Methods of Fire Tests of Building Construction and Materials"(NFPA 251).

Fire Suno ession- control and extinguishing of fires (firefighting). Manual fire suppression is the use of hoses, portable extinguishers, or manually actuated fixed systems by plant personnel. Automaticfire suppressions the use of automatically actuated fixed systems l such as water, Halon, or carbon dioxide systems.

Noncombushble Material-

a. A materialwhich in the form in which it is used and under the conditions anticipated,

- will not ignite, burn, support combustion, or release flammable vapors when subjected to fire or heat.

b. Material having a structural base of non. combustible material, as defined in a.,

above, with a surfacing not over 1/8-inch thick that has a flame spread rating not higher than 50 when measured using ASTM E-84 Test " Surface Buring Characteristics of Building Materials." (There is an exception to this definition as defined by BTP Appendix A, Position D.1.d. This position allows the use of combustible interior finishes when listed by a nationally recognized test laboratory, '

such as Factory Mutual or Underwriters Laboratories, incorporated, for a flame spread, smoke and fuel contribution of 25 or less in its use configuration.

Raceway- Cable trays, conduits, junction boxes, and other components used to support and route cables from circuit termination to circuit termination.

Raceway Fire Barrier- Nonload bearing partition type envelope systems installed around electrical components and cabling that are rated by test laboratories in hours of fire resistance and are used to maintain safe shutdown functions free of fire damage.

Restricted Area - any area to which access is controlled by the licensee for purposes of protecting individuals from exposure to radiation and radioactive materials.

Safetv-Related Systems and Comoonents - systems and components required to shut down the reactor,-mitigate the consequences of postulated accidents, or maintain the reactor in a safe shutdown condition.

Secondary Containment-' a structure that completely encloses primary containment, used for controlling containment leakage.

M-3 l

DRAFT - FOR PRAIRIE ISLAND INSPECTION. April.6, 1998 Sorinkler System -.a network of piping connected to a reliable water supply that will

~ distribute the water throughout the area protected and wil! discharge the water through sprinklers in sufficient quantity either to extinguish the fire entirely or to prevent its spread.

The system, usually activated by heat, includes a controlling valve and a device for actuating an alarm when t.he system is in operation. The following categories of sprinkler systems are defined in NFPA 13, " Standard for the installation of Sprinkler Systems":

e Wet-Pipe System o Dry-Pipe System o Pre-action System o Deluge System -

e Combined Dry-Pipe and Preaction System o On-Off System Standoine and Hose System - a fixed piping system with hose outlets, hose and nozzles connected to a reliable water supply to provide effective fire hose streams to specific areas inside the building.

Water Sorav System - a network of piping similar to a sprinkler system except that it utilizes open-head spray nozzles. NFPA 15, ' Water Spray Fixed Systems," provides guidance on these systems.

END 1

l l l l y 1 l

a M-4 l  :

l

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6.1998 APPENDIX O REFERENCES The below references are considered to be the primary documents relating to commercial nuclear power plant fire protection inspection. This list is by no means a comprehensive listing of industry, licensing or regulatory documents relating to commercial nuclear power plant fire protection. Industry standards and plant specific documents, such as license exemption requests, fire harcrd analyses, safe shutdown analyses, fire protection plans, reactor plant PRAs, IPEs and IPEEEs, NRC fire protection related safety evaluation reports and technical evaluation reports, FSAR/USAR, 50.59 analyses, and operating license technical specifications are not listed.

1. General Design Criterion (GDC) 3 of Appendix A to 10 CFR Part 50 " Fire protection,"

February 20,1971.

2. General Design Criterion (GDC) 5 of Appendix A to 10 CFR Part 50 " Sharing of Structures, Systems and Components," February 20,1971.

3.10 CFR 50.48, " Fire protection," February 19,1981.

4.10 CFR Part 50, Appendix R, " Fire Protection for Nuclear Power Facilities Operating Prior to January 1,1979," dated February 19,1981.

5. BranchTechnicalPosition(BTP) AuxiliaryPowerConversionSystemsBranch(APCSB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants"- Applicable to plants docketed after July 1,1976.

6. Appendix A to BTP APCSB 9.5-1, " Guidelines for Fire Protection for Nuclear Plants Docketed Prior to July 1,1976,"- Applicable to plants already operating or under construction (docketed) before July 1,1976.

l 7. BTP Chemical Engineering Branch (CMEB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants," Rev. 2, July 1981.

g L 8. NUREG-0800, " Standard Review Plan," Section 9.5.1,'" Fire Protection Program,

Rev. 3, July 1981.

9. NUREG-1552, " Fire Barrier Penetration Seals in Nuclear Power Plants," July 1996.

l 0-1 o .

DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

10. NUREG/CR-5088, " Fire Risk Scoping Study," Janucry,1989.

11. Generic Letter 77-02, " Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," August 29,1977.

12. Generic Letter 81-12, " Fire Protection Rule," February 20,1981

13. Generic Letter 82-21, " Technical Specifications for Fire Protection Audits," October 6,1982.

14. Generic Letter 83-33, "NRC Positions on Certain Requirements of Appendix R to 10 CFR 50," October 19,1983.

15. Generic Letter 86-10, " Implementation of Fire Protection Requirements," April 24, 1986.

16. Generic Letter 86-10, Supplement 1, " Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown Trains Within the Same Fire Area," March 25,1994.

17. Generic Letter 68-12, " Removal of Fire Protection Requirements from Technical Specifications," August 2,1988.

18. Generic Letter 88-20, Supplement 4, " Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f),"

June 28,1991.

19. Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability," November 7,1991.

20. Information Notice 83-41, " Actuation of Fire Suppression System Causing inoperability of Safety Related Equipment," June 22,1983.

i

21. Information Notice 84-09, " Lessons Learned from NRC Inspections of Fire Protection Safe Shutdown Systems," February 13,1984.

22. Information Notice 85-09, " isolation Transfer Switches and Post-fire Gafe Shutdown Capability," January 31,1985.

0-2

l DRAFT FOR PRAIRIE ISLAND INSPECTION April 6, 1998

23. Information Notice 85-85," Systems Interaction Event Resulting in Reactor System Safety Relief Valve Opening Following a Fire-protection Deluge System Malfunction," October 31,1985.

24. Information Notice 88-04, " inadequate Qualification and Documentation of Fire Barrier Penetration Seals," February 5,1988, and Supplement 1, June 28,1991.

25. Inforrnation Notice 88-56, " Potential Problems with Silicone Foam Fire Barrier l Penetration Seals," August 4,1988.

26. Information Notice 88-60, " inadequate Design and Installation of Watertight Penetration Seals," August 11,1988.

27. Information Notice 89-52, " Potential Fire Damper Operability Problems," June 8, 1989.

28. Information Notice 9177, " Shift Staffing at Nuclear Power Plants," November 26, 1991.

29. Information Notice 92-18,"Potentialfor Loss of Remote Shutdown Capability During a Control Room Fire," February 28,1992. )

30. Information Notice 94-28," Potential Problems with Fire-barrier Penetration Seals,"

April 5,1994.

31. Information Notice 94-58, " Reactor Coolant Pump Lube Oil Fire," August 16,1994.

32. Information Notice 95-36, " Potential Problems with Post-fire Emergency Lighting,"

August 29,1995.

33. Information Notice 95-48, "Results of Shift Staffing Study," October 10,1995.

34. Information Notice 97-01," improper Electrical Grounding Results in Simultaneous Fires in the Control Room and the Safe-shutdown Equipment Room," January 8, 1997.

35. NRC internal memorandum dated December 3,1982, from L.S. Rubenstein to R.J.

Mattson titled "Use of the Automatic Depressurization System (ADS) and Low Pressure injection (LPCI) to Meet Appendix R, Alternate Shutdown Goals." -

0-3

DRAFT FOR PRAIRIE ISl_AND INSPECTION April 6, 1998

36. NRC internal memorandum dated March 16,1983, from L.S. Rubenstein to R.J.

Mattson titled " Revision Statement of Staff Position Regarding Source Range Flux, Reactor Coolant Temperature and Steam Generator Pressure Indication to Meet Appendix R."

37. NRC internal memorandum dated March 22,1982, from R.J. Mattson to D.G.

Eisenhut titled " Fire Protection Rule - Appendix R (contains clarification of Generic Letter 81-12.

38. NRC Internal Memorandum dated February 16,1984, from D.G. Eisenhut to John Olshinskititled " Oil Collection System Reactor Coolant Pumps, Florida Power and L Light Company, St Lucie Unit 2, Docket No. 50-389."

39. IP 64704, " Fire Protection Program," March 18,1994.

40. IP 64100, "Postfire Safe' Shutdown, Emergency Lighting and Oil Collection at Operating and Near-term Operating Reactor Facilities," March 16,1987.

41. IP 64150, " Triennial Postfire Safe Shutdown Capability Reverification,"

March 16,1987.

42. IP 71707, " Plant Operations."

43. IP 37550, " Engineering,"

44.- IP 37551, "Onsite Engineering."

45. IP 40500, " Effectiveness of Licensee Controls in identifying, Resolving, and Preventing Problems."

46. IP 40501, " Licensee Self-Assessments Related to Team Inspections."

47. IPs 35740-50 and IP 35960, various topics relating to the inspection of quality assurance.

48. IP 37001, "10 CFR 50.59 Safety Evaluation Program."

49. IPs 37700-3 and IP 37828, various topics relating to the inspection of design changes, modifications, tests and experiments.

0-4

=

DRAFT - FOR PRAIRIE ISLAND INSPECTION April 6, 1998 50.' IPs 62700-7, various topics relating to the inspection of maintenance.

51. IP 38701, " Procurement Program."

52. IMC Part 9900, " Technical Guidance."

53. IMC 0610, " Inspection Reports," Februrary 2,1996.

. 54. IMC 2001, " Team inspections," March 24,1994.

55. NRR Office Letter No 904, Revision 1, " Unescorted Access et Nuclear Power Plants," August 30,1996

56. NRC Management Directive 10.131, " Protection of NRC Employees Against

- ionizing Radiation," July 23,1996.

57. NFPA 11 A, " Standard for Medium- and High Expansion- Foam Systems"

58. NFPA 12, " Standard on Carbon Dioxide Extinguishing Systems"

59. NFPA 12A, " Standard on Halon 1301 Fire Extinguishing Systems"

60. NFPA 13, " Standard for Sprinkler Systems"

61. NFPA 14, " Standard for the Installation of Standpipe and Hose Systems"

62. NFPA 20, " Standard for the Installation of Centrigual Fire Pumps"

63. NFPA 22, " Standard for Water Tanks for Private Fire Protection"

64. NFPA 24, " Standard for the Installation of Private Fire Service Mains and Their Appurtenances"

65. NFPA 72, " National Fire Alarm Code" i

66. NFPA 2001," Standard for Clean Agent Extinguishing Systems"

67. Regulatory' Guide 1.75, Revision 2, September,1978, " Physical independence of )

l Electric Systems." l

! l

(

0-5  ;

1 I

i DRAFT - FOR PRAIRIE ISLAND-INSPECTION April 6, 1998 i

68. Regulatory Guide 1.78, " Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release."

69. Regulatory Guide 1.120, Revision 1, November,1977, " Fire Protection Guidelines for Nuclear Power Plants,"(issued for comment)

70. List of Generic Communications Concerning Thermo-Lag Fire Barriers:

e Information Notice 91-47 " Failure of Thermo-Lag Fire Barrier Material to Pass Fire Endurance Test," August 6,1991 e information Notice 91-79 "Deficienciesin the Procedures for Installing Thermo-Lag Fire Barrier Materials," December 6,1991 e information Notice 91-79, Supplement 1 " Deficiencies Found in Thermo-Lag Fire Barrier Installations," August 4,1994 e Information Notice 92-46 "Thermo-Lag Fire Barrier Material Special Review Team Final Report Findings, Current Fire Endurance Tests, and Ampacity l i

Calculation Errors," June 23,1992 e Information Notice 92-55 " Current Fire Endurance Test Results for Thermo-Lag Fire Barrier Material," July 27,1992 e information Notice 92-82 "Results of Thermo-Lag 330-1 CombustibilityTesting,"

l December 15,1992

• Information Notice 94-22 " Fire Endurance and Ampacity Derating Test Results l for 3-Hour Fire Rated Thermo-Lag 330-1 Fire Barriers," March 16,1994 l

• Information Notice 94-34, "Thermo-Lag 330-660 Flexi-Blanket Ampacity Derating Concerns," May 13,1994 e Information Notice 94-86, " Legal Actions Against Thermal Science, Inc.,

Manufacturer of Thermo-Lag," December 22,1994 e Generic Letter 86-10, Supplement 1 " Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown Trains within the Same Fire Area," March 25,1994 0-6

DRAFT FOR PRAIRIE ISLAND INSPECTION _ April 6, 1998 1

e ' Generic Letter 92-08 "Thermo-Lag 330-1 Fire Barriers,". December 17,1992 e Bulletin 92-01 " Failure of Thermo-Lag 330 Fire Barrier System to Maintain Cabling in Wide Cable Trays and Small Conduits Free from Fire Damage," June 24,1992 e Bulletin 92-01 Supplement 1 " Failure of Ti)ermo-Lag 330 Fire Barrier System to

- Perform its Specified Fire Endurance Functior,," August 28,1992 END l 4

0-7

ENCLOSURE 3 Tvolcal Fire Protection Proaram Supporting Documentation

1. Provide the Fire Protection Program and Fire Hazards Analysis.

2. Provide the fire protection program implementing procedures (e.g., administrative controls, surveillance testing, fire brigade).

3. Have available for review the fire brigade training program and pre-fire plans.

4. Have available for review the post-fire safe shutdown systems and separation analysis.

5. Have available for review the post-fire altemative shutdown analysis.

6. Provide piping and instrumentation (flow) diagrams that highlight the components used to achieve and maintain hot standby and cold shutdown for fires outside the control room and those components used for those areas requiring attemative shutdown capability.

7. Provide plant layout and equipment drawings that identify hot standby and cold shutdown equipment physical plant locations.

8. Provide plant layout drawings that identify plant fire area delineation, areas protected by automatic fire suppression and detection, and location of fire protection equipment.

9. Provide plant layout drawings that identify the general location of post-fire emergency lighting units.

10. Have available for review the associated circuit analysis for hot shorts, shorts to grot.nd, or open circuit affects on alternate shutdown capability (e.g., analysis of associated j circuits for spurious equipment operations, common enclosure, common bus).

11. Provide the plant operating procedures that would be used for a shutdown from inside the control room with a postulated fire occurring in any plant area outside the control room, and procedures that would be used to implement alternative shutdown capability in the event of a fire in either the control or cab!e spreading room.

12- Provide the maintenance and surveillance testing procedures for alternative shutdown capability and fire barriers, detectors, pumps and suppression systems.

13. Provide the maintenance procedures that verify fuse / breaker coordination to support the post-fire safe shutdown coordination analysis, if applicable.

14. Provide a list of fire protection and post-fire safe shutdown related design change packages.

15. Have available for review the plant's IPEEE, results of any post-IPEEE reviews, and listings of actions taken/ plant modif; cations conducted in response to IPEEE information.

l l

l

16. : Provide a copy of the design control and temporary modification procedures.

l

17. Provide the fire protection staff and fire brigade organization charts.

18. Have available for review the layout / arrangement drawings of potertial reactor coolant

- pump lube oil system leakage points and associated lube oil collection systems.

19. Have available for review the SERs and 50.59 that form the licensing basis for the post-fire safe shutdown configuration.

i 20. Provide procedures / instructions that control the configuration of the fire protection progr?' I'38tures, and post-fire safe shutdown methodology and system design.

21. Prow a list of applicable codes and standards relating to the fire protection features:

design.

22. Provide procedures / instructions that control fire protection system work / maintenance, and special tests or systems operation.

l

23. Provide the three most recent fire protection QA audits.

24. Provide fire protection QA surveillance performed over the last three years.

25. Provide a list of open and closed fire protection condition reports.

26. Provide a list of plant fire protection licensing basis documents.

27. Provide the NFPA code versions committed to (NFPA codes of record).

28. Provide a list of plant deviations from code commitments.

29. Provide a list of Generic Letter 36-10 evaluations.

l' l

l 2