RIS 2004-03, NRC Regulatory Issues Summary (RIS) 2004-03, Revision 1: Risk-Informed Approach for Post-Fire Safe-Shutdown Circuit Inspection (Formerly RIS 2004-003)
| ML042440791 | |
| Person / Time | |
|---|---|
| Issue date: | 12/29/2004 |
| From: | Hiland P NRC/NRR/DIPM/IROB |
| To: | |
| Frumkin D | |
| References | |
| RIS-04-003 | |
| Preceding documents: |
|
| Download: ML042440791 (13) | |
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
WASHINGTON, D.C. 20555-0001 December 29, 2004 NRC REGULATORY ISSUE SUMMARY 2004-03, REVISION 1 RISK-INFORMED APPROACH FOR POST-FIRE
SAFE-SHUTDOWN CIRCUIT INSPECTIONS
ADDRESSEES
All holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.
INTENT
The U.S. Nuclear Regulatory Commission (NRC) is revising RIS 2004-03, Risk-Informed Approach for Post-Fire Safe-Shutdown Associated Circuit Inspections, issued on March 2,
2004. The intent of this revision is to inform the addressees that the NRC has risk-informed its inspection procedure for post-fire safe-shutdown circuit analysis inspections to concentrate inspections on circuit failures that have a relatively high likelihood of occurrence, and to notify addressees that the NRC will resume inspection of these circuits in January 2005. This revised RIS applies not only to the inspection of associated circuits but to all post-fire safe-shutdown circuits. This revision supercedes, in its entirety, the guidance provided in the original RIS.
This RIS also describes the process the NRC will use to implement the Reactor Oversight Process (ROP) for post-fire safe-shutdown circuit inspection findings when the inspections are resumed in January 2005. In addition, this RIS will discuss the steps that the NRC has taken regarding the use of enforcement discretion to address non-compliances.
BACKGROUND INFORMATION
The regulatory requirements regarding post-fire safe-shutdown are contained in Title 10 of the Code of Federal Regulations, Section 50.48 (10 CFR 50.48), and 10 CFR Part 50, Appendix A,
General Design Criterion (GDC) 3. Additionally, all nuclear power plants (NPPs) licensed to operate before January 1, 1979, are required to comply with 10 CFR Part 50, Appendix R,
paragraph III.G, Fire Protection of Safe Shutdown Capability. All NPPs licensed to operate after January 1, 1979, were evaluated against Section 9.5-1 of the Standard Review Plan (SRP), NUREG-0800, and their fire protection licensing bases are contained in each NPPs fire protection license condition. All NPP licensees are required to meet commitments in their fire protection plans, as well as their fire protection license conditions.
Each NPP licensee has a post-fire safe-shutdown (SSD) program that was reviewed and approved by the NRC. The inspection staff inspects the post-fire safe shutdown program as a part of the triennial fire protection inspection of each licensee.
RIS 2004-03, Rev. 1 The objective of the fire protection requirements and guidance is to provide reasonable assurance that one train of systems necessary to achieve and maintain hot shutdown is free of fire damage. This includes protecting circuits whose fire-induced failure could prevent the operation, or cause maloperation, of equipment necessary to achieve and maintain post-fire safe shutdown. As part of its fire protection program, each licensee performs a circuit analysis to identify these circuits.
This RIS addresses circuit failures that prevent operation or could cause maloperation of safe- shutdown equipment. These failures could result from hot shorts, open circuits, or shorts to ground. The attachment addresses the likelihood of hot shorts that could cause spurious actuations which could adversely affect the ability to safely shut down the plant.
Beginning in 1997, the NRC staff noticed that a series of licensee event reports (LERs)
identified plant-specific problems related to potential fire-induced electrical circuit failures that could prevent operation or cause maloperation of equipment necessary to achieve and maintain hot shutdown. The staff documented these problems in Information Notice 99-17, Problems Associated With Post-Fire Safe-Shutdown Circuit Analysis. Because of the number of similar LERs, the staff addressed the issue generically. In 1998, the NRC staff started interacting with interested stakeholders to understand the problem and develop an effective risk-informed solution to the circuit analysis issue. NRC also issued Enforcement Guidance Memorandum (EGM) 98-002, Disposition of Violations of Appendix R, Sections III.G and III.L Regarding Circuit Failures, on March 2, 1998. On February 2, 2000, the staff issued Revision 2 (ML003710123) of this EGM, which provides the most recent interim enforcement guidance for addressing noncompliances while the issues are being clarified.
The staff subsequently incorporated this guidance into the NRC Enforcement Manual, Section 8.1.7.1, Fire Induced Circuit Failures. The key points regarding the enforcement discretion guidance are as follows:
a. For licensees who assert that a particular nonconformance associated with a fire induced circuit failure vulnerability does not constitute a violation of regulatory requirements, the NRC will document the nonconformance as an apparent violation.
The NRC will defer enforcement actions for disputed apparent violations provided the licensee implements reasonable compensatory actions for the identified vulnerabilities.
b. For licensees who assert that a particular nonconformance associated with a fire induced circuit failure vulnerability does not constitute a violation of regulatory requirements and refuse to take compensatory measures, normal enforcement processes will be followed and the licensees may be subject to formal enforcement action.
c. When licensees do not dispute that a violation of regulatory requirements has occurred with respect to a nonconformance, enforcement discretion will be exercised not to cite the violation provided the licensees take prompt compensatory actions and implement corrective actions within a reasonable time. This discretion will be exercised regardless of who identifies the nonconformance.
RIS 2004-03, Rev. 1 d. NRC will judge the reasonableness of the corrective action schedule on the bases of the safety significance of the nonconformance, the established outage schedule, and the scope of the necessary modifications. Compensatory measures will normally be acceptable as an interim measure, but the circuit vulnerabilities must be resolved.
Because stakeholders had numerous different interpretations of the regulations, the staff temporarily suspended the associated circuits portion of the fire protection inspection. This decision is documented in an NRC memorandum from John Hannon, Chief of Plant Systems Branch-Office of Nuclear Reactor Regulation (NRR), to Gary Holahan, Director of Division of Systems Safety and Analysis-NRR, dated November 29, 2000 (ML003773142). Inspection of fire-induced circuit failures are scheduled to resume January 1, 2005.
To address stakeholders differing interpretations of the regulations, the NRC contracted with Brookhaven National Laboratory (BNL) to develop a post-fire safe-shutdown analysis letter report (ML023430533). This draft letter report provided a historical look at the elements of a post-fire safe-shutdown circuit analysis, regulatory requirements and NRC staff positions, successful industry implementations, and guidance for risk-informing the associated circuit analysis. During this period, the Nuclear Energy Institute (NEI) performed a series of cable functionality fire tests for NEIs risk-informed guidance. Revision D of NEI 00-01, Guidance for Post-Fire Safe-Shutdown Analysis, was issued in early 2003 (ML023010376). The results of the NEI cable functionality fire testing were reviewed by an expert panel to develop risk insights into the phenomena of fire-induced failures of electrical cables. The Electric Power Research Institute (EPRI) coordinated this effort and issued the final report, Spurious Actuation of Electrical Circuits Due to Cable Fires: Results of an Expert Elicitation (Report No. 1006961, May 2002).
The staff completed its revision of the Fire Protection Significance Determination Process (FPSDP) on May 28, 2004. The FPSDP includes techniques for performing limited risk analyses of fire-induced circuit failure findings. The FPSDP is in the public domain and may be used by licensees to evaluate fire-induced circuit related findings. The staff has also developed a draft method for Preliminary Screening of Fire-Induced Circuit Failures for Risk Significance (ML042230474). The method may be helpful in risk-ranking the fire areas or zones affected by a fire-induced circuit failure finding.
Expanding the use of risk insights, gained from the recent cable fire testing, to inspections of all circuits does not change the current regulatory requirement to provide reasonable assurance that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage. The inspectors will inspect in accordance with the inspection procedure1 and will process findings in accordance with the ROP. Applying these risk insights to all circuits will enhance safety since inspectors will focus on the areas of potentially high risk significance.
1 Inspection Procedure (IP) 71111.05, Fire Protection
RIS 2004-03, Rev. 1
SUMMARY OF THE ISSUE
Inspection Focus The staff incorporated information collected during the February 19, 2003, facilitated public workshop in Rockville, Maryland (ML030620006) into the inspection procedure. The information collected during the workshop has been used to risk-inform the post-fire safe- shutdown circuit analysis approach.
The results of the workshop discussions involved the identification of three separate categories, or bins, of circuit failure likelihood based on research and test results:
Bin 1 Circuit configurations most likely to fail Bin 2 Circuit configurations that need more research Bin 3 Circuit configurations unlikely or least likely to fail The establishment of the three categories of circuit configurations and the identification of configurations that should be included in each category provide a basis for closing the post-fire safe-shutdown circuit analysis issues. Details of the circuit configurations in Bins 1 and 2 are given in the attachment to this RIS. Bin 3 configurations are not addressed in the attachment, since Bin 3 will not be included in the inspection procedure.2 However, to the extent that a circuit failure configuration (regardless of which bin) is identified, noncompliance must be corrected in accordance with regulatory requirements.
The focus of the inspection will be on Bin 1 circuit configurations, as described in the attachment to this RIS. These Bin 1 configurations are summarized as follows: conductor-to- conductor shorts within a multiconductor cable, and thermoplastic-cable-to-thermoplastic-cable interactions. To focus on the most likely failure scenarios, including multiple concurrent spurious actuations, inspectors will assume fire damage to no more than two separate cables for each scenario evaluated. This assumed limit only applies to scenarios where multiple spurious actuations can occur, but does not limit the number of cables that may be damaged by fire. Fire damage to cables that could initiate other equipment failure modes, such as loss of function, will also be considered. The inspection will also focus on the high consequence failure of decay heat removal system isolation valves at high-pressure/low-pressure interfaces, that may be subject to three-phase, proper-polarity hot short cable failures. The inspectors will pay particular attention to circuit failures that could impede hot shutdown in the earliest stages of the fire. Inspectors will consider credible fire scenarios that could result in cable damage.
Research is ongoing for Bin 2 circuit configurations. Based on the results of this research, this RIS may be revised or supplemented to incorporate the results of the research being performed on Bin 2 circuit configurations.
2 For details about Bin 3, see the transcript from the February 19, 2003, meeting (ML030620006). Also see meeting summary ML030620418.
RIS 2004-03, Rev. 1 Restart of Circuit Failure Inspections The staff has completed the activities necessary to restart the circuits portion of the triennial inspection. The staff has risk-informed the inspections; revised the inspection procedure accordingly; upgraded the FPSDP to accommodate fire protection circuit findings3; issued appropriate generic communications; conducted public meetings4; and established an internal licensing basis review panel to ensure consistent regulatory decisions on compliance questions.
10 CFR 50.48(c), National Fire Protection Association Standard-NFPA 805, Performance- Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants is available to those licensees that want to adopt a risk-informed licensing framework, in lieu of their existing deterministic framework.
The staff has considered the history of post-fire safe-shutdown circuit analyses and believes that the approach discussed above is consistent with longstanding staff positions. For example, the staff position stated in the March 11, 1997, letter from S. Collins, Director of NRR, to R. Beedle, NEI (ADAMS Legacy Library Accession No. 9703130284), is that fires can induce multiple hot shorts. This position has not changed. The staff will continue to enforce the regulations consistent with existing staff guidance.
Dispositioning Circuit Failure Findings in the Reactor Oversight Process As noted above, the NRC will resume the inspection of post-fire safe-shutdown circuit analyses at operating nuclear power plants beginning in January 2005. NRC Inspection Manual Chapter (IMC) 0305, Operating Reactor Assessment Program, includes a process that gives the NRC
staff the option of refraining from processing certain inspection findings in the FPSDP and from entering findings into the ROP Action Matrix. This applies to findings and associated violations that are documented in an inspection report and meet the criteria of IMC 0305, Section
06.06.a.2, Violations in Specified Areas of Interest Qualifying for Enforcement Discretion.
This process, which is currently in place, provides a window for licensees to evaluate circuits, implement compensatory measures for nonconforming conditions, and implement corrective actions within a reasonable time frame, without being subjected to the ROP and enforcement for qualifying post-fire safe-shutdown circuit failure findings. This ROP implementation process for post-fire safe-shutdown circuit analysis issues was modified to be consistent with the NRC
Enforcement Manual, Section 8.1.7.1, because of these unique circumstances. The staff plans to maintain the circuit-related discretion addressed in Section 8.1.7.1 until December 31, 2005.
In addition, licensees have the option to voluntarily adopt a regulatory framework that provides for a risk-informed approach to fire protection issues under 10 CFR 50.48(c). The specifics regarding the transition to 10 CFR 50.48(c) and the associated enforcement discretion are discussed below.
3 The revised SDP is in Inspection Manual Chapter (IMC) 0609, Appendix F, dated May 28,
2004.
4 For example, the October 13-15, 2004, public meeting in Atlanta, Georgia.
RIS 2004-03, Rev. 1 Summary of 10 CFR 50.48(c) Discretion The Commission published a new rule, 10 CFR 50.48(c), National Fire Protection Association Standard NFPA 805, on June 16, 2004, which allows licensees to voluntarily adopt a risk-informed performance-based fire protection program in accordance with National Fire Protection Association (NFPA) standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 edition (69 FR 33536). This new rule allows licensees to risk-inform their fire-induced circuit failure analysis. The Commission concurrently published an Interim Enforcement Policy Regarding Enforcement Discretion For Certain Fire Protection Issues (10 CFR 50.48(c)) (69 FR 33684). The NRC will refrain from processing inspection findings in the FPSDP and entering findings into the ROP Action Matrix, if the licensee meets the criteria for enforcement discretion under the new 10 CFR 50.48(c)
enforcement discretion policy.
For noncompliances identified during the licensees transition process, this enforcement discretion policy will be in effect for up to two years from the licensees letter of intent to adopt the requirements of 10 CFR 50.48(c) and will continue until NRC approval of the license amendment request. The noncompliances must be licensee-identified, corrected, not likely to have been previously identified through routine efforts, and not willful. Also, the licensee must enter the noncompliance into their corrective action program and implement appropriate compensatory measures. The noncompliance must not be associated with a finding that the ROP significance determination process would evaluate as Red, or categorized as Severity Level I.
The enforcement discretion policy also applies to existing identified fire protection program noncompliances, including post-fire safe-shutdown circuit analysis issues, that meet the criteria for discretion. The licensee must enter the noncompliance into their corrective action program and must implement appropriate compensatory measures; the noncompliance must not be associated with a finding that, the ROP significance determination process would evaluate as Red, or would categorize as Severity Level I; and the licensee must submit a letter of intent within 6 months of the date of the final rule (June 16, 2004). The NRC is currently considering a revision to the policy to extend the deadline for the letter of intent to adopt 10 CFR 50.48(c)
from January 16, 2005, to December 31, 2005, to accommodate an industry request.
Regardless, the NRC Enforcement Manual, Section 8.1.7.1, is provided in addition to the 10 CFR 50.48(c) discretion policy for circuit failure findings until the NRC Enforcement Manual, Section 8.1.7.1, discretion is withdrawn.
Note that, although this RIS provides the bases to inspect post-fire safe-shutdown circuits in a risk-informed manner, licensees must implement immediate compensatory measures and take corrective actions within a reasonable time frame for circuit failure findings regardless of bin assignment.
CONCLUSION
This RIS does not change the regulations or specific licensing bases. This RIS merely explains the staffs inspection approach to verifying that one train of systems necessary to achieve and maintain hot shutdown remains free of fire damage. The staff will concentrate on circuit failures
RIS 2004-03, Rev. 1 that have a relatively high likelihood and that could prevent operation of safe-shutdown equipment or through maloperation could cause flow diversion, loss of coolant, or other scenarios that could significantly impact the ability to achieve and maintain hot shutdown Nothing in this inspection guidance changes the rules or NPP licensing bases. If an inspector discovers a circuit configuration (regardless of which bin) whose failure could prevent operation or cause maloperation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions, and if this configuration is not mitigated by an approved scheme in accordance with 10 CFR Part 50, Appendix R, paragraph III.G, or the plants specific licensing basis, enforcement may be pursued in accordance with the risk-informed ROP unless the enforcement discretion described in this RIS is applicable.
Enforcement discretion is available on a temporary basis for circuit findings to provide licensees an opportunity to identify and correct noncompliances. The staff plans to end the enforcement discretion addressed in Section 8.1.7.1, of the Enforcement Manual on December 31, 2005.
Enforcement discretion is also available under the Interim Enforcement Policy Regarding Enforcement Discretion For Certain Fire Protection Issues (10 CFR 50.48(c)), contingent on the successful transition to the risk-informed performance-based fire protection rule.
This RIS may be revised or supplemented in the future based on the results of the additional research conducted on the deferred items in Bin 2.
BACKFIT DISCUSSION
This RIS does not change the staff position on post-fire safe-shutdown circuit analysis. This RIS requires no action or written response and is, therefore, not a backfit under 10 CFR 50.109.
Consequently, the staff did not perform a backfit analysis.
FEDERAL REGISTER NOTIFICATION
A notice of opportunity for public comment on this RIS was not published in the Federal Register because this RIS is informational and pertains to a staff position that does not represent a departure from current regulatory requirements and practice. Furthermore, the subject matter of the RIS was discussed on February 19, 2003, at a facilitated public workshop in Rockville, Maryland. A notice of the workshop was published in the Federal Register on December 27, 2002 (67 FR 249, p. 79168). In addition, much of the guidance in this RIS is also given in a draft of RIS 2004-03 which was published in the Federal Register on August 18,
2003 (68 FR 159, p. 49529). The public comment period ended September 17, 2003.
Stakeholder feedback was considered in developing the final version of RIS 2004-03.
SMALL BUSINESS REGULATORY ENFORCEMENT FAIRNESS ACT OF 1996 The NRC has determined that this action is not subject to the Small Business Regulatory Enforcement Fairness Act of 1996.
RIS 2004-03, Rev. 1
PAPERWORK REDUCTION ACT STATEMENT
This RIS does not contain any information collections and, therefore, is not subject to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.)
CONTACT
Please direct any questions about this matter to the technical contact listed below or the appropriate NRR project manager.
/RA/
Patrick L. Hiland, Chief Reactor Operations Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation
Technical Contact:
Daniel M. Frumkin
301-415-2280
E-mail: dxf1@nrc.gov Attachment: Approach for Risk-Informing NRC Inspection of Circuits
ML042440791 OFFICE SPLB:DSSA Tech Editor SPLB:DSSA BC:SPLB:DSSA IIPB:DIPM
NAME DMFrumkin PKleene SDWeerakkody JNHannon DHCoe DATE 10/19/2004 09/21/2004 11/03/2004 11/04/2004 12/01/2004 OFFICE DD:DSSA OGC (SBREFA) OGC (NLO) PMAS OCIO
NAME SCBlack CHolzle STreby DMcCain BShelton DATE 12/03/2004 12/02/2004 12/02/2004 12/09/2004 12/08/2004 OFFICE OE CRGR OES:IROB:DIPM OES:IROB:DIPM C:IROB:DIPM
NAME JLuehman SBahadur AMarkley THBoyce PLHiland DATE 12/17/2004 12 /1/2004 12/22/2004 12/29/2004 12/29/2004
Attachment RIS 2004-03, Rev. 1 APPROACH FOR RISK-INFORMING NRC
INSPECTION OF CIRCUITS
BACKGROUND
In 1997 the NRC noticed an increase in the number of licensee event reports (LERs) which identified plant-specific problems related to potential fire-induced electrical circuit failures that could prevent operation or cause maloperation of equipment necessary to achieve and maintain hot shutdown in the event of a fire. The staff documented this information in Information Notice 99-17, Problems Associated With Post-Fire Safe-Shutdown Circuit Analysis. On November 29, 2000, inspections of associated circuits were temporarily suspended (ML003773142). During this period, the Nuclear Energy Institute (NEI) developed NEI 00-01, Guidance for Post-Fire Safe-Shutdown Analysis, Rev. D (ML023010376)5. The staff contracted with Brookhaven National Laboratory (BNL) to develop a post-fire safe-shutdown analysis guidance letter report, Introduction to Post-Fire Safe-Shutdown Analyses (ML023430533)6. The Electric Power Research Institute (EPRI) assembled an expert panel and issued Spurious Actuation of Electrical Circuits Due to Cable Fires: Results of an Expert Elicitation (Report No. 1006961, May 2002)7. Using these documents as background, the NRC
conducted a facilitated public workshop on February 19, 2003, in Rockville, MD8. After the workshop, the staff developed a proposed risk-informed inspection approach. This approach, initially transmitted in a March 19, 2003, memorandum to Cynthia Carpenter, Inspection Program Branch Chief, from John Hannon, Plant Systems Branch Chief (ML030780326), is essentially the same as the approach described below, with two exceptions. First, additional technical review indicated that thermoplastic cable-to-cable interactions should be in Bin 1 rather than Bin 2. The second exception is the statement Inspectors will not consider the impact of degraded control room instrumentation and indication circuits that might confuse operators pending additional research. This can easily be misinterpreted and has been deleted. A new section on instrumentation has been added in place of this statement. Having made these changes, the staff issued the draft RIS for public comment on August 18, 2003.
After reviewing public comments, the staff developed the approach discussed below.
DISCUSSION
NRC inspectors conduct design-based, plant-specific, risk-informed onsite inspections of the defense-in-depth elements used to mitigate the consequences of a fire. If a finding is identified, inspectors look for a credible fire threat that could potentially damage a cable of concern in the area under review. This threat may consist of in situ combustibles, or the actual or maximum
5 NEI 00-01 was subsequently issued as Revision 0 in May 2003.
6 The NRC issued this information with a 60-day public comment period as NUREG-1778, Knowledge Base for Post-Fire Safe-Shutdown Analysis (69 FR 19, January 19, 2004).
7 EPRI subsequently released Characterization of Fire-Induced Circuit Faults: Results of Cable Fire Testing, Report 1003326.
8 The transcript of the meeting is available in ADAMS (ML030620006).
-2- allowable amount of transient combustibles as controlled by plant-specific procedures, or a combination thereof. The fire protection significance determination process (FPSDP) provides methods and bases for identifying and analyzing these fire scenarios. When something more than a qualitative analysis is needed, the inspector can use the NRC fire dynamics tools9 to analyze the fire and its effects. The cable attributes will also be considered in assessing the likelihood of cable damage. Cable damage from the fire may be caused by heating in the hot gas layer, immersion in the plume, immersion in the flame zone (direct flame impingement), or radiant heating. All modes of heat transfer should be considered, as appropriate, for a given fire scenario. The May 2004 revision of the FPSDP provides methods, criteria, and bases for determining damage to specific cables.
For multiconductor cables, testing has shown that conductor-to-conductor shorting within the same cable is the most frequent mode of failure. This is often referred to as intracable shorting. It is reasonable to assume that, given damage, more than one conductor-to- conductor short will occur in a given cable. A second, less likely, mode of cable failure is conductor-to-conductor shorting between separate cables, commonly referred to as intercable shorting.
1. Items to Be Considered During Inspection-Bin 1 Consistent with the current knowledge of fire-induced cable failures, the following configurations will be considered for power, control, and instrumentation circuits whose fire-induced failure could prevent operation of safe-shutdown equipment or through maloperation cause a flow diversion, loss of coolant, or other scenarios that could significantly impact the ability to achieve and maintain hot shutdown:
A. For any individual multiconductor cable (thermoset or thermoplastic),10 failure that may result from intracable shorting, of any possible combination of conductors within the cable may be postulated to occur concurrently regardless of number.11 For cases
9 NUREG-1805, Fire Dynamics Tools (FDTs)-Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory Commission Fire Protection Program, published in November
2004.
10
Thermoset and thermoplastic are general terms for the two broad classifications of cable insulation and jacket material. Other factors such as cable raceway type and protective jacketing (e.g., tray, conduit, armor) are addressed in the FPSDP, which provides supporting guidance and bases for understanding and qualifying the performance criteria. For the purpose of analysis, cable shielded with metallic wire mesh may be considered as armored cable when the wire mesh envelops the insulated conductors (e.g., coaxial cable). When the shielding is constructed of thin foil, the cable should be treated like ordinary thermoset or thermoplastic cable. If the cable contains a drain, the uninsulated drain conductor may be treated as a ground conductor within the multiconductor cable.
11 The number of combinations of potential hot shorts increases rapidly with the number of conductors in a given cable. For example, a multiconductor cable with three conductors (3C)
has 3 possible combinations of two (including relevant combinations), while a five-conductor cable (5C) has 10 possible combinations of two (including relevant combinations), and a seven- conductor cable (7C) has 21 possible combinations of two (including relevant combinations).
-3- involving the potential damage of more than one multiconductor cable, assume a maximum of two cables to be damaged. Inspectors should consider only a few (three or four) of the postulated combinations whose failure is likely to significantly impact the ability to achieve and maintain hot shutdown.
B. For any two thermoplastic cables, failures of any combination of conductors that may result from intercable shorting (i.e., between two cables) may be postulated to occur concurrently. Inspectors should consider only a few (three or four) of the postulated combinations whose failure is likely to significantly impact the ability to achieve and maintain hot shutdown.
C. For cases involving direct current (DC) control circuits, consider the potential spurious operation due to failures of the control cables (even if the spurious operation requires two concurrent hot shorts of the proper polarity, e.g., plus-to-plus and minus-to-minus).
Consider potential spurious actuations when the source and target conductors are each located in the same multiconductor cable.
D. The decay heat removal (DHR) system isolation valves at high-pressure/low-pressure interfaces may be subject to three-phase, proper-polarity hot short cable failures.
Although this failure is unlikely, it could cause the opening of these valves which would pressurize the low-pressure portion of the DHR system piping outside of containment with the reactor coolant at or near normal reactor operating pressure. These three- phase power cables (either thermoset or thermoplastic jacketed) will be inspected to ensure that they are not subject to three-phase hot shorts that could cause the DHR
valves to spuriously open.
The potential consequences of the damaged circuits are determined by examining plant specific system documentation12 and by reviewing components that could fail to operate, prevent operation, or cause maloperation, such as flow diversion, loss of coolant, or other scenarios that could significantly impair the NPPs ability to achieve and maintain hot shutdown13. When considering the potential consequence of such failures, the inspector will also consider the time at which the prevented operation or maloperation occurs. Failures that impede hot shutdown within the earliest stages of the fire are significant in a first-order evaluation.
2. Items To Be Deferred at This Time, Pending Additional Research-Bin 2 The following items are deferred pending additional research:
A. Intercable shorting for thermoset cables, since the failure mode is considered to be substantially less likely than intracable shorting.
B. Intercable shorting between thermoplastic and thermoset cables, since this failure mode is considered less likely than intracable shorting of either cable type or intercable shorting of thermoplastic cables.
12 Piping and instrumentation diagrams (P&IDs), cable routing diagrams, and logic diagrams.
13 Hot shutdown is defined in the NPP technical specifications.
-4- C. Configurations requiring failures of three or more cables, since the failure time and duration of three or more cables require more research to determine the number of failures that should be assumed to be likely.
D. Multiple spurious operations in control circuits with properly sized control power transformers (CPTs) on the source conductors, since CPTs in a circuit can substantially reduce the likelihood of spurious operation. Specifically, where multiple (i.e., two or more) concurrent spurious operations due to control cable damage are postulated, and it can be verified that the power to each impacted control circuit is supplied via a CPT
with a power capacity of no more than 150 percent of the power required to supply the control circuit in its normal mode of operation (e.g., required to power one actuating device and any circuit monitoring or indication features).
E. Fire-induced hot shorts that must last more than 20 minutes to impair the ability of the plant to achieve hot shutdown, since recent testing strongly suggests that fire-induced hot shorts will likely self-mitigate (e.g., short to ground) in less than 20 minutes. This is of particular importance for devices such as air-operated valves (AOVs) or power- operated relief valves (PORVs) which return to their deenergized position upon abatement of the fire-induced hot short.
F. Consideration of cold shutdown circuits, since hot shutdown can be maintained and the loss of cold shutdown circuits is not generally a significant contributor to risk.
SUMMARY
In summary, the inspectors will continue to verify that one train of systems necessary to achieve and maintain hot shutdown remains free of fire damage. The inspectors will focus on circuits whose failure could prevent operation of safe-shutdown equipment or through maloperation could cause flow diversion, loss of coolant, or other scenarios that could significantly impact the ability to achieve and maintain hot shutdown. The inspectors will pay particular attention to events that occur within the earliest stages of the fire. The inspectors will develop credible fire scenarios that could produce a thermal insult resulting in cable damage. Risk insights gained from cable fire testing have demonstrated that conductor-to-conductor shorting in a multiconductor cable and cable-to-cable shorting between thermoplastic cables are the most probable causes of spurious actuations. Therefore, when considering potential cable damage scenarios, the inspectors should focus on these two specific circuit configurations. The inspectors should assume a maximum of two concurrently damaged cables (with the resulting spurious operations) for each scenario evaluated.