ML20236Q002

Final Rept, Prairie Island Fire IPEEE Technical Assessment

ML20236Q002
Person / Time
Site:	Prairie Island
Issue date:	02/28/1998
From:	Lambright J, Zee K ERIN ENGINEERING & RESEARCH, INC.
To:
Shared Package
ML20236P727	List: ML20236P724 ML20236P980 ML20236Q002
References
GL-82-21, NUDOCS 9807170249
Download: ML20236Q002 (41)

Text

_- _ _ _ _ _ _ - _ _ _ _ - _ - _ _ _ _ _ _ _ _ - - _ _ _ - _ _ _ _ _ _ - _ _ _ _ - _ - _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ - _ - _ _ _ _ _ _ - _ _ _ _ _

1 PRAIRIE ISLAND FIRE IPEEE TECHNICAL ASSESSMENT FINAL REPORT l

l Prepared for:  ;

Northern States Power Company Prairie Island Nuclear Station Prepared by: l ERIN

• e,,,o,, m a,,,a--w 2033 North Main Street., Suite 1000 Walnut Creek, CA 94596 l

I l February 1998 l

l 9807170249 980713 l PDR ADOCK 05000282

[

F,.. PDR

Prairie IslamiIPEEE Technical Assessment FinalReport TABLE OF CONTENTS Section.................................................................................................................Eage EX E C UTIVE S U MMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . .

R E P O RT AP P R OVAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1 . 0 1 N TR O D U CT I O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2. 0 AS S E S S M E NT S C O P E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

3. 0 AS S E S S M E NT R E S U LTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3.1 DEFINITION OF FIRE COMPARTMENTS .......................................................... 4 3.2 PLANT SYSTEM FIRE RELATED VULNERABILITIES ............... ............. ......... 5 3.3 SAFE SHUTDOWN SYSTEM SUCCESS CRITERIA........ ................................. 6 3.4 FIVE Q UALITATIVE S C R E E N IN G. .. . ......... ... .. . .. . . .... . .. . . . .. .. ... .. . .. .. ... ... ...... . . ....... 6 3.5 FIRE COMPARTMENT IGNITION FREQUENCY................................................ 6 3.6 DEVELOPMENT OF FIRE IPEEE RISK MODEL..................................... ........... 7 3.7 CALCULATION OF CONDITIONAL CORE DAMAGE PROBABILITY....... ........ 7

3. 8 F 1 R E M O D E L I N G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8l 3.9 REC OVERY/O P ERATOR ACTlON S ..... . .............. .. . . .... .. ... . .... .. . . ...... . . . ... ..... . ... 9 ,

1 l

l 3.10 SANDIA FIRE RISK SCOPING STUDY ISSUES......................... ................... . 9

4.0 CONCLUSION

S.................................................................................................10

5. 0 R E C O M M E N D ATI O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 APPENDIX A FIRE IPEEE ASSESSMENT DETAILS E R IN

• e ,*,,.,,a -n. i wisoo80i-o2,7 e 493

Prairie IslandIPEEE Technical Assessment FinalReport EXECUTIVE

SUMMARY

-The Prairie Island Fire IPEEE used the EPRI developed FIVE Methodology. This approach has been used by many utilities and has the advantage of having an NRC issued SER endorsing its acceptability for the Fire IPEEE. The FIVE Methodology provides a relatively high degree of latitude in the selection of plant equipment to be credited in the analysis, and the depth and rigor of the various analytical steps.

Diligent application of the FIVE Methodology with appropriate integration of plant IPE insights and fire mechanics can produce realistic Fire IPEEE results and characterization of fire induced core damage risk.

The overall conclusion of the assessment is that the Prairie Island Fire IPEEE has not adequately characterized the fire induced core damage risk. The application of certain

-analysis assumptions and certain elements of the methodology has compromised the analysis. The analysis does not provide an accurate risk ranking of the fire areas in the plant, does not adequately characterize the importance of certain operator actions, and may have masked or otherwise concealed dominant risk contributors and/or important risk insights. In addition, treatment of the Sandia Fire Risk Scoping Study issues was determined to be incomplete.

l This assessment has concluded that the weaknesses in the Fire IPEEE analysis should j be corrected prior to the NRC Fire Protection Functional inspection (FPFI) so that a realistic characterization and ranking of the risk significant plant areas will be available.

Additional tasks to improve and enhance the analysis should be considered as a longer l term action item. The tasks that should be completed prior to the FPFI are: I l

i l \

1. Re-evaluate Auxiliary Building Basement - FA 58 and 73

2. Re-evaluate Auxiliary Feedwater Pump Rooms - FA 31 and 32

3. Re-evaluate Main Control Room - FA 13 o

ERIN

• s.s s-=. u w-m 3

Prairie IslarulIPEEE Technical Assessment FinalReport

4. Re-evaluate Cable Spreading and Relay Room - FA 18

5. Re-evaluate Turbine Building - FA 69 and 70

6. Incorporate Fire Induced Spurious Actuation into the Fire IPEEE

7. Re-evaluate operator actions

8. Complete a reanalysis of the dominant cutsets (refer to Tasks 1 - 5 above) )

9. Re-evaluate the Sandia Fire Risk Scoping Study issues

10. Investigate Instrument Air Line Vulnerabilities l The objective of these tasks is to ensure that the Fire IPEEE is adequate with respect t

to identifying fire risk insights. The performance of the tasks listed above requires certain supporting activities which are discussed in the body of this report.

i I

i f

i 1

1 ERIN

• 1% -, w. iii wiao98oi-o2i7 8 3 1 _ _ _ _ _ _ _ _ _ _ _ - _ _ _

Prairie IslandIPEEE Technical Assessment FinalReport REPORT APPROVAL COVER SHEET This technical report documents a review of the Prairie Island Fire IPEEE against the criteria used in developing the analyses. The EPRI FIVE methodology was the governing criteria. All insights and conclusions are provided in Sections 4 and 5.

Significant technical contributors: Kiang Zee John Lambright l

I I

f Prepared: db \ k 7(37 A8

,\ Date Prepared: $d A AMTM k2 96 Date Approved: 9v v/ A 8 l ) Date

. ERIN %._2 ,- iv wi3 = i mi m =

l L- - --

Prairie IslamiIPEEE Technical Assessment FinalReport SECTION 1 INTRODUCTION The objective of Fire IPEEE assessment is to determine the adequacy of the analysis with respect to characterization of overall fire induced core damage risk and the identification of dominant risk sequences. The nuclear industry has recognized that the application of regulatory guidance related to postulated plant f

fires has been generally inconsistent and that this inconsistency may have resulted in certain situations where fire related core damage risk could be more significant than expected. One of the objectives of Generic Letter 88-20, Supplement 4 (IPEEE) was to evaluate the core damage risk associated with postulated plant fires. The intent of the Fire IPEEE analysis is to evaluate credible plant fire scenarios to determine whether these events could result in consequences, from a risk perspective, that warranted plant changes. These changes could take the form of physical changes or operating procedure changes.

The Prairie Island Fire IPEEE used the EPRI developed FIVE Methodology. This methodology has been successfully used by other utilities and has the advantage of having been issued a NRC SER to establish its acceptability for this application.

While the FIVE Methodology is prescriptive in many respects, it does provide great latitude in the depth and rigor of its application. A partial application of. the methodology will yield results, but these results may incorrectly skew the risk profile towards certain plant areas and mask the risk significance of other areas.

This assessment of the Prairie Island Fire IPEEE determined that the analysis was incomplete and contained technical errors. Therefore, the Fire IPEEE does not provide a realistic characterization of the fire related core damage risk. Analysis assumptions related to fire induced spurious actuation and superficial treatment of ERIN ? s, ,- , i wi30 oi-o2,7 3 l l

L __ __ -

Prairie IslandIPEEE Technical Assessment FinalReport the main control room and cable spreading and relay room have been found to be critical weakness.

The Fire IPEEE is one of the inputs for the NRC FPFl. In order for the Fire IPEEE to adequately support this inspection, several technical activities to correct the most critical deficiencies need to be performed. These deficiencies are summarized in this report.

w.

! ERIN *,.;:z:1 -z. , 2 wi309soi o2i7 8-94 3 t __ _ _ _ _ _ - - - _

1 Prairie IslandIPEEE Technical Assessment Final Report l

l SECTION 2 l ASSESSMENT SCOPE The scope of the Prairie Island Fire IPEEE included the entire suite of documentation associated with the analysis. Althougi, a comprehensive examination of all documents was not performed, a representative sample was selected (based upon our experience in conducting 30 IPEEE reviews) to provide both horizontal and vertical slices. The documents that were examined included both those associated exclusively with the Individual Plant Examination (IPE) and IPEEE efforts, as well as those generated to support the deterministic Appendix R compliance requirements.

ERIN %u.,,a -o,.u s w,m,m,mma

Prairie IslandIPEEE Technical Assessment Final Report SECTION 3 ASSESSMENT RESULTS The assessment effort identified several technical deficiencies and weaknesses in the analysis. While many elements of the analysis methodology was fundamentally correct, the implementation of the methodology results in various errors and inconsistencies. In addition, elements of the methodology were not fully implemented. Of particular concern is the failure to adequately assess and evaluate all credible fire induced plant events, the failure to perform fire modeling of dominant fire areas, and the inconsistent application of operator recovery actions.

. The not impact of the identified weaknesses is that the analysis in its current form does not provide a realistic risk' ranking of the plant fire areas, and may have concealed or otherwise masked critical risk insights.

The following sections provides a summary level discussion of the assessment-results and findings of the key analysis elements. A more detailed discussion of the results is provided in Appendix A to this report.

3.1 DEFINITION OF FIRE COMPARTMENTS The Fire IPEEE is based on fire compartments developed from the Appendix R Fire

' Area definitions. The Appendix R Fire Areas were generally based on physical barriers. The Fire IPEEE development of Fire Compartments was mostly based on the criteria provided in the EPRI developed FIVE Methodology which requires the presence of physical boundaries and barriers. However, for one dominant fire scenario, it was determined that the Fire IPEEE gave credit to a virtual b&rrier between FA 58 and 73. The basis for crediting this virtual barrier was qualitative and relied on spacing rather than fire modeling. Fire modeling should have been

. E RIN

• so a ,* *. 4 wi-imimaa i

L_-_ _ _ _______________________L _-__ ___ . _ - - - - - - - - - ~ - -

t Prairie IslandIPEEE Technical Assessment Final Report 3 performed to support this approach based on the ignition sources and combustibles located in the area.

3, 3.2 PLANT SYSTEM FIRE RELATED VULNERABILITIES l

The fire related vulnerabilities for the IPE equipment was not directly taken from the -

Appendix R analyses. Discussions with the preparer of the analysis determined that the scope of cables and related fire area vulnerabilities were developed using CHAMPS searches even for the Appendix R components. During the assessment effort, it -was determined that the Appendix R Safe Shutdown Analysis and I

supporting cable data had been updated by the Fire Protection Group, it would be appropriate to reconcile the updated Appendix R vulnerability information with the vulnerabilities used for the Fire IPEEE effort. A sample based review of the postulated fire induced failures for the switchgear and auxiliary feedwater pump.

rooms determined that not all of the consequences were properly treated in the risk model.

r The assessment also found that the Fire IPEEE analysis methodology excludes e consideration of fire induced spurious actuation on the basis of low likelihood of i occurrence. This is not a valid basis, is inconsistent with general industry practice

~

and, based on NRC SERs in this area, inconsistent with NRC expectations. The analysis needs to be updated to explicitly address fire induced spurious actuation.

L E RIN * % a. = s w-m an v.

L_ __

)

Prairie IslandIPEEE Technical Assessment FinalReport 3.3 SAFE SHUTDOWN SYSTEM SUCCESS CRITERIA I

The success criteria for the systems credited in the Fire IPEEE were consistent with I i

that considered in the Appendix R analyses. As such, the component and system {

vulnerabilities for Appendix R systems can be directly used in the Fire IPEEE effort.

)

3.4 FIVE QUALITATIVE SCREENING The Fire IPEEE performed only limited qualitative screening. The assessment of the screening that was performed did not identify any major deficiencies. A plant walkdown was performed to verify the adequacy of this limited screening. No risk-significant fire areas were identified which had been screened.

3.5 FIRE COMPARTMENTIGNITION FREQUENCY The calculation of Fire Compartment ignition Frequency contained numerous inconsistencies and errors. In the case of Fire Area 58, the ignition frequency was inappropriately adjusted in calculation V.SMN.97.003 by excluding some of the ignition source contributors. The two dominant causes of these problems were determined to be the lack of adequate support documentation and the use of an obsolete revision of the FIVE report. While the resolution of the inconsistencies and errors will change the fire compartment ignition frequencies, none of the identified issues are expected to have a significant impact.

i l

l l

ll i

ERIN * ,=; 24 -

, e wiso9eoio24788-s4s>

1

\ .

1 Prairie IslandIPEEE Technical Assessment Final Report ,

1 l

\.

l 3.6 DEVELOPMENT OF FIRE IPEEE RISK MODEL l i

The assessment of the Fire IPEEE risk model was performed by examining the  !

I dominant cutset results for individual fire areas. This methodology for establishing model adequacy is consistent with that used for the IPE. The performance of a fire risk analysis typically results in cases wherein minor or insignificant nuances in the  !

IPE model become dominant issues. This is because spatial hazard analyses often l include the disabling of large segments of the available event mitigation systems.

The assessment of the Prairie Island Fire IPEEE risk model found several instances l- where modeling errors were present. These errors were identified by the presence of invalid cutsets. A concern is that the invalid cutsets were ranked within the top 20 dominant contributors to core damage risk. This suggests that a review of cutsets was not performed as part of the Fire IPEEE analysis effort. It is essential l that s' complete review of the unscreened cutsets be performed to ensure that an adequate risk model was used. j l

3.7 CALCULATION OF CONDITIONAL CORE DAMAGE PROBABILITY l

l  !

The calculation of conditional core damage probability was performed using the modified IPE model. The calculation methodology generally assumed that all components and cables within a given fire area were disabled by the postulated fire event. This provides very conservative results. In cases where the resultant CCDP allows the compartment to be screened out, no further analysis would be necessary.

The FIVE Methodology specifies a screening value of 1.0E-6/yr. In cases, where the compartment does not screen out, it would be appropriate to refine the analysis to ensure that fire areas that may be dominant contributors to core damage risk are ranked properly, and that risk insights based on realistic fire scenarios are obtained.

. The review of the Prairie Island Fire IPEEE generally found that no analysis refinements were made for fire areas that failed to screen-out. The analyses were ERIN

• s.s , 7 wisosaoi.o2:7 -.<es y

L___--______________

Prairie IslandIPEEE Technical Assessment Final Report also limited to an incomplete set of potential fire induced scenarios. As a consequence, the risk ranking presented in the analysis documentation cannot be used to determine whether plant design or operational enhancements are appropriate. The inability to obtain fire related risk insights is of particular concern.

3.8 FIRE MODELING One of the key objectives of the Fire IPEEE is to evaluate physically credible and realistic fire scenarios to gain insights as to those plant-specific features which contribute to the fire risk. Given this objective, it is important that all fire areas that fail to screen-out have analyses based on realistic scenarios. Failure to do so could skew the overall plant risk profile and mask or otherwise conceal risk insights. This review determined that almost no fire modeling was performed. The one instance involving fire areas 31 and 32 where an analysis was prepared suffers from an invalid set of input parameters. Also, a plant walkdown determined that many of the postulated fire scenarios (particularly for fire areas 58 and 69) were physically  ;

incredible. All fire areas that fail to screen should be considered for detailed fire I modeling so that proper insights can be obtained regarding which plant-specific features contribute to the fire risk.

ERIN * ,%.un- u a wi=i-o2i7 8-94a3

Prairie IslandIPEEE Technical Assessment Final Report l

3.9 RECOVERY / OPERATOR ACTIONS The review of operator recovery actions found a number of critical weak areas in the Fire IPEEE analysis. Modifications were made to IPE recovery actions which were not affected by the fire environment. Operator recovery actions which took place in the fire environment did not account for elevated stresses which can occur. Also, multiple redundant recovery actions were credited from the remote shutdown panel.

l Therefore, it is recommended that a re-evaluation be performed for all unscreened cutsets of the operator recovery actions.

3.10 SANDIA FIRE RISK SCOPING STUDY ISSUES The NRC FPFI audit will focus extensively on potential seismic / fire interactions.

The treatment of seismic / fire interactions in the Fire IPEEE was found to be incomplete. Most of the dominant risk contributors which are documented in Generic issue 57, " Effects of Fire Protection System Actuation on Safety-Related Equipment," have not been considered. Also, a physically incredible seismic / fire scenario has been postulated in the Fire IPEEE. This scenario considers failure of a turbine building lube oil storage tank, subsequent fire, and structural failure of the enclosure berm.

This review has concluded that treatment of the other five Fire Risk Scoping Study issues is also incomplete. Therefore, it is recommended that the analysis of the Fire Risk Scoping Study issues be completed and a more detailed evaluation of the seismic / fire scenario in the turbine building be performed.

l l

l l

ERIN

• em.,o-a.,,,c. 9 W1309601-021798-9493 I

Prairie IslandIPEEE Technical Assessment Final Report SECTION 4 CONCLUSIONS The overall conclusion of the assessment is that the Prairie Island Fire IPEEE has not adequately characterized the fire induced core damage risk. The application of l certain analysis assumptions, incomplete implementation of elements of the l methodology, and various technical errors have compromised the analysis. The net impact of this is that the analysis does not provide a realistic characterization of the fire related core damage risk and consequently, does not provide an adequate

- risk ranking of the fire areas. Analysis assumptions related to fire induced spurious

' actuation and superficial treatment of the main control room and cable spreading l

and relay room are critical contributors to the weakness in the Fire IPEEE. In addition, treatment of the Sandia Fire Risk Scoping Study issues was determined to be incomplete.

l l

l l

l l

ERIN

• aman w to w< = ,.m< = u n

Prairie IslandIPEEE Technical Assessment Final Report SECTION 5 RECOMMENDATIONS The Fire IPEEE analysis is one of the inputs into the NRC FPFl. In order for the Fire IPEEE to adequately support this inspection, several technical activities need to be performed to corrected the identified analysis weaknesses prior to the NRC FPFl. Additional tasks to improve and enhance the analysis should be considered as a longer term action items.

ACTIONS PRIOR TO NRC FPFI The tasks that should be completed prior to the FPFI are:

1. Re-evaluate Auxiliary Building Basement - FA 58 and 73

2. Re-evaluate Auxiliary Feedwater Pump Rooms - FA 31 and 32 ,

3. Re-evaluate Main Control Room - FA 13

4. Re-evaluate Cable Spreading and Relay Room - FA 18

5. Re-evaluate Turbine Building - FA 69 and 70

6. Incorporate Fire Induced Spurious Actuation into the Fire IPEEE

7. Re-evaluate operator actions I

8. Complete a reanalysis of the dominant cutsets (refer to #1 through #5)

9. Re-evaluate the Sandia Fire Risk Scoping Study issues

10. Investigate Instrument Air line Vulnerabilities  ;

The major objective of these tasks is to ensure that the Fire IPEEE is adequate with respect to identifying the critical plant-specific fire risk insights. j I

l 4

ERIN

• e.,, , <n , , is wiso 80io25798-9493

(

l AppendixA i

i l

i l

l l

l l

I l

i APPENDIX A FIRE IPEEE ASSESSMENT DETAILS i f

I 1

l l

l l

1 i

I ERIN * ,---m w,-imim 3 l

l l

AppendixA A.1 DEFINITION OF FIRE COMPARTMENTS The Fire IPEEE is based on fire compartments developed from the Appendix R Fire Area definitions. The Appendix R Fire Areas were generally based on physical barriers. However, there was one instance where a virtual barrier was credited in the IPEEE analysis. This barrier was the interface between FA 58 and 73. Discussion with the Fire Protection Group determined that the updated Appendix R Safe Shutdown Analysis eliminated any reliance on this virtual barrier. The Fire IPEEE credited this virtual barrier using a qualitative assessment based on spacing when the methodology should have relied on analytical treatment of realistic fire scenarios using fire modeling techniques. The crediting of any virtual barrier must be based on supporting fire modeling analyses given the ignition sources and combustibles located in the area.

Based on this findings, re-analysis of FA 58 and 73 is considered necessary especially 1 in light of this area being one of the dominant fire risk contributors.

A.2 PLANT SYSTEM FIRE RELATED VULNERABILITIES The fire related vulnerabilities for the IPE equipment was not directly taken from the Appendix R analyses. Discussions with the preparer of the analysis determined that the scope of cables and related fire area vulnerabilities were developed using CHAMPS searches even for the Appendix R components. In addition, the Appendix R Safe Shutdown Analyses were recently updated which may have resulted in some changes in the distribution of fire related spatial vui.wrabilities. Preliminary discussions with the Fire Protection Group indicated that the updated analyses did not result in any notable change in the system level vulnerabilities.

A sampling of the treatment of postulated fire induced failures was performed. FA 20 i which is one of the Safeguards 4kV switchgear rooms was examined. It was noted that ERIN ' e ,, ,,,, ,n rch, Anc. A-1 W1309aoi-021798-9493

l l

AppendixA i a postulated fire in this room was assumed to disab!e the 1RY transformer feed to Bus 16, but did not disable the 1RY feed to Bus 15. Given a postulated fire which disables, or otherwise fails, the non-segregated bus duct from transformer 1RY to Bus 16, operation of the switchyard breakers would be required which would effectively disable the transformer. The impact of loss of this transformer was not reflected in the set of fire induced failures.

Further review of the treatment of the offsite power supply connections was performed by examining the postulated failures given a fire in the Auxiliary Feedwater Pump Room

- FA 32. In this case, the fire was assumed to impact the feeder from transformer CT11. Again, the set of impacted equipment was limited to only one 4kV bus.

In the examination of the two fire areas, all other postulated fire induced failures 1

appeared to be properly treated. It was concluded that errors were limited to nuances associated with the offsite connections. The fire areas which could affect the offsite power connections are FA 20, 32, 58, 69, 70, end 81. These areas should be considered for re-examination of fire induced risk contribution.

The Fire IPEEE analysis methodology excludes consideration of fire induced hot shorts on the basis of low likelihood of occurrence as stated in Assumption #7 of the submittal  !

document. A phone conference with the preparer of the analyses determined that fire induced spurious actuation was considered in the analysis with a conditional probability of 1.0 unless it resulted in a dominant risk contribution. In these cases, ' assumption #7' '

was used to ' reset' the basic event to the random failure probability. As a consequence, Assumption #7 was used to ' invalidate' any dominant cutset related to l fire induced spurious actuation. 4 Fire induced spurious actuation can occur due to an erroneous signal generated from shorted control wiring or the cross-energizing of power feed cables. In either case, i.

ERIN

• so , ,n rch,.c. A2 W1309801-021798-9493

AppendixA these failure modet, have been treated in almost all other utility Fire IPEEE analyses.

The Appendix R analyses explicitly treats fire induced spurious actuation and has available all of the necessary spatial vulnerability data. Particularly in light of the importance given to spurious actuation in upcoming NRC inspection, the Prairie Island Fire IPEEE must be updated to incorporate fire induced spurious actuation. The Appendix R documentation should be used to obtain the set of fire areas where undesired spurious actuation could occur. These fire areas must be examined and considered for re-analysis in the Fire IPEEE.

A.3 SAFE SHUTDOWN SYSTEM SUCCESS CRITERIA The success criteria for the systems credited in the Fire IPEEE were consistent with that considered in the Appendix R analyses. As such, the component and system 1

. vulnerabilities for Appendix R rystems can be directly used in the Fire IPEEE effort.

However, as discussed above, the Appendix R data was not used to establish fire related vulnerability, it is recommended that this issue be examined for those fire areas selected for re-analysis.

The re-analysis of the selected dominant fire areas should include a check of the fire induced failures assumed in the Fire IPEEE with those obtained from the Appendix R documentation. This will provide a means to objectively assess the adequacy of the cable selection process used in the Fire IPEEE.

E R I N

• s, , , w w A-3 wimm1NN

l ,

AppendixA A.4 FIVE QUALITATIVE SCREENING ,

The Fire IPEEE performed only limited qualitative screening. The assessment of the '

I screening that was performed did not identify any major deficiencies. A plant walkdown was performed which did not identify any risk-significant fire areas which were screened.

A.5 FIRE COMPARTMENT IGNITION FREQUENCY The calculation of the Fire Area Ignition frequency was determined to be based on the EPRI FIVE Methodology. However, numerous inconsistencies were identified. These included inconsistent treatment of contribution from transient ignition sources, junctions boxes, non-qualified cables, and an apparent error in the weighting factor for plant wide ignition sources, in addition, certain plant-wide values in the calculation were found to be inconsistent with the source document for the input parameters.

1. The ignition source contribution for cable related attributes are based on the mass or Btu content of the cables. The values shown in the ignition source worksheets were not consistent with those provided in the Appendix R combustible loading calculation.

2. The fire ignition frequencies were determined to have been taken from an earlier version of the FIVE report. A revision to these values was issued in September of 1993. As a result, the Prairie Island fire area ignition frequencies are inconsistent with the current FIVE Methodology.

3. A scan of the individual ignition source worksheets in calculation V.SMN97012, Rev.1 finds that contribution from cable fires caused by welding, transient fires caused by welding, non-qualified cable run, and junction boxes are inconsistently applied.

ERIN*e ,n c4km. A-4 w1309801021796-9493 i

AppendixA

4. The base value for Blu or weight of cables of 8,186 could not be verified nor the 2,503 used for FA 86

5. The weighting factor for plant wide ignition sources should be 2 because of the dual unit site. Some of the worksheets used a value of 1.

6. The ignition frequency worksheets show a total of 98 fire compartments. However a count of the table provided in calculation V.SMN97012 provides a total of 139 fire l

areas of which 95 are retained for analysis.

7. The ignition frequency for fire Arca 58 was inappropriately reduced in calculation V.SMN,97.003 by excluding some of the ignition source contributors. The treatment of insignificant ignition sources should have been via the calculation of conditional core damage probability.

Although'the assessment found several technical errors in the ignition frequency

' development, the impact is not expected to be significant. This review found ignition frequencies to be generally.the same, as that for similar units. These errors should, nevertheless, be corrected.

A.6 DEVELOPMENT OF FIRE IPEEE RISK MODEL The Fire IPEEE risk model is based on an existing Level 1 IPE model. The Level 1

. model was modified and simplified given that certain events are not expected to occur concurrently with a fire. The model retains proper treatment of general plant transients, loss of offsite power, and seal LOCA. Although not specifically reviewed, it is expected that the model also retained proper consideration of spurious PORV actuation.

The Fire IPEEE model also retained any ' imbedded' operator actions. This treatment is l generally acceptable to the extent that credited operator actions are performed in the main control room. Actions outside the control room could be adversely affected by the i postulated fire event if actions are required at the location of the fire, or the fire blocks E RIN * ,,,s , - .,c. A-5 W1meNoe

AppendixA or otherwise impedes the path to the location where the action is required. The treatment of operator actions is discussed further below.

A detailed review of the Fire IPEEE risk model was not performed. Rather, an assessment of the model adequacy was performed by examining cutsets. This review found two risk model structural errors. One. identified involved the treatment the component cooling water pump. The logic structure connected the maintenance unavailability and the system standby alignment under an AND gate when an OR gate should have been used. The correction of this error would increase the cutset value by a factor of 2.

The other error involved a cutset containing an operator failure associated with shutdown from outside the control room and another operator error for failure to initiate feed and bleed. This cutset was for a postulated control room fire that required evacuation. For this scenario, shutdown from outside the control is required. The identified cutset was non-minimal in that failure of either of the operator actions would have led to core damage it was also recognized that the overall treatment of the main control room was overly conservative in some aspects and deficient in other aspects.

The net effect of the weaknesses in the control room analysis requires that this fire area be re-evaluated as discussed in the next section.

- A.7 CALCULATION OF CONDITIONAL. CORE DAMAGE PROBABILITY

.The calculation of conditional core damage probability was performed using the ,

1 modified IPE model. The calculation methodology generally assumed that all  ;

components and cables within a given fire area were disabled by the postulated fire l

. event. This'provides very conservative results in cases where the resultant CCDP allows the compartment to be screened out, no further analysis would be necessary.

The FIVE Methodology specifies a screening value of 1.0E-6/yr. In cases, where the l

ERIN

• mm u, u wnm,m,==

l'

. j ..

AppendixA l

compartment does not screen out, it would be appropriate to refine the analysis to ensure that fire areas that may be dominant contributors to core damage risk are ranked properly, and that risk insights based on realistic fire scenarios are obtained.

l- The review of the Prairie Island Fire IPEEE generally found that no analysis refinements were made for fire areas that failed to screen-out based on very

. conservative criteria. The analyses were also limited to an incomplete set of potential fire induced scenarios and did not include consideration of fire-induced spurious actuation.

Fire Area 13 - Main Control Room - The analysis for the main control room assumed that all fires result in the need for evacuation regardless of whether fire suppression is successful. This treatment is inconsistent with all control room fire data and fire testing experience. The analysis assumes that the fire causes loss of Main and Auxiliary Feedwater and shutdown from outside the control room is credited. The analysis of the control room fails to address the potential for fire induced seal LOCA, spurious primary and/or secondary side PORV actuation, and fire induced loss of all offsite power. A walkdown of the control room panels determined that these fire induced scenarios were credible. Of particular concem is the single undivided panel containing the switchgear controls for the Safeguards 4kV buses for both units. A postulated fire in this panel could lead to a dual unit station blackout. The duration of this fire induced blackout would be based on the time required for the operators to gain control of the diesel generators and 4kV switchgear breakers from outside the control room.

l Fire Area 18 - Cable Soreadina and Relav Room - The analysis for the Cable Spreading and Relay Room assumed that a postulated fire would remain confined to a j single panel and that loss of any single panel would not be more severe that loss of Main and Auxiliary Feedwater. The basis for this approach relier, in part, on the installed automatic CO2 suppression system. This suppression systam actuates using ERIN

• sos ,a ,c4,he. A-7 W1300eot.021 Noms

, .I AppemlixA thermal detectors and incorporates a 60 second time delay. Time delays associated with system activation did not appear to have been considered. The analysis suffers from the same weaknesses as the Main Control Room. it fails to consider the potential for other potentially more severe scenarios being caused by the fire. In addition, industry tests on control panel fires indicate that damage to adjacent panels could occur if they contain sensitive electronic equipment. A walkdown of this room found that some of the panels had ventilation openings on top and on the front door. These openings would allow het gases to escape and potentially challenge the integrity of circuits routed in cable trays above the panels. The analysis for this room need to be expanded to address the potential for multiple panel fires, challenges to circuits in overhead cable trays, and additional fire induced scenarios.

Fire Area 20/80 - 4kV Safeauards Switchaear Room - The review of the analysis for these two areas noted that a postulated fire which disabled the 1RY offsite power feed to the switchgear did not result in the loss of the transformer to the switchgear in the opposite division room. The 1R transformer is a three winding transformer that supplies power to both the Safeguards and non-Safeguards 4kV buses. The presence of a fire induced short on any of the output circuits upstream of the switchgear itself l would require operation of the switchyard breakers to isolate the transformer and thereby de energizing the entire transformer. The Fire IPEEE did not appear to treat this fire induced failure in this fashion. Rather, it appear to only disable the 1RY feed to the switchgear at the fire location.

l l

Fire Area 31/32 - Auxiliary Feedwater Pumo Room - The fire propagation analysis for  !

L ' these rooms is based on modeling of a 1-quart oil spill hazard. It is assumed that all  ;

the equipment in the area where the fire occurs is lost if the suppression system fails.

The analysis of these areas has many deficiencies. The Appendix R combustible loading calculation shows that the most severe oil spill could involve the 6 gallons contained in any one of three air compressors. Such a spill in Fire Area 32 from air ERIN

• s,,s , ,ww A-8 wommmpe

i AppemlixA compressor 121 would disable that air compressor, the adjacent MCC, the Hot Shutdown Panel, and the control isolation switches for the two AFW pumps located in

.the area. Loss of the MCC would result in loss of power to air compressor 122. The loss of two air compressors disables the primary feed and bleed function. Fire induced failure of the Hot Shutdown Panel would require operator action to re-position AFW valves associated with the pumps in Fire Area 31. The fire could also damage cables routed in raceways throughout the area. One of the these circuits is the feed from offsite transformer CT11. - Fire induced failure of this circuit would result in loss of the CT11 supply' to both Bus 15 and 16. The analysis of this fire area is based on a non-bounding fire scenario and consequently failed to properly consider all of these potential vulnerabilities.

Fire Area 58/73 - Auxiliary Buildina Ground Floor - The Fire IPEEE identifies fire area )

58 as contributing 44% of the total plant fire risk. ' A walkdown performed as part of this review of fire areas 58 and 73 evaluated the ignition sources, combustibles, circuit routing, equipment locations, and other spatial attributes. This review concluded that the IPEEE results were inconsistent with the physical features of the area. The analysis performed no fire modeling~of this area. It is anticipated that fire modeling would yield three or more fire scenarios, all of which involving substantially less severe fire induced failures. The fire area features that would tend to mitigate the consequences of credible fire scenarios included the specific volumes of oil in each of the pumps, the distance and walls that separate the individual pumps, actual cable routes for each of the critical circuits, and the installed three hour rated wrapping on selected circuits.

Fire Area 69/70 - Turbine Buildina - The analysis for this area is based on a very conservative screening approach. All safety-related equipment whose cables are routed through the turbine building were assumed to be disabled by the postulated fire event. All potential combustible sources within the turbine building as well as in a few i

ERIN % = -o ,a,,>, m w .wme,

l . .

AppendixA other adjacent buildings were assumed to be capable of damaging all safety-related equipment. A walkdown of this area and the vulnerabilities associated with Safeguards equipment concluded that a relatively small spatial vulnerability exists. There are a number of raceways routed through the turbine building along the "G line" extending both east and west from the switchgear rooms. These raceways are enclosed in a non-combustible metal enclosure with no visible openings. The specific hazard that may represent a challenge to the integrity of these circuits is the main turbine lube oil tank.

A walkdown of this potential vulnerability found a few mitigating features that warranted consideration. The lube oil tank is provided with an adjacent automatic suppression system (located just outside the berm area) and with floor drains inside the berm area.

Additional automatic suppression systems are located adjacent to the raceway enclosure of interest. The physical arrangement of the walls, ficors, and ceiling are such that the ' target' would be located outside the plume of a postulated fire. In addition, it appears that it would also be outside the ceiling jet region. Based on these l

factors, it is expected that fire modeling will show that a postulated fire would not result in damage to the Safeguards circuits.

A.8 FIRE MODELING -

The objective of the Fire IPEEE is to evaluate credible and realistic fire scenarios to gain insights as to fire related plant core damage risk. . Given this objective, it is important that all fire areas that fail to screen-out have analyses based on physically realistic scenarios. Failure to do so could skew the overall risk profile and mask or otherwise conceal risk insights. The assessment of the Prairie Island Fire IPEEE determined that essentially no realistic fire modeling was performed. The one instance

, involving fire areas 31 and 32 where an analysis was prepared suffers from an invalid -

set of input parameters as discussed earlier. All fire areas that fail to screen should be considered for detailed fire modeling analyses so that proper analysis and treatment of l risk consequences can be performed.

ERIN'WWw A-10 w e .m m L_______________--___--_______-____________-_______ - _ _ _ _ _ - _ - - . _ _ _ - - _ _ _ _ - - - _ _ _ _ _ . _ _ _ _ _ - _ _

AppendixA A.9 RECOVERY / OPERATOR ACTIONS  ;

An evaluation of the operator recovery actions was performed for the dominant fire-related cutsets. This review of operator recovery actions found a number of critical weak areas in the Fire IPEEE analysis.

Modifications were made to IPE recovery actions which were not affected by the fire environment. For example, the probability of an operator failing to start the standby component cooling train was increased by a factor of 7.1 from the IPE value. This particular action takes place in the control room while the fire is postulated to occur in the auxiliary building ground floor elevation (fire area 58). Typical PRA practice is to q not modify IPE recovery probabilities unless operator actions can be affected oy environmental stressors as a result of the fire itself. The cutset which was altered became the dominant fire cutset contributing almost 36% to the total plant fire-induced core damage frequency.

Operator recovery actions which took place in the fire environment did not account for elevated stressors which can occur. For example, credit was given for an operator opening a component cooling system cross connect valve in the same area (fire area

58) where an extremely large fire was postulated. Typical PRA practice is to either not credit operator recovery actions at all in the presence of a fire or to allow recovery only after the fire has been suppressed. This recovery action was credited for the third most ,

dominant fire-related cutset.

Also, multiple redundant recovery actions were credited from the remote shutdown j' panel. Recovery was allowed in the fourth most dominant fire-related cutset for taking i control of the plant from the remote shutdown panel and also aligning for feed and bleed. These two operator actions do not appear to be independent events. As such, this cutset may not be minimal.

ERIN * ,: z2, ,n arch,he. A-11 w1309801-021798-9493 f

t

AppendixA Based in these deficiencies, it is recommended that a re-evaluation of operator recovery actions be performed for all unscreened cutsets. Particular-attention-should o

b,e fopysed_on those-cutsets-containing_ multiple _ operator-actions-to ensure ~that1he -

applied failure probabilitiesproperly-address.dependencQ A.10 SANDIA FIRE RISK SCOPING STUDY ISSUES l^

The NRC FPFI audit will focus extensively on potential seismic / fire interactions. The treatment of seismic / fire interactions in the Fire IPEEE was found to be incomplete.

Most of the potentially dominant seismic / fire interactions in the Fire IPEEE was found to be incomplete, Most of the potentially dominant seismic / fire risk contributors which are documented in Generic issue 57, " Effects of Fire Protection System Actuation on Safety-Related Equipment," have not been considered. These potential seismic / fire-related risk contributors have been documented in hformation Notice 94-12 and are also contained in the scope of the upcoming NRC FPFI audit.

I A physically incredible seismic / fire scenario has been postulated in the Fire IPEEE. l This scenario considers failure of a turbine building lube oil storage tank, subsequent l fire, and structural failure of the enclosure berm. Also, no credit is given for either automatic or manual fire suppression. No other Fire IPEEEs to date have identified a similar credible seismic / fire scenario for the turbine building even though most plants also have limited safety-related cables in the turbine building and some lube oil tanks.

I This review has concluded that treatment of the other five Fire Risk Scoping Study issues is also incomplete. In particular, very little credit has been given for manual fire suppression. In the control room analysis, control room abandonment is always l postulated, no matter whether the fire is quickly suppressed or not. For all other fire l

areas, the potential for manual fire suppression prior to damage to the critical safety-related equipment or its associated control and power cables is not considered.

I ERIN

• em.,a- m2 wnwamun 1

I e________________

AppendixA Insufficient documentation is provided in the submittal in the treatment of control systems interactions. More detail needs to be provided concerning the verification process of an electrically independent means of plant shutdown (given a postulated control room or cable spreading room fire). Other documentation weaknesses have been found regarding the other Fire Risk Scoping Study issues. These other documentation weaknesses are considered to be less significant.

Therefore, it is recommended that the analysis of the fire risks Fire Risk Scoping Study issues be completed and a more detailed evaluation of the seismic / fire scenario in the turbine building be performed.

I

{

1 ERIN

• c._ zt .m, rch,he. A-13 w1309eo1421798-9493 L-__-------------- -

i

t l Attachment 6 l

Prairie Island Nuclear Generating Plant Fire Protection Audit Practices SelfAssessment

)

L i

(.

l

)

l l

i saxmit Doc

_ _ _ _ _ _ _ _ _ _ _._..___1 _ . _ . _ _ . . _ _ _ . _ _ _ _ _

Fire Protection Audit Practices SelfAssessment Performed by: Ken Carlson Completed: 4/1/98

Purpose:

The purpose of this self-assessment was to evaluate the methods by which the NSP GQS organization has been accomplishing the Annual Fire Protection Audits. The assessment also reviewed the Fire Protection Audit Objectives for potential changes / improvements. The need to evaluate fire protection audit practices was identified as a result of analysis of the fourth quarter 1997 Prairie Island Tri-ennial Fire Protection Audit results.

Scope:

NRC Generic Letter GL 82-21, Technical Specifications for Fire Protection Audits, provides guidance on NRC expectations for fire protection related audits. This is the basis document used l by the outside consultants when performing the Tri-ennial FP audits. NSP has made no specific commitments to this document or the audit recommendations in Branch Technical Position APCSB 9.5-1, Appx. A. The NRC Fire Protection Program SER dated 9/6/79 accepted our QA program related to. fire protection controls. Review of the SER revealed no specific audit topic commitments Current industry practice and NRC expectations of audits in the fire protection area are to meet the guidelines of NRC GL 82-21.

The assessor compared NSP GQS Fire Protection Audit Plans and Objectives to the GL 82-21 guidelines. The assessor also compared other fire protection related audit objectives to these guidelines.

Generic Letter 82-21 also provides guidance on the qualifications of the audit team conducting fire protection audits. The assessor compared these guidelines to the qualifications of the

~ 1 personnel ro'utinely performing fire protection related auditing.

P Results:

GQS auditing activities currently meet all OQAP requirements for Fire Protection auditing. ,

j

.However, audit objectives and performance indicators are not consistent with current industry practice and NRC e: pectations for audits of fire protection programs to meet the guidelines of j j

NRC Generic Letter GL 82-21. i

)

Generic Letter 82-21 identifies three discreet fire protection audits-i-

1 - An annual fire protection and loss prevention inspection and audit. j i

I j

. _ _ _ _ _ _ _ _ ._____-____--__O

s

• II - A bi-ennial audit of the fire protection program and implementing procedures.

III - A tri-ennial fire protection and loss prevention inspection and audit.

The only difference between the annual audit and the tri-ennial audit is that the personnel conducting the tri-ennial audit must be outside qualified fire consultants, while the annual audits may be performed by NSP personnel.

GL 82-21 states the purpose of the bi-ennial audit of the fire protection program and implementing procedures is to assure that the requirements for design, procurement, fabrication, installation, testing. maintenance, and administrative controls for the respective programs continue to be included in the plant QA program for fire protection and meet the criteria of the QA/QC

, program established by the licensee.

The purpose of the annual and tri ennial audits is to assess the plant fire protection equipment and program implementation in depth to verify continued compliance with NRC requirements, the SAR commitments, and the license conditions.

I. NRC GL 82-21 provides minimum element recommendations for annual and tri-ennial fire protection audits. These audits should include inspection of all plant areas for which fire protection is provided and, in particular, examination of fire barriers, fire detection systems, and fire extinguishing systems provided for safety-related equipment. The generic letter lists nine (9) specific subject areas as minimum elements that should be verified. The assessor compared these 9 areas with our current fire protection related audit objectives and performance indicators.

A. The installed fire protection systems and barriers are appropriate for the objects protected by comparing them to NRC guidelines of SER approved alternatives and noting any deviations.

Audit objectives and performance indicators:

SFP01 Fire Protection Surveillance

1. 30-Panel fire barriers verified in proper position l #40-Fire hydrant barrel inspections SFP02 Fire Hazards Analysis i #20-10 CFR 50 Appx. R separation commitments SFP03 Fire Protection and Detection

1. 40-Adequacy of fire barrier penetration inspections

1. 50-Adequacy of fire barrier penetration materials These objectives and performance indicators evaluate the adequacy of fire barrier penetration l i materials, inspections, fire barrier verifications, and fire hydrant inspections. They also verify l

FHA consistency with the USAR. None of them directly discuss evaluation against NRC l guidelines, or the SER other than 10 CFR 50, Appx. R. Audit objectives and performance

, a 4

indicators that verify field conditions of barriers and systems against NRC guidelines and i i

approved alternatives should be generated.

B. The fire loading in each fire area has not increased above that which is specified in the SAR.

Audit objectives and performance indicators:

SFP02 Fire Hazards Analysis

1. 10-Established and implemented

1. 20-10 CFR 50, Appx. R separation commitments

1. 30-Updated i #40-Consistent with USAR l EDB05 USAR

1. 20-Adequately reflects plants current configuration l

l EMOO8 Plant Configuration Management

1. 10-Properly maintained after design changes These audit objectives and performance indicators verify the FHA is updated and consistent with  !

the USAR. They do not verify actual fire loading by observation of plant areas, only loading described in the FHA. Also, objectives EDB05 and EMOO8 are not part of the annual FP audit. '

l Audit objectives and performance indicators that compare actual plant fire loading i L

conditions to the FHA should be generated.

C. Regularly scheduled maintenance is performed on plant fire protection systems.

l Audit objectives and performance indicators:

[ SFP01 Fire Protection Surveillance l #10-Established and implemented / detection systems

1. 20-Established and implemented / protection systems SFP03 Fire Protection and Detection

1. 10-Established and implemented

1. 20-Post maintenance testing

1. 30-Preventive maintenance performance l-This area is adequately covered by the current audit process.

j D. Identified deficiencies have been promptly and adequately corrected.

Audit objectives and performance indicators:

)

i

)

indicators that verify field conditions of barriers and systems against NRC guidelines and approved alternatives should be generated.

B. The fire loading in each fire area has not increased above that which is specified in the SAR.

Audit objectives and performance indicators: l i

SFP02 Fire Hazards Analysis

1. 10-Established and implemented ,

1. 20-10 CFR 50, Appx. R separation commitments

1. 30-Updated c #40-Consistent with USAR j EDB05 USAR l

1. 20-Adequately reflects plants current configuration EMOO8 Plant Configuration Management ,

. #10-Properly maintained after design changes l These audit objectives and performance indicators verify the FHA is updated and consistent with the USAR, They do not verify actual fire loading by observation of plant areas, only loading l described in the FHA. Also, objectives EDB05 and EMOO8 are not part of the annual FP audit. I Audit objectives and performance indicators that compare actual plant fire loading conditions to the FHA should be generated. i C. Regularly scheduled maintenance is performed on plant fire protection systems, l Audit objectives and performance indicators:

SFP01 Fire Protection Surveillance

1. 10-Established and implemented / detection systems

1. 20-Established and implemented / protection systems SFP03 Fire Protection and Detection

1. 10-Established and implemented

1. 20-Post maintenance testing

' #30-Preventive maintenance performance

' This area is adequately covered by the current audit process.

D. Identified deficiencies have been promptly and adequately corrected.

r-Audit objectives and performance indicators:

y

h_-___-_.. _-___m____ _-__m__-m____.._.___.m__._______m_ ______ __

4 SFP04 Fire Protection Deficiencies

1. 10-Addressed

1. 20-Adequate emergency lighting

1. 30-Omega sprinkler head evaluations Performance indicators #20 and #30 appear to be specific deficiencies, and may not be appropriate as performance indicators. #10 relates to how identified deficiencies have been corrected. This area is adequately covered by the current audit process. SFP04 indicators #20 and #30 should be reviewed and removed if appropriate.

E. Special permit procedures (hot work) are being followed.

t Audit objectives and performance indicators:

SFP06 Fire Protection Practices

1. 20-Combustion source use permits

1. 40-Fire watches / tours within specified time limits MWC01 Work Control

1. 60-Fire prevention practices OPOl3 General Controls

1. 20-Fire prevention practices Objective SFP06 is the only objective specifically referenced in the fire protection audit. The other two objectives relate to hot work observed in the field during operations and/or maintenance audit activities. This area is adequately covered by the current audit process.

F. Plant personnel are receiving appropriate training in fire prevention and fire fighting procedures and that the training program is consistent with approved standards.

A'udit objectives and performance indicators:

SFP05 Fire Protection Personnel Training and Qualification '

1. 10-Training plans ,

1. 20-Attendance

{

#30-Completion criteria l

1. 40-Fire brigade '

l

1. 50-Drills and exercises j #60-Fire brigade physicals

1. 80-Fire brigade respirator fit / training None of the performance indicators address training and qualification of fire protection program / engineering personnel. A new performance indicator to assess training and qualification of the fire protection program / engineering personnel should be generated.

L______ _ _ _ _ _ _ - - _ .- J

G. Plant response to fire emergencies is adequate by analyzing incident records and witnessing an unplanned fire drill.

Audit objectives and performance indicators:

SFP08 Plant Response to Fire Emergencies

1. 10-Response documentation

, SFP05 Fire Protection Personnel Training and Qualification

1. 50-Drills and exercises Current industry standards require witnessing and unannounced fire drill at each nuclear site every year. SFP05 indicator #50 should relate to drills and exercises other than the witnessed drill. A new objective and performance indicator- to require witnessing an unannounced drill should be generated H. Administrative controls are limiting transient combustibles in safety related areas.

Audit objectives and performance indicators:

SFP07 Administrative controls

1. 10-Established and implemented This area is adequately covered by the current audit process.

I. Problem areas identified in previous audits have been corrected.

Audit objectives and performance indicators:

SFP04 Fire Protection Deficiencies

1. 10-Addressed The deficiencies addressed include past audit findings. To ensure appropriate coverage performance indicators should be generated to assess past QA Findings, CR's, NCR,s, etc.

l The generic letter also states that the audit should analyze all problem areas identified by the audit i

and recommend appropriate fire protection measures to provide a level of safety consistent with NRC guidelines. We do not have the internal expertise within the GQS department to provide an l adequate analysis to provide these recommendations. We do recommend that the condition be

corrected. If QA findings are issued we work with the line organization to develop realistic recommendations for the finding.

II. Part 10 of enclosure 2 to GL 82-21 provides guidance on the bi-ennial audit of the fire protection program and implementing procedures. By current industry standards this is a separate audit from the annua

• fire protection audit. Per the generic letter, the following provisions should be included in the bi-ennial audit:

A. Design Control and Procurement Document Control B. Instructions, Procedures, and Drawings i

C. Control of Purchased Material, Equipment, and Services D. Inspection Program E. Test and Test Control Program F. Inspection, Test, and Operating Status G. Nonconforming Item Control H. Corrective Action I. Records Our current audit process covers areas A, C, D, G, H, and I to some extent. These are covered under various audit subject areas in the engineering and plant support SALP audit areas.

Item A is covered under modification and design related engineering objectives EM001, EM002, EMOO3, EMOO4, EMOO6, EMOOS. None of these objectives or their related performance indicators specifically target fire protection related design or modifications. A new performance indicator should be generated to assess design / modification fire protection aspects.

The procurement issues are covered under plant support objective SPR02, Fire Protection Related Procurement. This objective and its related performance indicators adequately covers procurement.

Item C is covered under material control audit objectives EMC02, EMC03, and EMC05.

Procurement audit objectives SPR01, SPR05, and SPR08 also apply. No performance indicators specifically relate to control of purchased sevices. A new performance indicator related to control of purchased services should be generated.

Item D is adequately covered under the quality verification audit.

Items G, H, and I are covered in virtually every audit that is done.

Items B. E, and F are coverd programmatically within the audit process, however there are no specific audit objectives or performance indicators to assess these areas with respect to the fire protection program. New audit objectives and performance indicators should be generated to assess the following:

1. Fire protection program related instructions, procedures, and drawings

2. Fire protection related testing and test control program

3. Inspection, test, and operating status with respect to fire protection systems The NRC recommended approach to fire protection audits is to perform them with a qualified

, team including at least the following: a lead auditor from the licensee's QA organization, a systems engineer, and a fire protection engineer.

Our current practice is to perform the audits with qualified auditors from the QA organization, however we have not included a systems engineer, and the only time a fire protection engineer has been involved is when the tri-ennial audit is conducted. This results in the capability of the audit team being less than desirable to conduct a thorough audit based on the items discussed in GL 82-

21. This also inhibits the team's ability to make independent recommendations on appropriate fire protection measures to correct problem areas.

Recommendations:

1- Audit objectives and performance indicators that verify field conditions of barriers and systems against NRC guidelines and approved alternatives should be generated.

2- Audit objectives and performance indicators that compare actual plant fire loading conditions to the FIIA should be generated.

3- SFP04 indicators #20 and #30 should be reviewed and removed if appropriate.

4- A new performance indicator to assess training and qualification of the fire protection program / engineering personnel should be generated, 5- SFP05 indicator #50 shouid relate to drills and exercises other than the witnessed drill.

A new objective and performance indicators to require witnessing an unannounced drill should be generated 6- To ensure appropriate coverage performance indicators for objective SFP04 should be generated to assess past QA Findings, CR's, NCR,s, etc.

7- A new performance indicator should be generated to asmss design / modification fire protection aspects.

(- . .

p .

l j 8- A new performance indicator related to control of purchased services should be

generated.

l 9- New audit objectives and performance indicators should be generated to assess the following:

i 1. Fire protection program related instructions, procedures, and drawings

2. Fire protection related testing and test control program

3. Inspection, test, and operating status with respect to fire protection systems

10- Perform all fire protection audits, except the tri-ennial, via a team process with a team consisting of a NSP certified lead auditor and a fire protection engineer, and other auditors l.

as appropriate.

l L

I i

t l

l t

l l

Fire Protection Self Assessment Ar. tion Register I- Generate audit objectives and performance indicators that verify field conditions of barriers and systems against NRC guidelines and approved alternatives.

Responsible Individual:

Target Date:

2- Generate audit objectives and performance indicators that compare actual plant fire loading conditions to the FHA.

i Responsible Individual: ,

Target Date:

3- Review and remove SFP04 indicators #20 and #30 if appropriate.

Responsible Individual:

Target Date: i l

4- Generate a new performance indicator to assess training and qualification of the fire protection program / engineering personnel.

Responsible Individual:

Target Date:

5- SFP05 indicator #50 should relate to drills and exercises other than the witnessed drill.

Generate a new objective and performance indicators to require witnessing an unannounced drill.

Responsible Individual:

Target Date:

6- Generate appropriate coverage performance indicators for objective SFP04 to assess past QA Findings, CR's, NCR,s, etc.

Responsible Individual:

Target Date:

l t _ -_ -_____ _ ___ _ _

l 7- Generate a new performance indicator to assess design / modification fire protection aspects.

Responsible Individual' Target Date:

I 8- Generate a new performance indicator related to control of purchased services.

Responsible Individual: l l Target Date:

\

9- Generate new audit objectives and performance indicators to assess the following: )

1. Fire protection program related instructions, procedures, and drawings J

2. Fire protection related testing and test control program

3. Inspection, test, and operating status with respect to fire protection systems  !

i Responsible Individual:

} Target Date:

1

\

10- Perform all fire protection audits, except the tri-ennial, via a team process with a team consisting of a NSP certified lead auditor and a fire protection engineer, and other auditors

, as appropriate.

Responsible Individual:

Target Date:

l 1

(,

l l

_ _ _ _ _ _ - _ _ - - _ . - - - ..- ------------------A--- - - - - - - - ^ - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -