ML20207G037

Provides Info on Fire Risk & Significance of Reactor Fire Protection;Informs Commission About Completion of Fpfi Pilot Program as Directdd in SRM of 970207 & Make Recommendations on Appropriate Types & Frequencies of Rpfi

ML20207G037
Person / Time
Issue date:	05/20/1999
From:	Travers W NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
References
SECY-99-140, SECY-99-140-01, SECY-99-140-1, SECY-99-140-R, NUDOCS 9906100208
Download: ML20207G037 (45)

Text

.

RELEASEDTOTHE PDR fm%

i  : 4/9/99 TA) : ,

3

• S s

date initials  ;

...................eeeea

\...../

POLICY ISSUE (NEGATIVE CONSENT)

May 20.1999 SECY-99-140 FOR: The Commissioners FROM: William D. Travers Executive Director for Operations

SUBJECT:

RECOMMENDATION FOR REACTOR FIRE PROTECTION INSPECTIONS (WITS ITEM 199700021)

PURPOSE:

To provide information about fire risk and the significance of reactor fire protection; to inform the Commission about the completion of the fire protection functional inspection (FPFI) pilot program as directed in a staff requirements rnemorandum (SRM) of February 7,1997; and to make recommendations on the appropriate types and frequencies of reactor fire pro'.ection inspections and whether they should be part of the new reactor oversight process as directed in an SRM of April 1,1999.

BACKGROUND:

Overview of Reactor Fire Risk Risk assessments have shown that fires in nuclear power plants can be risk significant. To ensure that its decisions and recommendations regarding the regulatory program for reactor fire protection are commensurate with its importance and risk significance, the staff considers the underlying purpose of the regulatory requirements and, to the extent practicable, available CONTACTS:

Leon Whitney, SPLB/DSSA/NRR 301-415-3081 Steven West, SPLB/DSSA/NRR ,

301-415-1220 p Q 45-}Q- h 9906100208 990520 b bOI C Cd d b ~

PDR SECY 99-140 R PDR ,_

- The Commissioners fire risk data and insights. This paper presents an oveiview of the considerations applied by the staff.

Fire Protection Functional Inspection Pilot Proaram The staff informed the Commission of its plans for implementing the fire protection functional inspection pilot program in SECY-96-267, " Fire Protection Functional Inspection Program,"

December 24,1996. In an SRM of February 7,1997, the Commission informed the staff that it did not object to the staff's plans for the pilot program. In SECY-98-187, " Interim Status Report

- Fire Protection Functional Inspection Program," August 3,1998, the staff described the inspection results to date. The staff described its remaining work and the scope of its planned final report on the FPFI pilot program in SECY-99-040, "Second Interim Status Report - Fire Protection FunctionalInspection Program," February 5,1999. The staff briefed the Commission on February 9,1999, in an SRM of April 1,1999, the Commission directed the staff to include in its final report its recommendations on the appropriate types and frequencies of reactor fire protection inspections and whether they should be part of the new reactor oversight process. This paper presents the staffs final report on the FPFI pilot program and the staffs recommendations. This completes the staffs actions on WITS Item 199700021.

DISCUSSION:

Overview of Reactor Fire Risk Simply stated, the underlying purpose of the NRC fire protection regulation is to provide reasonable assurance that one means of achieving and maintaining safe-shutdown conditions will remain available during and after a fire. This is accomplished by applying the concept of fire protection defense in depth to reduce the likelihood of fires and to limit the extent of fire damage to the structures, systems, and components that would be used to achieve and maintain safe-shutdown in the event of a fire. The stated objectives of fire protection defense in depth are to prevent fires from starting; to rapidly detect, control, and extinguish fires that do start; and to design and protect structures, systems, and components so that a fire that is not promptly extinguished will not adversely affect safe-shutdown.

Fire is not treated as a design-basis accident, nor are fires postulated to occur simultaneously with non-fire-related failures in safety systems, plant accidents, or severe natural phenomena.

The regulation requires that only one train of equipment necessary to achieve hot shutdown be maintained free of fire damage. Unlike systems provided to mitigate design-basis accidents, the fire protection regulation does not require redundant or diverse post-fire safe-shutdown methods. Nor does the regulation require that fire protection systems and features or the structures,' systems, and components provided for achieving post-fire safe-shutdown be safety related, protected against a single failure, or covered by technical specifications. Finally, the regulation does not require that the equipment provided to achieve cold shutdown or to mitigate the consequences of design-basis accidents be maintained free of fire damage, in 1989, Sandia National Laboratories issued the " Fire Risk Scoping Study." This study, which included a review of the fire probabilistic risk assessments (PRAs) for four plants, concluded that the most risk-significant plant areas typically are main control rooms, cable spreading rooms, and switchgear rooms. According to this study, although plant modifications made in

The Commissioners response to Appendix R reduced, by a factor of 3 to 10, the core damage frequencies (CDFs) at the plants studied, fire can be an important contributor to CDF even after regulatory criteria have been satisfied. The study suggests that without the existing regulatory requirements, fire risk could be higher than it is today. The study also suggests that improper implementation of the regulatory requirements and degradation of fire protection defense in depth could be risk significant. The study concluded, for example, that weaknesses in either manual fire fighting effectiveness or control systems interactions could raise the estimated fire-induced CDF by an order of magnitude.

Under the individual plant examination of extemal events (IPEEE) program, the licensees systematically assessed the fire risk for each operating reactor. Although most licensees have reported numerical fire CDF estimates, the staff has not validated the accuracy of such i estimates. Because the licensees may have used simplifying assumptions and approximate procedures lii the analyses, the quantified CDF estimates reported in the IPEEE submittals only serve as generalindicators of plant fire risk. Nevertheless, the results of the IPEEE fire analyses provide important insights regarding reactor fire risk and confirm the results of the -

" Fire Risk Scoping Study." For example, the IPEEE results show that fire events are important contributors to the reported CDF for a majority of plants, ranging on the order of 1E-9/yr to 1E-4/yr, with the majority of plants repoding a fire CDF in the range of 1E-6/yr to 1E-4/yr. The reported CDF contribution from fire events can in some cases approach (or even exceed) that from intomal events. Licensees proposed or implemented procedural and/or hardware improvements in the fire area in response to the IPEEEs at more than half of the plants. (In most cases any risk reduction achieved by the improvements was not reported separdely, but was included in the total CDF.) Overall, the IPEEEs have confirmed that main control rooms, cable spreading rooms, and switchgear rooms are usually the most risk-significant plant areas.

Although it is generally understood that fire events can be serious and risk significant, fire science is a relatively new field. NRC fire research efforts and fire risk assessments have yielded both useful tools and important results. However, a number of important questions remain regarding the assessment and assurance of nuclear fire safety. For example, there are still significant uncertainties in the ability to mechanistically predict the behavior of fires under the broad variety of conditions that are relevant to nuclear power plant safety.

Attachment 1, " Fire Risk Fact Sheet," gives additional information about reactor fire risk.

Fire Protection Functional Inspection Proaram .

Pre-FPFI Pilot Program inspection Procedures Since Appendix R was issued in 1981, the staff published three reactor fire protection inspection procedures (IPs). 'These are IP 64100, "Postfire Safe Shutdown, Emergency Lighting and Oil Collection Capability at Operating and Near-Term Operating Reactor Facilities"; IP 64150, " Triennial Post-Fire Safe Shutdown Capability Reverification"; and IP 64704, " Fire Protection / Prevention Program."

i During the 1980s, the staff performed a 1-week team inspection at each facility using 2-IP 64100. These inspections consisted of an audit review of the plant fire protection features and post-fire safe-shutdown capability (hardware and procedures) egainst the licensee's l 1

e ,

b .

[ The Commissioners ' commitments and tht spplicable regulatory requirements. The inspections did not include detailed inspecSons of the safe-shutdown analysis or ofine design bases of fire detection systems, fire suppression systems, and fire barriers installed to protect safe-shutdown equipment.- For example, the inspector would verify, on an audit basis, that sprinkler systems installed to protect safe-shutdown equipment in accordance with the regulatory requirements were installed in the appropriate fire areas, but did not verify that the systems met the code requirements. Since these one-time inspections, the staff has re-inspected fewer than 10 plants in accordance with IP 64150, a 1-week regional initiative team inspection. The regions l conduct IP 64704, the routine (core) reactor fire protection inspection procedure, at each plant l

about once every 3 years. The objective of this IP, which is typically conducted by a regional inspector over about a 1-week period, is to inspect, on an audit basis, the overall adequacy of .

l the licensee's fire protection program. The focus of IP 64704 is on such typical fire protection l L features as extinguishers, fire hose stations, and sprinkler systems. In response to the l Thermo-Lag fire barrier and penetration real issues, the staff recently added to this IP additional guidance for inspecting these features. However, IP 64704, does not address l detailed design basis issues or post-fire safe-shutdown capability, nor does it thoroughly evaluate fire protection program configuration management.

l Basis For and Scope of FPFI Pilot Program l As documented in SECY-96-267, the FPFI program was based on the following staff commitments to the Commission: (1) to inspect the Thermo-Lag corrective actions at all plants, (2) to assess the NRC reactor fire protection program to determine if it had appropriately addressed all fire safety issues, (3) to determine if licensees are maintaining

. compliance with NRC fire protection requirements, (4) to identify the strengths and weaknesses of the reactor fire protection program, (5) to reevaluate the scope of the reactor fire protechon inspechon program, and (6) to develop a coordinated approach for reactor fire protection 'and systems inspections.

The FPFI pilot program consisted of a new inspechon procedure, four pilot inspections, a ' l

_ public workshop, and a final report. The staff conducted four pilot inspections,6 sing fire risk insights to help focus the inspections on areas most important to safety. Three of the four pilot inspections were full-scope FPFis. The fourth pilot inspection was a reduced-scope inspection of a licensee self-assessment. During the pilot program period, the staff also conducted major team inspections at Quad Cities and Clinton. . Attachment 2 is the " Fire Protection Functional Inspection Pilot Program Final Report." Among other things, the final report presents the detailed background of the FPFI pilot program, the program objectives and accomplishments, summaries of the FPFI findings and resulting enforcement actions, insights from the FPFI workshop, interactions with the Nuclear Energy Institute (NEI), and insights and lessons

!- . leamed fror'n the FPFI pilot program. For this paper and the final report, and for the the purpose of developing its plans for future reactor fire protection inspections, the staff considered the results of the four pilot FPFis and the results of the inspections at Quad Cities and Clinton. q i

l 1

i

The Commissioners Coordination With New Reactor Inspection and Oversight Program After it initiated the FPFI pilot program, the staff began to look for other ways to improve the NRC's reactor oversight process. To ensure that its plans for future reactor fire protection inspections would be consistent with the new reactor inspection and oversight program, the staff responsible for reactor fire protection and the FPFI program coordinated with the reactor

j. oversight task groups and considered the concepts and objectives of the new program when it developed the plans presented below.

Significant insights and Lessons Leamed The staff developed the following insights and lessons leamed from information it gathered l during the FPFI pilot inspections, the team inspections of Quad Cities and Clinton, and the FPFI workshop.

l- As discussed during the Commission meeting on February 9,1999, one of the results of the

! FPFI program was renewed industry attention to nuclear power plant fire safety. For example, in response to the FPFI pilot program a number of licensees conducted comprehensive self-assessments of their fire protection programs even though they had not been selected as pilot plants. In addition, in response to the FPFI pilot program, NEl is developing procedures to help licensees conduct self-assessments. (Additional information about this NEl effort is presented under " Ongoing Staff Work," below.) Finally, during NEl Fire Protection information Forums and other forums the staff has received information from licensees about voluntary changes to fire protection programs and planned self-assessments in response to the lessons j loamed from the FPFI pilot program.

For each FPFI, a senior NRR risk analyst reviewed available IPEEE results and other soiarcos  !

of risk information. (The FPFI inspection procedure contains guidance for using risk ,

information and insights to focus inspection activities.) The risk insights, which were used as input to the FPFI inspection plans, helped focus the FPFis on areas in which the potential fire ,

risks were greater and helped the inspectors improve their understanding of the significance  ;

of inspection findings.

As noted in SECY-98-187, potentially risk significant FPFI findings related to the regulatory requirements and licensee commitments had not been and would not have been revealed using the current core fire protection inspection procedure (IP 64704). Similarly, licensee quality assurance audits of reactor fire protection programs had not uncovered many of the findings related to the regulatory requirements and licensee commitments that were revealed during the pilot FPFis.

As noted above, until the FPFI pilot program, the NRC reactor fire protection inspection procedures did not direct the staff to thoroughly inspect the design bases of fire detection  !

. systems, fire suppression systems, and fire barriers installed to protect safe-shutdown

. equipment in accordance with the regulatory requirements or the details of the post-fire safe-shutdown analyses performed by the licensees to demonstrate compliance with the regulatory requirements. The FPFis included findings associated with the designs of fire protection systems and with safe-shutdown capabilities, including actions taken by licensees to resolve l Thermo-Lag fire barrierissues.

i l

f The Commissioners The FPFI pilot program inspection results and other indicators, such as licensee event reports, indicate deficiencies and weaknesses in reactor fire protection and post-fire safe-shutdown programs. For example, all of the pilot plants had some fire brigade weaknesses. Other findings were, for example, inadequate safe-shutdown analyses, inadequate or incomplete circuit analyses (discussed separately, below), incomplete safe-shutdown procedures, and inadequate attention to fire protection program management. The FPFI pilot program results suggest that deficiencies could exist in one or more layers of fire protection defense in depth at any given plant. As discussed above, because fires can be important contributors to CDF even after regulatory criteria have been satisfied, and because improper implementation of the regulatory requirements and degradation of fire protection defense in depth can be risk significant, it is important that the licensees maintain the reactor fire protection programs and that the staff monitor licensee performance in this area.

As noted above, the licensees for several of the FPFI pilot plants had conducted fire protection program self-assessments in advance of the FPFl. One of the pilot FPFis,was a reduced-scope inspection of a licensee self-assessment. _ The self-assessments were based largely on the FPFI procedure and lessons leamed by the licensees by observing previous pilot FPFis.

Overall, the licensee self-assessments were of good quality, were commensurate with the scope and depth of an FPFI, and reflected the strengths and weaknesses of the licensees' programs fairly well.

Independent of the FPFI pilot program and before the staff began the pilot FPFis, the reactor industry raised questions about the adequacy of the existing staff guidance concoming fire-induced circuit failures and the consistency of staff interpretations of both the guidance and the underlying regulatory requirements. The staff and the industry are currently working to 1

- resolve these questions and to develop riew guidance, if needed, to resolve this issue. During i several of the FPFis, the inspectors found compliance issues associated with the analyses that the licensees had performed to identify the circuits that require fire protection to support post- ;

fire safe-shutdown in accordance with the fire protection rule. These findings confirmed that j plant-specific circuit analysis issues may exist because of differing staff and licensee interpretations of the existing guidance and regulatory requirements. However, during the FPFI pilot program, the staff did not identify any significant new questions or issues concoming the existing fire protection regulatory requirements and guidance, or with the staff's licensing reviews of reactor fire protection programs. (The sta*f notes that at the FPFI workshop,  !

several participants expressed uncertainty as to what constitutes compliance with the fire 1 protection requirements, indicating that the uncertainty stems from the complexity of reactor fire protection, questions about existing staff guidance, and changing staff expectations.

l Circuit analysis was the only specific example offered. The ongoing staff and industry activities to resolve the circuit analysis issue and the comprehensive regulatory guide for i reactor fire ' protection that the staff is currently developing will address any uncertainties associated with the existing staff guidance and the regulatory requirements.)

Ongoing Staff Work Under the new reactor inspection and oversight progr m, fire protection (an area that includes fire protection features and post-fire safe-shutdown capability) falls within both the initiating events comerstone and the mitigating systems cornerstone. Fire protection is not presently covered by performance indicators. Therefore, reactor fire protection has been identified as an 4

The Commissioners inspectable area under the new program. As described in SECY-99-007A, " Recommendations for Reactor Oversight Process improvements (Follow-Up to SECY-99-007)," March 22,1999, the staff has drafted procedures for baseline inspections of fire protection programs that it l plans to test during the pilot program and then incorporate into the final program.

During a public meeting on March 25,1999, the staff discussed with NEl and other interested stakeholders its proposed fire protection baseline procedures. By letter dated April 14,1999, i

NEl submitted comments on the draft procedures and expressed concems about including fire protection in the pilot program because it was only recently added and the licensees may not have time to fully plan for this aspect of the pilot program. In response to NEl's comments, the staff revised the draft procedures, as appropriate. During a public meeting on May 6,1999, the staff met with NEl to discuss its letter of April 14,1999, and gave its revised procedures to

NEl. In response to NEl's concems about including fire protection in the pilot program, the i staff and NEl discussed conducting any pilot fire protection inspections late enough in the i program to allow for adequate planning and preparation by the staff and the pdot plant licensees. The staff indicated that it currently plans to conduct pilot fire protection inspections at three of the pilot plants. The specific plants have not yet been identified. The staff also indicated that it would take appropriate steps to ensure that the inspections were effective and j efficient, including for example, meeting with the pilot plant licensees to discuss the fire protection inspection process and to address any unanswered questions. The staff and NEl agreed to meet again on May 24,1999. The staff will continue to work with NEl and other stakeholders as appropriate.

I At the time of the FPFI pilot inspections, a tool for systematically assessing the risk {

significance of fire protection inspection findings was not available. During the FPFI workshop, there was general consensus that such a tool would be beneficial to both the staff and the industry. Subsequently, NRR's Plant Systems Branch and Probabilistic Safety Assessment Branch, with assistance from the Office of Nuclear Regulatory Research and the senior reactor l analysts, developed a proposed method for assessing the potential fire risk significance of fire protection inspection findings. After it is completed, the Fire Protection Risk Significance Screening Methodology (FPRSSM), which is described in Section 9 of the final report, could be i

used by inspectors to focus on risk-significant sets of inspection findings, while screening out findings that have minimal or no risk significance. The FPRSSM could also be used to evaluate inspection findings after the inspection. Inspection findings that the FPRSSM finds to be potentially risk significant (i.e., those that are not screened out as having minimal or no risk ,

significance) could be subjected to a more refined evaluation to help establish the appropriate j regulatory response to the findings. The FPRSSM could also be used by the licensees to ]

assess deficiencies found during self-assessments. j l

Although ttie FPRSSM was not available during the FPFis or the resulting enforcement proceedings, as a final activity of the FPFI pilot program, the staff used the FPRSSM to assess ,

a sample of the FPFI findings. The results of two FPRSSM assessments, one of potentially l high risk significance and one of low risk significance, are summarized in Section 10 of the j final report. The staff is working with the reactor oversight task groups to incorporate the FPRSSM into the Inspection Finding Risk Characterization Process described in SECY-99-007A. During a public meeting on March 25,1999, and the NEl Fire Protection Information Forum on May 3,1999, the staff discussed the proposed FPRSSM with NEl and other interested stakeholders. During a public meeting on May 6,1999, the staff gave NEl a l

L

O The Commissioners -

8-copy of the draft FPRSSM for review. The staff and NEl agreed to meet again on May 24,1999, to' discuss any NEl comments and to work through some sample applications.

NEl provided input and feedback on the FPFI pilot program during the FPFI workshop, in correspondence, and during follow-up meetings with the staff. NEl favors more reliance on licensee'self-assessments, with FPFis reserved for use when licensee performance approaches the " unacceptable performance," as defined by the new inspection and oversight program. : An NEl issue task force is developing procedures (based on the FPFI procedure) to help licensees conduct self-assessments. It is the staff's understanding that NEl plans to

phase in the self-assessment procedures, which will be available for licensees to use on a voluntary basis, beginning in summer 1999. While recognizing the difficulties of doing so, NEl has also formed an issues task force to develop performance indicators for reactor fire protection programs. NEl plans to complete small-scale performance indicator pilot trials at reactor sites by July 2000. ' During the public meetings o.1 March 25 and May 6,1999, the staff informed NEl that it would consider the results of NEl's efforts in the new reactor inspection and oversight program as they become available.

Conclusions Although the FPFI program involved a relatively small sample of plants, the results of the l

, inspections, coupled with other indicators, such as licensee event reports, suggest that continued monitoring of licensee performance is needed to achieve confidence that risk- '

significant fire protection program deficiencies do not exist at any given plant. Inspection is a proven and appropriate means of both monitoring licensee performance and finding deficiencies. Therefore, on the basis of the insights ano lessons leamed from the FPFI pilot program, the importance of fire protection from the point of view of potential risk, past operational experience (e.g., such issues as Thermo-Lag and circuit analysis), the absence of fire protecten and post-fire safe-shutdown performance indicators, and the existing regulatory requirements, the staff concludes that some level of NRC inspection of reactor fire protection programs is appropriate to maintain safety and increase public confidence. The staff also concludes that future NRC file protection inspections should be consistent with the concepts  ;

and objectives of the new reactor inspection and oversight program and should be included within that program.

' The staff believes that future fire protection inspectons should be more comprehensive and l risk informed than the current core inspechons. For example, future inspections should address the existing regulatory requirements regarding post-fire safe-shutdown capability,  !

which are not inspected under the current core inspection program, with emphasis on

. activities, plant areas,'and safe-shutdown configurations where the potential risks are greater.

in light of the renewed industry attention to reactor fire safety and NEl's plans for voluntary self-assessments, the staff also concludes that intense fire protection inspections, such as full- ,

scope FPFis, are not warranted as a routine-type inspection, but should be available for use on an as-needed basis, such as when plant performance declines or to respond to a specific event or problem at a plant.

The staff believes that, over both the short and long terms, licensee self-assessment activity c

will increase. The number and significance of reactor fire protection program deficiencies should decrease in response to more frequent and more robust self-assessments and NRC

l The Commissioners monitoring through the baseline inspections. Therefore, the staff concludes that it would be appropriate to consider licensee self-assessments during future NR,C inspections, provided

, that the scope and depth of the self-assessments are equivalent to the sicope and depth of the >

L NRC inspections discussed below. In such cases, in addition to some independent verifications of fire protection program features, the NRC inspections would verify the accuracy l of the licensees' assessment processes, and would review the licensees' effectiveness in l maintaining the appropriate level of performance to assure safe operation, and in finding and I ' resolving problems. In addition, taking into account the new reactor inspection and oversight program, if valid fire protection performance indicators are eventually developed, the staff will I

reassess the baseline fire protection inspection program (discussed in the following section) and consider changing the scope and frequency of the inspections, as appropriate. The staff's planned actions are presented below.

RECOMMENDATION:

Unless otherwise directed by ths Commission, the staff will:

1. Include risk-informed baseline procedures for routine resident inspector walkdowns and for triennial fire protection team inspections within the new reactor inspection and oversight program to monitorlicensee performance in the fire protection area. The staff previously described this approach in SECY-99-007A.

2. Structure the triennial baseline inspection procedure to emphasize its modular nature so that it could be used, for example, to independently inspect Thermo-l.ag corrective actions, licensee self-assessments, and specific aspects of fire protection defense in depth. To the extent practicable, the staff will schedule the triennial inspections so that plants that have not performed or do not plan to perform self-assessments are inspected before those that have done so.

3. Issue the FPFI pilot procedure as a permanent IP. The staff will format the procedure to emphasize its existing modular structure so that individual modules (e.g., fire l barriers, fire brigade, and safe-shutdown capability) could be applied independent of the entire procedure. The' FPFI procedure (a) would be used by the staff to support the ,

triennial inspections as specified in the triennial inspection procedure, (b) would be used by the staff when plant performance falls below a threshold to be established by the new inspection and oversight program or in response to a specific event or problem at a plant, and (c) could be used by the licensees as guidance for self-assessments.

4. . Delete IP 64100, IP 64150, and IP 64704 after the new reactor inspection and oversight program is implemented. (The procedures recommended above would supersede these existing procedures. Therefore, IPs 64100. 64150, and 64704 would no longer be needed.)

Staff requests action within 10 days. Action will not be taken until the SRM is received. We consider this action to be within the delegated authority of the EDO.

COORDINATION The Office of the General Counsel has review th!s Commission paper and has no legal objections.

f The Commissioners l

' The Office of the Chief Financial Officer has reviewed this Commission paper for resource l implications and has no objections.

__ j j

A if ^.L William D. Travers Executive Director for Operations Attachments: 1. Fire Risk Fact Sheet

' 2. FPFI Pilot Program Final Report SECY NOTE: In the absence of instructions to the contrary, SECY will notify the staff on Monday, June 7,1999 that the Comission, by negative consent, assents to the action proposed in this paper.

DISTRIBUTION:

Comissioners OGC OCAA OIG ]

OPA OCA

. ACRS CIO CFO EDO .

REGIONS-SECY

)

I i

Attachment 1 FIRE RISK FACT SHEET

• The average reported fire frequency at operating plants for the period 1965-1994 is 3.3E-1/yr'

• The average reported fire frequency for the pre-Appendix R implementation period 1965 -

1985 is 3.8E-1/yr' e The average reported fire frequency for the post-Appendix R implementation period 1985 - 1994 is 2.8E-1/yr' e During the post-Appendix R implementation period (1986-1994) there were two fire events that resulted in a scram and a loss of function of one safety related division or a loss of offsite power. This compares to 10 such events (not including the Browns Ferry fire) during the pre-Appendix R implementation period (1965-1985).'

e There were 41 fire events that resulted in L plant scram with no loss of function of a safoty related division in the 20 year pre-Appendix R implementation period and 40 such events in the 8 year post-Appendix R period.'

• Thirteen large losses from fire events at nuclear power plants during the period from 1966 - 1995 resulted in a total reported monetary loss of approximately $800 million, with an average monetary loss per event of approximately $62 million."

e On June 21,1991, the NRC issued GL 88-20, Supplement 4, requesting licensees to '

perform an Individual Plant Examination of Extemal Events (IPEEE) to (1) develop an  :

appreciation of severe accident behavior, (2) understand the most likely severe accident sequences, (3) gain a aualitative understanding of the overall likelihood of core damage and radioactive release, and (4) if necessary, to reduce the overalllikelihood of core l damage and radioactive release by modifying hardware and procedures that would help prevent or mitigate severe accidents.8 1

Shcial Study Fire Events - Feedback of U.S. Operating Experience, June 1997, James R. Hosghton, l Office for Analysis and Evaluation of Operational Data, USNRC l 2 l A 30-Year review of Large Losses in the Gas and Electric Utihty Industry 1966 1995, James B. Biggins, J&H Marsh & McLennan,1997 3

NUREG 1407," Procedural and Submittal Guidance for the individual Plant Examination of External j Events (IPEEE) for Severe Accident Vulnerabilities," USNRC, June 1991 ,

1 Page 1 of 2

I e Based on the IPEEE results, fire events are important contributors to the reported core damage frequency (CDF) for a majority of plants. The reported CDF contribution from fire events can in some cases, approach (or even exceed) that from internal events.*

• The reported IPEEE fire CDFs range on the order of E-9/yr to E-4/yr, with the majority of plants reporting a fire CDF in the range from 1E-6/yr to 1E-4/yr.5 More than half of the plants proposed or implemented procedural and/or hardware improvements in the fire area in response to their IPEEE.

l e Although most licensees have reported numerical fire CDF estimates, it is important to j note that the accuracy of such estimates has not been validated under the IPEEE l submittal review. Because simplifying assumptions and approximate procedures may l

have been used in the analyses, the quantified CDF estimates reported in the licensees' IPEEE submittals should 2Di y serve as a general indicator of plant risk. With that in mind the following preliminary information is provided.

a. Fire CDFs for approximately 40 units were greater than or equal to 1E-5/yr.

b. Fire CDFs for approximately 11 units were greater than or equal to 1E-4/yr.

c. Of those 29 units whose fire CDF was between 1E-5/yr and 1E-4/yr, approximately 17 had a reported fire CDF greater than or equal to the repor1ed internal events CDF.

d. Of those 11 units whose fire CDF was greater than or equal to 1E-4/yr,9 units had a fire CDF greater than or equal to the reported intemal events CDF. For the remaining 2 units the fire CDF was comparable to the intemal events CDF.

l l

l i

4 January 20.1998, memorandum to the Ccmmissioners from L Joseph Callan, Executive Director for Operations, Preliminary IPEEE Insights Report 5

This range includes all plants except Quad Cities. The licensee for Quad Cities will submit a revised and updated IPEEE fire analysis during May 1999.

Page 2 of 2 c

ATTACHMENT 2 Fire Protection Functional Inspection Pilot Program )

Final Report

. Plant Systems Branch i

and Probabilistic Safety Assessment Branch -

Division of Systems Safety and Analysis ]

Office of Nuclear Reactor Regulation i i

April 1999 t L. E. Whitney, P. M. Madden, E. A. Connell, J. S. Hyslop, K. S. West l

I

l I TABLE OF CONTENTS -

1 l

l 1. BAC KG R O U N D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 Bases for and Status of the FPFI Pilot Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 FPFI Pilot Program Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Scope of FPFI Pilot Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2. OVERVIEW OF REACTOR FIRE RISK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3. EXISTING FIRE PROTECTION INSPECTION PROCEDURES . . . . . . . . . . . . . . . . . . . . 7

4.

SUMMARY

OF FPFi lNSPECTION FINDINGS . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . 8 Pilot F P Fi s '. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 River Bend Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 S u sq ueh a nn a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . 9 St. Lu cie . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Prairie l sland . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . .. . . . . . . . . . . . . . 10 Clinton and Quad Cities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Clinto n . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 Q uad Citie s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 11

5. FP Fl WO R KS H O P . . . . . . . . . . . . . . . . . . . . . . . . . . .. ........... ......... 12

6. FPFI PILOT PROGRAM INSIGHTS AND LESSONS LEARNED . . . . . . . . . . . . . . . . . . . 14

7. CONCLUSIONS AND BASES FOR STAFF PLANS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

8. PLAN N ED STAFF ACTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

9. FIRE PROTECTION RISK SIGNIFICANCE SCREENING METHODOLOGY . . . . . . . . . 18

10. SAMPLE APPLICATIONS OF FPRSSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Q ua d Cities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 St. Lu cie . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 9

11. PROGRAM ACCOMPLISHMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Appendix A - FPFI Assessment Tree Appendix B - Fire Risk Fact Sheet Appendix d - Summary of Pilot FPFI Enforcement Actions Appendix D - Sun: mary of Staff Interactions with the Nuclear Energy institute i

Fire Protection Functional inspection Pilot Program Final Report

1. BACKGROUND Bases for and Status of the FPFI Pilot Prooram in a memorandum of August 25,1992, the staff of the U.S. Nuclear Regulatory Commission (NRC) submitted to the Commission its action plan for resolving the Thermo-Lag fire barriers issues. :The staff stated taat it would develop and implement a program to inspect the Thermo-Lag corrective actions at each plant. _ At that time, the staff believed that the licensees would simply replace or upgrade their existing Thermo-Lag fire barriers. However, since that time, the licensees have proposed a much broader range of corrective action options. For

. example, many licensees have initiated fire barrier reduction programs. The objective of these programs, which are based largely on reassessments and subsequent revisions of the plant

- post-fire safe shutdown analysis, is to eliminate as much as possible the need for fire, barriers.

Typical outcomes of barrier reduction programs include redefined fire area boundaries, new or relocated safe shutdown components, and new operator actions and procedures. Many licensees were also performing engineering evaluations to justify either eliminating certain Thermo-Lag barriers or keeping them as they are (i.e., without upgrades), in some cases, the licensees used such evaluations to justify exemptions from the NRC fire protection regulations.

In the memorandum of August 25,1992, the staff also informed the Commission that it would reassess the NRC reactor fire protection program to (1) determine if the program had .

appropriately addressed the safety issues, (2) determine if licensees are maintaining I compliance with the NRC fire protection requirements, (3) identify the strengths and weaknesses of the program, and (4) make recommendations for improvement. The staff issued its " Report on the Reassessment of the NRC Fire Protection Program" on 1 I

February 27,1993. That report recommended, in part, that the staff (1) develop a coordinated approach for the fire protection and systems inspections and (2) reevaluate the scope of the fire pnaection inspection program. In SECY-93-143,"NRC Staff Actions To Address the Recommendations in the Report on the Reassessment of the NRC Fire Protection Program" dated May 21,1993, the staff informed the Commission that it would implement these reassessment recommendations as part of the Fire Protection Task Action Plan. To do so, the staff considered fire events, licensee reports of deficiencies in the fire protection program, previous NRC inspection findings, the scope and adequacy of the existing NRC fire protection inspection program, and the need to inspect other plant fire protection features in response to ongoing NRC programs (e.g., self-induced station blackout, fire barrier penetration seals, turbine building assessments, and individual plant examinations of extemal events (IPEEEs)).

On the basis of the wide range of Thermo-Lag corrective actions proposed by the licensees, the staff concluded that an inspection of broader scope than that proposed in the Thermo-Lag

- Action Plan was needed. In addison, in view of the preliminary results of its work under the reassessment recommendation, the staff concluded that additional fire protection inspection effort appeared to be warranted. In SECY-95-034, " Status of Recommendations Resulting from the Reassessment of the NRC Fire Protection Program," dated February 13,1995, the staff informed the Commission that it was considering initiating a fire protection functional inspection (FPFI) program, which would cover all aspects of nuclear power plant fire safety

)

t F

(including Thermo-Lag fire barriers) and prcvide for more efficient, comprehensive and effective inspections. Revision and/or cancellation of some of the existing fire protection inspection procedures will be considered as part of tne FPFI program.

In a memorandum to the Commission dated September 20,1995, the staff documented its conclusion that an inspection of broader scope than that originally specified in the Thermo-Lag

- Action Plan was needed. The staff also informed the Commission that instead of the stand-alone Thermo-Lag fire barrier inspection pmgram that it had proposed, it would develop and

. Implement the FPFI program it had outlined in SECY-95-034. On February 8,1996, the staff briefed the Chairman on its plans for the future direction of the NRC reactor fire protection program including the FPFI program. Later, in an April 3,1996 memorandum to the Commission, the staff documented the framework for future direction of the NRC fire protection program with emphasis on the FPFI program, a plan for developing and implementing this program,- and a plan for centralized management, by the Office of Nuclear Reactor Regulation (NRR), of the FPFI program and all other reactor fire protection wod, in SECY-96-267, " Fire Protection Functional Inspection Program," dated December 24,1996, the staff informed the Commission of its plans for implementing the FPFI pilot program. The proposed FPFI pilot program consisted of developing the FPFI inspection procedure, conducting four pilot inspections and a public wo& shop, and preparing a final report. In a staff requirements memorandum (SRM) of February 7,1997, the Commission informed the staff

. that it did not object to the staff's plans to implement the FPFI pilot program, and indicated its interest in strategies that would shorten the time for the benefits of the program to become available to all licensees. The Commission requested that the staff send a report to the Commission at the end of the pilot program. By memorandum dated June 23,1997, the staff provided its draft FPFI procedure to the Commission.

In SECY-98-187, " Interim Status Report - Fire Protection Functional Inspection Program," i dated August 3,1998, the staff described the inspection results to that date, its plans to complete the pilot program, and the adjustments it had made to the pilot program since it issued SECY-96-267. Later, in SECY-99-040, "Second Interim Status Report - Fire Protection Functional inspection Program," dated February 5,1999, the staff explained the basis for extending the FPFI pilot program schedule and reported that its final report on the FPFI program would (1) provide an analysis of the FPFI findings, regional FPFl inspection followup activities, and enforcement actions arising from the pilot FPFis; (2) provide information on the use of risk insights for fire protection inspections; (3) discuss and evaluate the types of NRC  :

fire protechon inspechons that it has conducted since the fire protection regulation was issued in 1981; (4) address the strategies in which the Commission expressed interest in the SRM of February 7,1997; and (5) recommend the appropriate types and frequencies of reactor fire protection inspection (e.g. NRC-led and licensee self-assessments).

On February 9,1999, the staff briefed the Commission on the FPFI program. In an SRM of April 1,1999, the Commission directed the staff to provide its recommendations on the the appropriate types and frequencies of reactor fire protection inspections, and report on whether fire protection functional inspections are needed, and whether fire protection inspections should be part of the new reactor oversight process.

_o

l

[

)

FPFI Pilot Proaram Obiectives )

The objectives of the FPFI pilot program, as stated in the staff documents discussed under Section 1," Background," are summarized below. Accomplishment of these program objectives is discussed in Section 11 of this report.

1. To develop a strong, broad-based, coherent and coordinated NRC Fire Protection Prograin commensurate with the safety significance of the subject.

. 2. 1 To inspect licensee Thermo-Lag fire barrier corrective actions and compliance strategies.

3. To inspect non-Thermo-Lag fire protection features in response to ongoing NRC programs -

(e.g., self-induced station blackout, fire barrier penetration seals, turbine building assessments, and IPEEEs).

4. To provide immediate safety benefit through renewed industry attention to nuclear power

. plant fire safety.

5. To develop criteria for licensee fire protection self-assessments.

6. To ensure compliance with NRC post-fire safe shutdown regulations and commitments.

7. To focus resources on the fire protection issues of most importance.

8. To evaluate the scope and adequacy of the existing NRC reactor fire protection programs, and develop recommendations for program improvements, if warranted.

9. To review licensee fire protection and post-fire safe shutdown configuration management.

10. To provide clear guidance to the staff and industry regarding oversight of reactor fire protection programs, i

.11. To address smoke propagation and manual fire fighting operations, and their impact on equipment operability and operator actions.

12. To address balance of plant fire risks.

13. To improve consistency of intemal NRC oversight of licensee fire protection program.

14. To address fire safety considerations not expressly addressed by the fire protection regulation (e.g., event based fires, fire-induced plant transients, seismic / fire interactions, and fire-induced release of radioactive materials).

Scooe of FPFI Pilot Prooram The FPFI pilot program consisted of developing the FPFI inspection procedure, conducting four

' pilot FPFis and two other FPF1-type team inspections, holding a public workshop, and preparing this final report.

)

The pilot FPFis were announced, risk-informed inspections that covered all aspects of reactor fire safety. A FPFI assessment diagram is included as Appendix A. The principal focus of the /

1 inspections was on the plant fire protection and post-fire safe shutdown design and licensing bases and those fire protection program elements that are covered by existing NRC regulations and guidelines. These included, for example, safe shutdown performance objectives, safe -

shutdown systems and equipment, fire protection systems and barriers, emergency lighting, reactor coolant pump oil collection systems, quality control and quality assurance, configuration control including change control process, administrative controls and procedures, and training.

This aspect of the FPFI program satisfied the program objective of ensuring continued licensee compliance with NRC fire protection regulations and commitments. In addition, the pilot 4 inspections included reviews of fire safety considerations that are not expressly addressed by the fire protection regulation, but by other regulatory programs. This included, principally, Generic Letter 88-20, Supplement 4, " Individual Plant Examinations of External Events (IPEEE).

for Severe Accident Vulnerabilities,10 CFR 50.54(f)," dated June 28,1991. Such inspection j areas included,'for example, event initiated fires, fire induced reactor transients, and potential seismic fire interactions.

The Office of Nuclear Reactor Regulation (NRR) led pilot FPFis at River Bend, Susquehanna, and St. Lucie using inspectors from NRR, the regional offices, and Brookhaven National Laboratory. NRR coordinated plant selection and inspection schedules with the regional offices. The staff performed the inspections in accordance with the approach described in SECY-96-267 (2 weeks of preparation,1 week inspecting on site,1 week reviewing in office, and a final week inspecting on site) using the FPFI procedure that it had sent to the Commission in the memorandum of June 23,1997. This procedure is much broader in scope than the existing fire protection core inspection procedure (IP 64704, " Fire Protection Program"). For example, although the objective of IP 64704 is to evaluate the overall adequacy I I

of the licensee's fire protection program, it does not address post-fire safe-shutdown capability.

nor does it thoroughly evaluate fire protection program management and configuration control.

The FPFI procedure also differs from the core inspection procedure in that it provides guidance to the inspectors for using risk insights to help focus on areas most important to safety. NRR

' risk analysts helped the FPFI team obtain fire risk insights for the plant-specific inspection plans. j For these three pilot inspections, NRR prepared the FPFI reports and sent them to the licensees after the appropriate regional office reviewed the report. Like other NRR-led team inspections, and as described in SECY-96-267, the regional offices completed any inspection

. follow-up and enforcement actions resulting from the FPFl. After NRR issued the FPFI report to the licensee, it made recommendations for inspection follow-up and enforcement to the regional office and supported regional follow-up activities as requested by ths region.

Prairie Island was the fourth and final pilot FPFl. In SECY-96-267, the staff stated that licensee self-assessments could be an important element of the permanent FPFI program and that it would consider the role of self-assessments after it completed the pilot FPFI program. In the SRM of February 7,1997, the Commission stated that it was interested in the use of licensee self-assessments as a strategy to relieve some of the staff inspection burden to the extent that the NRC can be assured that the self-assessments are of good quality and accurately reflect

'the strengths and weaknesses of the program. The Commission noted that staff review of the self-assessments would be warranted to gain this assurance. After the staff announced the FPFI pilot program, Northern States Power Company conducted a self-assessment of the i

Prairie Island fire protection and post-fire safe-shutdown programs in anticipation of receiving a pilot FPFl. This gave the staff an opportunity to test an inspection strategy involving licensee self-assessments as part of the FPFI pilot program. This pilot inspection differed from the three previous pilot inspections in two significant ways. First, it was a reduced-scope inspection of a licensee self assessment instead of a full-scope FPFl. Second, it was led by the region rather than by NRR. NRR provided staff and contractor support to the region.

.in contrast to a full FPFI, the self-assessment inspection of Prairie Island was a one-week inspection. The NRC inspection team evaluated the licensee's self-assessment effort to determine whether or not the scope and depth of the effort were equivalent to an FPFI, or if the licensee had an acceptable basis for reducing the scope or depth. The team reviewed the licensee's organization, the technical qualifications of the licensee's assessment team, the completeness of the assessment, the corrective actions proposed by the licensee for the more significant assessment findings, and the licensee's handling of any operability concems. The staff considered this exercise in formulating its recommendations for future reactor fire protection inspections.

During the FPFI pilot program period, the staff also conducted major team inspections at Clinton and Quad Cities. Like the FPFI pilot inspections, these inspection experiences provided insights into possible weaknesses with the core fire protection inspection program, the potential benefits of more comprehensive fire protectiJn inspections (like FPFis), and the use of licensee self-assessments. Therefore, the staff also considered the results of these two inspections when it assessed the insights and lessons leamed from the FPFI pilot program and developed its recommendations for the types and frequencies of future reactor fire protection inspections.

The findings from the pilot FPFis and from the team inspections at Clinton and Quad Cities are summarized in Section 4 of this report.

On November 10,1998, the staff held a one-day workshop on reactor fire protection inspections. The workshop is discussed in Section 5 of this report.

2. OVERVIEW OF REACTOR FIRE RISK Risk assessments have shown that fires in nuclear power plants can be risk significant. To ensure that its decisions and recommendations regarding the regulatory program for reactor fire protection are commensurate with its importance and risk significance, the staff considers the underlying purpose of the regulatory requirements and, to the extent practicable, available fire risk data and insights. ,

Simply stated, the underlying purpose of the NRC fire protection rhulation is to provide reasonable assurance that one means of achieving and maintaining safe-shutdown conditions will remain available during and after a fire. This is accomplished by applying the concept of fire protection defense in depth to reduce the likelihood of fires and to limit the extent of fire damage to the structures, systems, and components that would be used to achieve and maintain safe shutdown in the event of a fire. The objectives of defense in depth are to prevent fires from starting; to rapidly detect, control, and extinguish fires that do start; and to design and protect structures, systems and components so that a fire that is not promptly extinguished will not adversely affect safe shutdown.

4 Fire is not treated as a design-basis accident, nor are fires postulated to occur simultaneously with non-fire-related failures in safety systems, plant accidents, or severe natural phenomena.

The regulation requires that only one train of equipment necessary to achieve hot shutdown be maintained free of fire damage. Unlike systems set up to mitigate design-basis accidents, the

- fire protection regulation does not require redundant or diverse post-fire safe-shutdown methods. Nor does the regulation require that fire protection systems and features or the structures, systems, and components provided for achieving post-fire safe shutdown be safety related, protected against a single failure, or covered by technical specifications. Finally, the regulation does not require that the equipment provided to achieve cold shutdown or to mitigate

- the consequences of design-basis accidents be maintained free of fire damage.

In 1989, Sandia National Laboratories issued the " Fire Risk Scoping Study." This study, which included a review of the fire probabilistic risk assessments (PRAs) for four plants, concluded that the most risk significant plant areas typically are main control rooms, cable spreading

. rooms, and switchgear rooms. According to this study, although plant modifications made in response to Appendix R reduced, by a factor of 3 to 10, the core damage frequencies (CDFs) at the plants studied, fire can.be an important contributor to CDF even after regulatory criteria have been satisfied. The study suggests that without the existing regulatory requirements, fire {

risk could be higher than it is today. The study also suggests that improper implementation of 1 I

the regulatory requirements and degradation of fire protection defense in depth could be risk significant. The study concluded, for example, that weaknesses in either manual fire fighting effectiveness or control systems interactions could raise the estimated fire-induced CDF by an order of magnitude.

Under the IPEEE program, the licensees systematically assessed the fire risk for each operating reactor. The results of the IPEEEs confirm the results of the " Fire Risk Scoping Study." Although most licensees have reported numerical fire CDF estimates, the staff has not validated the accuracy of such estimates: Because the licensees may have used simplifying assumptions and approximate procedures in the analyses, the quantified CDF estimates reported in the IPEEE submittals only serve as general indicators of plant fire risk.

Nevertheless, the IPEEE fire analyses provide important insights regarding reactor fire risk. For '

example, the IPEEE results show that fire events are important contributors to the reported CDF for a majority of plants, ranging on the order of1 E-9/yr to 1E-4/yr, with the majority of plants reporting a fire CDF in the range of 1E-6/yr to 1E-4/yr. The reported CDF contribution from fire events can in some cases approach (or even exceed) that from intemal events. More than half of the plants proposed or implemented procedural and/or hardware improvements in the fire area in response to their IPEEE. (in most cases any risk reduction achieved by the improvements was not reported separately, but was included in the total CDF.) Overall, the IPEEEs have confirmed that main control rooms, cable spreading rooms, and switchgear rooms are usually the most risk-significant plant areas, Although it is generally understood that fire events can be serious and risk significant, fire science is a relatively new field. NRC fire research efforts and fire risk assessments have yielded both useful tools and important results. However, a number of important questions remain regarding the assessment and assurance of nuclear fire safety. For example, there are stil1significant uncertainties in the ability to mechanistically predict the behavior of fires under the broad variety of conditions that are relevant to nuclear power plant safety.

Appendix B, " Fire Risk Fact Sheet," gives additional information about reactor fire risk.

=

3. EXISTING FIRE PROTECTION INSPECTION PROCEDURES As discussed under Section 2, the underlying purpose of the NRC fire protection regulation is to provide reasonable assurance that one means of achieving and maintaining safe shutdown conditions will remain available during and after a fire. This is accomplished by applying the -

concept of fire protection defense-in-depth to reduce the likelihood of fires and to limit the extent of fire damage to the structures, systems, and components that would be used to achieve and maintain safe shutdown in the event of a fire. Since the fire protection regulation was issued in 1981, the staff published three reactor fire protection inspection procedures (IPs).

These are IP 64100, "Postfire Safe Shutdown, Emergency Lighting and Oil Collection Capability at Operating and Near-Term Operating Reactor Facilities"; IP 64150, " Triennial Post Fire Safe Shutdown Capability Reverification"; and IP 64704, " Fire Protection / Prevention Program."

During the 1980s, the staff inspected each plant one time using IP 64100, a 1-week, region-led

. team inspection. The overall objective of IP 64100 was to verify, through a sampling audit at a specific reactor facility, that there was reasonable assurance that the facility could achieve and i maintain safe shutdown in the event of a fire. IP 64100 inspections generally consisted of a fire )

brigade drill, walkdowns of post-fire safe shutdown equipment locations and fire area and/or fire zone configurations, reviews of post-fire safe shutdown procedures, a post-fire safe shutdown procedure simulation, and audits of fire-induced circuit faHurs analyses. Typically, the inspectors verified the existence of fire detection systems, fire suppression systems, and fire barriers installed to protect post-fire safe shutdown equioment. However, the inspectors did not have sufficient time to inspect details of the safe shutdown analycis or the design basis of fire detection systems, fire suppression systems, and fire barriers.

After the original post-fire safe shutdown inspections (IP 64100), the regional initiative, one week, triennial team inspections under IP 64150, were intended to verify continued compliance with regulatory requirements regarding post-fire safe shutdown. IP 64150 was rarely conducted due to the lack of resources such as allocated inspection hours and the availability of experienced and skilled post-fire safe shutdown mechanical systems and electrical engineering specialists. Since the one-time IP 64100 inspections, the staff has inspected fewer than 10 plants in accordance with IP E4150.

Throughout the 1980s and 1990s the regions have conducted IP 64704, the routine (core) reactor fire protection inspection procedure at each plant about once every 3 years. The objective of this IP, which is typically conducted by a regional inspector over about a 1-week period, is to evaluate the overall adequacy of the licensee's fire protection program. IP 64704 focuses on such " classical" fire protection features as administrative controls of transient combustibles and ignition sources, surveillance and testing of detection and suppression systems, fire barrier integrity, quality assurance audits, and general employee and fire brigade fire response training and capabilities. IP 64704 does not address post-fire safe-shutdown capability, nor does it thoroughly evaluate the overall fire protection program configuration control. It should be noted that licensee QA audits or self-assessments that are based on IP 64704 would similarly not address post-fire safe shutdown capabilities.

As discussed in SECY-93-143,"NRC Staff Actions To Address the Recommendations in the Report on the Reassessment of the NRC Fire Protection Program," May 21,1993, on the basis of its self-assessment, the staff concluded that the existing NRC fire protection requirements

- would, if properly implemented, effectively address fire safety concerns at commercial nuclear power plants. The staff acknowledged, however, that it had not been inspecting post-fire safe shutdown capab_ilities. On the basis of its self-assessment, and in light of the Thermo-Lag fire

. barrier issue, the staff concluded that the NRC staff and the licensees had reduced their emphasis on fire protection after the licensees achieved compliance with fire protection requirements and the staff completed its one-time, post-fire, safe shutdown inspections. The staff initiated the FPFI pilot program, in large part, to assess the impact of this reduced licensee and regulatory emphasis.

4.

SUMMARY

OF FPFI INSPECTION FINDINGS The findings from the pilot FPFis and the team inspections at Clinton and Quad Cities are summarized below. These inspections _were intended to uncover problems and vulnerabilities in the licensee's fire protection programs. Therefore, this report section highlights fire protection and post-fire safe shutdown program deficiencies and degradations rather than strengths.

Pilot FPFI enforcement actions are listed in Appendix C.

Pilot FPFis

- At all FPFI pilot plants,- fire brigade equipment, fire fighting strategies, and performance were deficient to some degree. Problem areas included personnel safety equipment, equipment staging locations, response time, limited offsite fire department resources, communications, medical examination frequency, lack of flammable liquid suppression capability, drill realism, 4 fire fighting water drainage control, smoke removal, radiological control, and inadvertent or planned breaching of redundant train fire barriers as part of the fire fighting strategy.

Other pilot FPFI inspection findings were in the areas of: control of combustibles; fire detector and sprinkler system design (failure to meet minimum code criteria); gaseous suppression system acceptance testing and hazard suitability; hose and standpipe coverage and surveillance criteria; deficient fire area boundaries due to maintenance, installation defect or 4 design; inadequate safe shutdown passive barrier separation for redundant components; j

ineffective compensatory measures for removed fire barriers; inability of selected safe shutdown systems to meet performance goals given credible fire-induced actuations; l inadequate electrical safe shutdown analyses (e.g., inappropriate assumptions that multiple spurious operations would not occur from a fire in a single fire area, common power supply concems, and potential motor operated valve (MOV) mechanical damage due to fire-induced spurious operations which may bypass valve limit or torque switches); inadequate attention to

' fire protection program management; incomplete attemative safe shutdown procedures; inadequate emergency lighting to accomplish required operator actions; inadequate or potentially fire damaged communications capabilities; and non-conservative or invalid IPEEE assumptions.

Summaries of the pilot FPFI findings by plant are presented below.

i

--A

River Bend Station The results of the River Bend FPFI are documented in NRC inspection Report Number 50-458/97-201 dated March 20,1998. The inspection team reported the following findings:

- (1) there was a weakness in how transient combustibles are controlled; (2) smoke detection and fire suppression system designs did not meet industry standards; (3) there was a weakness in the analysis and testing of fire doors; (4) engineering evaluations of certain fire barrier.

designs did not demonstrate that the barriers protected adequately against the fire hazards; (5) fire brigade performance was weak; (6) compensatory measures for the lack of certain fire barriers did not provide an equivalent level of safety; and (7) certain IPEEE assumptions were

. weak. The inspection team also found that the licensee's post fire safe- shutdown circuit failure analysis methodology did not consider multiple circuit faults and, therefore, did not identify.

certain conditions that could prevent the operation or cause the maloperation of post fi.e safe-shutdown capability (e.g., a potential fire-induced reactor transient may not have been properly analyzed and bounded). As part of its Thermo-Lag corrective action program, the licensee re-analyzed its post fire safe shutdown methodology. The objective of the re-analysis was to reduce reliance on Thermo-Lag fire barriers and to upgrade required Thermo-Lag barriers. The inspection team did not identify any problems with the licensee's Thermo-Lag corrective action program.

Susquehanna The results of the Susquehanna FPFI are documented in NRC Inspection Report Nos. 50-387/97-201 and 50-388/97-201 dated May 13,1998. The inspection team reported the following findings: (1) transient combustibles were not controlled in accordance with plant procedures; (2) the fire brigade drill revealed response and firefighting technique problems; (3) fire detection and suppression system designs did not meet fire protection industry codes and standards; (4) the post-fire safe shutoown method for certain fire areas used the automatic depressurization and core spray systems and could allow core uncovery; (5) off-normal post-fire safe-shutdown procedures did not fully identify all required manual actions or did not identify the preferred instrumentation to be used to monitor reactor performance; and (6) emergency lighting was not provided for certain safe-shutdown operations. The inspection team noted that licensee personnel exhibited good knowledge of the Susquehanna fire protection features and post-fire safe-shutdown capability, that the scope and depth of operator training was good, that the licensee had been pro-active in addressing Kaowool fire barrier concerns, and that modifications had been implemented to prevent fire-induced spurious actuations of motor-operated valves (MOVs). During the inspection the licensee was in the process of confirming the design attributes of the installed Thermo-Lag fire barriers and evaluating required barrier upgrades. The inspection team did not identify any problems with the licensee's Thermo-Lag corrective action program.

St.Lucie .

The results of the St. Lucie FPFI are documented in NRC Inspection Report Nos. 50-355/98-201 and 50-389/98-201 dated July 9,1998. The inspection team reported the following i findings: (1) firs detection and suppression system designs did not meet fire protection industry l codes and standards; (2) transient combustibles were not controlled in accordance with plant

- procedures; (3) the fire brigade drill performance revealed response and firefighting technique problems; (4) the safe-shutdown analysis did not consider the fire-induced affects of multiple

< .g.

r

'k high impedance electrical faults associated with the power distribution system; (5) weaknesses were associated with the fuse breaker coordination control program; (6) there were no fire isolation measures to protect against fire-induced spurious operation of high/ low reactor pressure boundary valves; (7) there was no fire barrier to separate post-fire safe-shutdown charging function; (8) there was no analysis of fire-induced affects on instrument sensing lines; (9) there was a potential for fire-induced circuit failures leading to spurious operation of required post-fire safe shutdown MOVs; and (10) there was no emergency lighting for certain post-fire safe-shutdown operations. The team also found that there was a ge.neral lack of fire protection and post fire safe-shutdown program ownership by the engineering department, and that the licensee's response to negative quality assurance findings was slow. With respect to the licensee's Thermo-Lag fire barrier upgrade program, the inspection team found that certain wall '

. upgrades and designs were not sufficient to provide the fire resistance needed to contain the fire hazards in the areas of concern and that adequate fire resistive protection was not provided for thermal shorts that penetrate Thermo-Lag raceway fire barriers. i j

. Prairie Island j The results of the Prairie Island FPFI are documented in NRC Inspection Report Nos. 50- .

282/98-016 and 50-306/98-016 dated October 9,1998. At Prairie Island, the NRC conducted a  !

reduced-scope, one week inspection to review and validate a licensee fire protection program  ;

self-assessment. The inspectors concluded that the licensee's self-assessment process was [

acceptable. However, inspection findings included: omission of eight residual heat removal (RHR) containment sump suction valves from the analysis; missing one-hour rated fire barriers on electrical conduits for an auxiliary feedwater (AFW) pump suction valve; indeterminate fire-resistive performance of the Kaowool fire barrier system in the plant; and weakness in the safe shutdown timeline analysis for a fire-induced transient. Of special significance were instances in which the licensee had removed 1-hour fire-rated barriers that it had committed to maintain as part of approved Appendix R exemptions. In addition, through its self-assessment, the licensee found: 32 safe shutdown-related motor operated valves (MOVs) that were susceptible to fire damage due to fire-induced hot shorts; several inadequate Appendix R fire barriers and  ;

unsealed fira barrier penetrations; pressurizer level indication channels that did not meet , l separation requirements; and a 1-hour fire-rated barrier missing from a safety injection (SI) pump suction valve electrical conduit.

Clinton and Quad Cities The staff did not conduct FPFis at either Clinton or Quad Cities. However, as discussed in the following sections, recent experiences with these plants provided insights into possible weaknesses with the core fire protection inspection program, the potential benefits of more comprehensive fire protection inspections (like FPFis), and the use of licensee self-assessments.

Clinton The results of the Clinton fire protection related inspections are documented in a Special Evaluation Team (SET) report dated January 2,1998, and Inspection Report Nos. 50-461/98- t 026 dated December 13,1998. The results of a related follow-up fire protection inspection will be documented in Inspection Report 50-461/99-003 to be issued. The staff had scheduled a pilot FPFI at Clinton Power Station. In preparation for the FPFI, the licensee performed an

1 augmented fire protection program quality assurance audit and found that a program  ;

breakdown existed. The licensee issued 16 condition reports,11 of which were attributed to j inadequate post-fire safe-shutdown analyses. Before the staff could perform the pilot FPFI, it was canceled due to the licensee's commitment to perform an Independent Safety Assessment )

(ISA) and the NRC's oversight of this effort with a Special Evaluation Team (SET). Because of i the significance of the licensee's fire protection audit findings, the SET performed an in-depth, vertical-slice inspection of the Clinton fire protection program. The SET noted that the licensee could not demonstrate the ability of the post-fire safe-shutdown analysis, equipment, and procedures to ensure that the plant could achieve and maintain safe-shutdown following a fire.

. In its report, the SET reported that: the licensee had failed to ensure that 54 MOVs would remain free of fire damage due to fire-induced hot shorts in the valve control circuitry; the licensee was unable to provide acceptable industry fire barrier test reports to support the upgrade of an installed Thermo-Lag fire barrier assembly; the licensee did not have adequate test documentation to support the qualification of fire rated cables as equivalent to that of a fire rated barrier; and that the sprinkler systems in several risk significant fire areas may be incapable of suppressing a fire.

This experience demonstrated how one of the proposed benefits of the FPFI program, to gain renewed industry attention to nuclear power plant fire safety, is to be achieved. That is, implementation of the FPFI program led the licensee to assess its fire protection program, revealing significant programmatic and fire safety issues. The staff also notes that routine fire protection core inspections had not and would not have uncovered many of the issues that the licensee identified in preparation for the FPFI, but an FPF1-type inspection would have done so.

This experience also produced insights into the possible benefits and uses of licensee self-assessments as a reactor fire protection inspection strategy.

Quad Cities The results of the Quad Cities fire protection inspection are documented in Inspection Report Number 50-254/98-011 dated July 2,1998. In September 1997, the licensee found problems with the Quad Cities post-fire safe-shutdown procedures and declared all safe-shutdown paths inoperable. In December 1997, after significant effort to correct these and other fire protection l problems, the licensee was unable to demonstrate to the staff that the Quad Cities safe-

- shutdown analysis and procedures were adequate to assure that a fire in any plant area would I not prevent the performance of necessary post-fire safe-shutdown functions. Ultimately, the 1 licensee shut down both units to address these problems. l_ater, after a fire protection-related i restart team inspection, the units restarted.

At Quad Cities the licensees alternative post-fire safe shutdown capability had a number of

.significant weaknesses. These included: loss of control room indications; a forced dual unit station blackout condition; the potential for secondary fires which could interfere with timely safe shutdown, inadequate determination of the worst-case spurious signal or operation, .

inappropriate assumption that only one spurious operation would occur as a result of a fire in '

any area, and inappropriately crediting automatic actions for main steam isolation valve closure.

in addition, at Quad Cities a turbine building common area did not appear to have adequate detection and suppression equipment to assure alternative post-fire safe shutdown, the safe shutdown analysis did not adequately consider the smoke hazards to operators who would implement post-fire alternative safe shutdown measures, timeline and environmental condition considerations within the safe shutdown procedures were marginal, safe shutdown analysis

i~

i

• review' documentation was lacking, communication systems minimally supported the complex dual unit shutdown and fire brigade operations, administrative procedures to assure non-unit specific safe shutdown equipment operability needed enhancement. The licensee did appropriately identify the systems needed to achieve and maintain post-fire safe shutdown conditions, stage sufficient quantities of good material condition manual fire suppression equipment, and provide adequate 8-hour emergency lighting for required safe shutdown activities.

-This experience'is another example in which the core inspection had not and would not have revealed significant fire safety issues, but an FPFI would have. It also provided insights into the possible benefits and use of licensee self-assessments as a reactor fire protection inspection

. strategy.

- 5. FPFI WORKSHOP On November 10,1998, the staff sponsored a one-day workshop on reactor fire protection inspections. More than 170 people attended, about 150 worked for licensees, architect-1 engineer and consulting firms, such industry organizations such as NEl and the Boiling Water Reactor Owner's Group (BWROG), the press, and intervenor groups, and the rest were NRC

. staff from NRR, the Office for Analysis and Evaluation of Operational Data, the Office of Research, the Advisory Committee on Reactor Safeguards, and each of the four NRC regional offices.

The main purpose of the workshop was to discuss with the stakeholders options for the future direction of NRC reactor fire protection inspections in light of the lessons learned from the FPFI pilot program. NRC staff and managers made presentations on the overall direction of

. performance assessment and NRC inspections, the results of the four FPFI pilot inspections,,

' the results of FPF1-like inspections at the Quad Cities and Clinton, the types and frequencies of the inspection findings, the risk significance of the findings, and considerations for developing options for the future direction of the NRC reactor fire protection inspection program.

During the workshop, the staff noted that about one quarter of the findings were in the area of i post-fire safe shutdown, an area not covered by the NRC core fire protection inspection i procedure or licensee audits that are based on the core procedure. The staff also noted that l

~

one of the proposed benefits of the FPFI program, renewed industry attention to nuclear power l plant fire safety, had been achieved. Several workshop participants, including NEl, expressed agreement with this assessment.- The staff also noted that routine fire protection core inspections had not and would not have found many of the issues that the licensees identified in l preparation for FPFis and during self-assessment, or that the staff found during FPFis. Finally, the staff noted that the FPFI pilot program provided insights into the possible benefits and uses

.of licensee self-assessments as a reactor fire protection inspection strategy.

Staff and industry representatives also discussed the use of risk techniques and insights for fire protection inspections, for example, for planning lines of inspection inquiry and assessing the )

risk and safety significance of inspection findings.' There was general agreement that the tools

= to measure the risk significance of specific fire protection inspection findings are not mature and that relying on the results of IPEEE needs to be carefully considered because of the assumptions that go into the analyses and the screenings.

Representatives of two licensees of reactor plants at which pilot FPFI inspections were conducted discussed their experiences. NEl presented the results of an industry survey quantifying the frequency and focus of recent licensee self-assessments. NEl presented a preliminary proposal for an industry initiative to strengthen the self assessment process using FPFI procedures and techniques.

Key messages expressed by stakeholders at the workshop included the following:

1. NRC FPFI activities have heightened industry awareness of fire protection and post-fire safe shutdown issues, the importance of fire protection programs, and the need for licensee self-assessments in this area. It is important to have strong, focused, in-depth, cost-effective fire protection and safe shutdown programs. Re-examination of commercial nuclear power plant fire protection along the lines of the pilot FPFis is needed.

2. Some commercial nuclear plant fire protection programs do contain weaknesses today, in part due to a lack of industry awareness of important issues in this technical area. Some licensee representatives expressed uncertainty as to what constitutes compliance with the present fire protection requirements. This uncertainty arises due to issue complexity, technical ambiguities, multiple interpretations, numerous and sometimes vague documents (e.g., Branch Technical Positions, Generic Letters, Bulletins, Information Notices, Safety Evaluation Reports, etc.), and changing expectations.

3. A consistent tool for assessing the safety and risk significance of fire protection inspection findings is needed. The staff's response to this issue is presented in Section 9 of this 1

- report.

4. The first three major team pilot FPFis were conducted over a too short period of time given )

their broad scope and in-depth approach, were too resource intensive, and were costly to j support, requiring augmentation by contractors and A/E firms (even though licensee '

. preparation efforts should have been mainly comprised of revalidations of existing -

capabilities). Some expressed the view that the FPFis were not cost effective relative to the safety significance of the inspection findings. One licensee representative stated that  ;

narrowly focusing on licensees' fire protection program configuration management under 10 CFR 50.59 would be more efficient than the broad scope FPFis.

5. Fire protection and safe shutdown self-assessments have been com' mon in the nuclear industry since 1997,~ but not all licensees have conducted them and not all of those self-assessments have been broad and in-depth. There are still questions within industry as to wha' ;onstitutes compliance with Appendix R requirements.

6. The risk informed draft FPFI inspection procedure was accepted as a source of appropriately structured, effective and efficient lines of inspection inquiry, and also a source of insightful and detailed inspection guidance. )

~ 7. , NEl proposed,' as one possible future course of action, a fire protection and post-fire safe shutdown re-examination model consisting of licensee-managed self-assessments.

8. . NEl stated that systematic licensee fire protection / safe shutdown self-assessments should be integrated into the new reactor inspection and oversight program.

. A summary of staff interactions with the Nuclear Energy institute since the November 10,1998 workshop _ on reactor fire protection inspections is provided in Appendix D.

6. FPFI PILOT PROGRAM INSIGHTS AND LESSONS LEARNED As discussed during the Commission mesting on February 9,1999, one of the proposed benefits of the FPFI program, to gain renewed industry attention to nuclear power plant fire safety, was achieved. For example, in response to the FPFI pilot program, a number of

- licensees conducted comprehensive self-assessments of their fire protection programs even

~

though they had not been selected as pilot plants.

Since the staff completed its original post-fire safe-shutdown inspections (IP 64100), many licensees made major changes to their NRC-approved fire protection and post-fire safe-shutdown programs. For example, to resolve Thermo-Lag issues, licensees redefined plant fire

~ area boundaries, removed fire barriers, rerouted cables and relocated equipment, changed safe-shutdown methods, and added new operator actions and procedures. Under the current regulatory framework, many of these changes have not been subject to NRC review or

. inspection.

For each FPFI, a senior NRR risk analyst reviewed available IPEEE results and other sources of risk information.' (The FPFI inspection procedure contains guidance for using risk  !

information and insights to focus inspection activities.) The risk insights, which were used as input to the FPFI inspection plans, helped focus the FPFis on areas in which the potential fire

' risks were greater and helped the inspectors improve their understanding of the inspection findings. i As discussed in SECY-98-187, potentially risk significant FPFI findings related to the regulatory requirements and licensee commitments had not been and would not have been revealed using the current core fire protection inspection procedure (IP 64704): Similarly, licensee quality assurance audits of reactor fire protection progams had not uncovered many of the findings related to the regulatory requirements and licensee commitments that were revealed during the pilot FPFis.

Until the FPFI pilot program, the staff did not inspect the design basis of fire detection systems, fire suppression systems, and fire barriers installed to protect safe shutdown equipment. The FPFis revealed a number of findings in these areas, including actions taken by licensees to resolve Thermo-Lag fire barrier issues. Because of the importance of these defense-in-depth features with respect to protecting the safe-shutdown capability in the event of a fire, some level of NRC inspection is warranted.

Although the FPFI program involved a relatively small sample of plants, the inspection results indicate weaknesses in licensee fire protection and post fire safe-shutdown programs. The FPFI pilot program results suggest that deficiencies could exist in one or more layers of fire protection defense in depth at any given plant, and that the deficiencies could be risk significant. For example, all of the pilot plants had some fire brigade weaknesses. Other findings were, for example, inadequate safe shutdown analyses, incomplete safe shutdown procedures, and inadequate attention to fire protection program management.

=

)

1 4

The licensees for several of the FPFI pilot plants had conducted fire protection program self- l assessments in advance of the FPFl. One of the pilot FPFis was a reduced-scope inspection

' of a licensee self-assessment. The self-assessments were based largely on the FPFI j procedure and lessons leamed by the licensees by observing previous pilot FPFis. Overall, the licensee self-assessments were of good quality, were commensurate with an FPFI, and reflected the strengths and weaknesses of the licensees' programs fairly well. On the basis of its specific experience associated with the Prairie Island self-assessment inspection, the staff .

I concluded that (1) follow-up inspections of licensee fire protection program self-assessments could be a satisfactory means of fire protection program oversight, (2) the FPFI pilot inspection procedure (Tl 2515/XXX) is adequate and appropriate to guide the conduct of followup inspections of licensee self-assessments, (3) it is important that the licensee scif-assessment ,

audit plan, focus at a minimum on each of the topical areas addressed in the FPFI inspection l procedure, (4) the licensee should have finalized all technical analysis and documentation before the NRC inspection team visits the site to gather information needed to prepare for its inspection, and (5) the quality and completeness of the licensee's self-assessment program documentation significantly affect the scope and depth of the inspection team's activities.

7. CONCLUSIONS AND BASES FOR STAFF PLANS On the basis of the insights and lessons learned from the FPFI pilot program, the importance of fire protection from the point of view of potential risk, past operational experience (e.g., such issues as Thermo-Lag and circuit analysis), and the regulatory requirements, the staff concludes that it should continue some level of inspection of reactor fire protection programs.

The staff believes that future fire protection inspections should be more risk informed than current core inspections and should include the post-fire safe shutdown capability, which is not covered by the current core inspection program. The staff also concludes that intense fire

. protection inspections, such as full-scope FPFis, are not warranted as a routine-type inspection, but the FPFI procedure should be available for use on an as-needed basis, such as, when plant performance declines, or to respond to a specific event or problem at a plant. The staff also concludes that licensee selbassessments should be considered during future NRC inspections, provided that the scope and depth of the self-assessments are at least equivalent to that of the

' NRC inspections discussed below. In such cases, the NRC inspections would verify the accuracy of the licensees' assessment and review the licensees' effectiveness in finding and  ;

resoMng problems. Finally, the staff concludes that future NRC fire protection inspections should be consistent with the concepts and objectives of the new reactor inspection and oversight program and should be included within that program. Specific staff plans are presented below. ,

Within the new reactor inspection and oversight program', fire protection defense-in-depth is addressed by the initiating events comerstone (combustible material and ignition source control) and the mitigation systems cornerstone (fire detection and suppression features, and post-fire safe shutdown capability). Fire protection is not covered by performance indicators. In SECY-99-007A, " Recommendations for Reactor Oversight Process improvements (Follow-Up to SECY 99-007)," March 22,1999, the staff informed the Commission that it had drafted procedures for baseline inspections of fire protection programs for use under the new reactor inspection and oversight program. This baseline inspection procedure is the foundation of the staff's plans regarding the appropriate types and frequencies of reactor fire protection inspections and whether they should be part of the new reactor oversight process.

u

r7 F

' The baseline procedure calls for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> per month of routine residen* Inspector assessment of fire detection and manual and automatic suppression capabilities, barriers to fire propagation, and fire protection related compensatory measures. The resident inspectors' assessments of t the licensees

• control of transient combustibles and ignition sources would be addressed on a more frequent basis in the plant status inspection procedure.

The proposed reactor fire protection baseline inspection procedure also specifies a risk-informed, trienniel, one week, team inspection of each licensee's fire protection program. This triennial inspection will involve a 2-3 day information gathering site visit, and will be conducted L onsite by a team comprised of a fire protection engineer, a mechanical _ engineer, and an electrical engineer. The trbnnial team inspection is intended to look at all three elements of fire protection defense-in-depth, with major emphasis on post-fire safe shutdown capability and configuration management. The inspectors would selectively adopt, as appropriate, inspection 2 techniques developed during the FPFI pilot program. A senior reactor analyst (SRA) would

. provide input on risk insights for the inspection plan. <

The staff also proposes that the FPFI pilot procedure be issued as a permanent IP for use under the new reactor inspection and oversight program. The staff would format the procedure '

to emphasize its existing modular structure such that individual modules (e.g., fire barriers, fire brigade, safe shutdown capability, etc.) could be applied independent of the entire procedure.

The FPFI procedure (1) would be used by the staff to support the triennial inspections as

specified in the triennial inspedion procedure, (2) would be used by the staff when plant performance falls below a threshold to be established by the new inspection and oversight program or in response to a specific event or problem at a plant, and (3) could be used by the licensees as guidance for self-assessments.

The proposed fire protection baseline procedure, and the staff's plans to issue the FPFI inspection procedure to support the assessment of reactor fire protection programs under the new reactor 8nspection and oversight program, will accomplish the following:

o Prioritization of the FPFI" modules" so that most significant parts of the inspection can be included along with other staff inspections. As part of the new reactor oversight and inspection program the staff will reformat the supporting FPFI procedure to further emphasize its existing modular structure. Then, if needed, individual modules could be independently performed during other types of NRC inspections, o The strategy of using licensee self-assessments to relieve some of the staff inspection burden to the extent that the NRC can be assured (through inspection) that the self assessment is of good quality and accurately reflects the strengths and weaknesses of the program would be met by baseline procedure direction to the triennial inspection team

' leader that the inspection plan take into account self-assessment results, taken in cornbination with NEls expectation that licensee self-assessments will be phased-in during summer 1999. ,

o The risk-focused triennial team inspections would be guided by the proven inspection techniques of the FPFI pilot inspection procedure. These triennial inspections will be more narrowly focused than the full-scope pilot FPFI inspections, but their lines of inspection inquiry will be individually tailored during succeeding triennial inspections through the selection of modules from the FPFI procedure. The triennial baseline inspections will,

o .

, therefore,_ validate licensee fire protection and post-fire safe shutdown configuration management activities.

e Triennial team inspections would enhance nuclear power plant fire safety by heightening

. licensee awareness of the importance of fire protection programs and encouraging licensee self-assessments.

The SRM of February 7,1997, stated that the Commission understood that the staff was considering prioritization of plant reviews so that the most vulnerable plants are reviewed first.

In that time frame, it was envisioned that from four to eight full-scope FPFis would likely be conducted each year. However, with the development of the new reactor inspection and oversight program and its proposed baseline triennial fire protection inspections, and the staff's plans to conduct 1-week team inspections at each site every 3 years, the concem has lessened that vulnerable plants will be overlooked. Such triennial inspections would be scheduled under  !

priorities set within the reactor oversight and inspection program. .

8. PLANNED STAFF ACTIONS Unless otherwise' directed by the Commission, the staff will:

' 1.' include risk-informed baseline procedures for routine resident inspector walkdowns and for triennial fire protection team inspections within the new reactor inspection and oversight program to monitor licensee performance in the fire protection area. The staff previously described this approach in.SECY-99-007A, 1 l

2. Structure the triennial baseline inspection procedure to emphasizo its modular nature so that it could be used, for example, to independently inspect Thermo-Lag corrective actions, licensee self-assessments, and specific aspects of fire protection defense in depth. To the extent practicable, the staff will schedule the triennial inspections so that plants that have not performed or do not plan to perform self-assessments are inspected before those that have done so.

3. Issue the FPFI pilot procedure as a permanent IP, The staff will format the procedure to emphasize its existing modular structure so that individual modules (e.g., fire barriers, fire brigade, and safe-shutdown capability) could be applied independent of the entire procedure. The FPFI procedure (a) would be used by the staff to support the triennial inspections as specified in the triennial inspection procedure, (b) would be used by the staff when plant performance. falls below a threshold to be established by the new inspection and oversight program or in response to a specific event or problem at a -

plant, and (c) could be used by the licensees as guidance for self-assessments.

4. Delete IP 64100, IP 64150, and IP 64704 after the new reactor inspection and oversight program is implemented. - (The procedures recommended above would supersede these existing procedures. Therefore, IPs 64100. 64150, and 64704 would no longer be needed.)

4 K ,

9. EjRE PROTECTION RISK SIGNIFICANCE SCREEMNG METHODOLOGY

.' At the time of the FPFI pilot inspections, a tool for systematically assessing the risk significance of fire protection inspection findings was not available. During the FPFI workshop, there was general consensus that such a tool would be beneficial to both the staff and the industry.

Subsequently, NRR's Plant Systems Branch and the Probabilistic Safety Assessment Branch,

. with assistance form the Office of Nuclear Regulatory Research and the senior reactor analysts, developed a proposed method for assessing the potential fire risk significance of fire protection inspection findings. The Fire Protection Risk Significance Screening Methodology.

(FPRSSM) approximates core damage frequency (CDF) changes resulting from fire protection program deficiencies.. After it is completed, the FPRSSM could be used by inspectors to focus on risk-significant sets of inspection findings, while screening out findings that have minimal or no risk significance. The FPRSSM could also be used to evaluate inspection findings after the

' inspection. Inspection findings that the FPRSSM finds to be potentially risk significant (i.e.,

those that are not screened out as having minimal or no risk significance) could be subjected to--

a more refined evaluation to help establish the appropriate regulatory response.

In summary, the FPRSSM process is as follows: (1) a fire scenario is postulated; (2) the '

inspection findings (fire protection deficiencies) are grouped according to fire area, and then grouped within each fire area according to the particular defense-in-depth element which they impact; (3) the degradation of each defense-in-depth element is characterized qualitatively as severity level high, medium, or low (the severity levels correspond to specific numerical failure probabilities); (4) the failure probabilities are integrated with the ignition frequencies to determine the overall change in CDF for each fire area; (5) using threshold values, the CDF change values ~are assigned to a performance band (e.g. licensee response band, increased regulatory response band, required regulatory response band). It should be noted that, in this process, sets of related inspection findings are assessed collectively to determine their synergistic impact on risk. For example, if the plant fire brigade is deficient and the automatic fire suppression system in a fire area is deficient, the FPRSSM considers the adverse impacts of both deficiencies in its assessment of the overall fire risk in the fire area.

- Although the FPRSSM was not available during the FPFis or the resulting enforcement proceedings, as a final activity of the FPFI pilot program, the staff has recently used the FPRSSM to assess a samp's of the FPFI findings. An overview of the application of this methodology to two sets of inspection findings, one set of high risk significance, and one set of low risk significance, are summerized in Section 10 below.

During a public meeting on March 25,1999, the staff discussed the proposed FPRSSM with NEl and other interested stakeholders. The staff is working with the reactor oversight task groups to incorporate the FPRSSM into the Inspection Finding Risk Characterization Process described in SECY-99-007A.

10. SAMPLE APPLICATIONS OF FPRSSM Two examples of the application of the proposed Fire Protection Risk Significance Screening Methodology (FPRSSM) are summarized below.

4

. Quad Cities A fire protection inspection was performed at Quad Cities to assess the licensee's corrective actions to address a Confirmatory Action Letter (CAL). These actions included revision and verification of the safe shutdown analysis, development of safe shutdown procedures and identification and resolution of Appendix R discrepancies. The NRC inspection team evaluated i a challenging fire scenario involving a fire in turbine building fire area TB-11, a common center section (ground and mezzanine floor elevations) between the Units 1 and 2 turbines. The area contains switchgear, cables, portions of the turbine lube oil and electro-hydraulic system reservoirs, air compressors, transformers, various electrical panels, and the new resin storage.

This fire area has the potential ignition and fuel sources to produce a fire which is capable of producing a hot gas layer. The inspection team determined that a challenging fire in TB-11 could cause fire damage to redundant trains of safe shutdown functions, require operators of both units to evacuate the main control room and implement a dual unit alternative shutdown which would require manual recovery of safe shutdown equipment and functions for both reactor units.

- Using the FPRSSM, the estimated fire initiation frequency (lF) was determined to be on the order of 10 E-2/yr, the degradation in safe shutdown effectiveness (SSD) was judged to be high, the degradation of fire barrier (FB) effectiveness was judged to be high, the degradation in automatic detection / automatic suppression (AD/AS) effectiveness was judged to be medium, and the degradation in detection / manual suppression effectiveness (D/MS) was judged to be medium.

In terms of exponents, the potential risk significance for this scenario and set of identified weaknesses in fire protection defense in depth can be expressed as follows:

Potential Risk Significance (PRS) = IF + SSD + FB + AD/AS + D/MS

= -2 + 0 + 0 + -0.75 + -0.5

= -3.25 (CDF significantly greater than 10 E-4/yr) .

This result would prompt further NRC evaluation in order to determine the appropriate regulatory response.

St. Lucie :

An FPFI was pedormed at St. Lucie. The inspection focused on St. Lucie Unit 1. The inspection team noted that the licensee had failed to provide, in accordance with a granted exemption, a 1-hour fire rated wrap around those portions of the charging pump 1 A cable conduits which extended above the partial height walls separating the redundant charging pumps. Safe shutdown equipment in the charging pump room and an associated 4 foot wide passageway common to each pump cubicle include the charging pumps and their associated cables, the CVCS/RWT inter-tie valve and its associated cables, and the pressurizer heater proportional and backup banks control cables. The charging pump room had a low fire loading and no automatic suppression was installed.

Using the FPRSSM, the estimated fire initiation frequency was determined to be on the order of 16 E-Vyr, the degradation in safe shutdown effectiveness (SSD) was judged to be low, the degradation in fire barrier effectiveness (FB) was judged to be high, the degradation in automatic detection / automatic suppression effectiveness (AD/AS) was judged to be high, and the degradation in fire detection / manual suppression effectiveness (D/MS) was judged to be 1

medium.

in terms of exponents, the potential risk significance for a charging pump room fire scenaric and set of identified weaknesses in fire protection defense in depth can be expressed as follows:

Potential Risk Significance (PRS) = IF + SSD + FB + AD/AS + D/MS

= -3 + -3 + 0 + 0 + -0.5

= -6.5 (CDF greater than 10 E-6/yr)

This result would not indicate unacceptable fire protection performance and, in and ofitself, would not result in regulatory response above continued NRC " baseline" fire protection oversight.

11. PROGRAM ACCOMPLISHMENTS The following shows how the FPFI pilot program accomplishments, coupled with the proposed baseline fire protec9on procedures, satisfy the FPFI pilot program objectives.

1. To develop a strong, broad-based, coherent and coordinated NRC fire protection program commensurate with the safety significance of the subject.

The proposed fire protection baseline inspection program, combined with availability of the full-scope FPFI procedure when necessary, will provide a much improved and robust NRC fire protection program. The triennial review of licensee fire protection features, configuration management programs, and post-fire safe shutdown capabilities will ensure that ths NRC staff is continually well informed of the status of nuclear power plant fire protocdon.

2. To inspect licencee Thermo-Lag corrective actions and compliance strategies at all plants.

The draft fire protection bassa.:e inspection program will directly review licensee Thermo-Lag corrective actions whether they are based on batrier replacement or re-analysis approaches to Thermo-Lag derating.

3. To inspect non-Thermo-Lag fire protection features in response to ongoing NRC programs

- (such as self-induced station blackout, fire barrier penetration seals, turbine building assessments, and Individual Plant Examinations vf External Events).

Since the draft fire protection base!!ne inspection procedure will be conducted at each reactor site every three years, the opportunity will exist to rigorously address the site

[

l specific programs, procedures and equipment configurations relating to all ongoing NRC e

programs.  ;

, i

4. ; To provide immediate safety benefit through renewed industry attention to nuclear power l

. plant fire safety.

FPFI Workshop industry attendees admitted to the pilot FPFI programs effect of renewing licensee attention to fire protection programs. The staff believes the draft fire protoction baseline insepection program will be equally, if not more effective in doing the same.

Conversely, it is not clear that the recently renewed attention will continue without the existence of irequent and in-depth fire protection inspections.

5. To develop criteria for licensee fire protection self-assessments.

Workshop participants stated that the draft FPFI procedure (Tl 2515/XXX) is an appropriate basis and technical resource for conducting licensee self-assessments. After the pilot trials of the proposed fire protection baseline inspection procedures, the staff plans to issue the FPFI pilot procedure as a permanent IP. The staff would format the procedure to emphasize its existing modular structure such that individual modules (e.g., fire barriers, fire brigade, safe shutdown capability, etc.) could be performed independently during other types of inspections. The permanent FPFI procedure (1) would be used by the s'.aff to support the triennial inspections as specifLd in the triennial inspection procedure, (2) would be used by the staff when plant performance falls below a threshold to be established by _

the new inspection and oversight program, or in response to a specific fire protection event -

or problem at a plant, and (3) could be used by the licensees as guidance for self-assessments. i

6. To ensure compliance with NRC post-fire safe shutdown regulations and commitments.

The staff believes that baseline triennialinspections, and reactive use of the FPFI modules

- that address safe shutdown and configuration management, will ensure compliance with NRC post-fire safe shutdown regulations and commitments through increased licensee attention and corrective actions conducted in response to inspection findings and ,

enforcement actions. l

7. To focus resources on the fire protection issues of most importance (e.g. licensee control l of fire protection design and licensing bases, and mose fire protection program elements covered by existing NRC regulations and guidelines).  ;

The staff believes that the draft fire protection baseline inspection program, by virtue of its foundation on FPFI irspection proceoure lines of inquiry and inspection techniques, will directly and continuously focus NRC resources on the fire protection issues of most ~

importance.

8. To evalcate the scope and adequacy of the existing NRC reactor fire protection program, and develop recommendations for program improvement. l The development of the FPFI pilot inspection program was a result of the sta+f's efforts to evaluate the scope and adequacy of the exisiting NRC reactor fire protection program. The i

l

i

. staff believes that implementation of a pilot tested fire protection baseli.ne inspection procedure, combined with selective application of the full-scope FPFI procedure in response to assessments of significantly degraded licensee performance, would constitute a significant improvement over the previously existing routine fire protection inspection program. .

9. To review licensee fire protection and post-fire safe shutdown configuration management.

The FPFI pilot plant fire protection licensing and design bases was reviewed in detail by the FPFI inspection teams. Fire protection program managment and configuration controlis one of the current five major topics addressed in the FPFI procedure (Tl 2515/XXX). Since the proposed triennial inspections use this procedure as a foundation for their inspection planning and conduct, configuration management will receive strong attention if the fire protection baseline inspection procedure is conducted on the regular basis recommended by the staff.

10. To provide clear guidance to the staff and industry regarding oversight of reactor fire protection programs.

The staff believes, based on industry feedback as well as FPFI pilot inspection experience, that the FPFI procedure (Tl 2515/XXX) provides c'sar guidance to the staff and industry regarding oversight of reactor fire protection programs. The staff plans to issue Tl 2515/XXX as a permanent inspection procedure. ,

11. To address smoke propagation and macaal fire fighting operations, and their impact on equipment operability and operator actions.

During the pilot FPFis smoke propagation, manual fire fighting operations, and their impact '

on equipment operability and operator actions were addressed in a deliberate manner as directed by the FPFI peocedure (Tl 2515/XXX). The inspections included observations of fire drills in risk significant plant areas, and detailed plant tours during which smoke control and manual suppression strategies and capabilities were reviewed.

12. To address balance of plant fire risks.

The inspection reports for the four pilot FPFI inspections, and the Clinton and Quad Cities fire protection team inspections, document the balance of plant inspection results.

13. To improve consistency of internal NRC oversight of licensee fire protection programs.

The staff believes that the proposed baseline monthly resident inspector inspection tours, and the triennial frequency and depth of the proposed baseline team inspoctions will provide the regicas and NRR with a regular source of insightful information regarding the status of licensee fire protection programs. Such of information has been lacking under the existing IP 64704 inspections, especially with respect to post-fire safe shutdown and configuration management program elements.

-22

14. To address fire safety considerations not expressly addresssd by the fire protection regulation (e.g., event based fires, fire-induced plant transients, seismic / fire interactions, and fire-induced release of radioactive materials).  ;

One inspection finding regarding a potential fire-induced plant transient was found during .

the River Bend pilot FPFl. This finding involved the possible fire-induced simultaneous j opening of all 16 safety relief valves. The related line of inspection inquiry was selected through the review of risk information, including IPEEE results.

i l

i

).

o APPENDIX A FIRE PROTECTION FUNCTIONAL INSPECTION PROGRAM ASSESSMENT TREE i

l i

1 1

l l

2 APPENDlX B FIRE RISK FACT SHEET  ;

e The average reported fire frequency at operating plants for the period 1965-1994 is i 3.3E-1/yr!

e The average reported fire frequency for the pre-Appendix R implementation period 1965 l - 1985 is 3.8E-1/yr' .

e The average reported fire frequency for the post-Appendix R implementation period 1985 - 1994 is 2.8E-1/yr' i

• During the post-Appendix R implementation period (1986-1994) there were two fire l events that resulted in a scram and a loss of function of one safety related division or a  :

loss of offsite power.: This compares to 10 such events (not including the Browns Ferry fire) during the pre-Appendix R implementation period (1965-1985).'

I l e There were 41 fire events that resulted in a plant scram with no loss of function of a safety related division in the 20 year pre-Appendix R implementation period and 40 such events in the 8 year post-Appendix R period.'

e Thirteen large losses from fire events at nuclear power plants during the period from  ;

1966 - 1995 resulted in a total reported monetary loss of approximatel $800 million, vdh an average monetary loss per event of approximately $62 million e On June 21,1991, the NRC issued GL 88-20, Supplement 4, requesting licensees to perform an IPEEE to (1) develop'an appreciation of severe accident behavior, (2) '

. understand the most likely severe accident sequences, (3) gain a aualitative understanding of the overalllikelihood of core damage and radioactive release, and (4)

If necessary, to reduce the overalllikelihood of core damage and radioactive release by modifying hardware and procedures that would help prevent or mitigate severe accidents.8 4

l 1

Speial Study Fire Events Feedback of U.S. Operating Experience, June 1997, James R. Houghton,

- Office for Analysis and Evaluation of Operational Data, USNRC 2

A 30-Year review of Large Losses in the Gas and Electric Utility Industry - 1966 - 1995, James B. Biggms, J&H Marsh & McLennan,1997 i

3

' NUREG 1407,

• Procedural and Submittal Guidance for the Indevidua'. Plant Examination of Extemal l Events (IPEEE) for Severe Accident Vulnerabilities," USNRC, June 1991 l i

T n

d-

r

e. - Based on the IPEEE results, fire events are important contributors to the reported core damage frequency (CDF) for a majority of plants. The reported CDF contribution from fire events can in some cases, approach (or even exceed) that from internal events.'

• . D:o reported IPEEE fire CDFs range on the order of E-9/yr to E-4/yr, with the majority of plants reporting a fire CDF in the range from 1 E-6/yr to 1E-4/yr.5 More than half of the plants proposed or implemented procedural and/or hardware improvements in the fire area in response to their IPEEE.

'e Although most licensees have reported numerical fire CDF estimates, it is important to note that the accuracy of such estimates has not been validated under the IPEEE -

submittal review. Because simplifying assumptions and approximate procedures may have been used in the analyses, the quantified CDF estimates reported in the licensees' IPEEE submittals should 9D!y serve as a general indicator of plant risk. With that in mind the following preliminary information is provided.

a. Fire CDFs for approximately 40 units were greater than or equal to 1E-5/yr.

b. Fire CDFs for approximately 11 units were greater than or equal to 1E-4/yr.

c. Of those 29 units whose fire CDF was between 1E-5/yr and 1E-4/yr, approximately 17 had a reported fire CDF greater than or equal to the reported intemal events CDF.

d. Of those 11 units whose fire CDF was greater than or equal to 1E-4/yr,9 units had a fire CDF greater than or equal to the reported intemal events CDF. For the remaining 2 units the fire CDF was comparable to the intemal events CDF.

' January 20,1998. memorandum to the Commissioners from L Joseph Callan, Executive Director for Operations, Preliminary IPEEE insights Report 5

This range includes all plants except Quad Cities. The licensee for Quad Cities will submit a revised and updated IPEEE fire analysis during May 1999.

B-2

r l

l APPENDIX C'

SUMMARY

OF PILOT FPFI ENFORCEMENT ACTIONS Four pilot inspections were conducted (River Bend, Susquehanna, St. Lucie and Prairie Island.

In addition, during 1998 two additional inspections were conducted using the draft FPFl procedure. The enforcement actions for all six major fire protection and post-fire safe shutdown team inspections which utilized the draft FPFI procedure are provided below.

1. River Bend Non-cited violation - Lack of a procedure for providing a seismically-qualified source of water to fire protection systems hoss stations following a safe-shutdown earthquake.

~ Discretion exercised to not issue a citation for a Severity Level lli violation involving the potential for fire-induced circuit failures in a single multi-conductor cable that could result in simultaneous opening of all t16) safety relief valves, adversely affecting alternative safe shutdown capability.

2. Susquehanna Severity Level IV ( Supplement 1) - Indicated reactor vessel water twel would not be maintained above the top of the active fuel (TAF) during a postulated Append.c R fire.

Severity Level IV (Supplement I) - Seven instances of fire detection systems or automatic sprinkler systems not complying with code requirements.

Severity Level IV (Supplement I) hour safe shutdown _ emergency lights not provided in multiple areas where manual actions were required.

Severity Level IV (Supplement I) - Transient combustible material in excess of administrative procedures without a permit.

Severity Level IV (Supplement 1) - Potential for safe shutdown systems (HPCI, RCIC, CSS, and RHR) to be rendered inoperable from discharge pip!ng waterhammer due to unavailability of tools and equipment to install a temporary cross tie hose from the high pressure fire suppression water systems to the condensate transfer system.

Severity Level IV (Supplement I) - Operations Department fire brigade members dd not have physical examinations for periods up to two years.

3. St. Lucie Severity Level 111, no civil penalty - inadequate alternative shutdown capability procedure to provide adequate guidance to ensure that heating, ventilation and air conditioning equipment to the 1B Electrical Equipment Room and the Hot Shutdown Control Panet Room would be properly operated in the event of a fire in the Control Room or in the Cable Spreading Room.

Severity Level IV, non-cited - Failure to install a one-hour rated fire barrier for conduits carrying cables for charging pump (CP) 1 A in accordance with a granted exemption request.

Severity Level IV, non-cited - Incorrect procedural identification of the protected train low pressure safety injection (LPSI) pump.

Discretion exercised to not issue a citation for a Severity Level ill violation involving the licensee's failure to analyze for the potential for more than one fire-induced circuit failure that could cause maloperation of designated safe shutdown equipment.

Discretion exercised to not issue a citation for a Severity Level 111 violation involving the potential for fire to cause a breach of pressurizer power operated relief valve (PORV) and reactor coolant system gas vent systems (RCSGVS) high/ low pressure interface boundaries.

Inadequate evaluation of the potential for fire to cause damage to motor operated valves (MOVs) relied upon to accomplish post-fire safe shutdown - final disposition of enforcement is pending.

4. Prairie Island Discretion exercised to not issue a citation for a Severity Level lll violation involving the potential for mechanical damage to 32 motor operated valvels (MOVs) resulting from fire-induced circuit failures.

Severity Level IV, non-cited - Failure of fire protection plan to consider the effect of spurious actuation caused by fire damage to equipment needed to support a safe shutdown function.

Severity Level IV, non-cited - Removal of a one-hour rated fire barrier for a credited safe I shutdown core cooling pump.

5. Quad Cities L Severity Level ll, Supplement I - Failure to provide alternative shutdown capability in some fire '

areas. A postu!ated fire in certain fire areas would render safe shutdown equipment inoperable such that safe shutdown would not be ensured (14 examples), and a revision to Quad Cities Appendix R procedure was implemented which had not been evaluated and which involved an unreviewed safety question.

i

6. Clinton Discretion exercised for two violations of Appendix R requirements which had been self-identified during licensee fire protection re-validation efforts. Both violations involved design control problems, an area for which significant NRC enforcement action had previously been taken.- One violation peitained to failure to protect motor operated valves from fire induced mechanical damage, and the second violation contained three examples of failure to provide adequate electrical circuit isolation for several safe shutdown components.

C-2

.k i - - . . . . . . . .. . . . . . . . .

i l

h APPENDIX D  !

SUMMARY

OF STAFF INTERACTIONS WITH  !

THE NUCLEAR ENERGY INSTITUTE On November 10,1998, the Plant Systems Branch, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation (NRR) sponsored a workshop on re. actor fire protection inspections in Rockville, Maryland. During that one day conference for public and industry the Nuclear Energy Institute (NEI) proposed a possible course of action consisting of rapid phase-out of FPFis in favor of licensee-managed fire protection program self-assessments, Fire protection discrepancies would be tracked in licensee corrective action systems and result in programmatic changes, procedural changes and/or physical plant modifications. In support of i this effort, NEl stated that the NRC would develop a number of risk-informed inspection

" modules" from the pilot FPFI procedure (Tl 2515/XXX). Over a period of soveral years all of the modules would be conducted by the licensees. Under the NEl proposal, the NRC would maintain its oversight function through limited self-assessment review inspections. NEl stated that systematic licensee fire protection and post fire safe shutdown self-assessments should be integrated into the new reactor inspection and oversight program.

During a December 2,1998 meeting with NEl the NRC staff requested additional information regarding NEl's reactor fire protection initiative, and their expected interfaces with current NRC initiatives. By letter dated January 19,1999, NEl responded to this staff request. In that letter NEl stated that:

• The pilot FPFis improved the evaluation of licensee performance, including engineering of plant fire protection systems, compliance with industry standards, passive fire protection features and fire barriers used to protect safe shutdown functions, post fire safe shutdown capability, and licensee audits of Appendix R safe shutdown analysis compliance.

However, NRC and industry can achieve these benefits more cost-effectively through appropriate use of FPFI inspection guidance within NEl's proposed industry FPFI follow-on effort.

• Licensee self-assessments would bn more comprehensive and provide more timely )

information than continuation af the FPFI program. 1 I

• The results of the FPFis do not appear significant enough to warrant a separate inspection program. The NEl proposal will improve the ability of licensees and the NRC to focus on safety-significant issues, e . NEl is confident that useful fire protection and post-fire safe shutdown performance j indicators can be developed. l In its letter of January 19,1999, NEl revised its proposal for licensee-managed fire protection program self-assessments in light of SECY-99-007, " Recommendations for Reactor Oversight j j

Process improvements." This document described risk-informed NRC baseline fire protection inspections which would review ignition sources, contro! of combustible materials, and fire protection systems and equipment. No performance indicators were identified in this NRC program description. The revised NEl proposal was that:

i 1

]

O

~1. FPFI frequeric should be ' scaled back.-

2. Industry and NRC should implement performance indicators in appropriate fire protection and post-fire safe shutoown areas. NRC baseline inspection would be conducted in areas where performance indicators are not available.

3. NRC baseline inspections should utilize " regulatory requirement modules" developed f rom FPFI inspection guidance. Such " modules" would np.1 include guidance for inspecting potential fire related vulnerabilities as currently specified in Tl 2515/XXX.

4. Formal fire protection self-assessments need not be conducted while licensee perienmance is in the oversight process " green band," but licensees should conduct progressively more focused self-assessments and should receive increased regulatory attention when performance indicators or baseline inspections indicate a shift in performance to the white or yellow bands.

5. Licensees should use the NRC developed " regulatory requirement modules" when performing self-assessments.

6. The NRC and licensees should continue other inspections and assessments and credit the results against fire self-assessment activties where appropriate.

7. NRC should conduct team inspections similar to current FPFis only when licensee performance approaches the red " unacceptable performance" band.

The staff met with representatives of the Nuclear Energy Institute (NEI) on March 25,1999, in Rockville, Maryland to discuss the contents of NEl's January 19,1999, letter and the new draft baseline fire protection inspection procedure (which was provided to the public and industry the week of March 15,1999). The NEl. representatives stated that the NEl performance indicators issue task force would complete performance indicator pilot trials at selected reactor sites in July 2000. The staff indicated that if NEl develops valid fire protection performance indicators, it would consider their role in the new fire protection baseline inspection procedure at that time.

At the same meeting the NEl representatives stated that an NEl assessment issue task force is developing procedures for voluntary licensee fire protection program self-assessments, with phase-in at commercial reactor sites beginning in summer 1999. The NEl representatives stated that the first stage of the self-assessments would involve plant-specific review and risk-prioritization of fire protection commitments, and, depending on the first stage results, follow-on self-assessment activity could be equivalent in scope afd depth to that of the NRC's pilot FPFis. The NEl representatives stated that it would be reasonable to expect voluntary self-assessments to be conducted in advance of baseline triennial team inspections, thereby giving the staff an opportunity to reduce inspection burden. Tb, NRC staff noted that the new draft fire protection baseline inspection procedure directs the NRC triennial inspection teams to incorporate the results of licensee self-assessments into their inspection planning.

The new Fire Protection Risk Significance Screening Methodology was presented to the NEl representatives at the March 25,1999 meeting. Examples of the application of this methodology were discussed in detail.

i D-2

p l

. By letter dated AprifT4,1999,' NEl submitted comments on the proposed baselin'e inspec'ioil t

procedures and expressed concerns about including fire protection in the pilot program. The staff will continue to communicate with NEl and other stakeholders as appropriate. .

1 .

~!

1

)

l l

1

)

l l

\

i l

l

'D-3

-