Text

Provides Draft Fire Protection Functional Insp Procedure to Be Used to Conduct Upcoming NRR Lead Pilot Team Insp at Plant
	ML20140D823
Person / Time
Site:	River Bend
Issue date:	06/05/1997
From:	Wigginton D; NRC (Affiliation Not Assigned)
To:	Mcgaha J; ENTERGY OPERATIONS, INC.
References
	NUDOCS 9706110098
	Download: ML20140D823 (88)
	v • d • e

CuSe 5,1997 Mr. John R. McGaha, Jr.

Vice President - Operations Entergy Operations, Inc.

River Bend Station P. O. Box 220 St. Francisville, LA 70775

SUBJECT:

DRAFT FIRE PROTECTION FUNCTIONAL INSPECTION (FPFI) PROCEDURE The purpose of this letter is to provide you the draft Fire Protection Functional Inspection (FPFI) inspection procedure that will be used to conduct the upcoming Office of Nuclear Reactor Regulation (NRR) lead pilot team inspection at River Bend Station.

As you are aware, four U.S. connercial reactor plants are receiving pilot team inspections as part of the FPFI procedure development process. River Bend Station is the reactor plant selected to receive the first pilot FPFI inspection. Your continued cooperation and support during this inspection is appreciated. If you have questions concerning the inspection, please contact Patrick M. Madden, the FPFI team leader, at 301-415-2854. If you have questions regarding the FPFI program or procedure, please contact Leon Whitney, the FPFI Program Manager, at 301-415-3081.

Sincerely, j l

Orig. signed by David L. Wigginton, Senior Project Manager I Project Directorate IV-1 Division of Reactor Projects III/IV Office of Nuclear Reactor Regulation j Docket No. 50-458 I

Enclosure:

Draft FPFI Procedure cc w/ enc 1: See next page DISTRIBUTION: Docket File PUBLIC PD4-1 r/f SPLB r/f JRoe DWigginton ACRS TGwynn, RIV CHawes i OGC (15B18) EAdensam (EGAl) WBeckner LWhitney PQualls l GWiseman, RII PMadden SWest

, l Document Name: RBNDFPFI. FWD O /

OFC P[tkPp/-1 LA/PD4-1 SPLB _ SC/SPLB/NRR ;

NAME dhinton/vw CHawes//Till PMaddenNh/ SWestGM DATE (///97 6/.6/97 f,/<'/97 / (g /5/97 COPY kS)N0 YES/N0 YES/NO YES/N0 l 0FFICIAL RECORD COPY ,

g;ss "

NEEdEMBCE 9706110098 970605 PDR ADOCK 05000458 F PDR

. - . ~ . _ - ~ . .-

i

1. M4 '

p % UNITED STATES s-j NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 30eetwoot s...../ - l June 5, 1957 _

Mr. John R. McGaha, Jr.

Vice President - Operations ;

Entergy Operations, Inc.

River Bend Station P. O. Box 220 St. Francisville, LA 70775

SUBJECT:

DRAFT FIRE PROTECTION FUNCTIONAL INSPECTION (FPFI) PROCEDURE i l

The purpose of this letter is to provide you the draft Fire Protection Functional Inspection (FPFI) inspection procedure that will be used to conduct the upcoming Office of Nuclear Reactor Regulation (NRR) lead pilot team inspection at River Bend Station.

As you are aware, four U.S. commercial reactor plants are receiving pilot team i inspections as part of the FPFI procedure development process. River Bend l Station is the reactor plant selected to receive the first pilot FPFI inspection, Your continued cooperation and support during this inspection is appreciated. If you have questinns concerning the inspection, please contact Patrick M. Madden, the FPFI team leader, at 301-415-2854. If you have ;

questions regarding the FPFI program or procedure, please contact Leon '

Whitney, the FPFI Program Manager, at 301-415-3081.

Sincerely, O

hbh. i~~-

David L. Wigginton, Senior Project Manager Project Directorate IV-1 Division of Reactor Projects III/IV Office of Nuclear Reactor Regulation Docket No. 50-458

Enclosure:

Draft FPFI Procedure cc w/ encl: See next page

I l

1 j Mr. John R. McGaha Entergy Operations, Inc. River Bend Station CC*

Winston & Strawn Executive Vice President and 1400 L Street, N.W. Chief Operating Officer ,

Washington, DC 20005-3502 Entergy Operations, Inc.

P. O. Box 31995 Manager - Licensing Jackson, MS 39286 Entergy Operations, Inc.

River Bend Station General Manager - Plant Operations P. O. Box 220 Entergy Operations, Inc.

St. Francisville, LA 70775 River Bend Station P. O. Box 220 Director St. Francisville, LA 70775 Joint Operations Cajun 10719 Airline Highway Director - Nuclear Safety )

P. O. Box 15540 Entergy Operations, Inc.

Baton Rouge, LA 70895 River Bend Station P. O. Box 220 l Senior Resident Inspector St. Francisville, LA 70775 l P. O. Box 1050 St. Francisville, LA 70775 Vice President-- Operations Support ;

Entergy Operations, Inc.

President of West Feliciana P. O. Box 31995 )

Police Jury '

Jackson, MS 39286-1995 ,

P. O. Box 1921 l St. Francisville, LA 70775 Attorney General !

State of Louisiana l Regional Administrator, Region IV P. O. Box 94095 J U.S. Nuclear Regulatory Commission Baton Rouge, LA 70804-9095 !

611 Ryan Plaza Drive, Suite 1000 :

Arlington, TX 76011 Wise, Carter, Child & Caraway '

P. O. Box 651 Ms. H. Anne Plettinger Jackson, MS 39205 3456 Villa Rose Drive Baton Rouge, LA 70806 Vice President & Controller Cajun Electric Power Cooperative Administrator 10719 Airline Highway i Louisiana Radiation Protection Division P.O. Box 15540 l P. O. Box 82135 Baton Rouge, LA 70895 l Baton Rouge, LA 70884-2135 I I

l l

l a

__ . . _ . . _ _ ~ _ _ . _ -__ _ - _ _ . _ . _ _ _ _ _ . _ _ _ _ _ .. _ _ _ . _

DRAFT - FOR RIVER BEW STATION PIL0T INSPECTION JUNE 4, 1997 NRC INSPECTION MANUAL SPLB TEMPORARY INSTRUCTION 2515/XXX FIRE PROTECTION FUNCTIONAL INSPECTION (FPFI)

SALP FUNCTIONAL AREA: PLANT SUPPORT (SOPLTSUP) 2515/###-01 OBJECTIVES 01.01 The primary objectives of a Fire Protection Functional Inspection are to assess the capability of the licensee's fire protection programs o(FPFI) r fire protection plan to:

a. Prevent fires from starting, ,

b. Detect, rapidly control, and promptly extinguish fires that do occur,

c. Ensure that fires will not arevent essential plant functions from being performed (e.g., achieve anc maintain post-fire safe shutdown),

d. Conduct effective post-fire safe shutdown and fire protection program configuration management activities.

01.02 Secondary objectives of an FPFI.are to assess the potential for and the likely effects of:

a. Event initiated fires,

b. Fire induced reactor transients,

c. Seismic fire interaction,

d. Fire induced release of radioactive materials.

2515/###-02 BACKGROUND During the 1980s, the U.S. Nuclear Regulatory Commission (NRC) staff inspected certain aspects of reactor fire protection programs using IP 64100, "Postfire Safe Shutdown, Emergency Lighting and Oil Collection capability at Operating and Near-Term Operating Reactor Facilities." These inspections are commonly called the original " Appendix R" inspections. Since the 1980s, the regional offices i

j DRAFT - FOR RIVER BElm STATION PILOT INSPECTION JUNE 4, 1997

have used IP 64704, " Fire Protection Program," to conduct 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months of fire -

protection and fire prevention capabilities inspection at each plant every other SALP cycle. IP 64150, " Triennial Postfire Safe Shutdown capability -

Reverification," was issued in 1987. However, such inspections have usually not l been conducted due to NRC staff resource constraints.

, To resolve Thermo-Lag fire barrier issues, many licensees reassessed their fire

protection programs to eliminate as much as possible the need for fire barriers.

Typical outcomes of these reassessment programs included redefined fire area boundaries, new or relocated safe shutdown components, and new operator actions and procedures. Many licensees also performed evaluations to justify either eliminating certain Thermo-Lag barriers or keeping them as they were (i.e.,

i without upgrades). In some cases, the licensees used such evaluations to justify exemptions from the NRC fire protection regulations. In its response to the

Thermo-Lag experience, the NRC staff reassessed the NRC reactor fire protection ,

program and decided to (1) develop a coordinated apprcach for the fire protection I

, and systems inspections and (2) reevaluate the scope of the fire protection '

inspection program. To do so, the staff considered fire events, licensee reports of deficiencies, previous NRC inspection findings, the scope and adequacy of the existing NRC fire protection inspection program, and the need to inspect other plant fire protection features in response to ongoing NRC programs (e.g.,

Thermo-Lag f' re barriers, self-induced station blackout, fire barrier penetration seals, turbine building assessments, and individual plant evaluations of external events). The staff concluded that additional fire protection inspection effort was warranted and initiated the Fire Protection Functional Inspection (FPFI) program.

The principal focus of the inspections will be on the plant fire protection and~

post-fire safe shutdown design and licensing bases and tnose fire protection program elements that are covered by existing NRC regulations and guidelines.

These include, for example, safe shutdown performance objectives, safe shutdown systems and equipment, fire protection systems and barriers, emergency lighting, reactor coolant pump oil collection systems, quality control and quality assurance, configuration control including change control process, administrative controls and procedures, and training. These aspects of the FPFI program will satisfy the program objective of ensuring continued licensee compliance with NRC fire protection regulations and commitments. In addition, the pilot inspections will include a review of fire safety considerations that are not expressly addressed by the fire protection regulation, but by other regulatory programs.

This includes, principally, the Individual Plant Examinations of External Events (IPEEE) for severe accident vulnerabilities. Such inspection areas include, for example, event initiated fires, fire induced reactor transients, and potential seismic fire interactions. This feature of the FPFI program will provide useful information regarding broader aspects of nuclear power plant fire safety. The staff will use this information to identify the strengths and weaknesses of the l overall NRC reactor fire protection program and to develop and support recommendations for program improvement, where appropriate.

The staff will use risk insights to help focus the FPFIs on those areas most l j

DRAFT - FOR RIVER BENO STATION FIL0T INSPECTION JUNE 4, 1997 important to safety. This includes, for example: -

Assessing the capability of fire protection features, administrative ,

controls, systems, equipment, personnel, and procedures to mitigate the adverse effects of fires on structures, systems and components important to safety;

Evaluating the capability to achieve and maintain safe shutdown conditions during and after a fire;

Evaluating how the defense-in-depth principles were applied to plant-specific configurations and identify fire event sequences (vulnerabilities) of potentially high safety significance; and

. Verifying that the fire protection plan conforms to the NRC-approved licensing and design basis, and that suitable design controls are in place to ensure that the approved configuration is maintained over the life of the plant.

The FPFI uses a multi-disciplined team of inspectors including a fire protection engineer, an electrical systems engineer, a reactor systems / mechanical systems engineer, a probabilistic risk assessment (PRA) analyst, and regional inspectors, each having experience in one or more of the following disciplines: fire protection; fire-risk assessment; plant operations; design and operation of normal and emergency plant shutdown systems; post-fire alternative and dedicated l shutdown methodologies; abnormal and emergency operating procedures; fire response procedures; electrical distribution system design; instrumentation and control; quality assura.rce; and configuration control.

2515/fH-03 INSPECl ?A REQUIREMENTS 03.01 FPFI Inspcction Requirements Overview

a. Fire Protection Program

1. Fire Protection Program Administration (a) Licensing and Design Bases (b) Organization and Management Oversight I (c) Fire Protection Procedures (d) Administrative Controls (e) General Employee and Fire Watch Training.

l (f) Fire Brigade and Hre Response 1

- .-... -_- ~ . - - _ _ . - - . _ _ . . - . - - . - - - - - . - - . -

h l

l j DRAFT - FOR RIVER BEIS STATION PIL0T INSPECTION JUNE 4, 1997 l l

1. Fire Brigade Composition, Notification and Availability, and , ;

Shift Staffing for Fire Events !

{ 2. Fire Brigade Training and Equipment

3. Offsite Agreements l l 2. Fire Protection Systems and Features l (a) Licensing and Design Bases l (b) Fire Detection and Alarm Systems

(c) Fixed and Automatic Fire Suppression Equipment and Systems

! (d) Manual Fire Suppression Equipment and Systems i

(e) Fire Barriers (f) Reactor Coolant Pump 011 Collection Systems

3. Post-fire Safe Shutdown capability (a) Licensing and Design Bases 3

l (b) Fire Hazards Analysis l (c) Safe Shutdown Analysis l (d) Post-fire Safe Shutdown Areas and Systems Selection 1

(e) Hot and Cold Shutdown Procedures and Equipment, Cold Shutdown Repairs, and Shutdown Safety

(f) Electrical System Protection 4-l 1. Power, Control and Indication Cable Separation and Protection s

l 2. Alternative / Dedicated Safe Shutdown Panel Electrical

Independence and Isolation 4

3. Associated Circuits Analyses i (g) Post-fire Safe Shutdown Capability Implementation

1. Methods of Redundant Train and Alternative / Dedicated Safe .

Shutdown Implementation a

i 2. Electrical Loads Management

- ,.r ,- . . ...r - - - . -n -- .-

4 DRAFT - FOR RIVER BEM STATION PIL0T INSPECTION JUNE 4, 1997

}

l_ 3. Human Factors and Manning -

4. Control System Interactions / Control Location Transfers --

b. Fire Protection and Post-fire Safe Shutdown Program Management and j Configuration Control j 1. Fire Protection and Post-fire Safe Shutdown Management Processes i

(a) Quality Assurance / Quality Control Audits

{

(b) Surveillance Testing and Maintenance' Program (c) Operability Assessments and Compensatory Measures

2. Fire Protection and Post-fire Safe Shutdown Configuration Control (a) 50.59 Process (b) Design Reviews and Modification Packages (c) Review Committee Actions (d) FSAR Updates -

c. Potential Fire Related Vulnerabilities

1. Event Based Fires

2. Fire Induced Plant Transients

3. Seismic / Fire Interactions

4. Fire Induced Release Of Radioactive Materials 03.02 FPFI Inspection Requirements

a. Fire Protection Program Administration. Inspection requirements for this topical area are located in Appendix A.

b. Fire Protection Systems and Features. Inspection requirements for this topical area are located in Appendix B.

c. Post-fire Safe Shutdown capability. Inspection requirements for this topical area are located in Appendix C.

d. Fire Protection and Post-fire Safe Shutdown Program Management and Configuration Control. Inspection requirements for this topical area are located in Appendix D.

DRAFT - FOR RIVER BEW STATION PIL0T INSPECTION JUNE 4, 1997 l

e. Potential Fire Related Vulnerabilities. Inspection requirements for this -

topical area are located in Appendix E.

2515/###-04 GUIDANCE l 04.01 General Guidance

a. The inspection conduct process is detailed in Appendix H.

b. The inspection will be guided by the results of the analysis of available '

PRA information' conducted prior to the inspection. This analysis will '

develop risk sensitive systems, locations, and scenarios for the subject reactor plant. :

i 04.02 Snecific Guidance i h

a. Insoection Reauirement Annendir A. 6. (a)

1. Section 50.54(m) of 10 CFR Part 50 addresses minimum staffing levels of licensed personnel, but does not address minimum personnel availability during reactor events.

2. Generic Letter (GL) 77-02, " Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," ;

addressed plant fire brigade positions by providing guidance supplemental to Appendix A to Branch Technical Position 9.5-1 (sections A.1, B and C) and Regulatory Guide (RG) 1.120 (Sections C.1, C.2 and C.3). The supplemental information provided in GL 77-02 was that: ;

i Fire brigade positions should be responsible for fighting fires. !

The authority and responsibility of each fire brigade position ;

relative to fire protection should be clearly defined.

1 These responsibilities of each fire brigade position should correspond with the actions required by the fire fighting j procedures.

j!

The responsibilities of the fire brigade members under normal plant I conditions should not conflict with their responsibilities during a i

fire emergency. i

The minimum number of trained fire brigade members available onsite for each operating shift should be consistent with the activities i

required to combat the most significant fire. The size of the fire !

brigade should be based upon the functions required to fight fires with adequate allowance for injuries.

4 t

i j l

! l i

i

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 NFPA 27-1975 and the publications it references provide appropriate -

criteria for organizing, training and operating a plant fire brigade. ,

3. Section H, " Fire Brigade," of Appendix R to 10 CFR Part 50, (not backfit to plants licensed prior to January 1, 1979, to the extent that fire protection features proposed or implemented by the licensee had been accepted by the staff), contained the following requirements:

Adequate manual fire fighting capability shall be provided.

The fire brigade shall be at least 5 members on each shift.

The shift supervisor shall not be a member of the fire brigade.

Appendix R was silent on conflicting duties of fire brigade members other than the shift supervisor. Reactors not subject to Appendix R received licensing reviews against similar criteria.

4. NRC Information Notice (IN) 91-77, " Shift Staffing at Nuclear Power Plants," addressed adequate shift staffing following any event (not j necessarily a fire). IN 91-77 stated that:

The number of staff on each shift is expected to be sufficient to accomplish all necessary actions to ensure a safe shutdown of the reactor following an event. Those actions include implementing {

l emergency operating procedures, performing required notifications, establishing and maintaining communications with the NRC and plant management, and any additional duties assigned by the licensee's administrative controls.

5. An August 30, 1991, memorandum from William T. Russell, Associate Director for Inspection and Technical Assessment, Office of Nuclear Reactor Regulation (NRR), to Thomas T. Martin, Regional i Administrator, Region I, reiterated the above IN 91-77 guidance and '

provided the following amplification regarding event response:

Licensees should document actual staffing needs in administrative <

procedures based on plant specific analyses to account for l potential emergency situation at any time, including the l backshift... the staff considers those licensee's practice of !

using the STA (Shift Technical Advisor) to man the fire brigade or to provide support for other special occurrences to degrade the licensee's ability to adequately respond to an event.

6. IN 95-48, "Results of Shift Staffing Study," provided licensees with findings resulting from extensive interviews with site personnel. :

Licensees were asked to consider these insights when considering 1 l l l

l

DRAFT - FOR RIVER BEM STATION PIL0T INSPECTION JUNE 4, 1997 i

their capabilities to accomplish safety functions following an -

j event.

1.

' 7. It should be noted that the NRC does not require dedicated fire '

brigades (fire fighting personnel who have no event related i operational responsibilities). However, licensees are responsible

for establishing controls to ensure shift staffing is sufficient to i accomplish all necessary functions required by an event.

i i b. Inspection Reauirement Anoendix B Section 3.8.1 of GL 86-10 discusses the i applicability of NFPA codes.

i c. Insoection Reauirement Aor,endix B. 5. Fire barriers include penetration seals, wraps, walls, structural member fire resistance, doors, dampers, etc. Fire barriers are used to prevent the spread of fire and to protect

! redundant safe shutdown equipment. Laboratory testing of fire barrier i materials is done only on a limited range of test assemblies. However, in-plant installations can vary from the tested configurations. Under the provisions of GL 86-10, licensees are permitted to develop engineering i evaluations justifying such deviations. In-plant fire barrier l installations should reviewed to establish that they represent reasonable i l

! variations of tested configurations. (Appendix G provices staff positions 3

' on fire endurance rating tests.) Problems with the qualification of fire barrier materials include: in-conplete or indeterminate fire test results; i

questionable cable wrap ampacity derating test results; a wide range of :

i documented ampacity derating far. tors for the same material; barriers not l ' installed in accordance with vendor-recommended installation procedures; i

incomplete installation procedures; and as-built fire barrier configurations that may not have been qualified by valid fire endurance ,

tests or evaluated in accordance with guidance of GL 86-10. .

i The results of this inspection should confirm that the licensee has established an acceptable design basis for fire barriers used to separate safe shutdown functions within the same fire area. The inspectors should be able to draw conclusions regarding:

= The ability of fire barriers to perform their specified fire resistive ,

function and provide an adequate level of fire safety to electrical !

components; i The adequacy of the electrical design with respect to ampacity derating of cables protected by fire barrier systems;

The potential for fire barrier system weight to affect raceway response :

to a seismic event; !

The degree to which the design basis for fire bat 11ers, the drawings, specifications, calculations, fire test documentation and, installation procedures are consistent, technically adequate, reflect a conservative 8-

*'-+-e v +w7wv* 'atF--Tv r 7 p- 77- m--- -my - * ,' - ^ - -'

m--++"# ^^-' I

k DRAFT - FOR RIVER BEIS STATION PIL0T INSPECTION JUNE 4, 1997 !

l approach that provide an adequate margin of fire safety, and reflect -

"as-built" plant conditions;

_ l

The degree to which the "as-built" fire barrier configurations have !

been constructed and installed in accordance with the basis established l by the fire endurance qualification testing documentation and the

! conleteness of the licensee's engineering evaluations of fire barrier conditions that vary from the tested configurations;

The degree to which fire barrier configurations comply with regulatory ;

requirements and licensing commitments.

l i

d. Inspection Reauirement Annendix B. 5. The following types of documents associated with the use of fire barriers to protect the safe shutdown capability and the fire barrier installations should be available on-site

for review by the inspectors:

Lists of raceways, components, and equipment protected by fire barriers within the same fire area. The lists should identify type of cables and percent cable fill, raceway material and dimensions, location in the plant, and safe shutdown function protected. ;

Procurement, receipt inspection, and material storage specifications l and procedures. '

Procurement and receipt inspection records for fire barrier materials.

Fire endurance and ampacity derating test reports.

Design details and criteria.

Fire barrier design specifications and design drawings.

Engineering evaluations for fire barrier configurations that deviate from tested configurations.

Installation specifications and procedures.

QA and QC inspection and audit procedures QA and QC installation records ,

QA records associated with the installation process j

Course outline, lesson plans, and training records for installer i training, and installer training records

Seismic analyses for raceway systems protected by fire barrier l materials

_g.

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 i

. Ampacity derating test reports and calculations for cables enclosed in -

fire barriers e

e. Inspection Reauirement Anoendix B. 5. (a) 7. GL 86-10, and Enclosure I to GL 86-10, Supplement 1, provide detailed guidance on fire endurance test methods and acceptance criteria. GL 86-10, Suppiement 1, also provides detailed guidance on acceptable methods for determining cable i functionality after fire tests.

l

f. Insoection Reauirement Anoendix B. 5. (b) 5. In July,1996, the staff

, published NUREG-1552 " Fire Barrier Penetration Seals in Nuclear Power Plants." The inspector should read this document in detail. The staff made the following salient points and conclusions:

. i The general condition of penetration seal programs in the nuclear !

industry was satisfactory. Industry awareness had resulted in more l thorough surveillances, maintenance and corrective actions. No safety l significant proolems or potentially generic problems were found. j

The ability of a particular penetration seal design to achieve a specific fire rating is configuration dependent.

. Fire endurance tests have established the fire-resistive capabilities of the penetration seal materials, designs and configurations typically installed in nuclear power plants.

(Question 3.2.2 of " Appendix R Questions and Answers", Enclosure 2 to GL 86-10 addressed deviations from tested configurations.)

NRC fire protection regulations do not cover either fire endurance testing or fire test laboratories. There is no regulatory requirement that fire tests be conducted by a nationally recognized testing laboratory.

Historically, during licensing reviews, the staff had accepted the use of fire barriers without reviewing the fire test results if the barriers were tested and approved by UL (Underwriter's Laboratory) or FM (Factory Mutual). The staff had also accepted barriers that were tested by organizations other than UL and FM. In such cases, the staff may have reviewed the fire test results.

Proper installation, surveillance, maintenance and repair are important to the ability of penetration seals to perform their intended fire protection design function. Potential problems include:

Incomplete or inadequate fire test documentation.

In-plant penetration seal configurations not bounded by fire tests. '

l l

l

,l DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 i l

!

Seals not installed where required. .

l l

l

Seals not installed properly. -

1 1 l

Seals not repaired or not repaired properly.

i ,

+ Seals modified without a supporting engineering evaluation. ;

i i

!

Seals not inspected in accordance with plant surveillance

procedures.

l g. Insoection Raouirement Anoendix B. 5. (b) 6. IN 94-58, " Reactor Coolant d

Pump Lube Oil Fire," discussed a Haddam Neck reactor coolant pump (RCP) ;

i lube oil fire event and a Millstone Unit 2 RCP lube oil leak which was not

! collected by the oil collection system. Approved exemptions in this !

.: technical area almost exclusively deal with collection tank capacity l (sizing for complete leakage from one RCP, with (low probability) multiple RCP leakage overflow going to a non-hazardous location in containment).

! l

h. Insoection Reauirement Anoendix C. 4. The FSAR, 50.59 analyses, Section 7.4, " Safe Shutdown Systems," of the SRP, licensee submittals and safety evaluations provide important information regarding the purposes and capabilities of specific plant systems.

1. Insoection Reauirement Anoendix C. 7. In May 1992, Section 6.10 of NUREG 1449, " Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States," described typical licensee practices with regard to fire protection during shutdown and refueling. This section concluded ;

that (for the limited number of reactor sites visited): ;

A postulated fire could potentially damage the operable train or trains ,

of decay heat removal systems during shutdown conditions, I

Increased transient combustibles and ignition sources during outage ;

activities present additional fire risks,

Fire prevention administrative control procedures did not provide l enhanced controls or compensatory measures during shutdown conditions :

in those plant areas critical to supporting RCS makeup and decay heat removal, and

A majority of the fires at the facilities occurred during refueling outages.

j. Insoection Reauirement Anoendix C. 8 f a) 4. Cables enclosed in electrical i raceways protected with fire barrier materials are derated because of the insulating effect of the fire barrier material. Other factors that affect ampacity derating include cable fill, cable loading, cable type, raceway construction, and ambient temperature. The National Electrical Code, l

l l

l

I l DRAFT - FOR RIVER BDW STATION PILOT INSPECTION JUNE 4, 1997 i

?

Insulated Cable Engineers Association publications, and other industry -

i standards provide general ampacity derating factors, but do not include derating factors for fire barrier systems. Although a national standard "

ampacity derating test method has not been established, ampacity derating

factors for raceways enclosed with fire barrier material have been j determined for specific installation configurations by testing.

j Most cables used in nuclear power plant electrical systems are rated for 1 40 years of life at a continuous conductor temperature of 90 'C. Cables j that have continuous conductor temperatures 10

over.this temperature j

rating will have half the rated life (20 years). Cable insulation will begin to degrade (embrittle or melt) as higher conductor temperatures are encountered. Cracking in cable insulation due to long-term degradation can lead to conductor-to-conductor arcing, and eventually a fire.

Inspectors should verify that test results are reasonable and represent good engineering _ practices. For example, power cables supplying current

to a motor-operated valve (MOV would be energized for short and i infrequent durations. An assess) ment of the worst case (continuously j energized, high ambient temperature) ampacity derating factor for the

, installed fire barrier configuration, based upon either test results or

bounding analysis, would represent a conservative determination current

! carrying capacity degradation. '

i l Ampacity derating tests are conducted according to IEEE standards and j include the testing of cables in various configurations (conduits and

! cable trays). Test samples (cables) are brought to a steady state 1 conductor temperature of 90 *C and current flow through the conductors is 4 recorded. The cables are then enclosed in a fire barrier system, and the configuration is once again brought to a steady state conductor i temperature of 90 *C. The current is recorded and then compared to the l current recorded without the barrier system in place. The difference

! between these two recorded currents is the derating factor that must be j used for this barrier configuration.

The general industry practices for ampacity derating tests should be observed. Institute of Electrical and Electronic Engineers (IEEE)

Standard 848-1996, " Procedure for the Determination of the Ampacity Derating of Fire Protected Cables," issued on December 6,1996, was the latest industry document on this subject as of the date of this procedure.

Thermo-Lag specific ampacity derating background information is contained in Appendix K.

k. Inspection Reauirement Annendix C. 8. (d) 3. (d) IN 92-18, Question 5.3.10 of GL 86-10, and Director, NRR letter to the Nuclear Energy Institute dated March II,1997, (Collins to Beedle) provide background information on spurious signals. Note that the allowance to address each non-high/ low pressure interface spurious actuation or signal resulting

j i

i i DRAFT - FOR RIVER SEE STATION PIL0T INSPECTION JUNE 4, 1997 i

from a fire individually (one at a time) is limited to the engineering -

process of specifying design capacity and capability of the alternative or ;

i dedicated shutdown system. That is, during an alternative post-fire safe shutdown, can the licensee overcome any one fire induced failure with pump i i or tank size, identification of alternative flowpaths, specific manual '

} actions, or combinations thereof? Outside of the engineering design process, multiple, simultaneous failures from hot shorts caused by a postulated fire can be considered by the inspector.

1. Insoection Reauirement Anoendix C. - 9. (a) 1. By definition, redundant (normal shutdown) train post-fire safe . shutdown procedures should be i identical to normal plant shutdown procedures. However, when fire zones i exist (without floor to ceiling walls for separation of zones), such that l heat and combustion products could affect access into adjacent zones, the inspector may determine that a walk-through simulation of a redundant l train (normal shutdown equipment) shutdown should be observed.

m. Insoection Reauirement Annendix C. 9. (a) 2. Assign specific sections of !

the shutdown procedure to participating team members. The procedure walk- .

through should be carried out to the point where the plant operating staff l have demonstrated that a stable controlled cooldown has been established. '

In a memorandum of June 15, 1990, to Region IV, NRR stated that the agency

, position on testing of remote shutdown panels was to require no testing on plants licensed before 1979, and to require a one time test for plants licensed after January 1979 (see Regulatory Guide 1.68.2). The expectation (not requirement) was that licensees would periodically walk through the procedures for remote shutdown. The memorandum stated that NRR encourages inspectors from time to time to ask licensees to conduct walk-through simulations of its remote shutdown procedures, particularly

.in cases where it is obvious that a licensee is not doing so under its own initiative. GL 81-12 (and a clarification containing a rewrite of the request for additional information in the original February 20, 1981, GL 81-12) discussed important alternative safe shutdown system design issues which the insixceor can review in advance and consider during the alternative sa ~shutdoc walkdown.

The scope of 10 CFR 50.65, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," included remote post-fire safe shutdown panels and control stations. Regulatory Guide 1.160 and NUMARC 93-01 provided implementation guidance for 10 CFR 50.65.

n. Insoection Reauirement Anoendix C. 9. (b) 1. Several U.S reactor plants have alternative post-fire safe shutdown methodologies which may result in loss of all A.C. power (station blackout). Some of these voluntarily enter station blackout. The remainder appear to have procedures which ma',

cause a SB0 condition to be created as a result of fire effects (such 1.s procedures which direct operators to manually trip the credited emergency l

1 l

l DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 diesel generator (EDG) in the event of fire damage to circuits of vital -

EDG support systems).

o. Insoection Reauirement Accendix D. 3. GL 91-18 contains specific guidance regarding operability and the resolution of degraded and nonconforming conditions.

p. Inspection Reauirement Anoendix F General Design Criterion (GDC) 3 of Appendix A to 10 CFR Part 50 states that structures, systems and 1 components (SSCs) of water cooled nuclear power plants important to safety l shall be designed and located to minimize, consistent with other safety l requirements, the probability and effects of fires and explosions.

Therefore, inspector review of potential, non-post-fire safe shutdown related, fire vulnerabilities do not fall outside the scope of NRC -

regulatory programs and safety responsibilities. There are four !

categories of potential fire related vulnerabilities: 1 i

. Evaluation of the potential for mechanical failure events to cause a '

fire, and evaluation of the capability of the licensee to suppress the i fire and cope with (non-transient) fire effects such as heat, smoke and I suppression runoff,

Evaluation of the potential for postulated fires to cause plant i transients, and evaluation of the capability of the licensee to both l suppress the fire and control the reactor plant, '

Evaluation of the potential for the occurrence of seismic / fire interactions, and 1

. Evaluation of the potential for fire induced release of radioactive materials.

q. Inspection Reauirement Accendix F. 1. Event based fires are caused by equipment malfunctions or failures. These failures may result in an unanticipated sequence of events that initiates a fire, which in turn may also result in a degradation of plant safety and challenge the reactor plant's fire barriers and smoke, heat and suppression agent control features, and the licensee's fire fighting.

r. Insoection Reauirement Accendix F. 2. Fire-induced plant transients are defined as plant transients (e.g., inadvertent safety injection actuation, loss of off site power, over cooling and over and subsequent over filling of steam generators, spurious closure of containment isolation valves, significar.t loss of safety systems, station blackout, rapid cooldown) that initiate as a result of fire-induced circuit failures such as hot shorts, shorts to ground, or open circuits.

s. Insoection Reauirement Anoendix F. 3. Seismic damage is generally caused by movement or falling debris. Section 7 of GL 86-10 is a discussion of DRAFT - FOR RIVER BDW STATION PIL0T INSPECTION JUNE 4, 1997 fire protection and seismic events. The Sandia Laboratories Fire Risk -

Scoping Study (NUREG/CR 5088) and RG 1.29 address seismic damage. Fire suppression and detection systems are typically not qualified to the same '

level of seismic protection as safety related equipment. Fire protection systems must meet the design guidelines stated in paragraph C. 2. of RG 1.29.

t. Insoection Reauirement Anoendix F. 3. (b) Carbon dioxide is approximately seven times heavier than air. In some suppression system designs, one large low pressure tank of carbon dioxide is fed through timer pilot valves to a number of rooms in various fire areas. Seismic damage could cause the inadvertent release of much more than the intended volume of carbon dioxide. The resultant overpressure could damage fire doors, fire dampers and other fire barrier features.

u. Inspection Reouirement Accendix F. 4. Although there are no regulations addressing the spread due to fire of radioactive materials which apply to operating reactor plants, on July 29, 1996, the NRC published an amendment to 10 CFR 50.48 which required licensees who were terminating their licenses (and therefore undergoing reactor decommissioning) under 10 CFR 50.82 "to maintain a fire protection program for fires which could cause the release or spread of radioactive materials (i.e. which could result in a radiological hazard)." In May, 1997 a draft RG (DRG-1068) for 10 CFR 50.48 (f) was being considered for issuance. The inspector should obtain a copy of the draft or final issue regulatory guide and review it as background information on radioactive material fire hazards and fire protection.

2515/###-05 REPORTING REQUIREMENTS Inspection findings will be documented in a routine inspection report normally issued by NRC Headquarters.

2515/###-06 INSPECTION RESOURCES 06.01 Team Comoosition. See Appendix G for a detailed discussion of team makeup and qualifications.

06.02 Insoection Duration. A complete FPFI team inspection will be comprised of three weeks of activity: one week onsite, one week of in-office review of findings, and a second week onsite. See Appendix H for a detailed discussion of the team inspection process from plant selection and inspection announcement to inspection report writing and inspection finding followup.

06.03 Insoection Schedule. The events expected to occur during the two onsite inspection weeks are discussed in Appendix H.

2515/f##-07 COMPLETIQN SCHEDULE DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 Four pilot FPFI inspections are planned for Fiscal Year 1997. Thereafter, at -

least four and possibly as many as eight FPFI team inspections will be conducted each fiscal year. ,

2515/###-08 EXPIRATION This temporary instruction (TI) will remain in effect until December 31, 1997. l 2515/###-09 NRR TECHNICAL CONTACTS Any questions regarding this TI should be addressed to Leon Whitney, (301) 415-3081, Pat Madden (301) 415-2854, or Steven West (301) 415-1220.

2515/###-10 STATISTICAL DATA REPORTING For RITS input, the actual inspection effort should be recorded against 2515/###. l At regional management discretion, and with the concurrence of the Chief, Fire Protection Engineering Section, NRR, may take credit for completing appropriate core procedures on the basis of efforts expended under this TI.

2515/###-11 ORIGINATING ORGANIZATION / RESOURCES 11.01 Oroanizational Resoonsibilities. The Fire Protection Engineering Section, Plant Systems Branch, Division of Systems Safety and Analysis ( DSSA), NRR will I manage the FPFI program.

11.02 Estimated Resources. The inspection process described in Appendix H will take 7 to 10 weeks (excluding inspection finding followup). With the exception of the PRA analyst, all team members will be involved for the entire duration of the inspection process. Therefore, each inspection will require about 1,225 staff hours of effort (approximately 0.6 FTE). For MIPS planning purposes, there will be about 350 hours0.00405 days 0.0972 hours 5.787037e-4 weeks 1.33175e-4 months of direct inspection effort (DIE) expended during the two onsite weeks (assuming no usage of contractor personnel).

2515/###-12 INSPECTION IMPLEMENTATION LATITUDE / CREDIT FOR SELF ASSESSMENT 12.01 Insoection Imolementation Latitude The expectation is that this inspection will be conducted at every site over the next 10 to 15 years.

On a case-by-case basis, an evaluation, that has been approved by the Chief, Fire Protection Engineering Section, NRR, and concurred in the by the Director, DSSA, NRR, may conclude that the inspection scope can be reduced. This option is envisioned for situations in which in-depth inspections have recently been performed in specific areas addressed by this TI.

12.02 Self Assessment DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997

a. Credit for Self Assessment. NUREG/BR-0195 is the NRC Enforcement Manual. -

Section 8.1.7 of that document provides general policy on enforcement ~

actions involving fire protection. NUREG 1600 is the NRC Enforcement <

Policy.Section VII B. 3. of that document discusses licensee identified violations. Inspection Manual Chapter 0610, Section 05.02, provides guidance regarding violations identified as part of licensee self j assessments.

b. fPFI Use to Review Licensee Fire Protection Self Assessments. This TI may be used to revie.v licensee self assessments that are equivalent in whole or in part to FPFIs. The results of such a review will be documented in a routine inspection report. Review inspection findings will be processed in the normal manner, but taking into account the self assessment credit guidance discussed in Section 12.02 a. above.

APPENDICf1 A. Fire Protection Program Administration Inspection Requirements B. Fire Protection Systems and Features Inspection Requirements C. Post-fire Safe Shutdown Capability Inspection Requirements D. Fire Protection and Post' fire Safe Shutdown Management Process Inspection Requirements E. Fire Protection and Post-fire Safe Shutdown Configuration Control Inspection Requirements F. Potential Fire Related Vulnerabilities Inspection Requirements G. Team Makeup and Qualifications H. Team Inspection Process I. PRA Process Technical Guidance (to be dueloped summer 1997)

J. Fire Protection Regulatory Background Information K. Thermo-Lag Ampacity Derating Background Information L. Staff Position on Fire Endurance Rating Tests M. References END i

)

I

! DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 APPENDIX A -

i

' ~

[

FIRE PROTECTION PROGRAM ADMINISTRATION INSPECTION REQUIREMENTS

1. Licensing and Design Bases (licensing commitments, standards, technical 2

specifications, exemptions, safety evaluations (SERs), FSAR, 50.59 evaluations) ]

]

2. Organization and Management Oversight (a) Organization and Operating Responsibilities (b) Management Review and Audit Responsibilities and Programs,

3. Fire Protection Procedures (a) Maintenance Procedures and Records j

1. Review the extent of any backlog of fire protection system maintenance items, and the out-of-service duration of fire protection equipment.

2. Identify any spurious actuations of fire suppression systems and associated root cause analyses and long tem corrective actions.

(b) Surveillance Procedures and Records Relating to Fire Barrier Integrity (c) Fire Watch Procedures: Verify that fire watch procedures call for the establishment of fire watches for hot work and when fire protection ,

equipment is declared inoperable. '

i

4. Administrative Controls i (a) Control of Combustibles

1. Consider potential vulnerabilities associated with large quantities of combustible material being temporarily or permanently stored f n or adjacent to critical plant areas (e.g., ion exchange reslns, lubrication oil, wooden scaffolding, anti-contamination clothing).

2. Consider plant practices with respect to the control of combustibles in operating modes other than full power.

(b) Control of Ignition Sources (c) Fire Barrier Integrity Control During Plant Operation (d) Compensatory Measures for Inoperable / degraded fire protection features.

5. General Employee and Fire Watch Training A-1

l l

DRAFT - FOR RIVER BDW STATION PIL0T INSPECTION JUNE 4, 1997 (a) General Employee Fire Training (reporting, use of portable -

extinguishers) ,

I (b) Fire Watch Training l

l 6. Fire Brigade and Fire Response r I

(a) Fire Brigade Composition, Availability and Notification, and Shift Staffing for Fire Events

1. Verify that the fire brigade composition (as specified in reactor plant administrative control procedures) provides an adequate number of trained fire fighting personnel (at least five) whose expected responsibilities during a fire event do not conflict with their fire brigade duties. Detemine if alternative brigade members are available if the primary response team is injured or incapacitated by the event.

2. Verify that the number of staff on each shift is sufficient to accomplish all necessary actions to ensure a safe shutdown of the '

reactor following a fire. Those actions include implementing emergency operating procedures, performing required notifications, establishing and maintaining communications with the NRC and plant management, and ,

any additional duties assigned by the licensee's administrative l controls. '

l

3. Verify that the licensee has documented actual fire event staffing 1 needs in administrative procedures based on plant specific analyses for '

all times (including the backshift) and plant conditions. l

4. Review the procedures for notifying the fire brigade. Evaluate potential vulnerabilities to the notification process during a fire or seismic / fire event. Determine if a backup means of notification is available.

(b) Fire Brigade Training and Equipment

1. Fire Event Training (plant and equipment layout, fire effects, selection of suppression agents, pre-plans, drills / simulations, practical use of suppression agents) l l

(a) Verify that drills make effective use of the pre fire plans, and that the pre-fire plans accurately depict the conditions in the identified risk critical fire areas.

(b) Evaluate the adequacy of training given to the control room operators to recognize electrical faults and related scenarios as potentially incipient fires.

A-2

j . DRAFT - FOR RIVER BEM STATION PIL0T INSPECTION JUNE 4, 1997

! I j (c) Determine if the fire brigade training program places adequate -

emphasis on conducting drills in the identified risk critical plant areas, and that the brigade members are aware of

~

precautionary fire fighting practices near vital nuclear j equipment.

l (d) Observe a fire drill in one of the risk critical areas. Include

unannounced obstructions to access paths and/or inoperable hose

, stations to simulate potential seismic / fire interactions. Verify

! that the fire brigade response is satisfactorily demonstrated, j including fire brigade leader command and control, teamwork, i

communications techniques, utilization of support from other i resource groups, and proper selection of suppressant. Review the j adequacy of the fire brigade's capability to locally control HVAC ;

systems / dampers in the fire area. Review the licensee planning i for post-fire habitability of important operating spaces (ventilation, room cooling).

(e) Communications. Determine whether communications between the control room, alternative shutdown stations, remote operating -

stations and fire brigade are adequate to both fight the fire and conduct post-fire safe shutdown.

(f) Fire Brigade'/Security / Health Physics Interface. Ensure fire brigade members can overcome potential security related access ,

problems such as locked and electrically failed shut doors, and i health physics access problems for fires in radiologically l controlled /high radiation areas.

2. Fire Brigade Equipment Design and Function (a) Communications equipment (b) Environmental equipment (e.g., exposure suits, breathing apparatus)

(c) Fire fighting equipment: determine if any specialized fire fighting equipment is necessary for the identified risk critical areas.

3. Offsite Agreements (a) Determine if the training program places adequate emphasis on the offsite fire departments' knowledge of the identified risk critical plant areas.

(b) Determine the means of communications between the plant fire brigade and the offsite fire department. Verify that sufficient i

A-3 i 1

. - . . _ . .-. ._. _ - . .- . _ = _ = - -

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 i* radios on comon frequencies are provided. Verify that the -

radios are operable within the identified risk critical areas. -

(c) Verify that HP and security procedures are in place to enable the

! offsite fire department to access the protected area with minimal delay.

T i

1 A-4

l- DRAFT - FOR RIVER BElm STATION PILOT INSPECTION JUNE 4, 1997 l :

APPENIX B -

1 FIRE PROTECTION SYSTEMS AND KATURES INSPECTION REQUIREMENTS

! 1. Fire Protection Systems and Features Licensing and Design Bases (reference SERs, licensing commitments, technical specifications, etc. and the licensee 4

response to NRC 50.54 (f) letter dated October 9, 1996)

2. Fire Detection and Alarm Systems (a) Fire Alarms and Automatic Backup Power Systems (designed, installed and maintained in accordance with NFPA 72)

(b) Fire Detector Positioning (designed, installed and maintained in accordance with NFPA 72) I J -

l (c) Appropriateness of Detector Type Selection (thermal, smoke ionization or photoelectric, light beam, ultraviolet, infrared, UV/IR, etc. in

accordance with NFPA 72) 1 (e) Review plant procedures for testing detectors installed in remote, high ceiling or high radiation areas.

3. Fixed and Automatic Fire' Suppression Equipment and Systems (includes Water l Supplies, and other Liquid and Gaseous Agents) j (a) Fixed / Automatic Fire Suppression.

1. Verify that wet, dry pipe and pre-action sprinkler systems (designed, installed and maintained in accordance with NFPA 13)

2. Verify that deluge systems are designed, installed and maintained in accordance with NFPA 15

3. Verify that gaseous suppression systems (Halon, carbon dioxide and alternative clean agent systems) are designed, installed and mair:ained i in accordance with NFPA 12, NFPA 12A and NFPA 2001.

l (a) Give consideration to required minimum concentrations and. soak times (e.g., verify that the CO2 system is capable of achieving

, a 30 percent CO2 concentration in the protected space within 1-minute and 50 percent within 7-minutes and is capable of maintaining this 50 percent concentration for 20 minutes).

(b) Verify that the dampers / doors close automatically (or there closure is otherwise assured) upon actuation of the gaseous system. i

. B-1 l

l

. _ . - . - . . . ..= - - - _ - _- .. - .. . - - _ _ - . _ - -

l l

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 (c) Verify that the room penetration seals will minimize gas leakage. -

Review the adequacy of surveillance testing for room integrity ,

4. Verify that foam systems are designed, installed and maintained in accordance with NFPA 11.

5. Consider advertent and inadvertent fire suppression system actuation interactions (reference GSI-57 and NUREG-1472) l Equipment Damage from flooding or spray.

(a) l (b) Personnel Hazards (c) Inadvertent Actuation Root Causes (e.g., dust caused actuation of smoke detectors after a seismic event)

6. Consider potential suppression system actuation problems:

(a) Extended Actuations (b) Failure to Actuate (e.g., loss of offsite power)

(c) Inadvertent Actuations. Could a fire, indirectly, through the production of smoke, heat, or hot gases, potentially cause the activation of automatic water fire suppression systems in other .

plant locations and damage redundant shutdown equipment? l 1

(d) Verify that redundant trains of systems required for safe !

shutdown located in the same fire area are not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems (e.g.,

sprinkler caused flooding of other than the locally affected train). l I'

7. Consider protection of critical components from water spray and drippage, and the presence of water sealed cabling to critical electrical panels, where appropriate.

(b) Water Supplies

1. Biofouling.and microbiological 1y induced corrosion of tanks (designed, installed and maintained in accordance with NFPA 22), pumps, pipes, and valves (reference GL 89-13, Supplement 1, IE Bulletin 81-03, IN 89-76, and SECY 95-034)

2. Piping (including outdoor thermal protection)

3. Outdoor or underground piping and hydrants (designed, installed and maintained in accordance with NFPA 24)

B-2 l

7 i

j DRAFT - FOR RIVER BElm STATION PILOT INSPECTION JUNE 4, 1997

4. Fire pump capacity, pressure head, testing, reliability and motive -

source diversity (e.g., diesel and electrically driven pumps) adequate for the laniest sprinkler demand and simultaneous extinguishment > ~

hosestreams ' n the same area (designed, installed and maintained in accordance with NFPA 20)

(c) Suppression and Detection System Related Modifications. Address whether selected modifications / equipment installations:

1. Changed the flow of heat, smoke or suppression agent, or the horizontal or vertical location of combustibles.

2. Affected the threshold, response time, zoning or logic of automatic detection, alarm, or actuation devices (e.g., new walls, major structures, intermediate floors or horizontal surfaces can channel heat or smoke away from detectors, while ceilings with deep beams may act to .

collect heat and smoke and hasten detection.

3. Required changes in nozzle, detector, floor drain, flammable / combustible liquid or water confinement / spill. containment curb, or alare/ suppression activator box (" pull station") horizontal or vertical locations, or in the number and pattern of detectors or nozzles. ,

4. Required changes in gaseous system pressures or volumes (e.g., flow i rates may be affected by gaseous volume temperatm).

l S. Required changes in HVAC flows, HVAC deenergization interlocks, equipment deenergization interlocks, or door closure / damper closure interlocks.

6. Required changes in suppression system or water curtain design to account for the presence of new or repositioned fixed or permanently positioned combustibles (e.g., plastic /PVC piping, treated lumber, anti-contamination suits, decontamination materials, combustible process gases).

7. Required the installation of new fire barriers based on the introduction or repositioning of fixed or permanently positioned combustible material in lieu of or along with changes to suppression and detection systems.

(d) Review detection and suppression related exemptions and deviations for areas of the plant which are designated as using redur. dant train safe shutdown. In addition to determining whether there are any detection and suppression features which would appear to require the granting of an exemption or ' deviation from the NRC staff, and for which no such exemption or deviation exists, assess for granted exemptions or deviations whether:

B-3

I DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997

1. The NRC reviewer correctly interpreted the licensee submitted -

information.

2. The licensee submitted information was correct and complete.

3. The granted exemption / deviation was correctly implemented by the licensee.

4. Manual Fire Suppression Equipment and Systems (hose stations and standpipes)

(a) Verify hose stations and standpipes are designed, installed and maintained in accordance with NFPA 14, and provide adequate coverage for all plant areas.

(b) Verify that the utilization of manual fire-fighting systems by the fire brigade will not have an adverse affect on redundant trains within the fire area of concern, or cause water run-off that may have an affect on the redundant train located outside the fire area of concern.

5. Fire Barriers (a) General Fire Barrier Inspection Methodology

1. Verification of the fire barrier system installations through the review of installation procedures and records.

(a) Procurement of Fire barrier materials

1. Review the licensee's procurement documentation and verify that the materials used to construct the in-plant fire barriers are i the same as those used to construct the test specimens. l

2. Review of the procurement procedures and determine if the fire barrier materials and components were subject to receipt '

inspections. :

3. Verify that the attributes required to be confirmed by the receipt inspection are the same as those identified by the procurement and applicable design specifications and those identified by the fire test reports.

4. Determine the storage requirements for these materials and l confirm that these materials are being properly stored.

(b) Review of plant specific installation procedures

1. Confirm that the construction attributes identified in the .

licensee's installation procedure for each type of fire barrier (e.g., small conduits; large conduits; junction boxes; small B-4 ,

1 DRAFT - FOR RIVER BDS STATION PIL0T INSPECTION JUNE 4, 1997 i

j cable trays; large cable trays; air drops) are the same as those .

used in the construction of the test specimens i

2. Determine how the licensee repairs fire barrier which had to be opened, altered or modified (i.e. dismantled or opened for l purposes of penetration seal verifications, junction or pull-box i surveillance, etc). Verify that proper controls are established i and maintained to implement compensatory measures during degraded

conditions and that procedures are in place to fully restore the i barrier to an operable condition at the completion of work that impacted the fire barrier system.

1 (c) Review the installation and design drawing details and determine i that the configurations specified are consistent with the design j details used in the construction of test specimens.

(d) QC installation records 1

1. Using the sample of the fire barrier configurations identified '

during the plant walkdown, request the QC installation records for these barriers assemblies.

2. Verify that these records substantiate the construction of these barriers and confirm that the construction techniques used are consistent with the techniques specified by the installation specifications and procedures and the fire and ampacity derating test reports (e) QA audits of the installation process. Evaluate the scope of these audits, the problems identified, and the effectiveness of the corrective actions. i (f) Fire barrier installer training program

1. Review the installer training program and verify that the lesson plans properly instruct the application of the fire barrier construction attributes for the various fire barrier system 'l configurations identified by the installation specifications and procedures. !

2. Using the sample of the fire barrier configurations systems identified during the plant walkdown, determine from the l licensees records, which installers worked on the installation of 1 these fire barrier systems. Request the training records for l these installers and verify that they were properly trained prior i to working on in-plant fire barriers, i

2. Review fire barrier related exemptions and deviations for areas of the f plant which are designated as using redundant train safe shutdown. In B-5

- - - _ - - _ - _ - _ . _ . -._.- - _ - .- .- ...--- -.~.- -

1

't j DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997

) addition to determining whether there are any fire barrier features -

1 which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation - -

1 exists, assess for granted exemptions or deviations whether:

i' (a) The NRC reviewer correctly interpreted the licensee submitted infomation.

i (b) The licensee submitted infonnation was correct and complete. ;

1 j (c) The granted exemption / deviation was correctly implemented by the ;

licensee. !

l l 3. Inspection and walkdown of installed fire barrier systems. Review of j fire barrier surveillance procedures and records. !

! 4. Evaluation of the seismic analysis and calculations performed for fire l barrier systems (the weight of which may affect the seismic response of the equipment / components on which the fire barrier material is ,

l installed). j l 5. Evaluation of ampacity derating affects on any cables protected by i these fire barrier systems. Review plant related fire endurance and i ampacity derating qualification test reports to determine the l applicability of these test results to the plant specific fire barrier

designs.

/

} 6. Evaluation of plant specific engineering evaluations which were -

performed to justify in-plant fire barrier installation conditions that a

l vary from the tested configurations.

7. Fire Barrier Testing l

(a) Verify that the fire barrier qualification testing shows that the average temperature rise of the thermocouples on the outer surface of the raceway inside the test specimen (closest to the unexposed surface of the fire barrier material) was limited to l- 139 degrees C (250* F.) above the initial temperature

conditions, and that the maximum reading of any single

thermocouple was limited to 181 degrees C. (325

F.) above j ambient.

(b) If these values were exceeded during the testing, verify that the l licensee has an engineering evaluation showing that the specific

types and sizes of cables used in the plant would remain free of fire damage (as defined in GL 86-10) and would fully function at

~

rated voltage and current at the temperatures recorded during the

! qualification tests, i

B-6

1 l

DRAFT - FOR RIVER BEM STATION PIL0T INSPECTION JUNE 4, 1997 i

(c) Verify that, if cables were used in the test, that the cables -

were free of fire damage, regardless of what temperatures were recorded. ~

l (d) Verify that the fire barrier material did not exhibit any signs of burn-through during the test, regardless of what temperatures were recorded.

(e) Verify that the fire barrier material was not breached by the post-fire test hose stream test.

(f) Review the fire barrier system field installation instructions and compare them to the construction of the tested assembly.

Verify that the construction of the test specimen was the same as the barriers installed in the plant. Verify that the barrier .

thickness required for a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months rating, the weight per square foot of barrier material, the material properties of the stress skin (if used), and the material properties of fastening devices (banding, staples, wire ties, or bolts) used in the testing is the same as used in the plant. Verify that plant repair procedures require equivalent construction methods for sealing , opened raceways.

(g) Verify that the limited number of configurations tested bound the fire barriers installed in the plant. This includes the sizes of I

conduits and cable trays, the cable tray and conduit materials of construction (steel or aluminum), cable fill density, and the cable and cable jacket materials of construction.

(h) Review the plant procurement documentation to verify that the materials purchased and received at the plant were identical to ,

those used to construct the test specimens. Ensure that receipt !

inspections were performed. Verify that the materials were '

stored in accordance with the manufacturer's storage instructions ;

prior to installation. !

(1) Verify that appropriate QA & QC procedures were implemented and i properly appli ed to the installation of the fire barriers.

Verify the adequacy of the training given to installers and i inspectors of the materials. l (j) Visually observe the condition of the plant fire barrier systems.

Verify that the field installations comply with the tested i configurations and installation instructions. Verify that all ,

configurations that are outside of the test limits have been the '

subject of an engineering evaluation or exemption request. Review the engineering evaluations for technical adequacy and for ;

conformance in accordance with the criteria in GL 86-10.

B-7

l DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 (k) Review modified fire barriers / fire area walls. Assess the .

significance of:

1. Structural changes to the sup >orting elements of the barrier / degradation of the fire res'stive coating on structural members.

2. New penetrations in rated walls, floors or ceilings.

3. Additions, deletions or changes in the design of fire doors or fire dampers.

4. Removal of cable wrap material on cable trays carrying redundant electrical circuits.

8. Fire Barrier Surveillance. Verify that a surveillance program is implemented for the fire barrier system. Ensure that the inspection procedures confirm the continued operability of the barrier system by checking the physical attributes specified in the field installation instructions, as well as checking for any. potential damage. Verify that clear acceptance criteria are provided to decide if a barrier is inoperable. Determine if the time period that would elapse between the time a barrier is inspected and found inoperable and when compensatory i measures are implemented is acceptable. Verify the acceptability of the compensatory measures program.

(b) Type Specific Fire Barrier Inspection

1. Fire Doors (designed, installed and maintained in accordance with NFPA 80)

(a) Consider the effects of fire brigade hoses being passed through ,

fire doors. l 1

(b) Review the tested fire rating of the installed fire doors. l

2. Ventilation Dampers. Review licensee resolution of concerns specified in IN-89-52 " Potential Fire Damper Operational Problems." Verify that ,

fire dampers are tested under normal air flow conditions. Evaluate the i potential for smoke and heat migration through the openings before operation of the protectives, and the potential effects on redundant i equipment.

3. Cable / raceway Wraps. Verify that the added weight of the fire barrier system has been accounted for in the licensee's seismic analysis of the ;

protected raceways. ,

l

4. Coatings for structural steel (ensure the coating provides a fire resistance equivalent to the barrier rating).

B-8

l i

l DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997

5. Penetration Seals -

~

(a) Tour plant areas containing post-fire safe shutdown equipment or cables. Determine whether any seals are missing from locations where they appear to be needed to complete a fire barrier, and determine that seals appear to be properly installed and in good condition.

(b) Select at least three seals for detailed review based on:

1. Seal type and material (e.g., silicone foam, silicone elastomer, silicone gel, mineral wool / cement /Flammastic combinations, mechanical compression).

2. Seal location (e.g., whether the seal forms part of a significant j fire barrier which either forms a fire area boundary or i establishes separation between redundant post-fire safe shutdown components).

3. Historical repair or rework of the seal due to plant modifications.

(c) For the selected seals, determine whether they were designed, tested, installed, inspected (QA/QC) and maintained in accordance with licensee commitments, NRC fire protection requirements and guidance, and standard industry practice.

1. Examine procurement documentation for the penetration seal materials used and review the adequacy of the material for the application (e.g., pipe expansion or movement, radiation levels, flood potential).

2. Examine fire endurance tests and engineering evaluations associated with the seal qualification design (with special attention to the applicability of the tested seal configuration to *Se actual configuration of the selected seal in the reactor pla.t).

3. Review training programs for seal installers and inspectors.

4. Review QC/QA programs relating to installation and maintenance of penetration seals.

5. Review seal maintenance / repair / rework records.

6. Review surveillance program and fire protection program requirements for penetration seals.

B-9

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997

7. Partial and Full Height Fire Walls (between redundant -

components).

8. Miscellaneous / Unusual / Unique Fire Barriers (e.g., floor drains, electrical bus ducts, internal conduit seals, water curtains, etc.)

6. Reactor Coolant Pump 011 Collection Systems (a) Determina whether there are any RCP oil collection system features which would appear to require the granting of an exemption or deviation from the NRC staff.

(b) Review reactor coolant pump oil collection system related exemptions and deviations. Assess whether:

1. The NRC reviewer correctly interpreted the licensee submitted information.

2. The licensee submitted information was correct and complete.

3. The granted exemption / deviation was correctly implemented by the licensee. ,

i l

l

}

l B-10 i 1

l 6

1 DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 APPENDIX C -

~

POST-FIRE SAFE SHUTDOWN CAPABILITY INSPECTION REQUIREMENTS

1. Licensing and Design Bases

2. Fire Hazards Analysis

3. Safe Shutdown Analysis J

4. Post-fire Safe Shutdown Areas and Systems Selection .

l (a) Determine fire-risk significant areas of the plant to be evaluated by j the inspection team. A minimum of three areas should be selected that I contain components and/or cables associated with redundant trains of

the and which are not provided with an alternative or dedicated ,

, shutdown capability. Area selection criteria may include:

1. Plant areas for which the post-fire safe shutdown methodology may have been revised or replaced subsequent to the initial post-fire safe !

shutdown analysis.

2. The fire risk significance of the plant areas as indicated in the input ;

received from the team PRA analyst.

3. The number of manual actions required to achieve post-fire safe shutdown for the subject plant areas. It would not be expected that numerous manual actions would be required for post-fire safe shutdowns using redundant trains of normal shutdown equipment.

4. The existence of a exemptions relating to post-fire safe shutdown capability.

5. The existence of post-fire safe shutdown related 50.59 evaluations and/or equipment modifications for the subject plant areas (see Generic Letter 86-10).

6. Plant areas for which compensatory measures are repeatedly and frequently implemented for conduct of maintenance, surveillance or other operational reasons.

(b) Identify redundant safe shutdown trains of equipment. For the selected fire areas designated for redundant train safe shutdown capability, verify that the licensee has identified systems and equipment that are capable of performing each of the following reactor shutdown functions:

1. Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions (K < 0.99 and reactor coolant system (RCS)

+emperature less than or ,e,q,ual to 200* F).

C-1

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997

2. Reactor coolant system inventory (makeup) control capable of -

maintaining water level within the level indication of the pressurizer ~

(PWR) or above the top of active fuel (BWR) at all times during shutdown operation.

3. RCS Pressure control capable of providing over-pressure protection and ensuring RCS pressure-temperature limits are not exceeded

4. RCS decay heat removal

5. Process monitoring sufficient to control the above functions.

6. Supporting functions capable of providing process cooling, lubrication, ,

electrical power, essential HVAC, etc. required to permit operation of l the equipment used to achieve and maintain safe shutdown.

J (c) Alternative Post-fire Safe Shutdown Fire Area and Systems l Identification. For the selected fire areas designated as requiring i alternative and/or dedicated safe shutdown capability, verify that the l licensee has identified systems and equipment that are capable of i performing each of the following reactor shutdown functions:

1. Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions (K,,, < 0.99 and reactor coolant system (RCS) temperature less than or equal to 200* F). ,

i

2. Reactor coolant system inventory (makeup) control capable of !

maintaining water level within the level indication of the pressurizer (PWR) or above the top of active fuel (BWR) at all times during shutdown operation.

3. RCS Pressure control capable of providing over-pressure protection and ensuring RCS pressure-temperature limits are not exceeded

4. RCS decay heat removal

5. Process monitoring sufficient to control the above functions.

6. Supporting functions capable of providing process cooling, lubrication, electrical power, essential HVAC, etc. required to permit operation of the equipment used to achieve and maintain safe shutdown.

(d) Confirm the existing, as-installed, shutdown system configurations are as described in the plant's current licensing basis, as documented in the NRC staff's Safety Evaluatian Reports (SERs), the licensee's FSAR, and/or the licensee's Fire Hazard Analysis (FHA) and Safe Shutdown Analysis (SSA).

5. Alternative or Dedicated Shutdown Capability C-2

I l

1 l DRAFT - FOR RIVER BDS STATION PILOT INSPECTION JUNE 4, 1997 (a) Verify the adequacy of the alternative or dedicated shutdown - I methodology implemented in the event of fire requiring control room '

evacuation and achievement of safe shutdown conditions at remote shutdown panels and/or local control stations. Ensure this methodology l

, is capable of accomplishing post-fire safe shutdown conditions with or '

offsite power sources.

without the availability of the normal

(i.e.,where offsite power remains available and where offsite power may be lost as a result of fire damage).

(b) Verify the adequacy of abnormal / emergency operating procedures developed to implement the alternative or dedicated shutdown capability. Confirm that the SSA results and conclusions have been accurately reflected in the procedure (s). For plants that have adopted j the standard fire protection license condition (see Generic Letters 86-i 10 and 88-12), verify that changes made to the fire protection program under the provisions of 10 CFR 50.59 do not invalidate the shutdown methodology approved in the staff's SER, or institute a new, but potentially unsuccessful safe shutdown strategy / methodology.

' ]

(c) Conduct a step-by-step walk-through of operator actions with a )

knowledgeable plant operator. ;

(d) Assess analyses performed to demonstrate that operator actions can be j accomplished and shutdown system functions made operable in a timely '

manner (i.e., time-line studies). !

d (e) Evaluate the practicality of operator activities relied on to accomplish time critical shutdown functions from outside the main control room.

(f) Review alternative safe shutdown and emergency lighting related exemptions and deviations for areas of the plant which are designated as using alternative safe shutdown. In addition to determining whethe.r there are any alternative safe shutdown or emergency lighting characteristics which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists, assess for granted exemptions or deviations whether:

l. The NRC reviewer correctly interpreted the licensee submitted information.

1 2. The licensee submitted information was correct and complete.

3. The granted exemption / deviation was correctly implemented by the licensee.

]

(g) Verify that the minimum shift staffing level specified in the plant's Technical Specifications, exclusive of the fire brigade, is sufficient C-3 4

l

DRAFT - FOR RIVER SDS STATION PIL0T INSPECTION JUNE 4, 1997 to perform all activities specified in the alternative / dedicated -

)

I shutdown procedures for achieving and maintaining hot shutdown _

conditions. >

(h) Review operator training records for post-fire safe shutdown abnormal / emergency operating procedures.

l (1) Verify that ' repair activities are not required to accomplish hot- 1 shutdown / hot-standby conditions unless such actions were specifically '

reviewed and accepted by the staff in its SER and an exemption was granted by the NRC.

(j) Verify that no operator actions are required to be performed in the i fire affected area prior to fire extinguishment. l (k) Verify that adequate time, tools, materials, safety equipment (e.g.,

protective clothing) lighting and manpower will be available to perform repair activities that may be necessary to achieve cold shutdown conditions within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Confirm that any necessary replacement parts are dedicated to this activity and stored on site and that all repair activities are performed in accordance with approved procedures by personnel having appropriate knowledge and experience.

(1) Determine whether 'there are any features of the alternative safe shutdown process which would appear to require the granting of an '

exemption or deviation from the NRC staff, and for which no such exemption or deviation exists.

(m) Review maintenance records, relating to monitoring the ,

performance / effectiveness of remote post-fire safe shutdown panels and i control stations. Such records would be generated in accordance with '

a licensee Maintenance Rule Program meeting the requirements of 10 CFR -

50.65.

6. For normal (redundant train) and alternative / dedicated post-fire safe shutdown, evaluate operator activities (manual actions both inside and ;

outside the main control room) that are necessary to achieve safe shutdown j conditions in the event of fire in the selected area (s). This evaluation !

should consider such characteristics as:- !

1. Accessibility (a) The need to interface with plant security, health physics, control '

room operator or fire brigade personnel (b) The need for prestaged devices to provide access, operator safety or mechanical leverage (e.g., keys, ladders, protective clothing, procedures, special tools f

C-4

4 L

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 l

l (c) Required unual actions can be carried out without entry into the -

i fire affected area -

l 2. Habitability (a) Radiation j (c) Heat ;

i (d) Smoke j (e) Toxic gases

3. Normal and Emergency Lighting. If normal lighting at control stations or

! in plant areas -associated with manual actions is inadequate or can be j affected by the fire, emergency lighting is required for operators to j travel to and perform safe shutdown functions in these areas. Verify

that:

1 (a) Emergency lighting lamps are properly aimed to allow access, operation of safe shutdown equipment, performance of manual actions, ,

i and monitoring of safe shutdown indications;

! (b) Batteries, charge. rate indication (lamp or meter), and specific ;

j gravity indication is within specification; and '

4 ,

(c) Through review of manufacturer's information, that battery power l supplies are rated to at least an 8-hour capacity. ;

(d) Licensee maintenance and surveillance preventive maintenance / functionality check frequencies and procedures are as !

specified by the manufacturer.

(e) There are no emergency lighting characteristics which would appear to require the granting of an exemption or deviation from the NRC staff, and for which no such exemption or deviation exists.

Further, assess for exemptions or deviations which have already been granted whether:

(a) The NRC reviewer correctly interpreted the licensee submitted information.

(b) The licensee submitted information was correct and complete.

(c) The granted exemption / deviation was correctly implemented by the licensee.

4. Communications C-5

l DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 (a) Verify the availability, operability, and effectiveness of -

communication systews used during implementation of the alternative l or dedicated shutdown capability. This evaluation should consider- ~

l the following:

1. Electrical power requirements of the selected system, including the operability of the system during a loss of normal offsite power i 2. Physical and electrical independence of the designated system from l the fire area (s) of concern

3. If portable radios are used, determine if the licensee has l adequately identified areas of the plant where:

(a) Use of portable radios may be prohibited or restricted due to 1 the potential for radio interference with sensitive equipment; l or, (b) Use of portable radios may not be effective (i.e.,

transmission / reception ' dead spots"); or, (c) Availability of the portable radio communication system may be jeopardized due to the physical location of the radio repeater,'its power supply, the routing of connected power cables, and the potential effect of a loss of offsite power.

5. Timeliness (adequacy of manual action timeline)

6. Feasibility (of manual actions)

7. Procedural Adequacy (including cold shutdown repairs)

8. Operator familiarity with and training on safe shutdown actions.

9. Absence of Repairs to Achieve and Maintain Hot Shutdown

10. Cold Shutdown Repairs. For those plant areas where circuits or t.quipment are located which are needed to achieve and maintain cold shetdown, and the licensee's procedures call for reliance on repairs to achieve post-fire cold shutdown, verify the following:

(a) The licensee's analysis clearly identify which cold shutdown i equipment could be damaged in a postulated fire; (b) That the fire damage to control room or remote shutdown station cold i shutdown equipment can be repaired and the needed equipment made operable with<in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; C-6 4

j i

1

DRAFT - FOR RIVER BEls STATION PIL0T INSPECTION JUNE 4, 1997 (c) That the material required for cold shutdown equipment repair is '

i dedicated and available on-site. -

j .. i

[ 7. Shutdown Fire Safety. The inspector should review:

i l (a) The licensee's repair procedures, onsite resources, and timelines ;

i (relative to a reactor coolant saturation temperature condition) for !

shutdown or refueling plant conditions for postulated fires which could I

] damage both trains of decay heat removal capability.

]

! (b) The plant fire prevention administrative control procedures for l 1 transient combustibles and ignition sources for areas (and areas !

j adjacent to such areas) which contain both trains of decay heat removal !

! capability.

, i l 8. Electrical System Protection 1

(a) Power, Control and Instrumentation Cable Separation and Protection l i

i 1. Verify the licensee's Safe Shutdown Analysis (SSA) has adequately J

identified cables of required shutdown systems and equipment. Select !

a representative sample of components whose operation is required to i

accomplish the time critical shutdown functions. From a review of i

! electrical schematics depicting the as-built plant configuration, !

1 identify cables required for operation, control and/or monitoring of ,

this equipment and compare the results of this evaluation with the list l 1 of required cables listed or identified in the plant's SSA. It should I

be noted that this approach may also identify modifications made to the i j selected components since the original safe shutdown analysis was d

performed. If modifications were performed, verify they were i appropriately reviewed and incorporated into the component cable i i selection documentation of the SSA. l t

i 2. For the selected post-fire safe shutdown redundant equipment and 4

components with time critical shutdown functions, determine whether a

single fire could cause common cause failure of their redundant j shutdown system cables.

j (a) For each component, identify power, instrumentation and/or control cables to be evaluated in-depth, and request the licensee l to provide color-coded cable tray and conduit routing drawings

depicting the routing of the selected cables throughout the j plant.

1 (b) Determine the adequacy of fire separation between the selected !

i sets of redundant safe shutdown / required system and support system components, f C-7 )

i l I

DRAFT - FOR RIVER BEIS STATION PIL0T INSPECTION JUNE 4, 1997 1

l 3. Determine whether the licensee has conducted adecuate ampacity derating -

4 for safe shutdown related cables enclosed in fi re barrier protective .

wrap materials (e.g., age-related cable insulation degradation due to a

~

l trapped heat). The licensee engineering documentation and supporting l

i ampacity derating test results should bound the raceway configurations j protected by fire barriers.

4. For selected raceway fire barrier systems inspected during plant walkdown, review the licensee's cable ampacity derating calculations i and test documentation for adequacy, reasonableness and good

[

engineering practice.

I (a) Assumptions used in the calculations should be supported by

! actual test results.

1 i

(b) Ampacity derating calculations and test speciran design should address the actual arrangement, construction and installation

practices, size, material properties, procurement practices, and

! current loadings of the selected plant-specific barrier and cable

! configurations. For safety-related cable applications, the

associated ampacity tats should conform to the requirements of f 10 CFR Appendix 8 including adequate disposition of test ,

anomalies and material non-conformance.

i

(c) Determine if unique fire barrier / cable arrangement configurations

! are bounded by either ampacity derating test documentation or )

! ' plant specific engineering evaluations. l t

! (b) Review the licensee's response to GL 92-08, "Thermo-Lag 330-1 Fire i Barriers." Verify that the licensee has completed or is in the process ;

! of completing all commitments made with regard to potential ampacity '

! derating due to heating of enclosed / wrapped electrical cable. Review I any studies done by the licensee on this subject for adequacy, j_ reasonableness and good engineering practice.

(c) Alternative / dedicated Safe Shutdown Panel Electrical Independence and I Isolation.

1. Review the availability and adequacy of electrical isolation schemes .

(e.g., isolation / transfer switches) used to isolate circuits of ;

required shutdown equipment from the fire affected area (s) during implementation of the alternative shutdown capability.

2. Verify that a suitable isolation capability has been provided and the transfer switch design scheme incorporates a redundant fusing capability, where necessary, to preclude the need for replacement of control power fuses following transfer.

C-8

] DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997

, 3. Verify the availability and adequacy of fuse replacement control -

j procedures. Select a minimum of three fuse panels for, in-plant, field validation to ensure that the "as-installed" fuses are as specified in design drawings and the licensee's coordination study.

(d) Associated Circuits of Concern

1. Verify the adequacy of electrical protective / isolation measures e

provided for non-essential associated circuits which share a common source of electrical power (MCC, Switchgear, Fuse Panel etc.) with circuits of required shutdown equipment, as defined in NRC Generic J

Letters 81-12 and 86-10. Note that suitable protection may be provided by conformance to established redundant train separation criteria

. (Section III.G.2 of Appendix R) or coordination studies, or a

, combination of both (e.g., providing partial length barriers for cables

to limit the potential fault current to within acceptable limits necessary to obtain coordination). This evaluation should consider the i

occurrence of multiple high impedance faults for all associated circuits located in the fire area of concern.

2. Verify the adequacy of electrical fault protection provided for non-essential circuits which share a common enclosure (raceway, cable tray, conduit, distribution panel, etc.) with cables of required shutdown components, as defined in NRC Generic Letters 81-12 and 86-10. A minimum of three enclosures which contain a mix of non-essential circuits and circuits of equipment required for post-fire safe shutdown should be selected for an in-depth breaker / fuse coordination review.

Where circuit breaker and fuse coordination (selectivity) studies are ..

credited, verify that suitable maintenance and surveillance test l

procedures are available to ensure circuit-breaker and relay I coordination is maintained, and verify that performance of the ;

protection devices is routinely verified. Select a minimum of three i electrical protection devices and field verify their trip settings are as specified in the plant's design drawings and coordination study.

3. Verify the adequacy of the protection provided for circuits of equipment whose fire-induced spurious operation could adversely affect the plant's ability to achieve and maintain hot shutdown / hot standby conditions. This evaluation should consider:

(a) The validity of assumptions used in the performance of the analyses and suitability of evaluation methods.

(b) Whether the spurious signal analysis addresses all components whose spurious o)eration or saloperation could adversely affect the plant's ability to achieve and maintain hot shutdown / hot standby conditions. The evaluation should address:

C-9

- ~. _._ _.__ _.____ __ _ _.

f DRAFT - FOR RIVER BEls STATION PIL0T INSPECTION JUNE 4, 1997 l 1. Components whose spurious actuation would have a direct affect on -

l the operability of required (credited) shutdown systems, and ,

2. Components whose spurious actuation would cause non-essential systems. to spuriously actuate in a way that could affect the plant's shutdown capability. (Examples of this type of spurious actuations include: the potential for reactor overfill due to spurious injection of safety injection or feedwater systems; the ,

potential for uncontrolled reduction in reactor coolant system !

pressure. 1 (c) The adequacy of the licensee's analysis and method of protection l provided for valves which form a high/ low pressure interface. l Note that simultaneous spurious actuation of redundant (in this context, series) high/ low pressure interface valves should have been assumed in the licensee's analysis as discussed in Generic Letter 86-10.

(d) Potential for loss of alternative shutdown capability during a control room fire due to hot shorts, open circuits and shorts to !

ground leading to single or multiple, simultaneous mechanical (irreversible) failures or other types of equipment or valve positioning problems.

(e) Verify the licensae has considered the potential for inaccurate instrument indications and/or spurious equipment actuations that may occur as a result of an instrument sensing line being exposed to a fire and increased temperatures.

9. Post-fire Safe Shutdown Capability Implementation (a) Methods of Redundant Train and Alternative / Dedicated Safe Shutdown Implementation

1. Redundant Train Walk-through Simulation.

2. Alternative / dedicated Walk-through Simulation. Observe walk-through simulations of alternative / dedicated shutdowns for one or more fire areas. Specific items to observe during the simulation include:

(a) The appropriateness and feasibility of operator actions (b) Operator knowledge and training as demonstrated by their performance and responses to questions posed by the inspection team (c) The availability and effectiveness of communications C-10

(

l DRAFT - FOR RIVER BDW STATION PIL0T INSPECTION JUNE 4, 1997 ,

(d) The availability and effectiveness of emergency lighting (refer -

i

!. to IP 64100, Section 02.03 for inspection requirements). .

- )

l- (e) Observed areas of strength and weakness in licensee's consideration of human factors, including the potential for operator errors of commiission and omission.

(f) Access and habitability of local control and monitoring stations i

(g) Effort necessary to perform required shutdown activities (h) Availability and dispersal of necessary tools, radios, i' flashlights, or other shutdown related equipment, and the administrative controls established to ensure these items will be

available when needed, are periodically inventorted, maintained, and checked for proper function.

(b) Electrical Loads Management

1. Station Blackout (SBO). Prior to and during a post-fire safe shutdown

. walk-through simulation at a reactor plant that conducts full or partial station blackout procedures, the inspector should consider: !

4 (a) The A.C. power drop and plant component realignment timeline logic, assumptions and bases, including control room abandonment and offsite power drop decision criteria and time requirements.

(b) The ability of plant operators to monitor and control plant j parameters before, during and after S80 control room evacuation / abandonment.

(c) The ability of plant operators to monitor and control / align plant I components after SB0 control room abandonment.

(d) The practicality and reliability of EDG start and load (and !

restart, if applicable) under post-fire safe shutdown /SB0 l conditions. l (c) Human Factors and Muning (d) Control System Interactions / Control Location Transfers i

END 4

C-Il l

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 APPENDIX D -

^

FIRE PROTECTION AND POST-FIRE SAFE SHUTDOWN MANAGEMENT PROCESS INSPECTION REQUIREMENTS

1. Quality Assurance / Quality Control Audits j 2. Surveillance Testing and Maintenance Program i

l 3. Operability Assessments and Compensatory Measures. Evaluate the

effectiveness of plant administrative controls and procedures established to reduce fire risk to plant safety when portions of one train of shutdown

, equipment are out of service or inoperable.

I END i

i D-I

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 APPENDIX E -

FIRE PROTECTION AND POST-FIRE SAFE SHUTDOWN CONFIGURATION CONTROL INSPECTION REQUIRENENTS

1. 50.59 Process

2. Design Reviews and Modification Packages (a) Modifications i

1. Evaluate the impact of selected post-fire safe shutdown configuration modifications performed since the plant's fire protection program was originally reviewed and approved by the NRC staff and inspected under IP 64100. Ensure that fire protection and post-fire safe shutdown configurations have been maintained.

For plants that have adopted the standard fire protection license condition (see GL 86-10 and GL 88-12), verify that changes made to the fire protection program under the provisions of 10 CFR 50.59 do not adversely affect the level of separation and protection provided for redundant trains of shutdown equipment, invalidate the shutdown methodology approved in the staff's Fire Protection SER, or institute a new, but potentially unsuccessful safe shutdown strategy / methodology.

The inspector should specifically verify that:

(a) Changes in the plant's mechanical and electrical design were appropriately evaluated for their potential impact on plant fire safety by qualified personnel, knowledgeable in the reactor plant's safe shutdown analysis, (b) The modifications do not compromise the plant's ability to achieve and maintain safe shutdown conditions, (c) The installed mechanical and electrical configuration corresponds to the modification design requirements and is in agreement with the facility documents, and (d) Appropriate physical separation and/or electrical isolation has been maintained between redundant divisions of equipment and cables required for post-fire safe shutdown.

2. Examples of fire protection configuration management program implementation lines of inquiry include:

(a) New fire area boundaries or fire barrier penetrations.

]

E-1

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 (b) Changes to emergency lighting. -

(c) Changes in access for manual fire fighting.

(d) Changes in automatic fire suppression systems (e.g., changes from

wet pipe to dry pipe sprinkler system design).

3. Verify that temporary modifications are tracked, controlled, and reviewed for their potential impact on fire safety and post-fire safe shutdown capability by qualified operations, engineering, and fire 4

protection personnel knowledgeable in the plant's safe shutdown and j fire hazards analyses. Temporary modifications frequently involve the 4 use of electrical jumpers in indication and control cabinets, and are typically tracked in control room log books. The inspector should consider whether:

)

(a) Potential fire hazards were or are being created due to the presence of electrical jumpers.

! (b) The temporary modifications existed for the minimum duration practical.

(c) The temporary modifications potentially disabled the reactor plant's safe shutdown capability.

3. Review Committee Actions

4. FSAR Updates END E-2

i DRAFT - FOR RIVER BElm STATION PIL0T INSPECTION JUNE 4, 1957

APPENDIX F -

i

~

POTENTIAL FIRE RELATED VULNERABILITIES INSPECTION REQUIREMENTS

1. Event Based Fires

! (a) Consider which plant events could cause a fire. Review plant specific d

Licensee Event Reports (LERs) and the FSAR Chapter 15 accident analysis and the PRA/IPE/IPEEE to determine accident scenarios or sequences which could result in a fire. Specifically consider:

1. Turbine Generator Failure Events (a) Review- the licensee's turbine generator inspection and maintenance program, focusing on operability history and problems associated with the design, and the techniques used by industry to monitor, inspect and resolve keyway SCC problems in turbine generator high pressure (HP) and-low pressure (LP) rotors of either the shrunk-on (keyway) or monoblock (no keyway) wheel design; i

(b) Review and inspect the turbine generator lube oil system design !

(e.g., system logic, piping configuration, lube oil piping / bearing configuration);

(c) Review and inspect the hydrogen system and "; ability to be l promptly isolated in the event of a fire. The system was also '

reviewed to determine if an excess flow check valve was incorporated in the turbine hydrogen gas cooling system design; (d) Review the licensee's methods for coping with a lube oil fire in the lower levels of the turbine building. Included review of the availability of the licensee's fire brigade equipment and foam i capability, methods of fire attack, methods of smoke venting, '

implementation of off site assistance, and the potential impact a turbine fire event may have on safety related/ safe shutdown equipment.

(e) Review and inspect the licensee's fire protection program and features provided for turbine building and specific turbine related fire hazards.

(f) Evaluate the following: 1) fire protection provided for the turbine bearings, 2) fire protection features provided for the turbine lube oil system, 3) distribution of manual fire hose stations, 4) manual fire fighting foam capabilities and access and egress to turbine building areas, 5) communications available for fire fighting operations, 6) distribution and logic of the '

turbine fire / smoke detection system, 7) smoke venting capabilities, 8) fire protection features provided for the F-1 1

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 turbine generator hydrogen system, and 9) fire protection l features provided for cable trays in the areas of significant turbine building fire hazards. '

(g) Evaluate the potential for the postulated worst case fire in the i turbine building to impact safety related plant areas and '

equipment was evaluated. This evaluation should focused on ,

determining; '

1. Whether fire suppression activities could cause flooding and the potential affects flooding may have on safety related/ safe shutdown systems,

2. The potential for smoke migration into safety related areas, i

3. The direct and indirect affect the postulated fire may have on any safety related system located in the turbine building.

2. Emergency Diesel Generator (EDG) failure events (a) Mechanical failure of an operating emergency diesel generator is postulated. Consider:

1. Whether the fire separation between the diesel generators and its associated circuits and support systems adequate to provide !

reasonable assurance that tie redundant train is free of fire damage,

2. The licensee's smoke control measures and determine if they are adequate to preclude the smoke from entering the engine air intake or the redundant diesel engine,

3. The adequacy of the diesel generator compartment to confine a combustible liquid type fire, and

4. The adequacy of the automatic fire suppression system provided and determine its ability to control the fire and mitigate its consequences.

(b) Consider this failure concurrent with a loss of offsite power and/or a seismic event (a seismic event may have a severe impact on the operability on the fire detection system and the fire water system).

3. Recirculation pump MG set failure events. Evaluate:

(a) The fire separation between the MG sets and the remaining areas of the plant, F-2

I DRAFT - FOR RIVER BEND STATION FIL0T INSPECTION JUNE 4, 1997 (b) The licensee's smoke control measures and determine if they are -

adequate to preclude the smoke from entering adjacent safety related areas of the plant, ~

(c) The adequacy of the area around the MG set to confine a combustible liquid type fire, and (d) The adequacy of the automatic fire suppres'sion system provided and determine its ability to control the fire and mitigate its consequences.

4. Control Rod Drive MG Set Failure Events

5. Improper Electrical Grounding. Determine the nature and extent of the licensee's review of and possible actions in response to Information l Notice 97-01 on improper electrical grounding which may cause simultaneous fires.

6. High Energy Steam Line Breaks (b) Determine what plant equipment or systems are needed to suppress or control the effects of the postulated fire event. Review the cable ,

routing and component locations for this equipment and determine l whether the fire 'could prevent fire suppression or fire effects control.

2. Fire-Induced Plant Transients (a) Consider which plant fire events could cause a plant transient. Review plant specific Licensee Event Reports (LERs) the FSAR Chapter 15, Accident Analysis, emergency operating procedures (EOPs), and PRA/IPE/IPEEE to determine if any of the accident / transient scenarios or sequences discussed therein could be caused by a fire. Specifically !

consider: J

1. Intersystem LOCA and LOCAs (a) Evaluate the potential for fire initiated spurious actuation at high-low pressure interfaces that could cause an uncontrolled loss of reactor coolant inventory (e.g., spurious actuation of primary coolant interfaces such as at the reactor head vents, normal and excess letdown (PWR), pressurizer' PORVs (PWR),

Residual Heat Removal (PWR), and Shutdown Cooling System (BWR)).

1 (b) Evaluate the methods of protection provided by the licensee to l prevent fire induced spurious signals from initiating an !

uncontrolled loss of coolant (e.g., controlled by procedure or l administrative 1y) )

F-3 i

1 DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 l l'

2. Station Blackout .

(a) Determine in which areas of the plant a fire can cause a Station ~

l Blackout (loss of all AC).

(b) From the station blackout procedures determine the licensee coping strategies and what equipment it would rely on and determine if any of these components or their electrical circuits are routed through the fire areas of concern.

3. Rapid cooldown (a) Evaluate the licensee's E0Ps that give guidance when responding );

to a fire induced failure of an automatic turbine trip signal without a demand for a reactor trip. Determine the plant locations where a fire may cause this type of transient.

(b) Consider whether a fire could cause a transient which overfeeds either the reactor or the steam generators.

(c) Evaluate the vulnerability of primary steam reliefs to fire-induced failure in the open position.

4. Significant loss or inadvertent actuation of safety functions (a) Evaluate the layout and cable routings for safety related systems and their support systems to determine if there are any plant areas where a fire could cause for example, spurious actuation of safety injection and/or containment isolation actuation and make an operational assessment of the impact it may have on reactor safety.

(b) Evaluate the layout and cable routings for safety related systems and their support systems to detennine if there are any plant areas where a fire could cause a common mode failure of a significant portion of those systems needed to mitigate the consequence of certain plant accidents.

(b) Evaluate the defense-in-depth diversity and survivability fire mitigation features for the transient related fire area.

(c) Consider the effects of heat, smoke, hot gases, products of combustion, and fire extinguishing agents on the operability of components and equipment needed to control the plant transient.

3. Seismic / Fire Interactions (a) Review the potential for seismic events to cause fires (e.g., through gas or flammable liquid line or tank ruptures, or electrical equipment F-4

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 l

derangement, or water impingement, leakage or runoff onto electrical -

equipment). ,

(b) Review the potential for seismic damage to or inadvertent actuation of suppression systems which could cause damage to other plant equipment or create personnel hazards.

1 (c) Review potential for seismic events to cause loss of personnel access I

(e.g. through stairway collapse, jammed doors, dislodged gratings, or ;

, release of water, flammable or combustible liquids or gases, or large j quantities of carbon dioxide) and thereby reduce manual fire fighting capability.

(d) Consider the potential for seismic events to damage the reactor plant's fire pumps, fire mains and hose stations, and fire brigade

, communication equipment or supporting power sources. Consider the

reliability of the backup or offsite water supply following a seismic event.

4 (e) Consider the potential for seismic events to cause direct damage to redundant equipment, cabling or electrical switchgear. Consider whether non-safety related equipment could fall during a seismic event and damage safety related equipment 1

(f) Consider the potential for seismic events to damage fire area boundaries or other fire barriers.

(g) Consider the potential for seismic events to reduce suppression and detection system capabilities. l (h) Consider the effects of flooding or other equipment damage that may be cau:ed by inadvertent actuation of fire suppression systems.

4. Fire Induced Release of Radioactive Materials.

END F-5

i 4

DRAFT - FOR RIVER BEle STATION PILOT INSPECTION JUNE 4, 1997 4

APPENDIX G .-

l TEAN MAKEUP AND QUALIFICATIONS .,

n j The NRR team leader and regional representative shall be NRC employees. The PRA analyst, reactor systems / mechanical systems engineer, electrical engineer and fire protectinn engineer may be either NRC employees or NRR contractor personnel.

l TEAM LEADER (TL). The NRR team leader will manage team member activities and j interface with NRC and licensee management. The inspector's qualifications

should include

l i e Fire protection engineering degree, or equivalent experience !

i

Inspection Team Leader certification !

l

PRA familiarity (through formal training). j l

l PRA ANALYST (PRA). The PRA analyst will participate almost exclusively during the preparation phase of the inspection. He will conduct the PRA analysis methodology (see Appendix C for PRA technical guidance). The analyst's qualifications should include:

PRA expertise through education and experience I

Familiarity with nuclear reactor design and operations

Familiarity with U.S. regulatory / licensing process.

REACTOR SYSTEMS / MECHANICAL SYSTEMS ENGINEER (SE). The reactor systems / mechanical systems engineer will assess the capability of reactor and balance of plant systems, equipment, operating personnel, and procedures to achieve post-fire safe shutdown and minimize the release of radioactivity to the environment in the event of fire. The inspector's qualifications should include:

Knowledgeable in integrated plant operations, maintenance, testing, surveillance and quality assurance..

Knowledgeable in reactor normal and off normal operating procedures 1

Knowledgeable in BWR r.nd/or PWR (as applicable) nuclear and balance of plant ;

systems design i

= PRA familiarity (through formal training). j I

ELECTRICAL ENGINEER (EQ. The electrical engineer will identify electrical separation requirements, for power, control and indication cables (and, in conjunction with the inspection team fire peotection engineer, will review the adequacy of the fire protection features provi11ng that separation), will review l alternate and dedicated shutdown panel electrical isolation and electrical independence from fire areas of concern, and review associated non-safety i circuits of concern (including spurious signals, common enclosures, and fuse- !

breaker coordination). The EE verifies that the licensee has adequately demonstrated that fire-induced circuit faults (hot shorts, shorts to ground, open .

circuits) will not prevent safe shutdown operation. He also verifies circuit l G-1 ;

l

f DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 breaker coordination and fuse protection has been analyzed and provided, as -

necessary. The inspector's qualifications should include: ,

Reactor plant electrical /I&C design

PRA familiarity (through formal training)

Familiarity with industry ampacity derating standards.

FIRE PROTECTION ENGINEER (FPE). The fire protection engineer will review of fire protection features and procedures. The Fire Protection Engineer (FPE) assists other FPFI team members in determining the effectiveness of the plant fire

! barriers and systems which establish the post-fire safe shutdown configuration.

l He will determine whether suitable fire protection features (suppression,

separation distance, barriers, wrap, etc.) are provided for redundant trains of cables required to ensure plant safety and accomplish safe shutdown conditions.

The inspector's qualifications should include:

Fire protection engineering degree, or equivalent experience j

Knowledgeable in reactor plant fire protection.

' REGIONAL INSPECTOR (RGI). The regional inspector will review surveillance, testing, maintenance and repair activities and procedures, the application of 4

fire protection administrative controls, fire protection related QA/QC activities, and the practicality of fire event related procedures. The inspector's qualifications should include:

4 Standard regional inspector qualifications

,

Familiarity with reactor plant and B0P system design and operating procedures

Familiarity with licensee design change processes and procedures

PRA familiarity (through formal training)

Familiarity with licensee fire protection programs, NRC fire protection inspection procedures and their use, and NRC fire protection regulations and licensing guidance

Familiarity with licensee personnel and onsite organization (desirable).

END G-2

0 i

i l DRAFT - FOR RIVER BDB STATION PIL0T INSPECTION JUNE 4, 1997 i

j. APPENDIX H .

! TEAM INSPECTION CONDUCT PROCESS l [ Note: Specific topics addressed in this procedure may be conducted on an l individual (non-team) basis. If so, some of the information in this Appendix may

{ not apply.)

4 Plant Selection and Insoection Announcement. Selection of the pilot reactor i plants and the four to eight reactor plants to be -inspected per year will be I conducted by SPL8/NRR in coordination with the four regional offices. The i inspection should be announced to the licensee in writing between three and six

months before the inspection start date. The NRR Licensing Project Manager i should also be informed at this time.

1 Assianment of Team Members. Assignment of team members will be conducted by NRR l (in consultation with the cognizant regional office) at least three months before i the scheduled inspection. The team leader will ensure all selected team members i have taken within the last nine months, or shortly will have taken the NRC's j initial or refresher site access training course.

1

[ Initial Insoection Plan Outline. Approximately three months before the

! inspection start date, the inspection team leader will develop an initial j inspection plan outline and provide it to each team member and the respective i regional office.

F Headauarters Announcement Letter to the Licensee. Approximately three months

before the inspection start date, the inspection team leader will draft and issue i (through the appropriate NRR reactor projects division, an inspection i announcement letter to the licensee. This letter will discuss the scope of the i inspection, request an information gathering visit to the licensee reactor i site / engineering offices, discuss onsite document and licensee personnel availability needs during the two weeks of onsite inspection, and discuss a pre-

! inspection conference call to discuss administrative matters (see below). A copy

of the FPFI inspection procedure will be included in this letter.

! Information Gatherina Visit to Reactor Site and/or Licensee Coroorate !

l Headauarters and/or Enaineerina Offices. Approximately two and one half months i

[ before the inspection, the inspection team leader and selected team members will

! participate in a two day long information gathering visit to the reactor site

! and/or the licensee's corporate headquarters / engineering offices. The j information will be sent to the applicable team members. The ir4 formation gathered will support the " General Team Member Preparation" topical areas i described below.

During this site visit the team leader make a request that the licensee prepare ,

. a brief presentation for delivery during the first' onsite week entrance meeting l

addressing

! H-1 l

l J

_ . . . _ _ _ _ _ _ _ . _ . _ . _ _ _ . ~ _ . _ . _ . _ _ _ _ _ _ _ _ _ _ _ . . _ _ . _ _ _ _ . _

h l DRAFT - FOR RIVER BElO STATION PIL0T INSPECTION JUNE 4, 1997 l

I -

Licensee organization, responsibilities and authorities (including managerial -

i points of contact for specific topical areas)

!

Major or unique fire hazards as identified in the FHA ~

Post-fire safe shutdown analysis ' methodology and logic, and an outline of post-fire safe shutdown procedures and operator locations and f responsibilities

!

Specific unique regulatory commitments in the areas of fire protection or

post-fire safe shutdown Licensee procedures for control of modifications and procedure changes j

A listing of recent licensee fire protection / post-fire safe shutdown self-

! assessments, and the salient results of these self-assessments.

1

! pRA Process. At least two and one half months before the inspection start date, j the team leader will direct the PRA analyst to conduct the PRA process (Appendix C).

I i General Team Member Prenaration/Develonment of Individual Insoection Plan Inouts.

1 General topical areas requiring team member review are: the power plant's design,

! layout, and equipment configuration; the current licensing basis (i.e., fire

! protection regulatory framework); and the licensee's strategy / methodology for

! accomplishing post-fire safe shutdown conditions. Additionally, prior. to the

site visit (and using any modification packages obtained during the information

gathering visit), the team members should become knowledgeable of plant design 3

changes or modifications implemented since the plant's post-fire safe shutdown j capability was originally reviewed and approved by the staff.

! The team members should determine the plant's current post-fire safe shutdown

licensing basis through review of the staff's safety evaluation report (SER) on fire protection, the plant's operating license, Updated Final Safety Analysis Report (USAR), approved exemptions / deviations, and inspection reports and enforcement actions issued by the NRC.

The team members should also, before the inspection, examine the plant's methodology for accomplishing post-fire safe shutdown conditions. This will be accomplished through a review of plant specific documents, calculations, and analyses including the Updated Final Safety Analysis Report (USAR), the latest version of the Fire Hazard Analysis (FHA), the latest version of the Post-fire Safe Shutdown Analysis (SSA), fire protection / post-fire safe shutdown related 10 CFR 50.59 reviews, plant P& ids, and emergency / abnormal operating procedures.

This effort will determine:

The licensse's methodology for achieving safe shutdown conditions in the event of fire in any area of the plant,

The systems credited by the licensee (as surviving the fire and therefore available) for accomplishing required shutdown functions (e.g., reactivity control, reactor coolant make-up, decay heat removal),

The support system requirements of each shutdown system, and H-2 I

j

4 i

DRAFT - FOR RIVER BEls STATION PILOT INSPECTION JUNE 4, 1997 l

The licensee's approach for identifying and resolving associated circuits of -

! concern. This electrical review should consider the validity of assumptions j and boundary conditions used in the performance of the analyses. -

~

Further, the team members should select a minimum of three fire protection / post-

fire safe shutdown modification packages implemented since the plant's initial i fire protection' validation inspection (IP 64100) for detailed review during the

site visit.

t And -lastly, the team members should assess the historical' record of plant-specific fire protection issues through. review of plant specific documents

! including: previous NRC Inspection Reports, the results of internal audits i performed by the plant (e'.g., self assessment including triennial inspections, j Quality Assurance audits), Licensee Event Reports (LERs) submitted in accordance

! with 10 CFR 50.73, and Event Notifications submitted in accordance with 10 CFR 50.72.

The team members will develop individual inspection plan inputs.

Team Develooment of a Final Insoection Plan. Upon completion of the PRA analysis and receipt of the team member inspection plan inputs (approximately one month before the inspection start date), the team leader will organize a two day team meeting at NRC Headquarters or in the regional office to finalize the inspection plan.

The PRA analyst will present his analysis results. The regional inspector will discuss the fire protection regulatory history of the subject reactor plant / site, the licensee's engineering organization (and its working relationship to the operating organization), the engineering organization's administrative procedures, types of engineering and operational documents used by the licensee, past fire protection inspection history, and a short synopsis of the fire protection licensing basis of the reactor plant.

Pre-insoection Conference Call with Licensee Staff. Upon completion of the in- I office preparation team meeting, and in conjunction with the regional inspector J and resident inspector, the team leader will conduct a conference call with the ;

licensee staff discussing: l

Inspection scope and schedule of onsite activities

Number of team members and preferred office s) ace location

Documents to be made available in the team off' ce space during the inspection (including licensee staff organization charts and phone lists, station one-line and three-line wiring diagrams, selected P& ids, significant design change packages, Fire Hazards Analysis, Post-fire Safe Shutdown Analysis,10 CFR 50.59 evaluations, GL 86-10 evaluations, etc.)

Advance arrangements for reactor site access, including radiation protection i training, security, safety and fitness for duty requirements. I l

H-3 ;

i

- - - < - -r r- . , - --

l i DRAFT - FOR RIVER BEls STATION PILOT INSPECTION JUNE 4, 1997 The availability of knowledgeable operating and engineering organization .

personnel to be available as technical points of contact / escorts during the inspection s

. Arrangements for a fire event walk-through simulation or a drill. The team leader and plant representatives should discuss issues such as the selection of a fire scenario, the type of shutdown to be conducted (redundant train, ;

alternative or dedicated), the facilities to be used (e.g., actual reactor '

plant, onsite simulator), the availability of qualified off-watch personnel, and the stationing of observers. Typically the scenario of the walk-through simulation or drill will be unannounced to plant personnel.

Site Access Letter. Approximately one month before the first onsite period the

, team leader will issue a site access request memorandum to the Administrative

Management ~ Branch of the regional office's Division of Resource Management and

! Administration. The letter will specify which team members will require escorted access within the reactor plant protected area (typically technical specialist j contractor personnel).

Entrance Meetina/First Week of Inspection / Debrief. The first week of inspection i will begin with an entrance meeting with licensee representatives, an plant l layout / equipment location familiarization tour, and up to four hours of plant-specific site access training for some or all team members, as needed to gain unescorted plant access. During the entrance meeting the team members will be introduced to the licensee staff / technical counterparts, and the team will describe the scope of the inspection (including systems and scenarios selected for special emphasis , the expected working hour)s, pre planned planned plant schedule of inspector

/ system walkdowns, andactivities (including exit meetings),

and plant locations expected to be visited.

A possible division of activities between the first and second week of inspection could have the following structure: 1 First Week: Fire Protection Program Administration

! Fire Protection Systems and Features l Post-fire Safe Shutdown Capability Fire Protection Program Management Processes Second Week: Follow-up Inspection from First Week Post-fire Safe Shutdown Capability Implementation (walk-through simulations) !

Detailed Review of Fire Protection Feature and Post-fire Safe !

. Shutdown Modification Packages (configuration management)

Potential Fire Related Vulnerabilities During both the first and second weeks of inspection the team leader should keep regional management informed of any. potential operability concerns which are developed by the team. Normally a short debrief will be held with licensee representatives at the end of the first of two onsite inspection weeks (if it is decided to end the inspection after one week, the team will conduct a formal exit ,

1

H-4

i l

DRAFT - FOR RIVER BElm STATION PILOT INSPECTION JUNE 4, 1997 meeting). During this meeting the licensee will be briefed on the team's most -

! important current issues and findings. The licensee should be reminded that the findings are preliminary until reviewed by NRC management and the inspection ~

report is issued. The licensee should be briefed regarding team information needs for the second week of inspection. The team leader will notify regional managers regarding any items which appear to require immediate followup.

In-office Review Week. During an offsite week of in-office review, the team members will assess the first weeks results and prepare revised lines of inquiry for the second onsite week of inspection. These lines of inquiry will include the in-depth inspection elements for the primary objactives listed in Section 01 of this procedure. and reactive inspection of issues arising during the first week of inspection.

Second Week of Insoection/ Exit Meetina. During the second week the team will come to final conclusions regarding the capability of the licensee / reactor plant to safely cope with fire events and associated reactor transients. Regional managers should be notified regarding any items which appear to recuire immediate followup. An exit meeting will be held with licensee representat< ves at the end of the second onsite inspection week. However, as with all exit meetings, the licensee should be reminded that the findings are preliminary until reviewed by NRC management and the inspection report is issued.

Insnection Report Develooment. The inspection report will be developed over a two to three week period following the final exit meeting, and will nomally be issued by SPLB/NRR. within 6 weeks of the exit meeting. . The report should document what was reviewed, noted licensee strengths and weaknesses, the safety significance of any deficiencies, and the regulatory / licensing basis of the findings. The report should include conclusions drawn, references and a list of person's contacted. For each finding, the report should identify each finding, describe the finding, related technical and regulat'ory requirements, safety significance and related references.

Insoection Followuo. Inspection followup responsibilities will be assigned by FPES/SPLB on a case-by-case, issue-by-issue basis. Inspection followup activities will generally be conducted by the regional offices with support from the Fire Protection Engineering Section (FPES) of NRR, as required. Any unresolved findings identified during the inspection will be tracked by FPES/SPLB. Contractor personnel can be used to participate in the followup. A conference call involving regional management should be held by the team leader within one week following the exit meeting to identify followup items.

END H-5 1

i I

DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 APPENDIX I -

FPFI PRA PROCESS TECHNICAL GUIDANCE -

NRR will develop and provide PRA process guidance based on experience gained in providing PRA' support to the pilot FPFI inspections.

END l

1 I

I-l

I DRAFT - FOR RIVER BDS STATION PIL0T INSPECTION JUNE 4, 1997 t i

APPENDIX J .

l l FIRE PROTECTION REGULATORY BACKGROUND INFORMATION

! This information will aid the inspector in developing an understanding of how l current regulatory requirements and staff guidance have evolved to form the fire 4 l protection licensing basis of the specific plant to be inspected.

l General Design Criterion 3 (GDC 3) of Appendix A to 10 CFR 50 requires that j

! structures,- systems, and components important to safety be designed and located l

! to minimize the probability and adverse effects of fires and explosions, that )

t noncombustibio and heat resistant material be used wherever practical, and that fire detectio9 :nd suppression systems be provided to minimize the effect of fire !

on structures, systems, and components important to safety. In the early 1970's

evaluations of compliance to GDC 3 were typically deemed adequate if the plant j

! complied with National Fire Protection Association (NFPA) standards and I recommendations of the Nuclear Energy Property Insurance Association (NEPIA).

At that time, fire safety features provided for commercial nuclear power stations I were very similar to those employed by conventional, fossil-fueled, electric l generating stations.

! Fire protection continued to be evaluated on this basis until a major fire i occurred at the Browns Ferry plant on March 22, 1975. The fire occurred when i workers, using a candle to test for air movement, accidentally ignited ;

polyurethane foam material they had installed to plug air leaks in a wall l separating the cable spreading room from the reactor building. The fire spread 1 to a large bank of cable trr.ys in the reactor building. Due to the type and j quantity of combustibles involved (a large number of PVC insu17ted cables), the !

j location of the fire (cable trays near the ceiling of a room with a high j j ce 'ing), and operator reluctance to use water to extinguish fires involving e electrical equipment, the fire continued to burn for several hours before it was completely extinguished. l

Although damage was limited to a relatively small area ,

of the plant, more than 1600 cables routed in 117 conduits and 26 cable trays l

! were affected. Of those, 628 cables were safety related and their damage caused '

1 the loss of a cignificant number of plant safety systems. While there was no core

damage or unusual release of radioactivity, the fire caused a loss of control of j all Emergency Core Cooling Systems (ECCS) as well as control of other redundant

< safety systems.

1 Investigations of the cause and possible consequences of the Brown's Ferry fire

-b demonstrated that the occ:: pant safety and pro >erty protection concerns of the major fire insurance underwriters did not suff'iciently encompass nuclear safety issues, particularly with regard to the potential for fire to cause the failure of systems and components important to safe shutdown of the reactor. These investigations also revealed several significant fire protection vulnerabilities including: (a) the apparent ease with which the fire started, (b) the hours that elapsed before it was fully extinguished, and (c) the unavailability of redundant trains of plant safety equipmen. The NRC concluded that additional specific guidance for implementing the existing fire protection regulations (GDC 3 to 10 J-l

i

)

) DRAFT - FOR RIVER BDS STATION PIL0T INSPECTION JUNE 4, 1997 1

i I CFR 50) was necessary. In recognition of the potential consequences of fire, and -

! to assure that an adequate level of fire safety is incorporated into the overall

~

design and operation of all nuclear power plants operating in the United States, l the NRC detemined that established principles of defense-in-depth would be l applied in defense against fires.

l To achieve the high degree of safety required for nuclear power plants, the NRC i adheres to the application of a defense-in-depth philosophy of multiple levels of safety systems. This concept is also applicable to nuclear power plant fire safety, where defense-in-depth protection is provided by a combination of design features (fire barriers, safe shutdown system separation, fire detection systems, fire suppression systems), trained personnel, equipment, administrative controls, l and procedures directed at achieving an adequate balance in:

Preventing fires from starting;

Detecting fires quickly, suppressing those fires that occur, and limiting i their damage; and 1

Designing plant safety systems so that a fire that. starts and burns for a '

considerable time will not prevent essential plant safety functions from i being perfomed.

The multiple levels of protection that are embodied in the defense-in-depth >

philosophy assure fire safety throughout the life of the plant by minimizing both the probability and consequence of fires. A properly designed, implemented, and maintained nuclear plant fire protection program provides reasonable assurance, through a defense-in-depth approach, that the probability of fire is minimized, r.nd that the ef racts of fire, should one occur, will not prevent the performance of necessary safe shutdown plant functions.

To assist licensee's in preparing their fire protection programs, in May 1976, the NRC issued Auxiliary and Power Conversion Systems Branch, Branch Technical Position 9.5-1 (BTP 9.5-1) " Guidelines for Fire Protection for Nuclear Power Plants," and requested each licensee to provide an analysis that divides the plant into distinct fire areas and demonstrates that redundant trains of equipment required to achieve and maintain cold shutdown conditions of the reactor were adequately protected from fire damage (post-fire safe shutdown). The guidance contained in BTP 9.5-1, however, was only relevant to plants which filed an application for construction after July 1,1976.

In an effort to establish suitable defense-in-depth fire protection programs, without significantly affecting the design, construction, or operation of older plants that were either already operating or well past the design stage and into construction, in September of 1976 the NRC modified the guidelines in BTP APCSB 9.5-1, and issued Appendix A to BTP 9.5-1 " Guidelines for Fire Protection for Nuclear Plants Docketed Prior to July 1, 1976". This guidance provided acceptable alternatives in areas where strict compliance with BTP 9.5-1 would require significant modifications. Additionally, the NRC informed each plant J-2

i e

i 1 L

DRAFT - FOR RIVER BDB STATION PIL0T INSPECTION JUNE 4, 1997 I

that the guidance in Appendix A would be used to analyze the consequences of a -

! postulated fire within each area of the plant, and requested licensees to provide i results of the fire hazards analysis perfomed for each unit and the technical ~

, specifications for the present fire protection systems. The analyses submitted j by each operating plant in nsponse to this request, were then reviewed by the

staff against the guidance contained in Appendix A to BTP 9.5-1. The staff also

conducted plant visits to examine the relationship of structures, systems and j components important to safety with fire hazards, the potential consequences of' j fire,-and the associated fire protection features.

Supplementary' Fire Protection Program Management and Administration Guidelines:

After reviewing a number of licensee responses to BTP 9.5-1 and Appendix A to BTP 9.5-1, the staff determined that additional guidance on the management and administration of fire protection programs was necessary, and in mid-1977, issued a document titled: " Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls, and Quality Assurance." as GL 77-002. This document presents specific criteria used by the staff in the review of specific aspects of a licensee's fire protection program including: fire protection organization, training of the fire brigade, control of combustibles and ignition sources, fire fighting procedures and quality assurance.

10 CFR 50.48 and Appendix R to 10 CFR 50: By the late 1970s, the majority of operating plants had completed their analyses and had implemented most of the fire protection program guidance of Appendix A to the BTP. In most cases, the modifications proposed by licensees as a result of these analyses were found to be acceptable by the NRC. In certain cases, however, technical disagreements developed between certain licensees and the NRC staff, and several plants refused to adopt certain staff recommendations described in Appendix A. Even though a given issue might be contested by only a few plants, the NRC determined that the issues were a pctential generic problem, and rulemaking was deemed the appropriate vehicle for resolving these issues and implementing Commission policy with respect to fire protection. Therefore, to resolve areas of disagreement, the NRC amended its regulations, and in November 1980 issued 10 CFR 50.48, " Fire Protection" and Appendix R, " Fire Protection Program for Nuclear Power Plants Operating Prior to January 1, 1979." Appendix R sets forth Commission policy with respect to fire protection requirements.

By letter dated November 24, 1980, the Commission informed all power reactor licensees with plants licensed prior to January 1,1979, of new fire protection regulations contained in 10 CFR 50.48 (to ensure each plant had a fire protection program) and Appendix R to 10 CFR 50 (to ensure satisfactory resolution of disputed items). Attached as enclosures to this letter were a copy of the Federal Reaister Notice 45 FR 76602 (Enclosure 1) and a summary of open BTP items concerning the facility (Enclosure 2), with each open ites described in terms of a corresponding section of Appendix R. In its letter the Commission stated that the provisions of Appendix R can be divided into two categories:

Those provisions of Appendix R that are required to be backfit in their entirety by the new rule, regardless of whether or not alternatives to the J-3 .

l l

i i

[ DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 1

!' ?

i specific requirements of these sections have been previously approved by the -

NRC staff under the BTP review process. These requirements are set forth in !

i Sections III.G Fire Protection of Safe Shutdown Capability, III.J. Emergency - ~

l Lighting, and III.0, 011 Collection Systems for Reactor Coolant Pump.

J

Requirements concerning the "open items" of previous NRC staff fire protection reviews. (An open item is defined as a fire protection feature ,

j that has not been previously approved by the staff as satisfying the ;

provisions of Appendix A to Branch Technical Position 9.5-1, as reflected in j

a fire protection safety evaluation report).

l-l Initial validation inspections for compliance to the requirements of Appendix R j revealed that certain licensees had not considered Section III.L (Alternative and i Dedicated Shutdown Capability) when attempting to meet Section III.G. :'

i Specifically, where the protection of redundant trains of equipment necessary to i achieve post-fire safe shutdown can not be assured,Section III.G.3 requires an

alternative or dedicated shutdown capability which is independent of the cables,

! systems, or components in the fire affected area. The acceptance criteria for i i Section III.G.3 are listed in Section III.L. Although 10 CFR 50.48(b) does not !

i specifically include Section III.L with Sections III.G, J, and 0 of Appendix R as (backfit) requirements applicable to all power reactors licensed to operate

! prior to January 1,1979, Appendix R, when read as a whole (as evidenced by a 1 Court of Appeals Decision on Appendix R)does mean that Section III.L applies to ;

} the alternative safe shutdown option under Section III.G.

It is important to note that with the exception of Sections III.G, J, 0, and L, 1 (which were backfit to all plants regardless of previous approvals granted by the

staff), those portions of Appendix A to the BTP that were previously accepted by i the staff remained valid. Therefore, Appendix R does not, by itself, define the

fire protection program of any plant. For plants licensed before January 1,

. 1979, (pre-1979 plants) the fire protection program is defined by Appendix A to '

I the BTP, the aoolicable portions of Appendix R (i.e. Sections III.G, J, and 0 and l open issues resulting from BTP 9.5.1 Appendix A reviews), and any additional !

! commitments made by the licensee, as stated in conditions of its operating i license. :

1

! Fire Protection Guidelines for Plants Licensed After January 1,1979,: Appendix R i

! was not required to be implemented by plants that were licensed to operate after l January 1,1979. Rather, fire protection programs at these later plants were l typically reviewed against the licensing review guidelines presented in NUREG-

0800, " Standard Review Plan" '(SRP) Section 9.5.1, " Fire Protection Program."

l This document consolidates the guidance of BTP APCSB 9.5-1, Appendix A to BTP j APCSB 9.5-1, the Nuclear Plant Fire Protection Functional Responsibilities, j Administrative Controls and Quality Assurance (GL 77-002), and the criteria of Appendix R to 10 CFR 50.

l Since NUREG-0800, SRP 9.5.1 consolidates previous guidance issued by the staff, i it may be considered as a single reference document which describes the features

! of an acceptable fire protection program. As such, while not a regulatory l J-4 j

4 i ,

y,m -- -+ =-v----- -

w --'

1 DRAFT - FOR RIVER BEIS STATION PIL0T INSPECTION JUNE 4, 1997 )

I requirement, licensees of " older" (i.e., pre-1979) operating plants may also -

i implement the guidance contained in Section 9.5.1 of the SRP as a means of ~

1 establishing a fire protection program that complies with 10 CFR 50.48 and GDC 3. s l Certain plants licensed to o>erate after January 1,1979, however, may have been required to implement specif: c sections of Appendix R (typically sections III.G.,

III.J. and III.0) as specified in their " Fire Protection" license condition.

Additionally, note that with respect to the fire protection regulation (10 CFR i 50.48), only paragraphs (a)(requiring plants to have a fire protection plan that satisfies Criterion 3 of Appendix A to 10 CFR 50) and (b) (requiring plants to complete all fire protection modifications needed to satisfy Criterion 3 of Appendix A to 10 CFR 50 in accordance with the provisions of their operating licenses) apply to plants licensed after January 1,1979.

l Plant-specific conditions may preclude compliance with one or more of the provisions specified in the regulation. When the fire hazards analysis shows that adequate fire safety can be provided by an alternative approach (e.g., the use of a 1-hour fire rated barrier where a 3-hour barrier is specified)1icensees that are required to meet Appendix R to 10 CFR Part 50 (i.e., those licensed prior to i January 1,1979) may request NRC approval of an exemption from the technical requirements of Appendix R to 10 CFR Part 50. Requests for exemption must 4 include a sound technical basis that clearly demonstrates that the fire protection defense-in-depth,is appropriately maintained and that the exemption !

is technically justified (i.e., provides an equivalent level of safety).

Exemptions from fire protection requirements may be requested under 10 CFR 50.12.

As part of its exemption request the licensee must demonstrate, by means of a detailed fire hazards analysis, that existing protection or existing protection in conjunction with proposed modifications will provide a level of safety equivalent to the technical requirements of the regulation. Generally, the staff will accept an alternate fire protection configuration on the basis of a detailed fire hazards analysis if:

i

The alternate approach ensures that one train of equipment necessary to achieve hot shutdown from either the control room or emergency control stations is free of fire damage; .

l

The alternate approach ensures that fire damage to equipment necessary to achieve cold shutdown is limited so that it can be repaired within a reasonable time (minor repair using components stored on the site);

Fire-retardant coatings are not used as fire barriers; and

Modifications required to strictly meet the regulation would not enhance fire i protection sa.%ty levels above that provided by either existing or proposed alternatives / modifications.

The staff has also accepted an alternative fire protection configuration when, on the basis of a detailed fire hazards analysis, the licensee can demonstrate J-5 l

i i l i

DRAFT - FOR RIVER BElm STATION PILOT INSPECTION JUNE 4, 1997 i

that modifications required to strictly meet the regulation would be detrimental -

l to overall facility safety, the alternate configuration satisfies the four ,

, criteria above, and the alternate configuration provides an adequate level of

. fire safety.

} Plants licensed after January 1, 1975, have fire protection programs that were revicwcd ar.d approved under the licensing review guidance contained in NUREG-i 0800, SRP Section 9.5.1, and, therefore, typically are not subject to the i

specific regulatory requirements of 10 CFR 50.48 and Appendix R. For these

pl ants, a license amendment, or NRC staff approval of a deviation from a

commitment to a specific NRC guideline, is necessary when an alternate approach

! (i.e., an approach different from that specified in the guidelines) is used to satisfy the requirements of GDC 3. As with an exemption, however, the licensee

must submit a sound technical justification of equivalent safety for the ]

l alternate approach for NRC review and approval, along with its license amendment )

j or deviation request. l 1

! It should be noted that exemptions and deviations provide a method of l implementing alternatives to fire safety features specified in regulatory requirements (Appendix R) and staff licensing review guidance documents (NUREG 1 0800 SRP 9.5.1). Since approval is based on staff review of plant-specific

configurations, the exemption process provides licensees with a flexible means i of satisfying the intent of certain requirements, without reducing the overall level of protection that would be achieved through strict compliance with the j regulation.

Ihe operating licenses of plants licensed before January 1,1979, typically contain a condition requiring implementation of fire protection modifications

.! committed to by the licensee as a result of reviews conducted under Appendix A l to BTP APCSB 9.5-1. These license conditions were added by license amendments.

! The fire protection license conditions for plants licensed after January 1,1979, j however, vary widely in scope and content. Some only list open items that must ,

be resolved by a certain date or event (e.g., prior to start-up or prior to first J refueling outage), some reference a commitment to meet sections of Appendix R, I

and some reference the Final Safety Analysis Report (FSAR) and/or the staff's j fire protection safety evaluation report (SER).

License conditions do not specify when a licensee may make changes to the NRC !

4 approved program without requesting a license amendment. If the fire protection ;

program comitted to by the licensee is required by a specific license condition, '

or is not part of the FSAR for the facility, the provisions of 10 CFR 50.59 l

(Changes, Tests, and Experiments) may not be applied to make changes without prior NRC approval. Thus, licensees may be required to submit license amendment I requests even for relatively minor changes to the fire protection program.

l In GL 86-10 and GL 88-12, the NRC requested licensees to adopt a standard license i j condition for fire protection. In this manner, the fire protection program, t including the systems, the administrative and technical controls, the j organization, and other plant features associated with fire protection would be i J-6 4

4 i

i

DRAFT - FOR RIVER BElm STATION PIL0T INSPEC'* ION JUNE 4, 1997 1

$ I a ,

j on a consistent status with other plant features described in the FSAR. As part -

i of this process, the NRC requested licensees to incorporate their fire protection program that had been approved by the NRC, including the fire hazard ~

j l

analysis and major commitments that form the basis for the fire protection 4 i' program, by reference into their FSAR. Once the process was completed, and the standard license condition implemented, the provisions of 10 CFR 50.59 would

apply directly for changes that a licensee desired to make in the fire protection i program. In this context, the determination of the involvement of an unreviewed

! safety question defined in 10 CFR 50.59 (a) (2), would be made based on the

! " accident...previously evaluated" (i.e., the postulated fire in the fin Hazard 4 Analysis for the fire area affected by the change).

Licensees that have adopted the standard license condition for fire protection 4 may make changes to the approved fire protection program without prior approval

! by the Commission, provided those changes do not adversely affect the ability to i achieve and maintain safe shutdown in the event of a fire, or involve an unreviewed safety question. As with other changes implemented under 10 CFR 50.59,

, the licensee must maintain a current record of all such changes and report all l changes to the approved program annually to NRC. Additionally, if the operating ,

! license is amended to include this standard license condition, the licensee may l

! request an amendment to delete the, now redundant, non-administrative control j portions of the technical specifications. Also, under the standard license condition, temporary changes to specific fire protection features, which may be j necessary to accomplish maintenance or modifications, are acceptable provided

interim compensatory measures (e.g., fire watches) are implemented.

Examples of issues which would require an exemption (from Appendix R) or l l deviation (from SRP Section 9.5.1, NUREG 0800) are modifications to:

I l

The level of separation and protection provided for redundant trains of SSD j equipment;

Automatic detection systems; j

Automatic suppression; and

The SSD methodology approved in the SER.

! As stated above, to provide basic guidance for implementing the NRC's fire protection requirements the following documents were developed by the staff:

l.

i e Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch ,

4 (APCSB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants," - l 1

Applicable to plants docketed after July 1,1976, (May 1976). ;

Appendix A to BTP APCSB 9.5-1, " Guidelines for Fire Protection for Nuclear '

3 Plants Docketed Prior to July 1, 1976," - Applicable to plants already

operating or under construction before July 1,1976 (August 1976).

i l J-7 4

- , _ - - . . - _ m., , , - ., _ . _ , - ,

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997

Standard Review Plan, Section 9.5.1, " Guidelines for Fire Protection for - -

Nuclear Power Plants" (July,1981) - Used by the staff during the initial ~

licensing review process for some plants. Incorporates the guidance of BTP >

APCSB 9.5-1, Appendix A to BTP APCSB 9.5-1, and criteria of Appendix R to 10 CFR 50.

Staff reviews and inspections of licensee conformance to established criteria revealed cases where the licensees had misinterpreted certain requirements in a way that could result in unacceptable fire protection. Some of the more salient issues found to require further clarification include:

Allowable repairs to achieve safe shutdown;

Protection of safe shutdown capability from fire damage to associated non- i safety circuits;

]

Alternative shutdown instrumentation; I

Alternative shutdown capability;

Fire barriers and penetration seals;

Use of partial area coverage dettiction and suppression systems;

Reactor coolant pump oil collection :ystem capacity;

Use of low pressure injection systems (ADS /CS/LPCI) for alternative shutdown;

Allowable time to achieve safe shutdown; and j

Adequacy of electrical isolation provided for remote shutdown panels. ;

To address these and other issues, and develop a common understanding between licenscas and NRC reviewers and inspectors, a number of clarification and regulatory position documents were promulgated by the staff. Notable examples .

include:- l

" Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," (issued as- GL 77-002 in August 1977) provides supplemental guidance to Appendix A to BTP APCSB 9.5-1 regarding a licensee's fire protection organization, fire brigade training, control of combustibles and ignition sources, fire fighting procedures and quality assurance.

GL 81-12 (February 20, 1981) restated the requirement for each licensee to reassess areas of the plant where redundant trains.of systems necessary to achieve and maintain hot shutdown are located, defined the staff position on safe shutdown capability, and requested additional information concerning those areas of the plant requiring an alternative shutdown capability.

J-8

i i 1

j DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997 i

Clarification GL 81-12 (March 22,1982) provided additional clarification in -

i response to staff review of licensee responses to GL 81-12, and defined associated circuits of concern.

~ '

NRC internal memorandum, from L.S. Rubenstein, to R.J. Mattson, December 3,1982, "Use of the Automatic Depressurization System (ADS) and Low Pressure Injection (LPCI) to Meet Appendix R, Alternate Shutdown Goals," ,

stated that licensee proposals to use ADS and LPCI for alternate shutdown '

would be considered as a request for exemption from Section III.L of Appendix R, and that the staff intended to grant such exemptions. ;

NRC internal memorandum, from L.S. Rubenstein, to R.J. Mattson, March 16,1983, " Revision Statement of Staff Position Regarding Source Range l Flux, Reactor Coolant Temperature and Steam Generator Pressure Indication to l Meet Appendix R," accepted the use of exit core thermocouples as an !

acceptable alternative to the use of hot-leg temperature RTDs. '

GL 83-33 provided the following staff positions on certain requirements of Appendix R to 10 CFR Part 50:

Detection and automatic suppression;

Fire areas; ,

Structural steel related to fire barriers;

Fixed suppression systems;

Intervening combustibins;

Transient fire hazards.

NRC internal memorandum from D.G. Eisenhut to John 01shinski, February 16, 1984, '011 Collection System Reactor Coolant Pumps, Florida Power and Light Company, St Lucie Unit 2, Docket No. 50-389," provided the NRC position on the capacity of the oil collection system container required i by Section 111.0 of Appendix R. ;

IN 84-09, " Lessons Learned From NRC Inspections of Fire Protection Safe Shutdown Systems (10 CFR 50, Appendix R)': p ovided information related to analyses and modifications for implementing the requirements of 10 CFR 50, Appendix R with respect to the following issues:

Fire areas;

Fire barrier testing and configuration;

Protection of equipment necessary to achieve hot shutdown; J-9

DRAFT - FOR RIVER BEle STATION PIL0T INSPECTION JUNE 4, 1997

Licensee reassessment for conformance with Appendix R; -

l

~ 1

Identification of safe shutdown systems and components; l l

Combustibility of electrical cable insulation; 1

Detection and automatic suppression;

Applicability of 10 CFR 50, Appendix R, Section III.L; l l

Instrumentation necessary for alternative shutdown; :

Procedures for alternative shutdown capability;

Fire protection features for cold shutdown systems; i

RCP oil collection systems.

IN 85-09, " Isolation Transfer Switches and Post-Fire Safe Shutdown Capability," alerted licensee's of potential deficiencies in the electrical design of isolation / transfer switches which do not provide redundant fuses upon transfer.

GL 86-10. " Implementation of Fire Protection Requirements," April 24, 1986.

Certain licensees disagreed with, or found it difficult to implement, the some of the interpretations provided in GL 83-33. To pursue the matter with !

senior NRC management, the industry formed the Nuclear Utility Fire l

Protection Group. Subsequently, by direction of the Executive Director for Operations, the staff formed the Steering Committee on Fire Protection i Policy to "... examine all licensing, inspection and technical issues and to 1 make policy recommendations for expediting Appendix R implementation and for ,

assuring consistent levels of fire protection at all plants." Disagreements -)

in the implementation of interpretations provided in GL 83-33 were ultimately resolved by issuance - of GL 86-10, which consists of the most complete interpretation of the fire protection regulatory requirements. It contains information on: ;

Documentation required to demonstrate compliance

Applicable quality assurance requirements

NRC notification of deficiencies .

Incorporation of fire protection program into FSAR

Standard fire protection license condition i . Interpretations of Appendix R, including:

I J-10 i

y y ,,,c - . _ , , , . . . ~ _ _ - _ _

DRAFT - FOR RIVER BEM STATION PIL0T INSPECTION JUNE 4, 1997

Process monitoring instrumentation -

~

Repair of cold shutdown equipment

Fire damage

Tire area boundaries

Automatic detection and suppression

Alternative or dedicated shutdown capability

Appendix R questions and answers. To assist the industry in understanding NRC requirements, and improva the staff's understanding of the industry's concerns, a series of workshops were conducted in each NRC Region. The questions and answers presented NRC positions as responses to the questions posed by the industry during these workshops.

GL 88-12, " Removal of Fire Protection Requirements from Technical Specifications," gave plants additional flexibility to make changes to their fire protection programs. Through the implementation and adoption of a standard license condition, a licensee can make changes to its fire protection program without prior notification of the NRC in accordance with the provisions of 10 CFR 50.59, provided the changes do not adversely affect the reactor plant's ability to achieve and maintain post-fire safe shutdown.

Both GL 86-10 (Section F) and GL 88-12 addressed the subject of removing certain fire protection requirements from the technical specifications and updating the FSAR to incorporate the fire protection program. The intent of this guidance is to enable licensee's to evaluate and justify modifications to fire protection systems via the 10 CFR 50.59 process, as opposed to having the NRC provide specific review and approval for each fire protection change which impacts technical specifications or license commitments.

END J-11

i DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 i

APPENDIX K l

~~

THERMO-LAG AMPACITY DERATING BACKGROUND INFORMATION '

The Thermo-Lag vendor, TSI, has documented a wide range of ampacity derating

factors that were determined by testing. For example, between 1981 and 1985, the vendor provided test reports to licensees that document ampacity derating factors for cable trays that range from 5.3 to 12.48 percent for 1-hour barriers and from 16.15 to 20.55 percent for 3-hour barriers. On October 26, 1986, TSI informed the NRC and its customers by Mailgram that, while conducting special investigation in September 1986, at the Underwriter Laboratories, Incorporated (UL), it found that the ampacity derating factors for Thermo-Lag 330-1 barriers were greater than previous tests indicated (28.04 percent for 1-hour barriers and .

31.15 percent for 3-hour barriers). The NRC learned that UL performed duplicate i

, cable tray baseline tests using a longer stabilization period after the final current adjustment and obtained higher derating factors (36.1 percent for 1-hour barriers and 38.9 percent for 3-hour barriers). UL gave these results to the vendor, but they were not submitted to the NRC or to licensees. While reviewing tests which had been conducted at Southwest Research Institute (SwRI) in 1986, the staff learned that the ampacity derating factor for the tested configuration was 37.4 percent for a 1-hour Thermo-Lag barrier. The test procedures and test configurations differ for each of the aforementioned tests. Therefore, the results from these different ampacity tests may not be directly comparable to ;

each other.

l i

In IN 92-46 (Thermo-Lag Materials Report), the NRC informed licensees that a licensee also discovered a mathematical error in the calculation of the ampacity derating factor as published in a Industrial Testing Laboratories (ITL) test report. A preliminary assessment of the use of a lower-than-actual ampacity derating factor indicates that Thermo-Lag 330-1 barrier installations may allow cables to reach temperatures that exceed their ratings, which could accelerate cable aging.

The staff is also concerned that some licensees have not adequately reviewed the results of ampacity derating test results to determine if the tests are valid and if the test results apply to their plant designs. The staff ampacity derating concerns apply to the use of Thermo-Lag material on electrical raceways both as fire barriers to protect the safe shutdown capability and as barriers to create physical independence between electrical systems.

On May 13,1994, the NRC issued IN 94-34, "Thermo-Lag 330-660 Flexi-Blanket Ampacity Derating Concerns" to inform licer. sees that no ampacity derating testing or analysis had been performed by the vendor, Thermal. Science, Inc., (TSI) for the 330-660 Flexi-Blanket fire barrier system. The staff is concerned that some licensees may not have adequately assessed or conducted appropriate tests to determine ampacity derating factors to apply to their- plant designs, and as a result may have used non-conservative ampacity derating factors for the electrical raceway design.

K-1

l DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 NRR Electrical Engineering Branch (EELB) Safety Evaluation Reports or Technical -

Letter Reports, and licensee documents referenced therein, constitute the NRR review and approval of the licensee's ampacity derating tests or analyses for installed Thermo-Lag fire barrier configurations.

END l

l K-2

j i

DRAFT - FOR RIVER BDS STATION PIL0T INSPECTION JUNE 4, 1997 i-l l APPENDIX L -

! STAFF POSITION ON FIRE ENDURANCE RATING TESTS >

i

. It is the staff's position that fire endurance ratings of building construction and materials are demonstrated by testing fire barrier assemblies in accordance

! with the provisions of the applicable sections of NFPA 251, " Standard Methods of i Fire Tests of Building Construction and Materials," or ASTM E-Il9, " Fire Test of l Building Construction and Materials." Assemblies which meet specified acceptance

criteria when exposed to a standard test fire for a specific period of time (e.g., unexposed side temperature rise, and hose stream impingement) are

~

, considered to have a specific fire resistance rating.

3 Enclosure I to GL 86-10, Interpretations of Appendix R, provided additional

guidance with respect to the term " free from fire damage." Interpretation 3,

" Fire Damage," states, "In promulgating Appendix R, the Commission has provided i methods acceptable for assuring that necessary structures, systems, and

components are free from fire damage (see Section III.G.2a, b, and c), that is,

the structure, system or component under consideration is capable of performing j its intended function during and after the postulated fire, as needed."

i GL 86-10, Response 3.2.1, also stated that, "The resulting 325 *F cold side )

l temperature criterion is used for cable tray wraps because they perform a fire '

i barrier function to preserve' the cables free from fire damage. It is clear that i cable that beains to dearade at 450 *F is' free from fire damage at 325 *F"

! (emphasis added). In addition, the staff's response stated that, "for newly l identified conduit and cable trays requiring such wrapping new materials which

! meet the 325 *F criterion should be used, or justification should be provided for i the use of material which does not meet the 325 *F criterion. This may be based j on an analysis demonstrating that the maximum recorded temperature is

sufficient 1v below the cable insulation ignition temperature" (emphasis added).

I

! In 1984 Appendix R workshops held with industry, and later in GL 86-10, the staff j 3

provided guidance related to fire barrier testing " Acceptance Criteria." and the I i cold side temperature limits. In GL 86-10 the staff stated that the acceptance criteria contained in Chapter 7 of NFPA 251, " Standard Methods of Fire Tests of

Building Construction and Materials," pertaining to non-bearing fire barriers was ,

! applicable to cable tray fire barrier wraps. !

l

- On March 25, 1994, the NRC issued Supplement I to GL 86-10. Supplement 1 l clarified fire endurance testing acceptance criteria and guidance for the fire

barrier systems use to separate redundant safe shutdown equipment within the same i fire area.

l END 1

1 L-1 1

k

4 DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 APPENDIX M REFERENCES The below references are considered to be the primary documents relating to commercial nuclear power plant fire protection inspection. This list is by no i means a comprehensive listing of industry, licensing or regulatory documents relating to commercial nuclear power plant fire protection. Industry standards and plant specific documents, such as license exemption requests, fire hazard analyses, safe shutdown analyses, fire protection plans, reactor plant PRAs, IPEs i and IPEEEs, NRC fire protection related safety evaluation reports and technical l evaluation reports, FSAR/USAR, 50.59 analyses, and operating license technical ;

specifications are not listed. I

}

1. General Design Criterion (GDC) 3 of Appendix A to 10 CFR Part 50 " Fire protection," February 20, 1971

2. 10 CFR 50.48, " Fire protection," February 19, 1981

3. 10 CFR Part 50, Appendix R, " Fire Protection for Nuclear Power Facilities Operating Prior to January 1, 1979," dated February 19, 1981.

4. Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants" -

Applicable to plants docketed after July 1,1976

5. Appendix A to BTP APCSB 9.5-1, " Guidelines for Fire Protection for Nuclear Plants Docketed Prior to July 1,1976," - Applicable to plants already operating or under construction (docketed) before July 1,1976

6. BTP Chemical Engineering Branch (CMEB) 9.5-1, " Guidelines for Fire Protection for Nuclear Power Plants," Rev. 2, July 1981.

7. NUREG-0800, " Standard Review Plan," Section 9.5.1, " Fire Protection Program," Rev. 3, July 1981.

8. NUREG-1552, " Fire Barrier Penetration Seals in Nuclear Power Plants,"

July 1996.

9. NUREG/CR-5088, " Fire Risk Scoping Study," January, 1989.

10. IP 64704, " Fire Protection Program," March 18, 1994.

11. IP 64100, "Postfire Safe Shutdown, Emergency Lighting and Oil Collection at Operating and Near-tern Operating Reactor Facilities," March 16, 1987.

12. IP 64150, " Triennial Postfire Safe Shutdown Capability Reverification,"

March 16, 1987.

M-1

i

! i i

DRAFT - FOR RIVER BEND STATION PIL0T INSPECTION JUNE 4, 1997 i

i

13. Generic Letter 77-02, " Nuclear Plant Fire Protection Functional -

l Responsibilities, Administrative Controls and Quality Assurance," August 1 29, 1977.

l l

! 14. Generic Letter 81-12 " Fire Protection Rule," and its clarification issued i on March 22, 1982 ;

! l

15. Generic Letter 83-33, "NRC Positions on Certain Requirements of Appendix R i l to 10 CFR 50," 0ctober 19, 1983 1 4

16. Generic Letter 86-10. " Implementation of Fire Protection- Requirements," l April 24, 1986 l

17. Generic Letter 86-10, Supplement 1, " Fire Endurance Test Acceptance l Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown ]

Trains Within the Same Fire Area," March 25, 1994 ;

I

18. Generic Letter 88-12, " Removal of Fire Protection Requirements from !

Technical Specifications," August 2,1988 ;

19. Generic Letter 88-20, Supplement 4, " Individual Plant Examination of I External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR ]

50.54(f)," June 28, 1991. j

20. Information Notice 84-09, " Lessons Learned from NRC Inspections of Fire i Protection Safe Shutdown Systems," February 13, 1984

21. Information Notice 85-09, " Isolation Transfer Switches and Post-fire Safe !

Shutdown Capability," January 31, 1985 '

1

22. Information Notice 88-04, " Inadequate Qualification and Documentation of Fire Barrier Penetration Seals," February 5,1988, and Supplement 1, June 28, 1991

23. Information Notice 88-56, " Potential Problems with Silicone Foam Fire Barrier Penetration Seals," August 4,1988 *

]

l

24. Information Notice 91-77, " Shift Staffing at Nuclear Power Plants,"

November 26, 1991

25. Information Notice 92-18 " Potential for Loss of Remote Shutdown Capability During a Control Room Fire," February 28, 1992

26. Information Notice 94-28, " Potential Problems with Fire-barrier i Penetration Seals," April 5,1994

27. Information Notice 94-58, " Reactor Coolant Pump Lube Oil Fire," August 16, 1994 i

M-2 I l

1

l DRAFT - FOR RIVER BEND STATION PILOT INSPECTION JUNE 4, 1997

28. Information Notice 95-36, " Potential Problems with Post-fire Emergency l Lighting," August 29, 1995

29. Information Notice 95-48, "Results of Shift Staffing Study," October 10, ,

1995 i

30. Information Notice 97-01, " Improper Electrical Grounding Results in Simultaneous Fires in the Control Room and the Safe-shutdown Equipment 4

3 Room," January 8, 1997

31. NRC internal memorandum dated December 3,1982, from L.S. Rubenstein to R.J. Mattson titled "Use of the Automatic Depressurization System (ADS)

and Low Pressure Injection (LPCI) to Meet Appendix R, Alternate Shutdown Goal s. "

32. NRC internal memorandum dated March 16, 1983, from L.S. Rubenstein to R.J.

Mattson titled " Revision Statement of Staff Position Regarding Scurce Range Flux, Reactor Coolant Temperature and Steam Generator Pressure

, Indication to Meet Appendix R."

l 33. NRC Internal Memorandum dated February 16, 1984, from D.G. Eisenhut to l John 01shinski titled "011 Collection System Reactor Coolant Pumps,

! Florida Power and Light Company, St Lucie Unit 2, Docket No. 50-389."

1 <

l 34. List of Generic Communications Concerning Thermo-Lag Fire Barriers:

l !

Information Notice 91-47 " Failure of Thermo-Lag Fire Barrier Material l to Pass Fire Endurance Test," August 6, 1991

[

Information Notice 91-79 " Deficiencies in the Procedures for Installing

, Thermo-Lag Fire Barrier Materials," December 6, 1991 i

Information Notice 91-79 Supplement 1 " Deficiencies Found in Thermo-Lag Fire Barrier Installations," August 4,1994

Information Notice 92-46 "Thermo-Lag Fire Barrier Material Special Review Team Final Report Findings, Current Fire Endurance Tests, and Ampacity Calculation Errors," June 23, 1992

+ Bulletin 92-01 " Failure of Thermo-Lag 330 Fire Barrier System to Maintain Cabling in Wide Cable Trays and Small Conduits Free from Fire Damage," June 24, 1992

Information Notice 92-55 " Current Fire Endurance Test Results for Thermo-Lag Fire Barrier Material," July 27, 1992

Bulletin 92-01 Supplement 1 " Failure of Thermo-Lag 330 Fire Barrier System to Perform Its Specified Fire Endurance Function," August 28, 1992 M-3

a i

1 DRAFT - FOR RIVER BEM STATION PILOT INSPECTION JUNE 4, 1997 4

Information Notice 92-82 "Results of Themo-Lag 330-1 Combustibility.

Testing," December 15, 1992 j

s

Generic Letter 92-08 "Themo-Lag 330-1 Fire Barriers," December 17, 1992 i *

- Infomation Notice 94-22 " Fire Endurance and Ampacity Deratin Results for 3-Hour Fire Rated Thermo-Lag 330-1 Fire Barriers,"gMarch Test 16, 1994 l

e j

Generic Letter 86-10, Supplement 1 " Fire Endurance Test Acceptance !

Criteria for Fire Barrier Systems Used to Separate Redundant Safe '

j Shutdown Trains within the Same Fire Area," March 25, 1994 i Information Notice 94-34, "Themo-Lag 330-660 Flexi-Blanket Ampacity ;

Derating Concerns," May 13, 1994

/

! =

Information Notice 94-86, " Legal Actions Against Themal Science, Inc.,

Manufacturer of Themo-Lag," December 22, 1994 END 4

I .

i 1

I j -

i l

l 4

l i

1 i

l 1

i I

1 M-4 i

i

. . , . . y _. . _ - , _ . . . _ -

ML20140D823

Contents

Text

SUBJECT:

Enclosure:

SUBJECT:

Enclosure:

Navigation menu

ML20140D823

Text

SUBJECT:

Enclosure:

SUBJECT:

Enclosure:

Navigation menu

Search