Home > NRC Library > Document Collections > Generic Communications > Information Notices > 1984 > IN 84-09
Information Notice No. 84-09: Lessons Learned from NRC Inspections of Fire Protection Safe Shutdown Systems (10 CFR 50, Appendix R)
SSINS No.: 6835 IN 84-09 UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF INSPECTION AND ENFORCEMENT WASHINGTON, D.C. 20555 February 13, 1984 Information Notice No. 84-09: LESSONS LEARNED FROM NRC INSPECTIONS OF FIRE PROTECTION SAFE SHUTDOWN SYSTEMS (10 CFR 50, APPENDIX R) Addressees: All nuclear power reactor facilities holding an operating license (OL) or construction permit (CP). Purpose: This Information Notice is provided as guidance for power reactor facilities conducting analyses and/or making modifications to implement requirements of 10 CFR 50, Appendix R. It is expected that licensees will review this information for applicability to their activities. No specific action or response is required at this time. Description of Circumstances: A number of inspections to evaluate licensee implementation of the requirements of 10 CFR 50, Appendix R have been conducted at power reactor facilities licensed before January 1, 1979. Significant items of noncompliance were found at a number of facilities. As a result of these inspections, the NRC staff has prepared the enclosed Supplemental Guidance on 10 CFR 50 Appendix R Fire Protection Safe Shutdown Requirements. The staff intends to conduct workshops on fire protection safe shutdown requirements at locations near each of the NRC's five Regional offices during the next two months. At these workshops, an overview of inspection results and associated lessons learned will be presented and participants will be provided with the opportunity to present specific questions concerning Appendix R requirements. Schedules and agenda for the regional workshops will be forwarded to all utilities with nuclear projects in the near future. 8401190041 . IN 84-09 February 13, 1984 Page 2 of 2 If you have any questions regarding this matter, please contact the Regional Administrator of the appropriate NRC regional office or this office. Edward L. Jordan, Director Division of Emergency Preparedness and Engineering Response Office of Inspection and Enforcement Technical Contacts: L. E. Whitney, IE (301) 492-9668 T. Wambach, NRR (301) 492-7072 Attachments: 1. Supplemental Guidance on 10 CFR 50 Appendix R Fire Protection Safe Shutdown Requirements 2. List of Recently Issued IE Information Notices . Attachment 1 IN 84-09 February 13, 1984 Page 1 of 9 SUPPLEMENTAL GUIDANCE ON 10 CFR 50 APPENDIX R FIRE PROTECTION SAFE SHUTDOWN REQUIREMENTS I. Fire Areas At one facility inspected, the licensee's fire hazards analysis had not established fire areas. Therefore, in the absence of alternative means for safe shutdown in a separate fire area or approved exemptions, the redundant equipment within the plant was inspected for compliance with the separation requirements of Appendix R, Section III.G.2. Significant items of noncompliance were identified at this facility with respect to separation of redundant trains of systems and components. Footnote 3 in 10 CFR 50.48 directs attention to documents which provide basic fire protection guidance for nuclear power plants. One of these documents, Branch Technical Position Auxiliary Power Conversion System Branch BTP APCSB 9.5-1, "Guidelines for Fire Protection for Nuclear Power Plants," for new plants docketed after July 1, 1976, dated May 1976, defined a fire area as: that portion of a building or plant that is separated from other areas by boundary fire barriers (walls, floors, or roofs) with any openings or penetrations protected with seals or closures having a fire resistance rating equal to that of the barrier. "Supplementary Guidance on Information Needed for Fire Protection Evaluation," dated October 21, 1976, requested, as part of the fire hazards analysis, "plan and elevation views of the plant that show the plant as divided into distinct fire areas." Section III.G of Appendix R sets forth the requirements for the fire protection of safe shutdown capability on the basis of fire areas. Fire areas should be delineated in each facility's fire hazards analysis. NRC Generic Letter 83-33, dated October 19, 1983, restates NRC positions on Appendix R requirements regarding fire areas and the concept of "fire zones." II. Fire Barrier Testing and Configuration At some of the facilities inspected, fire barriers (both walls and one-hour fire barriers) were installed without basis for their fire rating (such as U/L listing or testing conducted by a nationally recognized testing laboratory for the configuration used in the plant). Fire barriers installed to meet the requirements of Section III.G.2 of Appendix R must have such a rating. Boundary fire barriers may have previous NRC acceptance documented in a Safety Evaluation Report. Some one-hour enclosures or wraps inspected have not been complete. Cable wraps which do not extend from fire barrier to fire barrier cannot constitute a one-hour barrier. . Attachment 1 IN 84-09 February 13, 1984 Page 2 of 9 III. Protection of Equipment Necessary To Achieve Hot Shutdown At one facility, redundant pressurizer heater control and power cables were separated by a partial horizontal pyrocrete barrier suspended from the overhead. At the same facility, two auxiliary feedwater pumps were located adjacent to each other and separated by a partial steel missile shield coated on one side with fire-retardant material. The separation criteria of Appendix R, Section III.G.2, were not met in that the coated shield did not meet the definition of a fire barrier of BTP APCSB 9.5-1. No alternative means of feedwater supply was designated. At a second facility, redundant pressurizer heater load centers were located within the same cabinet. At a third facility, redundant steamline isolation valves control cables for HPCI and RCIC pumps were located in close proximity without a fire rated barrier. Appendix R, Section III.G.1, requires that fire protection features shall be provided for structures, systems, and components important to safe shutdown. These features shall be capable of limiting fire damage so that one train of systems necessary to achieve and maintain a hot shutdown condition from either the control room or emergency control station(s) is free of fire damage. Sections III.G.2 and III.G.3 specify four alternatives that may be implemented outside of primary containment to assure that one redundant train of equipment, cabling and associated circuits necessary to achieve and maintain hot shutdown remains free of fire damage. The alternatives are: 1. Separation of redundant trains of equipment, cabling, and associated circuits by a three-hour fire barrier. 2. Enclosure of redundant trains of equipment, cabling, and associated circuits by a one-hour fire barrier with fire detection and automatic fire suppression systems installed in the area. 3. Separation of redundant trains of equipment, cabling, and associated circuits by a horizontal distance of 20 feet with no intervening combustibles and with fire detection and automatic fire suppression systems installed in the area. 4. Installation of alternative or dedicated shutdown capability independent of the equipment, cabling, and associated circuits under consideration, and installation of fire detection and fixed fire suppression systems in the area containing this alternative or dedicated shutdown capability. It should be noted that Sections III.G.2.d, e and f of Appendix R, provide additional options for the separation of redundant trains of equipment and cables within non-inerted containments. . Attachment 1 IN 84-09 February 13, 1984 Page 3 of 9 In addition, a licensee may request and receive exemptions from the requirements of Appendix R, Section III.G, under the Appendix R review process. Such exemptions should be for configurations and/or procedures that provide an equivalent level of safety to that provided by the four alternatives above. IV. Licensee's Reassessment for Conformance with Appendix R Problems found during the inspections with respect to providing redundant hot shutdown capability appear to be indicative of inadequate reassessment of plant configuration by the licensees. Also, at each facility inspected, documentation was lacking to provide assurance that a comprehensive associated circuits analysis had been conducted for all fire areas. At one facility visited in FY 1983, the inspectors could find no evidence (direct or indirect) that a thorough engineering review had been conducted against the requirements of Appendix R. At most facilities visited, the analyses provided for inspector review were developed prior to the issuance of Appendix R. Two letters were sent by NRR to the licensees of plants licensed prior to January 1, 1979. These letters clearly stated the requirement for licensee reassessment to ensure compliance of Appendix R, Sections III.G, III.J, and III.O, regardless of previous reviews and approvals by the NRC (e.g., SERs issued during the BTP APCSB 9.5-1 review process). A November 24, 1980 letter from the Director, Division of Licensing, Office of Nuclear Reactor Regulation, to the above licensees states, in part: The provisions of Appendix R that are applicable to the fire protection features of your facility can be divided into two categories. The first category consists of those provisions of the Appendix that are required to be backfit in their entirety by the new rule, regardless of whether or not alternatives to the specific requirements of these Sections have been previously approved by the NRC staff. These requirements are set forth in Sections III.G, Fire Protection of Safe Shutdown Capability; III.J, Emergency Lighting; and III.O, Oil Collection Systems for Reactor Coolant Pump. The fire protection features of your facility must satisfy the specific requirements of these three Sections by the dates established by Paragraph 50.48(c), unless an exemption from the Appendix R requirements is approved by the Commission. A February 20, 1981 letter from the Director, Division of Licensing, Office of Nuclear Reactor Regulation, to the above licensees states, in part: Paragraph 50.48(b) of 10 CFR Part 50, which became effective on February 17, 1981, requires all nuclear plants licensed to operate prior to January 1, 1979 to meet the requirements of . Attachment 1 IN 84-09 February 13, 1984 Page 4 of 9 Sections III.G, III.J, and III.O of Appendix R to 10 CFR Part 50 regardless of any previous approvals by the Nuclear Regulatory Commission (NRC) for alternative design features for those items. This would require each licensee to reassess areas of the plant where redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area to determine whether the requirements of Section III.G.2 of Appendix R are satisfied. If not the licensee must provide alternative shutdown capability in conformance with Section III.G.3 or request an exemption if there is some justifiable basis. The NRC expects that, when a reassessment has been performed at a facility, a documented record of this engineering activity would be available within the utility. The availability of documentation of (and personnel familiar with) a licensee's reassessment activities helps to confirm the licensee's methodology and subsequent implementation of reassessment results. Therefore, this documentation helps to confirm adequate licensee control of Appendix R reassessment activity. V. Identification of Safe Shutdown Systems and Components At two facilities inspected, redundant systems and components necessary for safe shutdown (within the same fire area) were not listed or otherwise identified in the licensees' fire hazards analysis or associated documentation. At these facilities, the inspectors used the lists of required safe shutdown systems provided in connection with the alternative shutdown analyses provided by the licensees in their original fire hazards analyses. At one of these facilities, the licensee felt the list used was too restrictive (in that it did not include existing potentially redundant systems). At another facility, the licensee felt that the list used was too broad (in that the list contained systems that the licensee subsequently realized were not actually necessary for safe shutdown). This situation should not have occurred since identification of required safe shutdown systems for each area of the plant is a logical starting point for reassessment of areas where redundant trains are located. The systems and equipment needed for post-fire safe shutdown are those systems necessary to perform the shutdown function defined in Section III. L of Appendix R. These functions are reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and associated support functions. The acceptance criterion for systems performing these functions is also defined in Section III. L: During the post-fire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal a.c. power, and the fission product boundary integrity shall not be affected; i.e., there shall be no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary. . Attachment 1 IN 84-09 February 13, 1984 Page 5 of 9 These guidelines apply to the systems needed to satisfy both Section III.G and III.L of Appendix R. VI. Combustibility of Electrical Cable Insulation At a number of facilities, findings of noncompliance were made because of the presence of insulated electrical cable between redundant trains of equipment necessary for safe shutdown. At one facility, the space between redundant electrical cabling at the internal and external containment electrical penetration areas was nearly filled with a high density of insulated electrical cabling. At another facility, four redundant trains of pressurizer heater control and/or power cables were routed in trays in the overhead of one room with numerous other cables and cable trays. Several comprehensive flammability tests conducted by the Electric Power Research Institute (EPRI NP-1200, EPRI EL-1263), Factory Mutual (Contract RP-1165-1), and Sandia National Laboratories (NUREG/CR-2431, among others) have shown that burning cable insulation represents a significant fire hazard. These tests were conducted on both IEEE-383 qualified and unqualified cable. While the qualified cable exhibited a tendency to ignite and propagate flame less rapidly, combustion of grouped cables continued at significant levels. In particular, grouped vertical cables which are not protected by a fire propagation retardant, such as metal tray covers or fire retardant coatings, can result in rapidly developing fires with high heat release rates. Section III.G.2.b of Appendix R requires redundant train "separation.. with no intervening combustibles...." The NRC staff position is that insulation of electrical cables, including those which are coated, should be considered as intervening combustibles. VII. Detection and Automatic Suppression At one facility, redundant trains of safe shutdown equipment located within the same fire area were found to be separated by at least 20 feet of horizontal empty space (no intervening combustibles). Yet, because no general area automatic fire suppression system was installed, the area was found not to meet the separation requirements of Appendix R, Section III.G. NRC Generic Letter 83-33, dated October 19, 1983, restates detailed NRC positions on Appendix R requirements regarding detection and automatic suppression. At another facility, some automatic sprinkler systems were not installed in ceiling spaces occupied by obstructions such as ventilation equipment, cable trays/conduit, etc. The effectiveness of these automatic sprinkler systems in extinguishing or suppressing fires in the overhead was therefore compromised. NFPA 13 should be referred to when determining sprinkler arrangement. . Attachment 1 IN 84-09 February 13, 1984 Page 6 of 9 VIII. Applicability of 10 CFR 50, Appendix R, Section III.L Some of the inspected licensees had not considered Section III.L of Appendix R when attempting to meet Section III.G. The acceptance criteria for Section III.G.3. are listed in Section III.L. Although 10 CFR 50.48(b) does not specifically include Section III.L with Sections III.G., J, and O of Appendix R as a requirement applicable to all power reactors licensed prior to January 1, 1979, the Appendix, read as a whole, and the Court of Appeals decision on the Appendix, Connecticut Light and Power, et al. v. NRC, 673 F2d. 525 (D. C. Cir.), cert. denied (1982), does mean that Section III.L applies to the alternative safe shutdown option under Section III.G. IX. Instrumentation Necessary for Alternative Shutdown At one facility inspected, hot shutdown source range neutron flux monitoring capability could not be provided until approximately 12 hours subsequent to a postulated fire in the control room. At another facility inspected, no alternative hot shutdown source range neutron flux monitoring capability, cold leg temperature indication, or wide-range hot leg temperature indication was provided. Section III.L.1 of Appendix R requires that alternative shutdown capability achieve and maintain subcritical reactivity conditions in the reactor. Section III.L.2 requires provision for direct readings of the process variables necessary to perform and control the reactor shutdown function. The following lists provide the minimum monitoring capability the NRC staff considers necessary to achieve safe shutdown: Instrumentation Needed for PWRs a. Pressurizer pressure and level. b. Reactor coolant hot leg temperature or exit core thermocouples, and cold leg temperature. c. Steam generator pressure and level (wide range). d. Source range flux monitor. e. Diagnostic instrumentation for shutdown systems. f. Level indication for all tanks used (e.g., CST). Instrumentation Needed for BWRs a. Reactor water level and pressure. b. Suppression pool level and temperature. c. Emergency or isolation condenser level. d. Diagnostic instrumentation for shutdown systems. e. Level indication for all tanks used. . Attachment 1 IN 84-09 February 13, 1984 Page 7 of 9 X. Procedures for Alternative Shutdown Capability At some facilities inspected, the alternative shutdown procedures have been deficient. Typical deficiencies identified have been: (1) inaccurately identified components, circuit breakers, wires, or terminals; (2) failure to address the effects on alternative shutdown capability of circuitry damage in the fire area; and (3) failure to identify the specific equipment and actions required to achieve cold shutdown. Section III.L.3 of Appendix R requires that alternative shutdown procedures be in effect which accommodate post-fire conditions, where offsite power is available and where offsite power is not available for 72 hours. XI. Fire Protection Features for Cold Shutdown Systems During inspection of one facility, the inspectors noted that the two residual heat removal (RHR) pumps were located in separate rooms in the Auxiliary Building. The wall separating the pumps (and other enclosing walls) had open penetrations. Also, the access doors to the rooms were constructed with non-closing ventilation louvers. Transient combustibles consisting of anti-C clothing, paper tape, etc., were stored on open shelves in the access area outside the RHR rooms. Also, the RHR pump power cables were not protected to preclude the loss of both trains of equipment from a fire in either of the pump rooms or the adjacent access area. Therefore, reasonable assurance was not provided that a single fire would not damage redundant RHR components or cables. The licensee had not performed an analysis to determine the limits of RHR system fire damage, the associated onsite repair material storage requirements, or the time required to complete necessary repairs. Section III.G.1.b requires that fire protection features for cold shutdown systems be capable of limiting fire damage so that systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired in 72 hours. To satisfy this requirement, the licensee should have an analysis which supports conclusions that the design features provided will limit the fire damage. The requirements for such repairs specified in Section III.L.5 should also be met: Materials for such repairs shall be readily available on site and procedures shall be in effect to implement such repairs. Repairs for cold shutdown systems are allowed by Section III.L.5 of Appendix R. For cold shutdown capability repairs, the removal of fuses for isolation and the replacement of cabling is permitted. Also, selected equipment replacement (e.g., such as replacing a valve, pump or control room controls and instruments) should be reviewed on a case-by-case basis to verify its practicality. Procedures for repairing damaged equipment should be prepared in advance with replacement equipment (i.e., cables made up with terminal lugs attached) stored on site in a controlled manner. All repairs should be of sufficient quality to assure . Attachment 1 IN 84-09 February 13, 1984 Page 8 of 9 safe operation until the plant is restored to an operating condition. Repairs not permitted include the use of clip leads in control panels (which means that hard-wired terminal lugs must be used), and the use of jumper cables other than those fastened with terminal lugs. When repairs are necessary in the fire area, the licensee should demonstrate that sufficient time is available to allow the area to be re-entered, that expected fire and fire suppressant damage will not prevent the repair from taking place, and that the repair procedure will not endanger operating systems. The licensee may, at his option, modify the plant so that cold shutdown can be achieved without reliance on repairs. XII. RCP Oil Collection Systems At some facilities, the lube oil collection systems for the reactor coolant pumps were not sized to accept the entire lube oil inventory from all reactor coolant pumps without overflow. This does not protect against the consequences of simultaneous failure of more than one lube oil system during a seismic event. Section III.O, Oil Collection Systems for Reactor Coolant Pump, is written for a single pump. The collection container is required to hold the entire inventory of the oil system of the pump. It follows that if additional pumps are present they would each be provided full collection capacity. There are usually from 2 to 4 reactor coolant pumps in a plant. The oil inventory of one large pump is approximately 275 gallons. Some licensees have provided several containers connected in parallel for each pump. The NRC staff position on the capacity of a reactor coolant pump oil collection system which meets Section III.O of Appendix R to 10 CFR 50 is: One or more tanks need to be provided with sufficient capacity to collect the total lube oil inventory from all reactor coolant pumps draining to the container. Alternatives which have been found acceptable under the exemption process are: 1. One or more tanks need to be provided with sufficient capacity to hold the total lube oil inventory of one reactor coolant pump with mar in if the tank(s) is/are located such that any overflow from the tank(s) will be drained to a safe location where the lube oil will not present an exposure fire hazard to or otherwise endanger safety-related equipment; or 2. Where the RCP lube oil system is shown, by analysis, to be capable of withstanding the safe shutdown earthquake (SSE) (eliminating the consideration of simultaneous lube oil system ruptures from a seismic event), protection is required for random leaks at mechanical joints in the lube oil system (e,g, flanges, RTD connections, sightglasses). Alternative methods of protection may be deemed acceptable for such designs. In RCP lube oil collection systems of such designs, one or more tanks need to be . Attachment 1 IN 84-09 February 13, 1984 Page 9 of 9 provided with sufficient capacity to hold the total lube oil inventory of one reactor coolant pump with margin. Because protection is required only against possible leakage resulting from random leaks from the one pump at a time, any overflow from the tanks need not be considered; or 3. For those pumps where the lube oil is contained entirely within the pump casing, an oil collection system may not be required, provided it can be shown that there are no potentially significant leakage points.
Page Last Reviewed/Updated Tuesday, November 12, 2013