Search Options
Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us

SECY-98-187

August 3, 1998

PURPOSE:

To inform the Commission of the status of the pilot fire protection functional inspection (FPFI) program and of the staff's plans to complete the program.

BACKGROUND:

The staff sent the Commission information leading up to the FPFI program in memoranda of August 25, 1992; September 20, 1995; and April 3, 1996, and in SECY-93-143, "NRC Staff Actions to Address the Recommendations in the Report on the Reassessment of the NRC Fire Protection Program," dated May 21, 1993; and SECY-95-034, "Status of Recommendations Resulting from the Reassessment of the NRC Fire Protection Program," dated February 13, 1995. In SECY-96-267, "Fire Protection Functional Inspection Program," dated December 24, 1996, the staff documented the complete background and description of the FPFI program and informed the Commission of its plans for implementing the program. In brief, the FPFI program was based on the following staff commitments to the Commission: (1) to inspect the Thermo-Lag corrective actions at all plants, (2) to assess the NRC reactor fire protection program to determine if it had appropriately addressed all fire safety issues, (3) to determine if licensees are maintaining compliance with NRC fire protection requirements, (4) to identify the strengths and weaknesses of the reactor fire protection program, (5) to reevaluate the scope of the reactor fire protection inspection program, and (6) to develop a coordinated approach for reactor fire protection and systems inspections.

In a Staff Requirements Memorandum of February 7, 1997, the Commission informed the staff that it did not object to the staff's plans for the FPFI program, and of its interest in strategies that would shorten the time for the benefits of the program to become available to all licensees. The Commission requested that the staff send a report to the Commission at the end of the pilot program that discusses the FPFI program and possible plans for accelerating the benefits of the program. On the basis of the schedule given in SECY-96-267, the staff was to have produced its final report during June 1998 (WITS 9700021). However, because of the program delays discussed under "Schedule," below, the staff will not complete the FPFI pilot program within the schedule given in SECY-96-267. Therefore, rather than the final report, the staff is sending the Commission this interim report. This interim report describes the inspection results to date, the plans to complete the pilot program, and adjustments made to the pilot program since SECY-96-267. The staff plans to submit its final report to the Commission by the end of calendar year 1998.

DISCUSSION:

The staff has completed three of the four pilot FPFIs: Region I (Susquehanna Steam Electric Station), Region II (St. Lucie Plant), and Region IV (River Bend Station). To complete the pilot program described in SECY-96-267, the staff must perform the fourth and final pilot inspection in Region III (Prairie Island), conduct a workshop to obtain public and industry comment on the FPFI program, prepare a final version of the FPFI procedure, and report to the Commission the results of the FPFI pilot program and the staff's recommendations for the future of the program.

Pilot Inspection Process

The Office of Nuclear Reactor Regulation (NRR) led the three pilot FPFIs completed to date using inspectors from NRR, the regional offices, and Brookhaven National Laboratory. NRR coordinated plant selection and inspection schedules with the regional offices. The staff performed the inspections in accordance with the approach described in SECY-96-267 (2 weeks of preparation, 1 week inspecting on site, 1 week reviewing in office, and a final week inspecting on site) using the FPFI procedure that it had sent to the Commission by memorandum dated June 23, 1997. This procedure is much broader in scope than the existing fire protection core inspection procedure (IP 64704, "Fire Protection Program"). For example, although the objective of IP 64704 is to evaluate the overall adequacy of the licensee's fire protection program, it does not address post-fire safe-shutdown capability, nor does it thoroughly evaluate fire protection program management and configuration control. The FPFI procedure also differs from the core fire protection inspection procedure in that it provides guidance to the inspectors for using risk insights to help focus on areas most important to safety. NRR risk analysts are assisting the FPFI team in obtaining fire risk insights for the plant-specific inspection plans. The staff will present additional information on the use of risk insights in its final report on the FPFI pilot program.

NRR prepared the FPFI reports and sent them to the licensees after the appropriate regional office reviewed the reports. Like other NRR-led team inspections, and as described in SECY-96-267, the regional offices are responsible for any inspection followup and enforcement actions resulting from the FPFI. After NRR issued each FPFI report to the licensees, it made recommendations for inspection followup and enforcement to the regional office and gave follow up support.

The staff will modify its approach for the final pilot FPFI as described under "Prairie Island" below.

Inspection Results to Date

The findings from the pilot FPFIs for the River Bend, Susquehanna, and St. Lucie plants are summarized below. The executive summaries from the FPFI reports for these plants, which contain detailed summaries of each inspection finding, are attached (Attachments 1, 2, and 3, respectively). The staff will prepare an analysis of the FPFI findings in its final report on the FPFI pilot program.

River Bend Station

The inspection team reported the following findings: (1) there was a weakness in how transient combustibles are controlled; (2) smoke detection and fire suppression system designs did not meet industry standards; (3) there was a weakness in the analysis and testing of fire doors; (4) engineering evaluations of certain fire barrier designs did not demonstrate that the barriers protected adequately against the fire hazards; (5) fire brigade performance was weak; (6) compensatory measures for the lack of certain fire barriers did not provide an equivalent level of safety; and (7) certain Individual Plant Examination of External Events (IPEEE) assumptions were weak. The inspection team also found that the licensee's post-fire safe- shutdown circuit failure analysis methodology did not consider multiple circuit faults and, therefore, did not identify certain conditions that could prevent the operation or cause the maloperation of post-fire safe-shutdown capability (e.g., a potential fire-induced reactor transient may not have been properly analyzed and bounded). As part of its Thermo-Lag corrective action program, the licensee reanalyzed its post fire safe shutdown methodology. The objective of the reanalysis was to reduce reliance on Thermo-Lag fire barriers and to upgrade required Thermo-Lag barriers. The inspection team did not identify any problems with the licensee's Thermo-Lag corrective action program.

Susquehanna Steam Electric Station

The inspection team reported the following findings: (1) transient combustibles were not controlled in accordance with plant procedures; (2) the fire brigade drill revealed response and firefighting technique problems; (3) fire detection and suppression system designs did not meet fire protection industry codes and standards; (4) the post-fire safe shutdown method for certain fire areas used the automatic depressurization and core spray systems and could allow core uncovery; (5) off-normal post-fire safe-shutdown procedures did not fully identify all required manual actions or did not identify the preferred instrumentation to be used to monitor reactor performance; and (6) emergency lighting was not provided for certain safe-shutdown operations. The inspection team noted that licensee personnel exhibited good knowledge of the Susquehanna fire protection features and post-fire safe-shutdown capability, that the scope and depth of operator training was good, that the licensee had been pro-active in addressing Kaowool fire barrier concerns, and that modifications had been implemented to prevent fire-induced spurious actuations of motor-operated valves (MOVs). During the inspection the licensee was in the process of confirming the design attributes of the installed Thermo-Lag fire barriers and evaluating required barrier upgrades. The inspection team did not identify any problems with the licensee's Thermo-Lag corrective action program.

St. Lucie

The inspection team reported the following findings: (1) fire detection and suppression system designs did not meet fire protection industry codes and standards; (2) transient combustibles were not controlled in accordance with plant procedures; (3) the fire brigade drill performance revealed response and firefighting technique problems; (4) the safe-shutdown analysis did not consider the fire- induced affects of multiple high-impedance electrical faults associated with the power distribution system; (5) weaknesses were associated with the fuse breaker coordination control program; (6) there were no fire isolation measures to protect against fire-induced spurious operation of high/low reactor pressure boundary valves; (7) there was no fire barrier to separate post-fire safe-shutdown charging function; (8) there was no analysis of fire-induced affects on instrument sensing lines; (9) there was a potential for fire-induced circuit failures leading to spurious operation of required post-fire safe shutdown MOVs; and (10) there was no emergency lighting for certain post-fire safe-shutdown operations. The team also found that there was a general lack of fire protection and post-fire safe-shutdown program ownership by the engineering department, and that the licensee's response to negative quality assurance findings was slow. With respect to the licensee's Thermo-Lag fire barrier upgrade program, the inspection team found that certain wall upgrades and designs were not sufficient to provide the fire resistance needed to contain the fire hazards in the areas of concern and that adequate fire resistive protection was not provided for thermal shorts that penetrate Thermo-Lag raceway fire barriers.

Prairie Island (Inspection of Licensee Self-assessment)

Prairie Island will be the fourth and final pilot FPFI. The inspection, which will be conducted during August 1998, will differ from the three previous pilot inspections in two significant ways. First, it will be a reduced-scope inspection of a licensee self-assessment instead of a full-scope FPFI. Second, it will be led by the region rather than by NRR. NRR will provide staff and contractor support to the region.

In SECY-96-267, the staff stated that licensee self-assessments could be an important element of the permanent FPFI program and that it would consider the role of self-assessments after it completed the pilot FPFI program. In the SRM of February 7, 1997, the Commission stated that it was interested in the use of licensee self-assessments as a strategy to relieve some of the staff inspection burden to the extent that the NRC can be assured that the self-assessments are of good quality and accurately reflect the strengths and weaknesses of the program. The Commission noted that staff review of the self-assessments would be warranted to gain this assurance. After the staff announced the FPFI pilot program, Northern States Power Company conducted a self-assessment of the Prairie Island fire protection and post-fire safe-shutdown programs in anticipation of receiving a pilot FPFI. This gave the staff an opportunity to test an inspection strategy involving licensee self-assessments as part of the FPFI pilot program.

In contrast to a full FPFI, the self-assessment inspection will be a one-week inspection. The NRC inspection team will evaluate the licensee's self-assessment effort and determine whether or not the scope and depth of the effort were equivalent to an FPFI, or if the licensee had an acceptable basis for reducing the scope or depth. The team will review the licensee's organization, the technical qualifications of the licensee's assessment team, the completeness of the assessment, the corrective actions proposed by the licensee for the more significant assessment findings, and the licensee's handling of any operability concerns. The staff will consider this exercise in formulating its recommendations for future reactor fire protection inspections.

Clinton and Quad Cities

The staff did not conduct FPFIs at either Clinton Power Station or Quad Cities. However, as discussed in the following sections, recent experiences with these plants provided insights into possible weaknesses with the core fire protection inspection program, the potential benefits of more comprehensive fire protection inspections (like FPFIs), and the use of licensee self-assessments.

Clinton

The staff had scheduled a pilot FPFI at Clinton Power Station. In preparation for the FPFI, the licensee performed an augmented fire protection program quality assurance audit and found that a program breakdown existed. The licensee issued 16 condition reports, 11 of which were attributed to inadequate post-fire safe-shutdown analyses. Before the staff could perform the pilot FPFI, it was canceled due to the licensee's commitment to perform an Independent Safety Assessment (ISA) and the NRC's oversight of this effort with a Special Evaluation Team (SET). Because of the significance of the licensee's fire protection audit findings, the SET performed an in-depth, vertical-slice inspection of the Clinton fire protection program. The SET noted that the licensee could not demonstrate the ability of the post-fire safe-shutdown analysis, equipment, and procedures to ensure that the plant could achieve and maintain safe-shutdown following a fire.

This experience demonstrated how one of the proposed benefits of the FPFI program, to gain renewed industry attention to nuclear power plant fire safety, is to be achieved. That is, implementation of the FPFI program led the licensee to assess its fire protection program, revealing significant programmatic and fire safety issues. The staff also notes that routine fire protection core inspections had not and would not have uncovered many of the issues that the licensee identified in preparation for the FPFI, but an FPFI-type inspection would have done so. This experience also produced insights into the possible benefits and uses of licensee self-assessments as a reactor fire protection inspection strategy.

Quad Cities

In September 1997, the licensee found problems with the Quad Cities post-fire safe-shutdown procedures and declared all safe-shutdown paths inoperable. In December 1997, after significant effort to correct these and other fire protection problems, the licensee was unable to demonstrate to the staff that the Quad Cities safe-shutdown analysis and procedures were adequate to assure that a fire in any plant area would not prevent the performance of necessary post-fire safe-shutdown functions. Ultimately, the licensee shut down both units to address these problems. Later, after a fire protection-related restart team inspection, the units restarted. This experience is another example in which the core inspection had not and would not have revealed significant fire safety issues, but an FPFI would have. It also provided insights into the possible benefits and use of licensee self-assessments as a reactor fire protection inspection strategy.

Plans for a Post-Pilot Program Public and Industry Workshop

The staff will conduct a FPFI workshop after it completes the final pilot inspection. The FPFI inspection process and pilot FPFI Inspection results to date will be made publicly available prior to the workshop. At the workshop the inspection results will be discussed, and public and industry input and feedback on the FPFI program will be solicited.

Schedule

The staff has extended the schedule for the FPFI pilot program by about six months for the following reasons. First, at the request of the licensee for River Bend, the staff delayed the original pilot FPFI by three months so that the inspectors could inspect a revised safe-shutdown analysis. Second, the staff canceled the Clinton pilot FPFI late in the inspection preparation period in favor of the SET discussed above. A replacement pilot FPFI could not be scheduled on such short notice. Therefore, FPFI contractor resources were reassigned to non-FPFI fire protection and post-fire safe-shutdown inspection activity in support of the Millstone Project Office. Third, the Prairie Island pilot FPFI was postponed to use FPFI inspectors to conduct the emergent, fire protection-related restart team inspection at Quad Cities.

With respect to the remaining pilot program activities, the staff plans to do the following: (1) perform the final pilot inspection at Prairie Island during August 1998, (2) conduct the FPFI workshop during November 1998, and (3) submit its final report to the Commission by the end of calendar year 1998. In its final report, the staff will do the following: (1) present an analysis of the FPFI findings, regional FPFI inspection follow-up activities, and enforcement actions arising from the pilot FPFIs; (2) present information on the use of risk insights for fire protection inspections; (3) discuss and evaluate the types of NRC fire protection inspections that it has conducted since the fire protection regulation was issued in 1981; (4) address the strategies that the Commission expressed interest in (SRM of February 7, 1997); and (5) recommend the type and level of reactor fire protection inspection that would be appropriate for the future.

ATTACHMENT 1

EXECUTIVE SUMMARY

River Bend Station
Fire Protection Functional Inspection Report 50-458/97-201

River Bend Station Unit 1 (RBS) is a General Electric 991 megawatt electric (MWe) boiling water reactor (BWR) with a Mark III containment. The plant entered commercial operation in June 1986. During the weeks of June 16 - 20 and June 30 - July 3, 1997, a team of Nuclear Regulatory Commission (NRC) and Brookhaven National Laboratory (BNL) engineers conducted a Fire Protection Functional Inspection (FPFI) at the River Bend Station. On August 19, 1997, the NRC staff conducted a meeting with representatives of Entergy Operations, Inc. (EOI), the licensee for RBS, at NRC headquarters to obtain additional information needed to complete the FPFI. The NRC staff held the FPFI exit meeting with the licensee on January 20, 1998.

Title 10, Section 50.48, of the Code of Federal Regulation (10 CFR 50.48) requires that all operating nuclear power plants have a fire protection plan that satisfies Criterion 3 of Appendix A of this part. Operating License NPF-47, Condition 2.C.10 specifies that the licensee shall comply with the requirements of the fire protection program as specified in Attachment 4 to the license, which specifies that the licensee shall implement and maintain in affect all of the provisions of the approved program as approved in the NRC Safety Evaluation Report (SER) dated May 1984 and its Supplement 3 dated August 1985. The NRC based its approval of the RBS fire protection program on the licensee's commitment to follow the guidance of Appendix A to Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, "Guidelines for Fire Protection for Nuclear Power Plants," and the licensee's commitment to meet Sections III.G, III.J., and III.L of Appendix R to 10 CFR Part 50.

To reduce the quantity of Thermo-Lag fire barrier material installed at RBS, the licensee has performed a complete revision of the post-fire safe-shutdown analysis methodology that was developed by the former licensee of RBS, Gulf States Utilities (GSU). This revised approach represents a significant difference in the manner in which components and cables were evaluated and dis-positioned to ensure that at least one train of the systems necessary to achieve and maintain post-fire safe-shutdown capability would remain free of fire damage. Specifically, in lieu of performing detailed circuit analyses, the former approach (240.201A, dated November 24, 1993) provided fire protective features (fire barrier wrap, fire suppression systems, and fire detection systems) to protect cables, equipment, and associated non-safety circuits from fire damage. In the recently revised approach (240.201A, Revision 2, undated), EOI placed greater emphasis on analytical techniques to evaluate the specific effects of fire damage to a particular component, cable, or circuit. While either approach may provide an acceptable means of demonstrating that a postulated fire will not affect the analyzed post-fire safe-shutdown capability of the plant, reliance on detailed electrical circuit analyses places greater importance on the assumptions and evaluation criteria that form the basis of the analysis.

The inspection consisted of a comprehensive evaluation of the fire protection program, fire safety features, and post-fire safe-shutdown capability developed by EOI for RBS Unit 1.

Specific areas reviewed by the FPFI team included:

• Compliance with Sections III.G, III.J, and III.L of Appendix R to 10 CFR Part 50 and the plant's ability to achieve, maintain, and implement the post-fire safe-shutdown capability. subsequent cold shutdown from inside and outside the control room in the event of fire in any plant area.
  
  
• The adequacy of separation and/or protection provided for redundant trains of equipment and cables required to achieve and maintain safe-shutdown conditions in the event of fire.
  
  
• The scope of the analysis performed and the adequacy of protection provided for non-essential associated circuits of concern to the plant's post-fire safe-shutdown capability.
  
  
• The post-fire alternative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
  
  
• The plant fire protection program to determine if it has been fully implemented and maintained in accordance with the guidance of Appendix A to BTP APCSB 9.5-1.
  
  
• The 10 CFR 50.59 change process as applied to the fire protection program and how the process assures the NRC-approved fire protection program is maintained.
  
  
• The ability to mitigate the consequence of a fire resulting from a plant event.

In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection program and licensee initiatives taken to implement improvements in "state-of-the-art" fire detection, control, and extinguishment technology.

Summary of Findings

The following items in the area of fire protection engineering and program implementation were identified during this inspection:

• The licensee's implementation of its procedure to control combustibles and plant operational practices were not consistent with NRC fire protection program guidance in that transient combustibles resulting from work activities were not removed at the completion of each shift. (See Report Section F1.1.)
  
  
• At the time of initial licensing for operation, the licensee established onsite the minimum level of fire brigade equipment specified in the approved fire protection program. The licensee has maintained this minimum level of equipment and has not upgraded the equipment in response to technological advances in manual fire fighting. The fire fighting equipment provided to the brigade, which is used to cope with onsite fire emergencies, does not provide the level of personnel safety (to both the plant fire brigade and the off site fire department) that is needed to efficiently handle onsite fire emergencies. (See Report Section F2.1.1.)
  
  
• Smoke detectors are required by the NRC approved fire protection program as referenced by operating License Condition 2.C.10 to provide early warning fire detection in fire area C-24, which contains safety-related and post-fire safe-shutdown equipment and cables. The placement of detectors in this fire area deviated from the codes and standards specified by the updated safety analysis report (USAR) and, therefore, may not provide sufficient early warning of a fire. (See Report Section F2.3.1.)
  
  
• NRC Generic Letter (GL) 86-10, "Implementation of Fire Protection Requirements," Question 8.9, stated that deviations from National fire Protection Association (NFPA) standards should be identified and justified in the final safety analysis report (FSAR) or fire hazard analysis report (FHAR). The licensee did not evaluate and justify deviations from the NFPA standards for the RBS fire detection and sprinkler systems. (See Report Sections F2.3.1 and F2.3.3.)
  
  
• The licensee did not have test procedures to demonstrate the operability of the service water system (SWS) seismic water source interface with the fire protection water supply system. Specifically, the licensee's test program did not verify the operability of the fire protection seismic check valves that provide fire protection system and SWS integrity following a safe-shutdown earthquake. (See Report Section F2.3.4.)
  
  
• As a case in point, RBS USAR, Section 9A.3.5.1.10, "Fire Area Enclosures," stated that separate fire areas are enclosed with minimum 3-hour rated fire walls and floors, or have been evaluated to be adequate using the guidance of GL 86-10. The licensee was unable to locate any of the engineering evaluations of deviations of fire barrier designs from tested configuration. The installed configuration of fire door CB 116-14 deviated from the commitments described in the USAR. The licensee did not perform an engineering evaluation to justify the adequacy of this door configuration. (See Report Section F2.3.5.)
  
  
• The licensee utilizes a fire door "GO-NO-GO" gauge to check the fire door gap clearances specified in procedure STP-000-3602. NFPA 80 (1983) specifies that the maximum clearance between the bottom of a fire door and the floor is 3/4 inch, and the maximum clearance between the door and its door frame is 1/8 inch. The dimensions of the check blocks on the gauge were specified as 1-inch and 1/4-inch thicknesses, respectively. The procedure states that if the gauge completely fits into the door gap (i.e., the gap is greater than 1 inch or greater than 1/4 inch), then the door gap is unacceptable. Thus, the procedural acceptance criteria can exceed the maximum door-to-door frame and door-to-floor clearances specified by NFPA 80. This practice for determining fire door clearances does not confirm that the door installations are being maintained in accordance with the conditions of their fire endurance qualification tests and their UL listing. (See Report Section F2.3.5.)
  
  
• The team observed an unannounced fire brigade drill and found that fire brigade exhibited performance weaknesses. During the drill, the inspectors observed that one security force fire brigade member was delayed in responding by approximately 10 minutes because it was necessary to relieve that member of an assigned security post. In the event of a fire, effective and timely fire suppression activities would have been hampered by equipment and fire brigade performance problems. (See Report Sections F3.1 and F4.3.)
  
  
• The licensee's fire protection operability assessments are too narrowly focused on satisfying the definition of operability as specified in the RBS technical requirements manual. As a result, the effect that a postulated fire may have on the plant's capability to achieve and maintain safe-shutdown conditions does not appear to have been fully evaluated for cases where passive fire barriers have been intentionally removed from service and redundant (two) trains of safe-shutdown capability can be exposed to a common fire and may both be damaged. Under these conditions, the use of an hourly fire watch appears insufficient as an adequate compensatory measure for missing or removed post-fire safe-shutdown raceway fire barrier, and the fire watch did not provide the fire safety margin needed to assure that the designated post-fire shutdown equipment can perform their intended post-fire safe shutdown functions if they were called upon. (See Report Section F7.3.4.)
  
  
• The fire conditions modeled by the RBS Individual Plant Examination of External Events (IPEEE) fire analysis were non-conservative. Limited insights were gained from this analysis regarding how the plant and operators would responded to a challenging fire. This is attributed to the methodological weakness of the RBS IPEEE fire analysis process which does not constitute an in-depth fire analysis of compartments that present high consequence to reactor safety. (See Report Section F7.8.)

The following items in the area of post-fire safe-shutdown were identified during this inspection:

• A fire in areas requiring implementation of the alternative shutdown capability and accomplishment of safe-shutdown conditions from outside the main control room (fire areas C-17 and C-25) could result in all 16 safety relief valves (SRVs) spuriously opening. Review of the licensee's current technical basis has raised issues pertaining to the ability of the operators to implement safe-shutdown requirements within the time-frame dictated by the thermal hydraulic plant changes this transient would induce. Additionally, calculations and documentation obtained from the licensee and reviewed by the team did not demonstrate that this capability would exist if the SRVs opened. The potential fire-induced spurious actuation of 16 SRVs caused by a postulated main control room fire could adversely impact the design of the alternative safe shutdown capability in that it could not meet the reactor performance goals specified in Section III.L of Appendix R . Specifically, the alternative shutdown system could not meet Appendix R Section III.L.1 in that it is not sufficient capacity and capability to mitigate the design basis transient conditions discussed in Generic Letter (GL) 86-10, the staff's Appendix R implementation guidance. Therefore, the RBS alternative shutdown capability was not capable of mitigating one worst-case spurious actuation transient that may be initiated by the fire (i.e. fire-induced spurious actuation of SRVs and concurrent loss of all automatic functions (e.g., no automatic initiation of EECS). Applying the GL 86-10 design basis transient performance criteria to the RBS alternative shutdown system design, the RBS design is not capable of meeting Section III.L.1 of Appendix R by maintaining reactor coolant inventory, achieving and maintaining hot shutdown, and maintaining the process variables within those predicted for a normal loss of a.c. power. In addition, the alternative shutdown capability deign was not capable of meeting Appendix R Section III.L.2 by maintaining the reactor coolant level above the top of the core. The associated SRV circuits of concern were not isolated from the affects of fire as specified by Appendix R Section III.L.7 such that a postulated fire would not prevent safe shutdown. (See Report Section F7.4, F7.6 and 7.7.)
  
  
• The licensee's method for identifying and protecting spurious equipment operations that may be induced by fire was found to differ significantly from that which was previously reviewed and inspected by the NRC in 1993 (Reference: NRC Inspection Report No. 93-09). Where the former approach relied on fire protection features (e.g., fire barrier wrap) to provide assurance that associated circuits of concern would remain free of fire damage, the licensee's revised approach relies on the performance of detailed analytical evaluations of potential cable damage and circuit faults that may be caused by fire. The inspection team noted weaknesses in the licensee's application of existing staff guidance regarding the performance of analytical evaluations of fire damage to unprotected cables. (See Report Section F7.6.)
  
  
• The licensee's evaluation criteria and methods for analyzing circuits of equipment for which spurious actuation could adversely affect post-fire safe-shutdown capability did not conform to the staff's Appendix R implementation guidance in GL 86-10, which specifies consideration of multiple circuit failures or faults such as hot shorts, open circuits, and shorts to ground. Consequently, the licensee's methodology for identifying circuits that can adversely affect post-fire safe shutdown capability may not provide the level of protection needed satisfy the licensee's commitment to meet Appendix R, Section III.G.2. (See Report Section F7.6.)
  
  
• For fire areas C2 and C6, a fire can cause the spurious operation of the SRVs and a demand for emergency core cooling system (ECCS). For fire areas C2 and C6, only one standby service water pump (SWP*P2A) is available to support safe-shutdown, and it is started by the ECCS signal. If the SRVs and a demand for ECCS happen before isolating or throttling non-safe-shutdown loads, such as reactor plant closed cooling water (RPCCW) heat exchangers, dry well coolers, containment unit coolers, and before flow is throttled to the residual heat remover (RHR) heat exchanger, in accordance with Abnormal Operating Procedure (AOP) 52, the standby service water pump may be damaged due to pump run out. In addition, the loss of this pump would cause the cascading loss of RHR pump A, emergency diesel generators (EDGs), and low-pressure core spray (LPCS) room coolers. This is an example of inadequate circuit analysis and its potential impact on the ability to achieve and maintain post-fire safe shutdown. Additionally, calculations and documentation obtained from the licensee and reviewed by the team did not adequately demonstrate that service water capability existed. (See Shutdown Report Section F7.7.)

ATTACHMENT 2

EXECUTIVE SUMMARY

Susquehanna Steam Electric Station
Fire Protection Functional Inspection Report 50-387/97-201 and 50-388/97-201

Susquehanna Steam Electric Station (SSES) is a dual unit station consisting of two General Electric boiling-water reactors (BWR Type 4) having Mark II containments. The rated output of Unit 1 is 1050 MWe and Unit 2 is rated at 1168 MWe. Unit 1 entered commercial operation in June 1983 and Unit 2 started in February 1985. During the weeks of October 20-24 and November 3-7, 1997, a team of Nuclear Regulatory Commission (NRC) and Brookhaven National Laboratory (BNL) engineers conducted a Fire Protection Functional Inspection (FPFI) at SSES. The NRC staff held the FPFI exit meeting with the licensee on November 7, 1997.

Section 50.48 of Title 10 of the Code of Federal Regulations (10 CFR 50.48) requires that all operating nuclear power plants have a fire protection plan that satisfies General Design Criterion (GDC) 3 of Appendix A of this part. Operating License NPF-14 (Unit 1) Condition 2.C (6) and NPF-22 (Unit 2) Condition 2.C(3) specify that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the Fire Protection Review Report (FPRR) for the facilities and as approved by the NRC Safety Evaluation Report (SER) dated August 9, 1989. The NRC based its approval of the SSES fire protection program on the licensee's commitment to follow the guidance of Appendix A to Branch Technical Position (BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, "Guidelines for Fire Protection for Nuclear Power Plants," and the licensee's commitment to meet Sections III.G, III.J., and III.L of Appendix R to 10 CFR Part 50.

While this inspection included a risk-informed evaluation of the fire protection program developed by the licensee, Pennsylvania Power and Light (PP&L), the inspection focused on assessing the fire safety factors at SSES Units 1 and 2 and the ability of each unit to achieve and maintain safe-shutdown conditions in the event of fire in any area of the plant.

Specific areas reviewed by the Fire Protection Functional Inspection team included:

• Compliance with Sections III.G, III.J, and III.L of Appendix R to 10 CFR Part 50 and the plant's ability to achieve, maintain, and implement the post-fire safe-shutdown capability.
  
  
• The adequacy of separation and/or protection provided for redundant trains of equipment and cables required to achieve and maintain safe-shutdown conditions in the event of fire.
  
  
• The scope of the analysis performed and the adequacy of protection provided for non-essential associated circuits of the plant's post-fire safe-shutdown capability.
  
  
• The post-fire alternative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
  
  
• Whether the plant fire protection program has been fully implemented and maintained in accordance with the guidance of Appendix A to BTP APCSB 9.5-1.
  
  
• The 10 CFR 50.59 change process as applied to the fire protection program and how the process assures the NRC-approved fire protection program is maintained.
  
  
• The ability to mitigate the consequences of a fire resulting from a plant event.

In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection program and licensee initiatives to implement improvements in state-of-the-art fire detection, control, and extinguishment technology.

Summary of Findings

The following items in the area of fire protection engineering and program implementation were identified during this inspection:

• During a plant walkdown, in the essential safeguards service water (ESSW) pump house, the team found that Nuclear Department Administrative Procedure (NDAP) NDAP-QA-0440, Rev. 2, "Control of Transient Combustible/Hazardous Materials," and NDAP-QA-0552, Rev. 1, "Transient Equipment Controls," were not fully implemented in that plant personnel failed to adequately control transient combustible materials and to perform the appropriate engineering evaluation on securing transient equipment to plant components or structures (see Report Section F1.1).
  
  
• The team found the fire brigade equipment disorganized and not ready to be rapidly transported to the fire scene and promptly deployed. Problems with equipment logistics and deployment could affect the fire brigade's ability to control and extinguish a fire in a timely manner. The team also noted that the licensee has prohibited the use of fire fighting foam on site and considers this a weakness. In the event of a fire involving flammable or combustible liquids, the use of fire fighting foam can improve manual fire control and extinguishment effectiveness and at the same time provide re-flash protection to fire brigade personnel (see Report Section F2.1.1).
  
  
• The team observed a fire brigade unannounced drill. This drill scenario was a fire in the B diesel generator room. Since the diesel generators are accessed from the outdoors, the fire brigade van was used to provide support equipment. It took the brigade 23 minutes to get ready and into position with a hose line to enter the diesel generator room. A critique was held immediately after the drill. The most significant issue identified during the critique was that the brigade leader couldn't understand the transmissions from personnel wearing self-contained breathing apparatus (SCBAs). After the critique, the team noted the extensive amount of time required for the first hose team to reach the fire area and the general uninterested attitude exhibited by the brigade members (see Report Section F3.3).
  
  
• The team noted that the Nuclear Training Department does not track the physical (medical) examinations of the fire brigade members. However, if a physical is overdue, the member's name appears on the monthly fire brigade report. Operations Department had changed over to biennial physicals for fire brigade members in 1995. The entire operations fire brigade complement received its first biennial physicals in 1996. The team pointed out that the NDAP-QA-0445 requirements still called for annual physicals and the basis for this change was questioned. The change to biennial fire brigade physical examinations does not satisfy the medical criteria established by industry standards and NRC fire protection program guidelines or requirements for the fire brigade members to have annual physical examinations, as established by plant procedure NDAP-QA-0445 (see Report Section F4.1).
  
  
• The team's review of the depth and scope of the fire protection program audits determined that they did not fully assess compliance with Appendix R. The 1994, 1995, and 1996 fire protection program audits did not perform audit samples in the following areas: design basis reverification of plant fire protection features; reverification of the fire-induced electrical fault evaluation and the electrical-engineering aspects of Appendix R (e.g., fuse breaker coordination, common enclosure, spurious equipment operations); reverification of systems and logic used to support the safe-shutdown methodology and the fire protection features for those systems; reverification and evaluation of operational implementation of the safe-shutdown analysis; evaluation of major plant modifications for potential impact on the plant fire protection program and/or the plant safe-shutdown analysis (see Report Section F5.2).
  
  
• The licensee's off-normal (ON) procedure ON-037-001 states that the condensate transfer system (CTS) or other method of maintaining keepfill is required for high-pressure core injection (HPCI), reactor core isolation cooling (RCIC), the core spray system (CSS), and residual heat removal (RHR) to prevent water hammer in the discharge piping. The CTS and the cross-tie to the demineralized water system alternative keepfill scheme are not powered from a 1E bus, which would make them unavailable during a fire event that causes the loss of offsite power (LOOP). Since normal methods of maintaining keepfill were not credited by SSES for post-fire safe shutdown, the team noted that the loss of this capability may result in excessive water hammer in required shutdown systems. To preclude such an occurrence, PP&L has developed an alternate keepfill scheme which involves the installation of a temporary cross-tie, using a hose to supply water from the fire water system to the CTS. Since this scheme involved manual actions with staged equipment, the licensee was asked to demonstrate the scheme's feasibility. During the team's walkthrough of the procedure, tools and equipment required to make the connection between the CTS and the fire water system were not available. Additionally, the team noted that the emergency lighting in the area where actions were to be performed did not appear to be sufficient (see Report Section F6.1.1).
  
  
• The licensee was granted an exemption to use an automatic depressurization system/core spray (ADS/CS) shutdown methodology in lieu of an RCIC/HPCI high-pressure methodology. The acceptance of this method was based on the licensee's claim that this low-pressure methodology did not allow the reactor pressure vessel (RPV) water level to go below top of active fuel (TAF). In EC-013-0843 (pg. 70), the licensee stated that spurious safety relief valve (SRV) opening from fire-related damage could cause the RPV water level to go below TAF. Additionally, in calculation EC-013-0509, "Minimum Reactor Water Level Under Spurious SRV Operation During a Control Room Fire," Rev. 1, dated July 7, 1994, the licensee did a thermal-hydraulic analysis and found that the spuriously opening one or two SRVs would cause the RPV water level to go below TAF (see Report Section F6.1.1).
  
  
• The licensee's off-normal procedures (ONs) for post-fire safe shutdown are symptom based. These procedures direct the operators to use other off-normal and emergency operating procedures (EOPs), depending on the availability of plant equipment. However, these other procedures do not take into account the impact of fire damage, including the potential for fire-induced spurious signals on shutdown systems. For example, the normal shutdown procedures would not contain cautions on the possibility that hot shorts could change valve positions or give the operators false instrumentation readings. In reviewing the licensee's procedures for implementing a safe shutdown of the plant following a fire in plant areas not requiring main control room (MCR) evacuation, the team found that preferred instrumentation and equipment that would be free of fire damage was not identified by the safe-shutdown procedures by fire area or fire zone, although this information was available in the licensee's safe-shutdown analysis (SSA). These procedures did not provide guidance regarding the manual operator actions which may have to be performed for specific fire area or zones in order to implement post-fire safe shutdown. Depending on the location of the fire, the licensee's SSA requires different post-fire safe shutdown manual actions to be performed for different fire areas (see Report Section F6.2.1).
  
  
• The team verified that RPV level and temperature instruments identified in the EOPs are not necessary to satisfy a literal interpretation of Appendix R requirements and staff guidance and that failure to perform repair activities specified in procedure would not preclude the ability to achieve and maintain post-fire safe shutdown (PFSSD). However, from discussions with plant operators it appears that the availability of these instruments would significantly enhance the shutdown capability. As a result it is expected that during a fire event operators would request plant instrumentation and control (I&C) technicians to perform the repair activities as specified in the procedure. Based on a walkdown of procedural actions necessary to perform the repairs, it was determined that actions necessary to install the temporary RPV temperature indication were not feasible; technicians would need to erect scaffolding, and work in a high-radiation area (straddling a RHR line that is approximately 20 off the floor). In addition, there was no emergency lighting, and equipment and tools necessary to perform repairs were not dedicated for use (see Report Section F6.2.2) .
  
  
• The team identified issues associated with the installed fire detection system and its ability to meet the minimum installation criteria established by the applicable National Fire Protection Association (NFPA) code of record (COR). High ceilings, deep beam pockets, and detector spacing limitations should be considered simultaneously in establishing the limiting parameters of the system design. Evaluating one parameter, without considering the others, will give a false impression of the design. The licensee could not adequately demonstrate that the fire detection system in the areas inspected met minimum industry fire protection codes. Specifically, the licensee could not demonstrate that the design considered all environmental and physical aspects of the installation including, but not limited to high ceilings, effects of the ventilation system on smoke movement, obstructions, and beam pocket ceiling construction (see Report Section F6.4.1).
  
  
• The team identified plant conditions that could affect the ability of the sprinkler system to react to a fire. The team concluded that certain sprinklers systems installed at SSES exhibited weaknesses in meeting the NFPA COR. Specifically, the COR guidance pertaining to the placement of sprinkler heads, sprinkler head coverage, and obstructions to the area of coverage (see Report Section F6.4.3).
  
  
• From its review of CO₂ suppression systems installed at SSES, the team concluded that these systems, because of the lack of appropriate pre-operational system discharge testing, might not be capable of performing their intended fire control function. In addition, because of the licensee's concern about thermal shock to electrical equipment, the team concluded that the application of these systems might not meet the intent of GDC 3, "Fire Protection," of Appendix A to 10 CFR Part 50 (see Report Section F6.4.4).
  
  
• The team performed a walkdown of the standpipe hose stations in the control building. SSES uses a Class II system as defined by the NFPA COR. The NFPA COR states: "The number of hose stations for Class II service in each building and each section of a building divided by fire walls shall be such that all portions of each story of the building are within 30 feet of a nozzle when attached to not more than 100 feet of hose." During the week of October 27, 1997, PP&L personnel walked down additional hose stations and found that the hose strainers did not meet the licensing and design basis because they could not provide the required area of coverage with the allotted 100 of hose (see Report Section F6.4.5).
  
  
• During the team's walkdown of emergency lighting, the licensee could not demonstrate that adequate emergency lighting existed for supporting the following post-fire safe shutdown operations: (1) checking the reactor water cleanup system (RWCU) equipment for leakage, (2) opening breaker 1Y219-018 to stop RWCU leakage or diverting reactor water to radwaste or the condenser via RWCU, and (3) closing flow control valve HV-243-F023A at motor control center 2B237043. In addition, the required emergency lighting units (ELUs) in the E diesel generator building were not receiving appropriate testing and maintenance (see Report Section F6.5.1).
  
  
• The team identified several weaknesses with the Individual Plant Examination of External Events (IPEEE) fire analysis and its assumptions: (1) large fires due to combustibles allowed by administrative limits are not modeled, (2) the cable spreading room has been omitted from the analysis as lacking combustibles even though cables in the cable spreading room are combustible and transient combustibles are allowed in the room by procedure, and (3) cabinet 1C601, the emergency core cooling system (ECCS) cabinet in the control room, has penetrations between cabinet sections and can potentially be damaged in a single fire (see Report Section F6.6).

Strengths / Positive Observations

• The PP&L technical personnel supporting the inspection exhibited a great deal of interest in and knowledge of the fire protection features and post-fire safe shutdown capability of SSES. Additionally, the team found licensee representatives to be candid, clear, and informative. They were professional and knowledgeable of NRC fire protection regulations and guidance and the corporate history of the development of the SSES fire protection program. The plant's fire protection features and post-fire safe-shutdown capability. The high quality of the licensee's technical, operations, and management organizations responsible for ensuring the post-fire safe-shutdown capability of SSES was viewed as a major strength by the team.
  
  
• The scope and depth of the training program for operators at SSES was observed to be good. This observation was supported by the simulator demonstration that was carried out by the "shift in training" for an MCR fire scenario.
  
  
• The techniques developed for aiming the emergency lighting units and maintaining the proper aim were good. The aiming markings on the units and their lamp receptacles were easily identifiable and supported the ready verification of proper aim.
  
  
• PP&L identified the fire-resistive limitations of its Kaowool raceway fire barrier systems and initiated a proactive response to the technical concerns (e.g., thermal performance limitations). PP&L has included these barrier systems in the scope of its Thermo-Lag resolution program.
  
  
• The licensee implemented the necessary plant modifications to its essential post-fire safe-shutdown-related motor-operated valves (MOV) eliminating the fire-induced spurious actuation and the resulting valve control and functional operation concerns.

ATTACHMENT 3

EXECUTIVE SUMMARY

St. Lucie Units 1 and 2
Fire Protection Functional Inspection
Report 50-335/98-201 and 50-389/98-201

St. Lucie Units 1 and 2 are two separate nuclear power plants of a similar design that share a common site. Both units are Combustion Engineering pressurized-water reactors and each unit has a rated output of 890 MWe. St. Lucie Unit 1 began commercial operation in December 1976 and Unit 2 in August 1983. During the weeks of March 9-13 and March 30-April 4, 1998, a team of U.S. Nuclear Regulatory Commission (NRC) inspectors and Brookhaven National Laboratory engineers conducted a Fire Protection Functional Inspection (FPFI) at the St. Lucie Plant (PSL).

In February 1997, the NRC informed the licensee, Florida Power and Light (FPL) Company, of its intent to perform an FPFI at Unit 1. In a letter dated December 15, 1998, FPL requested the NRC to delay the FPFI planned for March of 1998 and reschedule it to the June-July 1998 time frame. The NRC denied this request and, in a letter dated January 14,1998, advised FPL that it would conduct the FPFI as scheduled. Subsequent to the February 1997 notification, as documented in licensee-identified condition reports (CRs) reviewed during the inspection, FPL had initiated a comprehensive re-evaluation of its fire protection program for both units and a revalidation of the Unit 1 SSA (Document No. 8770-B-048, Revision 3, dated February 13, 1986) and Volume 9.5A of the UFSAR. This effort resulted in the generation of a significant number of CRs related to the fire protection program and post-fire safe-shutdowns. In response to these various fire protection/post-fire safe shutdown program weaknesses, FPL instituted compensatory measures.

Although this inspection included a risk-informed evaluation of the fire protection program developed by FPL, the inspection team focused on assessing the fire protection defense-in-depth at Unit 1 and the plant's ability to achieve and maintain post-fire safe-shutdown conditions in the event of a fire in any area of the plant. This inspection consisted of a comprehensive evaluation of the fire protection program, fire safety features, and the post-fire safe-shutdown capability developed by FPL for Unit 1 as required by Section 50.48 of Title 10 of the Code of Federal Regulations (10 CFR 50.48).

Section 50.48 requires that all operating nuclear power plants have a fire protection plan that satisfies General Design Criterion (GDC) 3 of Appendix A to Part 50. The PSL fire protection program requirements are established by Unit 1 Operating License DPR-67, Condition 2.C(3), and Unit 2 Operating License NPF-16, Condition 2.C.20. These operating license conditions specify that FPL implement and maintain in effect all provisions of the NRC approved fire protection program as described in the Updated Final Safety Analysis Report (UFSAR) for the facilities and as approved by various NRC Safety Evaluation Reports (SERs). Since Unit 1 was licensed to operate prior to January 1, 1979, it is required to meet Sections III.G, III.J, and III.O of Appendix R to 10 CFR Part 50

Specific areas reviewed by the FPFI team included the following:

• The licensee's compliance with Sections III.G, III.J, and III.O of Appendix R to 10 CFR Part 50.
  
  
• The adequacy of the licensee's separation and/or protection provided for redundant trains of equipment and cables required to achieve and maintain safe-shutdown conditions in the event of fire.
  
  
• The scope of the analysis performed by the licensee and the adequacy of the protection provided for non-essential associated circuits that can prevent the operation or cause the mal-operation of the plant's post-fire safe-shutdown capability.
  
  
• The licensee's post-fire alternative shutdown analysis methodology and the adequacy of procedures developed to implement this methodology.
  
  

• Whether the plant's fire protection program has been fully implemented and maintained in accordance with the plant's Operating License.
  
  

• The 10 CFR 50.59 change process as applied to the fire protection program and how the process ensures that the NRC-approved fire protection program is maintained.

In addition, the FPFI team reviewed fire safety considerations that are not expressly addressed by the fire protection regulation. For example, the team assessed the plant fire protection program and the licensee's initiatives to implement improvements in state-of-the-art fire detection, control, and extinguishment technology.

Summary of Findings

The licensee's administrative combustible control procedures adequately implemented the approved fire protection program. Implementation of the fire inspection program by the Protection Services Department was good; however, the various plant departments had not consistently implemented their responsibilities, as specified by these procedures, for the control of combustible fire hazards. The plant departments' implementation of the combustible control procedures and operational practices were not consistent with the PSL fire protection program in that plant personnel failed to follow combustible control procedures used to manage temporary storage of transient combustibles in safety-related areas. This failure to follow the combustible control procedures which manages the use and temporary storage of transient combustibles in safety-related areas was identified as an unresolved item (see Section F1.1).

Backup (emergency) lighting was not provided by the licensee for the fire brigade equipment and dressout lockers. This situation, under certain conditions, could delay the response of the fire brigade and the logistics for deployment of its equipment. This was considered an area requiring licensee attention. The licensee evaluated this situation during the inspection and took corrective actions to establish backup lighting in these areas. Also, during the fire brigade drill, the team noted that the personal protective firefighting equipment provided to the brigade and used to cope with onsite fire emergencies did not provide the level of safety needed to protect fire brigade members from being exposed directly to the hazards associated with interior firefighting (see Section F2.1.1).

Generally, the licensee's fire protection surveillance and inspection requirements (for fire protection systems selected by the team) were found to be satisfactory and properly implemented. However, two examples of fire protection surveillance program problems were identified during the inspection: (1) the failure to include any administrative requirements governing surveillance testing, operability, and compensatory measures for the Appendix R post-fire safe-shutdown equipment and features in the fire protection program, and (2) the failure of the fire hose station surveillance program to confirm coverage in accordance with requirements of the UFSAR. These examples are considered to be failures of the licenses's fire hose station surveillance program to confirm hose station coverage in accordance with the UFSAR and have been identified as an unresolved item (see Section F2.2).

The licensee has developed firefighting strategies for all Unit 1 and Unit 2 fire areas. However, these strategies, which provide important fire and smoke control information to the fire brigade, do not reflect (1) manual actions to ensure ventilation requirements as specified by the SSA, (2) radiological controls for firefighting water runoff, and (3) manual smoke removal methods for maintaining the post-fire operator habitability of shutdown-related spaces adjacent to the fire area of concern. These are examples of a failure to update the firefighting strategies to reflect the requirements of the approved fire protection plan and Appendix R. This has been identified as an unresolved item (see Section F3.1).

The team noted that the fire brigade did not fully use the self-contained breathing apparatus (SCBA) during the drill. The partial use of the SCBA did not expose the fire brigade personnel to the stresses and limitations created by its full use. The team concluded that the importance of the full use of the SCBA was not recognized. This has been identified as a failure to perform fire brigade drill in accordance with the requirements of the approved fire protection program and Appendix R. This has been identified as an unresolved item (see Section F3.3).

On the basis of a review of the PSL Fire Protection Plan and its referenced procedures, the team determined that no specific criteria or guidelines had been established for determining when either the plant fire protection or the post-fire safe-shutdown features are inoperable or outside their design basis. In addition, the plan does not establish controls that govern the operability or availability of post-fire safe-shutdown equipment such that power operations can be conducted with the assurance that a train of systems needed for safe-shutdown will be free of fire damage, or when conditions of inoperability exist, the plan does not ensure that appropriate measures have been established to compensate for the post-fire safe-shutdown system deficiency. The fire protection plan failed to address Appendix R post-fire safe-shutdown capability and govern its operability. This has been identified as an unresolved item (see Section F5.1).

On the basis of a review of the PSL Fire Protection Plan and the licensee's identified weaknesses associated with the SSA and its translation into post-fire safe-shutdown procedures and operator actions, it was not clear who was fundamentally responsible for overall compliance with fire protection requirements. This lack of program ownership was viewed by the inspection team as a significant contributor to the fire protection and post-fire safe-shutdown program weaknesses identified by the PSL reevaluation (see Section F6.2).

The Quality Assurance Department at PSL has been conducting detailed, critical, and insightful quality assurance audits in the fire protection and post-fire safe-shutdown areas. On the basis of Nuclear Quality Assurance Report 98-0141, PSL made a change to its procedures to ensure proper characterization of problems (as findings rather than technical recommendations) and automatic entry of those problems into a system structured to result in timely corrective action. The inspection team recognized that the effort of the PSL Quality Assurance Department since 1995, to identify problems in the fire protection/post-fire safe-shutdown area is a notable strength. However, this strength has been diminished by slow corrective action on the part of the PSL Engineering Department. Failure to conduct timely corrective actions for identified post-fire safe-shutdown procedural deficiencies has been identified as an unresolved item (see Section F6.3).

The lack of onsite Appendix R fire protection engineering expertise in the PSL Engineering Department has become apparent to the team. This was supported by the identified concerns in the modification review process to focus on maintaining the post-fire safe-shutdown design. This was identified as an area where further program performance improvements could be made (see Section F6.4).

Section III.L of Appendix R to 10 CFR Part 50 states that support functions shall be capable of providing the process cooling necessary to permit the operation of equipment used for safe-shutdown functions and that alternative shutdown capability shall accommodate post-fire conditions when offsite power is and is not available for 72 hours. Not including heating, ventilation, and air conditioning for the hot-shutdown control panel room represents a lack of incorporation of Appendix R fire effects in the safe-shutdown required analyses This is an example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.1).

For the sample of circuits selected by the team for review during the inspection, the FPFI team found that the level of protection provided for redundant trains of post-fire shutdown systems did not satisfy the technical requirements of Sections III.G and III.L of Appendix R to 10 CFR Part 50. Specifically, a fire in Fire Zones 57 (the cable spreading room), 70 (control room), 55W, or 27 may initiate spurious valve operations that could adversely affect the post-fire safe-shutdown capability. The FPL/PSL safe-shutdown reevaluation has identified instances in which equipment relied on to achieve and maintain safe-shutdown conditions may not have been capable of performing its intended post-fire safe-shutdown function due to (1) inadequate fire protection (charging pump 1A, and lack of radiant energy shields in containment), (2) inadequate separation distances (cables in containment), or (3) SSA deficiencies (Fire Area J and the effect of fire on non-credited equipment). This is another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.2).

On the basis of a sample of circuits, the team concluded that the FPL evaluation of circuit breaker, relay, and fuse coordination for low-impedance faults satisfied Section III.G of Appendix R to 10 CFR Part 50. However, the licensee had not developed a controlled procedure to govern the replacement of fuses. Additionally, the licensee's reliance on generic procedural guidance that directed operators to restore operability of power sources that may be lost as a result of fire-induced high-impedance faults did not satisfy Section III.G of Appendix R or the guidance contained in Generic Letter 86-10. In response to the team's findings regarding "time critical" alternative shutdown loads, the licensee has developed operator actions to prevent the loss of power sources whose operation is immediately required to support the accomplishment of alternative shutdown from outside the main control room. This is another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.5).

The licensee's analysis and method of protection for fire-induced spurious equipment operations does not satisfy 10 CFR Part 50, Appendix R, Section III.G or III.L. Specific deficiencies include (1) an analysis methodology that assumed only one spurious operation would occur as a result of fire in any area without any further consideration of the number, type, or specific location of potentially affected cables and circuits; (2) a potential for fire to cause a breach of pressurizer power-operated relief valve and reactor coolant system gas vent system high/low-pressure interface boundaries; (3) lack of an analysis of the effect of fire on instrument sense lines; and (4) inadequate evaluation of the potential for fire to cause damage to motor-operated valves relied on to accomplish post-fire safe-shutdown functions as described in Information Notice 92-18. These are additional examples of failures of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.1.5).

Post-fire safe-shutdown procedures 1-ONOP-100.01 and 1-ONOP-100.02 exhibited omissions in that they did not properly address isolation of the main feedwater system and its regulating valves, the main steam bypass valves, and the reactor head vent valves. This was identified as an area where procedure enhancements could decrease the likelihood that fire induced electrical failures could affect shutdown implementation (see Section F7.2.1).

FPL Thermo-Lag fire testing demonstrated that the upgraded fire wall would provide a fire-resistive rating for 1-hour and 48 minutes. However, this qualification rating may be questionable considering the failed hose stream testing. The FPL engineering evaluation of the cable loft wall could not adequately demonstrate to the team that it could protect one train of post-fire safe-shutdown capability and keep it free from fire damage. In the case of the Unit 1 cable loft, the evaluation was further weakened by the lack of any automatic fire suppression. This issue was considered significant since the Thermo-Lag fire wall was not designed or rated to bound the in situ fire loading and the lack of diverse fire protection (i.e., no automatic sprinklers installed in the area). These fire barriers walls are not qualified to meet the plant's licensing basis and the requirements. This has been identified as an unresolved item (see Section F7.3.1).

FPL's identification of detection system design errors and deficiencies was appropriate. Before this identification was made, the team noted numerous missed opportunities (e.g., main control room ceiling tiles, annunciator level) to recognize problems associated with the detection system. In addition, it was not clear that the licensee has demonstrated that the system design deficiencies will not have an impact on the system's defense-in-depth ability to rapidly detect a fire. This is an example of design condition where a fire mitigation system design does not meet plant licensing basis requirements or commitments to minimum industry codes and standards and is identified as an unresolved item (see Section F7.4.1).

FPL's procedures for testing the preaction sprinkler system's deluge valve do not meet the National Fire Protection Association Standard 25 or the vendor's requirements for testing the automatic water-based fire suppression systems. This is an example of a design condition where a fire mitigation system does not meet plant licensing basis requirements or commitments to minimum industry codes and standards for system testing. This has been identified as an unresolved item (see Section F7.4.3).

The results of the licensee's recent self-assessment identified problems with the Unit 1 cable spreading room Halon 1301 system. However, the question of the minimum required concentration and the minimum soak time has not been addressed by the licensee. The licensee considers the system to be "operable;" however, the licensee could not produce design-basis tests for the concentrations and soak times of the system, nor could it demonstrate operability to the inspectors. This issue was considered significant since the system was not designed to extinguish the expected hazard (i.e., a "deep-seated" cable fire). This is another example of a design condition where a fire mitigation system design does not meet plant licensing basis requirements or commitments to minimum industry codes and standards and has been identified as an unresolved item (see Section F7.4.4).

Problems were discovered by FPL with the standpipe and hose stations. All areas of the plant are required to have a minimum of two hose stations accessible to them. These problems have not been addressed by the licensee and was considered significant since the "primary protection" hose stations have been determined to possess certain design weaknesses. This issue brings into question the ability of the "backup" hose station (i.e., second hose station) to provide adequate coverage. This is another example of a condition where a fire mitigation system design does not meet plant licensing basis requirements or commitments to minimum industry codes and standards. This has been identified as an unresolved item (see Section F7.4.5).

The licensee found that the oil collection system for the reactor coolant pumps was not catching and collecting oil leaking from the reactor coolant pump motor's lubrication system as required by 10 CFR Part 50, Appendix R, Section III.O. This is another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.4.7).

As part of its ongoing safe-shutdown analysis revalidation effort, FPL has identified deficiencies in Appendix R emergency lighting and the post-fire safe-shutdown communications system. This is identified as another example of a failure of the fire protection program and post-fire safe shutdown analysis to demonstrate compliance with Appendix R. This has been identified as an unresolved item (see Section F7.5).

As result of the fire protection program and post-fire safe shutdown discrepancies identified by the FPL re-evaluation program, FPL established compensatory measures in the Reactor Auxiliary Building (RAB). A 30-minute roving fire watch patrol was established throughout the RAB. At the time of this inspection, the licensee was in the analysis and discovery mode of its re-evaluation and had not fully determined the scope of the corrective actions needed to

resolve the fire protection program and post-fire safe shutdown discrepancies. The compensatory measures and their adequacy to compensate for the known program discrepancies will be routinely reviewed by the licensee and revised as necessary to assure an adequate level of fire safety is being maintained.

In response to the fire protection issues or concerns arising from this inspection and FPL's re-assessment program, the licensee implemented compensatory measures in addition to those that it had established prior to the FPFI. The purpose of the compensatory measures was to further reduce the likelihood of potential fire hazard conditions and to provide reasonable assurance that prompt fire mitigation measures could be taken in the event of a fire. On the basis of all the fire protection issues, the licensee implemented the following additional compensatory measures for the Unit 1 "A" cable loft penetration room:

1. Fire doors for the "A" cable loft penetration room extension were closed.
   
   
2. Direction was given to PSL Construction Department to halt further removal of Thermo-Lag panels pending approval by the Engineering Department.
   
   
3. Fire Protection and Operations directed that no new fire breach impairments be implemented without engineering approval.
   
   
4. FPL temporarily installed additional firefighting equipment at strategic locations to enhance firefighting capabilities for the cable loft.
   
   
5. PSL Engineering Department provided a drawing depicting Thermo-Lag fire barriers and gave the location of supplemental firefighting equipment to the Nuclear Plant Supervisor to enhance fire brigade awareness.
   
   
6. A continuous roving fire watch will be established in the area where work is being performed.
   
   
7. Fire barrier breach permits have been placed under control of the Engineering Department.

The team concluded that these additional compensatory actions, in addition to those FPL had implemented prior to the FPFI, were adequate and provide the assurance needed to further reduce the likelihood that a potential fire hazard conditions will exist or that prompt fire mitigation measures could be taken in the event a fire were to occur in the various RAB fire areas of concern.