Thirty-three Years of Regulating Fire Protection at Commercial U.S. Nuclear Power Plants: Dousing the Flames of Controversy**

With USNRC approval, Tennessee Valley Authority restarted BF-1 on May 22, 2007, after a 22-year shutdown. It is currently licensed to operate through 2033.

Appendix A to BTP APCSB 9.5-1 provides USNRC staff guidance and should not be confused with Appendix A to 10 CFR 50 which established the requirements of GDC 3.

“[W]here cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of the following means of ensuring that one of the redundant trains is free of fire damage shall be provided: [a] Separation of cables and equipment and associated non-safety circuits of redundant trains by a fire barrier having a 3-h rating. Structural steel forming a part of or supporting such fire barriers shall be protected to provide fire resistance equivalent to that required of the barrier; [b] Separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 ft with no intervening combustible or fire hazards. In addition, fire detectors and an automatic fire suppression system shall be installed in the fire area; or [c] Enclosure of cable and equipment and associated non-safety circuits of one redundant train in a fire barrier having a 1-h rating, In addition, fire detectors and an automatic fire suppression system shall be installed in the fire area” [7].

Exemptions to USNRC regulations are submitted and approved in accordance with 10 CFR §50.12, “Specific Exemptions” [13].

A draft report from two national laboratories in support of the USNRC (K. Sullivan and S. Nowlen, "Guidance for Post-Fire Safe-Shutdown Analysis," USNRC JCN J2844 [December 2002]) offered the following definition for an adverse effect: "An undesired change in the operation or functional integrity of structures, systems, or components. Adverse effects may occur as a result of exposure to the effects of fire (i.e., heat or smoke) and/or fire-suppression activities." Regulatory Guide (RG) 1.189 states that, "[w]ithin the context of the standard fire protection license condition, the phrase ‘not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire,' means to maintain sufficient safety margins" [14]. RG 1.174 defines maintaining sufficient safety margins as: "[1] codes and standards or their alternatives approved for use by the NRC are met; or [2] safety analysis acceptance criteria in the licensing basis ... are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty" [15]. Nonetheless, without a quantitative specification, this still leaves room for subjective interpretation.

The scope of GL 92-08 was not limited only to the T-Lag ERFBS. As stated there, "[t]he NRC staff will evaluate other fire barrier materials and systems used by the licensees to satisfy the NRC's requirements. If the staff finds concerns, it will address them through appropriate communications ... [T]he staff expects that the recipients of this generic letter will review the information to determine if it applies to other barrier materials and systems used at their facilities and consider actions, as appropriate, to avoid similar problems" [19]. On May 28, 1993, the USNRC issued IN 93-41 informing licensees of potential concerns with the qualification tests for other ERFBSs, specifically Kaowool^®, 3M FS-195^® and 3M Interam E-50^® [20].

A hot short is defined in NUREG/CR-6850 as a "conductor-to-conductor short in which an energized conductor (source conductor) shorts to a separate, ungrounded conductor (target conductor)[, ...] characterized by an abnormal connection between conductors that does not produce a high fault current because of inherent impedance in the connection path attributable to circuit components" [23].

Remote or alternate shutdown is another provision of 10 CFR §50.48, Appendix R, namely Paragraph III.G.1, “Fire protection features shall be provided for structures, systems, and components important to safe shutdown. These features shall be capable of limiting fire damage so that: [a] One train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage; and [b] Systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired within 72 h;” or Paragraph III.G.3, “Alternative or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area, room, zone under consideration should be provided: [a] Where the protection of systems whose function is required for hot shutdown does not satisfy the requirement of Paragraph G.2 of this section; or [b] Where redundant trains of systems required for hot shutdown located in the same fire area may be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. In addition, fire detection and a fixed fire suppression system shall be installed in the area, room, or zone under consideration” [7].

Fire PRA techniques for NPPs originated as early as 1975, when an analysis of the potential frequency for core damage due to the BF-1 fire was incorporated into Appendix XI, “Analysis of Comments on the Draft WASH-1400 Report,” of the “Reactor Safety Study” (WASH-1400) [27]. Other early analyses followed, especially: (1) UCLA-ENG-7748, “Some Aspects of the Fire Hazard in Nuclear Power Plants;” (2) GA-A15402, a Fire PRA for a high-temperature gas-cooled reactor by General Atomic Co.; (3) “Fire-Induced Loss of Nuclear Power Plant Safety Functions,” based on a doctoral thesis at Rensselaer Polytechnic Institute; and (4) the then state-of-the-art PRAs for the Indian Point and Zion NPPs, which performed fire modeling using the COMPBRN computer code developed at the University of California at Los Angeles [28‐33].

LERs are submitted in accordance with 10 CFR §50.73, “Licensee Event Report System,” whereby “[t]he holder of an operating license ... for a nuclear power plant (licensee) shall submit a Licensee Event Report (LER) for any event of the type described in this paragraph within 60 days after the discovery of the event ... if it occurred within 3 years of the date of discovery regardless of the plant mode or power level, and regardless of the significance of the structure, system, or component that initiated the event” [38].

Discussed later in this article are two additional guidance documents, RIS 2005-30 and GL 2006-XX, that were also developed to provide guidance for the resumed circuit inspections by differentiating between compliance and inspection focus based on risk.

NFPA 805 is discussed in detail later in this article.

The ensuing rulemaking is discussed in detail later in this article.

The FP SDP categorizes a “performance issue that leads to an increase in core damage frequency (ΔCDF) larger than [or equal to] 1E-4/ry [one per ten thousand reactor-years] ... [as] risk significant and therefore the highest risk category (red).” In practice, any performance issue where ΔCDF ≥ 1E-6/ry (one per million reactor-years) is considered, at least potentially, “risk significant” [49].

A Fire PRA builds on a traditional “internal events” PRA by introducing fire-induced effects, including those on initiating events, into the logic model for systems, structures and components, including human actions, that can randomly fail such that core damage ensures. NUREG/CR-6850 identifies 16 tasks for performing a Fire PRA, as follows: (1) plant boundary definition and partitioning; (2) fire PRA components selection; (3) fire PRA cable selection; (4) qualitative screening; (5) fire-induced risk model; (6) fire ignition frequencies; (7) quantitative screening; (8) scoping fire modeling; (9) detailed circuit failure analysis; (10) circuit failure mode likelihood analysis; (11) detailed fire modeling; (12) post-fire human reliability analysis; (13) seismic-fire interactions assessment; (14) fire risk quantification; (15) uncertainty and sensitivity analyses; (16) fire PRA documentation. Supporting analyses include performance of plant walkdowns and development of a fire PRA database system [23].

"Those noncompliances must be entered into the licensee's corrective action program, must not be associated with findings that the Reactor Oversight Process Significance Determination Process would evaluate as Red [‘a performance issue that leads to an increase in core damage frequency (ΔCDF) larger than [or equal to] 1E-4/ry,’ i.e., one per ten thousand reactor-years], or would not be categorized at Severity Level l [‘most significant ... escalated enforcement actions ... with actual or high potential to have serious consequences on public health and safety or the common defense and security’], and appropriate compensatory measures have been taken."

The interim enforcement "will continue to be in place, without interruption, until NRC approval of the license amendment request to transition to 10 CFR §50.48(c)," i.e., it may extend beyond the 3-year period. Originally, the interim enforcement period was limited to 2 years [60]. In February 2007, the NEI “respectfully request[ed that] the current enforcement policy and discretionary period be reconsidered to provide a more orderly licensee transition process ... [by] stagger[ing] the LAR [license amendment request] submittals into four groups over a period of 24 months after the first pilot plant SER is issued.” The NEI cited “concerns related to the resource challenges needed to support the transition effort. These staffing concerns arise in three primary areas: [1] PRA Support ...; [2] General Staff Support ...; and [3] NRC Review.” The NEI request is currently under consideration [61].

A Regulatory Analysis is “[a structured evaluation of all relevant factors associated with a regulatory decision] to help ensure the following: [1] The NRC’s regulatory decisions made in support of its statutory responsibilities are based on adequate information concerning the need for and consequences of proposed actions; [2] Appropriate alternative approaches to regulatory objectives are identified and analyzed; [3] No clearly preferable alternative is available to the proposed action; [and 4] Proposed actions subject to the backfit rule (10 CFR 50.109), and not within the exceptions at 10 CFR 50.109(a)(4), provide a substantial increase in the overall protection of the public health and safety or the common defense and security and that the direct and indirect costs of implementation are justified in view of this substantial increase in protection” [69].

10 CFR §50.109(a)(1) defines backfitting as “the modification of or an addition to systems, structures, components, or design of a facility; or the design approval or manufacturing license for a facility; or the procedures or organization required to design, construct or operate a facility; any of which may result from a new or amended provision in the Commission rules or the imposition of a regulatory staff position interpreting the commission rules that is either new or different from a previously applicable staff position” [71].

A draft report from two national laboratories in support of the USNRC (K. Sullivan and S. Nowlen, "Guidance for Post-Fire Safe-Shutdown Analysis," USNRC JCN J2844 [December 2002]) attempted to define "any-and-all/one-at-a-time" to convey the intent that "[a]ll potential spurious actuations that may occur as a result of fire in a single fire area must be addressed and either prevented or the effects of each actuation appropriately mitigated on a one-at-a-time basis. That is, ... the analyst must assume that ‘any and all’ spurious actuations that could occur, will occur, on a sequential, one at-a-time, basis. Therefore, for each fire area, all potential spurious operations that may occur as a result of a postulated fire should be identified. While it is not assumed that all potential spurious actuations will occur instantaneously at the onset of fire, the analyst must consider the possibility for each spurious actuation to occur sequentially, as the fire progresses, on a one-at-a-time basis." If not appropriately prevented or mitigated, such sequential failures could result in concurrent failure of multiple devices. From this definition, it is conceivable that the need to address concurrent, non-mitigated MSAs could get lost in translation.

The preceding responses from GL 86-10 were provided in relation to questions regarding "safe shutdown and fire damage" in the context of "alternative and dedicated shutdown capability," as discussed in Appendix R, Paragraph III.G.3 In RIS 2005-30, the USNRC states that "unless protection is provided in accordance with [Paragraph] III.G.2, it is generally agreed that in a deterministic approach to fire protection, such as the approach required by Appendix R, a fire is assumed to damage all circuits and equipment in a fire area. Therefore, any and all other post-fire safe-shutdown circuits must be protected in accordance with III.G.2 unless an alternative or dedicated shutdown system is provided in accordance with III.G.3." That is, “alternative and dedicated shutdown capability” should be based on the assumption of only a single worst spurious actuation, but subsequently, MSAs should be considered [66].

A similar conclusion was reached that "all [MT^®] raceway systems failed to meet a 3-h fire endurance period" [83]. However, a separate IN, like that for Hemyc^®, was not issued since very few plants were known to have MT^® ERFBSs installed. Nonetheless, the USNRC included the MT^® with Hemyc^® ERFBS as potentially non-conforming [84].

CAROLFIRE results have also been applied for fire modeling improvement, including a new Thermally Induced Electrical Failure (THIEF) model for cables developed by the National Institute for Standards and Technology [87].

The ASME/ANS combined PRA standard will incorporate the ANS Fire PRA Standard essentially verbatim, such that an endorsement of the ASME/ANS combined standard essentially endorses the ANS Fire PRA Standard.

Duke Power, with the Oconee units as pilot plants, has estimated that, if one starts from a solid basis for their current FPP, the cost of transition will be approximately 8,000 person-hours per site, of which about 75% is needed for a state-of-the-art Fire PRA [102]. Progress Energy, with Shearon Harris as a pilot plant, performed cost-benefit analyses that indicated a savings of approximately 35% of the current licensing basis by transitioning to NFPA 805 using Fire PRA [103].