03-20994. Proposed Generic Communication; Risk-Informed Inspection Guidance for Post-Fire Safe-Shutdown Inspections

AGENCY:

Nuclear Regulatory Commission.

ACTION:

Notice of opportunity for public comment.

SUMMARY:

The U.S. Nuclear Regulatory Commission (NRC) is proposing to issue a Regulatory Issue Summary (RIS) to inform all holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel, of the risk-informed inspection guidance that will be used by NRC inspectors to perform future post-fire safe-shutdown associated guidance inspections. The NRC is seeking comment from interested parties on the clarity and utility of the proposed RIS and the draft technical input that will be used to develop inspection guidance. The NRC will consider the comments received in its final evaluation of the proposed RIS.

This Federal Register notice is available through the NRC's Agencywide Documents Access and Management System (ADAMS) under accession number ML032030584.

DATES:

Comment period expires September 17, 2003. Comments submitted after this date will be considered if it is practical to do so, but assurance of consideration cannot be given except for comments received on or before this date.

ADDRESSES:

Submit written comments to the Chief, Rules and Directives Branch, Division of Administrative Services, Office of Administration, U.S. Nuclear Regulatory Commission, Mail Stop T6-D59, Washington, DC 20555-0001, and cite the publication date and page number of this Federal Register notice. Written comments may also be delivered to NRC Headquarters, 11545 Rockville Pike (Room T-6D59), Rockville, Maryland, between 7:30 a.m. and 4:15 p.m. on Federal workdays.

FOR FURTHER INFORMATION CONTACT:

Mark Henry Salley at [phone] or by e-mail to [e-mail].

SUPPLEMENTARY INFORMATION:

 

NRC Regulatory Issue Summary 2003-XX: Risk-Informed Inspection Guidance for Post-Fire Safe-Shutdown Associated Circuit Inspections

Addressees

All holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.

Intent

The U.S. Nuclear Regulatory Commission (NRC) is issuing this regulatory issue summary (RIS) to inform addressees of the risk-informed technical input that will be used to develop inspection guidance used by NRC inspectors to perform future post-fire safe-shutdown associated circuit inspections.

Background Information

The regulatory requirements, guidance, and NRC staff's positions regarding post-fire safe-shutdown are contained in various NRC documents, including Title 10 of the Code of Federal Regulations, Section 50.48 (10 CFR 50.48), “Fire Protection,” and 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 3. Nuclear power plants (NPPs) operating prior to January 1, 1979, were backfit to 10 CFR Part 50, Appendix R, Section III G. NPPs licensed later were evaluated against Section 9.5-1 of NUREG-0800, Standard Review Plan (SRP). Regulatory Guide 1.189, “Fire Protection,” also provides regulatory guidance on post-fire safe shutdown. The extent to which these requirements or guidance are applicable to a specific NPP depends on the plant's age, commitments made by the licensee in establishing its fire protection plan, and license conditions regarding fire protection. One objective of the fire protection requirements and guidance is to provide reasonable assurance that fire-induced failures of associated circuits that could prevent the operation or cause maloperation of equipment necessary to achieve and maintain post-fire safe shutdown will not occur. As a part of its fire protection program each licensee performs an associated circuit analysis to evaluate and protect against these failures.

Each NPP licensee has a post-fire safe-shutdown program that was reviewed and approved by the NRC either as a part of the licensee's compliance with the 10 CFR part 50, appendix R, backfit or as a part of the initial operating licensing basis reviews. Licensees are required to maintain and update this analysis as a condition of their operating license. The NRC routinely inspects the post-fire safe-shutdown program as a part of the triennial fire protection inspection of each licensee.

Summary of the Issue

Beginning in 1997, the NRC staff noticed that a series of licensee event reports (LERs) identified plant-specific problems related to potential fire-induced electrical circuit failures that could prevent operation or cause maloperation of equipment necessary to achieve and maintain hot shutdown. The staff documented these problems in Information Notice 99-17, “Problems Associated With Post-Fire Safe-Shutdown Circuit Analysis.” Based on the number of similar LERs, the NRC determined the issue should be treated generically. In 1998, the NRC staff started to interact with interested stakeholders in an attempt to understand the problem and develop an effective risk-informed solution to the circuit analysis issue. Due to the number of different stakeholder interpretations of the regulations, the NRC decided to temporarily suspend the associated circuit portion of fire protection inspections. This decision is documented in an NRC memorandum from John Hannon to Gary Holahan dated November 29, 2000, (ML003773142). NRC also issued Enforcement Guidance Memorandum (EGM) 98-002, Revision 2 (ML003710123).

To address the differing interpretations of the regulations, the NRC contracted Brookhaven National Laboratory (BNL) to develop a post fire safe shutdown analysis letter report (ML023430533). This draft letter report provided a historical look at the essential elements of a post-fire safe-shutdown circuit analysis, regulatory requirements and NRC staff positions, successful industry implementations, and guidance for risk-informing the associated circuit analysis. During this period, the Nuclear Energy Institute (NEI) performed a series of cable functionality fire tests to be used in NEI's risk-informed guidance. Revision D, the latest revision of NEI 00-01, “Guidance for Post-Fire Safe Shutdown Analysis,” was issued in early 2003 (ML023010376). The results of the NEI cable functionality fire testing were reviewed by an expert panel. The purpose of this review was to develop risk insights into the phenomena of fire-induced failures of electrical cables. The Electric Power Research Institute (EPRI) coordinated this effort and issued the final report, “Spurious Actuation of Electrical Circuits Due to Cable Fires: Results of an Expert Elicitation” (Report No. 1006961, May 2002).

On February 19, 2003, the NRC conducted a facilitated, public workshop in Rockville, MD. The purpose of the workshop was to discuss, and gather stakeholder input on, proposed risk-informed post-fire safe-shutdown circuit analysis inspection guidance. Using the above-referenced documents as background, the goals of the workshop were to identify:

(1) The most risk-significant associated circuit configurations;

(2) other associated circuit configurations that require further research; and

(3) low-risk-significant associated circuit configurations.

The facilitated workshop was successful in meeting these goals. A complete transcript of the meeting is available in ADAMS (ML030620006).

The staff has completed drafting the technical input that will be used to risk-inform inspector guidance for the most risk-significant associated circuit configurations (Item 1), identified other configurations that require further research (Item 2), and performed confirmatory research to verify the low-risk-significant configurations (Item 3) (ML030780326).

In summary, the risk-informed inspection guidance will concentrate on associated circuits whose failure could cause flow diversion, loss of coolant, or other scenarios that could significantly impact the ability to achieve and maintain hot shutdown. The inspectors will pay particular attention to events that occur in the first hour. Inspectors will consider credible fire scenarios that could produce a thermal insult resulting in cable damage. The initial focus of the inspectors will be on conductor-to-conductor shorts within a multiconductor cable, since risk insights gained from cable fire testing demonstrated that intra-cable shorting is the most probable cause of spurious actuations. Thermoplastic-cable-to-thermoplastic cable interactions are also highly probable and should be considered. To focus on the most risk-significant aspects, inspectors will assume a maximum of two concurrent spurious operations for each scenario evaluated. The details of this inspection are in the attached draft inspection guidance.

Backfit Discussion

This RIS requires no action or written response and is, therefore, not a backfit under 10 CFR 50.109. Consequently, the NRC staff did not perform a backfit analysis.

Federal Register Notifications

For some time the NRC staff has worked with NEI, members of the public, and other stakeholders to develop the technical input necessary to risk-informed the associated circuit inspection guidance referenced in this RIS. On February 19, 2003, the NRC staff held a facilitated public workshop in Rockville, MD, where public participation was solicited. A notice of the workshop was published in the Federal Register on December 27, 2002 (Vol. 67, No. 249, p. 79168).

The draft RIS including the draft inspection guidance was published in the Federal Register to solicit public comments.

Paperwork Reduction Act Statement

This RIS does not request any information collection.

Attachment: Draft Guidance for Risk-Informing NRC Inspection of Associated Circuits

Background

In 1997, the NRC noticed that a number of licensee event reports (LERs) identified plant-specific problems related to potential fire-induced electrical circuit failures that could prevent operation or cause maloperation of equipment necessary to achieve and maintain hot shutdown in the event of a fire. The staff documented this information in Information Notice 99-17, “Problems Associated With Post-Fire Safe-Shutdown Circuit Analysis.” On November 29, 2000, inspection of associated circuits was temporarily suspended (ML003773142). During this period, the Nuclear Energy Institute (NEI) developed NEI 00-01, “Guidance for Post-Fire Safe Shutdown Analysis” Rev. D (ML023010376). The staff contracted Brookhaven National Laboratory (BNL) to develop a post-fire safe shutdown analysis guidance letter report (ML023430533). The Electric Power Research Institute (EPRI) assembled an expert panel and issued “Spurious Actuation of Electrical Circuits due to Cable Fires: Results of an Expert Elicitation” (Report No. 1006961, May 2002). Using the above-referenced documentation as background, the NRC conducted a facilitated public workshop on February 19, 2003, in Rockville, MD. The transcript of the meeting is available in ADAMS (ML030620006). Based on the information above, especially the facilitated workshop discussions, the staff developed the technical input for draft risk-informed inspector guidance. This guidance, initially transmitted in a memorandum to Cynthia Carpenter from John Hannon dated March 19, 2003 (ML030780326), is essentially the same as the guidance provided below with two notable exceptions. First, additional technical review of the probability of hot-shorts indicated thermoplastic cable-to-cable interactions should have been located in Bin 1 rather than Bin 2. Second, the statement “Inspectors will not consider the impact of degraded control room instrumentation and indication circuits that might confuse operators pending additional research” can be easily misinterpreted and has been deleted. A new section on instrumentation has been added in place of this statement. These changes have been made in the following guidance.

Discussion

The discussion summarizes the general guidance that would be needed to develop an inspection procedure.

Basic Risk Equation

The risk due to associated circuits can be evaluated using the following basic risk equation:

Risk = (fire frequency) × (likelihood of fire effects & cable attributes that

contribute to failure) × (likelihood of undesired consequences)

The three factors in this equation are defined as follows:

1. Fire Frequency. The fire frequency is based on a statistical analysis of nuclear power plant (NPP) operating experience. The fire protection significance determination process (SDP) provides a method and bases for estimating fire frequencies for plant areas. One unique aspect of circuit analysis is the potential need for evaluation of multiple areas (i.e., areas through which a cable or common set of cables is routed).

2. Likelihood of Fire Effects & Cable Attributes that Contribute to Failure. There needs to be a credible fire threat in the area under review to damage the cable of concern. This threat may consist of in situ combustibles, or the actual or maximum allowable amount of transient combustibles as controlled by plant-specific procedures, or a combination thereof. The fire protection SDP provides methods and bases for the identification and analysis of these fire scenarios. The NRC has published fire dynamics tools (i.e., Draft NUREG-1805) which can be used to approximate the fire and its effects when more than a qualitative analysis is necesaary. The cable attributes should also be considered in assessing the likelihood of cable failure. Failures due to thermal insult from the fire result from heating in the hot gas layer, immersion in the plume, immersion in the flame zone (direct flame impingement), or radiant heating. All modes of heat transfer should be considered as appropriate to a given fire scenario.

A. Thermoplastic Cables. Thermoplastic cables (typically non-IEEE 383 qualified) should be assumed to fail if exposed to the hot gas layer or plume temperatures of 425°F or greater for a minimum of 5 minutes. In the case of radiant heat transfer, the cable should be assumed to fail if exposed to a minimum 5kW/m² for 5 minutes. When a thermoplastic cable is within the flame zone of the fire (direct flame impingement) or in a cable tray that is burning, damage should be assumed to occur in 5 minutes.

B. Thermoset Cables. Thermoset cables (typically IEEE 383 qualified) should be assumed to fail if exposed to hot gas layer or plume temperatures of 700°F or greater for a minimum of 10 minutes. In the case of radiant heat transfer, the cable should be assumed to fail if exposed to a minimum 10kW/m² for 10 minutes. When a thermoset cable of concern is in the flame zone of the fire (direct flame impingement), or in a cable tray that is burning, damage should be assumed to occur in 10 minutes.

C. Cable Failure Modes. For multiconductor cables testing has demonstrated that conductor-to-conductor shorting within the same cable is the most common mode of failure. This is commonly referred to as “intra-cable shorting.” It is reasonable to assume that given failure, more than one conductor-to-conductor short will occur in a given cable. A second primary mode of cable failure is conductor-to-conductor shorting between separate cables, commonly referred to as “inter-cable shorting.” Inter-cable shorting is less likely than intra-cable shorting. At this time, the following configurations should be considered:

• For any individual multiconductor cable (thermoset or thermoplastic), any and all potential spurious actuations that may result from intra-cable shorting, including any possible combination of conductors within the cable, may be postulated to occur concurrently regardless of number. However, as a practical matter, the number of combinations of potential hot shorts increases rapidly with the number of conductors within a given cable. For example, a multiconductor cable with three conductors (3C) has 3 possible combinations of two (including desired combinations), while a five conductor cable (5C) has 10 possible combinations of two (including desired combinations), and a seven conductor cable (7C) has 21 possible combinations of two (including desired combinations). To facilitate an inspection that considers most of the risk presented by postulated hot shorts within a multiconductor cable, inspectors should consider only a few (three or four) of the most critical postulated combinations.
• For any thermoplastic cable, any and all potential spurious actuations that may result from intra-cable and inter-cable shorting with other thermoplastic cables, including any possible combination of conductors within or between the cables, may be postulated to occur concurrently regardless of number.
• For cases involving the potential failure of more than one multiconductor cable, a maximum of two concurrent spurious actuations should be assumed. For cases where more than two concurrent spurious actuations can occur as the result of intra-cable shorting within a single multiconductor cable they should be considered. The consideration of more than two concurrent spurious operations in more than two cables will be deferred pending additional research.
• Inspectors will consider the potential spurious operation of a direct current (DC) circuit given failures of the associated control cables even if the spurious operation requires two concurrent hot shorts of the proper polarity (e.g., plus-to-plus and minus-to-minus) provided the required source and target conductors are each located within the same multiconductor cable.
• The consideration of thermoset cable inter-cable shorts will be deferred pending additional research.

D. Instrumentation Circuits. Required instrumentation circuits are beyond the scope of this associated circuits guidance and must meet the same requirements as required power and control circuits. There is one case where an instrument circuit could potentially be considered as an associated circuit. If a fire-induced failure of an instrument circuit could interfere with the post-fire safe-shutdown capability, but not have a direct effect on systems and equipment needed to achieve and maintain hot shutdown, then the instrument circuit may be treated as an associated circuit and handled accordingly.

3. Likelihood of Undesired Consequences. The inspectors must assess the potential consequence of the associated circuit failure. The inspector should review the specific NPP process and instrumentation diagrams (P&IDs)^[1] for flow diversions, loss of coolant, or other scenarios that could significantly impair the NPP's ability to achieve and maintain hot shutdown.^[2] For the specific area under evaluation, the inspector may wish to consider components that could prevent operation or cause maloperation as the components of interest. When considering the potential consequence of such failures, the inspector should also consider the time at which the prevented operation or maloperation occurs. Failures that impede hot shutdown within the first hour of the fire tend to be most risk-significant in a first-order evaluation. Consideration of cold shutdown circuits will be deferred pending additional research.

Items To Be Deferred at This Time, Pending Additional Research

The following items are either considered of relatively low risk significance and/or are being deferred pending additional research:

• Inter-cable shorting for thermoset cables is considered to be substantially less likely than intra-cable shorting. Hence, the inspection of potential spurious operation issues involving inter-cable shorting for thermoset cables is being deferred pending additional research.
• Inter-cable shorting between thermoplastic and thermoset cables is considered less likely than intra-cable shorting of either cable type or inter-cable shorting of thermoplastic cables. The inspection of spurious actuation issues involving inter-cable shorting between thermoplastic and thermoset cables is therefore being deferred pending additional research.
• Pending further research, inspectors will not consider configurations involving three or more concurrent spurious operations involving more than three cables.
• Recent testing strongly suggests that a control power transformer (CPT) in a control circuit can substantially reduce the likelihood of spurious operation. The power output of the CPT relative to the power demands of the controlled device(s) appears critical. Pending additional research, inspectors may defer the consideration of multiple (i.e., two or more) concurrent spurious operations due to control cable failures if they can verify that the power to each impacted control circuit is supplied via a CPT with a power capacity of no more than 150% of the power required to supply the control circuit in its normal modes of operation (e.g., required to power one actuating device and any circuit monitoring or indication features).
• Recent testing strongly suggests that fire-induced hot shorts will likely self-mitigate (e.g., short to ground) after some limited period of time. Available data remains sparse, but there are no known reports of a fire-induced hot short that lasted more than 20 minutes. This is of particular importance to devices such as air-operated valves (AOVs) or pressure-operated relief valves (PORVs) which return to their de-energized position upon mitigation of a hot short cable failure. Pending further research, inspectors should defer the consideration of such faults if they can verify that a spurious operation of up to 20 minutes duration will not compromise the ability of the plant to achieve hot shutdown.

Items Not To Be Considered at This Time in Inspections

The following items are considered of very low likelihood and/or low risk, and will not be considered in the risk-informed inspection process:

• Open circuit (or loss of conductor continuity) conductor failures will not be considered as an initial mode of cable failure. Note that cable shorting (e.g., a short to ground) may result in an open circuit fault due to the tripping of circuit protection features.
• Inter-cable short circuits involving the conductors of an armored cable will not be considered. Such failures are considered virtually impossible unless the short involves the cable's grounded armoring.
• Inter-cable short circuits involving the conductors of one cable within a conduit and the conductors of any other cable outside the conduit will not be considered. As with armored cables, such faults are considered virtually impossible. Note that intra-cable shorting for thermoplastic or thermoset cables and inter-cable shorting between thermoplastic cables inside a common conduit are possible.
• Inspectors will not consider multiple high-impedance faults on a common power supply. Although such faults have been considered using deterministic methods for critical safe-shutdown circuits, such faults are considered of very low likelihood and often can be readily overcome by manual operator actions.
• Inspectors will not consider three-phase, proper-polarity hot short power cable failures. In theory, such failures could cause a three-phase device to spuriously operate. However, such failures are considered of very low likelihood because the three distinct phases of power would have to align in the proper phased sequence to operate. Note that three-phase devices may still be subject to spurious operations due to faults in their related control and/or instrumentation circuits.
• Inspectors will not consider multiple proper-polarity hot shorts leading to the spurious operation of a DC motor or motor-operated device when the postulated failures involve only the DC device's power cables (e.g., those cables that run from the motor control center (MCC) to the device). Such failures are considered unlikely because a shunt and a field require five separate conductors to have the correct polarity and sequence in order to operate. DC devices may still be subject to spurious actuation given failures in their control and/or instrument circuits.

Summary

In summary, the inspectors should focus on associated circuits whose failure could cause flow diversion, loss of coolant, or other scenarios that could significantly impair the ability to achieve and maintain hot shutdown, paying particular attention to those events that occur in the first hour. The inspectors should be able to develop credible fire scenarios that could produce a thermal insult resulting in cable damage. The inspectors should focus on conductor-to-conductor shorts within a multiconductor cable, since risk insights gained from cable fire testing have demonstrated that intra-cable shorting is the most probable cause of spurious actuations. The inspectors should also consider inter-cable shorting between thermoplastic cables. The inspectors should assume a maximum of two concurrent spurious operations for each scenario evaluated.

End

Documents may be examined, and/or copied for a fee, at the NRC's Public Document Room at One White Flint North, 11555 Rockville Pike (first floor), Rockville, Maryland. Publicly available records will be accessible electronically from the Agencywide Documents Access and Management System (ADAMS) Public Electronic Reading Room on the Internet at the NRC Web site, http://www.nrc.gov/​NRC/​ADAMS/​index.html. If you do not have access to ADAMS or if you have problems in accessing the documents in ADAMS, contact the NRC Public Document Room (PDR) reference staff at 1-800-397-4209 or 301-415-4737 or by e-mail to [e-mail].

Dated at Rockville, Maryland, this 11th day of August, 2003.

For the Nuclear Regulatory Commission.

William D. Beckner,

Chief, Reactor Operations Branch, Division of Inspection Program Management, Office of Nuclear Reactor Regulation.

Footnotes

1.  For NPPs that do not use P&IDs, the inspector will have to gather the same information from flow diagrams and cable routing/logic diagrams.

2.  Hot shutdown is defined in the NPP technical specifications.