Fire Protection: Barriers to Effective Implementation of NRC's Safety
Oversight Process (Letter Report, 04/19/2000, GAO/RCED-00-39).
Pursuant to a congressional request, GAO provided information on the
Nuclear Regulatory Commission's (NRC) fire protection program, focusing
on: (1) NRC's efforts to improve its oversight of fire protection at
nuclear power plants; (2) any potential barriers to the successful
implementation of the risk-informed oversight process for fire
protection; and (3) the extent to which fire risk assessments consider
the possible failure of passive fire barriers and penetration seals and
whether the cumulative effect of granting exemptions has increased the
risk of fire at nuclear power plants.
GAO noted that: (1) over the last several years, NRC has undertaken
several activities to improve fire protection at commercial nuclear
power plants; (2) NRC found various problems at the plants and required
the utilities to correct them; (3) more importantly, NRC concluded that
its oversight of the utilities' fire protection programs needed to be
improved; (4) although NRC will proceed with its new risk-informed
safety oversight process, its effectiveness for fire protection could be
hampered because important components will not be in place when
implementation begins in April 2000; (5) under the new oversight
process, NRC will use the risk assessments of the utilities to establish
thresholds of performance and inspections and indicators to assess
whether performance meets the thresholds; (6) NRC is working with
industry to develop a standard to help ensure the quality, scope, and
adequacy of the utilities' fire risk assessments but does not expect to
have such a standard until about 2 years after the new oversight process
is implemented; (7) performance indicators for fire protection are also
under development; (8) this summer, the nuclear utility industry plans
to pilot test them, and it hopes to provide some agreed upon indicators
to NRC in October 2000, 6 months after the new oversight process will
have been implemented; (9) until NRC finalizes the standard and develops
the performance indicators, it will implement the new oversight process
by relying on its inspection program to monitor the utilities' fire
protection efforts; (10) NRC's review of risk assessments for 38 nuclear
power plants found that the failure of passive fire barriers (walls),
active fire barriers (doors), and penetration seals had not been
considered; (11) however, most of the assessments assumed a small fire,
and NRC concluded that the failure to include barriers and seals was not
important because a small fire would not adversely affect them; and (12)
in addition, NRC used the risk assessments at 13 plants to determine
whether the cumulative effects of exemptions (alternative actions to
comply with regulations) that it had granted since 1983 increased the
risk of a fire and generally found them not risk significant.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: RCED-00-39
TITLE: Fire Protection: Barriers to Effective Implementation of
NRC's Safety Oversight Process
DATE: 04/19/2000
SUBJECT: Nuclear powerplant safety
Safety regulation
Inspection
Electric utilities
Quality assurance
Safety standards
Performance measures
IDENTIFIER: Browns Ferry Nuclear Plant (AL)
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO/RCED-00-39
Appendix I: Background on Passive Barriers and Penetration
Seals
18
Appendix II: Nuclear Power Plants Included in NRC's Various
Assessments
23
Appendix III: Comments From the Nuclear Regulatory
Commission
25
Appendix IV: Objectives, Scope, And Methodology
30
NEI Nuclear Energy Institute
NRC Nuclear Regulatory Commission
Resources, Community, and
Ecomonic Development Division
B-284198
The Honorable Edward J. Markey
House of Representatives
Dear Mr. Markey:
Concern over the risk of fire in commercial nuclear power plants increased
after a fire at the Browns Ferry nuclear plant in Alabama in 1975. The fire
damaged a relatively small area but adversely affected the functioning of
one of the plant's safety systems and the operator's ability to monitor the
status of the plant. As a result of that fire, the Nuclear Regulatory
Commission (NRC) and the nuclear utility industry have taken various actions
to help ensure that nuclear plants are safe from the threat of fires and
that utilities can safely shut these plants down should a fire occur. NRC's
fire protection regulations are intended to (1) prevent fires from starting;
(2) rapidly detect, control, and extinguish fires that do occur; and (3)
protect a nuclear power plant's structures, systems, and components so that
a fire that is not promptly extinguished will not prevent its safe shutdown.
According to NRC's regulations, these activities are designed to provide
reasonable assurance that any deficiencies occurring in one activity will be
backed up by another system so there is no undue risk to public health and
safety.
In recent years, NRC has been moving from its traditional regulatory
approach, which was largely developed without the benefit of quantitative
estimates of risk, to an approach--termed risk-informed regulation--that
considers relative risk in conjunction with engineering analyses and
operating experience.1 This risk-informed approach is also being applied to
NRC's regulation of fire protection at nuclear power plants. One component
of the new regulatory approach is an oversight process that was implemented
in April 2000, which will combine inspection results, risk assessments,2 and
performance indicators to determine a plant's overall safety performance,
including fire protection. NRC believes that this approach will reduce
unnecessary regulatory burden on licensees and reduce their costs without
reducing safety while increasing the agency's effectiveness and efficiency.
In the context of NRC's move to risk-informed regulation, you asked us to
examine various issues related to fire protection at commercial nuclear
power plants. As agreed with your office, this report provides information
on (1) NRC's efforts to improve its oversight of fire protection at nuclear
power plants and (2) any potential barriers to the successful implementation
of the risk-informed oversight process for fire protection. In addition, you
asked us to provide information on the extent to which fire risk assessments
consider the possible failure of passive fire barriers (walls) and
penetration seals (material used to seal openings in barriers) and whether
the cumulative effect of granting exemptions (alternative actions to comply
with regulations) has increased the risk of fire at nuclear power plants.
Over the last several years, NRC has undertaken several activities to
improve fire protection at commercial nuclear power plants. For example,
from June 1997 through October 1998, NRC conducted special fire inspections
at 10 of the nation's 103 nuclear power plants. NRC found various problems
at the plants and required the utilities to correct them. More importantly,
NRC concluded that its oversight of the utilities' fire protection programs
needed to be improved. For example, NRC identified four areas that had not
been included in its inspection program, such as assessing the ability of
the utilities to safely shut down a plant if a fire occurred. As part of its
efforts to implement a risk-informed approach for fire protection, NRC plans
to include these four areas in its inspection program and train its staff to
effectively inspect them.
Although NRC will proceed with its new risk-informed safety oversight
process, its effectiveness for fire protection could be hampered because
important components will not be in place when implementation begins in
April 2000. Under the new oversight process, NRC will use the risk
assessments of the utilities to establish thresholds of performance and
inspections and indicators to assess whether performance meets the
thresholds. NRC is working with industry to develop a standard to help
ensure the quality, the scope, and the adequacy of the utilities' fire risk
assessments but does not expect to have such a standard until about 2 years
after the new oversight process is implemented. Performance indicators for
fire protection are also under development. This summer, the nuclear utility
industry plans to pilot test them, and it hopes to provide some agreed upon
indicators to NRC in October 2000, 6 months after the new oversight process
will have been implemented. Until NRC finalizes the standard and develops
the performance indicators, it will implement the new oversight process by
relying on its inspection program to monitor the utilities' fire protection
efforts.
NRC's review of risk assessments for 38 nuclear power plants found that the
failure of passive fire barriers (walls), active fire barriers (doors), and
penetration seals had not been considered. However, most of the assessments
assumed a small fire, and NRC concluded that the failure to include barriers
and seals was not important because a small fire would not adversely affect
them. In addition, NRC used the risk assessments at 13 plants to determine
whether the cumulative effects of exemptions (alternative actions to comply
with regulations) that it had granted since 1983 increased the risk of a
fire and generally found them not risk significant.
Before the 1975 fire at Browns Ferry, NRC did not inspect the fire
protection programs of nuclear power utilities. At that time, NRC relied on
independent insurance carriers to ensure that the utilities used and
followed good fire protection practices at nuclear power plants. To resolve
some issues identified by the investigation of the Browns Ferry fire and
technical disagreements with utilities, in November 1980, NRC issued
regulations for fire protection. When it promulgated these regulations,
which applied to commercially operating plants and those under construction,
NRC recognized that compliance with some of the requirements would not
significantly enhance the level of fire safety at some operating plants. In
those cases, if the utility could demonstrate that existing or alternative
fire protection features were providing a level of safety equivalent to that
imposed by the new regulations, the utility could apply for an exemption.
According to NRC, the exemption process provided the utilities with the
flexibility to meet the performance objectives of its fire safety
regulations through alternative means.
With the implementation of its fire protection regulations, NRC conducted
one-time inspections to develop a baseline of each utility's fire protection
program and developed a routine inspection program for NRC staff. As part of
the routine inspection program, NRC had expected to inspect each operating
plant every 3 years to help ensure that the utility could safely shut it
down if a fire occurred. However, NRC did not follow through with the
triennial inspections; it inspected less than 10 operating plants. Moreover,
throughout the 1980s and 1990s, NRC inspectors focused their efforts on such
areas as ensuring that utilities had administrative controls for combustible
materials, maintained and tested fire extinguishers, and provided required
training for and tested the response of the fire brigade (the on-site fire
department). NRC acknowledges that it became complacent about fire
protection over about a 10-year period.
To comply with NRC's regulations and to confine a fire and limit its damage,
utilities divide the buildings at nuclear power plants into separate fire
areas, which generally are rooms or plant areas with walls and
floor-to-ceiling structural barriers that have been rated by fire resistance
tests. During the early stages of a fire, the barriers are expected to
contain it and prevent damage to important equipment until the automatic
detection and suppression (sprinkler) systems operate. If these systems fail
to operate, the barriers provide passive fire protection for important
equipment until specially trained plant personnel can begin to extinguish
the fire. In addition, a utility must have automatic detection and
suppression systems and either a 20-foot separation between electric cable
trays or a 1-hour fire-rated barrier between them to help ensure the
reliability of the electrical systems that are needed to safely shut down a
plant. If a plant does not have automatic detection and suppression systems,
the fire-rated barriers must provide at least 3 hours of protection. (App. I
provides additional information on fire barriers.)
In addition, openings in fire barriers, which are known as penetrations,
allow such items as cables, conduits, pipes, and ducts to extend from one
fire area to another. Penetration seals close these openings to maintain the
effectiveness of the fire barriers. Penetration seals help confine a fire to
the area in which it started and protect important equipment from a fire
within or outside that area. Penetration seals are neither technically
complex nor unique to the nuclear power industry−they have been used
in residential, commercial, and industrial buildings. According to NRC's
documents, it is generally accepted among fire protection professionals that
properly designed, tested, installed, inspected, and maintained seals will
provide reasonable assurance of the integrity of fire barriers. The
importance of fire barriers and penetration seals depends on a number of
factors, including the importance of the equipment and its accessibility to
a plant's firefighters. NRC's documents state that fire barriers are
generally more important to fire protection than penetration seals. (App. I
provides additional information on penetration seals.)
The regulation of nuclear power plants, including fire protection systems,
is changing. Since the early 1980s, NRC has been increasing the use of risk
information in its regulatory process. In August 1995, NRC issued a policy
statement advocating certain changes in the development and the
implementation of its regulations for these plants through a risk-informed
approach. Under this approach, NRC and the utilities would give more
emphasis to those structures, systems, and components deemed more
significant to safety. Moreover, in January 1999, NRC proposed a new
oversight process to respond to past criticisms about the lack of a
consistent, objective, and transparent method to assess the safety
performance of nuclear plants. The process will combine risk-informed
performance indicators, inspection results, utilities' self-assessments, and
clearly defined objective thresholds to determine a plant's overall safety
performance. NRC tested the new process at 13 plants between May and
November 1999 and implemented it nationwide on April 2, 2000. Under the new
oversight process, utilities will assume greater responsibilities for
ensuring compliance with NRC's regulations.
Protection at Nuclear Power Plants
Over the last several years, NRC has undertaken a number of activities to
improve the fire protection programs at individual nuclear power plants. NRC
found various problems at the plants, but, more importantly, it concluded
that its oversight of the utilities' fire protection programs needed to be
improved. NRC plans to include the identified improvements as part of its
efforts to implement a risk-informed approach for fire protection.
To determine the extent to which utilities complied with NRC's requirements
and could safely shut down a nuclear power plant if a fire occurred, NRC
conducted special fire inspections at 10 plants from June 1997 through
October 1998.3 (App. II lists the plants NRC included in these inspections.)
During its inspections, NRC identified weaknesses with the fire fighting
personnel, the analyses and the procedures to shut down a plant should a
fire occur, the analyses of the electrical circuits in the plants, and the
attention to fire protection by utility management.4 NRC required the
utilities to correct these weaknesses and concluded that they
� would not have been uncovered by its routine inspection program;
� could exist in one or more of the three aspects of fire
protection−prevention, detection, and suppression−at any given
plant; and
� indicated a need for future fire protection inspections to include the
following four new review areas: (1) the ability of utilities to safely shut
down a plant if a fire occurred; (2) the design of fire detection and
suppression systems; (3) the design of fire barriers; and (4) the actions
utilities have reported to NRC to correct problems with a specific type of
fire barrier material, called Thermo-Lag.5
NRC expects to include these four review areas in its new inspection
program, which is part of the new risk-informed oversight process, and to
conduct triennial fire inspections at all 103 operating nuclear power
plants. However, because NRC's inspections will assess the completed and
ongoing actions utilities have taken to correct their Thermo-Lag problems,
its inspectors may not have the expertise to verify the utilities' actions.
In the past, with the exception of NRC's Region II in Atlanta, Georgia, NRC
inspectors at the plants and in its regional offices did not have the
expertise needed to verify the utilities' actions.
In March 2000, NRC began training regional staff to carry out the new
inspection program. According to staff, NRC has developed a training program
for about 40 fire protection, mechanical, and electrical engineers who will
conduct the triennial inspections, beginning in April 2000. Subsequently,
NRC might develop training for other inspectors that would include the same
knowledge factors but would not be as detailed as the training provided to
the members of the triennial inspection team. NRC expects to conduct the
first of the triennial inspections at a minimum of seven nuclear power plant
sites. The staff also said that NRC headquarters staff with extensive fire
protection expertise would assist inspectors, when necessary. However,
starting in October 2000, NRC headquarters staff will no longer assist
regional staff with any type of inspections. Instead, all inspection
personnel will be based in the regional offices.
New Risk-Informed Oversight Process for Fire Protection
In moving toward a risk-informed regulatory approach, NRC and the nuclear
utility industry view risk assessments as one of the main tools to identify
and focus on those structures, systems, and components of nuclear plant
operations that pose the greatest risk. This is because these assessments
attempt to quantify the probability of an accident's occurrence and the how
it would impair a plant's operations. Under its new oversight process, NRC
will use the risk assessments of the utilities to establish thresholds of
performance and indicators to assess whether their performance meets these
thresholds. However, neither NRC nor the nuclear utility industry has a
standard that defines the quality, the scope, and the adequacy of risk
assessments. While NRC and the industry have a number of activities underway
to develop a standard, it is not expected to be completed it until about 2
years after the new oversight process has been implemented. Furthermore, as
part of NRC's new oversight process, the frequency and the number of
inspections of utilities' fire protection programs would be predicated on
performance indicators. The nuclear utility industry plans to pilot test
performance indicators this summer and provide some agreed upon indicators
to NRC in October 2000. Again, however, this will be 6 months after the new
oversight process has been implemented.
Since 1998, NRC has been working with the National Fire Protection
Association to develop a standard for the quality of fire risk assessments.
Before the Association issues a final standard, the Nuclear Energy Institute
(NEI) plans to conduct a 1- to 2-week pilot test on the proposed standard at
two nuclear power plants. NEI wants to determine whether the proposed
standard would change the licensing basis of the plants; such a change would
require NRC's approval. NEI also expects that the pilot test will help
identify parts of the standard that might adversely affect the plants as
well as areas that have not been considered in the proposed standard. The
National Fire Protection Association expects to incorporate feedback from
these tests before obtaining public comments on the proposed standard. The
Association expects to publish a final standard by April 2001. NRC plans to
adopt the standard, including obtaining public comments on it, by March
2002.
However, more needs to be done to ensure that an effective standard is
developed. For example, in February 1999, the Advisory Committee on Reactor
Safeguards notified NRC that the proposed standard is "not a bold step in
the direction of risk-informed fire protection" because it focuses on
existing fire protection requirements and only minimally considers the use
of risk information and performance criteria.6 NRC staff recognize that
limitations and uncertainties exist with certain aspects of fire risk
assessments, fire modeling, and performance measurement techniques. In part
to address such limitations, NRC initiated research efforts to improve,
among other things, the qualitative and quantitative understanding of the
risk that fires contribute to the probability and consequences of an
accident in nuclear power plants and to improve its fire risk assessment
methods and tools.7 In addition, because NRC staff believe that the National
Fire Protection Association standard may not address or amplify some fire
protection issues, the research staff have proposed that they develop fire
risk assessment guidance that will be more detailed than the standard under
development.
In commenting on NRC's research efforts, in July 1999, the Advisory
Committee on Reactor Safeguards told NRC that it lacked a plan to undertake
the research activities that would result in the types of tools it needs to
move forward with a risk-informed approach for fire protection. The Advisory
Committee noted that NRC has not developed the in-house capabilities to
quantitatively assess the impact of its research activities, prioritize
them, and allocate resources to them. Subsequently, NRC provided a plan to
the Advisory Committee, and the staff expects to discuss the plan and other
fire protection issues with the Advisory Committee in the spring of 2000.
According to Advisory Committee staff, one issue that will be discussed is
that the research plan does not specify how NRC would integrate the results
of its research into its overall risk-informed regulatory approach.
Along with risk assessments, performance indicators are another important
aspect of NRC's new risk-informed oversight process. The process is
predicated on NRC's conducting minimal inspections at first but then
increasing them when indicators and inspections show that a utility's
performance has deteriorated below the thresholds established by NRC. For
example, if three unplanned automatic or manual shutdowns is the performance
indicator and a plant had more than three, NRC would then increase its
inspection efforts until the indicator is within its prescribed limits. In
essence, the indicators would provide NRC with an early warning about a
nuclear plant's performance. Although NEI is developing performance
indicators for fire protection, they will not be finalized until at least
about 6 months after NRC implements the new oversight process.
In October 1999, NEI provided NRC with some suggested performance indicators
related to fire protection. NEI also noted that NRC and the nuclear utility
industry face a number of challenges in developing performance indicators
for fire protection. The challenges include ensuring the availability of
data that will be needed for the indicators; determining the effects of
measures taken to compensate for degraded, inoperable, or nonexistent
equipment (compensatory measures); and ensuring that the performance
indicators for fire protection are commensurate with those for other
activities at nuclear power plants. NEI expects to pilot test the
performance indicators at plants beginning in July 2000 and submit those
that the industry believes have merit to NRC in October 2000.
In June 1991, NRC asked nuclear power utilities to identify and report to
the agency all plant-specific vulnerabilities to severe accidents that could
be caused by earthquakes, high winds, floods, and fires. In response, NRC
received 70 risk assessments for the 103 operating plants. In January 1998,
NRC staff reported on their preliminary review of 24 fire risk assessments
for 38 plants. (App. II indicates which plants were included in the
preliminary review.) The purpose of NRC's review was not to validate or
verify the results of the utilities' assessments but to determine their
quality and their underlying assumptions.
NRC's review identified a number of weaknesses in the utilities' risk
assessments. For example, NRC found that practically none of the 24
assessments considered the possible failure of passive fire barriers (walls)
or properly modeled active fire barriers (doors) or considered the effects
that penetration seals might have on containing or spreading a fire.
However, NRC concluded that these weaknesses were not significant because
utilities had assumed a small fire in their risk assessments and such a fire
would not adversely affect a plant's barriers or seals. While this
assumption is consistent with an NRC study showing that the probability of a
large fire that would adversely affect a nuclear power plant is low, NRC and
the nuclear utility industry continue to debate the size and the type of
fire to assume in these risk assessments. The results of a fire risk
assessment depends on whether a utility assumes a large fire that most
likely would not occur, but would adversely affect a plant's safety systems,
or a small fire that would more likely occur but would be less likely to
adversely affect those systems.
NRC also found that although the routing of cables is one of the most
important elements of a fire risk assessment, almost none of the risk
assessments indicated that the utilities had verified their information on
cable routing. In addition, NRC found that the assessments had not
considered the actions and the effectiveness of the utilities' fire fighting
staff (except in analyzing a control room fire). Because of this omission,
the utilities had not taken into account the effects of smoke on the fire
fighting staff or the potential damage to equipment that could result from
their actions.
NRC staff asked the utilities to provide additional information on the
weaknesses identified and other issues in the risk assessments. On the basis
of their preliminary review of these assessments and the additional
information provided, NRC staff said that the fire risk assessments for some
of the remaining 65 plants were similar to the assessments for the 38 plants
it had already reviewed. NRC expects to issue a final report on its
evaluation of the fire risk assessments for all 103 plants in October 2001.
NRC staff also noted that more than half of the utilities improved their
fire protection efforts as a result of the assessments; the other utilities
had already taken actions to improve their fire protection programs or had
sufficient fire protection designed into the plants.
With regard to the alternative actions (exemptions) NRC had approved for
nuclear power utilities to comply with fire regulations, the utilities did
not explicitly specify that their fire risk assessments examined these
alternatives. However, NRC staff said the exemptions were an inherent part
of the assumptions made in the risk assessments. This is because granting an
exemption would include the utilities' changing a structure, system, or
component as an alternative way to comply with NRC's regulations and the
utilities had made these changes before preparing their risk assessments.
In addition to reviewing assumptions in risk assessments, NRC used them as a
basis to review the cumulative effects of granting exemptions. (App. II
indicates which plants were included in this analysis). NRC granted most of
the more than 1,300 exemptions from 1983 through 1987. Although granting an
exemption could increase fire risk, NRC did not consider the cumulative
effects of exemptions for individual plants until June 1998--about 15 years
after it had started to grant them. NRC staff told us that, until the
utilities completed their fire risk assessments, the agency did not have a
tool to determine the synergistic effects of the exemptions.
Using information from the risk assessments for 13 plants, NRC concluded
that the cumulative effects of most of the exemptions were not risk
significant. For example, NRC staff concluded that only 5 of the 169
exemptions granted to the 13 plants were potentially risk
significant−the utilities had sought the exemptions because they had
not installed automatic fire suppression systems in high-risk areas. They
found that 143 exemptions created a small or very small fire risk and they
could not determine the impact of the remaining 21 exemptions because the
risk assessments did not contain sufficient information. NRC acknowledges
that a number of uncertainties exist with this analysis, in part, because
the quality of the risk assessments varied among the plants and because of
information gaps in the risk assessments that NRC had used to prepare the
analysis. According to NRC staff, they could not project their findings to
the remaining 90 operating plants. They noted, however, that the synergistic
impact of the exemptions on the 90 plants would be small because the
estimated accident frequency for them was lower than for the plants that had
been examined.
Over the last several years, NRC has undertaken several activities to
improve fire protection at nuclear power plants. The success of NRC's
efforts to implement a risk-informed regulatory approach and its new
oversight process for fire protection depends in large part on the quality
and the scope of the risk assessments prepared by nuclear utilities because
NRC will use these assessments to determine the appropriate thresholds and
performance indicators to decide the frequency and the number of its
inspections. However, NRC will have neither a risk assessment standard nor
the performance indicators when it implements its oversight process in April
2000. Until NRC finalizes this standard and develops performance indicators,
it will implement its oversight process by relying on its inspection program
to monitor the utilities' fire protection efforts.
We provided a draft of this report to NRC for its review and comment. While
neither agreeing nor disagreeing with the report's message, NRC said that it
does not need a risk assessment standard to implement its new oversight
process. Instead, NRC will rely on existing techniques. However, NRC as well
as the Advisory Committee on Reactor Safeguards have noted that existing
risk techniques for fire risk assessments are not as developed as those for
assessing the risk of other accident initiators in a commercial nuclear
power plant. Therefore, we continue to believe that the successful
implementation of the new oversight process for fire protection could be
adversely affected without better and more consistent fire risk assessments.
NRC also provided other technical comments and clarifications that we
included in the report, where appropriate.
Unless you publicly announce its contents earlier, we plan no further
distribution of this report until 30 days after the date of this letter. At
that time, we will send copies to the Honorable Richard A. Meserve,
Chairman, Nuclear Regulatory Commission; the Honorable Nils J. Diaz, the
Honorable Greta Joy Dicus, the Honorable Edward McGaffigan, Jr., and the
Honorable Jeffrey S. Merrifield, Commissioners, Nuclear Regulatory
Commission; and the Honorable Jacob J. Lew, Director, Office of Management
and Budget. We will make copies available to others on request.
We conducted our work from April 1999 through March 2000 in accordance with
generally accepted government auditing standards. Appendix IV provides
details on our scope and methodology.
If you or your staff have any questions about this report, please call me at
(202) 512-8021. Other key contributors to this report are Mary Ann
Kruslicky, Philip Olson, and Michael Rahl.
Sincerely yours,
(Ms.) Gary L. Jones
Associate Director, Energy,
Resources, and Science Issues
Background on Passive Barriers and Penetration Seals
To confine a fire and limit its damage, utilities divide nuclear power plant
buildings into separate fire areas, which generally are rooms or plant areas
that have walls and floor-to-ceiling structural barriers that have been
rated based on fire resistance tests. These structural barriers are supposed
to have sufficient resistance to protect the rooms or areas from the hazards
of a fire. Such compartmentalization is not unique to nuclear power plants.
According to studies by the Nuclear Regulatory Commission (NRC), fire-rated
barriers are the first and last lines of defense for a fire. During the
early stages of a fire, the barriers contain the fire and protect important
equipment until the automatic detection and suppression systems operate. If
these systems fail to operate, the barriers provide passive fire protection
for important equipment. To help ensure the reliability of the electrical
systems needed to safely shut down a plant that are located outside
containment, nuclear utilities must have automatic detection and suppression
systems and either a 20-foot separation between electric cable trays or a
1-hour fire-rated barrier between them. If a plant does not have automatic
detection and suppression systems, the barriers must provide at least 3
hours of protection. NRC has other requirements to protect electric cables
that are inside containment.
In 1981, NRC began to receive requests from nuclear utilities to use a
specific type of passive fire barrier, a concrete-like substance called
Thermo-Lag, to satisfy its regulatory requirements, which stated that one
method to help ensure the safe shutdown of a nuclear power plant was to
enclose electric circuits with fire-rated barriers. Ultimately, utilities
installed the material in more than 85 plants. In 1987, a utility verbally
notified NRC that electric cable insulation was being degraded at a higher
rate than reported by Thermo-Lag's manufacturer because of the heat build up
caused by the material. Subsequently, utilities reported other problems to
NRC, including that the material did not meet NRC's 1- or 3-hour fire
resistance requirements and that the manufacturer had falsified test results
to gain NRC's approval. In June 1991, NRC established a special team to
review issues related to Thermo-Lag and recommend actions to resolve the
problems found. In December 1991, NRC conducted its first inspection of
Thermo-Lag's manufacturer. In 1992, NRC's Office of the Inspector General
found, among other things, that NRC had not followed up on any of the
allegations reported by the utilities.
In response, NRC required utilities to provide information to verify that
their Thermo-Lag fire barriers complied with NRC's requirements. NRC also
instituted efforts to help ensure that electric cable insulation had not
degraded because of the installation of Thermo-Lag. For example, in December
1992, the Commission required utilities to report on the types of systems
and components insulated by Thermo-Lag, the fire-endurance tests that had
been conducted on the material, the reduction in cable current required to
compensate for the increased heat, and the corrective actions that had been
completed or were scheduled to comply with NRC's regulations. NRC required
the utilities to provide this information by April 1993 or the reasons they
could not do so and asked them to provide a schedule for completing the
needed corrective actions. Since then, utilities have taken various actions
to address the design deficiencies with Thermo-Lag. NRC's documents show
that some utilities replaced the material with another passive fire barrier,
which was developed by a different manufacturer, in some areas of the
plants; rerouted or replaced cables in the plants; and applied a different
material or more Thermo-Lag. To resolve this issue, in 1994, NRC issued
orders to 17 plants to complete their Thermo-Lag corrective actions. Turkey
Point Units 3 and 4 in Florida, scheduled for December 2001, will be the
last to do so.
A number of reasons exist for the time that it has taken utilities to
complete their Thermo-Lag corrective actions. First, substitute material had
not been tested and approved for their use. Second, it took more time,
effort, and money to correct the problem than NRC and the utilities had
estimated. Third, NRC allowed the utilities to defer the corrective actions
until the plants were shutdown for refueling (about every 18 to 24 months)
to avoid undue disruptions with normal plant operations. Fourth, NRC and the
utilities placed a higher priority on other safety-related activities
because Thermo-Lag provided some degree of fire protection and the utilities
had implemented fire watches to help ensure the early detection of fires in
areas where the material had been installed.8 NRC staff noted, for example,
that Thermo-Lag could withstand the rigors of a fire for between 20 and 40
minutes. An NRC study of fires that have occurred since Browns Ferry
indicates that most fires are extinguished within 10 to 15 minutes; and
since the temperature would likely be less severe during the initial stages
of a fire, the fire watch would have time to notify the fire brigade and/or
begin to suppress the fire; and the barrier would provide a level of
protection until the fire is extinguished.
Public interest groups contend that fire watches are not a substitute for
passive barriers. In various documents, NRC acknowledged that fire watches
cannot replace fire barriers and cannot act as physical shields but
concluded that the watches are an acceptable compensatory measure for
utilities to implement. Although NRC found that Thermo-Lag could not meet
the required fire endurance rating and that fire watches did not compensate
for the barrier's shortcomings, NCR concluded that the combination of
Thermo-Lag and fire watches help ensure public health and safety until the
utilities have completed their corrective actions. Even after the utilities
have completed their Thermo-Lag corrective actions, they will likely
continue to use fire watches to supplement other fire detection systems.
Although utilities instituted fire watches to compensate for inoperable fire
barriers, they also use them during routine maintenance activities at the
plants.
Openings in structural fire barriers, which are known as penetrations, allow
such items as cables, conduits, pipes, and ducts to pass from one fire area
to another. Penetration seals close these openings and maintain the
effectiveness of the fire barrier. Penetration seals help confine a fire to
the area in which it started and protect important equipment from a fire
within or outside the area. Penetration seals are not technically complex
nor are they unique to the nuclear industry−they are used in
residential, commercial, and industrial buildings. According to NRC's
documents, it is generally accepted among fire protection professionals that
properly designed, tested, installed, inspected, and maintained seals will
provide reasonable assurance of the integrity of the fire barriers in which
they are installed. The importance of fire barriers and penetration seals
depends on a number of factors, including the safety significance of the
equipment and its accessibility to a fire brigade.
NRC's documents state that fire barriers are generally more important to
fire protection than penetration seals. In some cases, NRC does not require
penetration seals to have the same fire resistance rating as the barriers in
which they are installed. In fact, NRC does not require that all
penetrations be sealed. According to NRC's documentation, a nuclear power
plant can have up to 10,000 penetration seals, but the reported instances of
breached seals are rare. Although NRC does not require its inspectors or
utilities to destroy seals to inspect them, NRC staff said that some
utilities have conducted such inspections.
About 1985, NRC became aware that some utilities may not have been complying
with its requirements to properly test, install, inspect, and maintain the
penetration seals and subsequently sent them information notices about
potential problems with the seals. However, information notices do not
require utilities to take any actions or report their actions to NRC. In
1992, NRC again identified potential problems with the testing,
installation, inspection, and maintenance of penetration seals and initiated
a review of them. NRC wanted to determine if the potential problems
presented a significant safety or industrywide concern and if it needed to
issue additional regulatory requirements related to penetration seals. On
the basis of its review, NRC concluded that utilities generally had
satisfactory programs to install, maintain, and inspect the seals. NRC also
determined that the seals were not an industrywide problem and concluded
that it and the nuclear power industry understood the potential problems
with the seals, an industry fire test standard was available and followed by
the utilities, and qualified fire-resistant seal materials and appropriate
designs were available to correct potential problems. Despite these
conclusions, NRC staff recommended that the agency confirm the adequacy of
its inspection program for penetration seals.
In 1995, NRC's former Office for Analysis and Evaluation of Operational Data
reported on its assessment of penetration seals. That office reached many of
the same conclusions as NRC had raised in its 1992 effort and again raised
questions about NRC's procedures to inspect penetration seals. NRC requires
utilities to have written procedures to inspect and maintain penetration
seals. According to NRC documentation, utilities inspect some seals during
every refueling outage (about every 18 or 24 months). If the utility
identifies breached, degraded, improperly repaired, or inoperable seals
while the plant is operating, the utility is required to establish an
NRC-approved compensatory measure until the degraded condition is corrected.
NRC inspectors are expected to review a sample of the utilities'
documentation.
In addition, in July 1996, NRC issued a report on the results of a
comprehensive technical assessment of penetration seals and in January 1999,
issued a report that, among other things, discussed problems with
penetration seals reported by utilities and found during 153 inspections at
87 plants. In the latter report, NRC concluded that potential penetration
seal deficiencies are not a safety concern and do not result in undue risks
to public health and safety. In both reports, NRC concluded that the
utilities' penetration seal programs appear to be satisfactory, the problems
are understood, and fire-resistant penetration seal material is available to
correct the problems the utilities identify.
Nuclear Power Plants Included in NRC's Various Assessments
Continued
Preliminary review of
Plant utilities' fire risk Special Cumulative effect
assessments inspections of exemptions
Brunswick 1 X
Brunswick 2 X
Callaway X
Calvert Cliffs
1 X
Catawba 1 X
Catawba 2 X
Clinton X
Comanche Peak
1 X
Comanche Peak
2 X
Cook 1 X
Cook 2 X
Diablo Canyon
1 X
Diablo Canyon
2 X
Dresden 2 X
Dresden 3 X
Farley 1 X
Farley 2 X
Fort Calhoun X
Haddam Necka X
Kewaunee X X
LaSalle 1 X
LaSalle 2 X
Limerick 1 X
Limerick 2 X
McGuire 1 X
McGuire 2 X
Millstone 3 X
Nine Mile
Point 2 X
Palisades X X
Pilgrim X
Point Beach 1 X
Point Beach 2 X
Prairie Island
1 X
Prairie Island
2 X
Quad Cities 1 X
Quad Cities 2 X
River Bend X
Robinson 2 X X
St. Lucie 1 X X X
St. Lucie 2 X X X
Seabrook X
Sequoyah 1 X
Sequoyah 2 X
South Texas 1 X
South Texas 2 X
Summer X
Susquehanna 1 X X
Susquehanna 2 X X
Turkey Point 3 X X
Turkey Point 4 X X
a In 1996, the Connecticut Yankee Atomic Power Company decided to cease
operations and decommission this plant.
Comments From the Nuclear Regulatory Commission
The following are GAO's comments on the Nuclear Regulatory Commission's
letter dated March 24, 2000.
1. NRC said that it does not need the risk assessment standard being
developed by the National Fire Protection Association to implement the new
oversight process. Rather, the Commission will rely on existing risk
techniques. However, NRC as well as the Advisory Committee on Reactor
Safeguards have noted that existing techniques are not as well developed as
those for assessing the risk of other accident initiators in a commercial
nuclear power plant. Therefore, we continue to believe that the successful
implementation of the new oversight process for fire protection could be
adversely affected without better and more consistent fire risk assessments.
2. NRC said risk assessments consider the possibility that a fire will grow
beyond its initial size, but it believes the likelihood that a fire will
become severe enough to result in the failure of fire barriers is small. NRC
also noted that it has research relevant to multiarea fires within a nuclear
power plant. We believe that the report sufficiently discusses both the
continuing debate over the size of the fire that nuclear utilities should
consider in their fire risk assessments as well as NRC's research efforts.
Therefore, we made no change to the report.
3. We have revised the report by deleting the reference to the lack of fire
protection regulations before 1975.
4. The July 1999 Advisory Committee on Reactor Safeguards report (p. 12)
states: "There is not, however, a well-developed plan to show that these
research activities will, in fact, yield the kinds of tools that the agency
will need in its move toward risk-informed regulation." This is the same
information as shown in our report. Therefore, we have not changed the
report as NRC suggests.
5. In its January 1998 report, NRC states that almost invariably the
utilities said that they considered cable routing information in their fire
risk assessments. However, on the basis of its analysis, NRC later noted in
the report that almost none of the risk assessments indicated that the
utilities had verified cable routing or other fire-related information. We
have revised the report to note that almost none of the utilities had
indicated that they had verified cable routing information.
6. We agree that performance indicators and baseline inspections form the
basis to determine the need for additional inspections and where
appropriate, we have added "inspection" to the report.
Objectives, Scope, And Methodology
Representative Edward J. Markey asked us to examine various issues related
to fire protection at nuclear power plants. On the basis of discussions with
his office, we agreed to answer the following three questions: What has the
Nuclear Regulatory Commission (NRC) done to improve its oversight of fire
protection at nuclear power plants? What are some of the barriers that NRC
needs to resolve to successfully implement the risk-informed oversight
process for fire protection? Did utilities consider passive fire barriers,
penetration seals, and exemptions in their fire risk assessments? We
reviewed relevant sections of the Atomic Energy Act of 1954, as amended;
NRC's regulations; staff requirement memorandums; and various analyses
provided by the staff for the Commission's consideration.
To determine the actions that NRC has taken to improve its oversight of fire
protection, we reviewed an NRC Office of the Inspector General report,
Adequacy of NRC Staff's Acceptance and Review of Thermo-Lag 330-1 Fire
Barrier Material (Case No. 91-04N, Aug. 12, 1992) and met with the staff
responsible for this report. We also reviewed transcripts of March 1998 and
February 1999 Commission briefings on fire protection issues, information on
the results of a February 1999 public workshop to develop a method to assess
the risk significance of fire protection deficiencies, and a May 1999
memorandum from the Executive Director for Operations on the results of the
fire protection functional inspections and the recommendations for future
inspections. In addition, NRC provided us a computer disc of FIREDAT, its
database of exemptions granted to nuclear power plants. We used this
database to determine the number and the types of exemptions that NRC had
granted to nuclear power plants. We did not validate the information in the
database, and a June 1999 report by the Department of Energy's Sandia
National Laboratories stated that NRC had not validated the information.
Nevertheless, Sandia used the information in its analysis of exemptions. We
also reviewed a July 1999 memorandum from the Executive Director for
Operations to the Commissioners on the cumulative effects of exemptions on
fire risk. We also examined a June 1996 technical assessment of fire barrier
penetration seals in nuclear power plants and two reports on Fire Barrier
Penetration Seals in Nuclear Power Plants (NUREG-1552, July 1996 and
Supplement 1, Jan. 1999). We reviewed semiannual reports on the status of
the utilities' corrective actions related to Thermo-Lag fire barriers;
information notices that addressed such issues as the types of passive fire
barriers, compensatory measures, penetration seals, and postfire circuit
analyses; and generic letters that addressed such issues as fire protection
regulations, implementation of fire protection requirements, and endurance
tests for passive fire barriers. We also met or talked with NRC staff in the
Offices of Nuclear Reactor Regulation and Nuclear Regulatory Research as
well as officials from the Nuclear Energy Institute, the Union of Concerned
Scientists, the Nuclear Information and Resource Service, and the Institute
of Nuclear Power Operations.
To determine the issues NRC needs to resolve to successfully implement the
new oversight process for fire protection, we reviewed information on NRC's
fire risk research program and a draft report, Technical Review of
Risk-Informed, Performance-Based Methods for Nuclear Power Plant Fire
Protection Analyses (NUREG-1521, July 1998). In addition, we examined
proposed standards being developed by the National Fire Protection
Association and talked with the Association's Chairman, Nuclear Facilities
Committee, and Chairman, Standard 805 Subcommittee. We also obtained
information and attended public meetings regarding NRC's proposed
risk-informed baseline inspection program for fire protection and post-fire
safe shutdown of nuclear plants. We also met with NRC staff in the Offices
of Nuclear Reactor Regulation and Nuclear Regulatory Research as well as
officials from the Nuclear Energy Institute, the Union of Concerned
Scientists, and the Nuclear Information and Resource Service. We also talked
with a private individual that has had a long-standing interest in nuclear
plant fire protection as well as officials from American Nuclear Insurers
and Nuclear Electric Insurance Limited--companies that market nuclear plant
fire protection insurance.
To determine whether utilities included fire barriers, penetration seals,
and exemptions in their risk assessments, we reviewed NRC's January 1998
preliminary report on risk assessment that utilities had prepared for 38
nuclear plants. We met with NRC staff in the Offices of Nuclear Reactor
Regulation and Nuclear Regulatory Research as well as officials from the
Nuclear Energy Institute, the Union of Concerned Scientists, and the Nuclear
Information and Resource Service. We also reviewed transcripts of March 1998
and February 1999 Commission briefings on fire protection issues.
(141311)
1. NRC differentiates between "risk-informed" and "risk-based" regulation,
noting that the latter approach relies solely on the numerical results of
risk assessments. NRC does not endorse a risk-based approach.
2. Risk assessments systematically examine complex technical systems to
identify and measure the public health, environmental, and economic risks of
nuclear power plants. These assessments attempt to quantify the
probabilities and consequences of an accident's occurrence. By their nature,
risk assessments are statements of uncertainty that identify and assign
probabilities to events that rarely occur.
3. NRC included the inspections at 10 plants in its final report on the
special inspections, even though it inspected 3 plants using the same
criteria but not with the same level of detail and assessed the utility's
self-assessment at 2 plants.
4. In Nuclear Regulation: Preventing Problem Plants Requires More Effective
NRC Action (GAO/RCED-97-145 , May 30, 1997), we recommended that NRC assess
the competency and the performance of utility management. NRC disagreed and
will not implement this recommendation. In addition, NRC has determined that
it will not develop performance indicators for its new reactor oversight
program to assess the management performance and competency of utilities.
NRC says that it will continue to infer these qualities from its inspection,
assessment, and event follow-up activities.
5. Thermo-Lag is a fire barrier material that was used on electric cable
trays and other plant equipment. App. I provides a brief history of the
issues surrounding this material.
6. The Advisory Committee on Reactor Safeguards is a statutory committee
established to advise NRC on the safety aspects of proposed and existing
nuclear facilities as well as to perform other duties as the Commission may
request.
7. NRC also has research underway to (1) improve the estimates of the
frequencies of severe fires; (2) improve fire-modeling tools; (3) identify
scenarios for which smoke might pose a significant risk; (4) improve the
estimates of the probabilities of fires and their containment, including the
effects of active and passive barriers; (5) develop estimates of the
probability of failure of fire dampers, doors, and penetration seals during
a severe fire; (6) determine the extent to which fire risk assessment
methods can confidently be used to prioritize the selection of penetration
seals for inspections; (7) improve human risk assessment tools for fire
scenarios; (8) develop reliability estimates for configuration- and
condition-sensitive fire protection systems; (9) improve the tools to assess
the risk impacts of a fire that might simultaneously affect multiple plants
at a site; (10) determine the frequency and the characteristics of
switchgear and transformer fires; (11) determine the risk significance of
turbine building fires; and (12) improve the understanding of the
implications of actual fire events for risk assessments.
8. Fire watches are utility personnel trained to look for fire hazards and
conditions that could lead to a fire, summon the fire brigade, and start
suppression activities if a fire occurs. NRC allows utilities to compensate
for degraded or inoperable equipment. In the fire protection area,
compensatory measures can include enhanced controls over combustible
materials, briefing operators and the fire brigade on the nonconforming
condition, implementing temporary operating procedures, installing temporary
fire protection features, undertaking temporary repairs and temporary power
interconnections, and the manual operation of motor driven valves. The most
common compensatory measure is fire watches. NRC's regulations, however, do
not expressly discuss the compensatory measures that utilities can take.
Instead, the compensatory measures are set out in the NRC-approved plant
technical specifications and fire protection plan as well as administrative
procedures and license conditions.
*** End of document. ***