NUREG-0050

S

-IRECOMMENDATIONS RELATED

F

TO

BROWNS FERRY FIRE

Report By Special Review Group J

-- u,-

I

I LU. S. Nuclear Regulatory Commission

r -

L. -
muu Ii

-r

Available from

National Technical Information Service

Springfield, Virginia 22161

Price: Printed Copy $5.00 ; Microfiche $2.25

f
P;

NUREG-0050

IE

RECOMMENDATIONS RELATED

F

TO

BROWNS FERRY FIRE

Report By Special Review Group

Harold E. Collins

Saul Levine

Warren Minners

Voss A. Moore

Vincent W. Panciera

Karl V. Seyfrit

Stephen H. Hanauer, Chairman

Date Published: February 1976

Lý

U. S. Nuclear Regulatory Commission

Washington, D. C. 20555

r.

L
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D. C. 20555

February 21, 1976

-II

Lee V. Gossick, Executive Director for Operations

REPORT OF SPECIAL REVIEW GROUP ON BROWNS FERRY FIRE

Enclosed you will find the report of the Special Review Group you appointed on March 26, 1975,

to review the Browns Ferry fire of March 22. In accordance with its charter, the Group has

tried to distill from the available information those lessons that should be learned for the

future. Some of these lessons apply to operating plants, others to designers, standards

developers, State and local authorities, and the NRC.

Based on its review of the events transpiring before, during and after the Browns Ferry fire,

the Review Group concludes that the probability of disruptive fires of the magnitude of the

Browns Ferry event is small, and that there is no need to restrict operation of nuclear power

plants for public safety. However, it is clear that much can and should be done to reduce even

further the likelihood of disabling fires and to improve assurance of rapid extinguishment of

fires that occur. Consideration should be given also to features that would increase further

the ability of nuclear facilities to withstand large fires without loss of important functions

should such fires occur. The Review Group believes that improvements, especially in the areas

of fire prevention and fire control, can and should be made in most existing facilities.

Unless further developments indicate a need to reconvene the Review Group, its task is

considered complete with the publication of the report.

V

Harold E. Collins

Member, Special Review Group

Chief, Emergency Preparedness Branch

Office of International and State Programs

Saul Levine

Member, Special Review Group

Deputy Director

Office of Nuclear Regulatory Research

W. Minners

Member, Special Review Group

Reactor Systems Branch

Division of Systems Standards

Office of Nuclear Reactor Regulation

Voss A. Moore

Member, Special Review Group

Assistant Director

for Environmental Projects

Division of Site Safety and

Environmental Analysis

Office of Nuclear Reactor Regulation

Member, Special Review Group

Chief, Engineering Methodology

Standards Branch

Office of Standards Development

K. V. Seyfrit

Member, Special Review Group

Branch Chief, Reactor Technical

Assistance Branch

Office of Inspection and Enforcement

Chairman, Special Review Group

Technical Advisor to

the Executive Director for Operations
TABLE OF CONTENTS

Page No. -

GLOSSARY ....... ... ... ............................ vii

1.0 SUMMARY AND RECOMMENDATIONS ....... ................ 1

1.1 Introduction ......... ..................... 1

1.2 Sequence of Events in the Fire ............... ... 1

1.3 How Safe was the Public? ...... ............... 2

1.4 Perspective ...... ..... ..................... 3.v

1.5 General Conclusions ....... .................. 3

1.6 Principal Recommendations ..... ............... 4

1.6.1 Fire Prevention ....... ................ 4

1.6.2 Fire Fighting ............................ 5

1.6.3 Provisions to Maintain Important Functions in

Spite of a Fire ...... ............... 6

1.6.4 Quality Assurance 6...............6

1.6.5 Response of Other Governmental Agencies .i .. 7

1.6.6 Recommendations for the NRC ..... .......... 7

2.0 INTRODUCTION ...... ..... ........................ 8

2.1 Objective and Plan of this Report ..... ........... 8

2.1.1 Objective ....... ................... 8

2.1.2 Plan of this Report ...... .............. 8

2.2 Sources of Information ....... ................ 8

2.3 Scope of Review ....................... 9

2.4 Note on Changes with the Passage of Time.. . 9.......9

2.5 Perspective on Reactor Safety: Defense in Depth . . . 10

3.0 FIRE PREVENTION AND CONTROL ..... ................ .. 11

3.1 Details of the Fire ........ ................. 11

3.1.1 Sequence of Events ................... ... 11

3.1.2 Extent of Fire Damage ..... ............. 12

3.2 Criteria for Fire Prevention and Control .... ....... 14

3.3 Fire Prevention ..... .................... ... 15

3.3.1 Fire Prevention in Design .............. .. 15

3.3.2 Operating Considerations in Fire Prevention . . 16

3.4 Criteria for Combustibility of Materials .... ....... 17

3.4.1 Cable Insulation Criteria .............. .. 17

3.4.2 Criteria for Fire Stops and Seals .... ....... 19

3.5 Fire Fighting ...... ... .................... 21 L

3.5.1 Fire Detection and Alarm Systems ........... 22

3.5.2 Design of Fire Extinguishing Systems ........ 22

3.5.3 Ventilation Systems and Smoke Control ....... .22

3.5.4 Fire Fighting ....... ................. 25

3.5.5 Prevention and Readiness Efforts During

Construction and Operation ........... ... 26

iii
iv

TABLE OF CONTENTS (Continued)

Page No.

4.0 SYSTEMS CONSIDERATIONS ....... ................... 28

4.1 Availability of Systems During the Event .... ....... 28

4.1.1 Redundancy of Reactor Core Cooling

Equipment ....... .................. 30

4.1.2 Role of Normal Cooling Systems ............. 31

4.2 Redundancy and Separation-General Considerations . . 32

4.3 Separation of Redundant Electric Circuits ........ .. 35

4.3.1 Common Mode Failures Caused by the Fire . . . . 35 F

4.3.2 Common Mode Failures Attributable to

Indicator Light Convections ........... .. 35

4.3.3 Proximity of Cables of Redundant

Divisions ..... .................. ... 36

4.3.3.1 Trays and Conduit ............... 36

4.3.3.2 Non-Divisional Cables ............. 37

4.3.3.3 Cable Spreading Room .... ......... 37

4.3.4 Physical Separation Criteria for Cables . . . . 37

4.3.4.1 Browns Ferry Criteria for Physical

Separation and Isolation of Redundant

Circuits .... .............. .. 37

4.3.4.2 Comparison of Browns Ferry Separation

Criteria with Current NRC Separation

Criteria............ . .. . 40

4.3.4.3 Adequacy of Existing NRC Separation

Criteria .... .............. .. 42

4.3.4.4 Criteria for the Future ........... 42

4.4 Instrumentation Required for Operator Action ....... 46

5.0 TVA ACTIONS AFFECTING THE INCIDENT ..... ............. 48

5.1 TVA Organization ...... ................... .. 48

5.1.1 General ......... .................... 48

5.1.2 Quality Assurance Organization and OA Plan. .. 48

5.1.2.1 Design and Construction ........... 48

5.2 Lapses in Quality Assurance at Browns Ferry ........ 49

5.3 Plant Operating Staff ..... ................. .. 50

5.3.1 Radiological Monitoring ............... ... 50

5.3.1.1 Onsite ....... ................ 50

5.3.1.2 Offsite ...... ................ 51

6.0 ROLE OF U.S. NUCLEAR REGULATORY COMMISSION ............. 52

6.1 Introduction ......... ..................... 52

6.1.1 Responsibility for Safety .............. .. 52
v

TABLE OF CONTENTS (Continued)

Page No.

6.2 Organization ...... ..................... .. 52 -[

6.2.1 IE ........ ....................... 52

6.2.2 NRR ....................... 52

6.2.3 NRC Organization - Application to Unusual

Events and Incidents ..... ............. 52

6.2.4 NRC Organization for Quality Assurance ..... .. 54

6.2.5 Evolution of Regulatory Requirements ........ 55

6.3 NRC Action Before the Fire ...... .............. 55

6.3.1 Design and Operating Criteria .... ......... 56 F

6.3.2 Quality Assurance....... ... ..... ... ... 57

6.3.3 Inspection of Licensee Operations . . . . . . . 57

6.4 NRC Action During and After the Fire .... ......... 58

6.4.1 During the Fire and the First 24 Hours

Afterwards. ........................... 58

6.4.2 After March 23, 1975. .................. . 59

7.0 RESPONSE OF OTHER GOVERNMENT AGENCIES .............. .. 61

7.1 Summary ........ ....................... .. 61

7.2 State Governments ..... ................... .. 61

7.2.1 Alabama ...... .................... .. 61

7.2.2 Tennessee ....... ................... 62

7.3 Local Governments ..... ................... .. 63

7.3.1 Limestone County, Alabama .............. .. 63

7.3.2 Lawrence County, Alabama ... ........... .. 63

7.3.3 Morgan County, Alabama ..... ............ 63

7.3.4 Athens Fire Department .................. 63

7.3.5 Tri-County Health Department .............. 63

7.3.6 Drills and Exercises .... ............. .. 64

7.4 Federal Agencies ...... ................... .. 64

7.4.1 Energy Research and Development

Administration ...... ............... 64

7.4.2 Other Federal Agencies .................. 64

REFERENCES ....... ..... ........................... 67

APPENDIXES

A. NRC Announcement No. 45, "Appointment of Special

Review Group," March 26, 1975 ................. 73

B. Management Directive Regarding Interface Between

Licensing (Now NRR) and Regulatory Operations L

(Now IE), December 29, 1972 ..... ............. 75

C. Feasibility of Retrofitting Existing Designs to

Provide Redundant Cable Spreading Rooms ........... 82
vi a

TABLE OF CONTENTS (Continued)

Page No.

TABLES

1. Cable Materials ..... .................... ... 17 L

2. Assignment of Damaged Cables to Redundant Divisions. . 33

3. Unit I Redundant Subsystems Not Available .......... 35

4. Comparison of Browns Ferry FSAR Separation

Requirements with Regulatory Guide 1.75 .......... 38

FIGURES 1-

1. Area of Fire ...... ..................... .. 13

2. Region of Influence of Fire in Cable Tray .......... 43

3. NRC Organization Chart ....... ................ 53
GLOSSARY

ADRH

AEC

AWG

B1 owdown

Cardox

CD

CECC

CFR

Chemox

CO2

Condensate

booster pump

CP

CRD

DCPA

DRH

EACT

ECCS

EOC

EPA

ERDA

FDA-BRH

Feedwater

Fl amemasti c

FR

FSAR

GDC

gpm

HPCI

Assistant Director of Radiological Health, State of

Tennessee.

U.S. Atomic Energy Commission (abolished January 1975).

American Wire gauge.

Release of reactor steam through relief valves in

quantities sufficient to decrease reactor pressure.

A proprietary fixed carbon dioxide fire-fighting system.

Civil defense co-ordinator.

Central Emergency Control Center, TVA.

Code of Federal Regulations.

A proprietary self-contained breathing apparatus.

Carbon Dioxide.

Pump that forms part of feedwater system.

Construction permit.

Control rod drive-hydraulic mechanisms that move the control

rods.

Defense Civil Preparedness Agency.

Director of Radiological Health, State of Alabama or Tennessee.

Emergency Action Co-ordination Team of ERDA.

Emergency core cooling system.

Emergency operations center of ERDA at Germantown, Md.

Environmental Protection Agency.

Energy Research and Development Administration.

Bureau of Radiological Health, Food and Drug Administration,

Department of Health, Education, and Welfare.

Normal way of pumping water into the reactor for conversion

into steam to run the turbine - generator.

A proprietary coating material to improve fire resistance.

Federal Register (daily announcement journal).

Final Safety Analysis Report (Operating Liqense).

General Design Criteria for reactors; 10 CFR 50,

Appendix A.

Gallons per minute, a measure of water flow.

High pressure injection system, part of ECCS.

vii

V

I.

L
viii

a

IE

IEEE

IRAP

NEL-PIA

NFPA

NRC

NRR

OL

PSAR

psig

QA

QAP

RCIC

Relief Valve

RHR

SAR

Scram

SER

SLC

Suppression

pool

TVA

UL

Office of Inspection and Enforcement, NRC.

Institute of Electrical and Electronics Engineers.

Interagency Radiological Assistance Plan.

Nuclear Energy Liability and Property Insurance

Association.

National Fire Protection Association.

U.S. Nuclear Regulatory Commission.

Office of Nuclear Reactor Regulation, NRC.

Operating license.

Preliminary Safety Analysis Report (Construction Permit).

Pounds per square inch gauge, a measure of pressure.

Quality Assurance.

Quality assurance (program) for design, procurement,

manufacture, construction, and operation.

Reactor core isolation cooling system.

Method of releasing steam from the reactor.

Residual heat removal system - uses river water to cool

reactor and suppression pool.

Safety Analysis Report (by applicant).

Shutdown of nuclear reaction by rapid insertion of all

control rods into the core.

Safety Evaluation Report (by NRC).

Standby liquid control - a system for pumping water or

boron solution into the reactor.

Large tank half full of water. Steam from relief valves

is piped to below surface of pool, which condenses the

steam.

Tennessee Valley Authority.

Underwriters' Laboratories.

F
1.0 SUMMARY AND RECOMMENDATIONS

1.1 introduction

On March 22, 1975, a fire was experienced at the Browns Ferry Nuclear Plant near Decatur, Alabama.

The Special Review Group was established by the Executive Director for Operations of the Nuclear

Regulatory Commission (NRC) soon after the fire to identify the lessons learned from this event

and to make recoimmendations for the future in the light of these lessons. Unless further

developments indicate a need to reconvene the Review Group, its task is considered complete with

the publication of this report.

The Review Group's recomm~endations cover a variety of subjects. The responsibility for implementation of the various recommnendations belongs to the Nuclear Regulatory Commission generally,

and to appropriate offices within the NRC specifically.

Although recommendations are offered on a variety of specific items where improvements could be

useful, the Review Group does not believe that action is needed in every plant in response to

each of these comments. The overall objective of the recommendations is to achieve an acceptable

degree of protection from fires.- A balanced approach must be used in the application of the

recommendations to specific facilities, with due consideration for the details of the design and

construction of each specific plant.

The Review Group has not duplicated the investigation into the incident conducted by the Office

of Inspection and Enforcement or the safety review conducted by the Office of Nuclear Reactor

Regulation, both reported elsewhere. However, these reports, as well as input from the Tennessee

Valley Authority and other sources, were used by the Review Group in its evaluation.

The Group's recommendations are necessarily based on today's knowledge and understanding. The

Browns Ferry Construction Permit was issued in 1966, and its issuance based on the state of

knowledge at that time. Similarly, the Operating License review in 1970-72 was based on the

technology of that period. Many things that are now deemed evident as a result of the incident

and its analysis were not evident previously. The recommendations of the Review Group reflect

the increase in knowledge and understanding during recent years.

1.2 Sequence of Events in the Fire

The Browns Ferry plant consists of three boiling water reactors, each designed to produce 1067

megawatts of electrical power. Units 1 and 2 were both operating at the time of the fire. Unit

3 Is still under construction.

Units 1 and 2 share a common control room with a cable spreading room located beneath the control

room. Cables carrying electrical signals between the control room and various pieces of equipment in the plant pass through the cable spreading room.

The immediate cause of the fire was the ignition of polyurethane foam which was being used to

seal air leaks in cable penetrations between the Unit 1 reactor building and a cable spreading

room located beneath the control room of Units 1 and 2. The material ignited when a candle

flame, which was being used to test the penetration for leakage, was drawn into the foam by air

flow through the leaking penetration.

Following ignition of the polyurethane foam, the fire propagated through the penetration in the

wall between the cable spreading room and the Unit 1 reactor building. In the cable spreading

room, the extent of burning was limited and the fire was controlled by a combination of the

installed carbon dioxide extinguishing system and manual fire fighting efforts. Damage to the

cables in this area was limited to about 5 feet next to the penetration where the fire started.

The major damage occurred in the Unit 1 reactor building adjacent to the cable spreading room,

in an area roughly 40 feet by 20 feet, where there is a high concentration of electrical cables.

About 1600 cables were damaged. There was very little other equipment in the fire area, and the

only damage, other than that to cables, trays, and conduits, was the melting of a soldered joint

on an air line and some spalling of concrete.

The electrical cables, after insulation had been burned off, shorted together and 'grounded to

their supporting trays or to the conduits, with the result that control power was lost for much

of the installed equipment such as valves, pumps, and blowers. Sufficient equipment remained

I
2S

operational throughout the event to shut down the reactors and maintain the reactor cores in a

cooled and safe condition, even though all of the emergency core cooling systems for Unit 1 were

rendered inoperable, and portions of the Unit 2 systems were likewise affected. No release of

radioactive material above the levels associated with normal plant operation resulted from the

event.

In addition to the cable damage, the burning insulation created a dense soot which was deposited

'throughout the Unit 1 reactor building and in sane small areas in the Unit 2 reactor building. T

The estimated 4,000 pounds of polyvinyl chloride insulated cable which burned also released an

estimated 1400 pounds of chloride to the reactor building. Following cleaning, all exposed

surfaces of piping, conduit, and other equipment were examined for evidence of damage. Piping

surfaces where soot or other deposits were noted were examined by dye penetrant procedures.

With the exception of small (3 and 4 inch diameter) uninsulated carbon steel piping, one run of

aluminum piping, heating and ventilation ducts, and copper instrument lines in or near the fire

zone, no evidence of significant chloride corrosion was found. Where such evidence was found,

the material affected will be replaced. For some stainless steel instrument lines, an accelerated

inspection program has been established to determine if effects of chloride may later appear.F

1.3 How Safe was the Public?

The Review Group has studied the considerable evidence now available on the Browns Ferry fire

and has considered the possibility that the consequences of the event could have been more

severe, even though in fact they were rather easily forestalled. It is certainly true that, in

principle, degraded conditions that did not occur could have occurred. Some core cooling systems

were, or became, unavailable to cool the core; others were, or became, available and some of

these were used to cool the core. Much attention was drawn to the unavailability of Emergency

Core Cooling Systems. While it is certainly true that the availability of these systems would

have been comforting, they were not required during the Browns Ferry fire. In the absence of aloss of coolant accident, systems other than those designated as emergency core cooling systems

are capable of maintaining an adequate supply of water to the core. This was indeed the case

during the fire at Browns Ferry.

One way of looking at public safety during this event is to inventory the subsystems that were

available at various times during the course of the fire and to assess their redundancy, and to

consider what actions were potentially available to increase the redundancy. This is considered

in Section 4.1.1. Such an inventory shows that there was a great deal of redundant equipment

available or potentially available during most of the incident. Two periods of limited redundancy

were:

1. The period (about one-half hour) before Unit 1 was depressurized at 1:30 p.m. During this

period, the operating high pressure pumps had insufficient capacity to inject additional

water to make up for steam loss, but could have been augmented in several ways. Alternatively, the system could have been depressurized to allow utilization of redundant low

pressure pumps, and this was done.

2. The period (about four hours) during which remote manual control of the Unit 1 relief

valves, and thus the capability to depressurize the reactor, was lost. During this period,

only high-pressure pumping could be effective; there remained available three control-rod

drive pumps, any one of which could keep the core covered and cooled, provided that a steam

drain valve was opened (this was done some hours later) or a bypass valve opened. In

addition, two standby liquid control system pumps were also available, which together could

keep the core covered with the steam drain valve open, and either of which, added to any

one control-rod drive pump, could keep the core covered even without a drain or bypass

valve being opened. Other actions were available which could have been taken to augment

high pressure capability or to restore low pressure capability.

Actually, the remote manual control of the relief valves was restored and the added redundancy

of the three available condensate booster pumps made the other options academic. These other

options are discussed in Section 4.1.1.

A probabilistic assessment of public safety or risk in quantitative terms is given in the Reactor

Safety Study (1). As the result of a calculation based on the Browns Ferry fire, the study

concludes that the potential for a significant release of radioactivity from such a fire is

about 20% of that calculated from all other causes analyzed. This indicates that predicted

potential accident risks from all causes were not greatly affected by consideration of the

Browns Ferry fire. This is one of the reasons that urgent-action in regard to reducing risks

due to potential fires is not required. The study also points out that "rather straightforward

measures, such as may already exist at other nuclear plants, can improve fire prevention and

I
3

fire-fighting capability and can significantly reduce the likelihodA of a potential core melt

accident that might result from a large fire." The Review Group agrees.

Fires occur rather frequently; however, fires involving equipment unavailability comparable to

the Browns Ferry fire are quite infrequent (see Section 3.3). The Review Group believes that

steps already taken since March 1975 (see Section 3.3.2) have reduced this frequency significantly.

1.4 Perspective

The Browns Ferry fire and its aftermath have revealed some significant inadequacies in design

and procedures related to fires at that plant. In addition to the direct fire damage, there

were several kinds of failures. Some equipment did not function correctly, and, in hindsight,

some people's actions were incorrect or at least not as effective as they should have been. The

fire, although limited principally to a 201x40' interior space in the plant, caused extensive

damage to electric power and control systems, impeded the functioning of normal and standby

cooling systems, degraded the capability to monitor the status of the plant, and caused both

units to be out of service for many months. The history of previous small fires that had occurred '

at this plant, the apparent ease with which the fire started and cable insulation burned, and

the many hours that the fire burned--all indicate weaknesses in fire prevention and fire fighting.

The inoperability of redundant equipment for core and plant cool-down shows that the present

separation and isolation requirements should be reexamined. Deficiencies in quality assurance

programs were also revealed.

There is another way of looking at the lessons of the Browns Ferry fire. The outcome with

regard to the protection of public health and safety was successful. In spite of the damage to

the plant as a result of the fire, and the inoperable safety equipment, the reactors were shut

down and cooled down successfully. No one on site was seriously injured. No radioactivity

above normal operating amounts was released; thus there was no radiological impact on the public

as a result of the fire. The nuclear fuel was not affected by the fire and the damage to the

plant is being repaired. Based on its evaluation of the incident, the Review Group believes

that even if a fire such as the one at Browns Ferry occurred in another existing plant, the most

probable outcome would not involve adverse effects on the public health and safety.

The question naturally arises: How can a serious fire that involved inoperability of so many

important systems result in no adverse effect on the public health and safety? The answer is to

be found in the defense-in-depth used to provide safety in nuclear power plants today. It

provides for achieving the required high degree of safety assurance by echelons of safety features.

The defense-in-depth afforded in this way does not depend on the achievement of perfection in -

any single system or component, but the overall safety is high.

The lessons of Browns Ferry show that defense against fires had gaps, and yet the outcome of the

fire shows that the overall defense-in-depth was adequate to protect the public safety.

The Review Group suggests that this principle be applied in defense against fires. This defensein-depth principle would be aimed at achieving safety through an adequate balance in:

1. Preventing fires from getting started.

2. Detecting and extinguishing quickly such fires as do get started and limiting their damage.

3. Designing the plant to minimize the effect of fires on essential functions.

No one of these echelons can be perfect or complete. Strengthening any one can compensate in

some measure for deficiencies in the others.

1.5 General Conclusions

Based on its review of the events transpiring before, during and after the Browns Ferry fire,

the Review-Group concludes that the probability of disruptive fires of the magnitude of the

Browns Ferry event is small, and that there is no need to restrict operation of nuclear power

plants for public safety. However, it is clear that much can and should be done to reduce even

further the likelihood of disabling fires and to improve assurance of rap4d extinguishment of

fires that occur. Consideration should be given also to features that would increase further

the ability of nuclear facilities to withstand large fires without loss of important functions

should such fires occur. The Review Group believes that improvements, especially in the areas

of fire prevention and fire control, can and should be made in most existing facilities.

The Office of Nuclear Reactor Regulation in its evaluation of individual plants must weigh all

of the factors involved in fire prevention, detection, extinguishing, and system design to
4a

assure that an acceptable balancing of these factors is achieved. For each plant, the actual

measures to be taken will depend on the plant design and the nature of whatever improvement may

be needed. The various alternatives available in each case should be evaluated consistent with

these factors.

1.6 Principal Recommendations p

In the following subsections, the Review Group's principal recommendations are summarized. For

further information regarding a recommendation, the reader is referred to the place in the body

of this report where the recommendation and its basis are discussed in detail.

As indicated in the discussions of several specific topics in this report, there is presently a

notable lack of definitive criteria, codes, or standards related to fire prevention or fire

protection in nuclear power plants. Likewise, the existing criteria covering separation of

redundant control circuits and power cables need revision. The review group recommends that

development or revision of the needed standards and criteria receive a high priority. The group

also recommends that the regulatory guidance regarding the proper balancing of the three factorsF

identified as defense-in-depth principles for fires in Section 1.4 of this report be augmented.

The reader should be reminded that not every recommendation applies to every nuclear power

plant. For each plant, a comprehensive evaluation should be conducted using the perspective in

Section 1.4 and the echelons of safety discussed therein. The design of that plant, together

with its operating and emergency procedures, should be reviewed to determine whether changes are

needed to achieve adequate defense in depth for fires at that facility. Each echelon of safety

should be sufficiently effective; the overall safety and the balance among the echelons should

also be considered.

The Review Group's recommendations can therefore be regarded to some extent as representing

alternatives to the designer or evaluator. Other alternatives besides those recommended by the

Review Group may be equally acceptable. From among the various alternatives, those appropriate

and sufficient should be chosen for a given plant. For different plants, it will quite likely

be found that different choices are appropriate and sufficient.

1.6.1 Fire Prevention

The first line of defense with regard to fires is an effective fire prevention program. The

Review Group's recommendations for fire prevention are discussed in detail in Sections 3.3 and

3.4.

An undesirable combination of a highly combustible material (not included in the design) and an

unnecessary ignition source (the candle's use as a leak detector) represent the specific cause

of the Browns Ferry fire. Once the fire was started, other combustible materials, primarily

cable insulation and penetration sealant, enabled the fire to spread. The ease with which the

fire was started and the rapid ignition of these other materials indicates a deficiency in the

fire prevention provisions for Browns Ferry.

Information obtained from licensees and from special inspections performed at other reactor

sites by the NRC indicate that similar types of deficiencies also exist to some degree at other

facilities. None of the facilities, however, was found to have the combination of highly combustible flexible foam, unfinished penetrations, and incomplete work control procedures which

existed at Browns Ferry. Several facilities had open penetrations between the cable spreading

room and the control room or between the cable spreading room and other plant areas. Since some

facilities had no reference to fire stops or penetration seals in their Safety Analysis Reports,

and since the NRC had placed no emphasis in these areas, actual conditions vary widely. NRC and

licensee programs are underway to upgrade those plants that need it.

The Review Group recommends that greater attention be given to fire prevention measures generally

in nuclear plants, and that they should be reviewed and upgraded as appropriate in this respect.

Consideration should be given to limiting the amount and nature of combustible material used in

nuclear plants, to use of flame retardant coatings for combustible material where appropriate, L.

and to the use of measures to control potential ignition sources such as open flames or welding

equipment.

In implementing this recommendation, guidance in the form of standards or Regulatory Guides is

needed and should be developed. Such guidance must strike a reasonable balance among the factors

involved. For example, if the fire zone approach (section 4 of this report) is used, the flammability of materials may not have the same degree of importance as in other designs; if small

amounts of combustible material are present in a given area, the need for fire retardant coatings
5

is reduced. Standard qualification tests should be developed to assure that acceptable materials

and configurations are used for items such as cable insulation and penetration seals. Some

research will be needed to develop improved tests to characterize the flammability and the

nature of the products of combustion of potentially flammable materials.

The flexible polyurethane foam that caught fire in Browns Ferryi was not part of the original

design, but was being used to stuff into holes to stop leaks. Recent tests have shown that

seals containing this material are highly flammable. The Review Group recommends that seals 17

containing this material should be removed and replaced where possible; where this is not

possible, other measures should be taken as needed to assure safety. Other types of polyurethane foam, including that used in the original Browns Ferry design, are less flammable; the

potential improvement in safety from their replacement should be balanced against the potential

hazard of disturbing a large number of cables and seals.

1.6.2 Fire Fighting

It must be anticipated that fires will occasionally be initiated in spite of fire prevention

measures. Any fire that does get started should be detected, confined in extent, and extinguished promptly. Discussion of the Review Group's recommendations in this area is given inF

Section 3.5.

There was smoke in the Browns Ferry spreading room, but the smoke detectors did not alarm,

possibly because the normal flow of air from the spreading room to the reactor building drew

the smoke of the fire away from the installed detector in the spreading room. The smoke also

penetrated the control room (through the unsealed cable entryways) but the fire detectors

installed in the control room were of the ionization type which did not detect the products of

combustion generated by the cable fire and did not alarm. There was a great deal of smoke in

the reactor building in the vicinity of the fire, but detectors had not been installed in that

area. Detectors should be designed to detect the products of combustion of the combustible

materials actually or potentially present in an area and should be properly located.

The fire in the Browns Ferry cable spreading room was controlled and extinguished without the

use of water,. By contrast, the fire in the reactor building was fought unsuccessfully for

several hours with portable carbon dioxide and dry chemical extinguishers; however, once water

was used, it was put out in a few minutes. During the long period of burning, there were progressive increases in the unavailability of equipment important to safety.

It is obvious that the longer a fire burns, the more damage it will do. The Browns Ferry fire

shows that prompt extinguishing of a fire is, in most circumstances, also the way to limit the

consequences of a fire on public safety. Fire experts consulted by the Review Group and the

experience at Browns Ferry suggest that if initial attempts to put out a cable fire without the

use of water are unsuccessful, water will be needed. Many people have been taught, "Don't use

water on electrical fires." The Group is concerned that widespread opinion and practice emphasize the reasons for not using water as compared to those for its prompt use. Procedures and

fire training should give the use of water appropriate emphasis In the light of the foregoing

considerations.

The Review Group recoimmends that serious consideration be given to installing or upgrading fixed

water sprinkler systems, and to making them automatic. This is especially important in areas

containing a high density of cables or other flammable materials, where there is a combination

of flammable materials and redundant safety equipment or where safety equipment is located and

where access for fire fighting would be difficult. Adequate fire hoses should also be provided,

and access for manual fire fighting should be considered in the design and in procedures.

Capability for the control of ventilation systems to deal with fire and smoke should be provided,

but such provisions must be compatible with requirements for the containment of radioactivity.

These provisions and requirements may not be mutually compatible and in some cases may be in

direct conflict with each other. For example, operating ventilating blowers to remove smoke may

fan the fire; the same action may also result in a release of radioactivity, either directly by

transport of radioactive particles with the smoke or by decreasing the effectiveness of filters

whose purpose it is to aid in containing the radioactivity. It is obvious that some compromise

will be necessary and that flexibility of operation may be needed, depending on the nature of

any event that may occur. The pros and cons of each provision and requirement should be considered in the development of detailed guidance.

The control room should be protected as well, both from radioactivity and from smoke or toxic

gases. Adequate breathing apparatus and recharging equipment should be available for operators,

fire fighters, and damage control crews which may be working simultaneously during a prolonged

incident.
6

In addition to adequate equipment design, successful fire fighting requires testing and maintenance of the equipment and training and practice as teams under realistic conditions for the

onsite and offsite personnel who must fight the fire. Onsite and offsite equipment should be

compatible. Emergency plans should recognize the need for fire fighting concurrent with other

activities. They should provide for division of available personnel into preassigned, trained

teams responsible for the various activities needed, with proper utilization of offsite firefighters.

1.6.3 Provisions to Maintain Important Functions in Spite of a Fire

The public safety importance of a fire in a nuclear power plant arises from its potential consequences to the reactor core and the public. During the course of the Browns Ferry fire, numerous

systems became unavailable as a result of the cable damage. By a combination of alternative

switching, manual manipulation of valves. remote controls, and temporary wiring, the operating

staff kept enough equipment operating to shut down and cool down the reactor cores. Redundancy

was available at all times in case additional outages had occurred.

Redundancy is introduced into system design so that one or more unavailable components or sub- T

systems will not make the system function unavailable. The effectiveness of redundancy dependsr

on the independence of the redundant equipment. The Browns Ferry fire induced failures of sane

of the redundant devices that were provided, thus negating the redundancy and failing the system.

It is now known that the independence was negated by two errors: (1) wires connecting indicator

lamps in the control room to control circuits for redundant safety equipment were not separated from each other; the fire damaged some of these wires in such a way as to cause unavailability

of the redundant equipment, and (2) wires of redundant subsystems were routed in the same area

in the mistaken belief (embodied in design criteria) that putting one set of such wires in

electrical conduit (a lightweight pipe) would protect it. In the fire, the conduit got too hot

and the wires in it short-circuited. This caused concurrent unavailability of the redundant

safety equipment, part of which was fed from failed electrical circuits in the burning trays,

and the other part, fed from the failed wires in the conduit.

The Review Group has concluded that existing separation and isolation criteria need improvement.

A suitable combination of electrical isolation, physical distance, barriers, resistance to

combustion, and sprinkler systems should be applied to maintain adequately effective independence

of redundant safety equipment, and therefore the availability of safety functions, in spite of

postulated fires. Detailed discussions of the independence of redundant subsystems, separation

criteria, and other systems considerations are given in Chapter 4.

The Review Group notes that while some methods of improving separation are practicable only onnew designs, others are feasible and practical on existing plants. Examples of the latter type

are addition of barriers, fire-retardant coatings, and sprinkler systems, which contribute to

improvement of fire fighting as well as to maintenance of important functions in spite of postulated fires.

1.6.4 Quality Assurance

Quality assurance (QA) programs are intended to catch errors in design, construction, and operation, and to rectify such errors; QA is an essential component of defense-in-depth. Many aspects

of the Browns Ferry fire can be considered as lapses in QA. Examples are unfinished fire stops,

inadequate separation of cables containing indicator lamp circuits, testing operations with a

candle, use of highly flammable material to plug leaks in fire stops, and failure to pay attention to earlier small candle-induced fires.

The Review Group believes that the causes, course, and consequences of the Browns Ferry fire are

evidence of substantial inadequacies in the Browns Ferry QA program. A revised QA program has

been adopted by TVA; the Group has not evaluated the details of the new program. It should be

evaluated in the light of experience. The Review Group notes that NRC (and formerly AEC)

licensing review and inspection also failed to uncover these lapses in QA.

The extensive QA requirements of the NRC are applied to systems and components designated as

important to reactor and public safety. Before the Browns Ferry fire, this did not include such

items as fire protection systems or sealing of penetrations in walls, floors, and other barriers

aside from radioactivity containment structures. The QA requirements of the NRC are being

revised consistent with increased attention to fire protection in all NRC licensing, standards,

and inspection activities.

The QA programs of all nuclear power plant licensees should be reviewed. QA programs in some

operating plants that are known not to conform to current standards should be upgraded promptly.

The NRC review of licensee QA programs should be correspondingly upgraded, in particular to
7

include explicitly fire protection, fire fighting, and provisioni toimaintain important functions

in spite of a fire. Detailed discussion of QA is given in Sections 5.1 and 5.2, for TVA actions,

and Section 6.3.2, for NRC action.

1.6.5 Response of Other Governmental Agencies

If the Browns Ferry fire had developed into a situation where action by other governmental 17

agencies would have been required to protect people located offsite, effective action would have

depended on effective communication between TVA personnel and the cognizant Federal, State, and

local governmental agencies; see the discussion in Chapter 7. In accordance with emergency

plans, TVA personnel notified radiation control supervisors of the States of Alabama and Tennessee

and maintained communication with them until the fire was out. These States attempted to notify

additional agencies as indicated in their radiological emergency plans, even though a radiological

emergency did not exist. These attempts at notification revealed that elements of the Alabama

plan had weaknesses. More frequent exercises and drills to check the response of governmental

emergency organizations are needed in order to maintain an effective response posture of these

organizations. The Review Group has not studied the question whether drills involving the F

general public should be instituted and has no recommendation on this subject.

1.6.6 Recommendations for the NRC

The NRC must also consider the Browns Ferry lessons for improving its policies, procedures, and

criteria. The NRC is responsible for assuring the health and safety of the public and the safe

operation of Browns Ferry and all other reactors. NRC provides this assurance of public safety

through the establishment of safety standards, evaluation of the safety of plants, and

inspection and enforcement programs. The licensee, TVA, has the responsibility for the safe

design, construction, and operation of its plant within the framework of the NRC regulatory

program. If the NRC were to become too closely involved in the licensee's operations, this

might have an adverse effect on the licensee's view of his safety responsibilities. In other

words, it is the licensee's responsibility to operate the reactor safely, and it is NRC's

responsibility to assure that he does so.

The Review Group's evaluation of the events associated with the fire indicates that improvements

are needed in NRC licensing, standards development, and inspection programs. NRC actions and

related Review Group recommendations are discussed in Chapter 6. The Review Group recommends

that ongoing efforts to upgrade NRC programs in fire prevention and control and related QA be

expanded as needed, and as recommended elsewhere in this report, and coordinated to form a more

coherent regulatory program in this area. "

During the incident, troubles were experienced with communications among TVA, NRC, and other

organizations. The Review Group believes that some communications problems are inevitable but

that improved communications facilities are feasible and should be provided. A systems study on

communication needs is at least as important as purchase of new equipment; both should be

undertaken.

After the fire occurred and the initial evaluation indicated that public safety had been maintained, the division of responsibility within NRC between the Office of Inspection and Enforcement (IE) and the Office of Nuclear Reactor Regulations (NRR) resulted in an unnecessary delay

of several weeks in accomplishing a detailed technical evaluation by NRC of the safety of the

plant in the post-fire configuration. While the Review Group finds no evidence that there was

any immediate hazard during this period of time, certain aspects of the plant status were

improved following the detailed technical evaluation performed in May 1975, by NRR. Specifically,

the minimum crew size was increased to provide for required manual valving operations, and added

cooling system redundancy for critical components such as the diesel generators was provided.

The Review Group recommends that the procedures followed by NRR and IE in evaluating the safety

of the Browns Ferry plant be revised to ensure that detailed safety review of such an occurrence

will be more timely in the future.

The Review Group has consulted with cognizant NRC management during its review, and is aware

that programs to implement recommendations contained in this report are being developed in

several areas.
8a

2.0 INTRODUCTION

2.1 Objective and Plan of this Report

2.1.1 Objective

In this evaluation of the Browns Ferry fire incident, the Special Review Group has reviewed the

design and design criteria of the equipment involved, and the actions of persons and organizations before, during, and after the incident. The objective, as stated in the Group's Charter

()*was:

"... to review the circumstances of the incident and to evaluate its origins andr

consequences from both technical and procedural viewpoints.

"The Group's review is not intended to duplicate, or substitute for, the necessary

investigations by the licensee and the staff of NRC I&E Region II. Rather, the

Group is charged with marshalling the facts from these investigations and evaluating

them to derive appropriate proposed improvements in NRC policies, procedures, and

technical requirements."

In accordance with this charter, the Review Group has tried to distill from the available

information those lessons that should be learned for the future. Some of these lessons apply -

to operating groups, others to designers, standards developers, State and local authorities,

and the NRC.

2.1.2 Plan of this Report

The summary of this report is presented in Chapter 1, including the major recommendations.

Following the introduction of Chapter 2, Chapter 3 deals with the fire, including fire prevention

and fire fighting, and also materials combustibility considerations. Chapter 4 includes systems

considerations. It covers the availability and non-availability of plant subsystems during the

event, and considers criteria for the separation of redundant subsystems, including their

associated electrical cables. Chapters 5, 6, and 7 deal with people's actions and proceduresfor such actions, for TVA, NRC, and other governmient bodies, respectively.

2.2 Sources of Information

The Review Group did not attempt to du~plicate other fact-finding investigations into the incident.

Rather, these were used as sources of information for our evaluation, as discussed in the

following paragraphs. This information was supplemented as needed from other sources.

Where information from published sources is essential to understanding the Review Group's

conclusions and recommendations, it has been briefly summarized. Otherwise, the report relies

heavily on referencing this material.

The licensee, Tennessee Valley Authority, is conducting an extensive engineering and administrative program related to the incident. The TVA Recovery Plan (3) includes the report of the TVA

Preliminary Investigating Conmmittee, investigations into chemical, structural, and electrical

damage, and a program to restore the plant to operation. The Group has obtained much useful

information from the Recovery Plan (a much-revised and expanded document now approaching 1000

pages) and from detailed supporting information (4) furnished by the licensee.

With the issuance of its Investigation Report (5), the NRC Office of Inspection and Enforcement

completed its investigation of the proximate causes, course, and consequences of the fire. TheL

conclusions and findings in that report are presented in a detailed reconstruction of theL

events of the incident, which in turn is based on extensive witness interrogation and technical

analysis. This constituted a principal source of information for the Review Group's evaluation.

As a result of the IE-Region II investigation of the Browns Ferry fire, an enfcircement letter

was sent to TVA itemizing infractions, areas of concern, conclusions, and findings of facts as

perceived by the investigating team (6). TVA has replied to the letter (7), taking issue with

Reproduced as Appendix A
Bf

9

some of the items and agreeing with others. A reply was sent from the Region II Office (8)

acknowledging one error of fact in the enforcement letter and commenting on the TVA response to

it. There are several areas where differences of opinion still exist. Some of the differences

involve conflicting statements by different people interviewed by the investigators, some

represent differing views as to the interpretation of requirements, and some represent opposing

philosophical views. It is evident from this correspondence and from testimony presented at

the JCAE hearing that differing viewpoints will persist with regard to interpretation and

philosophy, and that the conflicting statements can never be fully reconciled. The Review

Group has considered these different views, and has also sought expert guidance from outside

sources, in reaching the conclusions presented in this report.

In pursuit of its licensing responsibilities, the NRC Office of Nuclear Reactor Regulation

(NRR) formed a Task Force to evaluate the safety of the Browns Ferry reactors following the

incident and during reconstruction and return to operation. Several reports, technical specification changes, and safety evaluations are available (9). They summarize referenced technical

information supplied by the licensee and evaluate the safety of the reactors in the post-fire

configuration and during the proposed restoration or operational phase. The Review Group has

used this material as an important source of information in its study.

The licensee's Restoration Plan is still under development and includes 35 revisions received

by the time of writing (3). Much additional information regarding proposed design features

remains to be developed by TVA, along with its analysis of the safety of the plant as restored.

Each step in the restoration program, and each change in plant configuration, must be authorized

by the NRC. Each authorization is based on an NRC safety evaluation, which in turn depends

primarily on information and analysis furnished by TVA. Future steps not yet authorized will

be covered by future NRC safety evaluations.

After the fire, the Nuclear Energy Liability and Property Insurance Association (NEL-PIA)

visited the Browns Ferry plant. This investigation report (65) and other documents (20) contain

recommendations for Browns Ferry that are also stated to be generally applicable to other

plants (20). NRC comments on the NEL-PIA recommendations as they apply to Browns Ferry have

already been published (67). The Review Group has considered all of the NEL-PIA reports and

recommendations in its evaluation. Discussion by the Review Group of the various subjects

treated by NEL-PIA will be found in the appropriate sections of this report.

2.3 Scope of Review

In view of the objective of the Review Group as delineated in Section 2.1, and of the other NRC

activities described in Section 2.2., the purview of this report is limited to the lessons to

be learned from the Browns Ferry incident. The viewpoint is toward application of these lessons.

Where appropriate, back-fitting of operating plants is considered as well as plants under

construction and those not yet designed, but these considerations are general and not specific

to any single plant. In particular, while the lessons surely pertain to the Browns Ferry

reactors, the application of these lessons to Browns Ferry, as to all specific reactors, is

left to the cognizant NRC organizations. The special circumstances of removing and restoring

the damaged portions of the Browns Ferry plant, and the safety requirements for these operations

and the redesign involved, are, as noted in Section 2.2.3, the purview of a special NRR Task

Force.

2.4 Note on Changes with the Passage of Time

The Group's review is necessarily based on knowledge and understanding at the time of writing--

1975/76. The reader must, however, understand that safety technology continues to develop as

new knowledge and experience is gained and that safety evaluation is a growing and evolving

art. The Browns Ferry application was originally filed on July 7, 1966, and the construction

permit was issued on May 10, 1967 for Units 1 and 2; July 31, 1968 for Unit 3. The design and

the review were governed by the state of the art at that time. The operating license review

during 1970-72 used the technology of that period, modified as needed to account for the earlier

construction permit approval.

Differences in safety technology and evaluation criteria from then to now are highly significant

to the Group's conclusion. These changes are considered in the separate discussions of each

topic in Chapters 3-7 of this report.

It is a truism that everyone should learn from experience. The quantum of experience represented

in this incident has been analyzed here for this purpose. But it is also true that hindsight

vision is 20/20. Many things are now evident to the Review Group, as a result of the incident
10a

and its analysis, that previously were not evident. This is the increment in knowledge attributable to the present effort. The discussions in this report of shortcomings in people

and hardware have been included as deemed necessary to learning the lessons. Since the group

believes these lessons to be useful and significant, their value is believed to outweigh any

chagrin on the part of those who are criticized.

2.5 Perspective on Reactor Safety: Defense in Depth

The principal goal of the NRC, and the primary concern of the Review Group, is the assurance of

adequate protection of the health and safety of the public, and the maintenance at an acceptably

low value of the risk due to nuclear power technology. This means, principally, the containment

of the radioactive materials, and the prevention of their release in significant quantities.

The provision of multiple barriers for such containment, and the concept of defense-in-depth,

are the means for providing the needed safety assurance.

The echelons of safety embodied in defense-in-depth can be viewed as the following:

1. High quality in the plant, including design, materials, fabrication, installation, andF

operation throughout plant life, with a comprehensive quality assurance program.-

2. Provisison of protective systems to deal with off-normal operations and failures of equipment

that may occur.

3. Provision, in addition, of safety systems to prevent or mitigate severe potential accidents

that are assumed to occur in spite of the means employed to prevent them and the protective

systems provided.

No one of these echelons of safety can be perfect, since humans are fallible and equipment is

breakable. It is their multiplicity, and the depth thus afforded, that provide the required high degree of safety in spite of the lack of perfection in any given system. The goal is a

suitable balance of the multiple echelons; increased strength, redundancy, performance, or

reliability of one echelon can compensate in some measure for deficiencies in the others.

As applied to fires in nuclear power plants, defense-in-depth can be interpreted as follows:

1. Preventing fires from getting started.

2. Detecting and extinguishing quickly such fires as do get started and limiting their damage.

3. Designing the plant to minimize the effect of fires on essential functions.

At Browns Ferry, a fire did get started, and burned for several hours in spite of efforts to

extinguish it. The damage to electrical cables disabled a substantial amount of core cooling

equipment, including all the emergency core cooling system pumping capability for Unit 1. In

the absence of a loss-of-coolant accident, this equipment was not needed for its intended

function. The reactors were successfully shut down and their cores kept covered with water.

In spite of the plant damage, the burned cables and the inoperable equipment, no radioactivity

release greater than normal occurred and the safety of the public was preserved. Thus, the

overall defense-in-depth was successful.

Given this success, why write the present report? The answer is that the apparent ease with

which the fire started, the hours that elapsed before it was put out, and the unavailability of

redundant equipment as a result of the fire all point to some inadequacies in each of the

echelons of defense. The Review Group has pointed out the inadequacies and presented reconmmendations for improvement, not all of which need to be applied for each reactor. A suitable

combination should be implemented to achieve an adequate balance of fire protection, appropriate

to the specific circumstances involved.

The Review Group feels impelled to make one other observation that is perhaps beyond its purview

of public safety. The fire at Browns Ferry involved principally cables for Unit 1 functions,

yet Unit 2 systems were in some cases affected. As a result of this Unit 1 cable fire, Unit 2

will be out of service for most of a year and the startup of Unit 3 is likely to have been

delayed. Thus, the interconnections and interactions between units designed into this multiunit generating station resulted in unavailability of two 1100 Mw units that could have been

avoided at least in part by a different design approach. The wasted resources and extra power

costs have no direct safety significance, but should be considered by designers and operators.

I
11 a

3.0 FIRE PREVENTION AND CONTROL

In this chapter, the Review Group considers all aspects of the fire that can be divorced from

plant systems considerations, which are the subject of Chapter 4. Following a brief summary of

the fire event as it occurred (Section 3.1), the chapter treats fire prevention (Section 3.2),

combustibility of materials (Section 3.3), and fire fighting (Sections 3.4 and 3.5).

3.1 Details of the Fire

3.1.1 Sequence of Events F

A report detailing the sequence of events associated with the fire and with operational actions

required to place the Browns Ferry reactors in a safe shutdown condition has been issued by the

NRC Office of Inspection and Enforcement (5). TVA has also prepared a summary of significant

operational events (10).

The immediate cause of the fire was the ignition of polyurethane foam which was being used to

seal leaks in cable penetrations between the Unit 1 reactor building and the cable spreading

room. A candle flame was being used to detect air leakage at the penetration. When the candle

was brought close to recently installed polyurethane foam, the flame was drawn into the foam by

air flow through the penetration which was still leaking. A pressure differential which is

normally maintained between the cable spreading room and the reactor building, created a draft

through the leak, thus making possible the leak detection but also fanning the fire once

ignition had taken place.

Immediately after the polyurethane foam ignited, the workman who had been using the candle to

check for leaks attempted to extinguish the fire using first a flashlight to beat out the

flames, and then attempting to smother it with rags. Efforts were then made to extinguish the

fire from within the cable spreading room using portable C02 extinguishers, followed by attempts

with portable dry chemical extinguishers. The fire was fought in this manner for about 15

minutes, after which an evacuation alarm associated with the C02 fire-fighting system sounded

in the cable spreading room. The CO2 (Cardox) system was discharged into the cable spreading

room about 12:45 to 1:00 p.m.

The fire started at about 12:20 p.m. CDT on March 22, 1975. At 12:35 p.m., the fire was

reported to the control room of Unit 1. This call resulted in initiation of the fire alarm.

Additionally, announcements of the fire were made over the public address system.

By this time, it was determined that the fire had progressed through the cable penetration and

was burning on the reactor building side of the wall. Starting immediately after the fire

alarm was sounded, fire fighting efforts were initiated on the reactor building side of the

wall, where both C02 and dry chemical extinguishers were used. Because of the inaccessibility

of the burning cables, this effort was sporadic and tedious. The cable trays are located about

20 to 30 feet above the floor and accessible only by ladder. The dense smoke and limited

availability of breathing apparatus was cited by several individuals as materially hampering

fire fighting efforts.

At 1:09 p.m., the Athens, Alabama fire department was called. At some time between about 1:00

and 1:10 p.m., fire fighting efforts in the reactor building appear to have been greatly

reduced, with no organized fire fighting efforts being resumed until about 4:30 p.m. There was

reluctance to use water to fight the fire, but dry chemical and C02 were used intermittently.

At some time between 5:30 and 6:00 p.m., use of water was authorized. At about 7:00 p.m., two

men, using the fire hose located near the fire area, directed water on the fire.

Because of difficulty with the breathing apparatus, the water hose nozzle was wedged into a

position where it would continue to pour water on the fire and the men left the fire area. At

7:15 p.m., two men returned and found no evidence of continued burning. The area was sprayed

again, and the fire was declared "out" at 7:45 p.m.

The control room was occupied throughout the event; however, there were minor problems with

smoke and C02 entering the control room through unsealed floor penetrations when the C02
121

system was discharged into the cable spreading room.

3.1.2 Extent of Fire Damage

The fire originated in a cable tray penetration between the cable spreading room and the

reactor building. Figure 1 shows the extent of the fire damage. Cables and raceways were

damaged for a distance of about five feet inside the spreading room. The major damage occurred 1

on the reactor building side of the penetration. Visible damage was observed in the cables in

a double stack of three trays south as far as a fire stop about 28 feet from the penetration

and west along the double stack of five trays for a distance of about 38 feet. Cables in four

vertical trays were also damaged downwards for a distance of about 10 feet.

TVA has identified and tabulated 117 conduits, 8 conduit boxes, 26 cable trays and a total of

1611 cables routed in these trays and conduits that are damaged or assumed damage (11).

Evaluation of Temperatures Reached and Duration

A program has been developed by TVA for evaluating temperature effects on structures and

components. This program is described in Section VIII of the TVA Browns Ferry Recovery Plan

(3). Temperatures as high as 15000F based on concrete discoloration and melted aluminum were

reached in the most intense area of the fire in the reactor building just outside the penetration. This area was roughly 10' by 8'. A second area just beyond the 1500*F area was estimated to have reached temperatures of about 1200OF based on melted aluminum. This area included some areas of high cable density and the area above the burned cable trays from the top

horizontal tray to an elevation (encompassing all of the evidences of melted aluminum,) within

a few feet of the ceiling.

Other zones of lower temperatures were identified. All these areas are depicted in Reference

(12).

Fire Damage to Structures and Equipment

In the following paragraphs is summiarized the damage to the plant besides the burned cables.

An extensive TVA investigation program was undertaken to identify all damage. Plans have been

made to replace or repair all damaged material and equipment.

Tasand Conduits. Damage to trays and conduits includes some corrosion caused by the corrosve tmsphrecreated by the burnint cable jackets and insulation. Some aluminum conduit

located above the burning trays was melted by the intense heat, and some cracking was noted in

some of the steel conduits.

Damage to Piping Systems. The only direct damage of pipe was the melting of a soldered Joint

in an air supply line which passed through the fire area. This air line supplied control air

to valves in the Unit 1 Reactor Water Cleanup Demineralizer System, and the line from the

refueling floor to the Standby Gas Treatment System.

Structural Damage. There is no evidence of significant structural damage except to trays, tray

supports, conduits, conduit supports, and perhaps some piping supports in the fire area.

Smoke and Soot; Chlorides. Extensive deposition of soot occurred on all equipment located in

the reactor building belo the refueling floor. It appears that no permanent damage resulted,

but extensive cleaning requiring disassembly of many instruments and other equipment was

required.

Following cleaning of all exposed surfaces of piping, conduit, ard other equipment, examination

for evidence of damage was conducted. Piping surfaces where soot or other deposits were noted

were examined by dye penetrant procedures. With the exception of small (3 and 4 inch diameter)

uninsulated carbon steel piping, one run of aluminum piping, heating and ventilation ducts, and

copper instrument lines in or near the fire zone, no evidence of significant chloride corrosion

was found. In the cases mentioned, the material affected will be replaced. In the case of

some stainless steel instrument lines, an accelerated inspection program has been established

to determine if delayed effects of chloride may later appear.

Water. There has been no evidence of any damage resulting from water used in fighting the
I-

,,,I P,

A U

0, I

S's -A

't zC4-A

61313
14

a

Damage Due to Electrical Shorts, Overloads, etc. Except for cables, conduits, cable trays, and

cable ladders, there is no evidence of significant equipment damage to electrical equipment.

Randomly selected panels in several systems have been closely inspected. Nothing abnormal has

been found that would indicate overheating, arcing, or flashovers. It has been noted that

several fuses had been replaced in various panels, based on the number of old fuses found lying

in the bottom of the panels. It is not known how many such replacements were made before,

during, or immediately following the fire. In the clean-up work and retesting completed to "[

date, no electrical components have failed or been found to be damaged in such a~way as to

indicate shorting or arcing had occurred.

Some items, such as molded-case circuit breakers, for which cleaning costs would be excessive,

are being replaced. Complete inspection and testing during pre-operational testing will be the

final arbiter. Based on the inspections and testing completed thus far, gross or extensive

damage to electrical equipment is not believed to be a problem.

3.2 Criteria for Fire Prevention and Control

Criterion 3 of the General Design Criteria for Nuclear Power Plants (Appendix A to 10 CFR 50) F

reads as follows:

"Fire protection. Structures, systems and components important to safety shall be

designed and located to minimize, consistent with other safety requirements, the

probability and effect of fires and explosions. Noncombustible and heat resistant

materials shall be used wherever practical throughout the unit, particularly in locations

such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse

effects of fires on structures, systems, and components important to safety. Firefighting

systems shall be designed to assure that their rupture or inadvertent operation does not

significantly impair the safety capability of these structures, systems, and components."

This criterion implements the defense-in-depth concept used in the design of nuclear power

plants and discussed in Section 2.5. In general, a methodology that can be used in applying

this concept to fires is described as follows:

Prevention

During the design, steps are taken to minimize the use of combustible material where it is

practical to do so, and to protect it where it is used. During operation, the use of com- -

bustible materials and ignition sources is controlled by procedures.

Control

In spite of these steps to minimize the probability of a fire, it is assumed that a fire can

happen, and means are provided to detect, control and extinguish a fire. This is done by

providing installed fire detection systems and fire extinguishing systems of appropriate

capacity and capability in areas of high concentration of combustible materials, difficult

access, or where fire damage could have a significant safety impact. Fire barriers are provided to limit the spread of a fire. A backup capability is provided in areas of high fire

risk and in the plant in general to limit the extent of a fire and extinguish it if other

measures fail by use of manual fire-fighting equipment consisting of hoses, connectors, nozzles

and air breathing equipment by properly trained fire fighting personnel.

Limiting Consequences

Provisions are made to limit the consequences of such a fire by providing isolation in the form

of barriers or suitable separation between redundant systems and components provided to carry

out each safety function. This separation is enhanced if the plant is divided into suitable

fire zones since redundant safety equipment can then be placed in separate zones. Provisions

are also made to facilitate fire fighting and limit the consequences of a fire by suitable

design of the ventilation systems so that the spread of the fire and products of combustion to

other areas of the plant is prevented.

Presently there is no regulatory guide or industry standard available to provide detailed

guidance in how to meet the requirements of General Design Criterion 3. An industry standard,

ANSI N18.10, was published for trial use and comment in September 1973, but the guidance given

is so general that it is of limited use to the designer. Notwithstanding its limitations, it

does require an analysis of potential fire and explosion hazards in order to provide a basis

for the design of fire protection systems.
15

The International Guidelines for the Fire Protection of Nuclear Power Plants (13) provides a

step-by--step approach to assessing the fire risk in a nuclear power plant n describes protective measures to be taken as a part of the fire protection of these plants. It provides the

best guidance available to datei~iO this important area. -

The NRC staff in April 1975 issued Section 9.5.1 of the Standard Review Plan (14). This

provides for the review and evaluation of the fire potential (to be described in the applicant's SAR) and an analysis of the amounts of combustibles located onsite and the effects of[

the hazards on safety-related equipment located nearby.

The Review Group concludes that more comprehensive regulatory guidance which provides fire

protection design criteria to implement the requirements of General Design Criterion 3 is

needed. A body of standards should be developed which will present acceptable design methodology to be used in fulfilling specific requirements of prevention, detection, and extinguishing of fires at nuclear power plants.

3.3 Fire PreventionF

Fire prevention is discussed In Section 2.5 as one of the three echelons of safety important to

defense-in-depth. The initiation of the Browns Ferry fire shows lapses in fire prevention.

The combination of the open flame on the candle and the highly flammable flexible foam used in

the seal repairs had caused many small fires prior to the large fire which finally occurred.

Failure to take corrective action as a result of the smaller fires reveals a disregard of fire

dangers and points to the need for a stronger fire prevention program.

Fire prevention begins with design and must be carried through during all phases of construction and operation. References (15-16) give a history of fires in U.S. and some foreign

nuclear power plants. A substantial fraction (14 out of 46 in the U.S.) were associated with

construction or major maintenance. The Browns Ferry fire was also partly of this class.

Including Browns Ferry, the 32 non-construction fires in the U.S. so far in operating reactors

gives an incidence rate of the order of one fire per 10 reactor years. Their consequences

ranged from trivial to serious. Based on this history, a nuclear power plant can on the

average be expected to experience about three fires during its lifetime. Most of these fires

will not-be very serious* based on past experience. Fire prevention efforts are aimed at

decreasing these rates. They cannot be reduced to zero.

3.a.1 Fire Prevention in Design

Each design should include measures to avoid potential problems with areas containing a highF

density of combustible material. There should be a methodical investigation of how to limit L

the amount of combustible material in areas containing safety-related equipment. Good practice

would dictate a system for maintaining an inventory of combustible material included in the

design in order to:

a. limit such material to applications where they are necessary

b. provide the bases for establishing fire zones

C. guide in the development of fire protection design requirements.

The design of Browns Ferry Incorporated provisions for sealing the openings between major

structural divisions such as the reactor building, the cable spreading room and the control

room. However, in the case of the Browns Ferry fire, one such seal between the cable spreading

room and the reactor building was not only ineffective in limiting the spread of the fire but

was the primary cause of the fire. The lack of other seals, such as those between the cable

spreading room and the control room, impeded plant operation during the fire.

There does not appear to have been an adequate understanding of the magnitude of the potential

hazard from the use of the flexible polyurethane in the cable seals. From combustibility testr

data developed after the Browns Ferry fire by the Marshall Space Flight Center using the types L

of polyurethane material found in the Browns Ferry seal (17), it is apparent that the specified

Flamemastic coating would have generally reduced the hazard associated with the highly flammable flexible foam.

*Based on the fa-c-t tIat one fire of the Browns Ferry severity has occurred in several hundred

reactor-years to date the incidence rate of such fires is estimated at between 10-S and 10-2

per reactor year.
16

It does not appear that the combustibility of the densely packed cables in the reactor building

adjacent to the cable spreading room was understood adequately by TVA or NRC, since cables

serving redundant safety equipment were permitted by the design in this area, without fireretardant coatings or sprinkler protection, and without adequate separation in the absence of

other protective measures.

In reviewing the overall effort for fire prevention during design the Review Group concludes

that more attention must be paid to this area. An assessment of the amount of combustible

material in each safety-related area should be accomplished. An appropriate combination of the

following measures should be taken where needed:

a. Limitation or replacement of combustible material

b. use of fire retardant coating

C. suitable barriers and seals to reduce the exposure of remaining combustible material.

For future plants, an additional alternative is available: establishment of fire zones basedr

upon the amount of combustible material present and selection of a suitable design basis fire,

arranged so that adequate isolation can be provided for redundant safety-related systems and

equipment.

3.3.2 Operating Considerations in Fire Prevention

Fire prevention during operation is a collection of actions by people to make the chance of a

fire being started low. By contrast to the preceding discussion of design considerations, the

plant design is here taken to be fixed.

A fire requires a combustible material, oxygen, and an ignition source. A power plant has

pipes containing water or steam that are hot enough to ignite some hydrocarbons. Indeed,

References (15-16) include a number of fires involving oil in nuclear power plants. In other

plant areas,*there would normally be no ignition sources. But experience indicates that the

occasional cigarette butt or electrical spark or welding torch can be present. The measures

available for fire protection are therefore to minimize the combustibles under the operator's

control, to recognize the combustibles he can't control (like cable insulation), and to maintain strict control of ignition sources. These measures should be embodied in written procedures.

A fire prevention program can be looked on as a part of the plant operating quality assurance

program. The fire prevention procedures involve inspections (for stray combustibles), permits

and precautions (for welding) and prohibitions (smoking in fire hazardous areas). They generally involve written information (inspection reports, welding permits) that can be audited.

Especially important is the control and limitation of open flames (for example, during welding)

and the taking of adequate precautions when their use is essential.

A principal lesson of Browns Ferry is the failure of fire prevention. The candle flame was an

obvious ignition source. The foam actually used is highly combustible, far more so than the

material specified in the design. The small fires actually experienced did not induce a fire

preventive response.

Following the Browns Ferry fire, the NRC sent out Bulletins to licensees (18) pointing out some

of these facts and calling for a re-evaluation of their fire prevention procedures. Almost all

licensees in replying cited systems of work permits and management review that should prevent

such obvious lapses. The Review Group, however, retains a certain skepticism. It is the

experience of the group's members, and that of the experts the group has talked to, borne out

by the tone of many of the licensee's replies to the Bulletin, that only a continuing attention

by the operating staff can achieve a satisfactory degree of fire prevention, and that many such

staffs remain complacent about fire prevention in their plants. This complacency has until

recently been mirrored by the absence of fire-related matters in the NRC licensing and inspection programs. That has now been partially remedied. The Review Group believes thatL

better regulatory guidance and greater NRC inspection attention should be directed toward fire

prevention and control in general, with particular attention to fire prevention. This will

require development of suitable regulatory guides and also allotment of review and inspection

resources for this purpose.
17£

3.4 Criteria for Combustibility of Materials

Most fire prevention programs deal with solvents, oils, oily rags and waste, wooden structures,

and electric sparks. The Browns Ferry fire, on the other hand, involved cable insulation and

the seals installed around cables at wall and floor penetrations to control air movement and

act as fire stops. The following sections deal with the combustibility of these two categories

of materials. For neither application are there adequate criteria for the selection of

materials or standardized test methods. The Review Group's recommnendation must therefore be

for more development work on materials and testing methods and development of selection criteria rather than for present adoption of a particular standardized and tested material. The

Review Group believes that materials less combustible than those that burned at Browns Ferry

can and should be developed and qualified using improved standardized tests for application in

future plants, and that means are available and should be used in existing plants to decrease

the combustibility of present materials found to need protection.

3.4.1 Cable Insulation Criteria

The Browns Ferry FSAR contains no criteria which specifically address the combustibility of theF

insulated cables. The statement is made, however, that the cables were selected to minimize

excessive deterioration due to temperature, humidity, and radiation during the design life of

the plant. There were 16 basic combinations of cable construction materials involved in the

fire. A list of the cable materials is given in Table 1.

TABLE 1.

CABLE MATERIALS

Insulation Materials Jacketing Materials

Polyethylene Nylon

Cross-linked polyethylene Polyvinyl-chloride

High density polyethylene High density polyethylene

Nylon backed rubber tape Polyvinyl

Irradiated blend of polyolef ins Aluminum foil

and polyethylene Chl orosul fated polyethylene

Fiberglass reinforced silicone

tape

Neoprene

Cross-linked polyethylene

TVA cable specifications for polyethylene insulated and cross-linked polyethylene insulated

wire and cable require number 8 AWG and larger sizes to pass the vertical flame test found in

IPCEA* S-19-81 Section 6.19.6 and number 9 AWG and smaller sizes to pass the horizontal flame

test found in Section 6.13.2 of the same document. No flame testing was required for nylon

Jacketed single conductor or multi-conductor cables. The vertical and horizontal flame tests

in IPCEA S-19-81 are single cable flame tests.

At the time of the approval of the Browns Ferry design there were no specific regulatory

requirements concerning the flame retardant properties of electric cables. No consensus

existed as to what test should be used and exactly what could be inferred from the test results.

Cable flame tests found in the various standards at the time were single cable tests. Predictions of the spread of fires in cable trays based on the results of the single cable flame

tests were not available.

The NRC requirements for flame retardancy of cables have been changed since the Browns Ferry

safety reviews by the NRC. Regulatory Guide 1.75 (66) endorses IEEE Standard 384-1974, "IEEE

Trial Use Standard Criteria for Separation of Class IE Equipment and Circuits." IEEE 384-1974

requires that flame retardant cable be used as a prerequisite to the applicability of the cable

separation criteria specified in the standard. "Flame retardant" is defined in the standard as

"capable of preventing the propagation of a fire beyond the area of influence of the energy

source that initiated the fire," but IEEE 384-1974 contains no further guidance for the selection or testing of flame retardant cable. This is given in IEEE Standard 383-1974, "IEEE

Standard for Type Test for Class IE Electric Cables, Field Splices, and Connections for Nuclear

*Insulated Power Cable Engineers Association
18

Power Generating Stations," which is presently used in NRC construction permit evaluations and

is under consideration for endorsement in a future Regulatory Guide. IEEE 383-1974 specifies a

method for testing of a vertical tray containing a number of cables to determine their relative

ability to resist fire. Unfortunately, the flame test of IEEE 383-1974 does not simulate the

normal cable tray installations very well. The test arrangement calls for several lengths of

cable to be arranged in a single layer in the bottom of a cable tray with approximately 1/2

cable diameter spacing between the cables. By contrast, typical cable trays in plants contain

several layers of cables with no space deliberately left between individual cables.

Although NRC criteriatpresently require cables to be "flame retardant" (but not yet specifying

even the IEEE-383 test and some flame tests are now available, the effect of a fire ignited in

a typical cable tray configuration with flame retardant cable is still not well-known. Prior

to the Browns Ferry fire, NRC had signed a contract with Sandia Laboratories to perform

experiments in which cables in typical cable tray configurations are ignited, but results of

this work are not yet available.

Since the Browns Ferry fire, fire experts have expressed reservations similar to those discussed above about the adequacy of the cable configuration in the IEEE 383 cable combustibility

test (19, 20). They have also recommended that higher energy ignition sources than that

specified in IEEE 383 be used In performing flame tests. A Nuclear Energy Liability and

Property Insurance Association (NELPIA) sponsored cable testing program is being conducted at

Underwriters' Laboratory to determine the relative performance of cables when subjected to the

IEEE 383 vertical flame tests, but using 20,000, 210,000, and 400,000 Btu per hour gas burners

to investigate the effect of varying the energy of the ignition source (20). Various control

cable constructions will be tested vertically and horizontally in multi-tiered groups of trays

to determine the effects of the ignition source intensity and cable geometry on flame propagation and circuit integrity.

Reference (65) contains a recommendation that mineral insulated metal sheathed cable or equivalent fire resistant cable should be used in one of the safety divisions. (For a discussion of

"safety divisions," see Section 4.3.3.1.) The objective of the recommendation appears to be to

provide one safety division capable of surviving a fire that envelopes all safety divisions and

destroys all other safety divisions. Although this approach may have merit in particular

situations, the Review Group questions its utility and believes it is not needed as a universal

requirement. There are other ways of accomplishing the objective of adequate divisional isolation. (See Sections 4.3.4.4 and 4.3.4.5).

Consideration of cable (and perhaps coating) materials is involved in all three components of

defense in depth. Proper selection of cable materials can reduce the probability that a fire

will start. Cable installations of good flame retardancy characteristics will limit the

spreading of a fire and thus aid in the control of a fire. Good flame retardancy in conjunction with adequate separation and isolation of redundant safety divisions is important in

maintaining avialability of safety functions in the event a fire occurs.

The Sandia and NELPIA-UL programs are efforts to fill the gap In present knowledge. The NRC

staff should follow these programs closely and encourage their prompt completion. If the

results of these programs indicate that additional investigation is required, such investigation should also proceed in a timely manner. If the results of these programs indicate that

significant improvement in safety can be achieved by changes in existing plants, such changes

should be implemented if needed. Improved criteria for flame retardancy of cables with or

without flame retardant coatings should also result from these investigations. L

An associated problem at Browns Ferry was the corrosive and toxic gases and dense smoke given

off by burning cable materials. The Review Group recommends that investigations into flammability include study of the airborne products of heating and combustion, and that these be

considered in selecting cable insulation materials.

It is not possible at the present time to forsee whether new cable insulating materials should

be developed. Certainly materials less flammable than those now commonly used are available;

they have drawbacks in cost, electrical and mechanical characteristics, availability, and other

properties and have not been widely used. Decisions regarding their adoption should be based

on assessment of the defense-in-depth components at each plant.

It should also be pointed out that fire retardant coating materials are available for use with

existing cable materials. They can be applied to areas in operating plants that might be

deemed to need additional fire resistance, without the necessity for disturbing the present

cables or trays. Tests of these coating materials by their manufacturers, reactor vendors and

others, the results of which are now being collected and evaluated by the NRC, indicate that
19

proper application of these materials can provide considerable fire protection. The Review

Group believes that Judicious use of such coatings in areas of high cable density or high fire

vulnerability has the potential for significantly reducing the risk from extensive cable fires

in operating and future reactors'. It recommends that research and testing be conducted as

needed to evaluate where and how such coatings can be used to decrease the cable fire hazard.

3.4.2 Criteria for Fire Stops and Seals

The Browns Ferry FSAR provided design criteria for fire stops and seals. It states that any

openings in the floors for vertical cable trays carrying redundant cables of cable Divisions I

or II are to be sealed and the cables coated with a fire retardant material (Flamemastic 71A*

or equal). Likewise, openings in walls for horizontal cable trays between buildings (reactor

and control) are sealed. Although the regulatory staff was concerned with fire prevention

techniques, there were no regulatory requirements concerning fire stops per se at the time of

approval of the Browns Ferry design. General Design Criterion 3, however, staEtes that noncombustible and heat resistant materials shall be used wherever practical throughout the unit,

particularly in the containment and the control room.

The design of the cable penetration where the fire started called for a 1/2-inch thick steel

plate bulkhead, slightly smaller than the dimensions of the penetration, in the center of an

opening in a concrete wall. Openings were cut in the bulkhead plate and steel sleeves welded

into the openings. The trays stop short of the opening and only the cables extend through the

wall penetration. The sleeves were to be filled with polyurethane foam after the cables were

installed to limit air leakage. The design called for pourable polyurethane foam to be applied

over and around the installed cables. Upon hardening of the pourable polyurethane foam, sprayable polyurethane was to be used to finish filling the sleeve. The pourable foam was specified

because it more completely fills the voids between the cables. A fire retardant coating,

Flamemastic, was then to be applied 1/8 to 1/4-inch thick over the foam and the cables on both

sides of the bulkhead for a distance of 12 inches.

TVA reported (21) on testing of a typical fire stop penetration in June 1973, and concluded

from the results that this fire stop design would provide a good barrier. The report further

stated that the Flamemastic manufacturer recommendation that the cables should be coated for 6

to 8 feet on both sides of the penetration was not valid; the one foot distance used in the

test was stated to be sufficient.

It is important to note the ways in which the seal that caught fire differed from the seal as

designed and tested. A principal difference was the use of the flexible foam for stuffing into

leaks. While sealing the penetrations, a dam was required in some cases to prevent the liquid

foam from flowing out of the sleeves. One solution for this problem was the use of a flexible,

resilient polyurethane foam (quite different in properties from the "polyurethane" discussed in

the preceding paragraph), cut to size for insertion into the sleeve openings to form a dam.

Although it goes by the same "polyurethane" name as the pour and spray foam "polyurethane," its

properties are different. In particular, it is far more easily set afire and burns in a different way. (See just below and Reference (17)). It is not known whether a piece of the

flexible material was used for a dam on the seal tested in 1973. It is known that the seal

that caught fire had a hole through it (2 by 4 inches in cross-section) and that a piece of

the flexible foam had been stuffed into that hole. Moreover, that piece of flexible foam had,

of course, no fire retardant coating.

Another difference may have been in the fire retardant coating. The Review Group has been

unable to find out whether the seal being repaired, that is, the one that caught fire, was

originally coated with Flamemastic. Some seals at Browns Ferry were not coated in accordance

with the design (21a).

A third difference was that the seal that was tested did not have a pressure differential

across it, which would have induced drafts through any leaks. Such a pressure differential at

Browns Ferry, in accordance with the design of their containment, contributed to both the

initiation and the spread of the fire.

Following the fire, the NRC had an independent set of tests performed on the materials found in

the cable penetration area. The following excerpt presents some findings from those tests

(17):

*The Flamemaster Corporation, 11120 Sherman Way, Sun Valley, California 91352
20

"Experimental tests clearly verified the ease of ignition of the foam rubber stuffing by

the candle. (In fact, actual contact with the flame is not required.) The resulting very

rapid, almost flash, burning combined with release of burning droplets constitutes not

only an intense local source of ignition but also a means of propagation of fire over a

much larger area, leading easily to a general conflagration with other local combustible

materials, especially in an air draft as acutally occurred.

"Initial cursory tests on materials collected in the cable spreader room confirmed that [

readily combustible materials were in the vicinity: rags, pour foam, and cable ties.

"Interpretation of the ASTM test results must be done with caution. These are intended to

be relative tests only and are done in a draft-free environment in a strictly empirical

test procedure.

"For example, the manufacturer's claim that the "instafoam" is "self-extinguishing" was

experimentally substantiated by testing in accordance with the referenced ASTM specification (D-1962). However, the data on both the spray and pour foam samples show that

the materials do very barely meet the requirements to be rated as "self-extinguishing" by F

this test. Specifically, the requirement is that in this horizontal test no specimens

burn ast a 5-inch gauge mark from the ignited end. Inspection of the data shows burn

lengths of 5", 3", and 5" for the pour foam and 5", 4-1/2, and 5" for the spray foam. One

could infer from these data that the 5-inch limit may have been derived from these type

materials, and thus the test was designed to accept such materials. The same inference

could be drawn from the ASTM vertical burning test (D-3014) in which a 10-inch long

specimen is specified. The data show burn lengths of 8 to 10 inches.

"However, the lead paragraph of both ASTM specifications states: 'This method should not

be used solely to establish relative burning characteristics and should not be considered

or used as a fire hazard classification' and further therein, 'Correlation with flammability under use conditions is not implied.

"Clearly, both materials are readily ignited, support combustion, and exposed surfaces

would contribute significantly to a general conflagration.

"The data do show that the polyurethane foam rubber burns much faster than the pour or

spray foams, and releases burning droplets. Further, these samples of pour foam burn

considerably faster than the spray foam. In addition, coating exposed surfaces with

Flamemastic was extremely beneficial. In fact, coated pour and spray foam samples did not

burn under the test conditions."

It can be concluded from the results of the two independent tests that Flamemastic 71A provides

considerable fire protection when utilized properly. However, more recently, TVA informed NRC

(22) that tests on a seal of the original design including the Flamemastic coating gave

unsatisfactory results. In one such test (Test 1.2.3 - External Flame Test) an explosion

occurred in the cold side of the test building. The explosion apparently resulted from the

ignition of flammable gases by flame passing through the cable tray seal. Additionally, there

was some damage to cables on the cold side of the seal up to approximately four feet from the

seal. These cables were somewhat charred and showed evidence that cable jackets melted. These

tests were considerably more severe than the 1973 TVA tests, and used a much hotter ignition

source than the candle that started the actual fire. Nevertheless, TVA has subsequently

decided (57) to remove such polyurethane foam seals as is practicable and to replace them with

a material found by testing to be more fire-resistant.

The Browns Ferry fire experience indicates that the materials of construction for fire stops

requires close examination. This is true in spite of the fact that the 1973 TVA tests indicate

that a properly made fire stop of the Browns Ferry design (with Flamemastic and without flexible foam) would probably not have initiated the fire (21) from the candle. The tests also

indicate that even if a fire had started, a fire stop made in accordance with the original

design may well have prevented its spread outside of the room where it started.

Inspections of all operating nuclear generating stations (23) revealed a number of deficiencies

associated with fire stops at a number of plants, although many plants had no deficiencies or

only trivial ones. Some of the deficiencies found were:

1. Required fire stops had never been installed.

2. Fire stops had been opened to install additional cables and had not been repaired.
21 a

3. Fire stops had been Improperly constructed.

4. Fire stops had been repaired with improper materials (including flammable ones).

5. Fire stops contained combustible materials left from construction (such as foam dams and

pull ropes).

6. Fire stops had deteriorated (crumbling concrete or shrunken and cracked coatings).

These deficiencies are being repaired. The experience is another manifestation of the need for

improved attention to fire prevention and control by both licensees and the NRC.

There are suitable materials available (24-28) that are less flammable than the type of polyurethane in which Browns Ferry fire started. Tests run by one utility (24) were stated to show

that the polyurethane tested in their case would not burn, but blackened and charred without

significant degradation. This is additional indication that different types of "polyurethane"

have different flammability properties. Unfortunately, the flammability characteristics of the

materials have not been compared by common tests. The claims for some of the materials come F

from promotional literature.

The Review Group recommends that a standard qualification test be developed to resolve the

problem of the uncertainties of flammability of fire stop materials and designs and to assure

acceptable performance of fire stops. Qualification tests of the separate materials of construction are needed as well as tests of the assembled fire stop, to give a measure of the performance

of fire stops with deteriorated or faulty fire retardant coating. It would be preferable to

have the qualification testing performed by a qualified testing laboratory. This would not

only eliminate any potential conflict of interest but would also permit the testing organization

to develop a high level of competency in fire testing and qualification. The Review Group

understands that Underwriters' Laboratory and Factory Mutual Insurance Company are currently

listing and approving devices and construction configurations for wall openings (20).

The possibility of providing fire stops at specified intervals in long cable trays has been

suggested (65). Such fire stops have the potential for further limiting the spread of a cable

tray fire and may offer a significant improvement in safety in certain installations.

A suggestion has been made that unapproved foam plastic seals be removed from existing plants

and that they be replaced with suitable items (65). Although this suggestion has merit, the

Review Group does not believe that this should be a blanket recommendation. Because there is a

potential for damaging safety related cables in the removal of fire stops and seals, the Review

Group believes that this should be considered on a case-by-case basis with the ease and safety

of removal considered along with the potential improvement in safety achievable with the replacement of seal material. Realistically, not all of the old materials will be removed and not all

the void space will be filled with new material. Use of a flame-retardant coating could help

to offset the inability to remove and replace existing flammable seal material. The improvement would, to a degree, be a function of the original seal design.

Although tests of some fire stops containing "polyurethane" show apparently acceptable results,

tests of fire stops that contain material such as the flexible polyurethane foam used as dams

and plugs at Browns Ferry show that they are extremely flammable. Fire stops which contain or

are believed to contain these types of highly combustible material should be replaced or

demonstrated to be acceptable on some other basis.

Cable penetrations are not the only places where fire seals and stops may be appropriate. It

is important that the habitability of the control room be protected in the event of a fire. It

is important, therefore, that all openings in the control room be sealed to prevent the entry

of smoke or other substances that might cause evacuation to be necessary.

Consideration should be given to the addition of stops and seals in existing plants where they

can significantly reduce the probability of the spread of fire, smoke, and toxic or corrosive

gases.

3.5 Fire Fighting

The detection, control, and extinguishing of fires that get started (in spite of. fire prevention

programs) involve both equipment and people. In the following sections are discussed the

Browns Ferry lessons related to fire fighting.
22 15

3.5.1 Fire Detection and Alarms Systems

A fire must be detected before it can be fought. At Browns Ferry, the workman with the candle

detected the fire immediately. The installed smoke detectors did not alarm, so there are fire

detection lessons that have become evident.

Browns Ferry had smoke detectors in 7 areas including the cable spreading room and rate-of-rise

temperature detectors in other areas.[

The fire started in the cable spreading room; yet the fire detectors in the cable spreading

room were not effective in signaling the start of the fire. It is the opinion of TVA that

because of the air pressure differential between the cable spreading room and the reactor

building, the flow of air drew the smoke from the fire in the cable spreading room away from

the detectors. That there was smoke in the cable spreading room is demonstrated by its later

displacement into the control room through the unsealed penetrations in the floor by the CO 2 of

the Cardox System when it was actuated.

The fire detectors installed in the control room did not alarm either. These detectors were ofF

the ionization type, and did not detect the products of combustion from the burning cable

insulation.

There was a great deal of smoke in the reactor building in the vicinity of the fire, but

detectors had not been installed in that area.

NELPIA and other fire prevention engineers are of the opinion that the effectiveness of a

detector is stongly dependent on its location and the type used for a particular product of

combustion. During the design of a fire detection system, assurance should be provided,

including testing if needed, of the compatibility of the detector at a particular location with

the products of combustion that would result from a fire in the materials occupying the area

where the detector is to be installed, and such adjacent areas as are appropriate.

Little regulatory guidance is available regarding fire detectors. The available draft standard

(ANSI-NI8.lO) provides little guidance. The National Fire Protection Association Standard on

Automatic Fire Detectors (NFPA No. 72E-1974) provides some information on the location,

maintenance and testing of detectors, but the guidance is incomplete. The Review Group believes

that more and better guidance should be provided preferably by a suitable standard based on

experiments with existing cables and detectors. The standard should be augmented when improved

materials become available.

It is the recommnendation of the Review Group that the fire detection systems for all plants be

reviewed to assure that suitable detectors are Installed at the proper locations. This review

should include verification of the effectiveness of the installed detectors for fires in the

materials present. The detection systems at operating plants should be upgraded as necessary

based upon this review.

Another lesson learned as a result of the Browns Ferry fire is that there may be areas within

other plants which contain significant amounts of combustible material where a detection system

is not provided. At Browns Ferry, the areas within the reactor building where a high density

of cables existed did not contain fire detection systems because these cables were not considered to be a fire hazard. Horizontal cable tray configurations were assumed to be self

extinguishing and vertical tray runs of cabling were considered to present an acceptable hazard

based on the assumed vertical fire propagating properties of these cables.

3.5.2 Design of Fire Extinguishing Systems

The objective of fire extinguishing systems is to provide automatic fire protection for areas

or equipment where it is needed and to provide adequate manually actuated fixed and portable

fire extinguishing systems for the entire plant.

The Browns Ferry FSAR describes three fire extinguishing systems:

1. A high pressure water system which supplies water for fixed water spray or fog systems for

selected equipment and to fire hoses and hydrants throughout the turbine building, reactor

building, service building, radioactive waste building, office building, and yard.

Automatic fog systems are provided for the following:
23a

a. Main turbine oil tanks,,

b. Reactor feed pump turbine oil tanks

c. Turbine head ends

d. Hydrogen seal oil units

e. HPCI pump turbine oil tanks

Automatic spray systems are provided in the service building for the carpenter shop,

oxygen-acetylene storage room and oil storage room.

2. Low pressure carbon dioxide with manual initiation is provided in the following areas:

a. Cable spreading rooms

b. Auxiliary instrument rooms

c. Computer rooms

Carbon dioxide from this system, with automatic control, is supplied to the four diesel

generator rooms, the lube oil purification room of the turbine building, and the paint

shop.

3. Fire Extinguishing Portable Equipment

Portable extinguishers to be used on Type A, B, and C fires (as defined by NFPA Standard

10-1967) are installed at various locations throughout the plant. The predominant type is

a dry-chemical type filled with potassium bi-carbonate and a gas propellant.

Neither the FSAR nor the SER for Browns Ferry covers the basis for the selection of the types

of fire extinguishing systems and the locations where these systems are installed, or considers

the type and amount of combustible material present in each area.

At Browns Ferry, areas containing a high density of electrical cables did not have installed

water sprinkler systems. This of course included the fire area in the reactor building. Fire

hoses and nozzles connected to hydrants were, however, available in the vicinity of the fire.

Although the fire in the cable spreading room was controlled and extinguished without the use

of water, the fire in the reactor building burned on for several hours in spite of numerous

attempts to put it out with portable COI and dry chemical extinguishers. However, once water

was used, it was put out in a few minutes.

The use of water to fight the fire was recommnended by the Athens, Alabama, fire chief early

during the fire (32). The plant superintendent's decision to use water was taken late and

reluctantly, after consultation with TVA management. Although TVA and Browns Ferry written

procedures do not forbid use of water to fight fires in electrical cables, TVA has defended the

long delay in deciding to use it.

Replies by licensees to the NRC Bulletin (18) have revealed a widespread reluctance to use

water on a fire in electrical cables. Much fire control training includes a prohibition of

"lusing water on electrical fires."

TVA maintains (29) that the plant superintendent made a conscious and correct decision not to

use water because of the possibility of shorting circuits and thus inducing further degradation

of the plants to a condition that would have been more difficult to control. TVA stated their

strong opinion that reactor safety concerns should take precedence over extinguishing a local

fire, and that only after a stable plant condition had been reached should water have been

used.

The Review Group agrees in principle that reactor safety comes first, but does not agree that

this principle mitigates against the use of water on cable fires. The sequence of events in

Browns Ferry shows that the fire caused successive failures, as detailed in Refarence (5). The

initial series of failures occurred in the first half hour, up to about 1:00 p.m. At 1:15

p.m., more equipment became unavailable. As late as about 6:00 p.m., remote manual control of

the relief valves was lost as a result of the progression of the fire (56), greatly reducing

the available redundancy.
24

Moreover, if the fire had been quickly extinguished and the smoke cleared, the efforts to

restore equipment and make temporary repairs would probably have been successful more quickly.

For example, the effort to manually align the RHR system valves was thwarted by the smoke from

the fire. Therefore, promptly extinguishing the fire, which the Review Group believes could

have been accomplished by the earlier use of water, would not only have prevented the failure

of equipment, but would have aided in the prompt restoration of the equipment which had been

disabled.

Of less merit, in the Group's opinion, is the TVA argument (30) that personnel safety considerations also mitigated against the use of water. A special nozzle for use on "electrical fires"

was available and was finally used to put out the fire without hurting anyone (31). Whatever

personnel danger was present earlier was not likely to be significantly less at 7:00 p.m.

Clearly there is a balancing of pros and cons to be made in cases like this. The Group's

concern is that widespread opinion and practice emphasize the reasons for not using water as

compared to those in favor of prompt water use. The Group certainly does not intend that water

shall be used immediately on all fires, and acknowledges the reasons against using water.

Nevertheless, the Group wishes to emphasize the need for quickly putting out all fires, especial- r

ly in situations where the unexpected is occurring. For this reason, in view of the Browns

Ferry experience, fire procedures and fire training should include these considerations in the

balancing of alternatives that all hazard control operations inevitably involve.

It has already been noted (32) that the Athens fire chief was of the same opinion as the Review

Group. The group has discussed this question with a variety of fire experts, who all favor the

early use of water in most circumstances. The experience at Browns Ferry, as well as expert

opinion, suggests that if initial attempts to put out a cable fire with non-water means are unsuccessful, water will be needed.

Fire fighting--by all methods--was impeded by the inaccessibility of the fire site. For areas

of high cable density--or high density of any flammable material--fixed extinguishing systems

should be installed, especially where access is difficult. Assessment of access should consider

firefighting conditions including vision impairment (smoke, lights out) and the need for wearing

breathing apparatus. Consideration should be given to making such a system automatic, which is

preferred if feasible, especially where access is difficult. The amount of water to be handled

can be minimized by judicious placement of sprinkler heads and using directional sprays where

appropriate.

TVA has also stated (33) that the limited number of air-breathing sets available forced the

plant staff to make priority decisions to favor valve and control manipulation in the smokefilled area over firefighting activities, and that this decision accounts for the lack of firefighting in the reactor buildin5 between 1:10 p.m. and 4:30 p.m. (58). The Review Group accepts

this explanation, but believes it has only limited relevance to the water--no water question.

The Group also points out that this difficulty experienced at Browns Ferry is another reason

for automatic initiation of firefighting systems. Putting out the fire would cut off the

generation of smoke and allow use of breathing apparatus for other purposes.

In principle, a C02 or Halon gas system could be effective in fighting a fire in a closed space

where oxygen could be excluded. The asphyxiation hazard to personnel is greater with such a

system than with water. Initiation of the C02 system in the Browns Ferry cable spreading room

was properly delayed to ensure personnel safety. This was also the stated reason for leaving

the metal plates installed, preventing local manual actuation of the system (see Section 3.5.5).

NELPIA and a number of fire protection consultants have questioned the ability of carbon dioxide

or dry chemicals to extinguish a deep seated cable fire. They argue that if a means is not

provided to remove the heat generated by the fire, the material will re-ignite once the oxygen

is readmitted to the hot combustible material.

Due care must be exercised in the design and installation of water systems. There must be a

drain for the water. Equipment that could be damaged by water should be shielded or relocated

elsewhere away from the fire hazard and the water. It is also good practice to separate redundant equipment so water applied to put out a fire in one division will not affect the others.

General Design Criterion 3 requires that fire fighting systems be designed to assure that their

rupture or inadvertent operation do not significantly impair the safety capability of structures,

systems and components important to safety. With the increased emphasis on the ose of installed

water sprinkler systems for the fire protection of electrical cables in nuclear power plants,

this specific requirement of General Design Criterion 3 takes on added significance. The

Review Group believes that guidance should be developed for the specification of quality and

design requirements in order to assure that installed water sprinkler systems will have adequate

integrity and reliability during the life of the plant.
25

For each plant, the Group recommends a detailed review of fire hazards and the installation or

upgrading of such systems as are needed. This assessment should be in conjunction with the

review of fire prevention measures and flammability recommended in Section 3.3. The Review

Group recommends that serious bonsideration be given to fully automatic directional sprinkler

or spray systems in areas containing high concentrations of combustible materials including

specifically cables used for safety-related equipment, and in areas where access for fire

fighting would be difficult.

It is further recommended that the design of all future plants should continue to provide for a

reliable high-pressure water-system including appropriate hoses, nozzles, and hydrants, In all

areas of the plant including those protected by sprinkler or spray systems.

3.5.3 Ventilation Systems and Smoke Control

At Browns Ferry, ventilation was lost at 12:45 p.m., shortly after the fire started, and was

not reestablished until 4:00 p.m. Even if venting the smoke through the installed ventilation

system had been planned in the design, it would not have been possible because of the inoperability of the system. The loss of the ventilation system was brought about because of loss of

power to the ventilation system and loss of power to its control subsystem. Control and power

cables of a ventilation system important to fire control should not be routed through areas the

system must ventilate in the event of a fire.

The Review Group recommends that ventilation systems in all operating plants be reviewed and

upgraded as appropriate to assure their continued functioning if needed during a fire. It is

further recommended that present designs be provided with the capability of isolating fires by

use of cutout valves or dampers.

Capability for the control of ventilation systems to deal with fire and smoke should be provided,

but such provisions must be compatible with requirements for the containment of radioactivity.

These provisions and requirements may not be mutually compatible and in some cases may be in

direct conflict with each other. For example, operating ventilating blowers to remove smoke

may fan the fire; the same action may also result in a release of radioactivity, either directly

by transport of radioactive particles with the smoke or by decreasing the effectiveness of the

filters provided to contain the radioactivity. It is obvious that some compromise will be

necessary and that flexibility of operation may be needed, depending on the nature of any event

that may occur. The pros and cons of each provision and requirement should be considered in

the development of detailed guidance.

At Browns Ferry, there was no attempt made to limit the transport of smoke to other areas of

the plant by closing vent dampers and valves. After actuation of the CO2 system, openings

between the control room and the cable spreading room had to be plugged to stop the entry of

smoke and CO2 into the control room. Some of these openings were in the floor of the control

room at the points where the cables entered the control room. This appears to violate the

design provision that these cable entryways would be sealed. In the event of a serious fire in

the cable spreading room the control room might have become uninhabitable because of smoke and

toxic fumes. Actuation of the CO2 system in the cable spreading room made the situation worse,

driving the smoke into the control room.

3.5.4 Fire Fighting

Fire fighting encompasses the ability to extinguish a fire and to prevent re-ignition. The

equipment design aspects of fire fighting were discussed in the preceding section; here we

treat the personnel aspects.

One aspect of fire fighting which is important is the access to and egress from a potentially

hazardous area. The emergency plans for all plants should lay out access and escape routes to

cover the event of a fire in 'the reactor building and other critical areas of the plant.

Consideration should be given in the design of future plants to providing access and escape

routes for each fire zone and in particular, areas containing a potential fire hazard.

There are areas within the plant where access for the purpose of fighting fires is especially

important. In particular, the cable tray area and the seals between the reactor compartment

and the cable spreading room were important in the Browns Ferry fire. Access to the seals and

the cable trays was extremely limited. Moreover, the design provision for centering the seals

in the wall between the cable spreading room and the reactor building was not carried out, with

the result that the seal areas were extremely difficult to reach from the cable spreading room.

After the fire had spread to the cables in the trays in the reactor building, fire fighting

efforts were hampered by lack of access to the affected areas (some 30' above the floor) even

though temporary wooden ladders were available in these areas.
26 a

During the Browns Ferry fire certain pieces of onsite fire extinguishing equipment were found

to have threaded connections which were not compatible with equipment used by the Athens Fire

Department. Such a situation could lead to decreased effectiveness of offsite fire fighting

units in a serious fire at a nuclear power plant. The Review Group recommends that all plants

should assure compatibility of fire fighting equipment with offsite fire fighting units which

may be called upon in an emergency.

Another important factor in fighting a fire is the equipment available to support life while

fighting the fire. At Browns Ferry the breathing apparatus capacity was not sufficient to

support all reactor system manipulation, electrical repair, and needed fire fighting activities

(33). The breathing apparatus available at Brown's Ferry had a design capacity of one-half

hour. Even assuming a well-trained operator and good access to the fire area, the 30-minute

capacity of the equipment presently approved for toxic atmospheres causes difficulties for an

operator at the scene fighting the fire (or doing anything else important) without having to

leave to get another fully charged unit.

There are two principal types of breathing apparatus--positive pressure and recirculating type.

To date the Occupational Safety and Health Administration (OSHA approves only the positive

pressure type for toxic atmospheres.

The largest positive pressure standard equipment currently available is rated at 30 minutes. A

representative of the Montgomery County, Maryland, Fire Department Training Academy stated that

although these units are rated for 30 minutes, fire departments in general recommend limiting

use to 20 minutes. If the mask does not fit properly, a considerable fraction of the air is

lost, and the service life may be less than 20 minutes.

Recirculation, or closed loop breathing apparatus is available with considerably larger usage life. In one such type, exhaled air, rather than exhausting to atmosphere, is recirculated

through a purification canister, then a metered amount of pure oxygen is added to return the

air to 20% oxygen. There are three disadvantages to this type apparatus: (1) potential inleakage of toxic fumes; (2) once a canister has been activated it must be discarded, even if not

used at all; and (3) the oxygen bottles must be returned to a supplier for recharge. The

obvious advantage is longer usage life. A second recirculation type uses the purification

canister without oxygen.

Browns Ferry personnel made limited use of the latter type of breathing apparatus, with generally acceptable results. Some individuals experienced difficulty in breathing with these units.

This is a fairly common complaint, especially when the user is engaged in heavy physical activity

or operating under significant stress.

Los Alamos Scientific Laboratory is doing a considerable amount of work on protective equipment

for NRC. This work is directed toward the use of protective equipment in the presence of

airborne radioactivity. However, the type of equipment available for use is the same, regardless of the type of atmospheric contaminant.

The method used by TVA to recharge their breathing equipment (cascading method) resulted in

excessive charging times and below capacity charges. It is recommended that all operating

plants review and upgrade as necessary the breathing equipment available as well as the capacity

and method of charging of breathing equipment, and that future designs include adequate recharging equipment.

3.5.5 Prevention and Readiness Efforts During Construction and Operation

The Browns Ferry FSAR specifically states that no special test of the fire protection and

detection system is required and that routine visual inspection of the system components,

instrumentation and trouble alarms is adequate to verify system operability. This approach was

demonstrably not adequate to assure the complete availability of the C02 system in the cable

spreading room for this incident. During the early stage of the fire, the operation of this

system installed in the cable spreading room was impeded and slightly delayed (59) because

metal plates had been installed over all the local control buttons in order to protect workmen

and prevent release of the C02 during the period of Browns Ferry Unit 3 construction.

An effective licensee inspection program by persons knowledgeable in fire protection and effective NRC audit of this program would have corrected this situation or, if the inhibition was

necessary, everyone would have been informed and alternative procedures developed: A plan

should be developed which provides for the required periodic tests and lists the responsible

I
A

27

individuals and their responsibilities in connection with adequate testing and inspection of

these systems. The requirements for operability and testing for the fire extinguishing

systems--that is, the Limiting Conditions for Operation and the Surveillance Requirements--

should be included in the Technidal Specifications to assure that these necessary systems are

available and in proper working condition.

Fire extinguishing systems must be disabled at times for maintenance on the systems. In certain 1

cases, automatic fire extinguishing systems must be disabled to avoid risk to personnel, working

in a confined area, from inadvertent actuation. In such cases, temporary measures must be

provided for fire protection in areas covered by the disabled equipment. Such measures should

include fire watches equipped with manual extinguishers, appropriate for the area protected,

standby personnel at hose stations, capability for manual restoration and/or actuation of the

disabled system or other acceptable substitute for the temporarily disabled system. This also

holds where fire seals must be breached. They should be restored promptly or, if this is not

practical, adequate temporary measures should be taken.

The NRC inspection report of the Browns Ferry fire (5) contains a number of examples where the

actions taken by the plant operating staff during the fire are stated not to be indicative of a

high state of training of plant personnel in fire fighting operations.

TVA has stated in reply (34) that training in fire fighting techniques was carried out prior to

the March 22 fire and that this training was effective. Since 1970, approximately 325 employees

have attended the Fire Brigade Leader Training Course and four safety professionals have attended

the Texas Firemen's Training School at Texas A & M University.

While the Review Group believes that such basic training is a necessary element in effective

preparation for fire fighting, such training alone does not assure smooth operation of fire

fighting personnel during a fire. Emergency plans should recognize the need for fire fighting

concurrent with other activities. There must be a clear understanding of the duties of the

onsitepersonnel, with preassigned and trained teams for each needed function. The degree of

dependency upon trained onsite fire fighting personnel must be related to the availability of

support personnel from professional fire fighting units (city or county fire departments,

military fire control units, etc.) or trained personnel in the licensee's organization who are

available for such emergency service. In general, the onsite personnel should have sufficient

training and practice to handle all small fires, and to contain larger fires until the offsite

units arrive. When it is deemed prudent to call in the offsite units, their capabilities

should be used to the greatest extent possible. Periodic drills, involving all onsite and

offsite organizations which may be expected to respond to a fire, should be held to enable the

groups to train as a team, permit the offsite personnel to become familiar with the plant

layout, and to permit evaluation of the effectiveness of communication among all those involved.

These drills should include operations personnel, those specifically assigned to fire fighting,

any offsite emergency control centers involved in the plan, and all those other organizations

that would normally respond to such emergencies.
B

28

4.0 SYSTEMS CONSIDERATIONS [

The importance of a fire in a nuclear power station to public safety arises from its potential

consequences to the reactor core and the public. This importance, discussed briefly in Sections

2.5 and 3.5.2, is the subject of the present chapter. Systems availability during and after

the fire is the subject of Section 4.1. The concepts of redundancy and the separation of

redundant equipment are treated in Section 4.2. Section 4.3 treats the application of these

concepts to electrical power and control systems, how the Browns Ferry fire in the cables of

these systems led to the failures experienced, and the lessons to be learned. Section 4.4

discusses the related subject of instrumentation needed during an event such as a fire.

4.1 Availability of Systems During the Event

The detailed history of availability of systems as a function of time during and after the fire

is given in Reference (35).

During the course of the fire, numerous instruments and other equipment gave indications of

unavailability. Restoration to service was accomplished in some cases by alternate switching,

and in some cases by installation of temporary cabling, both during and after the fire. It is

very difficult, therefore, to establish with accuracy which equipment was serviceable at what

time. It is known that power was lost to all Unit 1 Emergency Core Cooling System (ECCS)

equipment, including valve and pump motor controls. Additionally, many instrument, alarm, and

indicating circuits were affected by short circuits and grounds when the fire burned the

insulation off their cables, creating false and conflicting indications of equipment operation.

Starting about 12:40 p.m.. or about 5 minutes after the first notification about the fire to the

control room, alarms began to be received on the Unit I control panel that contains the controls and instrumentation for much of the ECCS. Comparison between the indications (alarms)

revealed discrepancies. For example, one panel indicated all the ECCS pumps were operating,

whereas another indicated normal reactor parameters with no need for such emergency operation.

Intermittent and apparently spurious alarming continued at a lesser rate. At 12:51 p.m., the

recirculating pumps tripped and the operator manually scrammed the reactor, that is, inserted

the control rods to shut off the power generation. Control rod position indication was still

operating at this time, and all rods were verified to be fully inserted.

The Unit I scram was initiated after many spurious alarms; the reactor power had by this time

decreased from 1100 MWe to almost 700 MWe due to a decrease in recirculating pump speed from a

cause unknown to the operator. The Unit 2 reactor was scrammed at 1:00 p.m., ten minutes after

Unit I was scrammed and after spurious alarms had occurred on Unit 2.

At the time, the operators did not know the extent of the fire and its location was only generally defined. The operators did verify that there was no immediate threat to the safety of

the reactors, but that the fire was affecting the emergency core cooling systems.

The operators did not appear to have any specific conditions in mind which would require the

reactors to be scrammed. In fact, the reactors were scrammed only after the spurious signals

had essentially prevented further operation.

The Review Group recognizes that no hard and fast rules can be laid down in advance covering

all possible contingencies, because of the enormous number of possible combinations of events.

In fact, this is one argument for the need to have highly trained operators. Although scram is

automatically initiated for most of the potentially hazardous conditions foreseen by the

designers, the conditions at Browns Ferry were obviously not anticipated. This will be the

case for many events. The operator has a difficult decision to make under these conditions.

He must have a certain amount of reluctance to initiate a scram or he would scram the reactor

needlessly every time an off-normal signal was indicated. Then again, one of his important

functions is to initiate a scram in situations that have not been anticipated by the designer

and require the operator's thought and action.

All this being the case, the time it took the operators to scram is not unexpected. In fact,

the regulatory staff has generally applied a "rule-of-thumb" to operator actions: The design

does not require operators to respond in less than ten minutes. Automatic controls are required

I
29 a

if the required response time isiless than ten minutes. The events at Browns Ferry seem to

confirm that operators need a significant amount of time to receiVe information, evaluate its

significance, make a decision, and put the decision into action. The Review Group has no

recommendation to make in this area. This discussion is included in the report because of

earlier criticism by others of the reactor's operators (62); the Review Group does not join in

this criticism. -7

Normal cooldown was interrupted when the main steam line isolation valves closed on Unit 1 less

than fifteen minutes after scram and on Unit 2 less than ten minutes after scram. Although

isolated from the main condenser, the plants could remain at operating pressure, but zero

power, by using the standby Reactor Core Isolation Cooling System (RCIC) provided for this

situation. Each unit has a steam driven centrifugal pump which injects water into the reactor

to maintain water level. Eleven relief valves are available to control the reactor pressure by

venting steam from the reactor to the suppression pool. The relief valves are self actuating

on high steam pressure, but can also be pneumatically actuated with manual control from the

control room. This RCIC system requires only d-c control power, which is supplied from the

emergency power system. The system can operate several hours by itself before the water in the

suppression pool would get too hot; normally, a pool cooling system dumps the energy and the

RCIC can then cool the reactor indefinitely.

Operation of the RCIC system was initiated on Unit 2, but the system on Unit 1 was disabled by

the fire. The Unit 1 RCIC had started automatically earlier, but was not needed then and was

shutdown. When required later it could not be restarted, because of power failure to the

isolation valve in the RCIC steam line which prevented opening it to admit reactor steam to the

RCIC turbine. However, the RCIC can also be driven by steam from the plant auxiliary boiler.

The system is not normally connected to the boiler and this connection must be accomplished by

inserting a special piece of pipe (spool piece) between the RCIC turbine steam admission line -

and the auxiliary boiler. The piece of pipe had been used for startup tests and was available

to bolt on in an hour or less. With this capability in mind, the operators started the auxiliary boiler, and it was ready for use by 1:30 p.m. (36). However, the spool piece was not

installed, as discussed later.

The High Pressure Coolant Injection System (HPCI) is similar to the RCIC but has a larger steam

turbine driven pump, and is a part of the ECCS. The HPCI systems in Units I and 2 were disabled

by fire damage to control cables.

Both units also have auxiliary systems, which as a necessary part of their normal function can

provide water and thus cooling to the core when the reactor is at any pressure. These systems r

include the Control Rod Drive (CRD) pumps and the Standby Liquid Control (SLC) Pumps. These L

systems can be supplied with electrical power from the diesel generators through the emergency

buses as well as from offsite power.

At 1:30 p.m., forty minutes after scram, an operator stated that he knew that the Unit 1

reactor water level could not be maintained with the CRD pump then operating and that the only

other available pumps could not inject water into the reactor at reactor pressures above 350

psig. After realigning the necessary valves in the feedwater train, and determining that two

of the three condensate pumps and one of the three condensate booster pumps were running, the

four Unit I relief valves that could be manually operated from the control room were opened and

the steam released to lower the reactor pressure. During the blowdown the water level dropped

to about 48 inches above the top of the core and then began to rise as the pressure fell below

350 psig, and the condensate booster pump started injecting water into the reactor. Within two

hours after scram, conditions in Unit 1 had stabilized with water level maintained with a

condensate booster pump and steam vented to the suppression pool through the manually actuated

relief valves.

Unit 2 during this period following scram was under control, using the RCIC to maintain water

level and venting steam through the relief valves even though manual operation of these valves

was lost for nearly an hour. However, one hour after scram (2:10 p.m.), a relief valve apparently stuck open and the reactor pressure began to fall. The operators then decided to continue to depressurize the reactor, with the water level being maintained with a condensate

booster pump as in Unit 1.

Although the condition of both reactors was stable at this time (3:00 p.m.), two hours after

scram, neither reactor was in the normal long term shutdown cooling mode. The'Unit 1 reactor

was venting steam to its suppression pool, which contains over a million gallons of water.

The Unit 2 reactor was venting steam to its main condenser and cooling of its suppression pool
30

had been established while the reactor was being blown down (2:30 p.m.). The operators' aim,

however, was to establish both reactor and suppression pool normal shutdown cooling on both

reactors using the Residual Heat Removal (RHR) systems.

The Unit 1 suppression pool cooling using the RHR system was established twelve hours after

scram (1:30 a.m. March 23) and normal Unit I reactor shutdown cooling using the RHR system was

established 15 hours after scram (4:10 a.m. March 23). -7

The Unit 2 suppression pool cooling using the RHR system was, as noted previously, established

one-half hour (1:30 p.m.) after scram while the reactor was still being blown down. The Unit 2

reactor shutdown cooling using the RHR system was established nine hours after scram (10:45

p.m.).

4.1.1 Redundancy of Reactor Core Cooling Equipment

Reference (35) gives a detailed analysis of cooling capability and redundancy for the Unit 1

reactor core during and after the fire. The periods of significant concern were before the F

reactor was depressurized at 1:30 p.m. and between 6:00 p.m. and 9:50 p.m., when the ability

was lost to open the relief valves to reduce the reactor pressure and utilize the redundant

low-pressure pumps to add reactor water.

The rate of water addition needed decreases as the reactor core decay heat decreases with time.

The decay heat boils the water in the core, and as the steam generated leaves the reactor,

water must be put in to replace it.

Before the Unit I relief valves were opened at 1:30 p.m. to depressurize the reactor, and after

6:00 p.m., when the relief valves could not be opened, the steam generated in the reactor core

caused the reactor pressure to rise slowly. When the pressure was above 350 psi, the condensate

booster pump, although operable, could not pump at such a high pressure and so could not inject

water into the reactor. That left a single CRD pump injecting somewhat more than 100 gpm of

water as the pressure rose.

At high reactor pressure, the automatic makeup is normally provided by the feedwater system

backed up with either the steam driven HPCI or RCIC systems. On Unit 1, neither the HPCI or

RCIC were available following their unneeded operation at the start of the fire.

Besides the CRD pump on Unit 1, other installed sources of high pressure makeup were the CRD

pump on Unit 2, a shared spare CRD pump and standby liquid control (SLC) pumps. The CRD pumps,

while performing their normal functions associated with the control rod drive system, also

provide water to the vessel at high or low pressure. One CRD pump per unit is normally in

operation and the pump for Unit 1 operated continuously throughout the course of the incident.

In addition the SLC pumps are each capable of providing approximately 56 gpm of water at

pressures up to reactor coolant system design pressure. The SLC pumps were not required as a

backup reactivity shutdown system since the control rods functioned normally. An analysis of

the available evidence suggests that there was a period of up to three hours following the

initiation of the fire during which the SLC pumps were not available due to loss of power;

however, the power for at least one pump is known to have been available at 6:00 p.m., and the

other either was easily available or could have been made available, if needed, within 1 hour.

The CRD pump in operation was part of a system for Units 1 and 2 which consisted of three CRD

pumps. One pump normally operates for each unit and the third pump can be used on either unit.

Subsequent examination of the actual piping configuration confirmed that it is also possible to

align the Unit 2 pump to provide water to Unit 1. Means also exist to increase the output of a

CRD pump by valving in a pump test bypass line which provides an additional flow path. It is

estimated that by opening this single valve it would have been possible to have provided

sufficient water, approximately 225 gpm, to maintain the core covered throughout the course of

the incident. No other systems would have been required to provide water to maintain an

adequate inventory of water in the reactor vessel and depressurization would not have been

necessary. This flow (225 gpm) could have been increased to in excess of 300 gpm with an

additional CRD pump.

An additional source of high pressure water mentioned previously as being unavailable due to

fire damage was the Unit 1 RCIC system.

It would have been capable of providing sufficient flow (600 gpm) for makeup water requirements

throughout the entire course of the incident if the decision had been to make it available. It

appears that this system could have been made available within an hour after making this

decision. The source of steam for the RCIC system would have been the auxiliary boiler which
31

was used for testing the RCIC prior to plant operation. Two procedures are necessary to

provide the st~am path. First. the auxiliary boiler must be put into operation. Full steam

pressure from this source can be obtained in less than one hour. The operators actually put

the auxiliary boiler into operation by 1:30 p.m. (36), and it was available during the time the

relief valves could not be opened. The second procedure is the installation of a piping piece

to make up the flow path from the auxiliary boiler to the RCIC turbine. This could have been[

accomplished in less than one hour. The operation of the RCIC would then have been possible

from the backup control room; however, the system was not actuated. Instead, the action to

restore relief valve operability was accomplished in approximately 3-1/2 hours following which

time the reactor vessel pressure was once again reduced within the capability of the condensate

booster pump to inject water.

There were other courses of action which might have been taken by the operator in the event

that remote-manual operability of the relief valves was lost. No immediate problem existed

since the pressure would have increased up to the setpoints of the relief valves in their

overpressure protection mode with subsequent steam relief to the suppression pool. The CRD

pump was providing a source of makeup water. With the much reduced decay heat, considerable

time was available for other operator action: two hours at 1:30 p.m.; at least 8 hours at 6:00

p.m. The alternative sources of high pressure makeup water were still available if control air

to the relief valves could not be reestablished.

Calculations, however, indicate (35) that after 7:00 p.m. no augmentation of CR0 pump flow was

necessary to maintain the plant in a safe condition. This is due to the availability of a

depressurization and heat removal path via the main steam line drain valves to the condenser.

Both of these valves were inoperable by electrical means as a result of fire damage. The

operators, however, decided to return draining capability to the main steam line and this was

achieved at approximately 7:00 p.m. It is calculated that the quantity of steam being removedfrom the pressure vessel through the main steam drain line was great enough that the reactor

pressure would have leveled off at a safe value prior to reaching the relief valve setpoint.

An equilibrium condition would then have been maintained with the reduced reactor pressure

reducing the head on the operating CR0 pump such that the pump would provide sufficient makeup

flow to maintain the core covered throughout the remainder of the incident.

4.1.2 Role of Normal Cooling Systems

By contrast to the safety systems provided to cool the reactor core in a postulated accident,

the systems used to cool the reactor in normal operation are not required to meet safety

criteria. Components of these systems--CRD pumps, condensate and condensate booster pumps, and

associated valves--were used successfully to cool the reactor during and following the Browns

Ferry fire. Redundant safety systems designed to cool the reactor in the event of failure of

the normal systems became unavailable as a result of the fire. (See Section 4.3.1 for details).

The survival of normal cooling systems when safety systems failed seems to have been the

result of the particular location of the fire rather than differences in their design criteria.

The fact that normal cooling systems kept the reactor cooled and safe during and following the

Browns Ferry fire, leads one to consider whether they should be designated as safety-related

systems. The most obvious question to ask is whether safety criteria should be applied to some

or all of the normal cooling systems. In general, the number of systems and components

required to meet safety criteria is deliberately limited in number. It is generally believed

that a safer design results when an intensive safety design effort can thus be concentrated on

these relatively few devices.

The number of systems and components designed to safety criteria would considerably increase if

normal cooling systems were so designed. The flexibility of the designer to design the most

efficient and economical systems for power generation would probably be limited. It is possible

that if normal cooling systems were required to meet safety requirements, designers might have

a tendency to reduce the attention given to the safety systems which back up the normal cooling

systems. Normal cooling systems tend to be large high capacity systems, and the cost of

upgrading their designs to meet safety criteria would, therefore, tend to be large. The Review

Group believes that the increased cost of designing normal cooling systems to safety criteria

would not be balanced by a large increase in safety. The Review Group has, therefore, concluded that upgrading normal cooling systems to meet safety criteria is not required and is not

necessarily desirable. Any required improvements in safety can be accomplished more effectively and at less cost inother areas.

The independence of the normal cooling systems from the systems that could cool the reactor in

the event of failure of the normal cooling systems failed should be considered. In particular,
32

the safety systems provided to cool the reactor should be located and protected so as not to be

affected by fires (or other events) that could make the normal cooling systems unavailable.

4.2 Redundancy and Separation - General Considerations

Redundancy is a design feature universally employed in systems that perform safety functions in[

nuclear power plants. It is defined as the provision of more than one component or subsystem,

arranged so that the system function is not halted upon the failure of a single component or

subsystem. The multiple devices are said to be redundant devices, and the "single failure

criterion" is used to govern the system design.

The reason for employing redundancy is the need for highly reliable safety functions in the

real world of pumps, valves, and other components known to be subject to failures. Perfect

components are unattainable. Improvements in the reliability of components can be achieved for

a cost, but there is a practical limit on what can be accomplished in this way. Given reasonablyr

reliable components, redundancy is generally far more effective in achieving highly reliable

systems than further efforts toward improvements in component reliability.

The large improvement predicted in system reliability as a consequence of redundancy is,

however, contingent on the independence of any failure affecting the redundant elements. That

is, the benefits of redundancy would be negated for any type of event that would induce concurrent failures in more than one of the redundant devices. Such events are called "common

mode failures." They can arise in various ways, the most obvious of which are the following:

1. An adverse "environment" affects the redundant devices--fire, flooding with water, high or

low temperatures, earthquake.

2. An auxiliary function or device necessary to operation fails and the failure affects the

redundant devices--electric power, lubrication, cooling.

3. A human action or series of actions affects the redundant devices--adjustment, manipulation

of controls, sabotage.

The Browns Ferry fire induced common-mode failures of redundant core cooling subsystems. The

damage to power and control cables by the fire caused the equipment served by these cables to

become unavailable for cooling the reactor core. Even during the fire, availability of some

equipment was restored, by switching actions to avoid using the damaged cables and by running

new wires to essential equipment via routes away from the fire.

One design feature which can and did lessen the operational consequences of the common mode

failures in the Browns Ferry electrical system was the capability to operate equipment manually,

principally valves, using handwheels. By contrast, the inability of the operators to open

manually the (single, non-redundant) air supply valve after it failed closed contributed to the

long inoperability time of the relief valves. The air supply was made operable and relief

valve operation restored by temporarily bypassing the air around the supply valve with some

copper tubing. As a result of this experience, TVA is now providing the capability to open

most fluid lines manually, in the case of the air supply for the relief valves by the addition

of a manual valve in parallel with the solenoid operated air supply valve. The Review Group

recommends that in general the capability to manipulate valves manually be a design consideration

in all plants. The operability of this manual capability should be periodically checked to

assure that such valves are manually operable and handwheels are not missing.

The Browns Ferry designers did not intend their design to be vulnerable to common mode failures;

the results were unexpected and contributed to the difficulties experienced during the event.

In the following sections, these cotmmon mode failures are examined for the lessons that can be

learned from them.

It should be pointed out that isolation of redundant safety devices and their cables is an

ideal, not fully achievable in real life. The goal of isolation and separation requirements is

that an adequate degree of isolation be provided. The control room and the cable spreading

room have already been identified as areas where isolation is difficult. Others are inside the

containment, in the vicinity of the reactor, and in the main electrical switchyard. The

redundant subsystems and their cables are associated with a single reactor, a single containment, a single turbine-generator, and a single control room. As with other echelons of safety,

perfection is neither required nor achievable, and the safety goal is a balanced defense-indepth rather than perfect isolation and separation.
33 a

TABLE 2

ASSIGNMENT OF DAMAGED CABLES TO REDUNDANT DIVISIONS

Plant Usage Number Safety Classification Channel or Division*

Common 20 Engineered Safeguard - ECCS I

Units I-I-I1 20 Engineered Safeguard - ECCS II

13 Engineered Safeguard - Diesel A IA

33 Engineered Safeguard - Diesel C IIC

5 Engineered Safeguard - Diesel D IID

7 Load Shedding - Diesel A Al

9 Load Shedding - Diesel C B1

7 Support Auxiliaries - Electrical IE

Subtotal 114

Unit 1 6 Engineered Safeguard - ECCS I

182 Engineered Safeguard - ECCS II

4 Load Shedding - Diesel A Al

5 Load Shedding - Diesel C B1

I Load Shedding - Diesel D B2

52 Neutron Monitoring (also activates RPS) IA

52 Neutron Monitoring " " IB

52 Neutron Monitoring " " IIA

52 Neutron Monitoring m " IIB

14 Primary Containment Isolation I

39 Primary Containment Isolation II

2 Reactor Protection (control rod scram) IA

2 Reactor Protection " " " IB

2 Reactor Protection " " " IIA

2 Reactor Protection " " I IIB

3 Reactor Protection " IIIB

12 Supporting Auxiliaries - Electrical IE

Subtotal 482

Unit 2 15 Engineered Safeguard - ECCS I

3 Engineered Safeguard - ECCS II

4 Supporting Auxiliaries - Electrical IE

Subtotal 22

Unit 3 4 Engineered Safeguards - ECCS I

3 Engineered Safeguards - ECCS II

3 Supporting Auxiliaries - Electrical IE

Subtotal 10

ii

F

r

L

TOTAL

*See Legend

628

(following page) for channel or division definitions.
34 a

TABLE 2 - LEGEND

The following apply to all cables:

I - Division I engineering safeguard or Primary Containment

Isolation cables

II - Division II engineering safeguard or Primary Containment

Isolation cables

IA - Diesel generator A shutdown logic cables (may be routed in

cable tray with Division I cables)

IB - Diesel generator B shutdown logic (routed in conduit)

IE - Supporting auxiliaries needed for safe shutdown of plant

IIC - Diesel generator C shutdown logic (may be routed in cable tray

with Division II cables)

IID - Diesel generator D shutdown logic cables (routed in conduit)

,V

The following apply

Al - 480V load

A)

A2 - 480V load

B)

B1 - 480V load

C)

B2 - 480V load

D)

to Load Shedding Cables:

shedding logic channel Al: (routed with IA-Diesel

shedding logic channel A2: (routed with IB-Diesel

shedding logic channel B: (routed with IIC-Diesel

shedding logic channel B2: (Routed with IID-Diesel

to Reactor Protection and Neutron Monitoring cables:

channel Al

channel A2

channel Bl

channel B2

The

IA

IIA

IB

lIB

following apply

- RPS logic

- RPS logic

- RPS logic

- RPS logic

The following apply to Reactor Protection cables:

IIIA - RPS manual and back-up scram solenoid channel A

IIIB - RPS manual and back-up scram solenoid channel B

A - 120V a-c RPS channels Al, A2, and A3 supply (RPS MG set A)

B - 120V a-c RPS channels Bl, B2, and B3 supply (RPS MG set B)
35

4.3 Separation of Redundant Electric Circuits

4.3.1 Common Mode Failures Caused by the Fire

The chronicle of the Browns Ferry fire includes mdny examples of unavailability of redundant

equipment. Evidently the independence provided between redundant subsystems and equipment was

not sufficient to protect against common mode failures. Therefore, although the system function--

cooling the reactor core--was in fact successful (see Section 4.1.1), the multiple unavailabilities need investigating.

Reference (37) contains a detailed accounting of the cables damaged by the fire. A summnary

listing is given here in Table 2, which is taken from Reference (37).

Separation of redundant subsystems is accomplished by dividing the safety equipment into redundant divisions. As can be seen from Table 2, on Browns Ferry the engineered safeguards are in

two divisions, the reactor protection instrumentation in four. Power sources are also separated into divisions. The distribution of power sources and essential equipment (power loads)

is arranged so that no failure of a single divison can interrupt essential functions.

The Browns Ferry design was intended to embody the principles of separated redundant divisions.

Yet Table 2 makes it obvious that the fire damaged cables belonging to both major divisions,

thereby inducing common mode failures. This is borne out by the chronology (35) wherein it is

recorded that redundant subsystems were unavailable. Some of the more notable examples for

Unit 1 are summarized in Table 3. In addition many redundant instruments were inoperative,

including all reactor neutron monitoring.

TABLE 3[

UNIT 1 REDUNDANT SUBSYSTEMS NOT AVAILABLE

Sys tem Number of Subsystems

Core spray 2

Residual Heat aRemoval 2

Relief Valvesa a 11 (4 restored)

High Pressure Coolant Injectiop 1

Reactor Core Isolation Cooling 1

Standby Liquid Control 2

This result is surprising in view of the redundancy and separation that were part of the plant

design basis. TVA has conducted an extensive review of the reasons for these inoperable

multiple redundant subsystems (37). The two principal causes of the common-mode failures that

occurred are discussed in the following sections. They are (1) feedback through indicator

light connections, and (2) proximity of conduit to cable trays. Following technical discussions

of these two principal causes, a survey of separation criteria is given along with recommendation for improvement.

4.3.2 Common Mode Failures Attributable to Indicator Light Connections

Equipment status indicators are essential to correct operation. The operator must have available to him enough information to assess the status of his plant and to supervise its operation.

A complex installation like a Browns Ferry unit--like any nuclear power unit--contains dozens

of systems and hundreds of devices. The arrangement of indicators and controls must facilitate

supervision of the operation by one or two people. The indicators are grouped and arranged to

enhance visual comprehension of the information patterns likely to be important.

Lights are used extensively to indicate the status of equipment. Their small size and easy

recognition when lit commend them to the designer and operator. The Browns Ferry control

panels, like most panels of their type, are liberally provided with them. One use of such

lights is to monitor the status of the plant's electric power system. This is especially

important during off-normal operation, and should have been helpful during the fire. Unfortunately, the damaged cables included the wires leading from the various power distribution

panels to the indicator lights that were supposed to tell the operator where he could find

power available for important systems. Additional damaged cables connected other indicator

lights to the control cubicles for motor-operated valves.

a For supplying water with the reactor at high pressure, these systems are redundant alternatives;

the relief valves must be coupled with low-pressure pumping.
36

It is indeed ironic that provision of indicator lights to aid the operator in doing the correct

thing during an emergency led to unavailability of multiple redundant devices. The light

circuits were thought to be isolated from the power sources and safety circuits by series

resistors. These resistors were ineffective because the circuit designers did not consider the

types of short circuits that actually occurred during the fire. When the cable insulation had

burned away, the resulting short-circuits among the wires in the trays fed power backwards from

the lights toward the power and control panels in spite of the series resistors, causing

breaker trip coils to remain energized thereby keeping breakers open. Tripping the breakers

removed power from safety equipment and made normal breaker control impossible. This was

discovered during the fire; some power and control circuits were restored by physically disconnecting the light circuits at the control or power panel, then replacing blown fuses and

realigning tripped breakers (5). This operation had in many cases to be carried out in dense

smoke by a craftsman wearing breathing apparatus, while the panel he worked on was energized by

normal power and by the short circuits.

Because these circuits were not recognized as potential sources of failure of safety equipment,

their cables were not separated into divisions and segregated away from non-safety cables.F

Rather, they were treated as non-safety cables whose routing and tray companions were of no

moment. Therefore, when failures occurred, there was no divisional separation and the equipment unavailability thus induced was not confined to one division in accordance with the plant

design objectives.

Today there are better criteria for this type of circuit (see Section 4.3.4.2). Circuits of

this sort would either (1) be designated as "associated circuits" and be required to meet the

same separation criteria as safety circuits or (2) be isolated adequately from the safety

circuits. The Review Group recommnends that where there are interconnections between safety

equipment and nonsafety circuits such as indicator light circuits, the adequacy of the isolation

should be assured.

4.3.3 Proximity of Cables of Redundant Divisions

4.3.3.1 Trays and Conduit

A nuclear power unit includes many thousands of electrical cables, some with multiple circuits.

Nearly all the control power, and much of the motive power, for the motors and pumps and valves

in the plant are electrical. The 1600 cables damaged by the Browns Ferry fire are in fact a

small fraction of the total. These cables are connecti *ons; the things they interconnect are

located throughout the plant. Therefore, there must be a system of "highways" along which are

routed groups of cables going the same way. In the Browns Ferry plant, as in most, this

function is performed principally by steel cable trays, typically 18 inches wide and a few

inches deep.

Separation of redundant equipment requires separation of their associated cables, therefore

separation of the trays for these cables. Grouping equipment into divisions naturally results

in grouping cable trays into divisions. The Browns Ferry fire started in one of a group of ten

trays, all of Division II (see Table 2). In principle, then, in accordance with design criteria,

only Division II equipment should have lost availability. This was evidently not the case.

One of the reasons was the presence of Division I cables in the fire zone, in spite of the

supposed separation. Upon examination (TVA has reported an extensive study in Reference (37)),

it turns out that the damaged Division I cables were in "electrical conduit"--pipes of aluminum

or steel also used as "highways" for electrical wires and cables.

TVA in their "Restoration Plan" (37) identified 68 places in the Browns Ferry plant where

cables of one division are now deemed to be too close to trays containing cables of a redundant

division. The Group has been informed that there may be more such places. TVA has now developed proposed criteria to define "too close," to be considered later in Section 4.3.4.5. They

are proposing to ameliorate these 68 situations with suitable combinations, relocation, improved

barriers, sprinkler protection, or other means; the details of the corrections are not within

the scope of the Review Group, but are to be reviewed in connection with other aspects of

Browns Ferry Licensing.

The areas of proximity were designed, reviewed, inspected, and approved that way. Running

cables in conduit is considered very good practice. The conduit was provided to solve routing

problems that would otherwise call for too close proximity of divisional trays; the conduit was

to isolate the cables from their redundant counterparts.

This lesson of Browns Ferry is that the conduit in the fire zone did not protect all cables

adequately. Improved criteria regarding the use of conduit are needed in the light of this

lesson; recommendations are given later in Section 4.3.4.
37 1

4.3.3.2 Non-Divisional Cables

It is worth noting that many cables are not safety-related and therefore belong to no division.

At first thought, it might be believed that the routing of such cables has no safety significance. This is true only if the non-safety cables never come into proximity with any safety

cables. If they do, then the potential for interaction of the non-safety cables with those of

a safety division suggests that the same non-safety cables should not come into proximity with

the other safety division(s). This concept is elaborated as "associated circuits" in present- 11

day cable separation criteria, as discussed later in Section 4.3.4.2.

4.3.3.3 Cable Spreading Room

It should also be noted that in present designs of cable spreading rooms--including Browns

Ferry--it has been found necessary to provide less separation of divisional cables than in

other parts of the plant. The problem arises in the layout of the control panels for ease in

operator comprehension--an essential--rather than separation of redundant divisions. In

addition, the routing problem in the cable spreading room is severe. Cables from every part of

the control room must be routed in many different directions to their destinations in the rest

of the plant. The result is congestion in most cable spreading rooms, and Browns Ferry is no

exception. In view of the obvious concentration of cables and circuits, and the reduced divisional separation, cable spreading rooms deserve, and receive, special attention in design and

procedures for fire prevention and fire fighting.

The installed CO system was successful in conjunction with repeated manual applications of dry

chemicals in minimizing the fire damage in the cable spreading room in the Browns Ferry fire.

The control of more than one generating unit from a single control room increases the potential

vulnerability of the cable spreading room, but has advantages in economy and operational coordination. Criteria for cable spreading rooms need further attention and improvement, in the [

Review Group's opinion. Also needed are some varied design approaches to seek improvement in

divisional (and, when applicable, multi-unit) separation. Improved access for fire-fighting

should also be sought. Criteria for cable spreading rooms are discussed further in Section

4.3.4.4.

4.3.4 Physical Separation Criteria for Cables

4.3.4.1 Browns Ferry Criteria for Physical Separation and Isolation

of Redundant Circuits

The Browns Ferry design provided redundant safety equipment and circuits to prevent the failure

of any single component or circuit from causing the loss of a safety function. The FSAR states

that the overall objective of the Browns Ferry separation criteria is to preclude loss of

redundant equipment by a single credible event. These criteria are summarized in Table 4,

along with more recent improved criteria.

TVA and NRC have conducted extensive evaluations of cable separation in the as-built Browns

Ferry plant. The results, and the Review Group's review of cable tray and conduit layout

drawings, and inspection of the physical installation, showed general compliance with the

physical separation criteria documented in the FSAR. There were, however, a number of areas in

which the objective of the separation criteria appear to have been compromised.

The Browns Ferry FSAR stated that routing of safety related cable through rooms or spaces where

fire hazards exist were generally avoided. The FSAR further states that in cases where it was

impossible to provide other routing, only one division of redundant cables was permitted in any

such areas. It is clear from the cable tray and conduit routing that TVA did not consider the

reactor building in the vicinity of the fire to be an area where significant fire hazard existed.

The events of the fire show that under the conditions existing at the time a fire hazard did

exist. The potential hazard would have been lower if the seals between rooms had been in their

design condition. The non-fireproofed seal, the highly flammable flexible foam, and the candle

created the hazard and the fire resulted.

The philosophy used by TVA in the design of the Browns Ferry electric system made the actual

assignment of circuits to redundant divisions and the implementation of their physical separation difficult. It was TVA's philosophy to provide considerable versatility in the design

which resulted in many interconnections between redundant power sources. These interconnections

really pertain to both divisions. A separate and redundant system, with no interconnections

between redundant divisions, would be easily divided into a minimum number of divisions. Each

component or cable would be clearly identifiable as belonging to its division. In laying out
38

TABLE 4

COMPARISON OF BROWNS FERRY FSAR

SEPARATION REQUIREMENTS WITH

REGULATORY GUIDE 1.75

1. Requirement for use of flame retardant cable

RG 1.75 - Required

Browns Ferry Criteria - No requirements specified in FSAR. Some

cable specifications require IPCEA flame

tests.

2. Associated circuits must meet same criteria as safety circuits up

to an isolating device F

RG 1.75 - Required

Browns Ferry Criteria - None except minor restrictions on

associated circuits.

3. Separation of safety circuits from non-safety circuits

RG 1.75 - Same separation required as between redundant

safety divisions.

Browns Ferry Criteria - None

4. Methods of separation

RG 1.75 - Separate Class I structures, distance, barriers

(RG 1.75 states preference for separate Class I structure)

Browns Ferry Criteria - Not discussed

5. Distance separation

5.1 Hazardous Areas (fire, missiles, pipe whip)

RG 1.75 - By ad hoc analysis

Browns Ferry Criteria - Avoid. Where not possible to avoid

route only one safety division.

5.2 Non-hazardous areas

RG 1.75 - 3 feet horizontal

5 feet vertical

Browns Ferry Criteria - 3 feet horizontal. Vertical stacking

avoided where possible. Where not possible

5 feet vertical separation.* 18 inches

permitted where redundant divisions cross.*

*With solid metal bottoms on upper tray and

solid metal top on lower tray.
39

5.3 Cable spreading room

RG 1.75 - Where feasible redundant cable spreading areas should be

utilized. Otherwise provide 1 foot horizontal, 3 feet

vertical.

Browns Ferry Criteria - 3 feet horizontal and 18 inches vertical. Conduit

where separation cannot be maintained.

5.4 With use of barriers

RG 1.75 - 1 inch horizontal

1 inch vertical

Browns Ferry Criteria - 18 inches vertical

Horizontal not specified

6. Barrier material requirements

RG 1.75 - Mttal (type not specified)

Cable tray covers approved by example.

Browns Ferry Criteria - Steel cable tray covers

7. Barrier configuration

RG 1.75 - 6 inches to 1 foot overlap depending on configuration

but metal covers with no overlap are permitted.

Browns Ferry Criteria - Not discussed

8. Separation within safety divisions

RG 1.75 - No requirements

Browns Ferry Criteria - 4 inch horizontal

9 inches (tray bottom to tray bottom) vertical

9. Conduits F

9.1 Use of conduits

RG 1.75 - Same requirements as for cable trays. Not specified

as to whether they qualify as barriers.

Browns Ferry Criteria - Permitted as barriers in cable spreading

room where adequate spacing cannot be

maintained. Reactor protection and containment isolation systems in conduits.

9.2 Conduit Materials

RG 1.75 - Not specified

Browns Ferry Criteria - Not specified
40 a

equipment locations and cable routings the designer would need only be concerned with keeping

one division separated and isolated from the other(s) and with avoiding areas where both

divisions are subject to failure from a common cause such as missiles, pipe whip, high energy

fluids, flooding, or fires. With interconnected systems, the designer has to decide whether he

must keep an interconnection separated from both divisions or only one. If he decides that

separation of all interconnections is not required he must perform a careful analysis to determine which interconnections can be routed together and develop an orderly method to assure that

the separation and isolation is properly implemented.

The separation criteria for these interconnections were not clearly stated in the Browns Ferry

FSAR. It is possible that the large number of interconnections was partially responsible for

the fact that conduits for one division were run quite close to cable trays of the other division. The complexity of the interconnected design was probably responsible for errors being

made that resulted in the normal power supply to power distribution panels in one division

being electrically connected to the alternate supply to panels in another division. For example,

the normal supply to 480 volt shutdown board lB was electrically connected to the alternate

supply to 480 volt shutdown board lB. This lack of electrical isolation introduced by interconnections provided to give increased flexibility appears to have decreased system availability

in the Browns Ferry fire.

The complexity of the Browns Ferry interconnections probably resulted in errors made in the d-c

controls for the 4kV shutdown boards that resulted in a power interruption on 4kV shutdown

board D (37). Each 4kV shutdown board is provided with a normal, an alternate, and an emergency

supply of d-c control voltage. The availability of any two of these three control voltage

sources was designed to be sufficient. In the actual installation, however, failure of a

single d-c cable made the board inoperative. TVA is redesigning the boards so that each is

fully functional with a single d-c supply; alternate supplies are also being provided.

There were violations of the intent of the Browns Ferry separation and isolation criteria in .

the indicator light circuits as discussed previously in Section 4.3.2. It is often desirable

to provide connections between safety circuits and non-safety circuits. Examples are connections from safety circuits to indicator lights and meters in the control room and to the

plant computer to permit the operator to monitor the performance of safety systems. Where this

is done, present NRC criteria require that adequate isolating devices be provided in the safety

equipment so that credible faults in the non-safety monitoring circuits will not affect the

safety circuits.

Although the Browns Ferry criteria do not mention conduit except for the cable spreading rooms,

the principles of physical separation and fire barriers were violated in the lack of adequate

separation of conduit containing cables of one division from cable trays of another division,

as discussed in Section 4.3.3.1. The Browns Ferry criteria require an 18 inch separation in

conjunction with steel cable tray covers in congested areas. At least one aluminum conduit

containing Division I cables was run parallel to and only 2 or 3 inches above a cable tray

containing Division II cables. In addition to violating the separation distance criterion, the

aluminum conduit proved to be an inadequate fire barrier. Based on the Review Group's discussions with fire experts (19), the steel cable tray covers permitted by the criteria also

appear to be inadequate fire barriers.

4.3.4.2 Comparison of Browns Ferry Separation Criteria with Current

NRC Separation Criteria

Section 50.55a of Title 10, Code of Federal Regulations, requires that protection systems meet

the requirements set forth in the Institute of Electrical and Electronics Engineers Standard,

"Criteria for Protection Systems for Nuclear Power Generating Stations," (IEEE 279). Section

4.6 of IEEE 279 requires, in part, that the channels that provide signals for the same protective

function be independent and physically separated. General Design Criterion 3, "Fire Protection"

of Appendix A tO 10 CFR Part 50 requires, in part, that the structures, systems, and components

important to safety be designed and located to minimize, consistent with other safety requirements

the probability and effect of fires. General Design Criterion 17 requires, in part, that the

onsite electric power supplies, including the batteries and the onsite electric distribution

system, have sufficient independence to perform their safety functions pssuming a single failure.

General Design Criterion 21 requires, in part, that the independence designed into protection

systems be sufficient to insure that no single failure results in loss of the protection

function.

Regulatory Guide 1.75 (66) documents separation requirements that have been found to be acceptable by the NRC staff. It endorses Institute of Electrical and Electronics Engineers Standard

IEEE 384-1974, but in addition modifies certain requirements of IEEE 384-1974 and provides

additional restrictions.

I
41

Table 4 provides a summary comparison of the Browns Ferry separation criteria as documented in

the FSAR with those of Regulatory Guide 1.75. In most significant areas the Browns Ferry FSAR

criteria compare quite favorably with Regulatory Guide 1.75. The comparison is particularly

favorable when one considers that the criteria documented in Regulatory Guide 1.75 were developed

over the 7 years after the construction permits for Browns Ferry 1 and 2 were issued in 1967.

Regulatory Guide 1.75 requires the use of flame retardant cable as a basis for using the separation distances specified in the guide. The standard endorsed by the guide defines the term

"flame retardant" as capable of preventing the propagation of a fire beyond the area of influence U

of the energy source that initiated the fire. The standard, however, provides no guidance for

testing to determine whether a specific cable qualifies as being flame retardant. The Browns

Ferry FSAR contains no criteria with regard to the flame retardancy of the cable to be used.

This subject is treated in Section 3.4.1 of this report.

The concept of associated circuits as documented in Regulatory Guide 1.75 is a recent refinement. Associated circuits are defined as non-safety circuits that share power supplies,

enclosures, or raceways with safety circuits or are not physically separated from safety circuits by acceptable separation distance or barriers. The guide specifies that associated

circuits meet the same separation requirements as the safety division with which they are

associated, up to and including an isolation device. Beyond the isolation device the associated

circuit is not subject to safety circuit separation requirements. The guide defines an isolation device as a device which prevents malfunctions in one section of a circuit from causing

unacceptable influences in other sections of the circuits or other circuits. If isolation

devices meeting this definition had been provided at Browns Ferry between circuit breaker

control circuits and cables to control room indicating lights (see Section 4.3.2), the system

unavailability as a result of the fire would probably have been decreased.

Regulatory Guide 1.75 contains provisions for isolating safety cables from non-safety cables in

the same way safety divisions are isolated from each other. The Review Group believes that

this represents a significant improvement over the Browns Ferry criteria. Much of the cable L

insulation that contributed to the extent of the Browns Ferry fire belonged to non-safety

cables. Isolation of that cable from safety cables would tend to reduce the fuel involved in a

safety cable fire. In addition it would tend to eliminate faults in non-safety cables as a

potential source of a fire in safety related cables. Such isolation could be provided in

several ways, such as physical separation, solid barriers, or fire-retardant coatings.

The Browns Ferry FSAR criteria for running cables in hazardous areas--areas subject to fire,

missiles, pipe break, etc.--are more specific than those contained in the Regulatory Guide.

The guide indicates that the routing of cables in such areas are to be justified by analysis.

The Browns Ferry FSAR criteria require these areas to be avoided where possible, and where not

possible only one safety division is to be routed through such an area.

The guide and Browns Ferry FSAR criteria for routing cables in non-hazardous areas and in the

cable spreading room are quite similar although the separation distances permitted by the

Browns Ferry FSAR criteria are somewhat less.

The guide and the Browns Ferry FSAR criteria both permit the use of barriers in areas where the

required physical separation cannot be maintained. The Browns Ferry FSAR criteria are somewhat

more stringent than those of the guide. Neither the guide nor the Browns Ferry FSAR criteria

are very specific with regard to barrier material requirements. Regulatory Guide 1.75 contains

no restrictions with regard to the type of metal permitted as cable tray cover barriers. The

Browns Ferry FSAR criteria permit cable tray covers to be used as barriers. The use of conduit

as barriers is vague in both the guide and the Browns Ferry criteria. The guide indicates that

the same requirements apply to conduit as apply to cable trays but the use of conduit as barriers is not mentioned. The Browns Ferry FSAR criteria permit conduit in the cable spreading

room where adequate spacing cannot be provided. Neither the guide nor the Browns Ferry FSAR

criteria provide any restriction with regard to the conduit materials.

Recently, the TVA has proposed (37) modified separation criteria to be used for design modifications deemed to be needed for rebuilding Browns Ferry. The Review Group has not evaluated

these criteria, which are evidently still being developed.

Regulatory Guide 1.6, "Independence Between Redundant Standby (Onsite) Power Sources and

Between Their Distribution Systems" describes an acceptable system consisting of redundant,

independent power sources and load groups. Restrictions are placed on interconnections between

load groups. Although Regulatory Guide 1.6 does not specifically discuss physical separation,

it describes a design that is conducive to good physical separation. A system designed in

accordance with Regulatory Guide 1.6 would not contain the numerous interconnections contained
42

in the Browns Ferry design, and the proper identification and separation of redundant circuits

could be more easily achieved.

There was no specific regulatory guidance concerning the sharing of onsite electric systems

between units and the electrical interconnections between units at the time of the Browns Ferry

safety evaluation. In the Browns Ferry plant, such sharing and interconnections are more

extensive than in most plants. The staff has more recently issued Regulatory Guide 1.81 to

provide a more orderly approach to minimizing interactions of onsite electric systems. The

regulatory position for new plants contained in Regulatory Guide 1.81 is that each unit should

have separate and independent onsite emergency and shutdown electric systems.

4.3.4.3 Adequacy of Existing NRC Separation Criteria

The basis for the present NRC separation criteria described in the previous section is that the

cables are run in a non-hazardous area and the only flammable material considered in the design is the cable insulation. Although the Browns Ferry fire was started in flammable material

external to the cable insulation, the fire propagation in the cable trays suggests to the

Review Group that the flammability of cable insulation was underestimated in the development ofF

these criteria, which were based on a review of the consequences of past cable tray fires. The -

results of the two cable tray fires that occurred at San Onofre Unit 1 in 1968 and the 1965

fire that occurred during the construction of Peach Bottom Unit 1 were reviewed (24,38). The

results of cable tray fires in non-nuclear units were also considered (39,40). During the

development of the IEEE-384 separation criteria, fire experts of the Nuclear Energy Liability and Property Insurance Association (NELPIA) were consulted. Other technical experts experienced

in cable manufacture and nuclear power plant design and operation were also consulted at IEEE

working group meetings. Later, the results of construction fires experienced more recently at

nuclear plants were evaluated to determine whether the criteria required modification (41-43).

It was the opinion of the NRC staff that the existing NRC guidance (IEEE-384 modified and

expanded) took into account the fire experience to date and the best expert advice available.

The Browns Ferry fire has provided additional information that must be considered in a reevaluation of NRC separation and isolation criteria.

As discussed in Section 3.1.2, TVA evaluated the temperatures reached during the fire and

developed a zone of influence (Figure 2) showing the area around a group of cable trays within

which cables of another division might be subject to fire damage. Such a zone of influence

could be used as a basis for improving the separation and isolation criteria and guidance. Figure 2 shows that the TVA study did not establish a distance above the fire where it would be

safe to run redundant cable. Therefore, criteria based on the Browns Ferry fire data would

have to preclude vertical stacking of cable trays of redundant safety divisions or of conduitcontaining redundant safety circuits above trays. A single specified minimum distance for

horizontal separation would also not be an adequate requirement, because the width of the zone

of influence (Figure 2) varies with the distance above the reference trays.

Another point brought out by the fire concerns the concept of an area that is "non-hazardous"

with regard to fire. The existing NRC guidance specifies that the minimum separation distances

are permitted only in non-hazardous areas. A non-hazardous area is defined as one in which the

only fire threat to safety circuits is the cable insulation. The specified minimum separation distances would not necessarily be adequate if appreciable amounts of flammable materials in

addition to the cable insulation were present. The Browns Ferry fire has shown that an area

intended to be non-hazardous with regard to fires will not necessarily remain non-hazardous for

the life of the plant. Although the Browns Ferry fire seals in their design condition might not have constituted a significant fire hazard, the hazard was increased by removing the fire

retardant coating to install additional cables. Such a condition could result from deter

ioratlon with time, construction operations, plant modifications, or poor housekeeping.

Deficiencies observed during the inspections of the fire seals of a number of other plants (see Section 3.4.2) illustrate that improvements in construction and operation quality assurance

programs will be required if areas designed to be non-hazardous are to be maintained nonhazardous.

Another concern with the present NRC separation and isolation criteria involves the definition

of flame retardancy of cable insulation. IEEE 384 requires as a condition for utilizing the

specified minimum separation distances that the cable insulation be flame retardant. The

subject of cable insulation and the difficulties in demonstrating flame retardancy are discussed in detail in Section 3.4.1.

4.3.4.4 Criteria for the Future

The Review Group has concluded that the existing MRC separation and isolation criteria require improvement. The Browns Ferry fire has shown a number of areas in which improvement is needed
I!I

II \IL1CILN

nII

\ /

II •

\ ~ ~II ,"

\ \ ,IIII

ru 3400 F

CABLE TRAY

ZONE BOUNDARY

I

FIGURE 2 REGION OF INFLUENCE OF FIRE IN CABLE TRAY

43
44 m

These include the assumptions underlying isolation criteria, the ways in which the requirements

are stated, inclusion of conduit, and the role of fire barriers and fire retardant coatings.

The fact that operating plants and those under construction are in many respects similar in

design to Browns Ferry, indicate that a reevaluation is needed. Either of two possible basic

approaches appears to have the potential for providing the necessary improvement. One would be

to use a suitable region of influence and the other would be to locate the redundant safety

equipment in separate fire zones. A third possibility--the bunkered system--is also perhaps

worth exploring.

In developing improved isolation and separation criteria, NRC and associated organizations

should bear in mind the role of isolation in defense-in-depth, and the impossibility of achieving

complete isolation. Emphasis should be on the establishment of goals and criteria, plus methods

of implementation known to be acceptable. The Review Group views the methods discussed below

as acceptable alternative candidates for implementation. Other acceptable methods will prob

ably be devised.

Practical limitations will narrow the choice of acceptable isolation methods for existing r

plants, whereas for future plants, new and different design approaches are likely to be more

cost-effective in achieving the desired degree of isolation.

For each plant, a suitable combination of electrical isolation, physical distance, barriers,

resistance to combustion, and sprinkler systems should be applied to maintain adequately effective independence of redundant safety equipment in spite of postulated fires. The Review

Group notes that physical separation and physical barriers also offer a measure of protection

against common mode failures from adverse conditions other than fires.

Region of Influence Approach

This approach is to revise the minimum cable separation distance criteria to take into account

a suitable specified "region of influence." To establish this reference region, the validity,

conservatism, and applicability of the TVA "zone of influence" should be investigated. A

suitable region of influence should be developed and used to evaluate physical separation and

isolation. Where safety-related cables of one division are found to fall within the region of

influence of another safety division or where more than one safety division falls within the

region of influence of non-safety cable, consideration should be given to cable relocation,

installation of fire barriers, or other measures such as provision of fixed automatic directional

sprinkler systems. Fire retardant coatings for the cables could also be considered. Where

barriers are used they should be shown to provide the necessary insulating qualities. The

Browns Ferry fire indicates, and discussions with fire experts reaffirm (19), that uninsulated

thin metal such as conduits or sheet metal tray covers are of questionable value as fire barriers.

Fire Zone Approach

The second approach would be to abandon the concepts of "non-hazardous areas" and minimum

separation distances. Regulatory Guide 1.75 states, "In general, locating redundant circuits

and equipment in separate safety class structures affords a greater degree of assurance that a

single event will not affect redundant systems. This method of separation should be used

whenever practical and where it does not conflict with other safety objectives." A fire in one

division would not affect the redundant division because of the safety class walls and floors

separating the divisions. These barriers could also be capable of withstanding fires, explosions,

missiles, steam and water jets, and pipe whip. Such a concept could provide protection against

other events in addition to fires.

The International Guidelines for the Fire Protection of Nuclear Power Plants (13) recommends

subdivision of nuclear generating stations into fire zones to prevent the spread of fire. The

identification of fire zones, with the requirementthat--equipment, including cables, of no more

than one safety division be located in any fire zone, would provide an orderly and effective

means of providing physical separation. The International Guidelines recommend that an inventory

of combustible material be made for each fire zone and that the appropriate fire resistance

rating be designed into the walls, floors, doors, and penetration seals to prevent the spread

of fire from one fire zone to another.
45

There are advantages and disadvantages to the fire zone concept. A disadvantage is that it is

probably impractical to implement it to any great extent in operating plants or those under

construction. For nearly completed designs, even though constructibn has not begun, the cost

of implementing the fire zone concept (see Appendix D) would probably outweigh the advantages.

To be most effective, provision of independent fire zones would have to be a design objective

from the start of the design effort.

Another disadvantage is that independence of fire zones cannot be implemented completely.[

Because the redundant systems are provided for the safety of a single reactor, the concept is

more difficult to implement close to the reactor. This is probably not a serious disadvantage

because most safety related cabling is located outside the containment where fire zones can be

implemented. Inside the containment other techniques such as physical separation, barriers and

minimizing combustible materials can be used.

An advantage of the fire zone concept is that it is not necessary to place reliance on "nonf ire hazard areas" and the administrative procedures needed to maintain them. Another advantage of fire zones is that sprinklers can be used without fear of the water disabling redundant

safety equipment. The reluctance to use water to put out a fire involving electrical equipment7

has been a recurring theme of the Browns Ferry fire investigation. In present designs the

decision of whether to use water and when water must be used is often left to the operator who

may have to make the decision under conditions involving considerable stress. The fire zone

design approach would make the decision easier by eliminating the consideration of water induced

failure of redundant safety equipment. It also simplifies the design of automatic systems

using water.

The fire zone concept has the additional advantage that it can strengthen all three levels of

the defense-in-depth. It strengthens fire prevention by providing an orderly way to control

and minimize combustible materials in important areas of the plant. It strengthens fire

fighting in that it limits the spread of fire and permits water to be used without the concernF

of disabling redundant safety equipment. It minimizes the effects of a fire by limiting it to

a single safety division.

Implicit in the concept of locating redundant circuits in separate fire zones is a requirement

for separate cable spreading rooms for redundant divisions. Although it has not been the

practice in the nuclear industry to provide separate cable spreading rooms, the Review Group

believes that providing separate cable spreading rooms can be a practical approach in future

plants. The increased cost could be kept relatively small if the concept were adopted at the

initiation of the design. The fact that at least one U.S. architect-engineering group has a

design including separate cable spreading rooms that is incorporated into a nuclear power plant

presently under construction (44) is one indication of the practicality of this approach.

Reference (45) also describes a design incorporating separate cable spreading rooms, one above

the control room and one below the control room.

The NELPIA report (65) recommiended that each unit have a separate cable spreading room. This

recoimmendation has the merit that it would tend to avoid a multi-unit outage as the result of a

single fire. Most of the advantages would, therefore, be in areas of power cost and reliability.

It is however, noted that trouble in one or more additional units as a consequence of trouble

in one unit could be of safety concern. Where possible, safety problems and hazards, and

safety-related incidents like fires, should be confined to a single unit. The Review Group

does not believe that the increment in safety is large enough to make separate cable spreading

rooms a mandatory requirement, even for future plants. For existing plants, changeover to

separate cable spreading rooms is impractical and unnecessary, in view of other alternatives.

Bunkered System Approach

A different approach has been suggested that involves the addition of a system for shutdown

cooling totally separate from other systems. The system would have the following characteristics: (1) isolation from all other systems in the plant; (2) fully protected against fire,

flooding, missiles, high energy line breaks, etc., in other parts of the plant; (3) selfsufficient in that it would contain dedicated power and water sources, heat sink, and fluid and

electrical systems; (4) relatively low capacity capable of supplying shutdown cooling with

normal (or tech spec maximum) primary system leakage. Because of the high degree of isolation

and protection envisioned for such a system, it has been referred to as a "bunkered" system.

An advantage of such a system is that it would be a small system with a limited number of

components and limited exposure to damage and therefore could be relatively easily isolated and

protected. There may be another advantage in application to some existing designs. If as the

result of evaluating an existing design, the required changes such as cable tray relocation or

installation of barriers between existing cables are found to be expensive or require extensive

down time, installation of such a separate new isolated system may have merit. A major dis-
46

advantage is that the concept is not fully developed, and therefore may involve unforeseen

problems. There may also be unforeseen advantages of such a system. Because of this, the

Review Group has no specific recommendations regarding the relative merit of such a system, and

suggests that a modest engineering evaluation of the concept might be useful.

Control Room Considerations

Improved isolation and separation requirements would probably place additional requirements on

the design of the control room. Because redundant safety equipment is controlled from the

control room, it is a natural confluence of redundant circuits. Generally, the indicators and

controls for the redundant safety divisions are mounted in separate panels. To implement the

f ire zone concept, the panels of each safety division would have to qualify as a fire zone, as

would the general control room operating area. Because of the relatively small amount of

combustible material in the panels and the control room, qualification as separate fire zones

would not be expected to result in a significant increase in cost. An additional cost could

also result from extra cooling equipment for panels in the control room to allow them to be

thermally isolated from the control room.

There is one area where redundant circuits are presently permitted to be located in the same

panel. Where there is an advantage for ease of operation, manual control switches may now be

mounted on the same control board provided certain separation requirements within the panel are

met. Such redundant manual control switches should be separated by suitable fire barriers.

Where location in separate panels has the potential for inducing operating problems, other fire

barriers should be provided.

4.4 Instrumentation Required for Operator Action

This section discusses the instrumentation that provides information needed by the operator in

performing manual safety functions and in monitoring the operation of safety equipment. The

instrumentation discussed in this section provides a direct readout, such as analog and digital

indicators, or a graphical record, such as analog charts and printouts.

To the best of the Group's knowledge, the instrumentation that gave erroneous indications,

erratic indications or otherwise failed did not result in any incorrect operator actions at

Browns Ferry. The effect of the instrumentation failures was that (1) the operators had to use

indirect and inferred methods to obtain needed information and (2) desired confirmatory

information was missing. There are a number of examples where indirect or inferred methods

were used to obtain needed information. In order to confirm that the control rods remainedr

inserted after the rod position indicators became inoperative, it was necessary for the operator to place the rod mode switch in the "Refueling" position and observe that the permissive

light for rod withdrawal came on. Another example is that it was necessary to take grab samples

and perform a laboratory analysis to measure radiation releases because portions of the on-line

radiation monitoring system were inoperative.

The loss of all neutron monitoring for a period of time is an example of desirable confirmatory

information not being available. In this case, neutron monitoring had been available at the

time of the scram to confirm the expected decrease in reactor power. Process instrumentation

measuring primary system and containment conditions was available from which the inference

could be made that the core power was approximately at decay heat level, as expected. However,

the spurious indication of high dry well temperature led to some concern during the fire but

later evidence showed temperatures to have been acceptably low.

Existing safety criteria, standards and guides deal primarily with the instrumentation used as

a part of automatically actuated safety systems. The NRC staff, however, has applied the

relevant portions of the criteria developed for automatic safety systems to instrumentation

used by the operator after an incident or accident to perform manual safety functions.

Historically, in standards, criteria, and safety evaluations, electrical and instrumentation

systems and equipment have been divided into two classifications: safety grade and non-safety

grade. Equipment and systems required to be safety grade are required to meet a number of

stringent standards. There are criteria for determining which equipment and systems must be

safety grade and which may be non-safety grade. A great deal of latitude is left to the

industry in the design, manufacture and installation of non-safety grade systems and equipment.

The regulatory philosophy has been to classify as safety grade only those systems and equipment

essential to safety. The expectation has been that by minimizing the amount of safety grade

equipment much more attention could be focused on high quality design, manufacture, installation

and maintenance of the equipment that is truly important to safety.
47 m

The approach to mechanical equipment has been somewhat different. A number of safety classifications are defined. Each safety classification has its own set of requirements and standards.

The difference in approach between mechanical equipment and electrical and instrumentation

equipment has been discussed at length in industry standards groups and within the NRC staff.

The IEEE Nuclear Power Engineering Committee appointed a subcommittee to consider definitions

and requirements for other safety categories for instrumentation. Unfortunately, progress has

been slow.

The Review Group urges the NRC staff and industry standards groups to accelerate their efforts

to develop standards and requirements for instrumentation required for operator information and

action. An additional category should be considered to cover this instrumentation; the concept of defining a minimum of systems and equipment as safety equipment should not be abandoned.

i7

qtw
48 1

5.0 TVA ACTIONS AFFECTING THE INCIDENT

In this chapter, the Review Group considers how the licensee's actions before, during and after

the fire affected the result, and what lessons can be learned from these actions. Confronted by

unexpected and (at the time) inexplicable plant situations and forced to work in dense smoke,

the TVA operating staff is believed by the Review Group to have behaved in exemplary fashion.

As has been noted many times and places, the reactors were shut down and cooled down without

damage from the fire, nobody was seriously injured, and the public health and safety were not

jeopardized in any way.

The TVA organization for design, construction, operation, and QA is discussed in Section 5.1.

Section 5.2 considers how QA lapses contributed to the fire and its consequences. Actions of

the operating staff are the subject of Section 5.3.

5.1 TVA Organization

5.1.1 General

The Tennessee Valley Authority, a corporate agency of the Fed Government, has fifteen offices

and divisions of which one has overall responsibility and operates the plant, one designed and

constructed the plant and two provide support services to the plant (47). The overall responsibility for the TVA power program, including the operation of Browns Ferry and other power

plants, is assigned to the Office of Power. However, the plant security and radiological hygiene

support services are provided through the Division of Reservoir Properties and the Division of

Environmental Planning, respectively. The design and construction of major TVA projects,

including Browns Ferry, is the respnsiblity of the Office of Engineering Design and Construction.

The primary responsibility and authority for reactor operation and safety is vested in the Plant

Superintendent and the plant operating staff. The Plant Superintendent assures that construction

has been satisfactorily completed and that plant systems and components meet the established

acceptance criteria before operation. He also verifies that modifications or revisions are

correctly made and do not degrade plant performance or design objectives. He certifies and

implements operating procedures, work instructions, and checklists. He is also responsible for

the adequacy and completeness of the operating and maintenance logs and the training and qualification of plant personnel. The Plant Superintendent reports to the Chief of the Nuclear

Generator Branch in the Division of Power Production.

The Office of Engineering Design and Construction performs the design and construction functions

that an outside architect-engineering firm usually does for most electric utility companies.

5.1.2 Quality Assurance Organization and QA Program

In addition to the responsibilities described in the preceding section, the various TVA organizational units have the responsibility to assure that Browns Ferry is designed, constructed,

operated and maintained to adequate standards of quality. The NRC requires applicants to

establish at the earliest practicable time, consistent with the schedule for accomplishing the

activities, a quality assurance (QA) program which complies with the requirements of Appendix B

to 10 CFR Part 50. (For a discussion of NRC activities and procedures in this area, see Section

6.2.4.)

5.1.2.1 Design and Construction

The quality assurance functions for the design and construction of the Browns Ferry plant are

performed by three organizational elements. The Manager of the Office of Engineering Design and

Construction has the overall responsibility for quality assurance during design and construction.

Reporting directly to him is a QA Manager and QA staff, which is responsible for the development,

coordination, implementation, monitoring, and maintenance of the QA program, and for auditing

all QA programs for design and construction. Quality assurance in design is executed by the QA

staff reporting to the Director of Engineering Design. This staff also audits suppliers and the

Design branches and projects.
QA in construction is executed by the Director ofConstruction. The Construction Engineer for

each project, who reports to the Project Manager, is assigned primary responsibility for quality

assurance of his project. He is assisted by the Quality Control Committee which consists of the

construction engineer, unit supervisors, and other project supervisors.

The quality assurance program for the operation, maintenance and modification of nuclear power

plants is supervised by the QA Manager and QA staff within the Office of Power. A QA coordinator resident at each nuclear plant site reports to the Office of Power QA Manager, independent 1

of plant management.

The Plant Superintendent has the line responsibility for QA at an operating plant, subject to

audit through the QA coordinator. He executes this responsibility through the plant QA staff,

and is advised by the Plant Operating Review Committee.

The regulations pertaining to quality assurance (10 CFR Part 50, Appendix B) were made effective

in July 1970, long after the construction of Browns Ferry had begun. TVA then developed a QA

program which was intended to meet these regulations. That QA program was in effect during the

major portion of construction and included a QA program to be followed during operation.r

The description of the Browns Ferry QA program for operations is on pages 24-30 of Appendix D,

FSAR. It was judged to be acceptable then; it would not be acceptable by today's standards.

In August 1974, TVA agreed (3) to implement an improved plan, recently developed for another TVA

facility, at Browns Ferry at least 90 days before fuel loading of Unit 3. More recently,

implementation was promised (4) in conjunction with the Restoration Plan, which includes its own

extensive QA program stated by the licensee to conform to current requirements.

5.2 Lapses in Quality Assurance at Browns Ferry

Investigation of the Browns Ferry fire has revealed lapses in QA in design, construction, and

operation. Listed below are some of the items which should have been prevented, or revealed and

rectified, by an effective QA program:

1. The design of the fire seals was inadequate, because it was based on inadequate testing.

2. The design for the indicating lamp circuits did not provide adequate isolation.

3. The construction of some of the fire seals was not completed in accordance with the design.

4. Some openings between the control room and the cable spreading room were not sealed at all. LI 

5. The testing and resealing operation (with the candle and the flexible foam) was not recognized to be hazardous and performed with proper precautionary measures.

6. The occurrence of several small fires did rnot elicit improved precautions.

7. Operation of the CO system in the cable spreading room was known to be impaired without

adequate compensatigg precautions being taken.

Quality Assurance programs, provided to catch and rectify imperfections, are inevitably themselves

imperfect. There were many errors that the QA programs that did not catch and rectify. In a

review like this one, no mention is made of all the things that were designed, constructed, or

operated correctly, or whose errors were caught and rectified by the QA programs being assessed.

Lacking this information, it has not been possible to be quantitative about the errors or how

good the Browns Ferry QA program was. Similarly, it is niot possible to say quantitatively how

good the QA program ought to have been. It is also worth noting that the NRC (and predecessor

AEC) licensing and inspection program was not effective in catching and rectifying these errors,

either. This is discussed further in Section 6.3. The Review Group nonetheless believes that

the causes, course, and consequences of the fire are evidence of substantial inadequacies in the

Browns Ferry QA program before the fire.

Reference (49) states that a revised QA program will be used by TVA for the restoration program.

The Review Group has not evaluated the acceptability of the revised QA program, but recommends

that it be reevaluated by TVA and NRC in the light of the experience of the Browns Ferry fire.

It would be well for TVA and NRC to examine the QA lapses revealed by the fire-'and consider

whether the revised program is likely to have led to catching and fixing of these errors.
I 50

The Review Group believes strongly in the necessity for an effective QA program at each plant. The QA program should be a complete system and a management tool. There tends to be excessive

emphasis on records associated with QA programs. Such records are worth while only to the

extent that they facilitate and assure quality in the actual design of the plant, in the equipment as constructed, and in the actual operating functions.

This lesson from the Browns Ferry fire is applicable to all plants, including those operating,

under construction, and proposed. Licensees, QA programs, and NRC evaluation of these programs, 7

should be reviewed in this light. Operating QA programs in older reactors, known not to conform

to current standards, should be upgraded promptly. All licensees should review their QA programs for the kinds of lapses revealed at Browns Ferry. The NRC bulletins sent out following the

fire (18) initiated this review. The NRC inspection program should be upgraded also. (See

Section 6.3). In particular, the licensee QA programs and the NRC licensing and inspection

programs should all include explicit reference to fire prevention, fire fighting, and consequence

mitigation in their written procedures, and these procedures should be implemented with effectiveness.

5.3 Plant Operating Staff F

Some of the lessons learned from the actions of the operating staff are discussed in other parts of this review. These include fire fighting (Section 3.5), fire prevention and readiness (Section

3.5.5), reactor scram (Section 4.1.1), and operating QA (Section 5.2). The Review Group's

overall evaluation of the operating staff's response to the fire is given in the introduction to

Chapter 5.

In the following sections, the Review Group has found some other lessons from the incident and

how the plant operating staff coped with it.

The Plant Superintendent has the primary responsiblity and authority for the operation and

safety of the plant. Although staff and support services are provided by the other personnel,

the Operations Section is responsible for all plant operations including pre-operational testing, fuel loading, startup, and operational testing. It also provides the nucleus of

emergency teams such as the plant rescue and fire fighting organizations.

The minimum shift complement required by the Technical Specifications for operation of two

Browns Ferry units is a crew of ten. The crew consists of a Shift Engineer, two Assistant Shift

Engineers, two Unit Operators, four Assistant Unit Operators, and a Health Physics Technician.

The Shift Engineer and at least one Assistant Shift Engineer have Senior Reactor Operator licenses. The other Assistant Shift Engineer and the two Unit Operators have Reactor Operator

licenses. At the time of the fire the onsite operations organization exceeded these requirements

of the Technical Specifications.

The Emergency Plan provides for augmenting the shift complement as needed during an emergency. A call-in system can augment the staff with off-duty staff members, including craftsmen and

specialists as needed. Outside help, such as the Athens Fire Department, is also available.

The Review Group suggests that available personnel--specifically the Athens Fire Department--

were not used as effectively as they could have been during the Browns Ferry fire. Efficient

use of this manpower would likely have freed some operations personnel for use in restoration of

some systems, although it is recognized that plant personnel would be required to guide and

assist the outside firefighters.

5.3.1 Radiological Monitoring

5.3.1.1 Onsite

Measurements made onsite and offsite confirmed that there was no abnormal release of radioactivity above the small amount associated with normal shutdown.

During the fire, radionuclides released to the environs were below the plant technical specification limits. No radiological overexposures to plant personnel or Athens Fire Department

personnel occurred as a result of the fire. Reactor water isotopic analysis did not show any

changes that would indicate increased or excessive fuel leakages.

As a result of the fire, certain fixed radiological monitoring equipment was rendered inoperable.

Additionally, reactor building ventilation systems were inoperable from approximately 12:45 p.m.

until 4:00 p.m.; however, some flow through the vents was induced by natural draft. During the

fire and during the time that the reactor building ventilation system radiation monitors were

I
511

out of service, "grab" (quick collection) samples were taken approximately every hour and

analyzed to determine the concentrations of any radioactive material being released from the

reactor buildings. Gamma spectrum analyses of samples taken inside the plant and the reactor

building ventilation ducts indicated that the only radioactive isotope of significance was

rubidium-88, for which the makimium level measured was 35% of Ma~ximum Permissible Concentration

(MPC). This decreased to less than 5% of MPC when ventilation was restored after the fire was

extinguished.

Utilizing reactor building ventilation grab sample results, coupled with data from other operable building vent monitors and stack monitoring data, dose estimates were calculated. The

maximum dose in any one sector surrounding the plant was estimated conservatively to be 1.8

millirem at the site boundary. No abnormal contamination levels were found.

5.3.1.2 Offsite

The TVA Radiological Emergency Plan (63) states that the TVA Environs Emergency Staff shall

assist the Alabama Department of Public Health in evaluating the extent of a radiologicalr

emergency if one should occur and its effect on the population and the environment.

The TVA Environs Emergency Director is responsible for evaluating the information obtained to

determine whether a hazard exists to the public or the environment, ensuring coordination of

activities with the Alabama Department of Public Health, NRC and other appropriate agencies,

and ensuring comprehensive monitoring throughout the emergency.

The Supervisor of the Health Physics staff for TVA (who is also the Environs Emergency Director)

was notified about the plant emergency at 3:00 p.m. on the day of the fire. Environmental air

particulate samples in the environs around the plant were taken by TVA radiological assessment

personnel commencing at about 5:00 p.m. until shortly before midnight the same day. Some of

these were grab samples while others were taken from fixed sampling devices that had been in

place since March 14, 1975. Radioactivity values obtained from these samples did not differ

greatly from routine environmental sample results and approximate background levels.

Alternate, or emergency (battery) power supplies were not provided for the fixed in-plant radiological monitoring equipment whose normal power supply was rendered inoperable by the fire.

Consideration should be given to providing alternate or emergency power supplies. Alternatively,

if portable monitors are to be used, the manpower required for this function must be included in

minimum shift complements.

TVA radiological assessment personnel in the field, conducting offsite environmental surveillance,

responded well to centralized control from the TVA Environs Emergency Center. Sample collection

and evaluation appeared to be well coordinated and efficiently carried out because of this

centralized control. However, tardiness on the part of plant personnel in notifying the Environs

Emergency Director contributed to a delay in commnencing offsite radiological monitoring activities,

which had no significance because radioactivity releases were within normal limits. Apparently,

because the fire did not fall into one of the four incident classification categories (all

associated with postulated radiological releases) in the TVA and Alabama emergency plans, a

delay of over two hours in notifying the Environs Emergency Director occurred, which in turn

delayed the start of offsite radiological monitoring activities. A "standby" classification

appears to be necessary to cover those incidents (like the fire) with potential for later triggering one of the four major Incident classification categories.

Prompt radiological assessment in the surrounding environment is often important. In this case,

the importance was accentuated because one of the State of Alabama local air samplers at Decatur,

Alabama (downwind at the time) was inoperative and not available. Prompt radiological assessment

in the surrounding environment by TVA could also have been important because the Alabama Department of Public Health did not field a radiological assessment team in the inmmediate vicinity of

the plant site (see Section 7.2-1)..
a

52

6.0 ROLE OF U.S. NUCLEAR REGULATORY COMMISSION

6.1 Introduction

The Nuclear Regulatory Commission (NRC) must consider the extent to which its own policies,

procedures, criteria, contributed to the Browns Ferry incident. In this chapter, the Review

Group evaluates the actions of the NRC before, during, and after the fire and recommends some

improvements for the future.

The Review Group has consulted with cognizant NRC management during itt review, and is aware

that programs to implement recommendations contained in this report are being developed

in several areas.

6.1.1 Responsibility for Safety

The NRC is responsible for assuring the health and safety of the public and the safe operation of Browns Ferry and all other reactors. NRC provides this assurance of public safety through

the establishment of safety standards, evaluation of the safety of plants, and inspection and

enforcement programs. The licensee, TVA*, has the responsibility for the safe design, construction, and operation of its plant within the framework of the NRC regulatory program. If

the NRC were to become too closely involved in the licensee's operations, this might have an

adverse effect on the licensee's view of his safety responsibilities. In other words, it is

the licensee's responsibility to operate the reactor safely, and it is NRC's responsibility

to assure that he does so.

6.2 Organization

An organization chart of the NRC is shown in Figure 3. As fas as the Browns Ferry fire is

concerned, the relevant parts of the agency are the Office of Inspection and Enforcement (IE)

and the-Office of Nuclear Reactor Regulation (NRR); the Office of Standards Development has

the lead in developing standards in all areas, including those affecting the fire.

6.2.1 IE

This organization's inspection program provides most of the onsite contact between the licensee

and the NRC. Information from inspections, routine and non-routine, announced and unannounced,

is fed back to IE and NRR in Bethesda Headquarters as well as to the licensee management. IE

is also responsible for enforcement actions and other functions not relevant to this report.

6.2.2 NRR

This organization's mission is to make licensing decisions; its output is the licenses issued,

together with their Technical Specifications and the NRC Safety Evaluation Reports (SER) that

set forth the safety assessment behind them. These licensing decisions are based on a large

body of technical information. Information regarding the design and evaluation of the particular

facility and operation under consideration is furnished by the licensee and its contractors and

suppliers in the Safety Analysis Report (SAR). This is underlain by industry and NRR knowledge and experience with other relevant applications and analyses, together with IE confirmation of

onsite information. Research information and the technology available are the fundamental basis

for all safety evaluation.

6.2.3 NRC Organization - Application to Unusual Events and Incidents

While the licensee has prime responsibility for the safety of the plant and makes the necessary

decisions during and following an incident, the NRC has an overall responsibility to assure

The fact that TVA is a U.S. Government agency in no way affects its status as an NRC licensee.

I
NUCLEAR REGULATORY COMMISSION

THECfCCCC~eeC~ae~.n.....

COMMISSIO C~~~~~~~flCO ACCCYeM Ma CC IC NUNUFN ...... qqqqq

U01KIC UN, AE ICeI4AIEP51C C e~~OAC C

U

* e p a q C CCC a eSIIm C -ls e en . -

"'N""C C INem.Ft "M ECqIFC

eeC- C - - - I C C 9C S

OFIR 1 C 7 INCC7 ~ . ~ '*****-;~;;***-*-** *CACMCCAC0 -", C FIN elc = I I CC ISA CR WDSAC INN I5 C C C

U'

C.,

a

PUN CC CCCLCA

WCC q CSA 31CCC CCCI

CIMC YLCLe

11

I elUtte CYree ECCUCIIC I IC-C-el

CC-I 1=6 CIb-

'---

IIIS ~ I=c=I lC-eCI

I=C~C

I m m l " •

I 

mm AACICC CEECCIM

C- C- 1II IF-5C CM ja

LrItmN

W,*CC CESACCUCI CCVICCCAE CM..?,.

e.Cineq CC-eq C-LCCCICAICTY SAC

C-.

C.~CC~CC II C-.- MC*e-.

INSL CC CM 0

VIUS

No" IF

tton IF

Sw C(GlxmCC CMC,,

CCMUCAILP(sME. -n.

tIlS?, Crn. CCCe. Ca--

91101,111111 F.CPA.CSECC

MCIX Cý CNeC.M. Cs,,.

Cm CClm m.YC C em- .sA. CC

FIGURE 3

p5--i F-1
54

that the licensee is fulfilling its responsibility. Both IE and NRR participate in the review

of safety-related unusual events and incidents that may occur in operating reactors.

IE personnel describe their role as making sure that all requirements are complied with. IE

responses to emergencies are governed by written procedures. During an incident, inspectors

(onsite or in the Regional Office, as appropriate) pay special attention to the licensee's need

for internal safety review and approval, as appropriate, of special operations and configurations. Additionally, the onsite inspector must make judgments based on personal observations, 17

augmented as appropriate by consultation with his supervision, regarding the acceptability of

actions taken by the licensee to assure that adequate safety is maintained.

NRR personnel view their role in an emergency as providing help to IE, and through IE to the

licensee, as needed and requested, in the form of information and evaluation of the licensee's

response to the emergency and plant safety. NRR is viewed by both NRR and IE personnel as being

responsible for resolution of safety problems on the plant involved and recognition and resolution of generic safety problems raised by the incident.

In the event of an incident, the IE inspector contacts the licensee and investigates. He assures

that the initial and continuing safety evaluation made by the licensee is complete and correct.

He may request aid from both IE and NRR management and technical support personnel at the Region

Office and NRC Headquarters. If the cause of the incident is understood and there are no significant design or operational inadequacies, IE will authorize the plant to return to or continue

operation. If there are unresolved safety questions, or if changes in the Technical Specifications or the FSAR are required, NRR evaluates the necessary changes.

As can be seen, the functions of NRR and IE during incidents follows the general division of

functions described in Sections 6.2.1 and 6.2.2.

ZE inspects, determines compliance with, and enforces regulations, license conditions, and

Technical Specifications, and reviews operating procedures and data. NRR decides on License and

Technical Specification changes that may be needed or operation outside previously reviewed or

licensed conditions.

Normally, this division of functions requires no formal direction and the actions of both groups

are coordinated through telephone conversations, meetings and memos at the various working

levels.

However, in the past, some confusion has arisen and the need to formally define the IE and NRR

responsibilities for an incident was perceived. As a result, the division of responsibilities

between the two organizations and the designation of a "lead responsibility" were set forth by

the then Director of Regulation, in a memorandum which is included in Appendix B. As discussed

in Section 6.4.2, the division and delegation of responsibility in the Browns Ferry fire led to

a delay in an independent safety evaluation, by NRC. This indicates to the Review Group a need

for improved NRC procedures for the safety review of incidents.

6.2.4 NRC Organization for Quality Assurance

Since quality assurance (QA) lapses played an important role in the conditions that led to the

Browns Ferry fire, it is instructive to set forth the procedure used by NRC to evaluate licensees'

QA programs today. The NRC review of the Browns Ferry QA program predated this procedure and is

discussed in Section 6.3.2.

Appendix B to 10 CFR Part 50 contains the NRC QA criteria; it is supplemented by a number of

Regulatory Guides, ANSI Standards, and NRC Standard Review Plans.

Present-day QA review activity by NRC begins approximately one year before application is made

for a construction permit (CP). At that time, representatives of IE and NRR visit a prospective

applicant and discuss QA requirements. When the Preliminary Safety Analysis Report (PSAR) is

submitted for review for docketing, an intensive 9-day review by NRR of the QA program for

activities already under way (design and procurement, mostly) is followed immediately by an IE

inspection of the actual implementation of the program. Acceptability of the application for

docketing is not adjudged unless and until the QA program is satisfactoiry. The reason for this

early attention is the applicant's need to design and purchase long-lead items long before

actual onsite construction begins.

NRR review of the PSAR includes the QA Program described and the IE inspection record of QA

performance of the applicant and his vendors and contractors on other plants. IE again inspects

the QA procedures and implementation as applied to ongoing work before a CP is granted.
551

During construction, IE inspections include QA aspects of major activities. Chapter 17 of each

applicant's Final Safety Analysis Report (FSAR) is required to lset forth the proposed QA program

for station operation, including operation, maintenance, repair, refueling, and modification.

This proposed program is reviewed in NRR for compliance with rules and acceptability as a

framework. IE inspectors review the program details and assess its implementation, both by

auditing and spot-checking the procedures and other paperwork and by reviewing its application

to other reactors owned by the licensee at the plant being reviewed and at other plants, and to

the reactor under review during preoperational testing.

The Review Group believes that licensee QA is central to implementing licensee responsibility

for the safe operation of his reactors. The efficacy of the operating QA program in actually

achieving safety in operation depends not on the quantity of paper produced by the program but

on whether it is actually used to perform its functions.

6.2.5 Evolution of Regulatory Requirements

The preceding discussions of organization and procedure are based on practice at the time of

writing (Fall 1975). The NRC procedures described differ somewhat from those earlier applied to

Browns Ferry, but the differences are not significant to the lessons to be learned from the

incident. By contrast, differences in safety technology and acceptance criteria of the present

day from those used for review of Browns Ferry are highly significant.

In general, knowledge and understanding increase with experience. The experience obtained from

the design, construction, and operation of numerous reactors between 1966 and today has led to

the changes in criteria. This review and the changes resulting from implementation of its

recommendations will be another step in the learning process.

For each increment of new knowledge, it is necessary to decide whether it must be applied to

earlier, plants. Guidance is provided by the Commission's regulations, 10 CFR 50.109:

"(a) The Coimmission may, in accordance with the procedures specified in this chapter,

require the backfitting of a facility if it finds that such action will provide substantial, additional protection which is required for the public health and safety or

the common defense and security. As used in this section, "backfittlng" of a production or utilization facility means the addition, elimination or modification of

structures, systems or components of the facility after the construction permit has

been Issued.

"b) Nothing in this section shall be deemed to relieve a holder of a construction permit r

or a license from compliance with the rules, regulations, or orders of the Commission.

"(c) The Commission may at any time require a holder of a construction permit or a license

to submit such Information concerning the addition or proposed addition, the elimination or proposed elimination, or the modification or proposed modification of

structures, systems or components of a facility as it deems appropriate."

In the following discussions, therefore, and in its recommendations, the Review Group has been

mindful of changing criteria and has tried to explain clearly the time frame for each consideration where this is relevant.

Each of the Review Group's recommendations that is relevant to existing plants is evidently a

recommendation for backfitting. Implementing such a recommendation must be decided plant-byplant, using the criteria just cited. The actual measures taken on each plant will depend on

the plant design as it exists, and also on the nature of the improvements that are deemed to be

needed. In each case, it would be expected that there exist alternative means of achieving the

desired results. The Review Group's recommendations are not intended to specify or foreclose

any alternative, but rather to delineate the need for changes and their objectives.

6.3 NRC Action Before the Fire

The licensing history of the Browns Ferry Nuclear Station is given in Reference (48). As with

all power reactors, the Browns Ferry units underwent detailed safety assessments before the

construction permits (CP) were issued and again before the operating licenses (OL) were issued.

Units 1 and 2 received OLs on June 26, 1973, and June 28, 1974; Unit 3 is not yet licensed to

operate.
56

a

The OL review process includes detailed review of Licensee-furnished information and analysis by

the NRR staff and by the independent Advisory Committee on Reactor Safeguards. The results of

this assessment are given in the SER (48). Development of Technical Specifications and their

bases proceeds during this time. The Technical Specifications establish the limiting conditions

and parameters governing the entire operation of the plant, plus reporting requirements.

Reference (60) is a collection of NRC inspection documents that constitutes an inspection history. [

Periodic inspections covered the Browns Ferry construction, operation, and QA program. As each

unit neared completion IE inspections additional to those associated with plant design and

construction were directed to the operating QA program, audit and review of the operating procedures including emergency procedures, review of the preoperational and hot functional tests,

culminating in a finding by IE that the unit had been constructed in accordance with the FSAR,

that the operating organization and procedures were in order, and that the plant was technically

ready for operation. This finding by IE plus the favorable safety evaluation by NRR were the

basis of each OL.

Since some aspects of the facility design, the QA program, the operations by the licensee, and F

the execution of the Emergency Plan have been found wanting (see earlier chapters and the IE

Investigation Report), it is instructive to consider how this took place, and whether future

improvements in NRC activities could decrease the liability to such lapses in the future.

A discussion of NRC criteria related to fire prevention and control is given in Section 3.2. At

the time of the Browns Ferry licensing reviews, very little was available in the way of criteria

or guidance. This was mirrored by the absence of significant attention to fire prevention and

control in both licensing review and inspection programs until more recently. Thus although

some attention was paid to mitigating the consequences of fires, the NRC program in fire prevention and control was essentially zero.

More recently, too late for the Browns Ferry design, the NRC program has made some progress, and

still more improvement is planned for the future. Information regarding fire prevention and

control is now called for in SARs; Regulatory Guide 1.70, issued in September 1975, sets forth

this information requirement. Guidance for regulatory review of fire prevention and control is

now given in Standard Review Plan 9.5.1, "Fire Protection System," (April 1975) which includes

detection, extinguishing systems, assistance from offsite fire departments, structural design of

fire prevention systems, control of combustible materials, and operating considerations.

Criteria for separation of redundant electrical cables, to mitigate the effects of any fire that

might occur, are under development as discussed in Section 4.3.4. Some research programs related

to fires in electrical cables are discussed in Section 3.4. In addition to the Bulletins and

inspections (18, 23, 52) after the fire, IE has revised inspection plans to include prevention

and control in the NRC inspection program.

At the present time, therefore, NRC has programs in fire prevention and control research, standards and criteria, licensing, and inspection. The Review Group believes that these efforts

should be continued, expanded as needed and as recommended in various sections of this report,

and coordinated to form a more coherent regulation program for fire-related matters in a timely

manner.

6.3.1 Design and Operating Criteria

The facility apparently conformed to applicable criteria and guides when it was approved, yet

design deficiencies are now apparent. Some criteria and guides are now known to need improvement, and also the conformance was not complete in some cases.

The need for improvement of design and operating criteria and guides in various areas is discussed at some length in the technical parts of this report. A list of the areas is as follows:

1. Fire prevention: establishment of design basis fire; application to fire zone rating and

protection requirements (Sections 3.3.1 and 3.3.2).

2. Comprehensive standard for fire protection design criteria (Section 3.2).

3. Development of standard combustibility tests for cables, seals; acceptance criteria

(Sections 3.4, 3.4.1 and 3.4.2).

4. Development of tests for effectiveness of coating materials to decrease cable fire hazard

(Section 3.4.1).

5. Development of standard tests and acceptance criteria for fire detectors (Section 3.5.1).

I
57 a

6. Development of standards for ,fire protection and other aspects of ventilation systems

(Section 3.5.3).

7. Development of standards for conduct and evaluation of fire fighting drills (Section 3.5.5).

8. Improved criteria for physical separation of redundant cables (Section 4.3.4); region of

fire influence, fire zones.

9. Standards for intermediate quality class of instruments (between non-safety and IEEE-279)

for post-accident monitoring (Section 4.4).

6.3.2 Quality Assurance

The Browns Ferry QA program for operations is on page 24-30 of Appendix D, FSAR. It was judged

to be acceptable then; it would not be acceptable by today's standards. In one sentence, the

SER (48) finds it "meets all the requirements" of 10 CFR Part 50, Appendix B, the only guidance

then available.

As described in Section 5.1.2.1, the TVA program for QA at Browns Ferry is being upgraded. ItF

takes time to write, staff, and implement a substantially improved QA plan. But the length of

time NRC has allowed TVA for development and implementation of the upgraded program seems

excessive to the Review Group. In view of the great importance of operating QA to the maintenance of safety, the Group recommends that NRC proceed promptly with any remaining QA upgrading

needed now in operating reactors.

6.3.3 Inspection of Licensee Operations

The fire revealed operating deficiencies. Examples cited in the NRC Investigation Report (5)

include failure to coordinate adequately the fire-fighting activities, the efforts to restore

equipment operability, the activities construction and operating personnel performed during the

f ire. These deficiencies, of course, could not have been specifically evaluated by NRC in

spectors prior to the fire. Other deficiencies included inadequate communication and management

response to several previous small fires. To the extent that these deficiencies might have been

reflected in written procedures, routine operating activities, or poor operating practices, they

should have been observed and evaluated by NRC inspectors.

For many of the items cited above, there are no clear cut requirements or regulations against

which the inspector can compare the licensee' s performance. The statements that operators

should "do a good job" or that activities involving various parts of site organizations shouldbe "well coordinated" are general and provide no specific basis for inspection. Additionally,

individual items which might indicate departure from good practice or safe operation may not of

themselves be of sufficient importance to require strong remedial action. On the other hand,

inspectors can and do identify general areas of poor performance or marginally safe practices,

but without specific requirements, enforcement actions are very difficult to justify.

Reference (60), the inspection history of Browns Ferry, contains a number of examples of an NRC

inspector pointing out areas that he considered to be poor practice. Although most of the

examples of poor practice did not contribute to the Browns Ferry fire or its consequences, they

do illustrate an inspection difficulty. In many of these cases there were no applicant commitments, NRC requirements, or applicable industry standards to support the inspector's contentions. In these cases, the NRC inspector requested guidance from NRC Headquarters. The

documented response to the inspector's requests contained in Reference (60) is undoubtedly not

as specific as the inspector would have desired.

The Review Group understands that additional oral guidance was provided. In many of the areas

discussed by the inspector, and many others, enforceable, documented guidance on "good practice"

is still generally unavailable. It is stated by IE to be present practice to resolve issues

raised by inspectors and to document the resolution.

Inspectors are more effective when there are enforceable criteria and requirements against which -

to inspect. Industry standards have been developed and adopted by the NRC staff covering areas

of good practice that were not available for Browns Ferry. The Review Group recognizes, however, that inspectors will continue to have difficulties because enforceable standards of good

practice will not be available in all areas. Inspectors will continue to identify instances

they/ consider to be poor practice. Although there are procedures for these issues to be resolved

by NRC management, these procedures should be reevaluated. In the reevaluation, the NRC staff

should determine whether the procedures are effective in providing prompt incorporation of good

suggestions into the inspection and enforcement program and into the licensing review.
581

The Review Group believes the inspectors' lack of attention to fire protection reflected a

similar lack in the licensing safety evaluation. Construction permit safety evaluations now

being performed in accordance with the Standard Review Plan include much greater emphasis on

fire protection than was the case in the Browns Ferry safety evaluation. Efforts are now underway to modify the Standard Review Plan to take the Browns Ferry fire experience into account.

Present and future safety evaluations provide more specific fire protection requirements and

criteria for the inspector to inspect against. The inspection program is being expanded to

reflect the improved licensing review of fire protection.

6.4 NRC Action During and After the Fire

Much of the information on which this section is based came from personal conmmunications from

the NRC personnel involved to one or more members of the Review Group.

6.4.1 During the Fire and the First 24 Hours Afterwards

The IE Region II duty officer was notified at 4:00 p.m. by the licensee and inspectors were

dispatched to the site. They arrived late that evening. The NRC Region Office in Atlanta is

relatively close to Browns Ferry. Other offices, especially in the West, are farther from some

of the reactor sites. Therefore, even using the fastest transportation available, several hours

will, in general, be the minimum time required for inspectors to reach a site after being notified.

It would be desirable to develop alternate modes of transportation for emergency use to ensure

that undue delays are not encountered.

As far as the Review Group was able to judge, the NRC inspectors at the site and in the Region

II Office carried out their mission during and immediately following the incident in an exemplary fashion.

The group of JE and NRR management and technical personnel gathered at NRC Headquarters had a

mission principally precautionary and informational in nature. They quite properly believed

that their role was to stay knowledgeable as the incident ran its course, to consider various

alternatives available for various possible contingencies, to act as a source of information to

government people, and to be helpful to Region 11 or the licensee if needed, e.g., for technical

consultation.' Reference material was quickly assembled accessible to a Headquarters emergency

center, to be ready in the unlikely event that Headquarters action would be needed. In this

incident, since no need was indicated, the only consideration for the Review Group is the test

that was performed of the system by the event.

The Group believes that the Headquarters cadre actually assembled on March 22-23 was knowledgeable

and functioned well. It is not clear that qualified back-up personnel would have been available

in the unlikely event the emergency had been significantly prolonged. The Group suggests that

some attention be given to assuring that enough management and technical talent are available so

that unexpected prolongation of an incident will not find the Headquarters cadre too tired to

function as well as it could.

The use by NRC inspectors of commiercial public telephone commnunication from the site to Region

Headquarters was not always satisfactory in this incident; telephone lines were in short supply.

At other sites, there may not be any phone lines available to NRC inspectors during an incident

or emergency.

There is no ideal solution for the communication problem. The onsite staff is struggling with

the fire or other incident, but there are many people who need current information for readiness

and/or action. On paper, the chains for information look great. (Two such chains are (1) Plant

operators - TVA Central Emergency Control Center (which has parts in three different locations)-

press and local governments; (2) Plant operators - onsite NRC inspectors - Region Il Office -

NRC Headquarters - government officials.) The well-known game of "password" shows how poorly

information is transmitted through such chains. Section IV of the NRC Inspection Report tells

of some specific shortcomings. The Review Group was informed of one instance where two people

at Region II Headquarters were receiving contradictory information on telephones, one from the

NRC inspector at the site, the other from the TVA center.

The Review Group believes that improved communications facilities are feasible and should be

provided. The Group has been told that transportable (suitcase) two-way radios are being considered for purchase. The Group recommends that the problem deserves a deeper study and more

expertise than it is able to bring to bear on it, and that a systems study (who should communicate with whom, when and how?) is at least as important as purchase of equipment to supplement

the demonstrated problems of relying on public telephone lines.
ý 

ý59

During the incident, the safety decisions were made by the plant operating staff, as is proper.

Presumably, If the NRC onsite inspectors, Region I1 Office staff, or the Headquarters cadre had

felt the need of questioning any decision, this would have been communicated to the operating

staff with whatever force or urgency would have been appropriate. The Review Group is not aware

of any such communications during~this incident. The Group has no recommendations for any

change (except improved communitations) in this NRC approach to safety during the course of an

incident. Distance, inevitable communication and information difficulties, and the unexpected

things that occur, mandate the ad hoc, responsive, admonitory NRC stance. One does the best one

can in the circumstances; the Gi-u-Felieves that the NRC groups did very well.

6.4.2 After March 23, 1975

During the first 6 weeks of this period, IE had the lead responsibility for NRC action on Browns

Ferry. A group of NRC inspectors were detailed to the site throughout this period; during

critical times, around-the-clock inspection coverage was maintained.

The role of the onsite inspectors, as perceived by them and their management, is to stay knowledgeable about what is going on--to watch and communicate with the licensee and with Region II

Office and NRC Headquarters. The inspector should be as helpful as his judgment and his primary "

responsibility allow, without infringing the licensee's safety responsibility. The Review Group

understands that a certain amount of admonishment of licensee staff by the inspector is par for

the course. The inspectors also feel a responsibility to have an informed opinion about the

safety of the plant and to communicate this view to their management.

After the Browns Ferry fire, an important and time-consuming Job for the inspectors was to

conduct the NRC investigation, which was started immediately. The Investigation Report includes

the reports of 171 interviews with participants in the incident. Another job was keeping Headquarters informed regarding-the still-changing status of the plant, and relaying information

about the incident (as it was uncovered and pieced together) to the concerned and curious.

It is the Review Group's impression that the onsite inspectors were very concerned with plant

safety, and took pains to stay informed. As temporary repairs were made and safety readiness

was improved, the inspectors expressed increasing concern that procedures should be implemented

for developing, reviewing, approving, and documenting any changes. Concern was also expressed

regarding the potential for unreviewed "improvements" to decrease the overall safety of the

facility. The inspection team at the site included technical specialists (operators, electrical, instrumentation) as needed.

However,-an IE management individual has stated that the inspection function needs the added

technical evaluation capability of NRR as part of the NRC effort in an emergency and its after- r

math. For this reason, even during the first few hectic days, the inspectors at the site con- L

sulted with NRR staff regarding plant safety and the acceptability of some proposed changes. In

this view, IE does not have the ability to do a complete technical review of plant safety. The

continuous informal consultation between IE and NRR staffs is needed so the inspection and the

licensing staffs can each perform its function. (See Section.6.2.3).

Beginning with the NRC inspectors at the site on the evening of March 22, the NRC evaluation of

the safety of Browns Ferry changed with time in accordance with the needs for safety assessment

and decisions. The onsite inspectors and the cadres at both the Region Office and the NRC

Headquarters followed closely the safety problems of the fire and its early aftermath. NRC

Headquarters personnel visited the site for firsthand briefing on March 24. Other visits followed

for investigation and safety review.

The evaluation and monitoring of both the safety of the plant and the response of the licensee

continued with IE taking the lead responsibility.

NRR staff members consulted viewed their role as helping IE, who "had the lead responsibility."

In the view of most everyone the Review Group talked with, NRR was indeed helpful to IE during

this period, but was most careful not to "take the lead." Although IE was generally aware of

the safety of the plant, neither IE nor NRR conducted anything like a complete technical review

of the safety of Browns Ferry during this interval.

On April 15, TVA requested changes in plant technical specifications stated to be necessary

because of the fire. Minor changes were proposed to the Limiting Conditions for Operation and

an associated section of the Surveillance Requirements, and were generally intended to describe

more properly the actual plant status and capabilities. Normally, request for changes in

Technical Specifications would be reviewed by NRR and accepted, rejected or modified. However,

in this case, NRR took no immediate action.
I

60

The prevailing view in NRR appeared to be that none should be taken until IE transferred the

"lead responsibility" or identified the portions of the problem to be handled by NRR in accordance with the previously discussed memo concerning lead responsibility. (See Section 6.2.3).

Although NRR took no action relative to the immediate status of the plant, on April 17, the

Acting Director of NRR sent a letter to TVA, setting forth information requirements and conditions that would have to be fulfilled before TVA would be permitted to begin the various steps

of reconstructing the plant. These information requirements included TVA design information and

safety analysis for the proposed changes involved in each step. The amendments to the license

and the technical specifications, their TVA safety analyses (3), and their NRR safety evaluations

(9), are the results so far of this effort.

A decision to turn over lead responsibility was made and finally accomplished on May 5, 1975.

Just prior to and in anticipation of the turnover, NRR personnel went to the plant with the

purpose of reviewing the safety of the plant in detail. As a result, numerous changes were made

to the Technical Specifications just after the turnover of lead responsibility. These changes

were not trivial. They included the following: F

1. Testing of Unit 3 equipment was stopped until the evaluation of the effect of such testing

on Units I and 2 could be made.

2. Certain changes needed to improve plant safety were required to be implemented promptly.

3. Routine maintenance proposed by TVA for core cooling equipment to take advantage of the

forced outage was not allowed.

4. Requirements for monitoring instrumentation and periodic surveillance were revised to be

consistent with the plant configuration.

5. Requirements for availability of safety equipment and energy sources were revised consistent

with safety needs of the shut down reactors and with the plant configuration.

6. The required shift operating complement was increased to account for the many remote manual

safety operations made necessary by the fire damage.

These revised technical specifications deemed by NRR to be needed would have been just as valid

before the "transfer of lead responsibility" as after. Although some of the information which

formed the basis for the Technical Specification changes was developed over a period of time

after the fire, most was certainly available well before the changes were made. Thus, the

Review Group believes that there was an unnecessary delay during the six weeks of March 22 -

May 5 before the detailed safety review of the post-fire configuration and the concomitant

specification changes were accomplished.

After NRR accepted "lead responsibility," the NRR licensing and inspection functions and interrfaces caused no unusual problems. The Review Group has not evaluated the TVA proposals and NRR

evaluations that constitute part of the still incomplete licensing process for restoration of

Browns Ferry. Neither has it probed any further into the concomitant inspection program.

It is evident to the Review Group that the division of responsibility between NRR and IE did not

function adequately during the period just after the Browns Ferry fire. Whether the failure

occurred because of or in spite of the management directive regarding lead responsibility is

unclear. In any case, someone should have seen to it that a complete evaluation of the safety

of the plant was performed no matter who may have been designated as having "lead responsibility."

The Review Group recommends that the procedure followed by NRR and IE in evaluating the safety

of the Browns Ferry plant from March 22 to May 5 be revised so as to ensure more timely, comprehensive and detailed safety evaluation of a plant in difficulties. The concept of "lead

responsibility" should be clarified, to delineate how the ongoing licensing, inspection and

reporting responsibilities are to be coordinated and where the decision making lies. Consideration should be given to designating a named individual to be in charge of an incident review.

For the Browns Ferry incident, there was an IE Chief Investigator, an NRR Project Manager, an -

NRR Task Force Leader, and an NRR Task Force Coordinator--plus a Review Group Chairman.

I
61

7.0 RESPONSE OF OTHER GOVERNMENT AGENCIES

7.1 SummaryU

The TVA Radiation Emergency Plan was implemented at 3:20 p.m., March 22, 1975, to the extent

that TVA notified designated State agencies, which in turn notified local government personnel

and principal support agenices. Several individuals could not be contacted, particularly at

the local level, and the States' attempt to notify these local officials was stopped in less

than one hour after it commenced.

No action was required of any one except for initiation of environmental air sampling around

the site by the State of Alabama Environmental Health Laboratory. TVA radiological assessment

personnel conducted radiological monitoring in the immnediate vicinity of the plant environs.r

The State of Alabama conducted air sampling by devices located several miles from the plant site. No radiation emergency existed.

7.2 State Governments

7.2.1 Alabama

According to the Alabama Radiation Emergency Plan (64), the State Health Department will determine the classification of an incident in one of four categories, all based upon varying degrees

of radiological release from the facility. The Alabama Department of Public Health, located in

Montgomery, has the responsibility to maintain liaison with the Browns Ferry operators and to

keep the State of Alabama Civil Defense Department informed of planning and emergency conditions.

The Health Department is responsible for all radiological and health aspects pertaining to an

incident. The Civil Defense Department coordinates all activities of other supporting State

and County agencies involving actual operations (evacuation, etc.).

On March 22, 1975 at 3:20 p.m. (over 2 hours after the start of the fire), the Director of

Radiological Health for the State of Alabama Department of Public Health (DRH) was notified by

the TVA Environs Emergency Director located at Mussel Shoals, Alabama that the Brown's Ferry

nuclear plant had a fire in the cable spreading room and that both operating reactor units had

scrammed. An attempt was made to notify the State Health Offices at 3:40 p.m. without success.

At 3:45 p.m. the Alabama DRHl notified the Alabama Civil Defense Department and subsequent toF

that the "Tni-County" Health Officer, of the fire and also that there had been no release of

radioactive materials. The tni-counties consist of Limestone, Lawrence and Morgan Counties.

The State Civil Defense Department was advised that radiation levels were not above permissible

levels but that the Civil Defense Department emergency plan notification procedures should be

carried out. The "-duty" representative attempted to contact the State Civil Defense Director

or his assistant and the three local government (county) Civil Defense representatives and

sheriffs. He was only partially successful and the "duty" representative discontinued all

notification attempts after less than one hour from having been notified. Alabama and the

involved local governments should reassess and strengthen notification methods and procedures

between State and local government agencies who may be called upon to respond to an emergency.

Periodic contact with exchanges of information Was maintained between the Alabama DRN and the

TVA Director of the Central Emergency Control Center (CECC) during and subsequent to the fire.

Sometime between 4:45 and 9:45 p.m., the Governor of Alabama was notified by the State Health

officer. The Governor's main concerns were: (1) whether or not additional State resources

were needed, especially the National Guard; (2) availability of adequate electrical power in

northern Alabama; and (3) whether or not sabotage was involved. The Governor was informed that

no additional resources were required; electrical power was adequate, and that the cause of the

fire had not been determined as of that time.

The Alabama Highway Patrol was not officially notified by the Department of Public Health or by

TVA. A representative of the Highway Patrol did become aware of the fire via local police

radio and offered his assistance to security guards at the site but no action wa-s requested.
62a

Since there was no release of radioactivity. and the incident was not of a type clearly classified in the TVA and State emergency plans, standby action was not required of many of the offsite support agencies. The Alabama DRH did perceive that the core cooling system was degraded and that it must be watched, the ability to monitor plant leakage was questionable, and that confirma- tion was needed that the main steam isolation valves had indeed been closed.

A "standby" classification appears to be desirable to cover incidents like the fire that have a potential for triggering one of the radiological accident classification categories in the

emergency plans. This "standby" classification would require that the licensee notify the principal State or local agency of the plant status, and would recommend that the pertinent offslte agencies who would be required to respond to a particular emergency be contacted, appraised of the situation, and directed to assume an alert condition until further notice. They would remain in this condition until either the plant was verified to be in a quiescent condition or one of the radiological accident classification categories was realized, requiring further action by offsite emergency response personnel.

Response on the part of the State Department of Public Health (specifically the DRH) appears to have been basically in accordance with the provisions of the State Radiation Emergency Plan.F

However, environmental air surveillance around the plant site by the State did not commence until sometime shortly before 5:45 p.m. when the Alabama Health Laboratory Director reported that environmental air sampling was being conducted at the Athens Water Treatment Plant, the

Athens Sewage Treatment Plant in Hillsboro, and in Rogersville, Alabama. These locations are several miles from the plant site. An air sampler owned by the State had become inoperative and was removed for repair from the Decatur, Alabama air sampling station, which was In the downwind sector from the plant. No replacement sampler was immediately available but at about 9:00 p.m. on the day of the fire, air sampling was instituted at this station using an air

sampler from another State agency (Air Pollution Control Commission). On March 24th, the State collected water samples and milk samples from areas surrounding the site. Thermoluminescent dosimeters located at fixed monitoring stations around the plant site were collected and analyzed.

7.2.2 Tennessee

The Tennessee Department of Public Health (Assistant Director of Radiological Health - ADRH)

was notified of the Browns Ferry fire at 8:15 p.m., March 22 from the CECC. He was told by the CECC representative that a fire in the cable tray room had "wiped-out Units 1 & 2."1 The CECC representative also advised the Tennessee ADRH that the first and second alternates for core

cooling were "gone" and the third alternate was considered. The Tennessee ADRH was also told that one alternate for the core cooling system left was to pump river water through the reactors

and circulate it to and from some ditches for cooling. He was also told that smoke was everywhere.

The Tennessee DRH notified the Tennessee Civil Defense Department concerning existence of the

fire. The Tennessee ADRH contacted the Alabama DRHt at 8:35 p.m. and exchanged information concerning the fire.

Tennessee Department of Public Health officials were unduly alarmed by the unfortunate language used by a CECC representative to describe the incident. CECC spokesmen need to use more careful phraseology in communicating the facts surrounding any incident without inciting undue

alarm or apprehension on the part of offsite agencies.

Neither the NRC or any other Federal agency has any legal authority to require that State and

local governments develop or improve Radiological Emergency Response Plans in support of fixed

nuclear facilities. NRC regulations require that the nuclear facility licensee prepare an

emergency plan and that an emergency preparedness interface be developed among the nuclear

facility and of State and local officials and agencies.

However, the regulations stop short of requiring plans of the States and local governments

themselves. The approach of NRC and other Federal agencies toward solving this problem has

been to provide training, publish emergency planning guidance and persuade the States and local

governments to accept and follow the emergency planning guidance.

A Federal interagency group with responsibilities for nuclear incident emergency planning

conducts training programs for State and local government personnel.

The NRC, which has lead agency responsibility for helping States develop radiological emergency

response plans, can neither require States to prepare adequate plans nor provide monetary

incentives to States; instead the NRC must use persuasion to get voluntary cooperation. Since
63B

intensifying its efforts in this area in mid-1974, the NRC has made progress in developing

revised guidelines for radiological emergency planning, developing training programs, and in

evaluating State plans. However, it is not yet clear whether the NRC approach of working with

States on a voluntary basis will result in improved radiological emergency plans for protecting the public health and safety. . ý .

The Review Group is concerned about this problem, but does not have the knowledge or resources

to pursue it. Lapses in notification and response were revealed by the Browns Ferry fire, butU

no response was really needed in most cases. The Group can only recommend continued efforts to

overcome the organizational, financial, and Constitutional problems involved.

7.3 Local Governments

7.3.1 Limestone County, Alabama

The Limestone County Civil Defense Coordinator on the day of the fire could not be located by

the Alabama Civil Defense duty officer. He received information concerning the fire nearly 2

days later. He also indicated that his copy of the Alabama Radiation Emergency Plan was notF

up-to-date and he had not received any information concerning the plan in several years.

The Limestone County Sheriff was not officially notified of the fire except that he did receive

some information after the fire was extinguished. The State of Alabama Civil Defense Department

did attempt to notify him at 4:08 p.m. on the day of the fire but no answer was received. The

Sheriff did not have a copy of the Alabama Radiation Emergency Plan and had received very

little information concerning his emergency responsibilities in the past two years.

7.3.2 Lawrence County, Alabama

The Lawrence County Civil Defense Coordinator was officially notified by the Alabama CD at 4:10

p.m. Pertinent information concerning the fire was forwarded to the coordinator, but no

specific action was requested of the Coordinator. An attempt to notify the Lawrence County

Sheriff by Alabama Civil Defense Department was made at 4:08 p.m. but no answer was received.

The Sheriff was not reached and no further attempts to contact him were made.

7.3.3 Morgan County, Alabama

The Morgan County Civil Defense Coordinator was officially notified by the Alabama Civil Defense

aJepartmekt at 4:05 p.m. However, the Coordinator was already at the Browns Ferry plant site

when he received official notification because he had learned of the fire approximately 30r

minutes after it had started from a local police radio system. No action was taken by the

Coordinator to contact the Alabama Civil Defense Department nor was any action apparently

requested of him.

The Morgan County Sheriff was officially notified by the Alabama Civil Defense Department at

4:05 p.m. No specific action was requested of the Sheriff except that he not inform the public

in order to avoid alarming the population. The Sheriff was newly elected (January 20th, 1975)

and had not been briefed on the Alabama Radiation Emergency Plan, nor did he have a copy of it.

He recommended that the principal support agencies in Morgan County should meet with the State

of Alabama Department of Public Health and define the emergency responsibilities and update the

plan.

7.3.4 Athens Fire Department

The Athens Fire Department was contacted by TVA at 1:09 p.m. The Fire Department arrived at

the site at 1:30 p.m., were issued film badges and dosimeters and were ready to assist by 1:45

p.m. The Athens Fire Chief examined the fire area and about 2:00 p.m. he recommended the use

of water to fight the fire. The Fire Department crew remained at the plant and was helpful to

the operating staff. In particular, Athens Fire Department equipment was used to recharge air

breathing apparatus.

The fire was extinguished at about 7:45 p.m. The Athens Fire Department departed the plant at

9:50 P.M.

7.3.5 Tni-County Health Department

The Tri-County Health Officer was notified by the Alabama DRH at 3:55 p.m. DRH informed the

officer of the status of the reactor and of his opinion of the situation. No action was taken

by or required of the Tni-County Health Department.
64

7.3.6 Drills and Exercise

With respect to drills and exercises, NRC regulations merely levy upon the licensee the

requirement for providing an opportunity for participation in the drills by "other persons

whose assistance may be needed in the event of an emergency."

NRC's Regional IE Offices require that an emergency preparedness exercise, requiring implementation of the licensees' emergency plan, be conducted by the licensee prior to obtaining an

operating license. As a part of this exercise, the Interface indicating the capability for

emergency response support on the part of the States and local governments is checked by IE

inspectors. However, the IE inspectors do not inspect State and local government emergency

response capabilities since they have no legal authority to do so. NRC regulations (10 CFR

Part 50, Appendix E) merely require that a supportive interface between the utility and the

State and local governments exists.

Although drills have been conducted involving TVA Browns Ferry personnel and the State over the

past several years, the drills apparently did not involve extensive local government participation, if any. This can be gleaned from remarks made by two separate county officials that they

had not received any information concerning the Alabama Radiation Emergency Plan in several

years. The local governments' capability to respond appears to be extremely weak and is in

need of Improvement.

The Review Group recommends that drills and exercises to test the emergency Interface between

TVA, the State of Alabama and its local governments should be instituted on a regular basis, at

least annually. Where needed, other licensees should also institute adequate regular exercises

to promote maintenance of emergency response capability by local governments. The Review Group

has not studied the question whether drills involving the general public should be instituted

and has no recommendation on this subject.

7.4 Federal Agencies

7.4.1 Energy Research and Development Administration (ERDA)

ERDA has prime responsibility for Implementing its Radiological Assistance Plan and the Federal

Interagency Radiological Assistance Plan. These plans provide for radiological assistance responses to incidents occurring In Federal agency or contractor operations, NRC licensed

operations, operations of State and local government agencies, and in the activities of private

users or handlers of radioactive materials.

At 7:00 p.m. on March 22nd, ERDA received a call from NRC requesting that the ERDA Emergency

Action Coordination Team (EACT) activate the ERDA Emergency Operations Center (EOC) in Germantown,

Maryland in connection with the incident at Browns Ferry. Specifically, NRC requested that

ERDA notify its radiological assistance teams to be alerted in the event that assistance was

needed.

The EOC was activated at 8:10 p.m. by ERDA representatives. The ERDA Oak Ridge and Savannah

River Operations Offices were informed of the incident and asked to alert their radiological

assistance teams. The EOC was secured at 4:00 a.m. after it had been determined that the

situation at Browns Ferry was under control.

7.4.2 Other Federal Agencies

Several Federal agencies, including the NRC, have nuclear incident emergency planning responsibilities assigned in a Federal Register Notice dated January 24, 1973 (54). Two of these

agencies also have radiological emergency response capabilities for responding to a radiological

incident.

The Environmental Protection Agency (EPA) and the Department of Health, Education and Welfare's

Bureau of Radiological Health (Food and Drug Administration) (FDA-BRH) can field radiological

assistance teams to assist in radiological incidents. The Defense Civil Preparedness Agency

(DCPA) can provide extensive resources to cope with disaster situations and possesses large

quantities of radiological survey instruments. EPA was the only agency to be notified of the

Browns Ferry fire at or near the time it occurred. This notification was received from the

Health Department of the State of Alabama. Since no radiological release affecting offslte

areas occurred, there was no action required of these agencies.

I
65

However, because of the nature of the fire at Browns Ferry with its potential for creating a

radiological release affecting offsite areas, It would also have been prudent for the State of

Alabama to notify FDA-BRH and DCPA Regional Offices to alert them in case their assistance was

required (short of implementing the Interagency Radiological Assistance Plan - IRAP). If the

IRAP was implemented by ERDA, these notifications to these agencies would in all likelihood

have automatically occurred since all three are signatories to the IRAP, and have committed

their resources to the IRAP.

F

[
II

rAl

Ii
67

REFERENCES

The Joint Committee on Atomic Energy has published "Browns Ferry Nuclear Plant Fire, Part 1"

containing testimony given September 16, 1975, and backup material including the entire text of

the NRC Investigation Report and license amendments with their Safety Evaluation Reports. This

will be referenced as JCAE, p. xxx.

The NRC Investigation Report is JCAE, pp. 218-685.

TVA has submitted to NRC its "Plan for Evaluation, Repair, and Return to Service of Browns

Ferry Units I and 2 (March 22, 1975, Fire)," dated April 13, 1975, with 35 amendments to date.

This will be referenced as TVA Plan, p. xxx.

The TVA "Final Report of Preliminary Investigating Committee," May 7, 1975, is given in JCAE

pp. 686-809 and also in TVA Plan, Part III, Section A.

1. "Reactor Safety Study," WASH - 1400, October 1975, Main Report pp. 6-56, Appendix XI,

Section 3.2.1, pp. XI 3-51 thru 62.

2. "Appointment of Special Review Group," NRC Announcement No. 45, March 26, 1975 (reproduced

as Appendix A to this report).

3. TVA Plan

4. Some of these are given in JCAE pp. 98-117; others were in the form of construction

drawings.

b. Reproduced in jCAE, pp. 218-685.

6. JCAE, pp. 210-217.

7. JCAE, pp. 918-936.

t. JCAE, pp. 845-851.

9. The ones issued so far are given in JCAE, pp. 963-1188.

10. JCAE, pp. 686-809.

11. TVA Plan, Parts V-VIII.

12. TVA Plan, Part VIII, Section C.

13. "International Guidelines for the Fire Protection of Nuclear Power Plants," Swiss Pool for

the Insurance of Atomic Risks, Mythenqual 60, Zurich, February 1974.

14. "Fire Protection System," NRC Standard Review Plan 9.5.1, April 1975.

15. JCAE, pp. 1189-93.

16. "Fires at U.S. and Foreign Nuclear Power Plants," NRC Memo T. Ippolito to S. Hanauer,

November 3, 1975. This reference is more comprehensive than Ref (15), which is included

in it, but less widely available.

17. "Interim Report - Materials Flammability Testing for NRC," W. A. Riehl, Marshall Space

Flight Center, April 10, 1975, Appendix A-6 in IE Investigating Report, JCAE pp. 502-23.

18. JCAE, pp. 194-196.

19. "Report of Meeting -Improved Fire Protection and Prevention at Nuclear Power Plants," NRC

memo V. W. Panciera to All Meeting Attendees, August 27, 1975.
68 m

iO. NEL-PIA Interoffice Communication, John J. Carney to Engineers-in-Charge," Proposed Meeting

on Fire Protection for Cable Systems," with attachments, May 23, 1975.

21. JCAE, pp. 476-478.

Ila. JCAE, pp. 479-501.

22. "Watts Bar Nuclear Plant - Browns Ferry Nuclear Plant Units 1-3 - Cable Sleeve Penetration

Test," TVA Memorandum J. C. Killian to F. W. Chandler, July 22, 1975, transmitted in

letter, J. C. Killian, TVA to V. L. Brownlee, NRC, August 18, 1975.

23. "Special Fire Stop Inspections," NRC Memos, B. H. Grier to K. R. Goller, July 3, 1975, and

October 24, 1975.

24. "Test Report on Cable Tray Fire Stop With a Polyurethane Ventilation Seal," Philadelphia

Electric Company, April 3, 1975; "Results of the Investigation and Testing to Establish

Criteria for Fire Resistant Cables," F. W. Myers, February 17, 1970; "Peach Bottom Fire V

Spurs Improved Cable Design," John Forencsik, Philadelphia Electric Company.

25. Letter, Wm. Cornelius Hall, Chemtree Corporation, to Dr. Herbert Kouts, NRC, March 26,

1975.

26. "Fiberglass Sheet Blocks Cable Fire in Detroit Edison Test," Electric Light and Power,

June 23, 1975, p. 61.

27. Letter, R. G. Tiffany, Dow-Corning Corporation, to Dr. S. H. Hanauer, NRC June 20, 1975.

28. Technical and sales literature, Brand Industrial Services, Inc.

29. JCAE, pp. 137-8, 157, 927, 932.

30. JCAE, p. 927.

31. JCAE, p. 157.

31. JCAE, p. 448.

33. JCAE, p. 137.

34. JCAE, p. 927.

35. JCAE, pp. 147-8, 257-277, 937-962.

36. Private Communication from H. J. Green.

37. TVA Plan, Part X.

38. "San Onofre Nuclear Generating Station Unit 1, Report on Cable Failures-1968," Southern

California Edison Company and San Diego Gas and Electric Company, NRC Docket 50-206.

39. "Fire Hazard Study-Grouped Electrical Cables," Fire Record Bulletin HS-6, National Fire

Protection Association.

40. Private Communications from L. Horn, Underwriters Laboratories to T. A. Ippolito, NRC.

41. Letter from William E. Caldwell, Jr., Consolidated Edison Company of New York, Inc., to

Peter A. Morris, AEC, concerning November 4, 1971 fire at Indian Point Unit 2, November 14,

1971, NRC Docket 50-247.

42. Letter for William A. Conwell, Duquesne Light Company to Lawrence E. Low, AEC, Beaver

Valley Station Unit 1, Fire at Motor Control Center, October 31, 1971, NRC Docket 50-334.

43. Letter from F. A. Palmer, Commonwealth Edison Company to J. F. O'Leary, AEC, Quad-Cities

Unit 2 Fire, July 24, 1972, NRC Docket 50-265.

44. "Summary of Meeting with General Public Utility Services Corporation," Ignacio Villalva,

March 7, 1975, NRC Memo, Docket 50-363.
69 1

45. "Arrangement of Control Building Complex," P. J. Corcoran, in Proceedings of the Specialists

Meeting on Control Room Design, July 22-24, 1975, IEEE 75 CH 10657-.

46. "Qualification of Safety - Related Display Instrumentation for Post -Accident Condition

Monitoring and Safe Shutdownt" Branch Technical Position EICSB 23; Standard Review Plan 7.4.

47. FSAR for Sequoia Nuclear Plant, TVA, Chapter 17, NRC Docket 50-327 contains the TVA organization and "new" QA information. Letters to NRC from TVA dated June 11 and August 5,

1975, apply Section 17.2 of the Sequoia FSAR, as amended by Amendment 22 in that docket,

to Browns Ferry, Dockets 50-259, 260, and 296.

48. "Safety Evaluation of the Tennessee Valley Authority Browns Ferry Nuclear Plant Units 1,

2, and 3," AEC, June 26, 1972, NRC Dockets 50-259, 260, 296, p. 122.

49. TVA Plan, Part XIII.

50. "The Atomic Energy Act of 1954," particularly Sec. 101-110, Public Law 83-703, as amended.

51. "Lead Responsibility Resolution Between RO and L," AEC Memo L. Manning Muntzing to J. F.

O'Leary and F. E. Kreusi, December 29, 1972. This is reproduced in Appendix B.

52. Every Licensee with an operating reactor has filed an answer to the IE Bulletins; these

were followed up with IE inspections and in some cases with additional information from

the licensee. All these papers are available in the NRC dockets.

53. JCAE, pp. 964-1037.

54. 38 FR 2356, January 24. 1973.

55. "Transfer of Lead Responsibility, Serial No. IE-C&O-75-7," NRC Memorandum to K. R. Goller,

May 5, 1975.

56. Letter, H. J. Green, TVA, to S. H. Hanauer. NRC, October 10, 1975.

57. "Summary of Meeting held on October 1, 1975, at NRC Offices to Discuss the New Electrical

Penetration Seal and Fire Stop Design," NRC Memorandum, Docket Nos. 50-259/260, October 10,

1975.

58. JCAE, p. 230, Finding No. 18.

69. JCAE, p. 153.

60. "Browns Ferry Inspection History," NRC Memo Norman C. Mosely to John G. Davis, May 30,

1975.

61. JCAE, p. 18.

62. JCAE, p. 226, Item 2(c) (from NRC Investigating Report).

63. "TVA Radiological Emergency Plan," December 20, 1971, Tennessee Valley Authority.

64. "Alabama Radiation Emergency Plan - Annex B," January 19, 1972, Alabama Department of

Health.

65. "Investigation Report by the Nuclear Energy Liability and Property Insurance Association

(NEL-PIA)," JCAE, pp. 810-842.

66. "Physical Independence of Electrical Systems," Regulatory Guide 1.75, U.S.N.R.C., February

1974.

67. JCAE, pp. 64-68.
a. F
I

F

APPENDI XESF

I

L
ia

II
NRC 9 41-75) 73

19 APPENDIX A

R UNITED STATES

C NUCLEAR REGULATdRY COMMISSION

ANNOUNCEMENT NO. 45

DATE: March 26, 1975

TO: All NRC Employees

F

SUBJECT: APPOINTMENT OF SPECIAL REVIEW GROUP

The following Special Review Group is appointed to review the Browns

Ferry fire incident of March 22, 1975:

S. H. Hanauer, Chairman

S. Levine

W. Minners

V. A. Moore

V. Panciera

K. V. Seyfrlt

The group will be assisted by consultation from inside and outside the

NRC staff as appropriate.

The objective of the Group is to review the circumstances of the incident

and to evaluate its origins and consequences from both technical and

procedural viewpoints.

Technical considerations include the design criteria of the affected

equipment, its materials of manufacture, its installation and maintenance,

and its degree of vulnerability to the conditions involved in the incident.

In addition, the review will cover the information available during the

incident and the response of the instrumentation used to determine the

state of the plant.

Procedural considerations include the response of licensee and NRC staff

groups to the incident as it progressed, communications among the people

involved, the measurements made and interpretations of them, and the

support needed by, and available to, the operating personnel.

NOTE: Mr. Collins was appointed later.
74 .3

-2-

The Group's review is not intended to duplicate, or substitute for,

the necessary investigations by the licensee and the staff of NRC -

I&E Region II. Rather, the Group is charged with marshalling the

facts from these investigations and evaluating them to derive appropriate

proposed improvements In NRC pollcles,.procedures, and technical

requirements.

The Group should also identify promptly any other actions or investigations

that it believes should be undertaken for the safety of the Browns

Ferry reactors or for obtaining additional information and insight

regarding the incident. V

Eecutie DGossick

Executive Director for Operations
S

APPENDIX B

UNITED STATES

ATOMIC ENERGY COMMISSION

WASH NGTON. D.C. 2054 F

US sDecember 29, 1972

L. F. O'Leary, Director

Directorate of Licensing

F. E. Kruesi, Director

Directorate of Regulatory F

Operations

LEAD RESPONSIBILITY RESOLUTION BETWEEN RO AND L

The Directorates of Licensing and Regulatory Operations both

interact directly with licensees in matters encompassing

the construction and operation of nuclear power plants and

processing facilities. There are certain functions which

clearly are the responsibility of one or the other of these

Directorates but also a spectrum of activities in which both

have responsibilities. The purpose of this directive is to

further clarify lead responsibilities where interfaces or

overlaps exist in the functions of the respective organizations.

The Directorate of Licensing is responsible for:

1. Review and evaluation of proposed amendments to licenses

and changes in Technical Specifications.

2. Applying and incorporating new regulations or safety

guides.

3. Providing interpretations of license conditions, Technical Specifications, FSAR's, and regulations.

4. Reviewing and making decisions concerning modes of operation which are different from licensing conditions, FSAR's,

or Technical Specifications.

5. Evaluating unreviewed safety questions.

The Directorate of Regulatory Operations is responsible for:

1. Inspecting facility operations for compliance with regulations, license conditions, and Technical Specifications.

75
76 3

J. F. O'Leary - 2 - December 29, 1972

F. E. Kruesi

2. Reviewing facility operating procedures. 17

3. Verifying operating data submitted by licensees.

4. Making component and system reliability studies.

5. Systematic evaluation of licensee performance.

Lead Responsibility

The Directorate of Regulatory Operations has the lead responsibility for initial investigation and contact with licensees

with respect to abnormal occurrences and operating difficulties

during construction and operation of nuclear facilities. In

cases where the licensee's operation can be returned to preoccurrence status, the cause of the difficulty is understood,

and no significant design or operational adequacy problems

appear unresolved, RO will retain lead responsibility.

Where, during its investigation, RO determines that problems

have arisen which may involve changes in Technical Specifications, modes of operation different from FSAR's, or unresolved

safety questions, RO will so notify L by memo, as described

in the attached procedure, and request L to assume lead

responsibility.

Interface Activities

Attached are a spectrum of activities which have been considered

in discussions on interface problems in meetings between you

or your representatives with E. J. Bloch together with your

consensus on resolution of these problems as to lead responsibility. The bases for these determinations are stated briefly

where this is not obvious. The Directorates of Licensing and

Regulatory Operations should assume lead responsibility

accordingly.

L. Man~ningunt"

Director of Regulation

Enclosures:

As Stated
77

PROCEDURE FOR DETERMINATION OF LEAD RESPONSIBILITY FOR

ACCEPTABILITY OFVARIATIONS IN PLANT CONSTRUCTION AND

PERFORMANCE AND EVALUATION OF ABNORMAL OCCURRENCES

The Directorate of Regulatory Operations has the lead responsibility for initial investigation and contact with licensees

with respect to abnormal occurrences and operating.difficulties

during construction and operation of nuclear facilities. In

cases where the licensee's operations can be returned to the

pre-occurrence status, the cause of the difficulty is understood, and no significant design or operational adequacy pro- F

blems appear unresolved, RO will retain lead responsibility.

Where, during its investigation, RO determines that problems

have arisen which may involve changes in Technical Specifications, modes of operation different from FSAR's, or unresolved

safety questions, RO will so notify L by memo, as described

further below, and request L to assume lead responsibility.

In cases where it is not clear whether Technical Specification

changes, modes of operation different from FSAR's, or unresolved

safety questions are involved the following modus operandi will

apply:

1. Problem Identification and Notification

Normally, because of its surveillance of licensee operations and the immediate reporting obligation of licensees

to RO, RO would expect to be the first informed of an

occurrence. RO will make inquiries, inspections, perform

independent measurements, if needed, and take such other

fact gathering actions as are necessary. This collection

of facts and identification of problem areas will be

communicated promptly to L by RO:HQ. In cases where L

has first knowledge of a significant occurrence, that

organization will inform RO, thereby initiating the inspection process'.

2. Preliminary Assessment

Based on the inspection findings, evaluation with respect

to license requirements, and the import of the safety

issues involved, the RO A/D for Inspection and Enforcement

will outline in a memorandum. to L a proposed course of

action and designation of lead responsibility. This might

include:
78 a

2-

a. Retention of lead responsibility by RO.

b. Transfer of lead responsibility to L for resolution U

of the requirements on the licensee.

c. Identification of some portions of the total problem

to be handled respectively by RO and L by mutual

agreement and designation of overall lead responsi- bility.

The memorandum from RO to L, or vice versa, would be F

serially numbered for followup and logging purposes. Signature lines would include both the A/D for Inspection and Enforcement and the appropriate A/D for Reactors in

Licensing. The respective A/D's signatures would attest

to agreement on responsibilities. No new memorandum is

needed; this represents further formalization of the existing one. RO will render such assistance in the areas of

inspection and enforcement as L may request to meet their

responsibility.

3. Resolution

Where agreement is not reached on a timely basis by the

A/D's, resolution of lead responsibility would be escalated

to the Directors or their deputies or to the Assistant

Director of Regulation.

4. RO will issue periodic summaries of outstanding problem

areas for the purpose of prompting resolution and to help

assure adequate followup actions.

I
LICENSING - REGULAIORY OPERATIONS ACTITIES

Activity

Lead

Assined

Review and evaluate applications for a

license

Review and evaluate proposed amendments to

license and changes to Technical

Specifications

Apply and incorporate new regulations and

Safety Guides

Provide interpretations of regulations and

intent of the license (including Technical

Specifications) and FSAR

L

L

L

RO/L

Reason

A licensing action.

A licensing action.

The position being taken by Regulation in. all cases

is known. L is aware of compensating factors and

possible alternatives. Timing can be coordinated

with amendment and/or change actions.

Both RO and L personnel are frequently asked for

interpretations of provisions in the regulations

and license. Such information should be freely given provided that the responder is certain that

the information is correct, as would be the case

if supplemental guidance or precedent made the

answer clear.

Where It is necessary to establish an Interpret-stion

and when a given interpretation is challenged,

as the unit that approved and issued the license,

will provide the interpretation. L will, when

appropriate, obtain OGC agreement. Even licensee

documents, such as the SAR, are subject to L

Interpretation in that L ascribed a certain meaning

during the licensing process and that meaning

should be maintained.

L

t,. f
Activity

Lead

Assigned Reason

Inspect facility operation for compliance with

regulation and license (including Technical

Specifications)

Review the adequacy of facility operation

procedures

Verification of data submitted by licensee

and possibly provide supplementary

Information

Administer enforc-e.-nt program

RO Frequently visit site and may readily observe

operation and inspect records. Well established

responsibility.

RO Procedures are not part of submittal for facility

licensing. Well established responsibility.

RO

RO

Frequently visit site and may readily observe

operation and inspect records. Well established

responsibility.

A major objective in the RO inspection program

is evaluation of the safety of licensee operations,

including determining if violatipns of regulations

and license conditions have occurred. If so,

subsequent enforcement action by RO is wellestablished responsibility. In such enforcement,

RO should ascertain that the violations will not

recur; this function may entail requesting information from the licensee regarding the physical

layout and management of the facility, measures

taken to prevent recurrence, measurements or tests

performed or similar information. In enforcement

actions, L should be advised in a timely mannE

of all enforcement actions, and should concur in

ones sent from RO-HQS.

Requests for design analyses and modifications shotu

be made by L even though recogi•tion of their need

may arise in connection with an enforcement matter.

CD0O

L

k. i p~~~. *i ý I
Lead

Activity

Determines acceptability of Variations in

plant performance, including modes of

operation different from the FSAR

Evaluation of abnornal occurrence

License operators and evaluate operator

performance

RO/L

L

Reason

Procedure for establishing and transferring lead

responsibility is attached.

Sam as above.

L performs operator licensing including evaluat4 n

of competence and issuance and renewal of licer. s

Well established responsibility, RO, during the

inspection program, provides information relative

to the conpetence of licensed personnel for L to

factor into its evaluation. RO also verifies that

the initial and retraining program have been

conducted in accordance with the. regulations and

the licensees' camiitments.

RO conducts inspection as with all inspections.

L should have opportunity to provide input and

discuss RO conclusions prior to final interview

with licensee management and may participate in

this meeting.

Conduct Management Systems Inspection RO -a

1, 1 *1 F I '~1 U -- U
82

APPENDIX C

FEASIBILITY OF RETROFITTING EXISTING DESIGNS TO PROVIDE

REDUNDANT CABLE SPREADING ROOMS

Section 4.3.4.4 of this report discusses the fire zone approach which the Review Group recommiends

for consideration for new designs. Redundant cable spreading rooms are a part of the fire zone

approach. NELPIA (Reference 65) recommends that each unit have a separate spreading room.

Both the 14ELPIA recoimmendation and the fire zone approach involve additional cable spreading rooms that do not exist in many present designs. The NELPIA recommendation was discussed at

the first session of hearings on the Browns Ferry fire conducted by the Joint Commnittee on

Atomic Energy on September 16, 1975 (61). Interest was expressed at the hearing in the cost to

retrofit nuclear power plants with separate cable spreading rooms for each reactor unit.

The Review Group concluded that although the adoption of the fire zone approach would entail

additional cost. the increased cost would not be prohibitive if the approach were adopted at

the beginning of the design effort. The cost of adopting the NELPIA recommendation also would

probably not be prohibitive provided it were factored into the design early. The purpose of

this Appendix is to consider the feasibility and cost of retrofitting existing designs to

provide additional cable spreading rooms.

Estimating the cost of retrofitting to provide additional cable spreading rooms in existing designs involves a number of difficulties. Because of differences in arrangement and design, a

detailed design and cost study of each operating plant would be required for an accurate cost

estimate. The cost for plants under construction would vary considerably with the state of

construction. Similarly with plants being designed, the cost would vary depending on the

degree of completion of the design.

In the design of nuclea r power plants, a design and arrangement approach is developed that

considers many interacting and overlapping requirements. A major change in approach such as

providing additional cable spreading rooms which would involve structural changes to existing

Seismic Class I structures, massive rerouting of cables, and control room redesign would require

careful investigation of all design requirements previously considered. The risk of overlooking

requirements previously incorporated in the design is very real. The chance of mistakes and

oversights seems to be greater when making major design changes and facility modifications than

in the original design effort and construction.

The HRC staff requested TVA to justify why they did not consider total independence of redundant

systems in their restoration plan. Although this request extends beyond provisions for additional

cable spreading rooms, TVA's response is of interest when considering retrofitting for additional

spreading rooms. TVA's response of August 21, 1975, (attached) estimates the capital cost

associated with retrofitting to complete separation to be $100 to $300 million. In consideration of plant down time which might be required to accomplish such major changes, TVA estimates

an additional 500 million to 1.3 billion for replacement energy costs.

The Review Group recognizes that the TVA study was approximate and included separation concepts

other than provisions for additional cable spreading rooms and also involved a complex three

unit plant. Even arbitrarily scaling the TVA estimates down by a factor of 10, however, would

yield large costs.

Although no detailed design and cost study was made, the Review Group concludes that a requirement to retrofit to provide additional cable spreading rooms would result in large costs, long

outages, and long delays in plants now in design and construction. If additional cable spreading rooms were the only way to provide an adequate level of safety, the costs, power unavailability, and delays would have to be borne by the utilities and ultimately by the electricity

users. The Review Group has concluded, however, that as discussed in Chapter 4 there are other

more practical ways to provide the desired improvement in fire protection for operating plants.

plants under construction, and plants partially designed.

I
83

o O 831 Power Building

TENNESSEE VALLE-Y AUTHORITY

m CHATTANOOGA. TENNESSEE 37401

August 21, 1975 -[

ATTACHMENT TO APPENDIX Ci

.: .-

Mr. Benard C. Rusche, Director

Office of Nuclear Reactor Regulation

U.S. Nuclear Regulatory Commission

Washington, DC 20555

Dear Hr. Rusche:

In the Matter of ) Docket Nos. 50-259

Tennessee Valley Authority ) 50-260

On July 3, 1975, members of your staff requested by telephone that we justify why TVA did not consider total independence of

redundant systems to the point that a fire could burn indefinitely

without any reliance on fire-fighting activities. The following

constitutes our response.

Since the fire that occurred in March 1975, TVA has been engaged

in a major effort directed toward reducing the probability of

occurrence of fires at Browns Ferry, toward limiting the extent

of propagation of fires, and toward minimizing the effect of

fires to ensure safe plant shutdown under any credible circumstances. We believe that the likelihood of a fire that could

jeopardize the safety of the plant is of sufficiently low prob- ability that public safety is assured.

Beyond those changes currently being undertaken to minimize the

probability of occurrence and to minimize the effects associated

with a major fire, TVA has considered various drastic schemes by which we might significantly modify the Browns Ferry Nuclear Plant

to accommodate a fire under the assumptions that no fire-fighting

action is taken and that a fire at any location where fires are

possible is allowed to burn to extinction. Schemes which we have

considered include enclosing all cables in conduits, use of armored

cable throughout the plant, and complete zonal separation such that

complete destruction of all equipment in any given zone would not

prevent safe plant shutdown. Such investigations raise numerous

difficult questions regarding the definition of a design basis event

and regarding the criteria under which the design changes would be

s important to recognize that such a design basis event

9068

An Equal Opportunity Employer
a 84

-2-

Mr. Benard C. Rusche August 21, 1975

has not been previously defined and that one of the major uncertainties is the applicability of various regulatory requirements and

regulatory guides to such an undefined event. After considering

various-possible alternatives, we have concluded that it may not be

possible to redesign and reconstruct the Browns Ferry plant to

accommodate such a proposed design basis event, particularily in

view of the fact that in addition to the event itself having not

been defined, the ground rules under which such an event would be F

accommodated have not been defined.

On the basis of a general consideration of the problem and on the

basis of our knowledge of past history in designing for major new

concepts of this complexity, we have concluded that it would require

two to three years of very determined effort by TVA and NRC to

adequately define the requirements and to receive regulatory concurrence for the basis of a major new design concept such as this.

If it were determined on the basis of the preliminary study and

definition that it were possible to make such modifications, we are

convinced, on the basis of our knowledge of the plant and the nature

of such a change, that a major reconstruction of the plant would

require an additional three to four years to complete. Thus, the

total overall schedule for such a major change would approach that

required for design and construction of a new plant.

The capital costs, not including costs of outage time for such an

effort directed at the Browns Ferry plant or any other plant under

construction, would be in the range of hundreds of millions of dollars,

perhaps $100 to $300 million.

The plant outage time to accommodate such a redesign and reconstruction

would be from three to seven years, depending on whether we were permitted to proceed with operation of the plant during the design and

licensing phase of such an effort.

An outage of this duration would place a severe economic burden on

TVA's customers and would seriously jeopardize our ability to serve

the region's power requirements. The current outage at Browns Ferry

costs our consumers about $4 to $5 million per unit per month. We
85

Mr. Benard C. Rusehe August 21, 1975

estimate that an additional plant outage of three to seven years would

result in an economic burden to our customers ranging from $500 million

to $1.3 billion for higher replacement energy costs with our coal-fired

units and purchase power, if available. In addition, a three to seven

year outage of the Browns Ferry plant would reduce our reserve margin

far below those desired and in some peak periods results in zero or

negative reserves.* This could require the addition of additional

capacity such as gas turbines which would add another economic burden

to our consumers. Thus, the total costs of this plant modification

would probably exceed the $600 million to $1.6 billion mentioned above.

We reaffirm that the Browns Ferry Nuclear Plant, as modified following

the fire which occurred in March 1975, is safe and that the current

design precludes the necessity of redesigning the plant to withstand

a major fire that is allowed to burn to extinction. We also point out

that, contrary to industry practice and over and beyond 1NRC requirements, the Browns Ferry Nuclear Plant was designed and constructed at

great expense to accommodate major damage from fire in the spreading

room or in the control room without jeopardizing safe plant shutdown.

Furthermore, we point out that the Browns Ferry plant successfully

withstood the effects of a fire in a critical location. In addition,

the plant design and plant construction and operating procedures have

been modified extensively both to further reduce the probabilities of

a fire recurring and to minimize the adverse effects in the extremely

unlikely event that a major fire were to occur in a critical location.

In conclusion, we feel very strongly that such a redesign is not

necessary to ensure plant safety, and that the cost of such a redesign

would far outweigh the benefit.* If such a change was contemplated, an

extensive and careful cost-benefit study should precede any decision to

proceed.

Very truly Fours,

aJ'_.Gilleland

Assistant Manager of Power
tFr