Nuclear Safety: NRC's Oversight of Fire Protection at U.S. Commercial Nuclear Reactor Units Could Be Strengthened
Released: 2008-06-30T00:00:00

Letter

Background

In 1971, the Atomic Energy Commission, NRC’s predecessor, promulgated the first regulations for fire protection at commercial nuclear power units in the United States. These regulations––referred to as General Design Criterion 3––provided basic design requirements and broad performance objectives for fire protection, but lacked implementation guidance or assessment criteria. As such, NRC generally deemed a unit’s fire protection program to be adequate if it complied with standards set by the National Fire Protection Association (NFPA)––an international organization that promotes fire prevention and safety––and received an acceptable rating from a major fire insurance company. However, at that time the fire safety requirements for commercial nuclear power units were similar to those for conventional, fossil-fueled power units.

NRC and nuclear industry officials did not fully perceive that fires could threaten a nuclear unit’s ability to safely shut down until 1975, when a candle that a worker at Browns Ferry nuclear unit 1 was using to test for air leaks in the reactor building ignited electrical cables. The resulting fire burned for 7 hours and damaged more than 1,600 electrical cables, more than 600 of which were important to unit safety. Nuclear unit workers eventually used water to extinguish the fire, contrary to the existing understanding of how to put out an electrical fire. The fire damaged electrical power, control systems, and instrumentation cables and impaired cooling systems for the reactor. During the fire, operators could not monitor the unit normally.

NRC’s investigation of the Browns Ferry fire revealed deficiencies in the design of fire protection features at nuclear units and in procedures for responding to a fire, particularly regarding safety concerns that were unique to nuclear units, such as the ability to protect redundant electrical cables and equipment important for the safe shutdown of a reactor. In response, NRC developed new guidance in 1976 that required units to take steps to isolate and protect at least one system of electrical cables and equipment to ensure a nuclear unit could be safely shut down in the event of a fire. NRC worked with licensees throughout the late 1970s to help them meet this guidance.

In November 1980, NRC published two new sets of regulations to formalize the regulatory approach to fire safety. First, NRC required all nuclear units to have a fire protection plan that satisfies General Design Criteria 3 and that describes an overall fire protection program. Second, NRC published Appendix R, which requires nuclear units operating prior to January 1, 1979 (called “pre-1979 units”), to implement design features—such as fire walls, fire wraps, and automatic fire detection and suppression systems—to protect a redundant system of electrical cables and equipment necessary to safely shut down a nuclear unit during a fire. Among other things, Appendix R requires units operating prior to 1979 to protect one set of cables and equipment necessary for safe shutdown through one of the following means:1. Separating the electrical cables and equipment necessary for safe shutdown by a horizontal distance of more than 20 feet from other systems, with no combustibles or fire hazards between them. In addition, fire detectors and an automatic fire suppression system (for example, a sprinkler system) must be installed in the fire area. 2. Protecting the electrical cables and equipment necessary for safe shutdown by using a fire barrier able to withstand a 3-hour fire, as conducted in a laboratory test (thereby receiving a 3-hour rating). 3. Enclosing the cable and equipment necessary for safe shutdown by using a fire barrier with a 1-hour rating and combining that with automatic fire detectors and an automatic fire suppression system.

If a nuclear unit’s fire protection systems do not satisfy those requirements or if redundant systems required for safe shutdown could be damaged by fire suppression activities, Appendix R requires the nuclear unit to maintain an alternative or dedicated shutdown capability and its associated circuits. Moreover, Appendix R requires all units to provide emergency lighting in all areas needed for operating safe shutdown equipment.

Nuclear units that began operating on or after January 1, 1979 (called “post-1979 units”) must satisfy the broad requirements of General Design Criteria 3 but are not subject to the requirements of Appendix R.

However, NRC has imposed or attached conditions similar to the requirements of Appendix R to these units’ operating licenses.

When promulgating these regulations, NRC recognizes that strict compliance for some older units would not significantly enhance the level of fire safety. In those cases, NRC allows nuclear units licensed before 1979 to apply for an exemption to Appendix R. The exemption depends on if the nuclear unit can demonstrate to NRC that existing or alternative fire protection features provided safety equivalent to those imposed by the regulations. Since 1981, NRC has issued approximately 900 unit-specific exemptions to Appendix R. Nuclear units licensed after 1979 can apply for “deviations” against their licensing conditions.

Many exemptions take the form of NRC-approved operator manual actions, whereby nuclear unit staff manually activate or control unit operations from outside the unit’s control room, such as manually stopping a pump that malfunctions during a fire and could affect a unit’s ability to safely shut down. NRC also allows nuclear units to institute, in accordance with their NRC-approved fire protection program, “interim compensatory measures”—temporary measures that units can take without prior approval to compensate for equipment that needs to be repaired or replaced. Interim compensatory measures often consist of roving or continuously staffed fire watches that occur while nuclear units take corrective actions.

In part to simplify the licensing of nuclear units that have many exemptions, NRC recently began encouraging units to transition to a more risk-informed approach to nuclear safety in general. In 2004, NRC promulgated 10 C.F.R. 50.48(c), which allows––but does not require–– nuclear units to adopt a risk-informed approach to fire protection. The risk-informed approach considers the probability of fires in conjunction with a unit’s engineering analysis and operating experience. The NRC rule allows licensees to voluntarily adopt and maintain a fire protection program that meets criteria set forth by the NFPA’s fire protection standard 805— which describes the risk-informed approach endorsed by NRC—as an alternative to meeting the requirements or unit-specific fire- protection license conditions represented by Appendix R and related rules and guidance. Nuclear units that choose to adopt the risk-informed approach must submit a license amendment request to NRC asking NRC to approve the unit’s adoption of the new risk-informed, regulatory approach. NRC is overseeing a pilot program at two nuclear unit locations and expects to release its evaluation report on these programs by March 2009.

According to NRC, Recent Fires at U.S. Commercial Nuclear Units Have Had Limited Safety Significance

NRC officials told us that none of the 125 fires at 54 sites that nuclear unit operators reported from January 1995 to December 2007 has posed significant risk to a commercial unit’s ability to safely shut down. No fires since the 1975 Browns Ferry fire have threatened a nuclear unit’s ability to safely shut down. Most of the 125 fires occurred outside areas that are considered important for safe shutdown of the unit or happened during refueling outages when nuclear units were already shut down.

Nuclear units categorized 13 of the 125 reported fires as “alerts” under NRC’s Emergency Action Level rating system, meaning that the reported situation involved an actual or potential substantial degradation of unit safety, but none of the fires actually threatened the safe shutdown of the unit. NRC further characterizes alerts as providing early and prompt notification of minor events that could lead to more serious consequences. As shown in the table 1, the primary reported causes of these fires were electrical fires.

Nuclear units classified the remaining 112 reported fires in categories that do not imply a threat to safe shutdown. Specifically, 73 were characterized as being “unusual events”––a category that is less safety-significant than “alerts”––and 39 fires as being “non-emergencies.” No reported fire event rose to the level of “site area emergency” or “general emergency”—the two most severe ratings in the Emergency Action Level system.

As shown in table 2 below, about 41 percent of the 125 reported fires were electrical fires, 14 percent were maintenance related, 7 percent were caused by oil-based lubricants or insulation, and the remaining 38 percent either had no reported causes or the causes were listed as “other,” including brush fires, cafeteria grease fires, and lightning.

We also gathered information on fire events that had occurred at nuclear unit sites we visited. NRC’s data on the location and circumstances surrounding fire events was consistent with the statements of unit officials whom we contacted at selected nuclear units. Although unit officials told us that some recent fires necessitated the response of off-site fire departments to supplement the units’ on-site firefighting capabilities, they confirmed that none of the fires adversely affected the units’ ability to safely shut down. Additionally, officials at two units told us that, although fires affected the units’ auxiliary power supply, the events caused both units to “trip”—an automatic power down as a precaution in emergencies.

NRC Has Not Resolved Long- standing Issues Affecting Industry’s Compliance with NRC’s Fire Regulations

NRC has not fully resolved several long-standing issues that affect the commercial nuclear industry’s compliance with existing NRC fire regulations. These issues include (1) nuclear units’ use of operator manual actions; (2) nuclear units’ long-term use of interim compensatory measures; (3) uncertainties regarding the effectiveness of fire wraps for protecting electrical cables necessary for the safe shutdown of a nuclear unit; and (4) the regulatory treatment of fire-induced multiple spurious actuations of equipment that could prevent the safe shutdown of a nuclear unit. Moreover, NRC lacks a central system of records that would enhance its ability to oversee and address the use of operator manual actions and extended interim compensatory measures, among other related issues. According to an NRC Commissioner, the current “patchwork of requirements” is characterized by too many exemptions, as well as by unapproved or undocumented operator manual actions. He said the current regulatory situation was not the ideal, transparent, or safest way to deal with the issue of fire safety.

Many Nuclear Units Are Using Operator Manual Actions That May Not Comply with NRC’s Fire Regulations

NRC’s oversight of fire safety is complicated by nuclear units’ use of operator manual actions that NRC has not explicitly approved. NRC’s initial Appendix R regulations required that nuclear units protect at least one redundant system—or “train”—of equipment and electrical cables required for a unit’s safe shutdown through the use of fire protection measures, such as 1-hour or 3-hour fire barriers, 20 feet of separation between redundant systems, and automatic fire detection and suppression systems. The regulations do not list operator manual actions as a means of protecting a redundant system from fire. However, according to NRC officials and NRC’s published guidance, units licensed before January 1979 can receive approval for a specific operator manual action by applying for a formal exemption to the regulations. For example, unit officials at one site told us they rely on 584 operator manual actions that are approved by 15 NRC exemptions for safe shutdown. (NRC allows units to submit multiple operator manual actions under one exemption.) Units licensed after January 1979 may use operator manual actions for fire protection if these actions are permitted by the unit’s license and if the unit can demonstrate that the actions will not adversely affect safe shutdown. NRC and nuclear unit officials told us that units have been using operator manual actions since Appendix R became effective in 1981. These officials added that a majority of nuclear units that use operator manual actions started using them beginning in the mid-1990s in response to the failure of Thermo-Lag––a widely used fire wrap––to meet fire endurance testing.

A lack of clear understanding between NRC and industry over the permissible use of operator manual actions in lieu of passive measures emerged over the years. For example, officials at several of the sites we visited produced documentation––some dating from the 1980s––showing NRC’s documented approval of some, but not all, operator manual actions. In some other cases, unit operators told us that NRC officials verbally approved certain operator manual actions but did not document their approval in writing. In some other instances, without explicit NRC approval, unit officials applied operator manual actions that NRC had previously approved for similar situations. NRC officials explained that NRC inspectors may not have cited units for violations for these operator manual actions because they believed the actions were safe; however, NRC’s position is that these actions do not comply with NRC’s fire regulations. Moreover, in fire inspections initiated in 2000 of nuclear units’ safe shutdown capabilities, NRC found that units were continuing to use operator manual actions without exemptions in lieu of protecting safe shutdown capabilities through the required passive measures. For example, management officials for some nuclear units authorized staff to manually turn a valve to operate a pump if it failed due to fire damage rather than protecting the cables that operate the valve automatically. Unit officials at one site stated that they rely on more than 20 operator manual actions that must be implemented within 25 minutes for safe shutdown in the event of a fire.

In March 2005 NRC published a proposal to revise Appendix R to allow feasible and reliable operator manual actions if units maintained or installed automatic fire detection and suppression systems. The agency stated that this would reduce the regulatory burden by decreasing the need for licensees to prepare exemption requests and the need for NRC to review and approve them. However, industry officials stated, among other things, that the requirement for suppression would be costly without a clear safety enhancement and, therefore, would likely not reduce the number of exemption requests. Officials at one unit told us that this requirement, in conjunction with other NRC proposed rules, could cost as much as $12 million at one unit, and they believe that the rule would have caused the industry to submit a substantial number of exemption requests to NRC. Due in part to these concerns, NRC withdrew the proposed rule in March 2006.

NRC officials reaffirmed the agency’s position that nuclear units using unapproved or undocumented operator manual actions are not in compliance with regulations. In published guidance sent to all operating nuclear units in 2006, NRC stated that this has been its position since Appendix R became effective in 1981. The guidance further stated that NRC has continued to communicate this position to licensees via various public presentations, proposed rulemaking, and industry wide communications.

In June 2006, NRC directed nuclear units to complete corrective actions for these operator manual actions by March 2009, either by applying for licensing exemptions for undocumented or unapproved operator manual actions or by making design modifications to the unit to eliminate the need for operator manual actions. Staff at most nuclear units we visited said they would resolve this issue either by transitioning to the new risk- informed approach, or by applying to NRC for licensing exemptions because making modifications would be resource-intensive. In March 2006, NRC also stated in the Federal Register that the regulations allow licensees to use the risk-informed approach in lieu of seeking an exemption or license amendment.

NRC officials told us that, at least for the short-term, they have no plans to examine unapproved or undocumented operator manual actions for units that have sought exemptions to determine if these units are compliant with regulations. They said that NRC has already received exemption requests for operator manual actions, and it expects about 25 units–– mostly units licensed before 1979 that do not intend to adopt the new risk- informed approach—to submit additional exemption requests by March 2009. They estimated that about half of the 58 units that have not decided to transition to the risk-informed approach do not have compliance issues regarding operator manual actions and, therefore, will not need to submit related requests for exemptions. These officials anticipate that the remaining units that are not transitioning to the risk-informed approach will submit exemptions in the following two broad groups: (1) license amendment requests that should be short and easy to process because the technical review has already been completed, showing that the operator manual actions in place do not degrade unit safety; and (2) exemption requests that require more detailed review because the units have been using unapproved operator manual actions.

NRC Has Not Yet Acted to Address Extended Use of Interim Compensatory Measures

Some nuclear units have used interim compensatory measures for extended periods of time—in some cases, for years—rather than perform the necessary repairs or procure the necessary replacements. As of April, 2008, NRC has no firm plans for resolving this problem. For example, at one nuclear unit we visited, unit officials chose to use fire watches for over 5 years instead of replacing faulty penetration seals covering openings in structural fire barriers. Officials at several units told us that they typically use fire watches with dedicated unit personnel as interim compensatory measures whenever they have deficiencies in fire protection features. NRC regional officials confirmed that most interim compensatory measures are currently fire watches and that many of these were implemented at nuclear units after tests during the 1980s and 1990s determined that Thermo-Lag and, later, Hemyc fire wraps, used to protect safe shutdown cables from fire damage, were deficient. According to a statement released by an NRC commissioner in October 2007, interim compensatory measures are not the most transparent or safest way to deal with this issue. Moreover, NRC inspectors have reported weaknesses in certain interim compensatory measures used at some units, including an over reliance on 1-hour roving fire watches rather than making the necessary repairs.

Although NRC regulations state that all deficiencies in fire protection features must be promptly identified and corrected, they do not limit how long units can rely on interim compensatory measures—such as hourly fire watches—before taking corrective actions or include a provision to compel licensees to take corrective actions. In the early 1990s, NRC issued guidance addressing the timeliness of corrective actions, stating that the agency expected units to promptly complete all corrective actions in a timely manner commensurate with safety and thus eliminate reliance on the interim compensatory measures. In 1997, NRC issued additional guidance, stating that if a nuclear unit does not resolve a corrective action at the first available opportunity or does not appropriately justify a longer completion schedule, the agency would conclude that corrective action has not been timely and would consider taking enforcement action. NRC’s current guidance for its inspectors states that a unit may implement interim compensatory measures until final corrective action is completed and reliance on an interim compensatory measure for operability should be an important consideration in establishing the time frame for completing the corrective action. This guidance further states that conditions calling for interim compensatory measures to restore operability should be resolved quickly because such conditions indicate a greater degree of degradation or nonconformance than conditions that do not rely on interim compensatory measures. For example, the guidance states that NRC expects interim compensatory measures that substitute an operator manual action for automatic safety-related functions to be resolved expeditiously. Officials from several different units that we visited confirmed that NRC has not implemented a standard timeframe for when corrective actions must be made regarding safe shutdown deficiencies.

NRC officials further state that interim compensatory measures could remain in place at some units until they fully transition to the risk- informed approach to fire protection. They stated that this was because many of the interim compensatory measures are in place for Appendix R issues that are not risk significant, and nuclear units will be able to eliminate them after they implement the risk-informed approach.

NRC Has Not Resolved Uncertainty Regarding the Effectiveness of Fire Wraps

NRC has not resolved uncertainty regarding fire wraps used at some nuclear units for protecting cables critical for safe shutdown. NRC’s regulations state that fire wraps protecting shutdown-related systems must have a fire rating of either 1 or 3 hours. NRC guidance further states that licensees should evaluate fire wrap testing results and related data to ensure it applies to the conditions under which they intend to install the fire wraps. If all possible configurations cannot be tested, an engineering analysis must be performed to demonstrate that cables would be protected adequately during and after exposure to fire. NRC officials told us that the agency prefers passive fire protection, such as fire barriers—including fire wraps—because such protection is more reliable than other forms of fire protection, for example, human actions for fire protection.

Following the 1975 fire at Browns Ferry, manufacturers of fire wraps performed or sponsored fire endurance tests to establish that their fire wraps met either the 1-hour or 3-hour rating period required by NRC regulations. However, NRC became concerned about fire wraps in the late 1980s when Thermo-Lag—a fire wrap material commonly used in units at the time—failed performance tests to meet its intended 1-hour and 3-hour ratings, even though it had originally passed the manufacturer’s fire qualification testing. In 1992, NRC’s Inspector General found that NRC and nuclear licensees had accepted qualification test results for Thermo-Lag that were later determined to be falsified. From 1991 to 1995, NRC issued a series of information notices on performance test failures and installation deficiencies related to Thermo-Lag fire wrap systems. As a result, in the early 1990s, NRC issued several generic communications informing industry of the test results and requested that licensees implement appropriate interim compensatory measures and develop plans to resolve any noncompliance. One such communication included the expectation that licensees would review other fire wrap materials and systems and consider actions to avoid problems similar to those identified with Thermo-Lag.

Deficiencies emerged in other fire wrap materials starting in the early 1990s, and NRC suggested that industry conduct additional testing. It took NRC over 10 years to initiate and complete its program of large-scale testing of Hemyc—another commonly used fire wrap—and then direct units to take corrective actions after small-scale test results first indicated that Hemyc might not be suitable as a 1-hour fire wrap. In 1993, NRC conducted pilot-scale fire tests on several fire wrap materials, but because the tests were simplified and small-scale models were used, NRC applied test results for screening purposes only. These tests involved various fire wraps assembled in different configurations. The test results indicated unacceptable performance in approximately one-third of the assemblies tested, and NRC reported that the results for Hemyc were inconclusive, although NRC’s Inspector General recently reported that Hemyc had failed this testing. In 1999 and 2000, several NRC inspection findings raised concerns about the performance of Hemyc and MT—another fire wrap— including: (1) whether test acceptance criteria for insurance purposes is valid for fire barrier endurance tests and (2) the performance of fire wraps when those wraps are used in untested configurations. In 2001, NRC initiated testing for typical Hemyc and MT installations used in units in the United States, and the test results indicated that the Hemyc configuration did not pass the 1-hour criteria and that the MT configuration did not pass the 3-hour criteria. In 2005, NRC held a public meeting with licensees to discuss these test results and how to achieve compliance.

In 2006, NRC published guidance stating that fire wraps installed in configurations that are not capable of providing the designed level of protection are considered nonconforming installations and that licensees that use Hemyc and MT—previously accepted fire wraps—may not be conforming with their licenses. This guidance further stated that if licensees identify nonconforming conditions, they may take the following corrective actions: (1) replace the failed fire wraps with an appropriately rated fire wrap material, (2) upgrade the failed fire barrier to a rated barrier, (3) reroute cables or instrumentation lines through another fire area, or (4) voluntarily transition to the risk-informed approach to fire protection.

According to NRC’s Inspector General, during testimony before Congress in 1993 on the deficiencies of Thermo-Lag, the then-NRC Chairman committed NRC to assess all fire wraps to determine what would be needed in order to meet NRC requirements. The testimony also contained an attachment of an NRC task force that made the following two recommendations: (1) NRC should sponsor new tests to evaluate the fire endurance characteristics of other fire wraps and (2) NRC should review the original fire qualification test reports from fire wrap manufacturers.

Although NRC maintains that it has satisfied this commitment, the NRC Inspector General reported in January 2008 that the agency had yet to complete these assessments. NRC officials told us that licensees are required to conduct endurance tests on fire wraps used at nuclear units; however, the NRC Inspector General noted that, to date, no test has been conducted certifying Hemyc as a 1- or 3- hour fire wrap. Licensees’ proposed resolutions for this problem ranged from making replacements with another fire wrap material to requesting license exemptions. In addition, although NRC advised licensees that corrective actions associated with Hemyc and MT are subject to future inspection, the Inspector General noted that NRC has not yet scheduled or budgeted for inspections of licensees’ proposed resolutions. The Inspector General’s report indicated that several different fire wraps failing endurance tests are still installed at units across the country, but NRC does not maintain current records of these installations. Until issues regarding the effectiveness of fire wraps are resolved, utilities may not be able to use the wraps to their potential and instead rely on other measures, including operator manual actions.

NRC Has Not Yet Acted to Resolve How to Protect against Multiple Spurious Actuations That Could Affect a Nuclear Unit’s Ability to Safely Shut Down

NRC has not finalized guidance on how nuclear units should protect against short-circuits that could cause safety-related equipment to start or malfunction spuriously (instances called spurious actuations). In the early 1980s, NRC issued guidance clarifying the requirements in its regulations for safeguarding against spurious actuations that could adversely affect a nuclear unit’s ability to safely shut down. However, NRC approved planning for spurious actuations occurring only one at a time or in isolation. In the late 1990s, nuclear units identified problems related to multiple spurious actuations occurring simultaneously. Due to uncertainty over this issue, in 1998 NRC exempted units from enforcement actions related to spurious actuations, and in 2000 the agency temporarily suspended the electrical circuit analysis portion of its fire inspections at nuclear units. Cable fire testing performed by industry in 2001 demonstrated that multiple spurious actuations occurring simultaneously or in rapid succession without sufficient time to mitigate the consequences may have a relatively high probability of occurring under certain circumstances, including fire damage.

Following the 2001 testing, NRC notified units that it expects them to plan for protecting electrical systems against failures due to fire damage, including multiple spurious actuations in both safety-related systems and associated nonsafety systems. NRC resumed electrical inspections in 2005 and proposed that licensees review their fire protection programs to confirm compliance with NRC’s stated regulatory position on this issue and report their findings in writing. The proposal suggested that noncompliant units could come into compliance by (1) reperforming their circuit analyses and making necessary design modifications, (2) performing a risk-informed evaluation, or (3) adopting the overall risk- informed approach to fire protection advocated by NRC. In 2006, however, NRC decided not to issue the proposal, stating that further thought and care can be taken to ensure the resolution of this issue has a technically sound and traceable regulatory footprint that would provide permanent closure.

The nuclear industry has issued statements disagreeing with NRC’s proposed regulatory approach for multiple spurious actuations. Industry officials noted that NRC approved licenses for many units that require operators to plan for spurious actuations from a fire event that occur one at a time or in isolation and that NRC’s current approach amounts to a new regulatory position on this issue. Furthermore, the industry asserts that units only need to plan for protecting against spurious actuations occurring one at a time or in isolation because, in industry’s view, multiple spurious actuations occurring are highly improbable and should not be considered in safety analyses. Industry officials told us that the 2001 test results were generated under worst-case scenarios, which operating experience has shown may not represent actual conditions at nuclear units. These officials further told us that NRC’s requirements are impossible to achieve.

In December 2007, the nuclear industry proposed an approach for evaluating the effects on circuits from two or more spurious actuations occurring simultaneously, but NRC had not officially commented on the proposal as of May 2008. NRC has stated that draft versions of the proposal it has reviewed do not achieve regulatory compliance. As of May 2008, despite numerous meetings and communications with industry, NRC has not endorsed guidance or developed a timeline for resolving disagreements with industry about how to plan for multiple spurious actuations of safety-related equipment due to fire damage. However, NRC officials told us they have recently developed a closure plan for this issue that they intend to propose to NRC’s Commissioners for approval in June 2008. NRC officials told us that after this plan is approved, their planned next steps are to determine (1) the analysis tools, such as probabilistic risk assessments or fire models, that units can use to analyze multiple spurious actuations; and (2) a time frame for ending its ongoing exemption of units from enforcement actions related to spurious actuations.

NRC Lacks a Comprehensive Database to Track Nuclear Units’ Use of Operator Manual Actions, Interim Compensatory Measures, and Exemptions

NRC has no comprehensive database of the operator manual actions or interim compensatory measures implemented at nuclear units since its regulations were first promulgated in 1981, in addition to the hundreds of related licensing exemptions. NRC does not require units to report operator manual actions upon which they rely for safe shutdown. Although NRC reports operator manual actions in the inspection reports it generates through its triennial fire inspections, it does not track these operator manual actions industrywide nor does it compile them on a unit by unit basis. NRC does not maintain a central database of interim compensatory measures being used in place of permanent fire protection features at units for any duration of time. In addition, NRC regional officials told us that triennial fire inspectors do not typically track the status of interim compensatory measures used for fire protection or which units are using them. However, units record maintenance-related issues in their corrective action programs, including those issues requiring the implementation of interim compensatory measures. As a result, data are available to track interim compensatory measures that last for any period of time as well as to analyze their safety significance. NRC resident inspectors told us that they review these corrective action programs on a daily basis and that they are always aware of the interim compensatory measures in place at their units. They reported that this information is sometimes reviewed by NRC regional offices but rarely by headquarters officials.

NRC officials explained that the agency tracked the use of exemptions— including some operator manual actions—through 2001 but then stopped because the number of exemptions requested by units decreased. This information is available, in part, electronically through its public documents system and partly in microfiche format. These officials explained that part of the agency’s inspection process is to test if licensees have copies of their license exemptions and, thus, are familiar with their own licensing basis. Inspectors have the ability to confirm an exemption, but once the inspectors are in the field, they often rely on the licensee’s documentation. According to these officials, NRC has no central repository for all the exemptions for a unit, but agency inspectors can easily validate a licensee’s exemption documentation by looking it up in their public documents system. They said that they conduct the triennial inspections over 2 weeks at the unit because they realize licensees may not be able to locate documentation immediately. They notify licensees what documents they need during the first week onsite so the licensees can have time to prepare them for NRC’s return trip. NRC regional officials told us that it is difficult to inspect fire safety due to the complicated licensing basis and inability to track documents.

An NRC commissioner told us that nuclear power units have adopted many different fire safety practices with undocumented approval status. The commissioner further stated that NRC does not have good documentation of which units are using interim compensatory measures or operator manual actions for fire protection and that it needs a centralized database to track these issues. The commissioner stated the lack of a centralized database does not necessarily indicate that safety has been compromised.

However, without a database that contains information about the existence, length, nature, and safety significance of interim compensatory measures, operator manual actions, and exemptions in general, NRC may not have a way to easily track which units have had significant numbers of extended interim compensatory measures and possibly unapproved operator manual actions. Moreover, the database could help NRC make informed decisions about how to resolve these long-standing issues. Also, the database could help NRC inspectors more easily determine whether specific operator manual actions or extended interim compensatory measures have, in fact, been approved through exemptions.

To Date, 46 Nuclear Unit Operators Have Announced They Will Adopt a New Risk- Informed Approach to Fire Safety, but the Transition Effort Faces Challenges

Officials at 46 nuclear units have announced their intention to adopt the risk-informed approach to fire safety. Officials from NRC, industry, and units we visited that plan to adopt the risk-informed approach stated that they expect the new approach will make units safer by reducing reliance on unreliable operator manual actions and help identify areas of the unit where multiple spurious actuations could occur. Academic and industry experts believe that the risk-informed approach could provide safety benefits, but they stated that NRC must address inherent complexities and unknowns related to the development of probabilistic risk assessments used in the risk-informed approach. Furthermore, the shortage of skilled personnel and concerns about the potential cost of conducting risk analyses could slow the transition process and limit the number of units that ultimately make the transition to the new approach.

Nuclear Units Adopting the Risk-Informed Approach Expect It to Improve Safety

As of May 2008, 46 nuclear units at 29 sites have announced that they will transition to the risk-informed approach endorsed by NRC (see fig. 1). To facilitate the transition process for the large number of units that will change to the new approach within the next 5 years, NRC is overseeing a pilot program involving three nuclear units at the Oconee Nuclear Power Plant in South Carolina and one unit at the Shearon Harris Nuclear Power Plant in North Carolina, and NRC expects to release its evaluation of these units’ license amendment requests supporting their transition to the risk- informed approach by March 2009. At that point, 22 nuclear units will have submitted their license amendment requests for NRC’s review, followed by other units in a staggered fashion.

NRC and transitioning unit officials we spoke with expected that transitioning to the new approach could simplify nuclear units’ licensing bases by reducing the number of future exemptions significantly at each unit. Furthermore, officials from each of the 12 units we contacted that plan to adopt the approach said that one of the main reasons for their transition is to reduce the number of exemptions, including those involving operator manual actions, that are required to ensure safe shutdown capability under NRC’s existing regulations. Specifically, these officials told us that they expected that conducting fire modeling and probabilistic risk assessments—aspects of the risk-informed approach— would allow the nuclear units to demonstrate that fire protection features in an area with shutdown-related systems would be acceptable based on the expected fire risk in that area. According to some of these officials, under these circumstances units would no longer need to use exemptions—including those involving operator manual actions—to demonstrate compliance with the regulations. Officials at 10 of the units we visited stated that, as a result, the approach could eliminate the need for some operator manual actions. For example, officials at one site that contained two nuclear units expected that by transitioning to the new risk- informed approach, the units could eliminate the need for over 1,200 operator manual actions currently in place. Other unit officials conceded that the outcomes of probabilistic risk assessments may demonstrate the need for new operator manual actions that are currently not required under the current regulations. These officials added that any new actions or other safety features could be applied only to those areas subject to fire risk, rather than to the entire facility, thereby allowing units to maximize resources.

According to nuclear unit officials, adopting the risk-informed approach could also help resolve concerns about multiple spurious actuations that could occur as a result of fire events. Officials from six units we visited told us that conducting the probabilistic risk assessments would allow them to identify where multiple spurious actuations are most likely to occur and which circuit systems would be most likely affected. These officials told us that limiting circuit analyses to the most critical areas would make such analyses feasible. NRC has repeatedly promoted the transition to the new risk informed approach as a way for nuclear units to address the multiple spurious actuation issue.

Industry and Academic Experts Expressed Concern about Probabilistic Risk Assessments That Would Be Used under the Risk- Informed Approach

According to industry officials and academic experts we consulted, the results of a probabilistic risk assessment used in the risk-informed approach could help units direct safety resources to areas where risk from accidents could be minimized or where the risk of damage to the core or a unit’s safe shutdown capability is highest; however, officials also noted that the absence of significant fire events since the 1975 Browns Ferry fire limits the relevant data on fire events at nuclear units. Specifically, these experts noted the following: Probabilistic risk assessments require large amounts of data; therefore the small number of fires since the Browns Ferry fire and the subsequent lack of real-world data may increase the amount of uncertainty in the analysis.

Probabilistic risk assessments are limited by the range of scenarios that practitioners include in the analysis. If a scenario is not examined, its risks cannot be considered and mitigated.

The role of human performance and error in a fire scenario—especially those scenarios involving operator manual actions—is difficult to model.

Finally, these parties stated that probabilistic risk assessments in general are difficult for a regulator to review and are not as enforceable as a prescriptive approach, in which compliance with specific requirements can be inspected and enforced.

NRC and Industry Face a Possible Shortage in Personnel with Skills Relevant to the Risk- Informed Approach

Numerous NRC, industry, and academic officials we spoke with expressed concern that the transition to the new risk-informed approach could be delayed by a limited number of personnel with the necessary skills and training to design, review, and inspect against probabilistic risk assessments. Several nuclear unit officials told us that the pool of fire protection engineers with expertise in these areas is already heavily burdened with developing probabilistic risk assessments for the pilot program units and other units, including the 38 units that had already begun transitioning as of October 2007.

Academic experts, consultants, and industry officials told us that the current shortage of skilled personnel is due to (1) an increased demand for individuals with critical skills under the risk-informed approach and (2) a shortage of academic programs specializing in fire protection engineering. According to these experts and officials, the current number of individuals skilled in conducting probabilistic risk assessments is insufficient to handle the increased work expected to be generated by the transition to a risk-informed approach. NRC officials we spoke with expressed concern that the nuclear industry has not trained or developed sufficient personnel with needed fire protection skills. These officials also told us that they expect that, as demand for work increases, more engineering students will choose to go into the fire protection field. However, to date, only one university has undergraduate and graduate programs in the fire protection engineering field, and the ability to produce graduates is limited. Other officials we spoke with noted that engineers in other fields can be trained in fire protection but that this training takes a significant amount of time.

Academic experts and industry officials stated that without additional skilled personnel, units would not be able to perform all of the necessary activities, especially probabilistic risk assessments, within the 3-year enforcement discretion “window” that NRC has granted each transition unit as an incentive to adopt the new approach. Most nuclear units that responded to an industry survey on this issue indicated that they expected that they will need NRC to extend the discretion deadline for each unit. Delays in individual units’ transition processes could create a significant backlog in the entire transition process.

NRC also faces an aging workforce and the likelihood that it will be competing with industry for engineers with skills in the fire protection area. As we reported in January 2007, the agency as a whole faces significant human capital challenges, in part because approximately 33 percent of its workforce will be eligible to retire in 2010. To address this issue, we reported that NRC identified several critical skill gaps that it must address, such as civil engineering and operator licensing. In relation to needed skill areas, the agency has taken steps, including supporting key university programs, to attract greater numbers of students into mission- critical skills areas and to offer scholarships to those studying in these fields. In relation to fire protection, and probabilistic risk assessments in particular, NRC officials told us that they expect to address future resource needs through the use of a multiyear budget and by contracting with the Department of Energy’s National Laboratories to help manage the process. Further, these officials stated that part of the purpose of the pilot program is to help them determine future resource needs for the transition to the risk-informed approach, and, as a result, they do not intend to finalize resource planning until the pilot programs are complete. A number of experts in the engineering field, including academics and fire engineers, stated that it will be difficult for NRC to compete with industry over the projected numbers of graduates in this field over the next few years. Also, NRC’s total workload, in addition to fire protection, is expected to increase as nuclear unit operators submit license applications to build new units, extend the lives of existing units, or increase the generating capacity of existing units. For example, NRC staff are currently reviewing license applications for units at six sites and have recently announced that operators have submitted licenses for two additional units at a seventh site. The agency expects to review or receive 12 more applications during 2008.

Operators of 58 Nuclear Units Have Not Announced Whether They Will Transition to the New Approach, in Part Due to Concerns about NRC’s Risk-Assessment Guidance and Pilot Program Timetable

To date 58 of the nation’s 104 nuclear units have not announced whether they will adopt the risk-informed approach. NRC and industry officials stated that they expected that newer units and units with relatively few exemptions from existing regulations would be less likely to transition to the new approach, while those with older licenses and extensive exemptions would make the transition. However, to date, 25 units licensed prior to 1979 have yet to announce whether they will make the transition. Officials from nontransitioning units we visited told us that concerns over NRC’s guidance and time table have been key reasons why they have not yet announced their intent to transition.

According to industry and nuclear unit officials we spoke with, the costs associated with conducting fire probabilistic risk assessments for the units may be too high to justify transitioning to the new approach. For example, some officials told us that performing the necessary analysis of circuits and fire area features in support of the probabilistic risk assessment could cost millions of dollars without substantially improving fire safety. These officials noted that both pilot sites currently expect to spend approximately $5 million to $10 million each in transition costs, including circuit analysis. Some of these officials also noted that updating probabilistic risk assessments—which units are required to do every 3 years or whenever any significant changes are made to a unit—would require units to dedicate staff to this effort on a long term or permanent basis.

Officials at transition and nontransition units stated that NRC’s guidance for developing fire models that support probabilistic risk assessments is overly conservative. In effect, these models require engineers to assume that fires will result in massive damage, burn for significant periods of time, and require greater response and mitigation efforts than less conservative models. As such, these officials stated that the fire models provided by NRC guidance would not provide an accurate assessment of risk at a given unit. Furthermore, these officials stated that unit modifications required by the risk analysis could cost more than seeking exemptions from NRC. Some of these officials stated that they expect NRC to revise the probabilistic risk assessment guidance to facilitate the transition process in the future. NRC officials told us that nuclear units have the option to develop and conduct their own fire models rather than follow NRC’s guidance. Furthermore, in its initial review of one of the pilot unit’s probabilistic risk assessments, NRC agreed with industry that models used in the development of the probabilistic risk assessment contained some overly conservative aspects and recommended that the unit conduct additional analysis to address this. However, nuclear unit officials expressed concern that the costs of developing site-specific fire models, a process that includes numerous iterations, could be prohibitive.

Nuclear industry officials identified another area of concern in the current transition schedule, in which 22 units are expected to submit their license amendment requests for the risk-informed approach before NRC finishes assessing the license amendment requests for the pilot program units in March 2009. Although NRC has established a steering committee and a frequently asked question process to disseminate information learned in the ongoing pilot programs to other transition units, a number of nuclear unit officials expressed concern about beginning the transition process before the transition pilot programs are complete and lessons learned from the pilot programs are available. For example, an official at one of the pilot sites noted that the success of the pilot program probably will not be known until after the first triennial safety inspection conducted by NRC, which will occur after March 2009. The transition project manager for two nonpilot transition units expressed his opinion that, due to uncertainties regarding the work units must perform in order to comply with the risk-informed standard, no unit should commit itself to transitioning to the new approach until 2 years after the completion of the pilot programs.

Conclusions

NRC’s ability to regulate fire safety at nuclear power units has been adversely affected by several long-standing issues. To its credit, NRC has required that nuclear units come into compliance with requirements related to the use of unapproved operator manual actions by March 2009. However, NRC has not effectively resolved the long-term use of interim compensatory measures or the possibility of multiple spurious actuations. Especially critical, in our opinion, is the need for NRC to test and resolve the effectiveness of fire wraps at nuclear units, because units have instituted many manual actions and compensatory measures in response to fire wraps that were found lacking in effectiveness in various tests. Compounding these issues, NRC has no central database of exemptions, operator manual actions, and extended interim compensatory measures. Such a system would allow it to track trends in compliance, devise solutions to compliance issues, and help provide important information to NRC’s inspection activities.

Unless NRC deals effectively with these issues, units will likely continue to postpone making necessary repairs and replacements, choosing instead to rely on unapproved or undocumented manual actions as well as compensatory measures that, in some cases, continue for years. According to NRC, nuclear fire safety can be considered to be degraded when reliance on passive measures is supplanted by manual actions or compensatory measures. By taking prompt action to address the unapproved use of operator manual actions, long-term use of interim compensatory measures, the effectiveness of fire wraps, and multiple spurious actuations, NRC would provide greater assurance to the public that nuclear units are operated in a way that promotes fire safety. Despite the transition of 46 units to a new risk-informed approach, for which the implementation timeframes are uncertain, the majority of the nation’s nuclear units will remain under the existing regulatory approach, and the long-standing issues will continue to apply directly to them.

Recommendations for Executive Action

To address long-standing issues that have affected NRC’s regulation of fire safety at the nation’s commercial nuclear power units, we recommend that the NRC Commissioners direct NRC staff to take the following four actions: Develop a central database for tracking the status of exemptions, compensatory measures, and manual actions in place nationwide and at individual commercial nuclear units.

Address safety concerns related to extended use of interim compensatory defining how long an interim compensatory measure can be used and identifying the interim compensatory measures in place at nuclear units that exceed that threshold, assessing the safety significance of such extended compensatory measures and defining how long a safety-significant interim compensatory measure can be used before NRC requires the unit operator to make the necessary repairs or replacements or request an exemption or deviation from its fire safety requirements, and, developing a plan and deadlines for units to resolve those compensatory measures.

Address long-standing concerns about the effectiveness of fire wraps at commercial nuclear units by analyzing the effectiveness of existing fire wraps and undertaking efforts to ensure that the fire endurance tests have been conducted to qualify fire wraps as NRC-approved 1- or 3-hour fire barriers.

Address long-standing concerns by ensuring that nuclear units are able to safeguard against multiple spurious actuations by committing to a specific date for developing guidelines that units should meet to prevent multiple spurious actuations.

Agency Comments and Our Evaluation

We provided a draft of this report to the Commissioners of the Nuclear Regulatory Commission for their review and comment. In commenting on a draft of this report, NRC found that it was accurate, complete, and handled sensitive information appropriately and stated that it intends to give GAO’s findings and conclusions serious consideration. However, in its response, NRC did not provide comments on our recommendations. NRC’s comments are reprinted in appendix II.

We are sending copies of this report to the Commissioners of the Nuclear Regulatory Commission, the Nuclear Regulatory Commission’s Office of the Inspector General, and interested congressional committees. We will also make copies available to others on request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-3841 or gaffiganm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Scope and Methodology

To examine the number, causes, and reported safety significance of fire incidents at nuclear reactor units since 1995, we analyzed Nuclear Regulatory Commission (NRC) data on fires occurring at operating commercial nuclear reactor units from January, 1995, to December, 2007. NRC requires units to report fire events meeting certain criteria, including fires lasting longer than 15 minutes or those threatening safety. To assess the reliability of the data, we (1) interviewed NRC officials about the steps they take to ensure the accuracy of the data; (2) confirmed details about selected fire events, NRC inspection findings, and local emergency responders with unit management officials and NRC resident inspectors during site visits to nuclear power units; (3) reviewed NRC inspection reports related to fire protection; and (4) checked the data for obvious errors. We determined that the data were sufficiently reliable for the purposes of this report.

To examine what is known about nuclear reactor units’ compliance with NRC’s deterministic fire protection regulations, we reviewed the relevant fire protection regulations and guidance from NRC and industry. We also met with and reviewed documents provided by officials from NRC, industry, academia, and public interest groups. In particular, we interviewed officials from NRC’s Fire Protection Branch, Office of Enforcement, four regional offices, Office of the Inspector General, and Advisory Committee on Reactor Safeguards. In addition, we interviewed officials from the Nuclear Energy Institute, National Fire Protection Association, nuclear industry consultants, and nuclear insurance companies. We conducted site visits to nuclear power units, where we met with unit management officials and NRC resident inspectors. During these site visits, we discussed and received documentation on the use of operator manual actions, interim compensatory measures, and fire wraps, and we obtained views on multiple spurious actuations and their impact on safe shutdown. We also reviewed and discussed each unit’s corrective action plan. Finally, we observed multiple NRC public meetings and various collaborations with industry concerning issues related to compliance with NRC’s deterministic fire protection regulations.

To examine the status of the nuclear industry’s implementation of the risk- informed approach to fire safety advocated by NRC, we met with and reviewed documents provided by officials from NRC, industry, and public interest groups, as well as academic officials with research experience in fire safety and risk analysis. In particular, we interviewed officials from NRC’s Fire Protection Branch, Office of Enforcement, four regional offices, Office of the Inspector General, and Advisory Committee on Reactor Safeguards. We also interviewed officials from the Nuclear Energy Institute, National Fire Protection Association, nuclear industry consultants, and nuclear insurance companies. We conducted site visits to nuclear power units, where we met with unit management officials and NRC resident inspectors. During these site visits, we discussed and received documentation on the risk-informed approach to fire safety, including resource planning and analysis justifying decisions on whether or not to transition to NFPA-805. We also observed multiple NRC public meetings and collaborations with industry concerning issues related to the risk-informed approach to fire safety. Finally, we reviewed relevant fire protection regulations and guidance from NRC and industry.

In addressing each of our three objectives, we conducted visits to sites containing one or more commercial nuclear reactor units. These visits allowed us to obtain in-depth knowledge about fire protection at each site. We selected a nonprobability sample of sites to visit because certain factors—including custom designs that differ according to each nuclear unit, hundreds of licensing exemptions and deviations in place at units nationwide, and the geographic dispersal of units units across 31 states— complicate collecting data and reporting generalizations about the entire population of units. We chose 10 sites (totaling 20 operating nuclear reactor units out of a national total of 104 operating nuclear units) that provided coverage of each of NRC’s four regional offices and that represented varying levels of unit fire safety performance, unit licensing characteristics, reactor types, and NRC oversight. At the time of our visits, 5 of the 10 sites we visited (totaling 10 of the 20 nuclear reactor units we visited) had notified NRC that they intend to transition to the new risk- informed approach to fire safety. Over the course of our work, we visited the following sites: (1) D.C. Cook (2 units), located near Benton Harbor, Michigan; (2) Diablo Canyon (2 units), located near San Luis Obispo, California; (3) Dresden (2 units), located near Morris, Illinois; (4) Indian Point (2 units), located near New York, New York; (5) La Salle (2 units), located near Ottawa, Illinois; (6) Nine Mile Point (2 units), located near Oswego, New York; (7) Oconee (3 units), located near Greenville, South Carolina; (8) San Onofre (2 units), located near San Clemente, California; (9) Shearon Harris (1 unit), located near Raleigh, North Carolina; and (10) Vogtle (2 units), located near Augusta, Georgia.

We selected the nonprobability sample from the entire population of commercial nuclear power units currently operating in the United States. In order to capture variations that could play a role in how these units address fire safety, we designed our site visit selection criteria to represent the following: (1) geographic diversity; (2) units licensed to operate before and after 1979; (3) sites choosing to remain under the deterministic regulations and those transitioning to the risk-informed approach; (4) pressurized and boiling water reactor types; (5) a variety of safety problems in which inspection findings or performance indicators of higher risk significance (white, yellow, or red) were issued; (6) units that have been subjected to at least some level of increased oversight since regular fire inspections were initiated in 2000; and (7) sites with various numbers of fires reportable to NRC since 1995. We received feedback on our selection criteria from nuclear insurance company officials, nuclear industry consultants, NRC officials, and academic officials with research experience in fire safety and risk analysis. We interviewed NRC resident inspectors and unit management officials at each site to learn about the fire protection program at the site. We also observed fire protection features at each site, including safe-shutdown equipment and areas of the units where operator manual actions, interim compensatory measures, and fire wraps are used for fire safety. Finally, we observed part of an NRC triennial fire inspection at one site.

We conducted this performance audit from September 2007 to June 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Nuclear Regulatory Commission

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Ernie Hazera (Assistant Director), Cindy Gilbert, Chad M. Gorman, Mehrzad Nadji, Omari Norman, Alison O’Neill, Steve Rossman, and Jena Sinkfield made key contributions to this report.

Related GAO Products

Nuclear Energy: NRC Has Made Progress in Implementing Its Reactor Oversight and Licensing Processes but Continues to Face Challenges. GAO-08-114T. Washington, D.C.: October 3, 2007.

Nuclear Energy: NRC’s Workforce and Processes for New Reactor Licensing are Generally in Place, but Uncertainties Remain as Industry Begins to Submit Applications. GAO-07-1129. Washington, D.C.: September 21, 2007.

Human Capital: Retirements and Anticipated New Reactor Applications Will Challenge NRC’s Workforce. GAO-07-105. Washington, D.C.: January 17, 2007.

Nuclear Regulatory Commission: Oversight of Nuclear Power Plant Safety Has Improved, but Refinements Are Needed. GAO-06-1029. Washington, D.C.: September 27, 2006.

Nuclear Regulatory Commission: Preliminary Observations on Its Process to Oversee the Safe Operation of Nuclear Power Plants. GAO-06-888T. Washington, D.C.: June 19, 2006.

Nuclear Regulatory Commission: Preliminary Observations on Its Oversight to Ensure the Safe Operation of Nuclear Power Plants. GAO-06-886T. Washington, D.C.: June 15, 2006.

Nuclear Regulatory Commission: Challenges Facing NRC in Effectively Carrying Out Its Mission. GAO-05-754T. Washington, D.C.: May 26, 2005.

Nuclear Regulation: Challenges Confronting NRC in a Changing Regulatory Environment. GAO-01-707T. Washington, D.C.: May 8, 2001.

Major Management Challenges and Performance Risks: Nuclear Regulatory Commission. GAO-01-259. Washington, D.C.: January 2001.

Fire Protection: Barriers to Effective Implementation of NRC’s Safety Oversight Process. GAO/RCED-00-39. Washington, D.C.: April 19, 2000.

Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC. GAO/T-RCED-00-115. Washington, D.C.: March 9, 2000.

Nuclear Regulatory Commission: Strategy Needed to Develop a Risk- Informed Safety Approach. GAO/T-RCED-99-071. Washington, D.C.: February 4, 1999.