Nuclear Safety
NRC's Oversight of Fire Protection at U.S. Commercial Nuclear Reactor Units Could Be Strengthened Gao ID: GAO-08-747 June 30, 2008After a 1975 fire at the Browns Ferry nuclear plant in Alabama threatened the unit's ability to shut down safely, the Nuclear Regulatory Commission (NRC) issued prescriptive fire safety rules for commercial nuclear units. However, nuclear units with different designs and different ages have had difficulty meeting these rules and have sought exemptions to them. In 2004, NRC began to encourage the nation's 104 nuclear units to transition to a less prescriptive, risk-informed approach that will analyze the fire risks of individual nuclear units. GAO was asked to examine (1) the number and causes of fire incidents at nuclear units since 1995, (2) compliance with NRC fire safety regulations, and (3) the transition to the new approach. GAO visited 10 of the 65 nuclear sites nationwide, reviewed NRC reports and related documentation about fire events at nuclear units, and interviewed NRC and industry officials to examine compliance with existing fire protection rules and the transition to the new approach.
According to NRC, all 125 fires at 54 of the nation's 65 nuclear sites from January 1995 through December 2007 were classified as being of limited safety significance. According to NRC, many of these fires were in areas that do not affect shutdown operations or occurred during refueling outages, when nuclear units are already shut down. NRC's characterization of the location, significance, and circumstances of those fire events was consistent with records GAO reviewed and statements of utility and industry officials GAO contacted. NRC has not resolved several long-standing issues that affect the nuclear industry's compliance with existing NRC fire regulations, and NRC lacks a comprehensive database on the status of compliance. These long-standing issues include (1) nuclear units' reliance on manual actions by unit workers to ensure fire safety (for example, a unit worker manually turns a valve to operate a water pump) rather than "passive" measures, such as fire barriers and automatic fire detection and suppression; (2) workers' use of "interim compensatory measures" (primarily fire watches) to ensure fire safety for extended periods of time, rather than making repairs; (3) uncertainty regarding the effectiveness of fire wraps used to protect electrical cables necessary for the safe shutdown of a nuclear unit; and (4) mitigating the impacts of short circuits that can cause simultaneous, or near-simultaneous, malfunctions of safety-related equipment (called "multiple spurious actuations") and hence complicate the safe shutdown of nuclear units. Compounding these issues is that NRC has no centralized database on the use of exemptions from regulations, manual actions, or compensatory measures used for long periods of time that would facilitate the study of compliance trends or help NRC's field inspectors in examining unit compliance. Primarily to simplify units' complex licensing, NRC is encouraging nuclear units to transition to a risk-informed approach. As of April 2008, some 46 units had stated they would adopt the new approach. However, the transition effort faces significant human capital, cost, and methodological challenges. According to NRC, as well as academics and the nuclear industry, a lack of people with fire modeling, risk assessment, and plant-specific expertise could slow the transition process. They also expressed concern about the potentially high costs of the new approach relative to uncertain benefits. For example, according to nuclear unit officials, the costs to perform the necessary fire analyses and risk assessments could be millions of dollars per unit. Units, they said, may also need to make costly new modifications as a result of these analyses.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-747, Nuclear Safety: NRC's Oversight of Fire Protection at U.S. Commercial Nuclear Reactor Units Could Be Strengthened
This is the accessible text file for GAO report number GAO-08-747
entitled 'Nuclear Safety: NRC's Oversight of Fire Protection at U.S.
Commercial Nuclear Reactor Units Could Be Strengthened' which was
released on June 30, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Requesters:
United States Government Accountability Office:
GAO:
June 2008:
Nuclear Safety:
NRC's Oversight of Fire Protection at U.S. Commercial Nuclear Reactor
Units Could Be Strengthened:
GAO-08-747:
GAO Highlights:
Highlights of GAO-08-747, a report to congressional requesters.
Why GAO Did This Study:
After a 1975 fire at the Browns Ferry nuclear plant in Alabama
threatened the unit‘s ability to shut down safely, the Nuclear
Regulatory Commission (NRC) issued prescriptive fire safety rules for
commercial nuclear units. However, nuclear units with different designs
and different ages have had difficulty meeting these rules and have
sought exemptions to them. In 2004, NRC began to encourage the nation‘s
104 nuclear units to transition to a less prescriptive, risk-informed
approach that will analyze the fire risks of individual nuclear units.
GAO was asked to examine (1) the number and causes of fire incidents at
nuclear units since 1995, (2) compliance with NRC fire safety
regulations, and (3) the transition to the new approach.
GAO visited 10 of the 65 nuclear sites nationwide, reviewed NRC reports
and related documentation about fire events at nuclear units, and
interviewed NRC and industry officials to examine compliance with
existing fire protection rules and the transition to the new approach.
What GAO Found:
According to NRC, all 125 fires at 54 of the nation‘s 65 nuclear sites
from January 1995 through December 2007 were classified as being of
limited safety significance. According to NRC, many of these fires were
in areas that do not affect shutdown operations or occurred during
refueling outages, when nuclear units are already shut down. NRC‘s
characterization of the location, significance, and circumstances of
those fire events was consistent with records GAO reviewed and
statements of utility and industry officials GAO contacted.
NRC has not resolved several long-standing issues that affect the
nuclear industry‘s compliance with existing NRC fire regulations, and
NRC lacks a comprehensive database on the status of compliance. These
long-standing issues include (1) nuclear units‘ reliance on manual
actions by unit workers to ensure fire safety (for example, a unit
worker manually turns a valve to operate a water pump) rather than
’passive“ measures, such as fire barriers and automatic fire detection
and suppression; (2) workers‘ use of ’interim compensatory measures“
(primarily fire watches) to ensure fire safety for extended periods of
time, rather than making repairs; (3) uncertainty regarding the
effectiveness of fire wraps used to protect electrical cables necessary
for the safe shutdown of a nuclear unit; and (4) mitigating the impacts
of short circuits that can cause simultaneous, or near-simultaneous,
malfunctions of safety-related equipment (called ’multiple spurious
actuations“) and hence complicate the safe shutdown of nuclear units.
Compounding these issues is that NRC has no centralized database on the
use of exemptions from regulations, manual actions, or compensatory
measures used for long periods of time that would facilitate the study
of compliance trends or help NRC's field inspectors in examining unit
compliance.
Primarily to simplify units‘ complex licensing, NRC is encouraging
nuclear units to transition to a risk-informed approach. As of April
2008, some 46 units had stated they would adopt the new approach.
However, the transition effort faces significant human capital, cost,
and methodological challenges. According to NRC, as well as academics
and the nuclear industry, a lack of people with fire modeling, risk
assessment, and plant-specific expertise could slow the transition
process. They also expressed concern about the potentially high costs
of the new approach relative to uncertain benefits. For example,
according to nuclear unit officials, the costs to perform the necessary
fire analyses and risk assessments could be millions of dollars per
unit. Units, they said, may also need to make costly new modifications
as a result of these analyses.
What GAO Recommends:
GAO recommends that NRC obtain and monitor data on the status of
compliance with its fire safety regulations, and address long-standing
fire safety issues concerning interim compensatory measures, fire wrap
effectiveness, and multiple spurious actuations. NRC commented the
report was accurate and complete but did not address the
recommendations.
To view the full product, including the scope and methodology, click on
[http://www.gao.gov/cgi-bin/getrpt?GAO-08-747]. For more information,
contact Mark Gaffigan at (202) 512-3841 or gaffiganm@gao.gov
[End of section]
Contents:
Letter:
Results in Brief:
Background:
According to NRC, Recent Fires at U.S. Commercial Nuclear Units Have
Had Limited Safety Significance:
NRC Has Not Resolved Long-standing Issues Affecting Industry's
Compliance with NRC's Fire Regulations:
To Date, 46 Nuclear Unit Operators Have Announced They Will Adopt a New
Risk-Informed Approach to Fire Safety, but the Transition Effort Faces
Challenges:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Nuclear Regulatory Commission:
Appendix III: GAO Contact and Staff Acknowledgments:
Related GAO Products:
Tables:
Table 1: Characteristics of Fires Rising to "Alert" Status at U.S.
Commercial Nuclear Units, 1995-2007:
Table 2: Information on Reported Causes of Fires at Nuclear Units from
January 1995 through December 2007:
Figure:
Figure 1: The 46 Commercial Nuclear Reactors in the United States That
Are Transitioning to the Risk-Informed Approach, as of May 2008:
Abbreviations:
NFPA: National Fire Protection Association:
NRC: Nuclear Regulatory Commission:
United States Government Accountability Office:
Washington, DC 20548:
June 30, 2008:
The Honorable Peter Visclosky:
Chairman:
Subcommittee on Energy and Water Development:
Committee on Appropriations:
House of Representatives:
The Honorable David Price:
House of Representatives:
On March 22, 1975, a fire involving electrical cables at unit 1 of the
three-unit Browns Ferry nuclear power plant in Alabama damaged numerous
safety systems and reduced unit operators' ability to monitor the
nuclear unit. The fire raised awareness of the potential danger that
fires pose to the ability of the nation's commercial nuclear units to
safely shutdown. The Nuclear Regulatory Commission (NRC), which
approves nuclear units' licenses to operate, responded by issuing
numerous guidance documents and in 1980 promulgating new fire safety
regulations for nuclear units. These regulations, commonly called
Appendix R, are intended to (1) prevent fires from starting; (2)
rapidly detect, control, and extinguish fires that do occur; and (3)
protect a nuclear unit's structures, systems, and components important
to safety so that a fire that is not promptly extinguished will not
prevent its safe shutdown.[Footnote 1]
NRC's fire safety regulations for the nation's commercial nuclear units
establish the design requirements in commercial nuclear reactor units
for mitigating the effects of a fire on the unit's ability to shut down
safely. As of May 2008, 104 commercial nuclear units operated at 65
sites in 31 states, with between one and three units located at each
site. Among other things, these prescriptive (or deterministic)
regulations call for nuclear units to have at least one redundant
system of electric cables and equipment available to safely shut down
the unit free from fire damage. When two such systems are in the same
area of a nuclear unit, the regulations require that they be separated
(1) horizontally by at least 20 feet with automatic fire suppression
and detections systems and without intervening combustibles or (2) by a
fire barrier, such as a fire-proof wall or floor, or by a material
(fire wrap) that protects important cables.[Footnote 2] The fire
barriers must be able to withstand fire for at least 1 hour in areas
with automatic fire detection and suppression equipment, such as smoke
detectors and sprinklers, or at least 3 hours where such features are
not present. NRC required nuclear units that were operating prior to
January 1, 1979, to make necessary modifications, if possible, to meet
NRC's fire regulations or request exemptions from the requirements.
Units that NRC licensed after that date incorporate the principles of
NRC's fire regulations as conditions to their operating licenses.
Over the years, NRC approved exemptions or deviations[Footnote 3] from
the fire regulations for units that could not meet the regulations if
these units could otherwise demonstrate the ability to safely shut
down. According to NRC's records, by 2001 NRC had granted over 900
exemptions for the nation's nuclear units. Many of these exemptions
take the form of operator manual actions, whereby nuclear unit staff
manually activate or control unit functions by hand outside of the
unit's control room, such as stopping a pump that malfunctions during a
fire and could impair a unit's ability to safely shut down. In
addition, NRC allows nuclear units, in accordance with their NRC-
approved fire protection program, to institute interim compensatory
measures, which are temporary measures that units can take without
prior approval to compensate for equipment that needs to be repaired or
replaced. These interim compensatory measures often consist of roving
or continuously manned fire watches[Footnote 4] that occur while
nuclear units take corrective actions. Under NRC rules, the repairs or
replacements should take place as soon as practicable, thereby limiting
the time an interim compensatory measure is in effect. Many operator
manual actions or interim compensatory measures were instituted because
some fire wraps did not meet the requirements to withstand a fire for 1
hour or 3 hours. In lieu of reliance on such a fire wrap, a unit might
opt to use a fire watch as an interim compensatory measure while
repairs are made.
In 2004, NRC issued a regulation that allowed the transition of nuclear
units from its existing, prescriptive fire safety regulations to a less
prescriptive, risk-informed, performance-based approach that complies
with the National Fire Protection Association (NFPA) standard
805.[Footnote 5] Under this approach, nuclear units can use tools, such
as fire modeling and risk analysis, to determine which areas of the
unit are most at risk from fire. According to NRC officials, these
analyses could enable units to focus their resources on addressing
these higher-risk areas and reduce the number of future exemptions in
areas that are no longer considered to be at high risk from fire.
Reductions in exemptions would, thus, simplify the units' licenses.
Resolving any issues about the fire safety of nuclear units will be
important for assuring the public that nuclear power is safe. Providing
such assurances is especially significant given the scope of the
nuclear power industry's plans for expanding the nation's capacity to
generate electricity using nuclear reactors. According to the Nuclear
Energy Institute, which represents the nuclear power industry, as of
April 2008, electric utilities planned to build 29 new nuclear power
units at 23 sites nationwide. Currently, 104 nuclear units are
operating in the nation, so the planned expansion will be significant.
In this context, we were asked to examine (1) the number, reported
safety significance, and causes of fire incidents at U.S. nuclear units
since 1995, (2) commercial nuclear reactor units' compliance with NRC's
fire protection regulations, and (3) the status of the nuclear
industry's implementation of the risk-informed approach to fire safety
advocated by NRC.
In conducting our work, we met with officials from NRC, industry,
public interest groups, and experts on fire safety and risk analysis in
academia and government. We also selected and visited 10 nuclear unit
sites, constituting a sample that is not generalizable to all nuclear
units at all nuclear unit sites. We selected sites based on covering
each of NRC's four regional offices, varying levels of unit
performance, different unit licensing characteristics, and reactor
types. At each site visit, we reviewed documentation on fire events,
use of operator manual actions and interim compensatory measures, and
analysis justifying decisions about whether to transition to the risk-
informed approach. In addition, we reviewed fire event data from NRC
and the industry for all fires in calendar years 1995 through 2007 to
provide us with a reasonable time frame of data. Finally, we reviewed
relevant fire protection regulations and guidance from NRC and
industry.[Footnote 6]
We conducted this performance audit from September 2007 to June 2008 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Results in Brief:
According to NRC, nuclear unit operators reported 125 fires at 54 sites
from January 1995 through December 2007; all were classified as having
limited safety significance, and no fire since the 1975 Browns Ferry
fire has threatened a nuclear unit's ability to safely shut
down.[Footnote 7] The most commonly reported cause of fires was
electrical followed by maintenance-related causes and the ignition of
oil-based lubricants or coolant. Although 13 fires were classified as
significant alerts, and some of these fires damaged or destroyed unit
equipment, NRC officials stated that none of these fires degraded
units' safe shutdown capabilities or resulted in damage to nuclear
units' core or containment buildings. These officials noted that most
of these fires occurred in areas that do not affect shutdown operations
or happened during refueling outages, when nuclear units are already
shut down.
NRC has not fully resolved the long-standing issues that complicate the
commercial nuclear industry's compliance with NRC's fire regulations;
moreover, NRC lacks a comprehensive database on the use of exemptions,
manual actions, and compensatory measures for long periods of time that
would facilitate the study of compliance trends or help NRC's field
inspectors in examining unit compliance. Specifically, these issues
include:
* The use of operator manual actions. After regular triennial fire
inspections began in 2000, NRC fire safety inspectors found that
nuclear units were using unapproved or undocumented operator manual
actions. Nuclear unit operators told us that, in some cases, NRC
officials approved these actions verbally but did not document their
approval in writing; however, in other cases, unit officials said they
applied operator manual actions that were not explicitly approved by
NRC but that NRC had approved for similar situations. NRC has directed
nuclear units to resolve these issues by March 2009, either by applying
for licensing exemptions for these operator manual actions or by
modifying the units' designs. Compounding this issue is a lack of a
centralized database of approved manual actions (exemptions), as well
as those that are unapproved or undocumented.
* The long-term use of interim compensatory measures. Some nuclear
units have used compensatory measures for extended periods of time--for
years, in some cases--rather than repairing or replacing the damaged
equipment. For example, at one nuclear unit we visited, unit staff used
fire watches for more than 5 years instead of replacing faulty seals to
cover openings in structural barriers. Although NRC guidance tells
units to repair fire protection features as quickly as possible, it
does not specify how long units can rely on interim compensatory
measures. NRC has no immediate plans for resolving this issue.
Compounding this issue is a lack of a centralized database of
compensatory measures that can be used for long periods of time.
* Concerns about the effectiveness of fire wraps. NRC has not resolved
the uncertainty regarding the effectiveness of some types of fire wraps
used to protect cables that are important for safely shutting down the
nuclear units. Until this issue is resolved, nuclear unit operators are
continuing to rely on operator manual actions and interim compensatory
measures. During testimony before Congress in 1993, a then-NRC chairman
committed to assess the effectiveness of fire wraps, and NRC officials
maintain that the agency has satisfied this commitment. According to
NRC officials, licensees are responsible for conducting endurance tests
on fire wraps used at nuclear units. However, in January 2008 the NRC
Office of Inspector General reported that no fire endurance tests have
been conducted to qualify a key fire wrap as an NRC-approved 1-or 3-
hour fire barrier.
* Mitigating the effects of short circuits on safety-related equipment.
Nuclear units must plan for short circuits that could cause safety-
related equipment to start or malfunction spuriously (instances called
spurious actuations). To date, units typically account only for
spurious actuations that occur one at a time or in isolation. In 2001,
industry tests demonstrated that spurious actuations could occur
simultaneously or in rapid succession and that units' current fire
protection plans do not account for this possibility. NRC has not
endorsed guidance or developed a timeline for industry to resolve this
issue, but NRC staff stated they expect to recommend a plan of action
by June 2008.
As of May 2008, 46 nuclear units had announced they would adopt the new
risk-informed approach to fire safety that NRC is endorsing. Four
nuclear units are piloting the new approach, and NRC plans to evaluate
the results for the pilot program units by March 2009. According to NRC
officials, 22 additional units will begin submitting their license
amendment requests for the risk-informed approach by March 2009.
Operators at the units that plan to adopt the new approach told us that
identifying and focusing their resources on the areas most at risk from
fire and areas that are significant to safely shutting down the unit
would help them better focus their resources and reduce the need for
some operator manual actions to meet regulations. However, experts we
contacted noted that while the risk-informed approach may have some
safety benefits, the small number of fires at nuclear units has
resulted in limited real-world data for use in the probabilistic risk
assessments that units will conduct under the new approach. NRC and
nuclear unit operators also face possible shortages of personnel with
expertise in developing and evaluating probabilistic risk assessments
and related analyses, which could delay the transition process.
Operators of some of the 58 nuclear units that have not indicated their
intention to adopt the new approach also said the costs and outcomes of
the new approach are uncertain. For example, the operators believe that
NRC's guidance for conducting the fire models that are used in the
probabilistic risk assessments assumes worst-case fire scenarios, and
thus the resulting analyses would not provide a realistic assessment of
risk. According to these officials, following those fire models could
require them to spend millions of dollars to install modifications that
likely would not provide a substantial increase in safety. These
officials also questioned NRC's encouragement of units to adopt the new
risk-informed approach before the two pilot programs are complete.
We are recommending that the Commissioners direct NRC staff to (1)
develop a central database for tracking the status of exemptions,
manual actions, and compensatory measures used for long periods of time
both nationwide and at individual commercial nuclear units; (2) address
safety concerns related to the extended use of interim compensatory
measures; (3) analyze the effectiveness of existing fire wraps and
undertake efforts to ensure that the fire endurance tests have been
conducted to qualify fire wraps as NRC-approved 1-or 3-hour fire
barriers; and (4) ensure that nuclear units are able to safeguard
against multiple spurious actuations by committing to a specific date
for developing guidelines to prevent multiple spurious actuations.
In commenting on a draft of this report, NRC found that it was
accurate, complete, and handled sensitive information appropriately and
stated that it intends to give GAO's findings and conclusions serious
consideration. However, in its response, NRC did not provide comments
on our recommendations. NRC's comments are reprinted in appendix II.
Background:
In 1971, the Atomic Energy Commission,[Footnote 8] NRC's predecessor,
promulgated the first regulations for fire protection at commercial
nuclear power units in the United States. These regulations--referred
to as General Design Criterion 3--provided basic design requirements
and broad performance objectives for fire protection,[Footnote 9] but
lacked implementation guidance or assessment criteria. As such, NRC
generally deemed a unit's fire protection program to be adequate if it
complied with standards set by the National Fire Protection Association
(NFPA)--an international organization that promotes fire prevention and
safety--and received an acceptable rating from a major fire insurance
company.[Footnote 10] However, at that time the fire safety
requirements for commercial nuclear power units were similar to those
for conventional, fossil-fueled power units.
NRC and nuclear industry officials did not fully perceive that fires
could threaten a nuclear unit's ability to safely shut down until 1975,
when a candle that a worker at Browns Ferry nuclear unit 1 was using to
test for air leaks in the reactor building ignited electrical cables.
The resulting fire burned for 7 hours and damaged more than 1,600
electrical cables, more than 600 of which were important to unit
safety. Nuclear unit workers eventually used water to extinguish the
fire, contrary to the existing understanding of how to put out an
electrical fire. The fire damaged electrical power, control systems,
and instrumentation cables and impaired cooling systems for the
reactor. During the fire, operators could not monitor the unit
normally.
NRC's investigation of the Browns Ferry fire revealed deficiencies in
the design of fire protection features at nuclear units and in
procedures for responding to a fire, particularly regarding safety
concerns that were unique to nuclear units, such as the ability to
protect redundant electrical cables and equipment important for the
safe shutdown of a reactor.[Footnote 11] In response, NRC developed new
guidance in 1976 that required units to take steps to isolate and
protect at least one system of electrical cables and equipment to
ensure a nuclear unit could be safely shut down in the event of a fire.
NRC worked with licensees throughout the late 1970s to help them meet
this guidance.
In November 1980, NRC published two new sets of regulations to
formalize the regulatory approach to fire safety. First, NRC required
all nuclear units to have a fire protection plan that satisfies General
Design Criteria 3 and that describes an overall fire protection
program.[Footnote 12] Second, NRC published Appendix R,[Footnote 13]
which requires nuclear units operating prior to January 1, 1979 (called
"pre-1979 units"), to implement design features--such as fire walls,
fire wraps, and automatic fire detection and suppression systems--to
protect a redundant system of electrical cables and equipment necessary
to safely shut down a nuclear unit during a fire. Among other things,
Appendix R requires units operating prior to 1979 to protect one set of
cables and equipment necessary for safe shutdown through one of the
following means:[Footnote 14]
1. Separating the electrical cables and equipment necessary for safe
shutdown by a horizontal distance of more than 20 feet from other
systems, with no combustibles or fire hazards between them. In
addition, fire detectors and an automatic fire suppression system (for
example, a sprinkler system) must be installed in the fire area.
2. Protecting the electrical cables and equipment necessary for safe
shutdown by using a fire barrier able to withstand a 3-hour fire, as
conducted in a laboratory test (thereby receiving a 3-hour rating).
3. Enclosing the cable and equipment necessary for safe shutdown by
using a fire barrier with a 1-hour rating and combining that with
automatic fire detectors and an automatic fire suppression system.
If a nuclear unit's fire protection systems do not satisfy those
requirements or if redundant systems required for safe shutdown could
be damaged by fire suppression activities, Appendix R requires the
nuclear unit to maintain an alternative or dedicated shutdown
capability and its associated circuits. Moreover, Appendix R requires
all units to provide emergency lighting in all areas needed for
operating safe shutdown equipment.[Footnote 15]
Nuclear units that began operating on or after January 1, 1979 (called
"post-1979 units") must satisfy the broad requirements of General
Design Criteria 3[Footnote 16] but are not subject to the requirements
of Appendix R. However, NRC has imposed or attached conditions similar
to the requirements of Appendix R to these units' operating licenses.
When promulgating these regulations, NRC recognizes that strict
compliance for some older units would not significantly enhance the
level of fire safety. In those cases, NRC allows nuclear units licensed
before 1979 to apply for an exemption to Appendix R. The exemption
depends on if the nuclear unit can demonstrate to NRC that existing or
alternative fire protection features provided safety equivalent to
those imposed by the regulations.[Footnote 17] Since 1981, NRC has
issued approximately 900 unit-specific exemptions to Appendix R.
Nuclear units licensed after 1979 can apply for "deviations" against
their licensing conditions.[Footnote 18]
Many exemptions take the form of NRC-approved operator manual actions,
whereby nuclear unit staff manually activate or control unit operations
from outside the unit's control room, such as manually stopping a pump
that malfunctions during a fire and could affect a unit's ability to
safely shut down. NRC also allows nuclear units to institute, in
accordance with their NRC-approved fire protection program, "interim
compensatory measures"--temporary measures that units can take without
prior approval to compensate for equipment that needs to be repaired or
replaced. Interim compensatory measures often consist of roving or
continuously staffed fire watches that occur while nuclear units take
corrective actions.
In part to simplify the licensing of nuclear units that have many
exemptions, NRC recently began encouraging units to transition to a
more risk-informed approach to nuclear safety in general. In 2004, NRC
promulgated 10 C.F.R. 50.48(c), which allows--but does not require--
nuclear units to adopt a risk-informed approach to fire protection. The
risk-informed approach considers the probability of fires in
conjunction with a unit's engineering analysis and operating
experience. The NRC rule allows licensees to voluntarily adopt and
maintain a fire protection program that meets criteria set forth by the
NFPA's fire protection standard 805[Footnote 19]--which describes the
risk-informed approach endorsed by NRC--as an alternative to meeting
the requirements or unit-specific fire-protection license conditions
represented by Appendix R and related rules and guidance. Nuclear units
that choose to adopt the risk-informed approach must submit a license
amendment request to NRC asking NRC to approve the unit's adoption of
the new risk-informed, regulatory approach.[Footnote 20] NRC is
overseeing a pilot program at two nuclear unit locations and expects to
release its evaluation report on these programs by March 2009.
According to NRC, Recent Fires at U.S. Commercial Nuclear Units Have
Had Limited Safety Significance:
NRC officials told us that none of the 125 fires at 54 sites[Footnote
21] that nuclear unit operators reported from January 1995 to December
2007 has posed significant risk to a commercial unit's ability to
safely shut down. No fires since the 1975 Browns Ferry fire have
threatened a nuclear unit's ability to safely shut down.[Footnote 22]
Most of the 125 fires occurred outside areas that are considered
important for safe shutdown of the unit or happened during refueling
outages when nuclear units were already shut down.
Nuclear units categorized 13 of the 125 reported fires as "alerts"
under NRC's Emergency Action Level rating system, meaning that the
reported situation involved an actual or potential substantial
degradation of unit safety, but none of the fires actually threatened
the safe shutdown of the unit. NRC further characterizes alerts as
providing early and prompt notification of minor events that could lead
to more serious consequences. As shown in the table 1, the primary
reported causes of these fires were electrical fires.
Table 1: Characteristics of Fires Rising to "Alert" Status at U.S.
Commercial Nuclear Units, 1995-2007:
Year: 2007;
Unit: Arkansas Nuclear One, Unit 2;
State: Arkansas;
Location within unit: Auxiliary building;
Cause: Electrical.
Year: 2007;
Unit: Columbia Generating Station;
State: Washington;
Location within unit: Equipment room;
Cause: Electrical.
Year: 2007;
Unit: Callaway Nuclear Plant;
State: Missouri;
Location within unit: Control building;
Cause: Electrical.
Year: 2006;
Unit: Arkansas Nuclear One, Unit 2;
State: Arkansas;
Location within unit: Breaker compartment;
Cause: Electrical.
Year: 2006;
Unit: Perry Nuclear Power Plant;
State: Ohio;
Location within unit: Ventilation fan;
Cause: Bearing.
Year: 2003;
Unit: Palisades Power Plant;
State: Michigan;
Location within unit: Cable spreading room;
Cause: Electrical.
Year: 2002;
Unit: D.C. Cook Nuclear Plant;
State: Michigan;
Location within unit: Switchyard;
Cause: Electrical.
Year: 2001;
Unit: Cooper Nuclear Station;
State: Nebraska;
Location within unit: Startup transformer;
Cause: Unreported.
Year: 2001;
Unit: Fermi Unit 2;
State: Michigan;
Location within unit: Emergency diesel generator;
Cause: Bearing.
Year: 2000;
Unit: Farley Unit 2;
State: Alabama;
Location within unit: Service water pump motor;
Cause: Unreported.
Year: 1998;
Unit: Fermi Unit 2;
State: Michigan;
Location within unit: Emergency diesel generator;
Cause: Unreported.
Year: 1997;
Unit: Limerick Generating Station Unit 2;
State: Pennsylvania;
Location within unit: Emergency diesel generator exhaust;
Cause: Unreported.
Year: 1996;
Unit: Clinton Power Station;
State: Illinois;
Location within unit: Pump turbine insulation;
Cause: Oil-Soaked Insulation.
Source: GAO analysis of NRC data.
[End of table]
Nuclear units classified the remaining 112 reported fires in categories
that do not imply a threat to safe shutdown. Specifically, 73 were
characterized as being "unusual events"--a category that is less safety-
significant than "alerts"--and 39 fires as being "non- emergencies." No
reported fire event rose to the level of "site area emergency" or
"general emergency"--the two most severe ratings in the Emergency
Action Level system.[Footnote 23]
As shown in table 2 below, about 41 percent of the 125 reported fires
were electrical fires, 14 percent were maintenance related, 7 percent
were caused by oil-based lubricants or insulation, and the remaining 38
percent either had no reported causes or the causes were listed as
"other," including brush fires, cafeteria grease fires, and lightning.
Table 2: Information on Reported Causes of Fires at Nuclear Units from
January 1995 through December 2007:
Cause of fire: Electrical-related;
Number of reported fire events: 51;
Percentage of total reported fire events: 41.
Cause of fire: Maintenance-related;
Number of reported fire events: 17;
Percentage of total reported fire events: 14.
Cause of fire: Oil-based lubricants or insulation;
Number of reported fire events: 9;
Percentage of total reported fire events: 7.
Cause of fire: Other causes[A] or cause not reported;
Number of reported fire events: 48;
Percentage of total reported fire events: 38.
Cause of fire: Totals;
Number of reported fire events: 125;
Percentage of total reported fire events: 100.
Source: GAO analysis of NRC data.
[A] Includes brush fires, cafeteria grease fires, and lightning.
[End of table]
We also gathered information on fire events that had occurred at
nuclear unit sites we visited. NRC's data on the location and
circumstances surrounding fire events was consistent with the
statements of unit officials whom we contacted at selected nuclear
units. Although unit officials told us that some recent fires
necessitated the response of off-site fire departments to supplement
the units' on-site firefighting capabilities, they confirmed that none
of the fires adversely affected the units' ability to safely shut down.
Additionally, officials at two units told us that, although fires
affected the units' auxiliary power supply, the events caused both
units to "trip"--an automatic power down as a precaution in
emergencies.
NRC Has Not Resolved Long-standing Issues Affecting Industry's
Compliance with NRC's Fire Regulations:
NRC has not fully resolved several long-standing issues that affect the
commercial nuclear industry's compliance with existing NRC fire
regulations. These issues include (1) nuclear units' use of operator
manual actions; (2) nuclear units' long-term use of interim
compensatory measures; (3) uncertainties regarding the effectiveness of
fire wraps for protecting electrical cables necessary for the safe
shutdown of a nuclear unit; and (4) the regulatory treatment of fire-
induced multiple spurious actuations of equipment that could prevent
the safe shutdown of a nuclear unit. Moreover, NRC lacks a central
system of records that would enhance its ability to oversee and address
the use of operator manual actions and extended interim compensatory
measures, among other related issues. According to an NRC Commissioner,
the current "patchwork of requirements" is characterized by too many
exemptions, as well as by unapproved or undocumented operator manual
actions. He said the current regulatory situation was not the ideal,
transparent, or safest way to deal with the issue of fire safety.
Many Nuclear Units Are Using Operator Manual Actions That May Not
Comply with NRC's Fire Regulations:
NRC's oversight of fire safety is complicated by nuclear units' use of
operator manual actions that NRC has not explicitly approved. NRC's
initial Appendix R regulations required that nuclear units protect at
least one redundant system--or "train"--of equipment and electrical
cables required for a unit's safe shutdown through the use of fire
protection measures, such as 1-hour or 3-hour fire barriers, 20 feet of
separation between redundant systems, and automatic fire detection and
suppression systems.[Footnote 24] The regulations do not list operator
manual actions as a means of protecting a redundant system from fire.
However, according to NRC officials and NRC's published guidance, units
licensed before January 1979 can receive approval for a specific
operator manual action by applying for a formal exemption to the
regulations. For example, unit officials at one site told us they rely
on 584 operator manual actions that are approved by 15 NRC exemptions
for safe shutdown. (NRC allows units to submit multiple operator manual
actions under one exemption.) Units licensed after January 1979 may use
operator manual actions for fire protection if these actions are
permitted by the unit's license and if the unit can demonstrate that
the actions will not adversely affect safe shutdown. NRC and nuclear
unit officials told us that units have been using operator manual
actions since Appendix R became effective in 1981. These officials
added that a majority of nuclear units that use operator manual actions
started using them beginning in the mid-1990s in response to the
failure of Thermo-Lag--a widely used fire wrap--to meet fire endurance
testing.
A lack of clear understanding between NRC and industry over the
permissible use of operator manual actions in lieu of passive measures
emerged over the years. For example, officials at several of the sites
we visited produced documentation--some dating from the 1980s--showing
NRC's documented approval of some, but not all, operator manual
actions. In some other cases, unit operators told us that NRC officials
verbally approved certain operator manual actions but did not document
their approval in writing. In some other instances, without explicit
NRC approval, unit officials applied operator manual actions that NRC
had previously approved for similar situations. NRC officials explained
that NRC inspectors may not have cited units for violations for these
operator manual actions because they believed the actions were safe;
however, NRC's position is that these actions do not comply with NRC's
fire regulations. Moreover, in fire inspections initiated in 2000 of
nuclear units' safe shutdown capabilities, NRC found that units were
continuing to use operator manual actions without exemptions in lieu of
protecting safe shutdown capabilities through the required passive
measures. For example, management officials for some nuclear units
authorized staff to manually turn a valve to operate a pump if it
failed due to fire damage rather than protecting the cables that
operate the valve automatically. Unit officials at one site stated that
they rely on more than 20 operator manual actions that must be
implemented within 25 minutes for safe shutdown in the event of a fire.
In March 2005 NRC published a proposal to revise Appendix R to allow
feasible and reliable operator manual actions if units maintained or
installed automatic fire detection and suppression systems. The agency
stated that this would reduce the regulatory burden by decreasing the
need for licensees to prepare exemption requests and the need for NRC
to review and approve them.[Footnote 25] However, industry officials
stated, among other things, that the requirement for suppression would
be costly without a clear safety enhancement and, therefore, would
likely not reduce the number of exemption requests. Officials at one
unit told us that this requirement, in conjunction with other NRC
proposed rules, could cost as much as $12 million at one unit, and they
believe that the rule would have caused the industry to submit a
substantial number of exemption requests to NRC. Due in part to these
concerns, NRC withdrew the proposed rule in March 2006.[Footnote 26]
NRC officials reaffirmed the agency's position that nuclear units using
unapproved or undocumented operator manual actions are not in
compliance with regulations. In published guidance sent to all
operating nuclear units in 2006, NRC stated that this has been its
position since Appendix R became effective in 1981.[Footnote 27] The
guidance further stated that NRC has continued to communicate this
position to licensees via various public presentations, proposed
rulemaking, and industry wide communications.
In June 2006, NRC directed nuclear units to complete corrective actions
for these operator manual actions by March 2009, either by applying for
licensing exemptions for undocumented or unapproved operator manual
actions or by making design modifications to the unit to eliminate the
need for operator manual actions.[Footnote 28] Staff at most nuclear
units we visited said they would resolve this issue either by
transitioning to the new risk-informed approach, or by applying to NRC
for licensing exemptions because making modifications would be resource-
intensive. In March 2006, NRC also stated in the Federal Register that
the regulations allow licensees to use the risk-informed approach in
lieu of seeking an exemption or license amendment.[Footnote 29]
NRC officials told us that, at least for the short-term, they have no
plans to examine unapproved or undocumented operator manual actions for
units that have sought exemptions to determine if these units are
compliant with regulations. They said that NRC has already received
exemption requests for operator manual actions, and it expects about 25
units--mostly units licensed before 1979 that do not intend to adopt
the new risk-informed approach--to submit additional exemption requests
by March 2009.[Footnote 30] They estimated that about half of the 58
units that have not decided to transition to the risk-informed approach
do not have compliance issues regarding operator manual actions and,
therefore, will not need to submit related requests for exemptions.
These officials anticipate that the remaining units that are not
transitioning to the risk-informed approach will submit exemptions in
the following two broad groups: (1) license amendment requests that
should be short and easy to process because the technical review has
already been completed, showing that the operator manual actions in
place do not degrade unit safety; and (2) exemption requests that
require more detailed review because the units have been using
unapproved operator manual actions.
NRC Has Not Yet Acted to Address Extended Use of Interim Compensatory
Measures:
Some nuclear units have used interim compensatory measures for extended
periods of time--in some cases, for years--rather than perform the
necessary repairs or procure the necessary replacements. As of April,
2008, NRC has no firm plans for resolving this problem. For example, at
one nuclear unit we visited, unit officials chose to use fire watches
for over 5 years instead of replacing faulty penetration seals covering
openings in structural fire barriers. Officials at several units told
us that they typically use fire watches with dedicated unit personnel
as interim compensatory measures whenever they have deficiencies in
fire protection features. NRC regional officials confirmed that most
interim compensatory measures are currently fire watches and that many
of these were implemented at nuclear units after tests during the 1980s
and 1990s determined that Thermo-Lag and, later, Hemyc fire wraps, used
to protect safe shutdown cables from fire damage, were deficient.
According to a statement released by an NRC commissioner in October
2007, interim compensatory measures are not the most transparent or
safest way to deal with this issue. Moreover, NRC inspectors have
reported weaknesses in certain interim compensatory measures used at
some units, including an over reliance on 1-hour roving fire watches
rather than making the necessary repairs.
Although NRC regulations state that all deficiencies in fire protection
features must be promptly identified and corrected,[Footnote 31] they
do not limit how long units can rely on interim compensatory measures-
-such as hourly fire watches--before taking corrective actions or
include a provision to compel licensees to take corrective actions. In
the early 1990s, NRC issued guidance addressing the timeliness of
corrective actions, stating that the agency expected units to promptly
complete all corrective actions in a timely manner commensurate with
safety and thus eliminate reliance on the interim compensatory
measures. In 1997, NRC issued additional guidance, stating that if a
nuclear unit does not resolve a corrective action at the first
available opportunity or does not appropriately justify a longer
completion schedule, the agency would conclude that corrective action
has not been timely and would consider taking enforcement action. NRC's
current guidance for its inspectors states that a unit may implement
interim compensatory measures until final corrective action is
completed and reliance on an interim compensatory measure for
operability should be an important consideration in establishing the
time frame for completing the corrective action.[Footnote 32] This
guidance further states that conditions calling for interim
compensatory measures to restore operability should be resolved quickly
because such conditions indicate a greater degree of degradation or
nonconformance than conditions that do not rely on interim compensatory
measures. For example, the guidance states that NRC expects interim
compensatory measures that substitute an operator manual action for
automatic safety-related functions to be resolved expeditiously.
Officials from several different units that we visited confirmed that
NRC has not implemented a standard timeframe for when corrective
actions must be made regarding safe shutdown deficiencies.
NRC officials further state that interim compensatory measures could
remain in place at some units until they fully transition to the risk-
informed approach to fire protection. They stated that this was because
many of the interim compensatory measures are in place for Appendix R
issues that are not risk significant, and nuclear units will be able to
eliminate them after they implement the risk-informed approach.
NRC Has Not Resolved Uncertainty Regarding the Effectiveness of Fire
Wraps:
NRC has not resolved uncertainty regarding fire wraps used at some
nuclear units for protecting cables critical for safe shutdown. NRC's
regulations state that fire wraps protecting shutdown-related systems
must have a fire rating of either 1 or 3 hours. NRC guidance further
states that licensees should evaluate fire wrap testing results and
related data to ensure it applies to the conditions under which they
intend to install the fire wraps. If all possible configurations cannot
be tested, an engineering analysis must be performed to demonstrate
that cables would be protected adequately during and after exposure to
fire. NRC officials told us that the agency prefers passive fire
protection, such as fire barriers--including fire wraps--because such
protection is more reliable than other forms of fire protection, for
example, human actions for fire protection.
Following the 1975 fire at Browns Ferry, manufacturers of fire wraps
performed or sponsored fire endurance tests to establish that their
fire wraps met either the 1-hour or 3-hour rating period required by
NRC regulations. However, NRC became concerned about fire wraps in the
late 1980s when Thermo-Lag--a fire wrap material commonly used in units
at the time--failed performance tests to meet its intended 1-hour and 3-
hour ratings, even though it had originally passed the manufacturer's
fire qualification testing. In 1992, NRC's Inspector General found that
NRC and nuclear licensees had accepted qualification test results for
Thermo-Lag that were later determined to be falsified. From 1991 to
1995, NRC issued a series of information notices on performance test
failures and installation deficiencies related to Thermo-Lag fire wrap
systems. As a result, in the early 1990s, NRC issued several generic
communications informing industry of the test results and requested
that licensees implement appropriate interim compensatory measures and
develop plans to resolve any noncompliance. One such communication
included the expectation that licensees would review other fire wrap
materials and systems and consider actions to avoid problems similar to
those identified with Thermo-Lag.
Deficiencies emerged in other fire wrap materials starting in the early
1990s, and NRC suggested that industry conduct additional testing. It
took NRC over 10 years to initiate and complete its program of large-
scale testing of Hemyc--another commonly used fire wrap--and then
direct units to take corrective actions after small-scale test results
first indicated that Hemyc might not be suitable as a 1-hour fire wrap.
In 1993, NRC conducted pilot-scale fire tests on several fire wrap
materials, but because the tests were simplified and small-scale models
were used, NRC applied test results for screening purposes only. These
tests involved various fire wraps assembled in different
configurations. The test results indicated unacceptable performance in
approximately one-third of the assemblies tested, and NRC reported that
the results for Hemyc were inconclusive, although NRC's Inspector
General recently reported that Hemyc had failed this testing. In 1999
and 2000, several NRC inspection findings raised concerns about the
performance of Hemyc and MT--another fire wrap--including: (1) whether
test acceptance criteria for insurance purposes is valid for fire
barrier endurance tests and (2) the performance of fire wraps when
those wraps are used in untested configurations. In 2001, NRC initiated
testing for typical Hemyc and MT installations used in units in the
United States, and the test results indicated that the Hemyc
configuration did not pass the 1-hour criteria and that the MT
configuration did not pass the 3-hour criteria. In 2005, NRC held a
public meeting with licensees to discuss these test results and how to
achieve compliance.
In 2006, NRC published guidance stating that fire wraps installed in
configurations that are not capable of providing the designed level of
protection are considered nonconforming installations and that
licensees that use Hemyc and MT--previously accepted fire wraps--may
not be conforming with their licenses. This guidance further stated
that if licensees identify nonconforming conditions, they may take the
following corrective actions: (1) replace the failed fire wraps with an
appropriately rated fire wrap material, (2) upgrade the failed fire
barrier to a rated barrier, (3) reroute cables or instrumentation lines
through another fire area, or (4) voluntarily transition to the risk-
informed approach to fire protection.
According to NRC's Inspector General, during testimony before Congress
in 1993 on the deficiencies of Thermo-Lag, the then-NRC Chairman
committed NRC to assess all fire wraps to determine what would be
needed in order to meet NRC requirements. The testimony also contained
an attachment of an NRC task force that made the following two
recommendations: (1) NRC should sponsor new tests to evaluate the fire
endurance characteristics of other fire wraps and (2) NRC should review
the original fire qualification test reports from fire wrap
manufacturers.[Footnote 33]
Although NRC maintains that it has satisfied this commitment, the NRC
Inspector General reported in January 2008 that the agency had yet to
complete these assessments. NRC officials told us that licensees are
required to conduct endurance tests on fire wraps used at nuclear
units; however, the NRC Inspector General noted that, to date, no test
has been conducted certifying Hemyc as a 1-or 3-hour fire wrap.
Licensees' proposed resolutions for this problem ranged from making
replacements with another fire wrap material to requesting license
exemptions. In addition, although NRC advised licensees that corrective
actions associated with Hemyc and MT are subject to future inspection,
the Inspector General noted that NRC has not yet scheduled or budgeted
for inspections of licensees' proposed resolutions. The Inspector
General's report indicated that several different fire wraps failing
endurance tests are still installed at units across the country, but
NRC does not maintain current records of these installations. Until
issues regarding the effectiveness of fire wraps are resolved,
utilities may not be able to use the wraps to their potential and
instead rely on other measures, including operator manual actions.
NRC Has Not Yet Acted to Resolve How to Protect against Multiple
Spurious Actuations That Could Affect a Nuclear Unit's Ability to
Safely Shut Down:
NRC has not finalized guidance on how nuclear units should protect
against short-circuits that could cause safety-related equipment to
start or malfunction spuriously (instances called spurious actuations).
In the early 1980s, NRC issued guidance clarifying the requirements in
its regulations for safeguarding against spurious actuations that could
adversely affect a nuclear unit's ability to safely shut down.[Footnote
34] However, NRC approved planning for spurious actuations occurring
only one at a time or in isolation. In the late 1990s, nuclear units
identified problems related to multiple spurious actuations occurring
simultaneously. Due to uncertainty over this issue, in 1998 NRC
exempted units from enforcement actions related to spurious actuations,
and in 2000 the agency temporarily suspended the electrical circuit
analysis portion of its fire inspections at nuclear units. Cable fire
testing performed by industry in 2001 demonstrated that multiple
spurious actuations occurring simultaneously or in rapid succession
without sufficient time to mitigate the consequences may have a
relatively high probability of occurring under certain circumstances,
including fire damage.[Footnote 35]
Following the 2001 testing, NRC notified units that it expects them to
plan for protecting electrical systems against failures due to fire
damage, including multiple spurious actuations in both safety-related
systems and associated nonsafety systems.[Footnote 36] NRC resumed
electrical inspections in 2005 and proposed that licensees review their
fire protection programs to confirm compliance with NRC's stated
regulatory position on this issue and report their findings in writing.
The proposal suggested that noncompliant units could come into
compliance by (1) reperforming their circuit analyses and making
necessary design modifications, (2) performing a risk-informed
evaluation, or (3) adopting the overall risk-informed approach to fire
protection advocated by NRC. In 2006, however, NRC decided not to issue
the proposal, stating that further thought and care can be taken to
ensure the resolution of this issue has a technically sound and
traceable regulatory footprint that would provide permanent closure.
The nuclear industry has issued statements disagreeing with NRC's
proposed regulatory approach for multiple spurious actuations. Industry
officials noted that NRC approved licenses for many units that require
operators to plan for spurious actuations from a fire event that occur
one at a time or in isolation and that NRC's current approach amounts
to a new regulatory position on this issue. Furthermore, the industry
asserts that units only need to plan for protecting against spurious
actuations occurring one at a time or in isolation because, in
industry's view, multiple spurious actuations occurring are highly
improbable and should not be considered in safety analyses. Industry
officials told us that the 2001 test results were generated under worst-
case scenarios, which operating experience has shown may not represent
actual conditions at nuclear units. These officials further told us
that NRC's requirements are impossible to achieve.
In December 2007, the nuclear industry proposed an approach for
evaluating the effects on circuits from two or more spurious actuations
occurring simultaneously, but NRC had not officially commented on the
proposal as of May 2008. NRC has stated that draft versions of the
proposal it has reviewed do not achieve regulatory compliance. As of
May 2008, despite numerous meetings and communications with industry,
NRC has not endorsed guidance or developed a timeline for resolving
disagreements with industry about how to plan for multiple spurious
actuations of safety-related equipment due to fire damage. However, NRC
officials told us they have recently developed a closure plan for this
issue that they intend to propose to NRC's Commissioners for approval
in June 2008. NRC officials told us that after this plan is approved,
their planned next steps are to determine (1) the analysis tools, such
as probabilistic risk assessments or fire models, that units can use to
analyze multiple spurious actuations; and (2) a time frame for ending
its ongoing exemption of units from enforcement actions related to
spurious actuations.
NRC Lacks a Comprehensive Database to Track Nuclear Units' Use of
Operator Manual Actions, Interim Compensatory Measures, and Exemptions:
NRC has no comprehensive database of the operator manual actions or
interim compensatory measures implemented at nuclear units since its
regulations were first promulgated in 1981, in addition to the hundreds
of related licensing exemptions. NRC does not require units to report
operator manual actions upon which they rely for safe shutdown.
Although NRC reports operator manual actions in the inspection reports
it generates through its triennial fire inspections, it does not track
these operator manual actions industrywide nor does it compile them on
a unit by unit basis. NRC does not maintain a central database of
interim compensatory measures being used in place of permanent fire
protection features at units for any duration of time. In addition, NRC
regional officials told us that triennial fire inspectors do not
typically track the status of interim compensatory measures used for
fire protection or which units are using them. However, units record
maintenance-related issues in their corrective action programs,
including those issues requiring the implementation of interim
compensatory measures. As a result, data are available to track interim
compensatory measures that last for any period of time as well as to
analyze their safety significance. NRC resident inspectors told us that
they review these corrective action programs on a daily basis and that
they are always aware of the interim compensatory measures in place at
their units. They reported that this information is sometimes reviewed
by NRC regional offices but rarely by headquarters officials.
NRC officials explained that the agency tracked the use of exemptions-
-including some operator manual actions--through 2001 but then stopped
because the number of exemptions requested by units decreased. This
information is available, in part, electronically through its public
documents system and partly in microfiche format. These officials
explained that part of the agency's inspection process is to test if
licensees have copies of their license exemptions and, thus, are
familiar with their own licensing basis. Inspectors have the ability to
confirm an exemption, but once the inspectors are in the field, they
often rely on the licensee's documentation. According to these
officials, NRC has no central repository for all the exemptions for a
unit, but agency inspectors can easily validate a licensee's exemption
documentation by looking it up in their public documents system. They
said that they conduct the triennial inspections over 2 weeks at the
unit because they realize licensees may not be able to locate
documentation immediately. They notify licensees what documents they
need during the first week onsite so the licensees can have time to
prepare them for NRC's return trip. NRC regional officials told us that
it is difficult to inspect fire safety due to the complicated licensing
basis and inability to track documents.
An NRC commissioner told us that nuclear power units have adopted many
different fire safety practices with undocumented approval status. The
commissioner further stated that NRC does not have good documentation
of which units are using interim compensatory measures or operator
manual actions for fire protection and that it needs a centralized
database to track these issues. The commissioner stated the lack of a
centralized database does not necessarily indicate that safety has been
compromised.
However, without a database that contains information about the
existence, length, nature, and safety significance of interim
compensatory measures, operator manual actions, and exemptions in
general, NRC may not have a way to easily track which units have had
significant numbers of extended interim compensatory measures and
possibly unapproved operator manual actions. Moreover, the database
could help NRC make informed decisions about how to resolve these long-
standing issues. Also, the database could help NRC inspectors more
easily determine whether specific operator manual actions or extended
interim compensatory measures have, in fact, been approved through
exemptions.
To Date, 46 Nuclear Unit Operators Have Announced They Will Adopt a New
Risk-Informed Approach to Fire Safety, but the Transition Effort Faces
Challenges:
Officials at 46 nuclear units have announced their intention to adopt
the risk-informed approach to fire safety. Officials from NRC,
industry, and units we visited that plan to adopt the risk-informed
approach stated that they expect the new approach will make units safer
by reducing reliance on unreliable operator manual actions and help
identify areas of the unit where multiple spurious actuations could
occur. Academic and industry experts believe that the risk-informed
approach could provide safety benefits, but they stated that NRC must
address inherent complexities and unknowns related to the development
of probabilistic risk assessments used in the risk-informed approach.
Furthermore, the shortage of skilled personnel and concerns about the
potential cost of conducting risk analyses could slow the transition
process and limit the number of units that ultimately make the
transition to the new approach.
Nuclear Units Adopting the Risk-Informed Approach Expect It to Improve
Safety:
As of May 2008, 46 nuclear units at 29 sites have announced that they
will transition to the risk-informed approach endorsed by NRC (see fig.
1). To facilitate the transition process for the large number of units
that will change to the new approach within the next 5 years, NRC is
overseeing a pilot program involving three nuclear units at the Oconee
Nuclear Power Plant in South Carolina and one unit at the Shearon
Harris Nuclear Power Plant in North Carolina, and NRC expects to
release its evaluation of these units' license amendment requests
supporting their transition to the risk-informed approach by March
2009. At that point, 22 nuclear units will have submitted their license
amendment requests for NRC's review, followed by other units in a
staggered fashion.
Figure 1: The 46 Commercial Nuclear Reactors in the United States That
Are Transitioning to the Risk-Informed Approach, as of May 2008:
This figure is a map of the 48 commercial nuclear reactors in the
United States that are transitioning to the risk-informed approach, as
of May 2008.
[See PDF for image]
Source: NRC (data); Map Resources (map).
[End of figure]
NRC and transitioning unit officials we spoke with expected that
transitioning to the new approach could simplify nuclear units'
licensing bases by reducing the number of future exemptions
significantly at each unit.[Footnote 37] Furthermore, officials from
each of the 12 units we contacted that plan to adopt the approach said
that one of the main reasons for their transition is to reduce the
number of exemptions, including those involving operator manual
actions, that are required to ensure safe shutdown capability under
NRC's existing regulations. Specifically, these officials told us that
they expected that conducting fire modeling and probabilistic risk
assessments--aspects of the risk-informed approach--would allow the
nuclear units to demonstrate that fire protection features in an area
with shutdown-related systems would be acceptable based on the expected
fire risk in that area. According to some of these officials, under
these circumstances units would no longer need to use exemptions--
including those involving operator manual actions--to demonstrate
compliance with the regulations. Officials at 10 of the units we
visited stated that, as a result, the approach could eliminate the need
for some operator manual actions. For example, officials at one site
that contained two nuclear units expected that by transitioning to the
new risk-informed approach, the units could eliminate the need for over
1,200 operator manual actions currently in place. Other unit officials
conceded that the outcomes of probabilistic risk assessments may
demonstrate the need for new operator manual actions that are currently
not required under the current regulations. These officials added that
any new actions or other safety features could be applied only to those
areas subject to fire risk, rather than to the entire facility, thereby
allowing units to maximize resources.
According to nuclear unit officials, adopting the risk-informed
approach could also help resolve concerns about multiple spurious
actuations that could occur as a result of fire events. Officials from
six units we visited told us that conducting the probabilistic risk
assessments would allow them to identify where multiple spurious
actuations are most likely to occur and which circuit systems would be
most likely affected. These officials told us that limiting circuit
analyses to the most critical areas would make such analyses feasible.
NRC has repeatedly promoted the transition to the new risk informed
approach as a way for nuclear units to address the multiple spurious
actuation issue.
Industry and Academic Experts Expressed Concern about Probabilistic
Risk Assessments That Would Be Used under the Risk-Informed Approach:
According to industry officials and academic experts we consulted, the
results of a probabilistic risk assessment used in the risk-informed
approach could help units direct safety resources to areas where risk
from accidents could be minimized or where the risk of damage to the
core or a unit's safe shutdown capability is highest; however,
officials also noted that the absence of significant fire events since
the 1975 Browns Ferry fire limits the relevant data on fire events at
nuclear units. Specifically, these experts noted the following:
* Probabilistic risk assessments require large amounts of data;
therefore the small number of fires since the Browns Ferry fire and the
subsequent lack of real-world data may increase the amount of
uncertainty in the analysis.
* Probabilistic risk assessments are limited by the range of scenarios
that practitioners include in the analysis. If a scenario is not
examined, its risks cannot be considered and mitigated.
* The role of human performance and error in a fire scenario--
especially those scenarios involving operator manual actions--is
difficult to model.
Finally, these parties stated that probabilistic risk assessments in
general are difficult for a regulator to review and are not as
enforceable as a prescriptive approach, in which compliance with
specific requirements can be inspected and enforced.
NRC and Industry Face a Possible Shortage in Personnel with Skills
Relevant to the Risk-Informed Approach:
Numerous NRC, industry, and academic officials we spoke with expressed
concern that the transition to the new risk-informed approach could be
delayed by a limited number of personnel with the necessary skills and
training to design, review, and inspect against probabilistic risk
assessments. Several nuclear unit officials told us that the pool of
fire protection engineers with expertise in these areas is already
heavily burdened with developing probabilistic risk assessments for the
pilot program units and other units, including the 38 units that had
already begun transitioning as of October 2007.
Academic experts, consultants, and industry officials told us that the
current shortage of skilled personnel is due to (1) an increased demand
for individuals with critical skills under the risk-informed approach
and (2) a shortage of academic programs specializing in fire protection
engineering. According to these experts and officials, the current
number of individuals skilled in conducting probabilistic risk
assessments is insufficient to handle the increased work expected to be
generated by the transition to a risk-informed approach. NRC officials
we spoke with expressed concern that the nuclear industry has not
trained or developed sufficient personnel with needed fire protection
skills. These officials also told us that they expect that, as demand
for work increases, more engineering students will choose to go into
the fire protection field. However, to date, only one university has
undergraduate and graduate programs in the fire protection engineering
field, and the ability to produce graduates is limited. Other officials
we spoke with noted that engineers in other fields can be trained in
fire protection but that this training takes a significant amount of
time.
Academic experts and industry officials stated that without additional
skilled personnel, units would not be able to perform all of the
necessary activities, especially probabilistic risk assessments, within
the 3-year enforcement discretion "window" that NRC has granted each
transition unit as an incentive to adopt the new approach. Most nuclear
units that responded to an industry survey on this issue indicated that
they expected that they will need NRC to extend the discretion deadline
for each unit. Delays in individual units' transition processes could
create a significant backlog in the entire transition process.
NRC also faces an aging workforce and the likelihood that it will be
competing with industry for engineers with skills in the fire
protection area. As we reported in January 2007, the agency as a whole
faces significant human capital challenges, in part because
approximately 33 percent of its workforce will be eligible to retire in
2010.[Footnote 38] To address this issue, we reported that NRC
identified several critical skill gaps that it must address, such as
civil engineering and operator licensing. In relation to needed skill
areas, the agency has taken steps, including supporting key university
programs, to attract greater numbers of students into mission-critical
skills areas and to offer scholarships to those studying in these
fields. In relation to fire protection, and probabilistic risk
assessments in particular, NRC officials told us that they expect to
address future resource needs through the use of a multiyear budget and
by contracting with the Department of Energy's National Laboratories to
help manage the process. Further, these officials stated that part of
the purpose of the pilot program is to help them determine future
resource needs for the transition to the risk-informed approach, and,
as a result, they do not intend to finalize resource planning until the
pilot programs are complete. A number of experts in the engineering
field, including academics and fire engineers, stated that it will be
difficult for NRC to compete with industry over the projected numbers
of graduates in this field over the next few years. Also, NRC's total
workload, in addition to fire protection, is expected to increase as
nuclear unit operators submit license applications to build new units,
extend the lives of existing units, or increase the generating capacity
of existing units. For example, NRC staff are currently reviewing
license applications for units at six sites and have recently announced
that operators have submitted licenses for two additional units at a
seventh site. The agency expects to review or receive 12 more
applications during 2008.
Operators of 58 Nuclear Units Have Not Announced Whether They Will
Transition to the New Approach, in Part Due to Concerns about NRC's
Risk-Assessment Guidance and Pilot Program Timetable:
To date 58 of the nation's 104 nuclear units have not announced whether
they will adopt the risk-informed approach. NRC and industry officials
stated that they expected that newer units and units with relatively
few exemptions from existing regulations would be less likely to
transition to the new approach, while those with older licenses and
extensive exemptions would make the transition. However, to date, 25
units licensed prior to 1979 have yet to announce whether they will
make the transition. Officials from nontransitioning units we visited
told us that concerns over NRC's guidance and time table have been key
reasons why they have not yet announced their intent to transition.
According to industry and nuclear unit officials we spoke with, the
costs associated with conducting fire probabilistic risk assessments
for the units may be too high to justify transitioning to the new
approach. For example, some officials told us that performing the
necessary analysis of circuits and fire area features in support of the
probabilistic risk assessment could cost millions of dollars without
substantially improving fire safety. These officials noted that both
pilot sites currently expect to spend approximately $5 million to $10
million each in transition costs, including circuit analysis. Some of
these officials also noted that updating probabilistic risk
assessments--which units are required to do every 3 years or whenever
any significant changes are made to a unit--would require units to
dedicate staff to this effort on a long term or permanent basis.
Officials at transition and nontransition units stated that NRC's
guidance for developing fire models that support probabilistic risk
assessments is overly conservative. In effect, these models require
engineers to assume that fires will result in massive damage, burn for
significant periods of time, and require greater response and
mitigation efforts than less conservative models. As such, these
officials stated that the fire models provided by NRC guidance would
not provide an accurate assessment of risk at a given unit.
Furthermore, these officials stated that unit modifications required by
the risk analysis could cost more than seeking exemptions from NRC.
Some of these officials stated that they expect NRC to revise the
probabilistic risk assessment guidance to facilitate the transition
process in the future. NRC officials told us that nuclear units have
the option to develop and conduct their own fire models rather than
follow NRC's guidance. Furthermore, in its initial review of one of the
pilot unit's probabilistic risk assessments, NRC agreed with industry
that models used in the development of the probabilistic risk
assessment contained some overly conservative aspects and recommended
that the unit conduct additional analysis to address this. However,
nuclear unit officials expressed concern that the costs of developing
site-specific fire models, a process that includes numerous iterations,
could be prohibitive.
Nuclear industry officials identified another area of concern in the
current transition schedule, in which 22 units are expected to submit
their license amendment requests for the risk-informed approach before
NRC finishes assessing the license amendment requests for the pilot
program units in March 2009. Although NRC has established a steering
committee and a frequently asked question process to disseminate
information learned in the ongoing pilot programs to other transition
units, a number of nuclear unit officials expressed concern about
beginning the transition process before the transition pilot programs
are complete and lessons learned from the pilot programs are available.
For example, an official at one of the pilot sites noted that the
success of the pilot program probably will not be known until after the
first triennial safety inspection conducted by NRC, which will occur
after March 2009. The transition project manager for two nonpilot
transition units expressed his opinion that, due to uncertainties
regarding the work units must perform in order to comply with the risk-
informed standard, no unit should commit itself to transitioning to the
new approach until 2 years after the completion of the pilot programs.
Conclusions:
NRC's ability to regulate fire safety at nuclear power units has been
adversely affected by several long-standing issues. To its credit, NRC
has required that nuclear units come into compliance with requirements
related to the use of unapproved operator manual actions by March 2009.
However, NRC has not effectively resolved the long-term use of interim
compensatory measures or the possibility of multiple spurious
actuations. Especially critical, in our opinion, is the need for NRC to
test and resolve the effectiveness of fire wraps at nuclear units,
because units have instituted many manual actions and compensatory
measures in response to fire wraps that were found lacking in
effectiveness in various tests. Compounding these issues, NRC has no
central database of exemptions, operator manual actions, and extended
interim compensatory measures. Such a system would allow it to track
trends in compliance, devise solutions to compliance issues, and help
provide important information to NRC's inspection activities.
Unless NRC deals effectively with these issues, units will likely
continue to postpone making necessary repairs and replacements,
choosing instead to rely on unapproved or undocumented manual actions
as well as compensatory measures that, in some cases, continue for
years. According to NRC, nuclear fire safety can be considered to be
degraded when reliance on passive measures is supplanted by manual
actions or compensatory measures. By taking prompt action to address
the unapproved use of operator manual actions, long-term use of interim
compensatory measures, the effectiveness of fire wraps, and multiple
spurious actuations, NRC would provide greater assurance to the public
that nuclear units are operated in a way that promotes fire safety.
Despite the transition of 46 units to a new risk-informed approach, for
which the implementation timeframes are uncertain, the majority of the
nation's nuclear units will remain under the existing regulatory
approach, and the long-standing issues will continue to apply directly
to them.
Recommendations for Executive Action:
To address long-standing issues that have affected NRC's regulation of
fire safety at the nation's commercial nuclear power units, we
recommend that the NRC Commissioners direct NRC staff to take the
following four actions:
* Develop a central database for tracking the status of exemptions,
compensatory measures, and manual actions in place nationwide and at
individual commercial nuclear units.
* Address safety concerns related to extended use of interim
compensatory measures by:
- defining how long an interim compensatory measure can be used and
identifying the interim compensatory measures in place at nuclear units
that exceed that threshold,
- assessing the safety significance of such extended compensatory
measures and defining how long a safety-significant interim
compensatory measure can be used before NRC requires the unit operator
to make the necessary repairs or replacements or request an exemption
or deviation from its fire safety requirements, and,
- developing a plan and deadlines for units to resolve those
compensatory measures.
* Address long-standing concerns about the effectiveness of fire wraps
at commercial nuclear units by analyzing the effectiveness of existing
fire wraps and undertaking efforts to ensure that the fire endurance
tests have been conducted to qualify fire wraps as NRC-approved 1-or 3-
hour fire barriers.
* Address long-standing concerns by ensuring that nuclear units are
able to safeguard against multiple spurious actuations by committing to
a specific date for developing guidelines that units should meet to
prevent multiple spurious actuations.
Agency Comments and Our Evaluation:
We provided a draft of this report to the Commissioners of the Nuclear
Regulatory Commission for their review and comment. In commenting on a
draft of this report, NRC found that it was accurate, complete, and
handled sensitive information appropriately and stated that it intends
to give GAO's findings and conclusions serious consideration. However,
in its response, NRC did not provide comments on our recommendations.
NRC's comments are reprinted in appendix II.
We are sending copies of this report to the Commissioners of the
Nuclear Regulatory Commission, the Nuclear Regulatory Commission's
Office of the Inspector General, and interested congressional
committees. We will also make copies available to others on request. In
addition, this report will be available at no charge on the GAO Web
site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-3841 or gaffiganm@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this report. GAO staff who made major contributions
to this report are listed in appendix III.
Signed by:
Mark Gaffigan:
Director, Natural Resources and Environment:
[End of section]
Appendix I: Scope and Methodology:
To examine the number, causes, and reported safety significance of fire
incidents at nuclear reactor units since 1995, we analyzed Nuclear
Regulatory Commission (NRC) data on fires occurring at operating
commercial nuclear reactor units from January, 1995, to December,
2007.[Footnote 39] NRC requires units to report fire events meeting
certain criteria, including fires lasting longer than 15 minutes or
those threatening safety.[Footnote 40] To assess the reliability of the
data, we (1) interviewed NRC officials about the steps they take to
ensure the accuracy of the data; (2) confirmed details about selected
fire events, NRC inspection findings, and local emergency responders
with unit management officials and NRC resident inspectors during site
visits to nuclear power units; (3) reviewed NRC inspection reports
related to fire protection; and (4) checked the data for obvious
errors. We determined that the data were sufficiently reliable for the
purposes of this report.
To examine what is known about nuclear reactor units' compliance with
NRC's deterministic fire protection regulations, we reviewed the
relevant fire protection regulations and guidance from NRC and
industry. We also met with and reviewed documents provided by officials
from NRC, industry, academia, and public interest groups. In
particular, we interviewed officials from NRC's Fire Protection Branch,
Office of Enforcement, four regional offices, Office of the Inspector
General, and Advisory Committee on Reactor Safeguards. In addition, we
interviewed officials from the Nuclear Energy Institute, National Fire
Protection Association, nuclear industry consultants, and nuclear
insurance companies. We conducted site visits to nuclear power units,
where we met with unit management officials and NRC resident
inspectors. During these site visits, we discussed and received
documentation on the use of operator manual actions, interim
compensatory measures, and fire wraps, and we obtained views on
multiple spurious actuations and their impact on safe shutdown. We also
reviewed and discussed each unit's corrective action plan. Finally, we
observed multiple NRC public meetings and various collaborations with
industry concerning issues related to compliance with NRC's
deterministic fire protection regulations.
To examine the status of the nuclear industry's implementation of the
risk-informed approach to fire safety advocated by NRC, we met with and
reviewed documents provided by officials from NRC, industry, and public
interest groups, as well as academic officials with research experience
in fire safety and risk analysis. In particular, we interviewed
officials from NRC's Fire Protection Branch, Office of Enforcement,
four regional offices, Office of the Inspector General, and Advisory
Committee on Reactor Safeguards. We also interviewed officials from the
Nuclear Energy Institute, National Fire Protection Association, nuclear
industry consultants, and nuclear insurance companies. We conducted
site visits to nuclear power units, where we met with unit management
officials and NRC resident inspectors. During these site visits, we
discussed and received documentation on the risk-informed approach to
fire safety, including resource planning and analysis justifying
decisions on whether or not to transition to NFPA-805. We also observed
multiple NRC public meetings and collaborations with industry
concerning issues related to the risk-informed approach to fire safety.
Finally, we reviewed relevant fire protection regulations and guidance
from NRC and industry.
In addressing each of our three objectives, we conducted visits to
sites containing one or more commercial nuclear reactor units. These
visits allowed us to obtain in-depth knowledge about fire protection at
each site. We selected a nonprobability sample of sites to visit
because certain factors--including custom designs that differ according
to each nuclear unit, hundreds of licensing exemptions and deviations
in place at units nationwide, and the geographic dispersal of units
units across 31 states--complicate collecting data and reporting
generalizations about the entire population of units.[Footnote 41] We
chose 10 sites (totaling 20 operating nuclear reactor units out of a
national total of 104 operating nuclear units) that provided coverage
of each of NRC's four regional offices and that represented varying
levels of unit fire safety performance, unit licensing characteristics,
reactor types, and NRC oversight. At the time of our visits, 5 of the
10 sites we visited (totaling 10 of the 20 nuclear reactor units we
visited) had notified NRC that they intend to transition to the new
risk-informed approach to fire safety. Over the course of our work, we
visited the following sites: (1) D.C. Cook (2 units), located near
Benton Harbor, Michigan; (2) Diablo Canyon (2 units), located near San
Luis Obispo, California; (3) Dresden (2 units), located near Morris,
Illinois; (4) Indian Point (2 units), located near New York, New York;
(5) La Salle (2 units), located near Ottawa, Illinois; (6) Nine Mile
Point (2 units), located near Oswego, New York; (7) Oconee (3 units),
located near Greenville, South Carolina; (8) San Onofre (2 units),
located near San Clemente, California; (9) Shearon Harris (1 unit),
located near Raleigh, North Carolina; and (10) Vogtle (2 units),
located near Augusta, Georgia.
We selected the nonprobability sample from the entire population of
commercial nuclear power units currently operating in the United
States.[Footnote 42] In order to capture variations that could play a
role in how these units address fire safety, we designed our site visit
selection criteria to represent the following: (1) geographic
diversity; (2) units licensed to operate before and after 1979; (3)
sites choosing to remain under the deterministic regulations and those
transitioning to the risk-informed approach; (4) pressurized and
boiling water reactor types; (5) a variety of safety problems in which
inspection findings or performance indicators of higher risk
significance (white, yellow, or red) were issued; (6) units that have
been subjected to at least some level of increased oversight since
regular fire inspections were initiated in 2000; and (7) sites with
various numbers of fires reportable to NRC since 1995. We received
feedback on our selection criteria from nuclear insurance company
officials, nuclear industry consultants, NRC officials, and academic
officials with research experience in fire safety and risk analysis. We
interviewed NRC resident inspectors and unit management officials at
each site to learn about the fire protection program at the site. We
also observed fire protection features at each site, including safe-
shutdown equipment and areas of the units where operator manual
actions, interim compensatory measures, and fire wraps are used for
fire safety. Finally, we observed part of an NRC triennial fire
inspection at one site.
We conducted this performance audit from September 2007 to June 2008 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
[End of section]
Appendix II: Comments from the Nuclear Regulatory Commission:
United States:
Nuclear Regulatory Commission:
Washington D.C. 20555-0001:
June 17, 2008:
Mr. Mark Gaffigan, Director:
Natural Resources and Environment:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, D.C. 20548:
Dear Mr. Gaffigan:
Thank you for providing the U.S. Nuclear Regulatory Commission (NRC)
the opportunity to review and comment on the U.S. Government
Accountability Office's (GAO's) draft report GAO-08-747, "Nuclear
Safety: NRC's Oversight of Fire Protection at U.S. Commercial Nuclear
Reactor Units Could Be Strengthened." The NRC staff has reviewed the
draft report and found that it was accurate, complete, and handled
sensitive information appropriately. We intend to give GAO's findings
and conclusions serious consideration.
If you have any questions regarding this response, please contact Jesse
Arildsen. Mr. Arildsen can be reached by telephone at (301) 415-1785.
Sincerely,
Signed by:
R. W. Borchardt:
Executive Director for Operations:
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
Mark Gaffigan, (202) 512-3841 or gaffiganm@gao.gov:
Staff Acknowledgments:
In addition to the contact named above, Ernie Hazera (Assistant
Director), Cindy Gilbert, Chad M. Gorman, Mehrzad Nadji, Omari Norman,
Alison O'Neill, Steve Rossman, and Jena Sinkfield made key
contributions to this report.
[End of section]
Related GAO Products:
Nuclear Energy: NRC Has Made Progress in Implementing Its Reactor
Oversight and Licensing Processes but Continues to Face Challenges. GAO-
08-114T. Washington, D.C.: October 3, 2007.
Nuclear Energy: NRC's Workforce and Processes for New Reactor Licensing
are Generally in Place, but Uncertainties Remain as Industry Begins to
Submit Applications. GAO-07-1129. Washington, D.C.: September 21, 2007.
Human Capital: Retirements and Anticipated New Reactor Applications
Will Challenge NRC's Workforce. GAO-07-105. Washington, D.C.: January
17, 2007.
Nuclear Regulatory Commission: Oversight of Nuclear Power Plant Safety
Has Improved, but Refinements Are Needed. GAO-06-1029. Washington,
D.C.: September 27, 2006.
Nuclear Regulatory Commission: Preliminary Observations on Its Process
to Oversee the Safe Operation of Nuclear Power Plants. GAO-06-888T.
Washington, D.C.: June 19, 2006.
Nuclear Regulatory Commission: Preliminary Observations on Its
Oversight to Ensure the Safe Operation of Nuclear Power Plants. GAO-06-
886T. Washington, D.C.: June 15, 2006.
Nuclear Regulatory Commission: Challenges Facing NRC in Effectively
Carrying Out Its Mission. GAO-05-754T. Washington, D.C.: May 26, 2005.
Nuclear Regulation: Challenges Confronting NRC in a Changing Regulatory
Environment. GAO-01-707T. Washington, D.C.: May 8, 2001.
Major Management Challenges and Performance Risks: Nuclear Regulatory
Commission. GAO-01-259. Washington, D.C.: January 2001.
Fire Protection: Barriers to Effective Implementation of NRC's Safety
Oversight Process. GAO/RCED-00-39. Washington, D.C.: April 19, 2000.
Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC. GAO/
T-RCED-00-115. Washington, D.C.: March 9, 2000.
Nuclear Regulatory Commission: Strategy Needed to Develop a Risk-
Informed Safety Approach. GAO/T-RCED-99-071. Washington, D.C.: February
4, 1999.
[End of section]
Footnotes:
[1] 10 CFR part 50, Appendix R applies to commercial nuclear units that
were operating prior to January 1, 1979. Units that began operation on
or after that date are required to meet specific requirements in their
licensing conditions that are similar to Appendix R.
[2] NRC's technical term for such a wrap is "Electrical Raceway Fire
Barrier System." However, in this report we use the term "fire wrap"
because this term is widely used in practice by industry.
[3] Nuclear units licensed prior to January 1, 1979, pursuant to
Appendix R are issued "exemptions" to the regulations NRC, while those
licensed after 1979 are issued "deviations" from conditions in their
licenses. For purposes of clarity, hereafter, our report will use the
generic term "exemptions."
[4] Fire watches are teams of nuclear unit employees who can be posted
continuously in a single location or can rove throughout the unit site
to detect signs of fire.
[5] NRC, through 60 Fed. Reg. 33536 (June 16, 2004)(codified at 10
C.F.R. 50.48(c)), endorsed the use of key aspects of National Fire
Protection Association, NFPA-805, Performance-Based Standard for Fire
Protection for Light Water Reactors Electric Generating Plants, 2001
Edition (Quincy, Massachusetts, 2001). NRC differentiates between "risk-
informed" and "risk-based" regulation, noting that the former uses risk
analysis to augment other information used to support management
decisions, while the latter approach relies solely on the numerical
results of risk assessments. NRC does not endorse a risk- based
approach for fire protection.
[6] The scope of our work focuses on fire safety as it pertains to a
nuclear unit's ability to achieve safe shutdown. NRC is also overseeing
plans and actions undertaken by unit operators to safeguard against
fires resulting from a catastrophic event in which containment
structures surrounding a unit's core and spent fuel pool are damaged or
destroyed. We did not analyze this issue because it falls outside the
scope of our audit.
[7] NRC only collects data on events that meet certain reporting
thresholds including (1) whether a fire lasts longer than 10 or 15
minutes and (2) whether the fire affects plant equipment necessary for
safe shutdown.
[8] In 1974, Congress abolished the Atomic Energy Commission and
created two new agencies in its place--NRC and the Energy Research and
Development Administration (now the Department of Energy). NRC
continued to function with the same regulations and guidance developed
under the Atomic Energy Commission and currently codified in Parts 1-
199 of Title 10 of the U.S. Code of Federal Regulations.
[9] Appendix A to 10 C.F.R. 50, "General Design Criteria for Nuclear
Power Plants," Criterion 3 - Fire protection: Structures, systems, and
components important to safety shall be designed and located to
minimize, consistent with other safety requirements, the probability
and effect of fires and explosions. Noncombustible and heat resistant
materials shall be used wherever practical throughout the unit,
particularly in locations such as the containment and control room.
Fire detection and fighting systems of appropriate capacity and
capability shall be provided and designed to minimize the adverse
effects of fires on structures, systems, and components important to
safety. Firefighting systems shall be designed to assure that their
rupture or inadvertent operation does not significantly impair the
safety capability of these structures, systems, and components.
[10] NRC typically documents its acceptance of a fire protection
program by issuing safety evaluation reports.
[11] See NUREG 0050, "Recommendations Related to Browns Ferry Fire"
(February 1976).
[12] 45 Fed. Reg. 76610 (Nov. 19, 1980) codified as amended at 10 CFR
50.48.
[13] 45 Fed. Reg. 76611 (Nov. 19, 1980).
[14] Appendix R also includes other requirements for fire safety, such
as requirements governing fire brigades at nuclear units.
[15] These requirements are contained in paragraphs G.3 and J of
Section III of Appendix R.
[16] See 10 CFR 50.48(a).
[17] Licensees request exemptions from fire protection requirements in
accordance with 10 CFR 50.12.
[18] As previously noted, post-1979 units documented their differences
in licensing "deviations" against the criteria with which NRC approved
their fire protection programs. For clarity purposes, we use the term
"exemptions" to refer to both exemptions and deviations.
[19] National Fire Protection Association NFPA 805: Performance-Based
Standard for Fire Protection for Light Water Reactor Electric
Generating Plants, 2001 ed. (Quincy, Massachusetts, 2001).
[20] 10 CFR. 50.90 provides the requirements for making license
amendment applications. 10 C.F.R. 50.48(c)(3) describes the required
content of the application for adopting the risk-informed, performance-
based approach to fire safety.
[21] The nation's 104 nuclear units operate at 65 sites in 31 states.
[22] NRC directs nuclear units to report fires to the agency in
accordance with their approved fire protection programs. Typically,
this includes fires that meet certain criteria, such as (1) whether a
fire lasts longer than 10 or 15 minutes and (2) whether the fire
affects plant equipment necessary for safe shutdown.
[23] NRC requires units to categorize events according to the following
four classes of Emergency Action Levels in increasing order of
seriousness: Notification of Unusual Event, Alert, Site Area Emergency,
and General Emergency. The first two levels are to provide early and
prompt notification of minor events that could lead to more serious
consequences. In particular, an Alert describes a situation that
involves an actual or potential substantial degradation of the level of
safety of the plant, with any resulting radiological releases expected
to be limited to small fractions based on guidance from the
Environmental Protection Agency. A Site Area Emergency reflects
conditions where some significant radiological releases are likely but
where a core melt situation is not indicated, and a General Emergency
involves actual or imminent substantial core degradation or melting
with the potential for loss of containment.
[24] See NRC, NRC Regulatory Issues Summary 2006-10, Regulatory
Expectations with Appendix R Paragraph III.G.2 Operator Manual Actions
(Washington, D.C., June 30, 2006). These regulations also require a
trained fire brigade with adequate capability to fight fires in all
areas of the unit containing structures, systems, and components
important to safety.
[25] 70 Fed. Reg. 10901 (Mar. 7, 2005)
[26] 71 Fed. Reg. 11169 (Mar. 6, 2006)
[27] See NRC, NRC Regulatory Issue Summary 2006-10.
[28] See NRC, NRC Regulatory Issue Summary 2006-10.
[29] 71 Fed. Reg. 11169 (Mar. 6, 2006).
[30] NRC officials told us that the actual number of exemptions will be
less than 25 because units will submit them by site, not per nuclear
unit.
[31] See Appendix B to 10 C.F.R. 50.
[32] This inspection guidance states the following: In determining
whether the licensee is making reasonable efforts to complete
corrective actions promptly, the NRC will consider safety significance,
the effects on operability, the significance of the degradation, and
what is necessary to implement the corrective action. The NRC may also
consider the time needed for design, review, approval, or procurement
of the repair or modification; the availability of specialized
equipment to perform the repair or modification; and the need for the
unit to be in hot or cold shutdown to implement the actions. If the
licensee does not resolve the degraded or nonconforming condition at
the first available opportunity or does not appropriately justify a
longer completion schedule, the staff would conclude that corrective
action has not been timely and would consider taking enforcement
action.
[33] Nuclear Regulatory Commission, Office of Inspector General, NRC's
Oversight of Hemyc Fire Barriers, Case 05-46 (Washington, D.C., Jan.
22, 2008).
[34] Specifically, Appendix R requires plants to protect cables or
equipment necessary for safe shutdown from fire damage, including (1)
electrical systems used directly to perform a safe-shutdown function
and (2) associated nonsafety circuits--electrical systems not directly
related to performing safe-shutdown functions but for which a spurious
actuation might prevent safe shutdown. For example, an associated
nonsafety system might control a valve necessary for keeping a storage
tank full of water used to cool a reactor, whereas a safety-related
system might control a pump responsible for transporting the water to
the reactor.
[35] See Electric Power Research Institute, Spurious Actuation of
Electrical Circuits Due to Cable Fires: Results of an Expert
Elicitation, Report No. 1006961 (Palo Alto, California, May 2002); and
NRC, Cable Insulation Resistance Measurements Made During Cable Fire
Tests, NUREG/CR-6776 (Washington, D.C., June 2002).
[36] NRC has also stated that plants cannot use operator manual actions
to mitigate multiple spurious actuations because Appendix R does not
mention operator manual actions as an acceptable method of fire
protection. As discussed previously, many plants believe that operator
manual actions are allowed without explicit approval from NRC. However,
industry testing in 2001 indicates that some operator manual actions
may not be able to mitigate multiple spurious actuations due to
insufficient time to act.
[37] NRC has stated that it also expects that the risk-informed
approach to fire protection will (1) focus licensee and regulatory
attention on design and operational issues commensurate with their
importance to public health and safety, (2) identify areas with
insufficient safety margin, and (3) provide the bases for additional
requirements or regulatory actions.
[38] GAO, Human Capital: Retirements and Anticipated New Reactor
Applications Will Challenge NRC's Workforce, GAO-07-105 (Washington,
D.C.: Jan. 17, 2007).
[39] The scope of our work focuses on fire safety as it pertains to a
nuclear unit's ability to achieve safe shutdown. NRC is also overseeing
plans and actions undertaken by unit operators to safeguard against
fire resulting from a catastrophic event in which containment
structures surrounding a unit's core and spent fuel pool are damaged or
destroyed. We did not analyze this issue because it falls outside the
scope of our audit.
[40] In most cases, however, fires only result in notification because
there is a declaration of an emergency class, which is reportable under
10 C.F.R. 50.72. According to NRC guidance, a fire lasting longer than
10 or 15 minutes or which affects plant equipment important to safe
operation would result in declaration of an emergency class. If there
is an actual threat or significant hampering, a Licensee Event Report
is also required. According to 10 C.F.R. 50.73, a plant must submit a
Licensee Event Report for any event, including a fire, that posed an
actual threat to the safety of the nuclear power plant or significantly
hampered site personnel in the performance of duties necessary for the
safe operation of the nuclear power plant. NRC guidance states that it
generally considers a control room fire to constitute an actual threat
and significant hampering.
[41] The information gathered on these site visits cannot be used to
generalize findings to, or make inferences about, the entire population
of plants, or the nuclear power industry as a whole. Although the
sample provides some variety, it is unlikely to capture the full
variability of conditions under which fire protection takes place at
the plants, and it cannot provide comprehensive insight into the
effects of any one set of conditions. This is because, in a
nonprobability sample, some elements of the population being studied
have no chance, or an unknown chance, of being selected. However, the
information gathered during these site visits allows us to make
qualified comparisons between different groups of plants and to discuss
issues faced by each group. It also helps us interpret the quantitative
data, documentation, guidance, and testimonial evidence we have
collected. In addition, it provides anecdotal and illustrative evidence
about fire protection at plants under various conditions, as well as
providing important context overall.
[42] As of May 2008, the commercial nuclear power industry in the
United States was composed of 104 operating nuclear reactor units at 65
sites in 31 states. Each site had one to three units often operated and
licensed by the same utility, and therefore combined for NRC oversight
purposes.
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
