Information Notice 1983-41, Actuation of Fire Suppression System Causing Inoperability of Safety Related Equipment
SSINS No.: 6835 IN 83-41 UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF INSPECTION AND ENFORCEMENT
WASHINGTON, D.C. 20555 June 22, 1983 IE INFORMATION NOTICE 83-41: ACTUATION OF FIRE SUPPRESSION SYSTEM CAUSING
INOPERABILITY OF SAFETY-RELATED EQUIPMENT
Addressees
All holders of operating licenses (OLs) or construction permits (CPs).
Purpose
This information notice is issued to alert licensees to some recent experiences
in which actuation of fire suppression systems caused damage to or inoperabi- lity of systems important to safety. No specific action or response is required
at this time.
Description of Circumstances
In its continuing review of licensee event reports (LERs) the NRC has identified
many LERs describing automatic actuation of fire suppression systems, where the
actuation resulted in degrading or jeopardizing the operability of systems
important to safety. In some instances the suppression system actuated pro- perly, in response to a valid signal. In other instances there was no real
need for initiation. In these latter instances, there does not appear to have
been a single common causative factor. It appears that errors have been made
in design (including selection of the most appropriate sensors), in installa- tion, and in plant operating and maintenance procedures.
The NRC is concerned that fire fighting systems and activities, if not properly
designed and implemented, can contribute to risks to the plant and public.
General Design Criterion 3, Fire Protection, of Appendix A to 10 CFR Part 50
states in part: "Fire detection and fighting systems of appropriate capacity
and capability shall be provided and designed to minimize the adverse effects
of fires on structures, systems and components important to safety. Fire
fighting systems shall be designed to ensure that their rupture or inadvertent
operation does not significantly impair the safety capability of these struc- tures, systems and components." Paragraph II B of Appendix R to 10 CFR Part 50
and the related NRR Branch Technical Position requires that a fire hazard
analysis be performed to assess the probability and consequences of fires in
each utilization facility. This analysis, in considering the consequence of a
postulated fire, must include the effect of fire fighting activities. Such an
analysis need not be complex, but should not be limited to a "paper study."
The events reported indicate that a walk-down of plant equipment would have
identified instances where minor modifications such as shielding equipment and
sealing conduit ends would have reduced water damage from inadvertent operation
of the fire protection system,
8305110477
IN 83-41 June 22, 1983 without significantly reducing its effectiveness. It appears that in many
instances, the hazards analysis did not adequately address system interactions
betWeen fire suppression systems and systems important to safety, particularly
those necessary for safe shutdown. The overall design must accommodate both
needs; that is, it must provide an effective fire protection system but not
adversely affect other aspects of plant safety.
Attachment 1 to this Information Notice tabulates several representative
examples of events reported, with some attribution of probable cause. Also, the Institute of Nuclear Power Operations is planning to issue a document
providing further information on this subject.
To date, none of the reported events have resulted in a serious impact on the
functional capability of the facility to protect the health and safety of the
public. However, in many instances it would not be difficult to extrapolate
actual occurrences in a sequence of events that could lead to much more serious
consequences. Attachment 2 gives some examples.
Although no written response to this notice is required, it is suggested that
holders of operating licenses or construction permits review the information
in this notice for applicability at their facilities. If you have any ques- tions regarding this matter, please contact the Regional Administrator of the
appropriate NRC Regional Office, 'or this office.
Edward L. Jordan, Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact:
J. B. Henderson, IE
(301) 492-9654 Attachments:
1. Selected Examples of Licensee Event
Reports Related to Fire Suppressions Systems
2. Events That May Be Precursors to More Serious
Similar Events
3. List of Recently Issued IE Information Notices
- IE
- SEE PREVIOUS CONCURRENCE AEOD R-:IE
KVSeyfrit Jordan
6/ /83 6//83
JBHenderson AWDromerick RSanders RLBaer VBenaroya WJohnston
6/ /83:jr 6/ /83 6/ /83 6/ /83 6/ /83 6/ /83
IN 83- June 1983 without significantly reducing its effectiveness. It appears that in many
instances, the hazards analysis did not adequately address system interactions
between fire suppression systems and systems important to safety, particularly
those necessary for safe shutdown. The overall design must accommodate both
needs; that is, it must provide an effective fire protection system but not
adversely affect other aspects of plant safety.
Because of the number and variety of events reported, it is not feasible to
describe all the events reported, but Attachment 1 to this Information Notice
tabulates several representative examples, with some attribution of probable
cause. Also, the Institute of Nuclear Power Operations is planning to issue
a document providing further information on this subject.
To date, none of the reported events have resulted in a serious impact on the
functional capability of the facility to protect the health and safety of the
public. However, in many instances it would not be difficult to extrapolate
actual occurrences in a sequence of events that could lead to much more serious
consequences. Attachment 2 gives some examples.
Although no written response to this notice is required, it is suggested that
holders of operating licenses or construction permits review the information
in this notice for applicability at their facilities. If you have any ques- tions regarding this matter, please contact the Regional Administrator of the
appropriate NRC Regional Office, or this office.
Edward L. Jordan, Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact:
J. B. Henderson, IE
(301) 492-9654 Attachments:
1. Selected Examples of Licensee Event
Reports Related to Fire Suppressions Systems
2. Events That May Be Precursors to More Serious
Similar Events
3. List of Recently Issued IE Information Notices
- SEE PREVIOUS CONCURRENCE AEOD4 E :IE
KVSeyfrit o nI
6/0/83
JBHenderson AWDromerick RSanders RLR~ VBenaroya 6/ /8ton
6/ /83 6/ /83 6/1 e83 6A0 /83 6110183
IN 83- May , 1983 analysis need not be complex, but should not be limited to a "paper study." The
events reported indicate that a walk-down of plant equipment would have identi- fied instances where minor modifications such as shielding equipment and sealing
cnnduit ends would have reduced water damage from inadvertent operation of the
fire protection system, without significantly reducing its effectiveness. It
appears that in many instances, the hazards analysis did not adequately address
system interactions between fire suppression systems and systems important to
safety, particularly those necessary for safe shutdown. The overall design must
accommodate both needs; that is, it must provide an effective fire protection
system but not adversely affect other aspects of plant safety.
Because of the number and variety of events reported, it is not feasible to
describe all the events reported, but Attachment 1 to this Information Notice
tabulates several representative examples, with some attribution of probable
cause. Also, the Institute for Nuclear Power Operation is planning to issue
a document providing further information on this subject.
To date, none of the reported events have resulted in a serious impact on the
functional capability of the facility to protect the health and safety of the
public. However, in many instances it would not be difficult to extrapolate
actual occurrences to a sequence of events which could lead to much more
serious consequences. Attachment 2 gives some examples.
Although no written response to this notice is required, it is suggested that
holders of operating licenses or construction permits review the information
in this notice for applicability at their facilities. If you have any ques- tions regarding this matter, please contact the Regional Administrator of the
appropriate NRC Regional Office, or this office.
Edward L. Jordan, Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact:
J. B. Henderson, IE
(301) 492-9654 Attachments:
1. Selected Examples of Licensee Event
Reports Related to Fire Suppressions Systems
2. Selected Fire Suppression System
Actuation Events
3. List of Recently Issued IE Information Notices
DEPER:I E"ER PSB:IE DEP=R -,E D:DEPER:IE
JBHende r'..n , merick RSanders RLBEkiv ELJordan
5t$/83:Jr ,/83 5/ /83 5/1//83 5/ /83
Attachment 1 IN 83-41 June 22, 1983 SELECTED EXAMPLES OF LICENSEE.EVENT REPORTS
RELATED TO FIRE SUPPRESSION SYSTEMS
Oyster Creek, November 9, 1980
Personnel were trouble-shooting an electrical fault in an automatic fire
suppression system, without de-activating the automatic feature. Sprinkler
actuation occurred, causing water damage and inoperability of one train of
a redundant safety feature actuation system.
This event appear.s to involve two deficiencies: The hazards analysis had
not recognized the potential system interaction between the fire suppres- sion system and the emergency safety feature actuation system; and the
plant procedure for trouble-shooting was either inadequate or inadequately
implemented (or both).
Oyster Creek, January 9, 1982
A pump drive motor overheated, actuating an automatic fire suppression
sprinkler system. The sprinkler system operation was consistent with- conceptual and detailed design.
Some safety-related equipment suffered water damage. Subsequent.licensee
evaluation indicated that minor modifications, such as sealing conduit ends
and shielding equipment and vents could significantly reduce water damage, without degrading fire suppression capability. A more effective as-built
walkdown could have initiated appropriate preventive actions.
Dresden Unit 3, November 30, 1981
Ionization-type smoke detectors in an HPCI room reacted to high tempera- ture and humidity, and actuated an automatic sprinkler system. The HPCI
system was rendered inoperable as a result of water damage.
Subsequent licensee analysis indicated the heat and humidity signals were
valid, but resulted from local steam and vapor leaks, and from inadequate
procedures related to local ventilation. Analysis also indicated that
water damage could be significantly reduced and perhaps eliminated by
judicious sealing and shielding of equipment. The fire suppression system
was modified to reduce probability of future events.
Dresden Unit 2, December 24, 1981
An event similar to the November 30, 1981 event at Unit 3 occurred at Unit
2. The fundamental cause was the same - inadequate operating and mainte- nance procedures allowed a high-temperature, high-humidity condition to
develop which caused actuation of the sprinkler system in the HPCI room.
In this instance, the redundant automatic depressurization system was co- incidentally found to be inoperable because of a broken wire.
System modifications similar to those on Unit 3 were made on Unit 2.
Attachment 1 IN 83-41 June 22, 1983 Farley Unit 1, June 10, 1981 and July 21, 1982 These two events resulted in unnecessary actuation of the deluge system
for the main cooling towers. Actuation of this system resulted in draw- down of the two water storage tanks below the technical specification
limit*
The sprinkler control system is pneumatic and designed so that an actuation
signal bleeds off control pressure, allowing a deluge valve to open. In
both instances of actuation, the control system had been taken out of
service for maintenance. The procedures were inadequate to maintain
control system pressure above the trip value.
Trojan, July 26, 1981
The automatic fire suppression system was actuated by smoke from welding.
Water damage caused inoperability of one train of the redundant contain- ment atmosphere hydrogen recombiner system.
Maintenance procedures for the welding activity were either inadequate
or inadequately implemented. The maintenance procedure should include
steps to establish a local fire watch and to deactivate, and later re- activate the automatic feature of the fire suppression system.
Surry Unit 2' May 28, 1981 The licensee reported that as part of the fire suppression system, a foam
distributor system was installed in the main (reserve) diesel fuel oil tank.
The system was piped (solid) to the fire suppression water main, without
adequate precautions to prevent accidental unwanted water injection to the
tank. During an unrelated manipulation of the suppression water supply
system, the valve introducing water to the oil tank was inadvertently left
slightly open.
More than 4000 gallons of water had been introduced and some had been
widely distributed in the diesel fuel oil system before a routine
periodic test disclosed the presence of the water. The water had
not reached the immediate supply (day) tanks for the diesel engines
which were promptly and successfully test started. However, extensive
cleanup operations were required and the diesel generators were tech- nically "inoperable" until the water had been removed.
This event is a particularly vivid example of apparent inadequacy in the
analysis required by 10 CFR 50 Appendix R. The fundamental safety require- ment is that there shall be an onsite, reliable source of power to cover
emergency shutdown and cooldown power requirements. The supporting re- quirement is that there shall be on site a sufficient quantity of clean
fuel to sustain operation of the emergency generators. Fire prevention
and suppression provisions are, of course, desirable. dowever, they must
not assume such importance that they jeopardize safety concerns. The sub- seauent reevaluation resulted in retaining the foam-type fire suppression
system but removing the fixed piping internal to the tank.
Attachment 1 IN 83-41 June 22, 1983 Diablo Canyon, October 1982
.A grass fire started outside the controlled area. Neither unit was
operating. The fire burned extensive acreage and the heat and products
of combustion caused temporary loss of all offsite power.
The fire did not cause any damage within the plant. The onsite diesel
generators were started (in anticipation of loss of offsite power) and
operated reliably. However, because of drifting smoke from the fire, the plant staff isolated the control room to assure continued habita- bility. Drifting smoke from the fire caused many fire alarm actuations, and the plant staff was kept nearly continually busy responding to those
alarms. No automatic sprinkler actuation took place since sensors used
for sprinkler actuation are of the heat-sensitive type.
North Anna, Unit 2, July 3, 1981
A fire occurred as a result of an internal electrical fault in a single
phase main transformer. Energy from the fault ruptured the transformer
case containing approximately 9300 gallons of insulating oil. The plant
design provided a drainage pit around the Unit 2 main and station service
transformers, with individual fire walls between transformers. The pit
was filled with uniformly sized gravel for personnel access, but the void
spaces were calculated to be sufficient to contain the inventory of oil
in case of transformer rupture. Two 6-inch drains were provided, to
conduct liquid from the drainage pit to nearby Lake Anna.
Each transformer cubicle is equipped with a water deluge system except the
spare main transformer cubicle, which is at one end and adjacent to the
faulted transformer. Two of the main unit transformer deluge systems
actuated automatically, and the third was actuated manually to protect the
transformer. These deluge systems, plus manual hose streams were competing
with the spilled oil for the limited drainage pit volume. As a result, some of the burning oil escaped from the pit and had to be extinguished
on the ground. The NRC inspector estimates that during the course of the
fire, approximately 130,000 gallons of water were delivered by the deluge
system, and about 90,000 gallons by hand-held hoses.
Ginna, November 14, 1981
Personnel were performing a lamp test on "Satellite Station A (SSA),"
which provides power to smoke detector circuits associated with several
automatic fire suppression water spray/sprinkler systems. System actuation
occurred in several plant areas, which resulted in the trip of one RPS
motor generator set and a small amount of water entering the control rod
drive switchgear cabinet. In response to two dropped control rods, caused
by the above condition, the control. room operators manually tripped the
reactor from full power.
Attachment 1 IN 83-41 June 22, 1983 Subsequent licensee analyses indicated an apparent design deficiency
associated with the power supply to the SSA. Fire suppression system
modifications have been made to preclude inadvertent water discharge. It
was also revealed that personnel had not followed plant procedures for
reenergizing the SSA following a loss of power. Had-personnel followed
procedures, which requires deactivation of the solenoid valve actuator
associated with the fire suppression systems, this mishap would not have
occurred.
Grand Gulf Unit 1, July 14, 1982
A ground in the initiation circuit caused the repeated actuation of the
CO system in the ECCS penetration room resulting in sufficient pressure
buid-up to force open the locked door to the auxiliary building.
The design of the ECCS penetration room was inadequate since it did not
provide proper venting to prevent overpressurization during CO2 discharge.
Attachment 2 IN 83-41 June 22, 1983 EVENTS THAT MAY BE PRECURSORS TO MORE SERIOUS SIMILAR EVENTS
Based on reported events, such as those summarized in Attachment 1 with a reason- able extrapolation, the NRC is concerned that some fire protection systems may be
susceptible to events that were not adequately considered in detailed designs, and that could cause a significant impact on plant safety. Examples of these
concerns are discussed below.
1. Contamination of diesel fuel oil by fire suppression system water.
The Surry Unit 2 contamination of the diesel fuel oil tank by fire sup- pression water (described in Attachment 1) was identified by routine
sampling before the water had reached the diesel engine day tanks, but
a slightly greater rate of inleakage could have contaminated those
tanks too before the sampling interval had expired. Under those cir- cumstances the diesels, even if they started, whould not have operated
long, and could have been damaged to the degree that all of them would
be out of service for an extended time. If the diesels started in re- sponse to an actual loss of offsite power, the consequences could have
been serious.
2. Damage to safety-related equipment by inadvertent actuation of a fire
suppression system.
Most of the events listed in Attachment 1 fall in this category with- out extrapolation.
3. Control and disposal of excess fire suppression water.
The North Anna fire is an excellent example of this concern. The
designer had made provision to control oil leakage in a drainage pit, but had not considered what to do with about 220,000 gallons of water, delivered over a period of about 1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. As a-consequence, the two
6-inch drain lines were overwhelmed, and the burning oil, floating on
the water, escaped from the drainage pit. Escape of the oil made fire
fighting more difficult, and caused some contamination of Lake Anna.
If radioactivity had been involved, the consequences could have been
far more severe.
A number of events have been described in which fire suppression water
leaked through a floor and damaged equipment below. Leakage paths
include cracks (which are not structurally significant) in concrete
floors, unsealed construction joints, and openings for passage of
vertical pipes, cable ways, etc., which do not have water control
seals or coamings.
Attachment 2 IN 83-41 June 22, 1983 4. Common cause for concurrent actuation of many fire suppression systems.
The Diablo event could be repeated at other sites, with more serious
consequences. Many facilities use smoke detectors to actuate fire
suppression systems. These smoke detectors are subject to actuation
by smoke from other areas, dust and, in some cases, steam. Further, the
remote siting of some of these facilities makes them more susceptible
to brush or grass fire effects.
5. Problems that appear to relate to improper or inadequate design.
The Surry water contamination of diesel fuel oil is an example where
the designer did not perform a sufficient analysis of system inter- actions.
The Farley events, the Grand Gulf event, and the Surry event give
evidence that the control system design was not tolerant of oper- ational or procedural errors.
Control systems for fire detection and suppression can take many forms, such as pneumatic, hydraulic-electro-mechanical and direct electric
systems. In some instances initiation is caused by a positive signal, in others, by removal of an inhibit~control. In most, if not all in- stances, electric power is involved. The power supply needs to have
high reliability, and the control systems need to be carefully designed
to minimize the probability of either failure or inadvertent actuation.
In the Farley events the control system contained a pneumatic inhibit
device. When the air pressure decayed sufficiently, the deluge system
actuated.
At Grand Gulf, an intermittent ground in the control system caused
repeated discharge of CO2 to a closed room until a closed and locked
door was blown open.
Events such as this could lead to the generation of missiles that could
damage equipment located in the area or adjacent areas. This damaged
equipment may in turn be required to prevent or mitigate reactor
accidents. An event such-as this could also allow CO to enter the
plant ventilation system and adversely affect plant o~erating peronnel.
Attachment 3 IN 83-41 June 22, 1983 LIST OF RECENTLY ISSUED
IE INFORMATIONNOTICES
Inforrm.ation Date of
Notice No. Subject Issue Issued to
83-40 Need ot Environmentally 06/22/83 All power reactor
Qualify Epoxy Grouts and facilities holding
83-39 Failure of Safety/Relief 06/22/83 All power reactor
Valves to Open at BWR - facilities holding
83-38 Defective Heat Sink Adhesive 06/13/83 All power reactor
and Seismically Induced facilities holding
Chatter in Relays Within an OL or CP
Printed Circuit Cards
83-37 Transformer Failure Result- 06/13/83 All power reactor
ing From Degraded Internal facilities holding
83-36 Impact of Security Practices 06/09/83 All power reactor
on Safe Operations facilities holding
83-35 Fuel Movement with Control 05/31/83 All power reactor
Rods Withdrawn at BWRS facilities holding
83-34 Event Notification Informa- 05/26/83 All power reactor
tion Worksheet facilities holding- an OL or CP
83-33 Nonrepresentative Sampling 05/26/83 All power reactor
of Contaminated Oil facilities holding
83-32 Rupture of Americium-241 05/26/83 All licensees holding
Source(s) Contained in a a specific license
Well Logging Device to possess and use
sealed sources con- taining byproduct or
OL = Operating License
CP = Construction Permit