ML20217H516
| ML20217H516 | |
| Person / Time | |
|---|---|
| Issue date: | 08/12/1997 |
| From: | Connell E NRC (Affiliation Not Assigned) |
| To: | |
| References | |
| NUDOCS 9804290404 | |
| Download: ML20217H516 (12) | |
Text
.
INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS PROGRAM: PERSPECTIVES ON TIIE FIRE RISK ASSESSMENT OF OPERATING REACTORS' Edward A. Connell, CSP, P.E.
Sr. Fire Prctection Engineer U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation Washington, DC 20555-0001
)
Presented at the Second International Conference on Fire Research and Engineering National Institute of Standards and Technology Gaithersburg, Maryland - August 12. 1997 1
i This paper was prepared by an employee of the United States Nuclear 2
Regulatory Commission.
It 3 resents information that does not represent an i
official staff position.
T1e NRC has neither approved or disapproved its technical content.
(j l 9804290404 970812 PDR ORQ NRRA
'( K ';
/
ABSTRACT On June 28. 1991. the U.S. Nuclear Regulatory Commission (NRC) issued Supplemant 4 to Generic Letter (GL) 88-20. " Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities." which requested that the licensees of the operating nuclear power reactors in the United States perform a risk assessment to identify any vulnerabilities to severe accidents resulting from internal fires. identify any low-cost improvements to mitigate the vulnerabilities, and report the result-s of the analysis to the Commission.
At the present time. approximately 35 of the 72 IPEEE submittals have been reviewed by the NRC staff.
This paper provides some preliminary perspectives on fire risk gained through the review of the licensee's submittals.
Thus far, only a few licensees have reported a vulnerability due to fire.
Some licensees have implemented plant modifications or procedural changes as a result of the fire analysis.
Licensees have typically utilized either a fire probabilistic risk assessment (PRA), the " Fire Induced Vulnerability Evaluation Methodology (FIVE) Plant Screening Guide" developed by the Electric Power Research Institute (EPRI). or a combination of the two methods to perform the analysis.
Fire events typically contribute from 3 to 80 percent of the overall risk of core dmage resulting from internal and external events.
A single fire can disable redundant equipment necessary to achieve and maintain safe shutdown conditions and influence the plant operators' performance in response to the event.
The methodology and the assumptions used for the fire analysis have a significant effect on the results. Although there is significant variation in the application of the methodologies. many licensees have gained useful insights concerning the risk due to fire at their facilities.
The NRC is evaluating the use of the fire IPEEE results in the development of performance-based fire protection regulations and for the inspection of licensees fire protection programs.
2
INTRODUCTION Following the fire at Browns Ferry in 1975, the NRC determined that additional regulatory involvement in fire protection was necessary to ensure public health and safety.
Part of this regulatory involvement was the development of the Branch Technical Position (BTP) 9.5-1. " Guidelines for Fire Protection for Nuclear Power Plants." in June 1976.
The BTP provided prescriptive guidance to licensees to establish a fire protection program to provide assurance, through a defense-in-depth design, that a fire will not prevent the performance of necessary safe shutdown functions and will not significantly increase the risk of radioactive releases to the environment.
The NRC. at that time, did not quantitatively define what a significant increase in risk was, or how it was to be determined.
By the late 1970s most licensees had accepted the NRC positions and interpretations provided in the BTP ar.d had revised their fire protection programs accordingly.
However 17 generic issues were outstanding av 32 plants at which agreement had not been reached between the licensees and the 1.5.
To resolve the open issues the NRC determined that an amendment to the regulations was necessary to require certain provisions for fire protection in operating nuclear power plants.
This rulemaking activity resulted in the issuance of 10 CFR 50.48. " Fire Protection." and Appendix R to 10 CFR Part 50
" Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1. 1979 " on November 19. 1980.
Appendix R prescribed the minimum fire protection requirements necessary to resolve the open issues for the operating reactors.
In 1975, the NRC completed the first assessment of the risk of severe accidentsinnuclearpowerplantsandpublishedtheresultsoftheassessment in the Reactor Safety Study (RSS).
However. the RSS did not include an analysis of fire initiated accidents.
The first assessment of fire risk by 2
the NRC was published in 1990.
This assessment, which was based on the avaluation of two operating plants, concluded that the fire-initiated core damage sequences are significant in the total probabilistic analysis for these plants, although these plants had implemented the fire protection requirements specified in Appendix R.
On June 28. 1991, the NRC issued Generic Letter (GL) 88-20. Supplement 4
" Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities.3" which requested licensees to perform an evaluation for plant-specific severe accident vulnerabilities initiated by external events and submit the results to the NRC.
Guidance regarding the process for performing and submitting the results was provided to licensees in NUREG-1407.
" Procedural and Submittal Guidance for the Examination of External Events for Severe Accident Vulnerabilities.'" The purpose of the IPEEE is for each licensee to:
1.
Develop an appreciation of severe accident behavior.
2.
Understand the most likely severe accident sequences that occur during full-power operations.
3
3.
Gain a qualitative understanding of the overall likelihood for core damage.
4.
Reduce, if necessary, the overall likelihood of core damage and radioactive release through plant modifications or procedural changes.
The NRC will evaluate the IPEEE submittals and assess if the licensee has adequately analyzed the plant design and operations to discover potential vulnerabilities.
The NRC will also assess whether the conclusions of the licensee's analysis regarding changes to the plant design of operations are adequate to resolve the vulnerabilities.
The NRC is evaluating the use of the fire IPEEE results in the development of performance-based fire protection 5
regulations and for the inspection o the licensee's fire protection 6
programs NETHODOLOGY To perferm the fire analysis, licensees had the option of using a Level 1 (core damage) probabalistic risk assessment (PRA), the " Fire Induced Vulnerability Evaluation (FIVE).7" developed by the Electric Power Research Institute (EPRI). or ariother systematic examination method acceptable to tha NRC staff.
Specific areas to be addressed by the assessment regardless of the method selected included:
1.
Seismic / fire interactions 2.
Effects of fire suppressants on electrical equipment 3.
Control systems interactions j
l 4.
Potential for cross-zone fire propacation j
5.
Effectiveness of fire barriers 6.
Automatic / manual fire suppression effectiveness 7.
Component fragility to fire and combustion products 8.
Hazards associated with transient combustibles l
Most licensees have used a hybrid method combining the qualitative screening l
aspects of the FIVE methodology with the quantitative aspects of a PRA.
Some licensees have used aspects of EPRI's " Fire PRA Implementation Guide,8" or
" Fire PRA Requantification Studies.'" for the fire IPEEE. The implementation j
guide is based, to a large extent, m the requantification studies.
These documents have not been approved by the NRC as an acceptable method for responding to the request for information in GL 68-20. Supplement 4. as it provides for a less conservative assessment method with a questionable technical basis.
4
To assess the potential for fire damage, licensees have generally used the COMPBRN" code, or the simplified look-up tables provided in the FIVE methodology".
More developed zone models such as CFAST and field models j
12 such as KAMELEON" have not been used by licensees in the submittals reviewed j
thus far.
The COMPBRN code is limited in its application to relatively small j
fires in large com)artments.
These fire scenarlos are generally not risk i
significant.
The IVE screening methodology does not address fire propagation, such as could occur in a stack of cable trays.
The results achieved by both models are highly sensitive to the heat release rate selected for the exposure fire.
The validation and verification of the available fire models for application to nuclear power plants are deficient.
The information requested by the NRC to be provided by the licensee in the submittal includes:
1.
A description of the methodology and key assumptions used in the assessment 2.
A summary of walkdown findings, including a description of the team and j
the procedures used 3.
The criteria used to identify critical fire areas, including a list of the critical fire areas 4.
The criteria used for determining fire size and duration 5.
The application of the fire initiation database 6.
The application of fire damage modeling 7.
Functional event trees associated with fire-initiated sequences l
8.
Fire-induced core damage frequency i
9.
Fire-induced containment failures i
INSIGHTS Fire events typically contribute from 3to 80 percent of the overall risk of l
core damage resulting from internal and external events.
The reported core damage frequencies (CDFs) due to fires range from 1.0E-09 to 5.2E-03 for the submittals reviewed thus far.
The majority of reported CDFs are in the range of 1.0E-06 to 1.0E-05. The broad range of reported CDFs is 3rimarily due to the methodology and assumptions used for the analysis, and t1e safe shutdown scheme used at the plant.
The greatest variance in shutdown schemes for similar plant designs is for fires that require the use of the remote shutdown panel (s), such as fires in the control room or the cable spreading room.
The types of equipment available at the remote shutdown panel (s), and the number and complexity of operator actions is plant specific.
Examples of the variance in assumptions include the treatment of fire barriers. automatic and manual suppression, transient fire hazards, and the selection of heat release rates for plant equipment.
5 i
l
)
There is no correlation evident at present between the type of nuclear steam system supply (NSSS) design (i.e.
Westir.ghouse. Combustion Engineering.
l General Electric. Babcock and Wilcox) or the vintage of the plant and the reported CDF.
In one instance in which two plants operated by different licensees, with the same NSSS design and architect engineer, licensed at l
approximately the same time, the re)orted CDF due to fire for one ]lant was j
1.0E-09. While the value for the otler plant was 1.0E-06.
The rist-significant fire areas identified in the submittals were not the same between the two plants.
The risk-significant fire areas identified by most licensees included the control room, the cable spreading room, the essential switchgear or relay room. vital battery rooms, and the turbine building.
The control room and the cable spreading room are the most dominant contributors due to the reliance on the remote shutdown panel (s) for achieving shutdown following a fire incident.
The essential switchgear/ relay rooms are significant contributors due to the close proximity of important equipment and the potential for a fully developed fire due to the high combustible load typically found in these areas due to cable insulation.
In most scenarios analyzed by licensees, for a fire to lead to core damage a random failure of equirment, not related to the effects of the fire must occur.
This confirms the effectiveness of the existing NRC fire protection requirements Some licensees have implemented plant modifications or procedural changes as a result of the fire analysis that reduced the CDF for the risk-significant fire areas.
These modifications or procedural changes were low-cost improvements voluntarily implemented by the licensee.
Some licensees have identified noncompliances with NRC fire protection requirements through the IPEEE assessment.
Some of these noncompliances have existed since the plant's original fire protection assessment in the early 1980s, while others are the result of plant modifications or procedural changes that were not adequately assessed for impact upon the fire protection program prior to implementation.
Not all licensees have been intimately involved in the preparation of the fire risk assessment.
In some cases, the assessment has been assigned to contractors with limited knowledge of the plant being evaluated and without adequate particip uon or oversight by knowledgeable licensee personnel.
Ancillary participation of the licensee can result in an evaluation that lacks the depth necessary to gain a through understanding of the fire risk at the particular facility.
The walkdowns conducted by the licensees are generally the strongest aspect of the risk assessment, although the detail provided in the submittals varies significantly from plant to plant. The purpose of the walkdowns are to gather data and verify the assumptions used in the assessments. The walkdowns typically address the seismic / fire interactions, some of the Sandia Fire Risk Scoping Study Issues", and transient fire hazards.
The IPEEE fire risk assessment submitted for NRC's review is a snapshot in time of the plant's fire protection configuration.
Few licensees have indicated any desire to voluntarily maintain the analysis as a "living document" and revise the assessment as necessary during the plant's lifetime l
6
)
to reflect the current configuration of the plant or assess the potential risk significance of proposed modifications.
The fire risk assessed in the submittal is not necessarily indicative of the fire risk of a particular facility in the future.
Some specific examples of potentially risk-significant vulnerabilities
)
identified in the submittals reviewed thus far include:
i 1.
A fire in the turbine building that results in the loss of both the offsite power supply and the emergency diesel generator power supply.
which renders all high-and low-pressure pumps that provide water to the l
reactor and heat sink inoperative 2.
A fire in the control building of a multiple unit plant that results in the loss of offsite power to all units, couoled with a random failure of the emergency diesels i
l l
3.
A fire in the turbine building of a two-unit plant that damages the I
fire-affected unit's low-pressure systems when the opposite unit's systems, which are redundant, are unavailable due to maintenance during l
a unit outage l
On the basis of the review of the internal fire analysis submitted to date and of special studies conducted by the NRC staff addressing fire protection l
issues at operating nuclear power plants, the following generic weaknesses with the IPEEE internal fire examinations have been identified:
1.
Fires originating in the turbine building or other plant areas that do l
not contain equipment required for safe shutdown after a fire are being screened from further analysis by most licerisees.
Specific examples.
l identified in a s)ecial study conducted by the NRC" of potential vulnerabilities tlat are overlooked when the turbine building is screened out include (a) the challenge to reactor protection systems following a turbine trip. (b) the potential for a main steam line break and the loss of main feedwater. (c) the effects of turbine building flooding on safe shutdown components, and (d) the potential for a loss of offsite power.
Tne potential for cross-zone s) read of fire hc... in general, not been adecuately addressed in the IPEEE submittals.
Licensees have been acvised by the NRC that rated fire barriers could be considered, for the purpose of the analysis, to prevent fire propagation between fire areas due to the defense-in-depth elements of the plant's fire protection program.
However licensees have not considered the failure of the active components of a fire barrier, such as doors and l
dampers, in their analysis.
In addition, cross-zone propagation from I'
the turbine building and other areas with significant fire hazards, such-as diesel generator rooms, cable spreading rooms, switchgear rooms, and lube oil storage areas. should not be screened from detailed analysis based solely upon the lack of post-fire safe shutdown equipment in the area. An evaluation of the adequacy of the fire barriers that separate these high hazard areas is generally not included in the assessment.
7
2.
The assumption in most internal fire examinations that Institute of Electrical and Electronics Engineera (IEEE) 383 qualified cables remain functional until the cable jacket temperature reaches 700 *F and that unqualified cables remain functional until the cable temperature reaches 425 "F may be incorrect.
In recent industry-sponsored fire endurance tests of electrical raceways enclosed within Thermo-Lag fire barrier materials, the staff has observed that thermal degradation of IEEE 383 qualified cable occurs at cable jacket temperatures below 400 "F.
To ensure that potential vulnerabilities are identified, licensees should use the temperature thresholds spacified in GL 86-10. Supplement 1.
" Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Se arate Redundant Safe Shutdown Trains Within the Same Fire Area p6" in their analysis. unless cable-specific test data are available that demonstrate cable functionality at higher temperatures.
3.
The partitioning of fire-initiating event frequencies for plant areas from the Sandia Nuclear Power Plant Fire Data Base" or other industry historical database based upon a building's total floor area is not justified.
The type, location, and cuantity of combustible materials, the presence of ignition sources, anc the accessibility to the area by plant personnel are the principal factors that should be censidered when partitioning plant areas in order to calculate fire-initiating event frequencies.
4.
The historical data for fire suppression and detection systems used in the IPEEE submittals commonly assume a probability of failure for those systems between 0.01 and 0.02.
This data is generally acceptable for systems that have been designed, installed, and maintained in accordance with appropriate industry standards, such as those published by the National Fire Protection Assoc'? tion.
However some licensees are using these failure probabilities for systems that deviate from the applicable standards.
For example, deviations involving location and type of sprinkler heads and detectors affect the functioning and effectiveness of the systems.
In determining the appropriate failure probabilities, licensees should fully consider all aspects of system design and maintenance.
Manual suppression is usually assessed solely on the basis of recorded respense times of the plant fire brigade during drills.
The time delays associated with fire development. detection, notification of the brigade, the donning of protective equipment. and deciding to initiate fire attack are generally not considered in the assessment.
5.
The use of fire models, such as COMPBRN. by licensees to evaluate the environment inside a fire compartment and the resultant effects upon components required for safe shutdown after a fire incident without an adequate understanding of the limitations, intrinsic errors, and uncertainties associated with the fire models by the user may result in a failure to identify potential vulnerabilities.
Specific examples include (1) single compartment limitation of the model and compartment geometry: (2) validity of modeling coefficients such as heat transfer; ventilation and plume entrainment: (3) validity of input data such as thermal properties of materials: (4) location of fire and targets:
(5) time step dependence on fire development: (6) uncertainty analysis 8
i r
methodology; and (7) obstructed ceiling effects on hot gas layer calculations.
The FIVE simplified lock-up tables assume that all the energy (Joules) from the combustibles in the compartment is released instantaneously.
This method for most scenarios evaluated results in damage times and suppression activation times on the order of 1 to 15 seconds, which is not realistic and may not be conservative in the relative ranking of damage time versus suppression time.
6.
The impact of human performance on the plant's fire risk is potentially significant as the methodology to achieve safe shutdown is usually dependent upon operator actions.
However, the information and methods available to analysts to thoroughly evaluate human performance are lacking.
Operator actions are the most significant in fire scenarios that require abandonment of the main control room and the use of remote or alternate shutdown systems and equipment.
Whereas plant personnel are familiar with the operation of the plant from the main control room, as a result of extensive simulator training and daily experience with control room operations, such is not the case for the remote or alternate shutdown method.
In most cases, operator training is limited to classroom instruction on procedures and plant walkdowns as simulators are typically not available for the remote or alternate systems and equipment.
In addition, an actual plant shutdown using the remote or alternate capability is generally not demonstrated due to the lack of i
diversity and redundancy associated with the method.
In some cases, operators must station themselves at different locations in the plant and coordinate their activities by use of radio communications.
The effect of the fire-induced environmental conditions on personnel performance is generally not addressed.
The stress associated with the fire incident itself and its effects on human performance are generally not considered in the analysis.
7.
The dependence of the assessment on the fire protection criteria issued by the NRC and the licensee's previous fire protection (Appendix R) analysis is a potential weakness.
In general, it is assumed in the analysis that the fire protection criteria specified by the NRC for the separation of redundant systems and components are adequate to allow the fire area to be screened from further analysis.
Few licensees have attempted to verify the information from the previous fire protection analysis, which may be more than 10 years old, although it is used as a basis for the IPEEE. and if incom)lete or inaccurate could invalidate the results of the IPEEE fire risc assessment and mask a potential vulnerability.
Exemptions or deviations granted to licensees from NRC fire protection requirements when an alternative method of providing an equivalent level of safety was approved by the NRC in the past are t
typically not fully evaluated in the assessment for potential vulnerabilities, although guidance to evaluate exemptions is provided in the FIVE methodology.
8.
The effects of the products of combustion, such as smoke. on equipment and personnel are generally not well addressed in the assessments.
The basis for this weakness is due, in part. to the lack of adequate quantitative data on the effects of smoke on the performance of operator 9
I actions. on equipment such as cables, electrical canels. motors, and integrated circuits, and on the lad of valid methods for evaluating smoke effects.
Licensees that have addressed this area generally do so qualitatively. as part of the plant walkdown.
This approach has been generally acceptable.
Some research into the effects of smoke on plant equipment is being sponsored by the NRC*l These weaknesses are generally the focus of requests for additional information provided to the licensees in order to complete the review of the submittal by the NRC staff.
On the basis of the original submittal and the licensee's response to the questions provided, the NRC makes a determination as to whether the licensee has met the intent of GL 88-20. Supplement 4.
l CONCLUSION Licensees that were intimately involved, committed the necessary resources.
and performed thorough and conservative fire risk assessments have gained i
l useful information on the risk posed by fire to their facility.
For licensees that did not consider the fire IPEEE a high priority and unnecssesarily i
restricted their participation and resot-ce commitment the assessment is of limited value for evaluating fire risk.
The assessments indicate that the NRC fire protection requirements have been effective in reducing the risk to the public and the environment from internal i
fire events at nuclear power plants.
The assessments also indicate that some l
plant areas, such as the control room, the cable spreading room, and the I
switch gear rooms, are universally risk significant.
The variability in the methods and assumptions used for the fire risk j
assessments, coupled with the uncertaintj associated with some of the j
assessment tools, such as fire modeling and human factors. precludes the use of the analyses for a comparison of the fire risk between plants and limits l
the application of the assessments for regulatory activities, such as the i
inspection of licensees' facilities, justification for deviations from NRC fire protection requirements, and the development of a performance-based fire l
protection regulation.
Advancements in the state of the art are necessary to reduce the unceroi nties associated with the methods and to produce more uniform results between similar plants to fully gain the benefit of the risk information.
l 10 l
l l
l
I REFERENCES 1.
USNRC, WASH-1400 (NUREG-75/0140). " Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants."
October 1975.
l 2.
" Severe Accident Risks: An Assessment for Five U.S.
Nuclear Power Plants." December 1990.
3.
USNRC Generic Letter 88-20. Supplement No. 4. " Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities. 10 CFR 50.54(f)," June 28. 1991.
4.
Chen. J.T.. Chokshi. N.C., et al.
NUREG-1407. " Procedural and Submittal I
Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulneraoilities, Final Report " U.S.
1 Nuclear Regulatory Commission. June 1991.
6.
Madden. P.
" Fire Safety Rulemaking Issues Confronting Regulatory Change
)
in the United States." Structural Mechanics in Reactor Technology.
Post-conference Seminar No. 6. Fire Safety in Nuclear Power Plants and Installations, Lyon, France. August 25-28. 1997.
6.
USNRC, SECY-96-267. " Fire Protection Functional Inspection Program,"
December 24, 1996.
7.
EPRI TR-100370, " Fire-Induced Vulnerability Evaluation (FIVE)." Electric Power Research Institute (EPRI). April 1992.
8.
EPRI TR-105928 " Fire PRA Implementation Guide " Electric Power Research Institute (EPRI). December 1995.
9.
Parkinson. W., et al.
NSAC/181. " Fire PRA Requantification Studies."
Electric Power Research Institute (EPRI) Nuclear Safety Analysis Center (NSAC). March 1993.
10.
Ho. V., Chien. S.
Aspostolakis. G.. UCLA-ENG 9016. "COMPBRN IIIe: An Interactive Computer Code for Fire Risk Analysis." UCLA School of Engineering and Applied Science, October 1990.
11.
Mowrer. F.
EPRI TR '.00443. " Methods of Quantitative Fire Hazard Analysis." Electric Power Research Institute. May 1992.
12.
Jones, W.W., Forney. G.P.. Technical Note 1283. "A Programmer's Reference Manual for CFAST. the Unified Model of Fire Growth and Smoke Transport," National Institute of Standards and Technology, 1990.
l 13.
Magnussen. B.F., NTH /SINTEF. 1990.
11 l
r
- s
,e 14.
Lambright. J., Nowlen. S.. et al. NUREG/CR-5088. SAND 88-0177. " Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk.
Including Previously Unaddressed issues." USNRC January 1989.
15.
Madden. P., " Assessment of Postulated Fires Resulting From Turbine Failures at U.S. Nuclear Power Facilities." Conference Papers.
Fire & Safety '94. December 1994.
16.
USNRC. Supplement 1 to Generic Letter 86-10. " Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown Trains Within the Same Fire Area." U. S.
Nuclear Regulatory Commission. March 1994.
17.
Wheelis. W., NUREG/CR-4586 " User's Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base." Sandia National Laboratories.
August 1986.
18.
Tanaka. T.. Nowlen. S., Anderson. D.,
NUREG/CR-6476. SAND 96-2633. " Circuit Bridging of Components by Smoke." USNRC. October 1996.
12 L