ML20249C724

Discusses Decision on Dpvs for Improving Effectiveness of NRC Fire Protection Regulations.Staff Recommended Option in SECY-98-058 Can Lead to Efficient Transition If NRC Formulates Clear Workable Regulatory Framework for Option

ML20249C724
Person / Time
Issue date:	06/15/1998
From:	Dey M NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:	Morris B NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20249C707	List: ML20249C706 ML20249C715 ML20249C720 ML20249C724 ML20249C725
References
NUDOCS 9807010100
Download: ML20249C724 (212)

Text

- _ _ _ - _ - - _ _ _ _

.y

() r, '

• f*

i J

4 UNITED STATES

~

j j

NUCLEAR REGULATORY COMMISSION f

WASHINGTON, D c. 20556 0001 o

+9 *.. +,o June 15,1998 MEMORANDUM TO:

Bill M. Morris, Acting Director Office of Nuclear Regulatory Research FROM:

Monideep K. Dey, Senior Nuclear Engineer g}g Probabilistic Risk Analysis Branch Division of Systems Technology, RES

SUBJECT:

DECISION ON DIFFERING PROFESSIONAL VIEWS FOR IMPROVING THE EFFECTIVENESS OF NRC FIRE PROTECTION REGULATIONS In your memorandum, dated June 12,1998, in which you provided me with your decision and rationale for that decision on my d;fici,g professional views (DPVs) I had offered to the agency, you requested my response on whether I was satisfied with the disposition of the issues through the informal process of a DPV. Additionally, you requested any commerits I may have related to the Findings contained in the report of the DPV Panel. In your memorandum to me you specifically stated that you have decided to dispose of the issues in my DPVs by implementing the follow.ing DPV Panel Recommendations:

1.

Draft NUREG-1521 should be issued for peer review and public comment. Industry representatives should be given an opportunity to comment on the document prior to finalissusnce. The information contained in the document could then be used by the industry and staff.

2.

The staff should coordinate fire protection and fire risk research with the EPRI, NFPA and representatives of the nuclear industry. Research activities should include reducing uncertainties associated with application of PRA techniques and underlying assumptions to fires at nuclear power plants.

3.

An approach for using fire PRA in risk-informed decisions on plant-specific changes to the current ll censing basis should be developed consistent with RG 1.174.

I am satisfied with the disposition of the issues in my DPVs with your decision to take the above actions, and do not believe review of the issues in the formal process for expressing differing professional opinions per Management Directive 10.159 would further benefit the agency. I believe the in-depth consideration and analysis of the information I had provided by the DPV panel and RES management, and decision to utilize the information in the future for the agency's mission has benefited the agency toward achieving its strategic objective for implementing risk-informed, performance-based approaches in NRC's regulatory framework.

l 4

i Although you did not adopt my suggested rulemaking option to issue a proposed rule to guide the National Fire Protection Associations (NFPA) in its development of a risk-informed, performance-based fire protection consensus standard, I believe the staff's recommended 1

l 9907010100 990626 E

PDR ORO MtER b

PDR

[

,,3.

[

. -. s.

y. :. ~ :

2 option in SECY-98-058 can lead to an efficient transition. This can be accomplished if the NRC formulates a clear, workable regulatory framework in which such a standard would be adopted and transmits it i2 the industry and NFPA during the standard development process. Industry is opposed to tha rulemaking because of the current lack of clarity regarding a risk-informed, performance-based regulatory framework for fire protection, and is concemed that such a framework may require them to rebaseline their current programs to a new set of standardized prescriptive requirements. An analysis of the change in industry position regciding fire protection rulemaking (from submitting a petition for rulemaking to advocating the canc;tlation c' any potential rulemaking by the staff) will be helpful for future efforts to make a transition in the agency's regulatory structure. Industry's lack of support or opposition to rulemaking does not necessarily mean that there might not be a need to revise current regulations, it does indicate the industry favors the status quo compared to the uncertainties it associates with rulomaking.

The Panel analyzed the current state-of-the-art tools for supporting a risk-informed, performance-based regulatory framework. The DPV Panel concluded that although risk information should be used to assess the robustness of fire protection features and assess the impact of small chanf,es on plant risk, current methods are not adequate to provide a basis for replacing existi: 3 fire protection regulations. There is a varying degree to which methods in existing regulations can be replaced by risk-informed methods, especially for fire protection.

Using risk information to make sma!! changes to fe protection features in some cases will require exempting programs from current regulations. Revising current regulations so that these small changes can be made without requiring exemptions may be a more desirable '

regulatory approach. There are other ways risk information could be used to formulate fire protection features without totally replacing the existing deterministic framework. A further analysis of how risk information could be used in varying degrees to supplement the deterministic framework, and regulatory options available to a!!ow increased use of risk information without requiring exemptions from current regulations, should be beneficial toward the agency's goal to transition to a risk-informed regulatory structure.

cc J. Craig J. Flack R. Wessman A. Thadani H. Thompson P. Bird T. King M. Cunningham N. Siu S. Collins G. Holahan T. Marsh

NUREG-1521 Technical Review of Risk-Informed, Performance-Based Methods for Nuclear Power Plant

~

i Fire Protection Analyses

\\

U.S. Nuclear Regulatory Commission

^

Office of Nuclear Regulatory Research

~

4 g

e NS k

e DRAFT 1

tun p

)

NUREG-1521 l

l Technical Review of Risk-Informed, Performance-Based Methods for Nuclear Power Plant Fire Protection Analyses Manuscript Completed: February 1998 Date Published: March 1998 M. Dey, M. A. Azarm,* R. Travis,* G. Martinez-Guridi*, R. Levine" Division of Regulatory Applications Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 DRAFT

• Brookhaven National Laboratory Upton, NY 11973

• • F:rmerly With j

N tional Institute of Standards and Technology l

Building and Fire Research Laboratory G ithersburg, MD 20899 I

ABSTRACT The Nuclear Regulatory Commission (NRC) has regulatory improvement. This report presents a instituted an initiative for regulatory improvement technical review and analysis of risk-informed, to focus licensee and NRC resources on risk-performance-based methods that are alternatives significant activities, and to decrease the to those in current prescriptive fire protection prescriptiveness of its regulations through requirements or guidance that could allow cost-performance-based methods that allow licensees effective methods for implementing safety increased Hexibility in implementing NRC objectives, focusing licensee efforts, and regulations. The NRC has identified risk-informed achieving greater efficiency in the use of methods utilir.ing insights from probabilistic risk resources for plant safety. A technical analysis of analysis (PRA) as a major tool for achieving its the usefulness of the results and insights derived goal for regulatory focus. The issue of fire from these methods (including accounting for the protection requirements has been identified as a uncertainties in the results) in improving regulatory area in which NRC will pursue regulatory decisionmaking is presented.

i March 1998 iii NUIEG-1521

CONTENTS Srslign Page AB STRACT....................................................................... iii EXECUTIVE S UMMARY............................................................ ix AC KNOWLEDGMENTS........................................................... x v ACRONYMS AND INITIALISMS.................................................... xvii 1 INTRODUCTION....................................

........................1-1 2 CURRENT NRC REGULATORY REQUIREMENTS................................. 2-1 2.1 Fire Safety Requirements................................................

2-2 2.2 Documentation and Reporting Requirements.................................. 2-5 3 EXPERIENCE WITH NRC REQUIREMENTS.....................................

3-1 3.1 Internal Staff Review and Industry Feedback............................... 3-1

' 3.2 Exemption Review...................................................

3-3 3.3 Concl usion...................................................... 3-12 4 ALTERNATE METHODS DEVELOPED SINCE ISSUANCE OF APPENDIX R

....... 4-1 4.1 Fire Probabilistic Risk Assessment Methodology.....................

..... 4-1 4.1.1 Identification of Fire Areas, Fire Zones, and Critical Fire Locations...... 4-1 4.1.2 Estimation of Fire Frequency for Fire Areas, Fire Zones, and Critical Fire Locations................................

.... 4-2 4.1.3 Fire Damage and Suppression................................... 4-2 4.1.4 Fire Event Trees............................................ 4 3 4.2 The "FIVE" Methodology................................

............. 4-3 4.3 Preliminary IPEEE Results.....

4-4 4.4 Results From Fire PRAs.............

.............. 4-4 4.4.1 Review of 12 Fire PRAs..

.............................. 4-4 4.4.2 Comparison of NRC and EPRI Studies..............

........ 4-6 4.5 Uncenainties...................

.4-6 4.5.1 Fire Models............................................

4-6 4.5.1.1 Source Heat Release Rates

.......................... 4-7 4.5.1.2 Multi-Compartment Effects........................ 4-8 4.5.1.3 Effects of Ventilation............................. 4-8 4.5.1.4 Structural Cooling Effect.........

................... 4-8 4.5.2 Parameters Imponant for Calculating Fire Risk.........

.......... 4-8 4.5.2.1 Fire Ignition Frequency............................... 4-8 4.5.2.2 Reliability and Effectiveness of Fire Detection and S uppression...................................... 4-9 4.5.2.3 Threshold for Thermal Equipment Damage Criteria......... 4-9 4.5.2.4 Effect of Smoke on Equipment........................ 4-9 4.5.2.5 Operator Actions................

.................4-10 4.6 Concl u sion....................................................... 4-10 March 1998 v

NUREG-1521

Contents Section Pace 5 DEVELOPMENTS AND PRACTICES OUTSIDE NRC AND U.S. NUCLEAR INDUSTRY....

5-1 5.1 Developments in Nuclear Industry in France

. 5-1 5.1.1 The FLAMME-S Fire Computer Code.

5-1 5.1.2 The MAGIC Computer Code..

..... 5-3 5.1.3 Fire Computer Code Validation..

5-3 5.1.4 Conclusion

..........5-3 5.2 Developments in U.S. and Foreign Building Industries

.5-4 5.2.1 United States..

... 5-4 5.2.1.1 The Program FPETOOL.....

5-6 5.2.1.2 The Program CFAST.............

.. 5-6 5.2.1.3 The Program FASTLite.

5-9 5.2.1.4 Codes for Simulating Smoke Travel During Fires...

... 5-9 5.2.1.5 Computational Fluid Dynamics (Field) Models.....

. 5-9 5.2.2 Japan.

. 5-10 5.2.3 United Kingdom.......

.. 5-11 5.2.4 International Efforts for Code Validation

. 5-12 5.2.5 Features of Some Fire Computer Codes.

....... 5-13 5.3 Conclusion

.... 5-14 6 APPLICATIONS OF RISK-INFORMED, PERFORMANCE-BASED METHODS...

. 6-1 6.1 Categorization of Methods and Application Areas..

.6-1 6.1.1 Perfortnance-Based Methods

.. 6-1 6.1.2 Risk-Informed, Performance-Based Methods.

.. 6-3 6.2 Applications

... 6-5 6.2.1 Performance-Based Analyses...

6-5 6.2.1.1

" Engineering Tools" for Evaluating Fire Dynamics-Bounding Analyses of Combustible Fire Loads........6-5 6.2.1.2 Reliability Methods

.. 6-6 6.2.1.3 Fire Models and Computer Codes Based on Zone Models-Analysis of Safe Separation Distance 6-13 6.2.2 Risk-Informed, Performance-Based Analyses

. 6-19 6.2.2.1 Use of Risk Insights in a Qualitative Manner-Evaluating Need for Emergency Lighting...

..... 6-19 6.2.2.2 Event Tree Modeling and Delta-CDF Quantifications.... 6-22 7 APPLICATION COST BENEFITS

...............7-1 7.1 Emergency Lighting...

7-2 7.2 The 72-Hour Criterion To Reach Cold Shutdown

.7-3 7.3 Cost Evaluation of Fire Detector Case.

7-4 7.4 Safe Separation Distance

......... 7-5 7.5 The Loss-of-Offsite Power Requirement for Alternative or Dedicated Shutdown Capability..........

.. 7-5 7.6 Other Licensee Initiatives.......

.7-7 7.6.1 Fire Barriers....

.7-8 7.6.2 Smoke and Heat Detectors.

... 7-9 7.6.3 Fire Protection Valve Inspections....

................ 7-9 7.6.4 Emergency Lighting

. 7-9 7.6.5 Fire Extinguishers..

.... 7-9 NUREG-1521 vi March 1998

Contents Section Eage 8 REFERENCES................................................................ 8-1 APPENDIX A: REVIEW OF FIRE PROTECTION LITERATURE -

APPENDIX B: CONTRIBUTION OF FIRE TO FREQUENCY OF CORE DAMAGE IN OPERATING NUCLEAR POWER PLANTS: A DATABASE APPENDIX C: FIRE MODELING UNCERTAINTY APPENDIX D: APPLICATIONS OF RISK-INFORMED, PERFORMANCE-BASED METHODS FIGURES Figure 1.1 Objective of the Study......................................................... 1 -2 5.1 Quantification of Thermal Response by FLAMME-S Code (Three-Zone Model)........... 5-2 6.1 Annual Test Failure Probability for Battery-Operated Emergency Lights................ 6-11 6.2 Demand Failure Probability for Battery-Operated Emergency Lights (77'F)............. 6-12 6.3 Demand Failure Probability for Battery-Operated Emergency Lights (50*F)............. 6-12 6.4 Illustration of Critical Cable Locations in the Representative Emergency Switchgear Room (Configuration 1).................................... 6-14 6.5 COMPBRN-Predicted Heat Release From Burning Cables.......................

6-17 6.6 1-MW Fire Source Target and Hot Layer Temperature............................ 6-17 l

6.7 2-MW Fire Source Target and Hot Layer Temperature............................. 6-18 l

6.8 3-MW Fire Source Target and Hot Layer Temperature............................. 6-18 6.9 Comparisons of Hot Gas Layer Temperatures.................................... 6-19 6.10 72-Hour Case Study---Quantified Event Tree..................................... 6-23 6.11 Quantified Event Tree for Loss-of-Offsite-Power Case Study......................... 6-26 TABLES Table Eage i

3.1_ Appendix R Technical Exemptions Granted by the Staff............................. 3-4 3.2 Additional Approved Exemptions From Section III.G.2.a.............................. 3-8 3.3 Sample Approved Exemptions From Section III.G.2.c................................ 3-9 4.1 Plant Core-Damage Frequency (CDF).............................................. 4-5 l

l 5.1 Features of Several Ccmputer Fire Codes........................................ 5-15 6.1 Comparisons of Fire Protection Equipment Surveillance............................. 6-7 6.2 - Effect of Temperature on Battery Capacity Rating................................... 6-10 6.3 Summary Results From FIVE Analyses......................................... 6-15 l.

6.4 Summary of COMPBRN Results................................................ 6-16 6.5 Mean Fire-Suppression Time.................................................... 6-20 6.6 - Percentage of Total CDF..................................................... 6-21 March 1998 vii NUREG-1521

i EXECUTIVE

SUMMARY

In SECY-94-090, the staff formulated the methods to selected areas of requirements for fire framework to institutionalize a Continuing protection contained in Appendix R of 10 CFR Program for Regulatory Improvement. This Pan 50. These applications, or case studies, assess framework was approved by the Commission and the potential for risk-informed, performance-based the program was initiated in May 1994. The main methods to provide additional insights that would objective of this program is to improve regulatory improve regulatory decisionmaking-in evaluating efficiency by providing flexibility to licensees for potential alternate means of implementing NRC implementing safety objectives in a cost-effective fire protection safety objectives while accounting manner, and to use risk information and insights for uncertainties in the results of these methods.

where appropriate to focus NRC and licensee activities in risk-significant areas of its This document presents a technical review of requirements. Funhermore, in COMSECY information relevant and useful to the process for 061, dated April 15, 1997, " Risk-Informed, regulatory improvement. This document is not Performance-Based Regulation" (DSI-12), the intended to suppon any regulatory action by the Commission recognized that, in order to NRC staff. It is specifically noted that the accomplish the principal mission of the NRC in an applications, or case studies, of risk-informed, efficient and cost-effective manner, it will in the performance-based methods presented in this future have a regulatory focus on those licensee report examine and illustrate the potential benefits activities that pose the greatest risk to the public.

of such methods for providing new technical In this document, the Commission reiterated its information, a more systematic process for statement in the PRA Policy Statement that the judging the acceptability of alternative approaches use of PRA technology should be increased in all to prescriptive compliance, and new or improved regulatory matters to the extent supported by the insights of the risk significance of key event state of the art in PRA methods and data, and in a scenarios, including operator actions.

The manner that complements the NRC's deterministic weaknesses and constraints of these applications approach and suppons the NRC's traditional will need to be further defined, and guidance defense-in-depth philosophy. NRC's requirements developed before the implementation of these for fire protection have been identified as an area methods in the regulatory process.

in which NRC intends to pursue regulatory improvement toward meeting the above-stated Experience With NRC Requirements objectives. The intent of this study is to repon on a technical review of risk-informed, performance-A comprehensive analysis of experience with based methods for fire protection analyses that NRC requirements was conducted through a l

have become available since the issuance of NRC review of exemptions granted to Appendix R.

I fire protection requirements and that nave the The technical bases for granting the exemptions potential to improve the regulatory system by and areas in which risk-informed, performance-providing additional insights beyond those based methods were or could have been used to provided by current prescriptive methods, and provide the basis for the request for approval or organizing a systematic process for evaluating fire granting of the exemptions were identified. The protection issues.

following conclusions are drawn on the basis of review of exemptions to Appendix R granted by The experience with NRC requirements was the staff:

reviewed to identify opportunities for the application of risk-informed, performance-based The justifications provided by licensees for methods, while the availability of these methods the request for exemptions, and the technical was determined in a parallel review. The results bases used by the staff for granting the of these reviews were used to conduct trial exemptions, were primarily qualitative applications of risk-informed, performance-based analyses of combustible loading and effect March 1998 ix NUREG-1521 f

L

Executive Summerv based on engineering judgment; in a few A review of 12 PRA studies conducted by the cases, quantitative analyses using fire NRC, EPRI, and nuclear utilities to assess plant models were submitted by licensees as risk, including risk from fire events, yielded the part of the justifications for the following observations:

exemptions.

Given the same plant configuration and Qualitative analyses and arguments similar to parameters, the absolute results of fire those in recovery models in PRA Human PRAs vary significantly because of the data, Reliability Analysis (HRA) were used in

methods, and assumptions used several submittals for exemptions; however, (particularly between those sponsored by quantitative PRA or HRA analyses were not NRC and EPRI) submitted at that time.

Given the same data, methods, and Most of the exemptions are in technical areas assumptions, the major differences in amenable to the use of risk-informed, estimated fire CDF can be explained by performance-based methods that have been plant-specific system design and the developed since the issuance of Appendix R embedded level of redundancies in safety and exemptions granted to that regulation, functions.

e.g., fire PRA, including HRA analysis, and modeling the dynamics of fire effects.

Most studies indicate that the majority (in some cases as much as 90 percent) of the Alternate Methods Developed Since Issuance of risk from fires in nuclear power plants Appendix R comes generally from three or four fire areas, such as the control room, cable In parallel to the review of experience with spreading room, and the switchgear room.

current requirements summarized above, fire PRA and modeling methods that have been developed Fire protection analysis using PRA differs and used by the NRC and the U.S. nuclear in many respects to analysis per NRC industry for conducting PRA studies, and by requirements in Appendix R. For example, licensees for conducting individual plant even though most fire PRAs have identified examinations for external events (IPEEEs) in fires in the control room and the cable response to NRC Generic Letter 88-20, spreading room as significant contributors Supplement 4, were reviewed. The results of to core-melt probability, a coincident loss of PRAs and the IPEEEs are currently not used to offsite power is not included in the support regulatory decisionmaking for the scenarios. This is quite different from the implementation of NRC fire protection regulation, regulation in Appendix R, which requires but have been limited thus far to examine if an assumption that offsite power is lost specific vulnerabilities to fires exist in plants.

coincident with a fire in the control room.

Since Appendix R was issued in 1980, the The significance of a control room fire as probabilistic risk assessment methodology has modeled in PRAs is usually attributable to been developed and used over the last 15 years by scenarios other than the loss of offsite the NRC and the U.S. nuclear industry to power (e.g., a control room fire in a PWR may, among other things, cause the power-(1) determine plant risk from fire events as part operated relief valves (PORVs) to open of general assessments of the total risk spuriously).

profile from plant operations, and The review identified various uncertainty issues (2) identify vulnerabilities to fire events and that have been stated to be associated with fire implement cost-effective safety improve-PRA and modeling. A number of different areas meats to either eliminate or reduce the of a fire protection program can be analyzed impact of these fire vulnerabilities.

without the need for fire modeling (e.g., fire NUREG-1521 x

March 1998 1

Executive Summarv protection equipment surveillance and state of the art of fire models for nuclear plant maintenance test intervals). For these cases, the applications beyond the current state. They have issue of uncenainty can be formally addressed and concluded that this tool provides useful incorporated in the decisionmaking process. In information for safety assessments to supplement other cases in which evaluation of the issues engineeringjudgment on which reactor design and necessitates the use of fire modeliag, the portion fire protection provisions are based. The French of fire modeling that predicts the fire heat-release program includes research work for fire code rate can be differentiated from the portion that development and validation with tests, and predicts the thermal environment. Larger application of the developed fire computer code in uncertainty ranges are associated with the their fire PRA studies initiated in 1993. They predicted heat-release rate than with the thermal intend to use fire PRAs to identify the most l

environment. The heat-release rate is the driving significant locations where vulnerabilities exist I

force for the plume mass flow rate, the ceiling jet and to support the necessary analysis within the temperature, and finally, the hot layer temperature framework of the periodic safety assessments that is driven by energy balance. The fire heat-conducted every ten years in France for each release rate is dependent on the initial fire size, plant.

the growth of fire by propagation and ignition of additional combustibles, and the heat-release rate The review of developments in the U.S. and from these additional combustibles. In any case, foreign building industries revealed a notable the heat-release rate of the fire source, knowing move toward the use of performance-based design the current state of the art, may be estimated methods, and to a limited extent risk analysis, to conservatively by using simplified engineering replace current prescriptive requirements. Among evaluation, subjectivejudgment, and extrapolation the benefits identified are designs to achieve fire of actual fire events or fire tests.

safety that are better and less expensive than those achieved with prescriptive code provisions.

Finally, a preliminary conclusion has been Although the main goal of fire protection for l

reached by the NRC staff that the fire PRA and commercial buildings, thrst is, life safety, is FIVE methods have been successfully used to different from that for nuclear power plants, achieve the objectives of the IPEEE regulatory several features of the fire models and computer program to identify plant vulnerabilities to fire codes being used in the building industry that are events and implement cost-effective safety essential for applications in nuclear power plants improvements to either eliminate or reduce the are similar. Also, other important goals in impact of these fire vulnerabilities. The fire building fire safety - the assessments of the fire j

IPEEE conducted by the Quad Cities nuclear endurance of walls and floors to determine fire power station has been cited by the NRC staff as fighting capability, and spread of fire to nearby an example of the success of the IPEEE program structures-are applicable to nuclear power and use of fire PRA and/or the FIVE methods to plants. Recognizing the benefits of performance-identify vulnerabilities not addressed by Appendix based methods, several countries (New Zealand, R.

Australia, Canada, and U.K.) have modified their building fire laws and regulations to make this Developments and Practices Outside NRC and transition to performance-based regulation.

U.S. Nuclear Industry Australia and Canada are pursuing the use of risk analysis in conjunction with performance-based Developments and practices outside NRC and the methods for building fire protection design. More l

U.S. nuclear industry were also reviewed. The recently, the National Fire Protection Association Institute of Protection and Nuclear Safety (IPSN) in the U.S. has also initiated development of of the French Atomic Energy Commission (CEA) performance-based standards.

and the utility Electricit6 de France have considerable efforts underway for developing and Since the early 1980s, notable developments have utilizing fire PRAs supported by fire computer been made for fire safety engineering analysis for codes. The goal of their program is to advance the building safety using fire models, particularly in March 1998 xi NUREG-1521 j

t

Executive Summarv the U.S., U.K., and Japan. A number of computer Establishing Surveillance Intervals Based codes have been developed and are currently on Performance and Reliability being used for building Gre protection analysis.

Recently, an international collaborative effort Optimizing Test Duration for Appendix R involving several countries has been initiated to Emergency Lighting validate fire computer codes being used in the different countries.

Several intemational Considerations for the Use of Portable conferences are now held annually to present and Lights for Outdoor Activities share results, and experiences. Other than efforts in France, a similar level of international activity Fire Computer Codes Based on Zone Models for developing the capability for performance-

-Analysis of Safe Separation Distance based analysis for nuclear power plant fire protection is not evident. One collaborative effort B. Risk-Informed. Performance-Based Analyses between U.S. and French utilities to compare fire computer codes is noted.

Use of Risk Insights in a Qualitative Manner Evaluating Need for Emergency Lighting Applications of Risk Informed, Performance-Based Methods Event Tree Modeling and Delta-CDF Quantifications This review explored and categorized a variety of applications of risk-informed, performance-based

- Analysis of the 72-Hour Criterion To Reach methods for protection analyses.

Cold Shutdown The first general category of methods is those that

- Evaluation of Loss-of-Offsite-Power would support performance-based approaches, but Assumption for Alternative or Dedicated are not necessarily risk-informed, i.e.,

these Shutdown Capability methods will support implementation of less-prescriptive safety objectives, but do not directly

" Engineering 'ools" based on the principles of analyze or utilize risk information.

thermodynamics, fluid mechanics, heat transfer and combustion have now becorne more available The second general category of methods is those and can be useful for analysis of unwanted fire that would support performance-based and more growth and spread (fire dynamics). These analyses risk-informed approaches, i.e., these methods will can be mostly conducted by hand without a support implementation of less-prescriptive computer program, or sometimes with simple performance criteria, and they analyze or utilize computer routines of fire correlations.

risk information. Based on the review of exemptions to Appendix R and deterrnination of

" Engineering tools" for certain configurations are areas that are amenable to risk-informed, available for calculating an equivalent fire performance-based methods, the following severity, adiabatic flame temperature of the fuel in categories and applications were developed and comparison to the damage temperature of the chosen to exarrine the benefits of applying these target, fire spread rate, pre-flashover upper layer methods:

gas temperature, vent flows, heat release rate needed for flashover, ventilation limited buming.

A. Performance-Based / 1.g and post-flashover upper layer gas temperature.

" Engineering Tools" for Evaluating Fire With the formulation of appropriate guidance, Dynamics-Bounding Analyses of these tools can be used in a gross and conservative Combustible Fire Loads manner to evaluate the adequacy of deviations from prescriptive requirements for configurations Reliability Methods with low fire loading, or to establish the basis for a

fire barrier ratings, safe separation distance, and NUREG-1521 xii March 1998

Executive Summary need for fire detectors and suppression systems in safe-shutdown equipment).

Risk-significant protecting one train for safe shutdown. Since accident sequences, e.g.; for fire-induced station these tools generally employ bounding blackout, can be examined to determine the need calculations, results will be conservative but can for emergency lighting. In some cases, lighting provide useful infonnation to indicate areas where may be required for more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

fire protection features have been overemphasized (or underemphasized).

Fire PRA and other methodologies have inherent in them screening processes that can progressively In cases in which hand calculations cannot be distinguish between and identify high-and low-conducted to provide useful results, fire computer risk fire areas. The screening methods employed codes can be used for more detailed calculations in fire PRAs and other methods can be used to support an assessment of the fire hazard and toward formulating a risk-graded fire protection predict fire protection system response. These program by identifying and focusing on critical computer codes are based on plume correlations, fire areas.

Categories, or grades, can be ceiling jet phenomena, and hot and cold layer established for currently identified fire areas in development and can predict the temperature of plants. A higher level of fire protection could targets exposed to fires, detector and suppression then be extended to fire areas that contribute system actuations, and smoke level and transport signincantly to plant fire risk. This approach during Dres in certain specific configurations. As would be in contrast to prescriptive requirements with any model or computer code, it is essential to that specify that all structures, systems, and understand the bounds of the configuration and components (SSCs) of one shutdown train be parameters within which these computer codes are protected from fires by the same measures valid in order to use the results for developing regardless of the extent of vulnerability of those credible conclusions.

SSCs to a fire or impact on plant risk if they are damaged.

Several reliability-based (based on operating data) methods are available now and are being used in PRA operator recovery models and delta-CDF other areas of NRC requirements. For example, calculations are also available now and can be NRC requirements in Appendix J of 10 CFR Part used to supplement the information used to 50 (60 FR 49495) allow licensees an option to determine the adequacy of alternate approaches.

formulate a performance-based program for Regulatory guides currently being finalized for containment leakage testing. Such approaches can implementing specific changes to a plant's be used to determine an optimal and adequate licensing basis allows the use of delta-CDF as an maintenance and surveillance test interval for fire indicator of the acceptability of implementing protection detection and suppression systems.

speci5c changes. Fire PRA methods can be used Reliability analyses can also be used to provide to calculate the change in core-damage frequency insights on the important parameters to be (delta-CDF) for alternate approaches to fire considered in optimizing the test duration for protection, including for evaluating the role of emergency lighting, and the approximate change operators for recovery actions. These methods are in reliability as a function of test duration.

useful for evaluating the extent to which repairs are appropriate to maintain one train of systems to The results of PRAs and other IPEEE analyses, achieve and maintain shutdown conditions, and including human recovery modeling, and other the use of non-standard systems for shutdown.

more limited analysis, are now available and can The methods can also be used to evaluate and be used in a qualitative manner to provide risk compare alternate means of providing fire insights regarding the impact of alternate protection (by combining separation, fire barriers, appresches. An example is the use of fire PRA and detection and suppression) to safe-shutdown results, including human recovery modeling, to

systems, develop the basis for the plant emergency lighting

{

program in lieu of prescriptive requirements (e.g.,

8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />' duration for all plant areas containing

~

March 1998 xiii NUREG-1521

Executive Suminerv Application Cost Benefits Concluding Remarks Implementation of alternate approaches for fire MP M Presents som potential amas of fire protection programs has the potential to provide opportunities for cost optimization. For operating pr tection requimrngnts that am amenaWe to -

currently available nsk-informed, performance-reactors, opportunities are limited in areas in based rnetMs, and mustrates the rnannu in which fire protection programs have already been which applications could be made. The benefits established and recurring maintenance is not f these methods arejudged to W that they couM necessary. However,if deficiencies are identified Provide new or improved insights for fire as a result of inspections or self-assessments, the pr tection analyses, and a mom systernatic one-time savings could be significant. There is a Process to judge the acceptability of altemative potential for cost reduction in areas in which approaches. These benefits have the potential to recurring activities are required, e.g.,

for surveillance. These costs can be significant when fmProve decisionmaking and increase flexibility in the current mgulatory stmetwe.

A considered over the life of the plant.

comprehensive list of applications, further definition of specific weaknesses and contraints for these applications, and guidance on their use will need to be developed prior to implementing these approaches in the regulatory system.

l l

l l

NUREG-1521 xy March 1998 l

ACKNOWLEDGMENTS The NRC is grateful to the Institute of Protection areas discussed in the report. The authors wish to and Nuclear Safety of the French Atomic Energy acknowledge members of the NRC staff for their Commission (CEA) and Electricit6 de France for comments and contributions to this report, and to the information on their initiatives in technical Rayleona Sanders for editing this report.

l

~

March 1998 xv NUREG-1521

(

ACRONYMS AND INITIALISMS l

ADS automatic depressurization system ERL expected risk to life AFW auxiliary feedwater ESGR emergency switchgear room AHU air-handling unit ESW emergency service water ANSI American National Standards Institute FCE fire-cost expectation AOV air-operated valve FHAR fire hazards analysis report APCSB Auxiliary and Power Conversion FIVE fire-induced vulnerability Systems Branch evaluation ASHRAE American Society of Heating, FPETOOL Fire Protection Emergency Tools Refrigeration, and Air FRA fire risk assessment Conditioning Engineers FSAR final safety analysis report ASTM American Society for Testing and FSES fire safety evaluation system Materials GL generic letter BNL Brookhaven National Laboratory GSA General Services Administration BRI Building Research Institute (Japan)

HPCI high-pressure coolant injection BRP Big Rock Point HPCS high-pressure core spray BSI British Standards Institution HPI high-pressure injection BTP branch technical position HRR heat-release rate B&W Babcock & Wilcox HVAC heating, ventilation, and air BWR boiling-water reactor conditioning CCW component cooling water IAEA International Atomic Energy CDF core-damage frequency Agency CEA Atomic Energy Commission IEEE Institute of Electrical and (France)

Electronics Engineers CFAST Consolidated Model of Fire IP2 Indian Point Unit 2 Growth and Smoke Transport IPE individual plant examination CFD computational fluid dynamics IPEEE individual plant examination for CFR Code ofFederalRegulations external events CHR containment heat removal IPSN Institute of Protection and CIB International Council for Building Nuclear Safety (France)

Research and Development IRRAS Integrated Reliability and Risk CNRS Centre National de la Recherche Analysis System Scientifique ISO International Organization for COMPBRN Fire Hazard Model fer Risk Standardization Analysis CRD control rod drive LER licensee event report CS containment spray LES Large Eddy Simulation LOCA loss-of-coolant accident DCPP Diablo Canyon Power Plant LOR level of resolution DG diesel generator LOSP loss of normal ac offsite power DPC Duke Power Company LPCI low-pressure coolant injection DSIN Directorate for the Safety of LPCS low-pressure core spray Nuclear Installations (France)

LPI low-pressure injection EdF Electricit6 de France LWR light-water reactor EPRI Electric Power Research Institute March 1998 xvii NUREG-1521

Acronyms endinitialisms MCC motor control center RCP reactor coolant pump MCR main control room RCZ radiological control zone MCS minimal cutset RHR residual heat removal MITI Ministry ofInternational Trade RMIEP Risk Methods Integration and and Industry (Japan)

Evaluation Program MOC Ministry of Constmction (Japan)

RPV reactor pressure vessel MSIV main steam isolation valve RRG Regulatory Review Group RY reactor-year NASA National Aeronautical and Space Administration SBO station blackout NFPA National Fire Protection SDC shutdown cooling Association SER safety evaluation report SFPE Society of Fire Protection N'ST National Institute of Standards and Technology Engineers NMD2 Nine Mile Point Nuclear Station st tutory instr ent p

dnit 2 Teknisk Forskning (Norway)

NPP nuclear power plant SNL Sandia National Laboratories NRC Nuclear Regulatory Commission SPC suppression pool cooling NRCC National Research Council of SRP Standard Review Plan Canada SRV safety relief valve SSCs structures, systems, and PC personal computer components PCS power conversion system SSD safe shutdowTi PDR public document room STA Science and Technology Agency PG&E Pacific Gas & Electric Co.

(Japan)

PORV power-operated relief valve STP South Texas Project PRA probabilistic nsk assessment PVC polyvinyl chloride TBCW turbine building cooling water PWR pressurized-water reactor TSD technical support document UK United Kingdom QRA quantitative risk analysis UL Underwriters Laboratory RAM risk assessment model V/I value impact RBCW reactor building cooling water RCIC reactor core isolation cooling l

l NUREG-1521 xviii March 1998

1 INTRODUCTION As part of the regulatory improve nent program it analysis asessing the potential for improving the established in 1994, the NRC is reviewing current current regulatory system through the use of regulations in an effon to improve regulatory results and insights gained from risk-informed, focus and cost-effectiveness of implementing performance-based methods. Figure 1.1 is a flow regulatory safety objectives. Reactor fire chart depicting the objective and process used protection has been identified as one of several in conducting this study. The experience with areas in which the NRC is pursuing regulatory NRC requirements was reviewed to identify improvement.

opponunities for the application of risk-informed, performance-based methods, while the availability The consideration of risk in regulatory decision-of these methods was determined in a parallel making has long been part of NRC's policy and review. The results of these reviews were used to practice. Initially, these considerations were more conduct trial applications of risk-informed, qualitative and were based on risk insights. The performance-based methods to selected areas of early regulations were more prescriptive and requirements for fire protection contained in relied on good practices and accepted Appendix R to 10 CFR Part 50. These epplica-deterministic standards rather than on quantitative tions, or case studies, assess the usefulness of models and risk-informed and performance-based the results and insights from risx-informed, designs. As a result of this practice, most NRC performance-based methods in improving regu-regulations were prescriptive and were applied latory decisionmaking-in evaluating potential uniformly to all areas within the regulatory scope.

alternative means of implementing NRC fire Consideration of the varying risk significance protection safety objectives-while accounting among the areas was limited by the lack of risk-for uncenainties in the results of these methods.

informed methods at that time. The development of new methods has prompted the NRC to initiate This report has eight chapters. Chapter 2 describes a plan for " regulatory improvement" (SECY current NRC regulatory requirements for fire 090).

protection in nuclear power plants to establish the foundation for presenting the experience with In a broad sense, risk-informed and performance-these requirements. Chapter 3 describes the based methods can be thought of as a means of experience with current NRC fire protection providing an altemative option for implementation requirements. Alternate methods for fire l

of regulations that is more efficient in terms of protection developed since the issuance of l

expenditure of resources, while at the same time Appendix R are presented in Chapter 4. Chapter 5 l

focusing proper attention on the risk-significant presents practices and developments outside the aspects of the regulation. This means may NRC and U.S. nuclear industry in nuclear potentially be achieved by an increase in risk-industries abroad, and in other industries in the I

informed discrimination offered by the United States. Chapter 6 presents several trial l

methodology assessed in this report. The applications (case studies) evaluating the j

implementation of such a process may be applicability and usefulness of alternative risk-j facilitated by the availability of plant-specific informed and performance-based methods in l

PRAs* being performed by utilities in response to improving regulatory decisionmaking accounting

(

NRC Generic Letter 88-20, Supplement 4, on for the uncertainties in the results. Potential j

individual plant examinations.

efficiencies in terms of cost savings that may be gained from applying risk-infe'med, performance-This report presents a technical review and based methods are presented in Chapter 7. A list of references is given in Chapter 8. Appendices l

supplement the information in the repon.

• However, these risk assessments, when used for l

such purposes, must remain up to date.

l March 1998 1-1 NUREG-1521 l

introduct on. _

i Review risk-Review experience with

informed, NRC fire protection requirements, and Performance-based identify opportunities for methods in practice the use of risk-informed, or being developed performance-ba.ed for fire protection methods (Ch. 3) analysis (Ch. 4 & 5)

I V

Conduct trial applications of these methods to assess their usefulness in providing

{

insights for regulatory decsionmaking onissues identified in the experience review (Ch. 6) l Figure 1.1 Objective of the Study

)

i NUREG-1521 12 March 1998

)

2 CURRENT NRC REGULATORY REQUIREMENTS In order to present the experience with NRC how operating plants had implen-ented the requirements (discussed in the next chapter),

guidance contained in Appendix A to the BTP.

current NRC requirements are described briefly in With the exception of Sections III.G, J, L, and O this Chapter.

(which were backfit on all plants regtrdless of previous approvals granted by the staff), those After investigating the 1975 fire at Browns Ferry, portions of Appendix A to the BTP that were the NRC determined that additional specific previously accepted by the staff remair ed valid.

guidance was necessary to assure that Therefore, Appendix R does not, by itself, define the fire protection program of any plant. For the existing fire protection regulations plants licensed before January 1,1979 (pre-79

=

(General Design Criterion 3) were properly plants), the fire protection program is detined by implemented Appendix A to the BTP, the applicable pos tions of Appendix R (i.e., open issues from Appendix A the established principles of " defense in reviews), and any additional commitments made depth" were applied in defense against fire by the licensee, as stated in conditions of its operating license.

Subsequently, in May 1976, the staff issued Branch Technical Position, Auxiliary and Power The fire protection programs implemented by the Conversion Systems Branch,9.5-1 (BTP APCSB remaining " newer" units were generally reviewed 9.5-1) "Gndelines for Fire Protection for Nuclear under NRC Standard Review Plan (SRP) Section Power Piants." The guidance in this document, 9.5-1 (NUREG-0800) and applicable sections of however, was only applicable to plants that had Appendix R (as identified in the plant's operating filed an application for a construction permit after license).

July 1,1979.

The operating licenses of pre-79 plants typically At the time of the Browns Ferry fire, the majority contain a condition requiring implementation of of plants that are operating today were either modifications committed to by the licensee as a operating or were well past the design phase and result of reviews conducted under Appendix A to into construction. In an effort to establish an BTP 9.5-1. These license conditions were added acceptable level of fire protection at these " cider" by license amendments.

plants, without significantly affecting their design, construction, or operation, the NRC modified the The license conditions for plants licensed after guidelines in the original BTP (BTP APCSB 9.5-1979 (post-79 plants) vary widely in scope and

1) and,in September 1976, issued Appendix A to content. Some only list open items that must be BTP 9.5-1, " Guidelines for Fire Protection for resolved by a certain date or event (e.g., before Nuclear Power Plants Docketed Prior to July 1, startup or before first refueling outage); some 1976." The NRC then reviewed the analyses reference a commitment to meet sections of submitted by each operating plant against the Appendix R; and some reference the final safety guidance contained in Appendix A to BTP 9.5-1 analysis report (FSAR) or the staff's safety and visited plants to examine the relationship evaluation report, or both.

between structures, systems, and components important to safety and fire hazards, the potential License conditions did not specify when a consequences of fire, and the associated fire licensee may make changes to the approved protection features.

program without requesting a license amendment.

If the fire protection program committed to by the it is important to note that Appendix R to 10 CFR licensee is required by a specific license condition Part 50 was issued to address only certain "open or is not part of the FSAR for the facility, the issues" raised by the NRC during its review of provisions of 10 CFR 50.59 may not be applied to March 1998 2-1 NUREG-1521

Current NRC Regulatorv Requirements make changes without prior NRC approval. Thus, approved by the Commission.

licensees may be required to submit license amendment requests even for relatively minor As with other changes implemented under 10 CFR changes to the fire protection program.

50.59, the licensee must To resolve these problems, Generic Letter (GL) maintain a cunent record of all such

=

86-10 authorized plants to incorporate the fire changes,and protection piogram and major commitments, including the fire hazard analysis, by reference report all changes to the approved program e

into the FSAR. In this mannar, the fire protection annually to the NRC Office of Nuclear program-including the

systems, the Reactor Regulation.

administrative and technical controls, the organization, and other plant features associated Additionally, if the operating license is amended with fire protection-would be on a consistent to include this standard license condition, status with other plant features described in the FSAR. Also, the provisions of 10 CFR 50.59 The licensee may request an amendment to would then apply directly for changes the licensee delete the technical specifications that will desires to make that would not adversely affect now be unnecessary.

the ability to achieve and maintain safe shutdown.

Specifically, GL 86-10 allows licensees to adopt Temporary changes to specific fire the following standard license condition:

protection features which may be necessary to accomplish maintenance or modifications (Name of licensee) shall implement and are acceptable provided that interim maintain in effect all provisions of the compensatory measures (e.g., fire watches) approved fire protection program as are implemented.

described in the Final Safety Analysis Report for the facility (or as described in Examples of issues that could require an submittals dated

) and as exemption (from regulation) or deviation (plant approved in the SER dated license condition) regardless of license (and Supplements dated i

amendment option selected are modifications to subject to the following provision:

the level of separation and protection provided The licensee may make changes to the for redundant trains of safe-shutdown approved fire protection program without equipment, prior approval of the Commissien only if those changes would not adversely affect auto suppression and detection systems, and the ability to achieve and maintain safe shutdown in the event of fire.

the safe-shutdown methodology approved in the plant's safety evaluation report.

Therefore, plants that have amended their oper-ating licenses in accordance with GL-86-10 may 2.1 FIRE SAFETY REQUIREMENTS alter specific features of their approved fire protection program provided that The major fire protection requirements for nuclear power plants are the following:

the change does not otherwise involve a a

g7, g 9

char.ge m a license condition or techm, cal specification or result in an unreviewed safety question (see 10 CFR 50.59), and performance of a fire hazards analysis the change does not result in a failure t establishment of fire protection features for s

i or pmig a Gm complete the fire protection program as hazard to stmetures, systems, or components NUREG-1521 2-2 March 1998

Current bRC Reguletorv Requirements important to safety the main fire loop for maintenance.

provision of an alternative or dedicated safe-shutdown capability in areas in which fire III.C The requirement for hydrant protection features cannot ensure safe-isolation valves: These valves shutdown capability permit the isolation of outside hydrants from the fire main for These fire protection requirements have been maintenance activities without implemented at all ope.ating nuclear power affecting the protection by the plants. As described above, the fire protection fire suppression system of safety-commitments identified in the plant operating related or safe-shutdown systems.

license is a function of vintage and other plant-specific considerations. Pre-79 plants are III.D The requirement for the install-generally committed to all or portions of ation of sufficient manual stand-Appendix A to BTP APSCSB 9.5-1 and portions pipe and hose systems so that at of Appendix R to 10 CFR Part 50. Newer plants least one effective hose stream were reviewed to SRP Section 9.5-1 and the will be able to reach any location appropriate section of Appendix R.

that contains or presents an exposure fire hazard to stmetures, A brief description of the major sections of systems, and components that are Appendix R follows.Section III, " Specific Re-important to safety.

quirements." is discussed in greater detail to present the necessary background for the case III.E The requirement for hydrostatic studies in Chapter 7.

testing for fire hoses: Hoses stored in outside fire houses must I

Contains an introduction and discusses the be tested annually; interior stand-scope of Appendix R.

pipe hoses must be tested every 3 years.

II Presents the general requirements of Appendix R, including the establishment of III.F The requirement for the install-a fire protection program, the performance ation of automatic fire detection of fire hazards analysis, and the incor-systems in all plant areas that poration of fire prevention features into the contain or present an exposure design and operation of the plant.

fire hazaad to safe-shutdown or safety-related systems and III Presents the following specific require-components.

ments of Appendix R:

III.G The following requirements for III.A The requirements for fire sup-protecting the safe-shutdown pression system water supplies:

capability from fire:

Two separate water supplies, each consisting of a storage tank, (1) Fire protection featmes must pump, piping, and the appro-be provided for structures, i

priate isolation and control valves, systems, and components are required to furnish the that are important for safe necessary water volume and shutdown. One train of pressure for the main fire loop.

systems necessary to achieve and maintain hot shutdown III.B The requirement for the install-should be free of fire ation of sectional isolation valves damage. Systems necessary to permit isolation of portions of to achieve and maintain March 1998 2-3 NUREG-1521

Current NRC Regulatorv Requirements cold shutdown must be IIIJ The requirement for the install-repairable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

ation of 8-hour, battery-powered, emergency lighting units in all (2)

Separation or protection areas in which safe-shutdown and, in some cases, de-equipment must be operated, and tection and automatic for access and egress routes suppression are required thereto.

for redundant trains within the same fire area to ensure III.K The requirement for admin-that one hot-shutdown train istrative controls to minimize fire is free of fire damage. Fire hazards in areas containing areas inside non-inerted stmetures, systems, and com-containments have addi-ponents important to safety. Plant tional fire protection procedures are required to be options.

established, including procedures to control the handling and limit (3)

Alternative or dedicated the use or storage of com-shutdown capability is bustibles, govern the use of required if the hot shut-ignition sources, maintain good down protection / separation housekeeping practices, control requirements of Section plant response to a fire, and III.G.2 are not satisfied, define fire fighting strategies to or if fire suppression protect safety-related equipment.

activities or inadvertent operation or failure of the III.L The following major require-fire suppression system ments address the altemative and can damage all redundant dedicated shutdown capability:

hot-shutdown trains. In addition, fire detection and (1) The attemative or dedicated a fixed fire suppression shutdotyn capability must system are required for reach cold-shutdown condi-these areas.

tions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain reactor coolant III.H The requirement for the estab-system process variables lishment of a fire brigade on site within those predicted for a to ensure adequate manual fire loss of normal ac power.

fighting capability for all areas of the plant containing structures, (2) The functional performance systems, and components im-goals of shutdown must be portant to safety. Brigade size, presented.

brigade qualifications, and mini-mum fire fighting equipment are (3) The shutdown capability specified.

must be independent of the specific fire area (s) for III.I The requirement for the estab-which it is being used. It lishment and maintenance of a also must be independent of fire brigade training program, offsite power for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

consisting of periodic classroom instruction, fire fighting practice, (4) The systems and equipment and fire drills, to ensure the necessary for hot shutdown capability to fight potential fires.

or hot standby must have NUREG-1521 2-4 March 1998

Current NRC Regulatorv Requirements the capability to maintain order to minimize the likelihood such conditions until cold of fires ass.riated with RCPlube shutdown can be achieved.

oil leaks.

(5) The safe-shutdown equip-2.2 DOCUMENTATION AND REPORTING ment and systems for each REQUIREMENTS fire area must be isolated Currently, fire protection requirements are from non-safety-associated SPecified in 10 CFR 50.48 and Appendix R to circuits to ensure that circuit failures will not 10 CFR Part 50. Additional guidance is given in prevent operation of safe-E!"*#

'.etters and information notices (stated in Section-2.1). The requirements in shutdown equipment.

Appendix R instruct the nuclear power plant designer on how to provide fire protection that III.M The requirement that only non-will be acceptable to the NRC, and what actions combustible materials may be (e.g., fire bngade training, equipment testing, and used for fire barrier cable pene-in5Pection procedures) must be carried out to tration seals.

Qualification maintain a license to operate.

testing acceptance criteria are Presented.

,g 9

P an approved by the NRC staff. If changes are l

Ill.N The requirement that the closure desired in this program plan, approval of such capability of fire doors must be changes is requested from the NRC, and when verified periodically to ensure approved, the changes become a part of the that these doors protect the program plan. Fires experienced in the plant that openings in case of fire.

affect safety equipment are reponed to the NRC in licensee event repons per Q 50.73 of 10 CFR Part III.O The requirement that a reactor 50 and become a part of the permanent NRC coolant pump (RCP) oil col-rec r Utre safety exprience.

lection system is provided for non-inerted containments, in l

l March 1998 2-5 NUREG-1521

l l

l

3 EXPERIENCE WITH NRC REQUIREMENTS This chapter presents a summary of an internal indicate that typically four or five significant staff review and industry feedback on the fire events (i.e., those that degrade one or experience with NRC requirements discussed in more safety systems or result in a plant Chapter 2. This is followed by a comprehensive transient) will occur each year in all domestic analysis of experience with NRC requirements nuclear power plants.

through a review of exemptions granted to Appendix R. The technical bases for granting the NRC-sponsored probabilistic fire risk i

l exemptions are identified, and areas in which risk-assessments have generally estimated that the informed, performance-based methods were or core-melt frequency due to fire is currently in could have been used to provide the basis for the the range of IE-4 to IE-5 per reactor-year and request for approval or granting of the exemptions that implementation of the NRC fire are presented.

protection requirements has generally reduced the vulnerability due to fire by about 1 order 3.1 INTERNAL STAFF REVIEW AND of magnitude. The risk fraction of the total INDUSTRY FEEDBACK core-damage frequency (CDF) due to fire for the plant can range anywhere from less than The Regulatory Review Group (RRG), an 5 percent to more than 50 percent, but for independent group of NRC staff established by most plants is 20 to 40 percent. Industry the NRC in 1993, reviewed the fire protection studies have indicated that the fire risk regulations and recommended improvements. The fraction of the total CDF is lower. The risk group stated that " improvements in fire protection contribution of fires in nuclear power plants is material and component performance and the discussed in greater detail in Section 4.4.1.

years of fire protection experience and data gained since the issuance of the fire protection rule in Dominant sequences in fire PRA studies 1980, appear to indicate that additional flexibility typically involve control rooms, control in the applicable regulations could be allowed cabinets, emergency switchgear rooms, and without adverse safety impact." The fire cable spreading rooms.

protection regulations were also reviewed by the Office of Nuclear Reactor Regulation at the NRC The Fire Risk Scoping Study (NUREG/CR-in 1992, and the results of the review were 5088) concluded that weaknesses in either published in the staff report on the reassessment manual fire fighting effectiveness or control of the NRC fire protection program (SECY systems interactions could raise the assumed 143). That report contained a finding that the fire-induced CDF by 1 order of magnitude.

current requirements and guidelines were developed before the staff or the industry had the The vast majority of fires are identified and benefit of probabilistic risk assessments (PRAs) extinguished by plant personnel (including for fires and before there was a significant body of fire watches) and not by automatic detection operating experience. The report concluded that and suppression systems. The human element a revised 10 CFR 50.48 (and perhaps the is clearly a critical part of the fire safety elimination of 10 CFR Part 50 Appendix R) could equation and should be recognized as the first establish a more reactor-safety-oriented fire line of defense for mitigating the effects of protection rule, add appropriate flexibility in some fire. Fire watches may be more valuable as a areas, and eliminate the potential for confusion mitigating factor than was previously and conflict between 10 CFR 50.48 and Generic recognized.

Letter 86-10. Additionalinsights important to fire protection issues in the report are the following :

Most fires are of electrical origin, and since electrical fires typically involve significant Event reports submitted over the last 5 years pre-ignition heating times, they are more March 1998 3-1 NUREG-1521

Experience With NRCRequirements I

likely to be discovered by plant personnel who of combustion (such as turbine building fires),

occupy and tour the different areas of the but their severity in terms of challenges to plant. Also, circuit protective features can safety systems operation has been limited.

intermpt power to faulted circuits and/or the faulted condition can cause control room Fire durations during power operations and annunciation before the fire can become fully shutdown conditions were generally short developed. It is, therefore, important to train (less than 10 minutes).

plant operators to be sensitive to these scenarios and to respond accordingly.

Operating experience indicates that the frequency and duration of shutdown fire Fire event reports indicate that automatic fire events appears to be similar or less significant

+

suppression and detection systems do not than for fire events occurring at power always function properly, and heavy smoke operation.

can inhibit manual fire fighting efforts.

On the basis of two questionnaires in conjunction Event reports sometimes describe fire with formal interviews used to survey industry suppression system actuations that cause organizations and the NRC, NUREG/CR-4330 design deficiencies or maintenance problems reported on regulations that were suggested for to be discovered, such as inadequately sealed improvement. One of the regulations most components cnd inadequately sealed fire frequently cited by the industry was 10 CFR areas.

Part 50, Appendix R. The licensees suggested modifying specific parts of Appendix R or Fire research studies indicate that the 20-foot guidance for it that contained the following:

separation criterion required by Appendix R is not always sufficient in and of itself to disabling automatic features such as transfer protect redundant trains from a single functions and system realignments in order exposure fire. Considerations like this have to satisfy the separation requirements for played an important role in establishing the safe-shutdown equipment current defense-in-dep'S requirements.

assumptions for transient combustible loads for areas with safe-shutdown components On the basis of inspection experience, it the loss-of-offsite-power assumption in the appears that licensees typically maintain their event of a fire fire protection programs as required by the the use of 3-hour fire barriers regardless of regulations, and a few licensees actually go fire loading beyond the regulatory requirements.

fixed emergency lighting for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> regard-less of an assessment of the need for lighting In 1997, the NRC staff completed a special study, no credit for operator action to mitigate the AEOD/S97-03 (NRC,1997) to examine U.S.

effects of plant fires operating experience through a review of fire events from 1965 through 1994. The report The proceedings of the workshop on the program identified the following major findings and for the elimination of requirements marginal to conclusions:

safety (NUREG/CP-0129) were also reviewed.

During the workshop, several regulatory areas, A comparison of fire events in the pre-including the Appendix R fire protection Appendix R period (1965-1985) with fire requirements, were examined. Potential areas for events in the subsequent period shows that regulatory reexamination suggested by industry event frequencies have declined slightly, were fire hose testing, fire brigade training, while the safety significance of events has standard repair operations for hot shutdown, also been lower. Since the fire at the Brown's emergency lighting, suppression and detection Ferry nuclear plant, some fires have been system surveillance and maintenance severe in terms of the magnitude and duration requirements, use of fire watches, the 20-foot l

NUREG-1521 3-2 March 1998

Extwrience With NRCRequirements separation criterion, prescriptive use of 1-and 3-require modifications and potential forced hour fire barriers, loss of offsite power, and the outages, and have a significant economic impact.

capability to attain cold shutdown within 72 However, other areas, such as surveillance, for hours.

which a licensee is in full compliance, may also prove to be economically significant nver the life 3.2 EXEMPTION REVIEW of the unit.

Since the implementation of Appendix R to 10 The effort to review exemptions commenced with CFR Part 50, the NRC has issued approximately a review f selected Appendix R documents for 900 non-scheduler exemptions from the fire background, meluding the federal Register protection requirements (Levin and Kanz,1995).*

statements of consideration for the rule; the These exemptions implement alternative m erPretation of fire protection requirements approaches which provide a plant-specific level of f und in Generic Letter 86-10; IE Information fire safety that is considered equivalent to the Notice S4-09, m which the NRC staff cited Prescriptive requirements of Appendix R.

lessons learned from the fire protection inspecti ns f safe-shutdown equipment; SECY-In general, the licensees requested most of the 83 269; NUREG/CR-4330; and NUREG/CP-exemptions from the techm. cal requirements of 0129, which contains a summary of the workshop Section III.G,

• Fire Protection of Safe Shutdown n regulati ns that have marginal to safety Capability"; Section IIIJ, " Emergency Lighting";

and Section III.L, "Altemative and Dedicated

[*9""***"I The intent of this review was to identify areas m. which industry compliance to the Shutdown Capability." Table 3.1 presents a rule was stated as a hardship as evidenced by the summary of the number of exemptions granted results of inspections, exemption requests, and the techmcal areas in which equivalency was s rveys, and input during the workshop.

demonstrated and approved by the staff. Details of these exemptions are presented later.

SECY-83-269 summarized approved exemptions l

f r the 1982-1983 time period. More than 88 Given the state of the art for PRA and the fire Percent of the 234 exemptions addressed sciences when Appendix R was adopted, a highly Appendix R,Section III.G. These include prescriptive regulation was appropriate. The flexibility of the exemption process allowed non-fuse rem val f r hot shutdown or repair of

+

compliances to be examined in detail and equi ment that is not immediately needed P

approved if equivalency could be demonstrated.

(III.G.1)

However, a cost is associated with each exemption request, both for the licensees and the partial barriers or less than 3-hour rated

)

+

NRC. Furthermore, the exemption process is barriers (III.G.2.a) itself a disincentive for many licensees, especially when there are no precedents. Rather than be intervening combustible materials within the

+

subject to this unknown, many licensees opt t 20-foot separation required by II.G.2.b, if the make the necessary changes to prescriptively quantity was judged m.sigmficant.

comply with the regulation. Only when the cost of compliance becomes prohibitive does the no automatic suppression (III.G.2.b, c), again

+

exemption process become attractive. Thus, the with a low fire loading and high exemptions that are requested and the subsets that c mPartment ceilings are approved tend to be substantive issues that l

Three exemptions from the emergency lighting requirement (Section IIIJ) were approved to allow portable emergency lights inside the containment

• In addition, approximately 450 deviations from BTP 9.5-1, Appendix A to BTP APCSB 9.5-1, and l

SRP 9.5-1 have been approved.

March 1998 3-3 NUREG-1521

Experience With NRC Requirements Table 3.1 Appendix R Technical Exemptions Granted by the Staff App. R No.

Section Technical Area Exemption Remarks s

III.

Specific Requirements III.A Water Supplies 1

III.E Hose Testing 1

III.F Automatic Fire Detection l4 III.G.1 Fire Protection Features 2

III.G. I.a One Train of Safe-Shutdown Systems 11 Maintained Free of Fine Damage III.G.I.b Systems Necessary To Achieve Ccid 4

Shutdown Can Be Repaired Within 72 Hours III.G.2 Redundant Trains of Systems Necessary 175 To Achieve and Maintain Hot Shutdown Outside of Primary Containment III.G.2.a 3-Hour Fire Banier 164 III.G.2.b 20-Feet of Spatial Separation With Auto-129 matic Suppression and Detection III.G.2.c l-Hour Fire Barrier With Auto Detectien 122 and Suppression III.G.2.d Inside Containment-Horizontal Serara-21 tion of More Than 20 Feet III.G.2.e Inside Containment-Auto Detection and 6

Suppression III.G.2.f hside Containment-Rarilant Energy 7

Heat Shields III.G.3 Fire Detection and Suppression for Areas 139 Most plants requested an Requiring Alternative or Dedicated exemption from auto-Shutdown Capability suppression in the main control room III.H Fire Brigade 1

IIIJ Emergency Lighting 39 III.L Alternative and Dedicated Shutdown 36 Capability III.M Penetration Seals 4

III.O Reactor Coolant Pump Oil Collection 24 Majority of exemptions System were associated with collection tank capacity Total 900 NUREG-1521 3-4 March 1998

l Experience With NRC Requirements Several exemptions from Section III.L (alternative As indicated in the earlier discussion of SECY shutdown) were granted to allow licensees to 269, the bulk of the approved exemptions (up to achieve cold shutdown in more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 1983) were for the separation requirements of provided that onsite power was used. Requests Section W.G. As showr,.a Table 3.1, Section for exemption from the loss-of-offsite-power IILG continues to account for about 87 percent of requirement were denied.

all approved exemptions in the FIREDAT database.

Some exemptions from Sectiori m.O for reactor coolant pump oil collection systems were Section m.G.I.a requires that the installed fire approved because of small quantities of oil or the protection features be capable of limiting fire use of non flammable fluid in the pump coupling.

damage so that one train of systems necessary to achieve and maintain hot-shutdown conditions is The FIREDAT computerized database (Levin and free of fire damage.

Kanz,1995) contains NRC-approved deviations and exemptions granted to licensees from the The FIREDAT database has identified 11 criteria contained in NRC guidelines on fire approved exemptions for Section m.G.I.a. The protection, namely, Branch Technical Position approved hot-shutdown repairs range from simple (BTP) APCSB 9.5-1, Appendix A; BTP CMEB low-voltage fuse pulling (to prevent spurious 9.5-1 (NUREG-0800); and 10 CFR Part 50, operation) to more complex actions that involve Appendix R. FIREDAT is used to update the lifting leads and attaching jumpers to permit local SECY-83-269 ex. nption summary to early 1994.

equipment operation. A sample of the approved exemptions is discussed below (the bases for the The database has identified 1273 approved approval of the exemptions presented here are exemptions and dc iations as follows:

derived from the review of the safety evaluation v

reports):

Appendix R 900

=

BTP 9.5-1 355 The Dresden licensee received approval for

=

Appendix A 96 manual recovery actions [8908220394]**,

=

1351*

including fuse removals, fuse replacements, tripping circuit breakers, opening disconnect As shown in Table 3.1, Sections m.F. G. J, L, and switches and load shedding. The established O account for most of the exemptions granted plant procedures for these actions as well as from Appendix R.

licensee controls for fuse replacement (i.e.,

location, accessibility, surveillance, and Section III.F " Automatic Fire Detection," has 14 operator safety) were considered.

approved exernptions.These approved exemptions I

address plant areas containing safety-related FitzPatrick requested an exemption to permit i

equipment that lacks automatic fire detection fuse pulling, lifting of leads, and cable f

systems. The majority of these exemptions were cutting, all for low-voltage circuits. The staff approved on the basis oflow combusuble loading approval [8305060548] was limited to high-in the area and a qualitative assessment of limited pressure coolant injection (HPCI) and reactor l

damage if a fire were to occur. Other approved core isolation cooling (RCIC) fuse pulling.

exemptions credit fire detection capability within Both recovery actions involved the removal of the area (partial) or in adjacent zones.

a single fuse located in the relay room.

The Hatch licensee received permission

• The discrepancy between the 1273 total and the

[8701070595] for operator action to restore i

detailed breakdown of 1351 appears to be attribus residual heat removal (RHR) pump room l

able to those cases in which one exemption or deviation is applicable to multiple requirements or guidance, i.e., Appendix R, IllJ and BTP APCSB 9.S-1.

" [NUDOCS accession number]

March 1998 3-5 NUREG-1521 1

U__________________.

Experience With NRC Requirements I

cooling, RCIC pump and room cooling, The use of gasoline-powered fans for and the diesel generator voltage regulator.

charging pump cubicle and emergency The RHR and RCIC room cooling manual switchgear room ventilation was approved for l

actions were estimated to take about 20 the Beaver Valley licensee [8303290263].

minutes each. These actions have a time The fans would be set up and operated by the wiadow of about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> before room fire brigade. A 1-hour to 2-hour time period temperatures reach the design limit. In the is available before high ambient temperatures case of the voltage regulator for the diesel could damage critical equipment.

generator, its function can be restored in 15 minutes by opening links and installing The Big Rock Point fire analysis assumes the jumpers. The time available to perform this loss ofinstrument air in certain fire areas due action is % hour. In order to perform this to a loss of service water for compressor task, a dedicated operator will be immediately cooling. This disables two air-operated valves dispatched to the diesel generator building that must be opened to supply makeup water upon the loss of offsite power. The licensec to the emergency condenser. The licensee has also committed to store the tools received approval [9002220554] to manually necessary for the repairs in locked boxes and recover instrement air. This involves cross-cabinets.

connecting the demineralized water system to a portion of the service water system with a Vermont Yankee [8612090830] received en cooling water hose. The hose is stored on exemption to permit RHR and RCIC fuse site. This recovery action appears to be replacement to achieve and maintain hot formalized in a procedure and is estimated to shutdown. The RCIC system is required to be take about 10 minutes to complete. The operational within 43 minutes of reactor available time to establish emergency scram, and the RHR system is required to be condenser makeup is about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

operational within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of reactor scram.

In either case, it is unlikely that all fuses Sequoyah received permission

• to use local would be damaged. However, in either case, control of a main control room air-handling all fuses could be replaced in less than 20 unit (AHU) [8606110363]. This involves minutes, and two sets of spare fuses are lifting leaas in a 480-V shutdown board, readily availe.ble at the locations needed.

installing a jumper, and replacing the necessary control fuses. The manual actions The exemption also allows the operators to are proceduralized, and are estimated to connect a backup battery charger to the require about I hour. Adequate personnel are alternate shutdown battery ir the event of a available to perform the required actions fire in the cable vault. The post-fire loads are within the estimated 5-hour window. The staff not expected to discharge the battery before also credited the auxiliary building fire 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and the alignment of the backup protection features, which should reduce any battery charger is considered to be a routine major fire damage to the cabling and action.

components of the control room ventilation system.

The Pilgrim licensee received permission to replace five control power fuses and to In general, the approved exemptions have the assume local control of five valves for torus following characteristics:

cooling [890ll80397]. The staff considered that the 2-hour time period before torus Relatively simply repairs typically take 20 cooling was necessary was much longer than minutes or less to complete.

the estimated 20 minutes for fuse replacement, and that the detailed procedures and operator training would ensure success of

• Permission was granted for a deviation from guid-the action.

ance since Sequoyah was not required to comply with Appendix R and did not need to be exempted.

NUREG-152i 3-6 March 1998

Experience With NRC Requirements The necessary tools and material are

below, controlled and readily available. The time available to complete the repair provides Peach Bottom received several exemptioris for reasonable assurance of success.

less-than-3-hour-rated barriers. In one instance (8503260032] a 1%-hour-rated damper was The repairs are formalized in the plant deemed to provide equivalent protection for a procedures.

switchgear room. The area has a fire detection system, manual hose stations, and po:+able fire The shift staffing has been examined to extinguishers. The fixed combustible loading is ensure sufficient personnel are available.

approximately 27 minutes using the equivalent fire severity method (NFPA, 1991) which The repair environment and the nature of the correlates a fire loading to an equivalent fire a

repair do not endanger plant personnel.

severity approximately equivalent to that of test under standard ASTM E-119 curve for a specific Section III.G.2 applies to fire areas that contain period *. The fire detectors will reasonably assure redundant trains of systems necessary to achieve that a fire will be discovered in its incipient stage.

and maintain hot-shutdown conditions. This Although the staff anticipated a time delay section allows several methods to ensure that between the receipt of the initial fire alann and the cables, equipment, and associated circuits of at arrival of the fire brigade, the low fire loading least one redundant train of systems necessary to provides reasonable assurance that the 1%- hour achieve and maintain hot shutdown is free of fire damper will provide adequate protection in the damage. These methods include the use of 3-barrier.

hour-rated barriers (III.G.2.a),20-foot separation (III.G.2.b), or 1-hour-rated barriers (III.G.2.c).

The licensee also received exemptions for several The latter two alternatives require that fire concrete block walls separating emergency detectors and an automatic fire suppression switchgear and battery rooms [9110220275]. The system be installed in the area.

walls have a fire-resistance rating of only 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The maximum combustible loading is 28,800 2

Section III.G.2.a permits the use of 3-hour-rated Bru/ft with an equivalent fire severity of 19 barriers to separate redundant trains. Structural minutes. Automatic smoke detectors are installed steel forming a part of, or supponing, tie in each of the rooms.

barriers must also be protected to provide a fire resistance equivalent to that of the barrier.

In its approval of similar exemption requests for Pilgrim (8810180045], the staff noted that it The FIREDAT database lists 164 exeraptions to previously reviewed and approved the concept of III.G.2.a. Exemptions were granted for unrated fire protection engineering evaluations to componsts (such as water-tight doors or steel icument the adequacy of fire protection latches), paniel 3-hour barriers, barriers with measures at Pilgrim when the existing unprotected openings, less-than-3-hour barriers, or configuration was not otherwise in strict components (such as dampers or doors) with less-compliance with Appendix R.

than-3-hour ratings.

Other licensees have received similar exemptions.

The staff frequently cited low fire loading in its Some of these approved exemptions are review of the licensee's exemption request. One summarized in Table 3.2 (above).

candidate area for examination using performance-based methods (i.e., fire modeling) are configurations that have complete, albeit less-than-3-hour-rated, barriers with low combustible loading. An assumption of the amount of transient

• The method and daa for barrier ratings and how combustibles is typically embedded in this they are applied can be found in NUREG-1547.

determination. Several examples are discussed This report also presents findings regarding the acceptability of the equivalent fire severity method.

Mr.rch 1998 3-7 NUREG-1521

Emerience With NRC Requirements Table 3.2 Additional Approved Exemptions From Section III.G.2.a Plant Reference Conformance Issue Fire Severity (Minutes)

Salem 8907270300 1%-hr doors 1 to 46 1%-hr dampers 1 to 46 1-hr ventilation ducts I to 46 Duane Arnold 8401170530 1%-hr doors 8 to 23 1%-hr dampers 8 to 23 2-hr doors 6 to 24 Grand Gulf 9109060092 2-hr walls 15 to 30 The staff's key consideration appears to be the Section III.G.2.b is a second means to ensure that preservation of the defense-in-depth concept. The cables or equipment of redundant trains necessary combustible loading in the areas adjacent to the to achieve and maintain shutdown be free of fire nonconforming barriers is appreciably lower than damage. This section seguires separation of the installed barrier, generally by a factor of 2 or cables, equipment, and associated circuits of more.*

redundant trains by a horizontal distance of more than 20 feet with no inter ening combustibles. In In addition to low fire loading, exemptions for addition, fire detectors and an autematic partial barrier designs credited fire detection suppression system must be installed in the area.

(sometimes with autosuppression), barrier location, or roor geometry. For those areas Most of the exemptions to this section address without barriers, low fire loading in conjunction cases with fewer than 2.0 feet of separation (or with installed detection, or fire detection with separation with intervening combustibles) or no automatic suppression, were generally cited as automatic suppression in the area or both. Low providing reasonable assurance that at least one fire loading in the area and a fire detection system redundant hot shutdown train will be free of fire were major considerations cited in the damage.

exemptions. These factors would allow a fire to be discovered and extinguished before a Although not explicitly cited in the FIREDAT redundant train was damaged.

database, it appears that at least two licensees may have used fire modeling in support of their Fire modeling was used to support at least two exemption requests for unprotected stmetural steel exemption requests from Section III.G.2.b. The forming part of, or supporting, a required fire FitzPatrick licensee used a fire model to verify barrier. For example, the SusqueL2nna licensee adequate separation between redundant trains submitted calculations demonstrating that steel in without taking credit for the installed detection areas with automatic suppression, or subject to a and suppression systems. The exemption was cable fire from two or fewer trays, could not be approved on Febmary 1,1984 [840223M38].

raised to its failure point [8908170037].

Another exemption from the 20-foot separation criterion was approved in 1991. It involved process monitoring instmments in the containment air room that are necessary for ssfe shutdown, but

• Exemptions have been granted for fire severities where the redundant systems are not protected by that approach the rating of the installed barrier on the 20 feet of separation, barriers, or installed the basis of such additional considerations as in-protection systems (sprinklers). The computer stalled automatic suppression.

program HAZARD I was used to show that the NUREG-1521 3-8 March 1998

Experience With NRC Requirements largest credible fire, a self-initiated (electrical consideration.

overload) fire in one of the redundant cable trays, I

would not increase the temperature of lower layer Table 3.3 presents examples of these exemptions.

l air enough to cause damage to the instruments or their process tubing, and that the upper air layer Several exemptions were approved for areas would not descend to the vicinity of the without 1-hour barriers or area wide automatic instruments.

suppression. As before, low fire loading, fire detection, and, as appropriate, panial auto-Section III.G.2.c provides another compliance suppression were generally cited. A limited l

method to protect safe-shutdown capability. One number of exemptions were issued for areas that l

of the redundant shutdown trains is enclosed in a do not have 1-hour barriers or any automatic l-hour-rated fire barrier. Fire detection and suppression. These approaches credit operator l

automatic fire suppression is also required in the action in a process that is conceptually similar to l

area.

PRA recovery modeling. For example, the Farley licensee was granted exemptions for various fite The FIREDAT database has 122 approved areas [8701080637] that (1) credit detailed fire exemptions. Exemptions were granted for partial procedures and operator action to regain control or no 1-hour barriers, less than 1-hour barriers, of the service water system, a pressurizer power-partial or no autosuppression, and combinations of operated relief valve (PORV), charging pump these.

miniflow; (2) establish reactor coolant pump (RCP) seal injection; (3) isolate various sample The lack of areawide automatic suppression was lines; etc. Another approved exemption of this the issue ia many of these exemptions. The staff kind was for Indian Point Unit 2 [8703110139].

generally cited low in situ combustibles using a The licensee committed to provide portable reasoning that is sirrular to the approved III.G.2.a exhaust fans as an alternative means of cooling exemptions for barriers that are less than 3-hour pump rooms.

rated.

In accordance with Section III.G.3, if the Exemptions were also approved for configurations protection requirements of Section III.G.2 cannot that had barriers that were less-than-1-hour rated, be satisfied for the area, room, or zone under Again, low in situ combustibles were a major consideration, altemative or dedicated shutdown Table 3.3 Sample Approved Exemptions From Section III.G.2.c Plant Reference Conformance Installed Features Fire Severity Issue (Minutes) i ANO-1 8304060505 No autosuppression 1-hr barrier, fire Negligible detection (in situ)

Salem 8907270300 No autosuppression 1-hr barrier, fire

< 10 detection Rancho 8301140522 No autosuppression, 30-min barrier, fire

<7 Seco lack of I-hr barrier

• detection i

Sequoyah 8606110363 Lack of a 1-hr barrier, 40-min barrier, fire Negligible area wide suppression detection, partial auto-(overall) suppression

• Barrier is calcium silicate, rated for 30 minutes.

March 1998 3-9 NUREG-1521 1

Experience With NRC Requirements capability is required. In addition, this section installed detection systems.

requires fire detection and fixed fire suppression for the fire area (i.e., the area, room, or aone under Section IIIJ requires emergency lighting units consideration).

with a minimum 8-hour battery-powered supply for all areas needed for the operation of safe-Most of the approved exemptions addressed the shutdown equipment and for the access and egress fixed fire suppression requirement for the main routes thereto. The FIREDAT database has 39 control room. The primary considerations in approved exemptions. The lack of emergency granting these exemptions were low fire loading, lighting in certain plant areas comprised most of partial or full fire detection, and the faut that the the exemptions. Although these areas were control room is continuously manned.

typically inside the containment or in the yard, some exemptions applied to indoor areas outside Exemptions from the fixed suppression require-the containment. In reviewing exemption requests ment were also granted for such other plant areas from the IIIJ lighting requirements, the staff as electrical penetration rooms. Low fire loading considered the timing of the manual actions that and fire detection capability were generally require emergency lighting. Many of the actions credited in these exemptions. The rationale is that are for cold shutdown and can be performed any fire that started would propagate slowly, several hours after a fire-induced loss of power.

allowing ample time for detection and manual For example, ANO-1, received an exemption suppression.

[8811070033] for a lack of emergency lighting indoors on elevation 317 because the need to An exemption was identified for the FitzPatrick access safe-shutdown equipment in that area plant [8305060553], which is conceptually similar occurs after the 8-hour battery-powered to a PRA recovery model. The exemption pennits emergency-lighting time frame expires. South low-voltage fuse pulling, lifting of leads, and Texas [NUREG-0781, Supp. 4] received a similar i

cable cutting in the cable tunnel to mitigate the exemption for the lack of battery-powered effects of fires in certain areas.

emergency lighting inside the containment based on the need for access in the 8-10 hour time H.B. Robinson received an exemption for its frame.

service water pumphouse [8312140199]. The area does not comply with Section Ill.G because it St. Lucie 2 [8612100269] received permission to does not have an automatic suppression system, use dedicated portable lights for manual operation 20 feet of separation or 1-hour barriers, and an of the shutdown cooling valves inside the automatic detection system. There is no alternate containment. Turkey Point 3 and 4 received a shutdown capability for this area. The licensee similar exemption.

In that document justified this alternative on the basis of the

[8404230366], the staff noted that additional following considerations:

personnel will be available during this period to carry and position the lights.

manual fire fighting capability Several licensees received exemptions to use television camera surveillance of the area by security lighting as an alternative to Section IIIJ security personnel in lieu of fire detection lighting for the yard. The security lighting was generally powered by a dedicated security diesel Iow combustible loading-An analytical generator (ANO [8811070033], Haddam Neck model was employed to show that the

[8712210060]).

The Hatch licensee's magnitude of any exposure fire needed to

[8701070595] security lighting will not be damage redundant components is significantly available if offsite power is lost. Hatch has higher than reasonably expected.

dedicated engine-driven portable lights to illuminate the required areas in the yard as a Other approved exemptions have cited auto-backup.

suppression system waterflow alarms, in lieu of 1

l NUREG-1521 3-10 March 1998

Experience With NRC Requirements There have been several exemptions issued for the alternative. The design and routing of hardwired use of portable lighting, both indoors and in the systems were reviewed to ensure availability for yard. Quad Cities [9106060039] can use portable each fire area that was credited. Portable lights l

lighting to read the suppression poM 'M sight require a program to ensure both the availability j

glasses. This action is expected t' v mqu -:d in and operability of the flashlights, when needed.

no sooner than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. H.B. Rc w : eived permission to use portable ligE 3 i neveral Two exemptions [8507160041, 8701070595] were areas of the plant, both inh

..u outside for control room lighting for 90- or 120-minute the containment [8807120348, 8708060038, batteries for the Duane Arnold and Hatch plants, 9210160190]. As discussed above, St. Lucie and respectively. For example, at Hatch, the Turkey Point have received permission to use emergency lights in the control room are designed portable lighting for valve alignments inside the to be powered initially from the station batteries containment.

and later transferred to the emergency diesel generators after they are started. The emergency Portable lighting in the yard is primarily used for lights are designed so that a fire in any area operator access and egress (Davis-Besse outside of the control room or cable spreading

[9004240205], Millstone 1 [8708060275]). In room would not result in the loss of both divisions addition, Brunswick [8701020203] uses portable of emergency lighting. The feeder circuits outside lighting to read gauges in the yard. Haddam Neck of the control room and the cable spreading room uses portable lighting to supplement security have divisional separation equivalent with the lighting for access / egress and manual valve separation requirements of Section III.G.2 of operation.

Appendix R. Therefore, the emergency lighting would be supplied with diesel-driven ac power Several licensees have received permission to use prior to battery depletion.

hardwired lighting systems instead of battery-powered emergency lighting. With the possible The Beaver Valley licensee [8701070595]

exception of Fort St. Vrain [8805240108], these received an exemption which allows the use of 2-exemptions address specific fire areas. Davis-hour-rated emergency lighting in the fire brigade Besse received an exemption [9004240205] for room. This room is used as a staging area for the use of its essential lighting system in parts of alternate shutdown procedures and is expected to the auxiliary and turbine building for fires in the be used less than 30 minutes.

control room and the cable spreading room. A fire in any area outside the control room will not Section III.L of Appendix R states the cause the loss of both divisions of emergency requirements for alternative or dedicated lighting. Diablo Canyon [NUREG-0675, Supp, shutdown capability. This capability is required 23] has also received credit for hardwired lighting when the separation requirements of Section III.G systems. As discussed below, Hatch uses its cannot be satisfied. The majority of the hardwired emergency lighting systems as a exemptions from Section III.L were granted in the backup to its 2-hour-rated battery-powered lights three areas discussed below.

in the control room.

Several exemptions were granted from the Although then: are some small inconsistencies, requirement to maintain reactor coolant system primarily with regard to the t se of porde lights process variables within those predicted for a loss and manual actions, the staff appears i t spprove of normal ac power (LOSP). These exemptions exemptions to the emergency lighting require-were for boiling-water reactor (BWR) licensees ments if the altemative could provide enough that generally employed rapid reactor pressure illumination to facilitate the task and was reliable.

vessel depressurization as part of their alternative In general, the adequacy of the illumination level shutdown capability. This rapid depressurization was verified in the field. Routes of travel were can temporarily lower the vessel level below the examined for obstructions and tripping hazards.

core. The basis of these approvals was the The reliability assessment was dependent on the assessment that the fuel rod cladding would March 1998 3-11 NUREG-1521

l Experience With NRC Requirements remain intact, despite a temporarily depressed cases, licensees submitted quantitative water level. PRAs also typically use fuel cladding analyses using fire models as part of the integrity as the measure of successful core cooling justifications for the exemptions.

in those cases in which marginal mitigation Qualitative analyses and arguments similar to capability is available.

l those in recovery models in PRA human The unavailability of a complete set of process reliability analysis (HRA) were used in variable readings for the alterative shutdown several submittals for exemptions; however, process also accounted for several approved quantitative PRA or HRA analyses were not exemption requests. The considerations cited in submitted at that time.

these approvals were the availability of reading Most of the exemptions are in technical areas material that could provide similar information or an assessment that the subject parameters were amenable to the use of tisk-informed, not necessary to assure a safe and stable shutdown performance-based me; hods that have been condition.

developed since the issuance of Appendix R and exemptions granted to that regulation, The last major subject of approved exemptions e.g., fire PRA including HRA analysis, and from Section III.L concerned the capability to modeling the dynamics of fire effects.

reach cold shutdown (with onsite power only) within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Six PWR licensees received The opportunities for the use of risk-informed, exemptions from the 72-hour requirements. As performance-based methods are discussed further part of the approval process, the NRC in Chapter 6. Trial applications are presented to qualitatively assessed the safety significance of evaluate the usefulness of the results and insights using nonstandard system alignments over a from these methods in improving regulatory protracted time period to reach cold shutdown.

decisionmaking, on issues that were the subject of past exemptions presented above.

Section III.O of Appendix R requires a reactor coolant pump (RCP) oil collection system for non-On the basis of the review of the experience and inerted containments. The majority of the 24 exemptions, the following issues were chosen for approved exemptions from this section were for further analysis and for trials of risk-informed, systems with collection tanks that were not sized perfonnance-based applications:

for the entire inventory of all the RCPs. In general, those systems could contain the emergency lighting (Section IIIJ), specifically lubricating oil contents of one pump. The the requirement for an 8-hour lighting exemptions were granted for RCP lubricating oil duration systems that are seismically qualified and, therefore, subject to small random leaks.

the 72-hour cold-shutdown capability and requirement of Sections III.G.1 and III.L.5 surveillance requirements for fire detectors

3.3 CONCLUSION

The following conclusions are drawn on the basis surveillance test duration for emergency of the review of exemptions to Appendix R lighting granted by the staff:

the 20-foot safe separation requirement of Section III.G The justifications submitted by licensees for

=

the request for exemptions, and the technical the loss-of-offsite-power requirement for bases used by the staff for granting the alternative or dedicated safe-shutdown exemptions, were primarily qualitative capability (Section III.L) analyses of combustible loading and effect based on engineering judgment; in a few NUREG-1521 3-12 March 1998

1 1

4 ALTERNATE METHODS DEVELOPED SINCE ISSUANCE OF APPENDIX R This chapter summarizes fire probabilistic risk PRAs are based on reliability and/or state-assessment (PRA) and modeling methods that transition models for suppression, and are have been developed and used by the NRC and panially based on deterministic phenomenological the U.S. nuclear industry for conducting PRA models (e.g., COMPBRN) for fire growth.

studies, and by licensees for conducting individual Summaries of the approach of typicalinternal fire plant examinations for external events (IPEEES)

PRAs (NUREG/CR-2300, NUREG/CR-2258, in response to NRC Generic Letter 88-20, Indian Point 2 PRA (Consolidated Edison,1992),

Supplement 4. The results of PRAs and the Limerick PRA (NUS,1983)) follow. A fire PRA IPEEEs are currently not used to support utilizes the models developed for an internal event regulatory decisionmaking for the implementation PRA.

of NRC fire protection regulation, but have been limited thus far to determine if specific 4.1.1 Identification of Fire Areas, Fire Zones, vulnerabilities to fires exist in plants. The and Critical Fire Locations methods that have been developed and used are described below, followed by a discussion later in The fire areas and fire zones as defined in the the chapter of the current uncertainties associated plant's submittal in accordance with Appendix R with the methods. This chapter also describes the to 10 CFR Pan 50 are used in the screening methods and some findings from their use in the analysis. First, fire areas and zones (1) that do not past, and summarizes the experience from their contain safe-shutdown equipment and (2) in use as related by the users. These methods were which a fire will not adversely impact safe-also applied specifically for the purposes of this shutdown equipment in other fire areas and zones study, i.e., to assess their usefulness in improving are eliminated from consideration. In the regulatory decisionmaking in evaluating alterna-Appendix R analysis, the safe-shutdown tive methods for implementing current fire equipment is tabulated for each fire area and zone.

protection requirements. A critical analysis of the This information is used in the screening analysis usefulness of the results and insights from the of the fire areas and zones. That is, all of the applications for this study, in light of the equipment in the fire area and zone is assumed to uncenainties associated with the methods, are be disabled by the fire. As a result, an accident-presented in Chapter 6.

initiating event may occur (i.e., a fire-induced transient or a loss-of-coolant accident). The 4.1 FIRE PROBAHILISTIC RISK relevant event tree of the intemal event PRA is ASSESSMENT METIIODOLOGY used to calculate the contribution of the fire zone Internal fire PRAs typically follow a two-phase to core-damage frequency (CDF) by using the fire approach. In phase 1, a screening analysis is frequency for the area or zone as the initiaths performed to identify the important fire locations event frequency and assuming that all components within the fire area or zone fail. Some numerical and screen out those areas that are not nsk sigmficant In phase 2, a detailed analysis is screening criterion, such as IE-08 per year, is performed for the important fire scenarios. The used to screen out unimponant fire areas and z us.

risk-mformed results of a fire PRA are usually obtained from the logic trees and models Critical fire locations are those locations for developed for internal event PRAs. For the fire PRA, the input probabilities to the PRA models which fire accident scenarios would be developed.

Their identification inside a fire area or zone are determined from a performance evaluation of the fire scenarios (propagation, damage, and requires cable routing information obtained by suppression) and an a'ulysis of fire frequencies, tracing the cable routing drawings and by The performance evaluation models used in fire performii.g a walkdown of the plant. The March 1998 4-1 NUREG-1521

Alternate Methods Developed Since issuance ofAppendix R determination of the critical fire locations is based 4.1.3 Fire Damage and Suppression on the effect of the postulated fire at the location COMPBRN III and the worksheets in the FIVE and is done subjectively. The criterion is that a methodology (discussed later) are available for postulated fire at the location must cause an predicting the fire propagation times. These codes initiating event and failure cf multiple equipment divide the compartment into at least two zones (an needed to mitigate the accident.

upper layer of hot gas and a lower layer).

Depending on the program, the fire and its plume 4.1.2 Estimation of Fire Frequency for Fire may be separate zones or may be included m the Areas, Fire Zones, and Critical Fire Upper zone. The gas layers are assumed to be well Locations mixed. Other zone models (e.g., CFAST) that are Because of the lack of sufficient plant-specific being used to support non-nuclear plant data on fire frequency in most cases, the data applications (e.g., fire regulation of buildings) collected from the total population of U.S. nuclear exist and, depending on the application, have power plants are generally used. These generic different strengths and weaknesses. These models data are sometimes used in some staff-sponsored are discussed in the next chapter, studies along with the plant-specific data in a Bayesian statistical analysis of the fire frequency.

A number of" field" models for application to fire The latest compilation of fire incidents at nuclear problems a.e currently under development. The power plants was prepared by Houghton in NRC field model is a complex Duid mechanics model document AEOD/S97-03 (NRC,1997). The two of turbulent flow derived from classical fluid ways of estimating the fire frequency for a critical dynamics theory. This type of model solves the fire location are the following:

fundamental equations of mass, momentum, and energy. In order to facilitate the solution of the Area based. The fire incidents are grouped on the equations, the space being analyzed is divided into basis of the fire area or building in which they a three-dimensional grid of small cells. Field took place (e.g., the switchgear room or the models typically use hundreds of thousands of auxiliary building) to estimate the fire frequency cells or zones; zone models use two or three. The of the respective fire areas. This overall area-field model calculates the physical conditions based frequency is apportioned among the fire (temperature, gas velocity, species concentration) zones and critical fire locations on the basis of the in each cell, as a function of time. The size of the ccmponents within those zones. This approach is space can range from an area within a room to a sometimes used to estimate the transient fire large portion of the outdoors (Stroup,1995).

frequencies.

Field models are being used to analyze a number of fire protection issues such as tne placement of Component based. The fire incidents are grouped heat and smoke detectors, and the interaction of I

on the basis of the type of component that was sprinklers, vents, and draft curtains. A brief involved in the initiation of the fire (e.g., cables, description of CFD codes available or being motor control centers, panels, and pumps) and are developed is presented in the next chapter. These used to estimate the fire frequency by component codes have net as yet been used in the U.S.

type. The frequency with which a fire occurs at a nuclear industry.

critical location is determined by prorating the plantwide frequencies of each component type COMPBRN III is a deterministic fire hazard within a critical location.

computer code designed to be used in a probabilistic analysis of fire growth in a Data analyses and estimation techniques play an compartment. Its primary application to date has important role in performing this type of been the assessment of fire risk in the nuclear evaluation. Several personal-computer-based tools power industry. COMPBRN III follows a quasi-are available for these types of analyses (Azarm static approach to simulate the process of fire and Chu,1991).

growth during the pre-flashover period in an enclosure. Physical models, which quantify the thermal hazard (including temperature and heat NUREG-1521 4-2 March 1998

Alternate Methods Developed Since issuance ofAppendix R fluxes) during a compartment fire, are developed.

(NUREG/CR-5813) is widely used by NRC The dimensions of the compartment, location, contractors. Other widely used computer tools for quantity of fuel, layout of cables, locations and this purpose are RISKMAN (a Pickard, Lowe and sizes of doorways, and ventilation rates through Garrick, Inc., proprietary code), NUPRA (an NUS ventilation ports are user specified.

Corporation proprietary code), and SAICUT (a Science Applications International Corporation Possible outputs of COMPBRN include the total proprietary code).

heat release of the fire, the average temperature and thickness of the hot gas layer formed near the 4.2 TIIE "FIVE" METIIODOLOGY compartment ceiling, the mass burning rate for Fire-induced vulnerability evaluation (FIVE) individual fuel elements (affected by thermal I wa unc Ver ng f

)is nent radiation from the ceiling layer), and *he surface temperature of non-burning elements. The time plant vulnerabihties that make certain fire-initiated events more likely than others. It until the target (e.g., cable tray) reaches its Provides a combination of deternumstic and damage temperature is the time available for fire probabilistic techmques, smu,lar to PRAs, for supprusion. Fire suppression data can be used t examining a power plant's fire propagation and determine a probability distribution for the time t protection characteristics. The FIVE methodology suppression, and the probability that a fire is not was developed in response to NRC Generic Letter suppressed before it propagates can be determined 88-20, Supplement 4. A utility may choose to using such a curve. Siu and Apostolakis (1986) conduct a fire PRA or use the FIVE screening give more detail on how fire detection and methods to conduct IPEEEs in its response to suppression can be modeled in a fire PRA.

Generic Letter 88-20, Supplement 4. The FIVE methodology was compared (EPRI TR-100443)

Experimental data from the UIJSNL series with data from two series oflarge scale tests: the (NUREG/CR-3192) are used in Electric Power FM/SNL series (NUREG/CR-4681, NUREG/CR-Research Institute report EPRI NP-7282 1 5384) and the UUSNL series (NUREG/CR-3192).

validate the calculation of flow through a doorway (driven by the buoyancy of the hot gas), the gas The FIVE methodology is very similar to fire temperature in the hot layer, and heat transfer PM olog with the following exceptions:

from the hot layer to cables in trays.

FIVE uses the progressive screening approach 4.1.4 Fire Event Trees at various stages of evaluation and usually For a fire at a given critical fire location with the gives full credit (i.e., not evaluated) to the fire either suppressed or propagated, the areas that are in compliance with Appendix R, equipment that will be damaged by the fire is unless the analyses are deemed necessary by determined. Therefore, the effect of the fire on the analytical team (see discussion on p. 6-2 the plant's capability to mitigate it is defined. An of EPRI TR-100370 on the requirement in applicable internal event tree can then be modified Section III.G.2b in Appendix R).

to model the mitigation of the fire. The quantification of the event tree accounts for the FIVE provides guidelines to assess the frequency of the fire at the location, the potential for fire propagation across probability of fire propagation or suppression, and compartments due to structural failure of the availability of alternate equipment for safe barriers and penetration seals. The fire PRA shutdown.The fire event tree analysis is similar to process could also address this issue, but that that of intemal event analysis, except that the is generally not the practice.

impacts of the fire on equipment and operator actions are identified.

FIVE provides compartment-type fire ignition

+

frequencies from a recent EPRI database.

Several tools developed by both the NRC and FIVE recommends that the self-ignited fire industry are available for the purpose of such frequency for cables rated according to analysis. The NRC code known as IRRAS Institute of Electrical and Electronics March 1998 4-3 NUREG-1521

Alternate Methods Developed Since issuance ofAppendix R Engineers (IEEE) 383 standard be set to zero safety improvements to either eliminate or reduce (in contrast to past PRAs) regardless of the the impact of these fire vulnerabilities. On the voltage and rated power.

basis of the reviews of an initial set of IPEEEs, the staff has made a preliminary conclusion that FIVE provides tables, worksheets, and most licensees have met the objective of the various equations for fire propagation IPEEEs using the methods described above. The analyses whereas COMPBRN IIIe is a preliminary repon also provides summaries of computer code..

results, findings and plant improvements reponed in the IPEEEs, and additional perspectives related FIVE provides tables for estimating the to fire events, and the strengths and weaknesses of availability of automatic suppression and the methods used toward accomplishing the detection systems (p.10.3-7 of EPRI TR-IPEEE objectives.

100370, Table 2). The unavai' abilities reported in this reference are more optimistic 4.4 RESULTS FROM FIRE PRAS than those values used in PRAs (Gallucci and 4.4.1 Review of 12 Fire PRAs llockenbury,1981).

Y ch c e out d val tion h e een contribution of fire to annual CDF md to identify performed in accordance with Appendix R.

dominant fire sequences and important plant areas In FIVE, some other systems that may be from a fire perspective. This section summarizes unaffected by a fire may not be credited, since the review; a detailed discussion of each plant is they were beyond the current scope of in Appendix B.

Appendix R documentation in the plant, whereas in a fire PRA, an analyst may or may As shown in Table 4.1, the CDF as a result of fire-not choose to credit those systems.

initiated events varies from 2.3E-4 (Big Rock Point PRA) to 8.lE-8 (McGuire individual plant In 1995 EPRI issued a Fire PRA Implementation Guide (EPRI TR-105928) for use by licensees in

• • ".nunanon for extemabents N)Ae 6m imtiated CDFs reponed in the IPEEs are generally conducting the IPEEEs. This guide uses many of the methods and assumptions included in the qders of magnitude smaller than those I r reported in earlier PRAs. These PRAs typically "FIVE" method. Some assumptions in the PRA identify fires m the switchgear room, auxihary Implementation Guide that go beyond those in building, control room, and cable spreading room FIVE have been questioned by the staff.

as the major contributors to fire-m, duced CDF.

4.3 PRELIMINARY IPEEE RESULTS The reasons for the differm.g contnbutions of fire to the overall CDF were further investigated. The A preliminary report (NRC memorandum,1998) f ndings are based on a review of four fire PRAs.

has been developed by the NRC documenting The four plants selected for this review cover the insights on the results generated and methods used varying ranges of the fire-initiated CDF in m an imtial set of IPEEEs. The mitial set of IPEEEs used either the FIVE method, a fire PRA, pressurized water reactors (PWRs) and boiling wa eman rs (

s).

or a combination of the two methods. The EPRI Fire PRA Implementation Guide was not available to licensees that subnutted these IPEEEs before (1) The fire PRA issued in March 1981 for Big the guide became available as an additional Rock Point (Consumers Power Company, 1981) (a BWR plant) reported a fire CDF of P ""

2.3E-4 per reactor-year.

The large bution of fire to CDF was a result of The objective of the IPEEEs was to identify E**'"

I vulnerabilities to fire events using the methods described above, and implement cost-effective c ntainment and the station power room.

NUREG 1521 4-4 March 1998

Alternate Methods Developed Since Issuance ofAppendix R Table 4.1 Plant Core-Damage Frequency (CDF)

Contribution Total CDF Fire CDF of Fire to Planet (per RY)

(per RD Total CDF Reference Indian Point 2*

9.6E 5 6.5E-5 68 %

Indian Point 2 IPE (Consolidated Edison,1992)

!.imerick 1 4.4E-5 2.3E-5 53%

Limerick PRA (NUS,1983)

LaSalle 2 1.0E-4 3.2E-5 32%

NUREG/CR-4832, Vol.1 Big Rock Point (BRP) 9.75E-4 2.3E-4 24 %

BRP PRA (Consumers Power Company, 1981)

Peach Bottom 1.1 E-4" 2.0E 5 18 %

NUREG-1150. Vol.1; NUREG/CR-4550, Vol. 4, Rev.1. Part 3 Seabrook 2.3 E-4 1.75E-5 9%

Seabrook PRA (Garrick et al.,1983)

Zion 4.9E-5 4.6E-6 9%

Zion PRA (Commonwealth Edison Co.,

1981)

Surry 1.5 E-4 1.1E-5 6%

NUREG-1150, Vol.1; NUREG/CR-4550, Vol. 3 Rev.1. Pan 3 Oconee 2.5E-4 1.0E-5 4%

Oconee PRA (Nuclear Safety Analysis Center,1984)

South Texas Project 4.4 E-5 4.9E-7 1%

STP IPEEE (Cross et al.,1992)

(STP)

Catawba 1 and 2 7.8E-5 3.4E-7

<1%

Catawba IPEEE (Duke,1992) p McGuire 7.4 E-5 8.lE-8

<.1 %

McGuire IPEEE (Duke.1991)

• The Indian Point Unit 2 (IP2)IPE does not contain extemal events analyses. The fire contribution was taken from a report prepared by EG&G (EGG-2660) in 1991. The data in that report for IP2 were based on a report prepared in the 1980s, and the total CDP was calculated as the CDF from the IP2 IPE (3.13E-5) plus the fire contribution (6.5E-5). The percentage was calculated by this study using these values.

• Total CDF based on seismic analysis using LLNL hazard curves.

In both areas, the cables from redundant Limerick PRA was conducted for licensing safe-shutdown trains were routed through the plant and did not reveal any the same fire area and adjacent to each vulnerabilities that had to be addressed in other with little or no separation distance the licensing process.

(see page VI-25, Consumers Power Company,1981); therefore, a single fire (3)

For the PWR plants, the fire CDF, shown in could have damaged all the cables.

Table 4.1, ranges from 1.0E-5 per reactor-year to 1.0E-7 per reactor-year. The Surry (2) The fire PRA for Limerick (NUS plant ((NUREG-1150, Vol.1) was selected Corporation,1983), a typical BWR with as a representative plant for the higher respect to fire CDF, was issued in April range (1.0E-5). About 85 percent of the fire 1983 and estimated a CDF of about 2.3E-5.

CDF in the Surry nuclear power plant is due Self-ignited cable-raceway fires, including to fires thet result in reactor coolant pump IEEE-rated cable fires, account for more (RCP) seal loss-of-coolant accidents than 50 percent of this contribution. Self-(LOCAs).

ignited fires for IEEE-rated cable are excluded from PRAs being performed as (4)

The South Texas Project IPE (Cross et al.,

part of IPEEE/FIVE methodologies. The 1992) was reviewed as representative of March 1998 4-5 NUREG-1521

Alternate Methods Developed Since issuance ofAppendix R those PWRs with a low CDF (5.0E-7).

Parkinson et al. (1993) provides a systematic Unlike the Surry plant, the South Texas approach for fire risk assessment using FIVE, Project has positive displacement purnps COMPBRN, and the existing databases.

capable of providing RCP seal injection.

However, large numbe.. of assumptions, Therefore, South Texas Project is not as extrapolation of test data, and interpretation of the susceptible to fire-induced seal LOCAs.

past fire events are embedded in the approach.

Excluding RCP seal LOCA, the fire CDFs Currently, there is no agreerrent between NRC for Surry and South Texas are comparable.

and EPRI about the validity of these assumptions.

4.4.2 Comparison of NRC and EPRI PRA Studies 4.5 UNCERTAINTIES After the development of the FIVE methodology, the Electric Power Research Institute (EPRI)

This section presents a description of the common initiated a fire risk assesstnent (FRA) program to uncertainties associated with fire models and better understand risk due to fire. To meet this PRAs that have been raised in the past. Key objective, the EPRI program provided to its assumptions, methods, or data that are currently members a set of user-friendly tools (including said to be the major sources of uncertainty are FIVE), the needed databases, and an approach for presented. A critical analysis of trial applications performing PRA. To understand the impact of to assess the usefulness of results and insights these tools, two existing fire PRAs (Seabrook and gained from fire PRA and modeling methods for Peach Bottom) were requantified (Parkinson et al.,

improving regulatory decisionmaking in light of 1993). EPRI's approach, in almost all cases, the these uncertainties is presented in Chapter 6.

resulted in significantly lower estimates for fire An extensive description of these uncertainties is CDF. As an example, the requantification of the provided at this point in the report because these cable spreading room at Seabrook resulted in uncertainties are cited most frequently as the basis approximately a factor of 400 below that of the for the very limited usefulness of risk-informed, Fire Risk Scoping Study (NUREG/CR-5088). A performance-based methods for fire protection.

reduction factor of 10 was obtained for ignition Each of these sources of uncertainty is critically t

frequency; another reduction factor ur 15 was analyzed in Chapter 6 in terms of its effect on the obtained for the overall suppression failure usefulness of the results and insights gained from probability; and a reduction factor of 2 was the trial applications.

obtained for the probability of a fire occurring in a critical area. These reduction factors stem from 4.5.1 Fire Models the following four major differences:

The uncertainties associated with a fire model in (1) the impact of the EPRI database on igmtion a PRA process may be categorized as follows:

frequency (Attachment 10.3 in EPRI TR-100370),

(1) uncertainties in the input variables to the fire model and in the parameters used in the (2) initial fire heat release rate and rejection of model the possibility of large transient fire in the I

cable spreading room supported by the (2) accuracy of the fire model, excluding any EPRI database input variability discussed above (3) incorporation of modeling uncertainty in The uncertainty distribution, associated with input damage time calculated by COMPBRN variables and model parameters (issue 1), is estimated using measurements or monitored data (4) modeling of various means of detection and through application of the Bayes method (Kaplan, I

t suppression 1983). Computer software is widely used for these types of uncertainty analyses for both risk-NUREG-1521 4-6 March 1998

Alternate Methods Developed Since issuance of Appendix R informed and performance-based models. This run, the higher would be its weight. This is also technology has been utilized for more than a the case for the computer codes for evaluating fire decade in various probabilistic risk assessments propagation times.

and reliability studies. The uncertainties in input variables and the model parameters are A formal treatment to determine fire model propagated through an integrated model using uncertainties is proposed in Appendix C. Several Monte Carlo sampling techniques. Variance sources of data uncertainties, i.e., parameter reduction techniques and stratified sampling uncenainty and uncertainty of initial and strategies have been extensively used to propagate boundary conditions are identified. The current the uncertainties in an efficient manner. These treatment of data uncenainties is summarized and techniques have already been developed and different sources of modeling uncertainties software developed (e.g., the IRRAS computer resulting from assumptions, approximations, code (NUREG/CR-5813) and COMPBRN (EPRI simplifications, and numerical algorithms are NP-7282)) for fire PRAs.

discussed. An approach is proposed on the basis of decomposition of uncertainties to the most The accuracy of model prediction, excluding the basic level of modeling and aggregation of the variabilities of the input and model parameters, is uncertainties using the current uncertainty entrenched in code validation. In most cases, propagation techniques.

A process for simplifying conservative assumptions have been decisionmaking under both modeling and data incorporated to reduce the code's development uncertainty is also presented. This proposed effort and to facilitate the large number of runs treatment could form the basis of research to required for conducting fire PRAs. Two methods further define fire modeling uncertainties.

of validation are usually proposed. The first is the Methods or effects that are currently stated to be comparison of the code predictions to those of the major sources of uncenainty in fire models another validated code that is more based on experience and engineeringjudgment are comprehensive and suffers from fewer simplifying discussed below. A more detailed review of the assumptions. The other method requires features, limitations and uncertainties in fire comparison of the code predictions to available models can be found in Mowrer and Stroup,1998.

measurements obtained through a well-instrumented experiment.

4.5.1.1 Source IIeat Release Rates In any case, exhaustive maparisons of the I

d in h s is existing codes to either experirtents or to a more associated with the heat-release rate (Mowrer and comprehensive code are e generally feasible Stroup,1998). The phenomenological modeling because of the large numbe, cicase runs that may f the combustion process and heat release is be necessary or the cost associated with new extremely complex and in an early research stage.

experiments and/or additional computer runs.

Experimental data are widely used and provided Various statistical methods are available to provide an estimate of the inaccuracies of the code

^8 *P.ut to fire models, and large uncertamties are ass iated with this input because of the mability prediction using a small set of validation runs t amateh correlate expehend data to h (such as clustering methods). Currently, expert f re s ur e f c ncem. The heat-release rate is the judgments are used in most cases to determine the accuracy of the code predictions in light of the

".vmg f rce f r the plume mass flow rate, the ee81in8 jet temperature, and finally, the hot layer limited experimental data available. One method temperature that is driven by energy balance. The used in the building industry, albeit informal, heat-release ram is dependent on h imtial aggregates the results of those fire experiments (or actual fire events) that are judged to be I*I# size, the growth of fire by propagation and igmtion of additional combustibles, and the heat-representative of the case under study,in order to release rate from these additional combustibles.

refine the code estimates. The aggregation process is based on the weighted mixture of all results.

The closer the fire experiment represents the case March 1998 4-7 NUREG-1521

Alternate Methods Developed Since issuance ofAppendix R 4.5.1.2 Multi-Compartment Effects Therefore, the gas in the hot layer could actually be much cooler than calculated. If field models It has been stated that a source of uncenainty for were used mstead of zone models, the prediction cenain applications is related to the number of f the plume and upper-layer characteristics may compartments analyzed by the model, and the be improved; but the processes mvolving thermal companment geometry used in the experimental radiation would be more difficult to handle in validation. The COMPBRN code is a smgle-room field models.

model that assumes a small (pre-flashover) fire m a large companment. Currently, fire probabilistic 4.5.2 Parameters Important for Calculating nsk assessments (PRAs) do not consider the fire FM Rid propagation across fire-rt.ted structural barriers and seals. Generally, PRAs assume that the g p; probabihties of such events are negligible, considering the larp size of, and the slow burning Large uncertainties are reported in the estimated materials (cables) m, the companments of nuclear fire frequencies for the control room, cable power plants. PRA analysts sometimes consider spreading room, and switchgear rooms, primarily that smoke propagates across companments as a because the data are quite sparse. Four fires have result of damper failures, especially if smoke-occurred in the control room, but all were small sensitive equipment is in the adjacent room.

with mean duration of 2.5 min (NRC,1997) and

• • • E

""Y 4.5.1.3 Effects of Ventilation evacuation. On the basis of these data, the control In certain applications, the effects of mechanical room fire frequency is typically estimated to have ventilation may he imponant. Most fire models a 95-percent confidence range of 1.0E-6 to 7.0E-3 have difficulty in accurately predicting the effects per reactor-year. Similar uncenainty ranges have of mechanical ventilation on fire development been reponed for the cable spreading room and and the corresponding effects on the fire the switchgear room (NUREG/CR-4550, Vol. 3, compartment (s) and contents. COMPBRN has Rev.1 Part 3 and Vol. 4, Rev.1, Part 3).

this feature; however, the experimental validation is lacking. In contrast to COMPBRN, where vent The impact of underreponed and event screening flow is calculated using empirical equations, on the uncertainties of fire frequencies used in fire CFAST (discussed in Chapter 5) utilizes PRAs has also been raised as a concern. A Bernoulli's solution for the velocity equation.

detailed discussion of this concem and the This solution is augmented for restricted openings uncenainties associated with fire ignition by an empirically based flow coefficient. Forced frequencies as a result of underreponing and event ventilation is treated as constant flow rate in screening is presented in a recent review COMPBRN, whereas in CFAST, the forced-sponsored by the NRC (Azarm,1998). This study ventilation mass flow rate varies with square root concluded that small fires that cause little or no of pressure drop. Nuclear power plants in the U.S.

propeny damage or component failure may not be are typically multi-room windowless structures of completely captured by generic databases. The various sizes and are provided, exclusively, with potential impact that small fires could have on risk forced-ventilation systems. Neither COMPBRN insights from fire PRAs was investigated. It was nor CFAST is experimentally validated for such concluded that the level of detail in PRA models configurations.

dictates what fire events should be considered for estimating the initiator-event frequency. More-4.5.1.4 Structural Cooling Effect detailed PRA models reduce variability in the estimated risk, but -quire more cxtensive data on Considerable cooling effect can come from the

' #" * * **^*

~

masses of cable trays, ventilation ducts, and and the associated level of detail, the available pipmg m the upper part of companments in generic databases should be sufficient for nuclear power plants. Zone models have not been used to calculating the heat transfer by convection btaining generic risk insights as opposed to from the gas in the hot layer to these structures.

detailed plant-specific results.

NUREG-1521 4-8 March 1998

Alternere Mzthods Developed Since issuance ofAppendix R 4.5.2.2 Reliability and Effectiveness of Fire 4.5.2.3 Threshold for Thermal Equipment Damage Criteria Detection and Suppression Automatic detection and suppression systems Failures of equipment exposed to the harsh envir nment f a fire and the subsequent have been backfitted in nuclear power plants and, in some cases, automatic fire detectors and suppression activities are typically determined by suppression heads may be obstructed by such a threshold value of an appropn, ate parameter.

structures as cable trays, piping, and ducts. How Jhis threshold value is referred to as the e9ui ment damage criterion. As an example, a P

obstructions affect these automatic features is threshold face temperature is usually currently unknown.

considered as a damage criterion for cables.

Wre is a difference between reliability and Relative humidity and smoke concentration may effectiveness of an automatic detection and be more suitably considered for small electncal

?9ui ment such as relays, but are not considered P

suppression system. The reliability basically deals m cumnt s.

with the probability that the component is not failed; the effectiveness deals with the probability that the component can successfully perform the Establishing damage en.tena is a complex process.

Equipment exposed to the thermal environment of function expected. This issue relates to effectiveness of the automatic fire detection and a fire may fail either temporarily or permanently, l

As an examP e, an electrome circuit may suppression system.

temporarily fail (not respond or respond The response time of fire detectors may be incorrectly) when exposed to high temperature; affected by the presence of the obstructions. The however,it may recover performance when the slower the detector's response time, the larger the temperature drops. The failure criteria for e9ui ment are also dependent on equipment P

size of the fire by the time of detection; so early detection is very important. It would be important function. As an example, small insulation leakage current can cause failure of an instrument cable, to assess the capability of current codes in estimating the detector response, whereas, the same amount of leakage m low-voltage power cable could be inconsequential.

The zone models calculate the depth and temperature of the ceiling layer as a function of Owing to these difficulties, among others, the time, assuming a plume algorithm, but they ignore damage criteria typically used in PRAs are j

Ws i

would be directly the transit time for the gas from the fire to rise and mix with the ceiling layers. An estimate of the reflected in the fire PRA results, since the damage criteria are used to determine the time available time scale for transit and mixing of the gases, and 7

3 impact on detector response would be useful.

Current zone models also do not account for the effect of stmetural obstruction on the ceiling layer 4.5.2.4 Effect of Smoke on Equipment i

and its potential convective cooling.

Smoke from a fire that starts in one zone might propagate to other zones and potentially damage Suppression system effectiveness would be addi+.ional equipment. Currently, fire PRAs do affected by the water droplets hitting an not treat the question of smoke propagation to obstruction and not bouncing off, leaving a hole in other areas and their effect on component the spray pattern. If more than one sprinkler were operability in a comprehensive manner. The activated, the hole in the spray pattem might be exter.t to which the issue is addressed depends on somewhat negated.

It is well known that the analyst and, if it is addressed, it is typically sprinklers cannot put out a fire that is burning addressed qualitatively, below a low barrier.

The current general understanding on this issue is described below:

March 1998 49 NUREG-1521

Alternere Methods Developed Since issuance ofAppendix R l

l (1)

Smoke, depending on what is in it (such as To date, PRA methods have not been used to hcl from burning polyvinyl chloride (PVC) implement current fire protection regulations.

insulation), causes corrosion after some time. A little smoke has been shown to A review of 12 PRA studies conducted by the cause damage days later if the relative NRC, EPRI, and nuclear utilities to assess plant humidity is 70 percent or higher. Navy risk, including risk from fire events, yielded the experier. has shown that corrosion can be following observations:

avoided if the equipment affected by smoke is cleaned by a forceful stream of water Given the same plant configuration and a

containing non-ionic detergent, and then parameters, the absolute results of fire PRAs rinsed with distilled water and dried.

vary significantly because of the data, methods, and assumptions used (particularly (2)

Smoke can damage electronic equipment between those sponsored by NRC and EPRI);

(NUREG/CR-6476), especially computer boards and power supplies. Fans cooling the Given similar

data, methods, and electronic equipment can introduce large assumptions, there are major differences in amounts of smoke into the housing, strongly estimated fire CDF that can be explained by affecting the extent of the damage.

plant-specific system design and the embedded level of redundancies in safety (3)

Smoke can also impair the operation of functions; relays in the relay cabinet by depositing smoke products on the contact points.

Most studies indicate that the majority (in Again, the force cooling of the relay panel some cases as much as 90 percent) of the risk can exacerbate the situation.

from fires in nuclear power plants comes generally from three or four fire areas, such as 4.5.2.5 Operator Actions the control room, cable spreading room, and the switchgear room.

Because of the state of the art of human reliability analysis (HRA), large uncertainties are generally Fire protection analysis using PRA differs in

=

associated with the success of operam: ocirs.

many respects to analysis per NRC For fire events, the modeling of operator actions requirements in Appendix R. For example, becomes more complex because of the necessity even though most fire PRAs have identified to account for the effects of the fire and smoke on fires in the control room and the cable operators.

spreading room as significant contributors to core-melt probability, a coincident loss of offsite power is not included in the scenarios.

4.6 CONCLUSION

This is quite different from the requirements of Appendix R, which requires an assumption Since Appendix R was issued in 1980, the that offsite power is lost coincident with a fire probabilistic risk assessment methodology has in the control room. The significance of a been developed and used over the last 15 years by control room fire as modeled in PRAs is the NRC and the U.S. nuclear industry to usually attributable to scenarios other than the loss of offsite power (e.g., a control room fire (1) determine plant risk from fire events as part in a PWR may, among other things, cause the of general assessments of the total risk power-operated relief valves (PORVs) to profile from plant operations; and open spuriously).

(2) identify vulnerabilities to fire events and A preliminary conclusion has been reached by the implement cost-effective safety improve-NRC staff that the fire PRA and FIVE methods ments to either eliminate or reduce the have been successfully used to achieve the impact of these fire vulnerabilities, objectives of the IPEEE regulatory program to NUREG-1521 4-10 March IWs

Alterncle Methods Developed Since issuance ofAppendix R I

l identify plant vainerabilities to fire events and In other cases in which evaluation of the issue l

implement cost-ffective safety improvements to necessitates the use of fire modeling, the portion either eliminate or reduce the impact of these fire of fire modeling that predicts the fire heat-release vulnerabilities. The fire IPEEE conducted by the rate was differentiated from the portion that Quad Cities nuclear power station has been cited predicts the thermal environment. Larger by the NRC staff as an example of the success of uncertainty ranges are associated with the l

the IPEEE program and an example of the use of predicted heat-r-lease rate than with the thermal fire PRA and/or the FIVE methods to identify environment. In any case, the heat-release rate of vulnerabilities not addressed by Appendix R.

the fire source, knowing the current state of the art, may be best estimated conservatively by using Various uncertainty issues that have been stated to simplified engineering evaluation, subjective be associated with fire PRA and modeling are judgment, and extrapolation of actual fire events discussed in this chapter. A number of different or fire tests. A critical analysis of trial areas of a fire protection program can be analyzed applications to assess the usefulness of results and without the need for fire modeling (e.g., fire insights that may be gained from fire PRA and protection equipment surveillance and modeling methods for improving regulatory maintenance test intervals). For these cases, the decisionmaking in light of the uncertainties issue of uncertainty can be formally addressed and discussed in this chapter is presented in Chapter 6.

incorporated in the decisionmeking process. This is discussed further in Chapter 6.

{

March 1998 4-11 NUREG-1521 i

5 DEVELOPMENTS AND PRACTICES OUTSIDE NRC AND U.S. NUCLEAR INDUSTRY 5.1 DEVELOPMENTS IN NUCLEAR the existing means of detection and intervention INDUSTRY IN FRANCE and the types of action to be carried out in order to Hm t k Dre and ns consequences. M des The main measures concerning fire protection in French nuclear power plants are (1) fire measums to ensum tha} this quality (of training an pera n) is maintamed at a satisfactory level prevention by physical separation between throughout the lifetime of the m.stallation.

redundant safety trains, fire confinement, and protection for cables; (2) fire protection by zones and alarms transmitted to the control rooms;(3)

The following is description of computer codes that have been developed by the French nuclear fire fighting, including escape paths, containment industry. The material is purely descriptive and no of smoke, and suppression systems. These attempt has been made to provide a critical requirements are dehe.: m a document called analysis since the detailed documentation for the RCCI (mles for fire protection in pressurized-code was not reviewed, and the authors did not water reactors (PWRs)). The Directorate for the use the code for examining any specific problems.

Safety of Nuclear Installations (DSIN) of the Ministry of Commerce issues the basic safety 5.1.1 The FLAMME-S Fire Computer Code requirements and is supported by the Institute of Protection and Nuclear Safety (IPSN) of the French Atomic Energy Commission (CEA) in the Although limited efforts were underway earlier to review of the designs.

use fire models, IPSN initiated an intensive effort in 1993 to develop the FLAMME code to The safety roles are divided between the regulator quantify the thermal response to the environment and operator as follow:;:

and equipment and use the results of this analysis in their fire PRAs. The objective is to predict the Government authorities determine the safety damage time for various safety-related equipment.

+

objectives.

The FLAMME-S version (Bertrand et al.,1996) may simulate the development of fire in one of Plant operators propose the means to meet the several rooms in a parallelopedic form with objectives which is reviewed by the safety vertical or horizontal openings, confined or authority and approved, if satisfactory.

ventilated, containing several targets and several combustible materials. The design of the code is The authorities exercise oversight in the design based on the assumption of a three-zone model:

stage, the construction stage, and the operation (1) cold zone, (2) hot zone, and (3) plume of l

stage.

f'ame. In particular, the code can quantify the thermal response to equipment located in the Once the installation is in operation, French safety plume directly above the fire source, in the hot gas authorities analyze the causes and consequences layer outside the plume, or next to the fire source of minor fires and also inspect the facilities.

exposed to heating by thermal radiation. The Because of the standardization of French PWRs, code not only calculates the fire within a the discovery of an anomaly in one unit leads to a compartment, but also the consequences of the corresponding modification of all the PWR units potential extension to other compartments through concemed. The efficacy and rapidity of the communicating elements. A compartment can l

interventions in the event of fire are an essential also contain several cable trays as well as several complement to the protective measures. For pieces of equipment such as electrical cabinets.

example, each nuclear power plant draws up a The code has several additional features: (1) it number of fire action sheets that define, for each can use liquid or solid fuels and a mixture of facility or fire zone and for each staff category, flammable product gases in each compartment; (2)

March 1998 5-1 NUREG-1521

Developments and Practices Outside NRC and U.S. Nuclear Industry ventilation can be forced or natural; (3) a fire combustion products: (2) pressure; (3) mass rates damper or door can be closed gradually, as a of gas inflow and outflow via openings; (4) function of time or of temperature or of heat flux; temperatures of the gases (bottom zone, top zone, (4) there can be mass exchange between the plume, in equipment), of the walls, and of any plume, upper ' mr, lower layer, and the ventila-equipment in the compartment; (5) heat Dux tion; and (5) the f.re can be on the floor or above emitted by the flame and incident heat flux in a cabinet. A pictorial representation of the walls and on installed equipment surface; and (6)

FLAMME-S code is shown in Figure 5.1.

damage (fonctional impairment or combustio.1) and time to damage of equipment.

Some additional characteristics of the fire model are that oxygen needed for combustion is taken The code is subject to a specific quality assurance from the compartment with the fire in it, and the procedure. This quality assurance procedure flame is a point source of radiant Dux. Calculated requires, in particular, the production of a " life target temperatures are surface and average inside history" for the code, known as the " qualification temperatures, and cable trays can ignite grid by dossier" containing the following main documents:

grid. Equipment can be impaired by the tempera-(1) functional specifications (design principles of the ture or the heat Dux, and impairment depends on code); (2) technical specifications; (3) physical and the location of the target. The shape of the fire mathematical models (formulas used in the plume need not be a V, which permits realistic development phase); (4) numerical descriptions radiation view factors, and it is possible to handle (approximations of the formulas used); (5) the partial shielding of the thermal radiation by an computer description (code and its computer intervening object, but this is difficult, so it is en vironment); (6) qualification report (comparison seldom done.

of tests and calculations); (7) data sensitivity study (data uncertainties and numerical The code can be used to predict the following sensitivity); and (8) a user's guide containing phenomena: (1) oxygen concentration and information on adequate data selection and NATURAL OR FORCED VENTILATION b

mmummi

~

I GAS LAYER CONVECTION l

Lmm) 1 HOT GAS TARGET LAYER OUTFLOW I

PLUME GASES O "

GASES

~( W (OPEN DOOR)

.M FLAME l

e k.j b7 RADIATION h

4, - -

COLD G AS LAYER

[3j h

"7 NATURAL OR FORCED _ _

i;!

4_

4; 4

VENTILATION - %

FIRE INFLOW OF AMBIENT AIR (OPEN DOOR)

Figure 5.1 Quantification of Thermal Resp <mse by FLAMME S Code (Three Zone Model)

NUREG-1521 5-2 March 1998

Developments and Practices Outside NRC and U.S Nuclear industry l

examples. The last three elements are considered source to other combustible materials in the i

the most important for ensuring quality. Any same compartment, fire propagation from the modifications or upgrades to the code leads to the originating compartment to other compartments issuance of a new version, and the quality through communicating elements, and defining assurance process is applied before the upgrade is real cable dysfunction phenomena. At present,40 released for use.

intermediate and large-scale tests have been performed in various configurations with fuels The first version of FLAMME-S is operational. It common in nuclear facilities and used in the code will be used for the fire PRA study for the 900-validation and qualification process. A program MWu PWRs being conducted by IPSN and for of experiments, which comes under the IPSN's other safety assessments of issues uncovered "Five Year Plan," is currently in process in order dering plant inspections (some safe-shutdown to gain a better understanding of the fire equipment was found to be outside protected phenomena, increase confidence in the results of areas).

the digital simulation and, particularly, to qualify new versions of the code.

5.1.2 The MAGIC Fire Computer Code The French utility, Electricity de France (EdF).

The MAGIC code has been qualified with real-size experiments. A selection of real-size tests uses a different computer program, called fmm the iterature of several countries, including the U.S., {is used for a direct comparison with

" MAGIC." MAGIC is a multicompartment zone model, and it is used by safety engineers at EdF as a basis for discussions of fire safety provisions.

results. EdF also plans to compare MAGIC with The lower layer stays cold, and the heat transfer CFAST, COMPBRN, and FIVE tables through a mem randum of understanding between EdF and through the walls is one-dimensional conduction, the Electric Power Research Institute (EPRI).

with the heat going into the next compartment.

There can be several (up to about 5 or 6) fires in IPSN and EdF are mvolved m several a compartment, each with a separate plume.

Radiation can be calculated between the flame, international collaborative programs to improve walls, and gases; gases are treated as semi-its code and capabih, ties ire this area. One current transparent, and the walls as " gray." The fire can j int activity by IPSN and EdF is to compare MAGIC and FLAMME calculations for a 10-m x be limited by lack of oxygen, in which case the unburned gas in the next compartment flames.

5-m x 3-m concrete room with a pool fire at the Research work for MAGIC is carried out both by center f the floor surface, and with three targets, at different elevations. They will compare the French Govemment research agency, Centre l

National de la Recherche Scientifique (CNRS) at calculated temperatures, layer height, pressure, l

Poiriers, and by intemational cooperation.

xygen c ncentrations, wall temperatures, and the concentrations of other species.

5.1.3 Fire Computer Code Validation 5.1.4 Conclusion l

l FLAMME-S is being validated by fire tests in two In conclusion. IPSN and the utility Electricity de IPSN laboratories, Grenoble and Cadarache, France have considerable efforts underway for which have chambers of volumes from 5 m' to developing and utilizing fire PRAs supported by 3600 m' for use in small, medium, and large-scale the fire computer codes discussed above. They tests in vr.rious configurations. Tests are have concluded that this tool provides useful conducted to determine input parameters for fire information for safety assessments to supplement aad ventilation computer codes for various deterministic analysis on which reactor design and configurations and fuels commonly used in fire protection pmvisions are based. The fire PRA nuclear installations, validation of fire and will identify the most significant locations where ventilation computer codes for various vulnerabilities exist. The results will be used to configurations, and obtaining a better under-support the necessary analysis within the standing of fire phenomena. The experiments framework of the periodic safety assessments include fire propagation from the first ignition conducted every ten years in France for each March 1998 5-3 NUREG-1521

r l

l

\\

Developments and Practices Outside NRC and U.S. Nuclear Industry plant.

accepted elsewhere and has worked). Recently, engineering models and calculations are being 5.2 DEVELOPMENTS IN U.S.

AND submitted to suppon deviations from prescriptive FOREIGN BUILDING I'iDUSTRIES provisions. With positive experiences, code officials are becoming more comfortable with The building industry in the Unites States and calculations for egress and fire growth in granting several other countries (e.g., Japan, Sweders variances. It has been recognized that performance Finland, Australia, Canada, United Kingdom, and codes are a wonhy goal in that they promise to New Zealand) has moved toward adopting allow safety to be maintained, while improving performance-based codes (note " code" here design flexibility and reducing cost. Although a 1

denotes a regulation). Among the benefits more foimal equivalency-determination system l

identified are designs to achieve fire safety that has been introduced in some areas (e.g., Health are better and less expensive than those achieved Care Occupancy chapter of National Fire i

with prescriptive code provisions. The Japanese Protection Association's Life Safety Code), it has Ministry of Construction is in the forefront of been recognized that the move toward these effons. The initiatives in the United States, performance-based fire safety codes will require Japan, and United Kingdom are summarized fundamental changes in fire safety regulation.

below to illustrate the nature of and progress in developing performance-based fire safety codes.

Most of the prescriptive building codes used by Although the main goal of fire protection for the various State and local governments in the commercial buildings, that is, life safety, is U.S. are derived from one of three model codes.

different from that for nuclear power plants, the Currently, the three model code organizations are information in this section is presented because working to create a single prescriptive several features of the fire models and computer

" International Building Code" (Traw, 1998),

codes for the two applications would be similar.

which is scheduled for release in the year 2000.

Also, other important goals in building fire safety This " international" code will be a selective are the assessments of the fire endurance of walls combination of prescriptive requirements from the and Hoors to determine fire fighting capability, existing three model codes. In a parallel effort, and spread of fire to nearby structures, both of this same group is developing a performance-which are applicable to nuclear power plants.

based version of the " International Building Appendix A describes the initiatives in New Code" to be called the " International Performance Zealand, Australia, Canada, and Nordic countries, Code." The target date for completing the and describes the Japanese initiative completely.

performance version is early 2000.

5.2.1 United States In July 1995, the National Fire Protection Association published a document titled NFPA *s Many players, both private and pubh.e, are Future in Performance-Based Codes and mvolved m the development of fire safety codes m the Umted States. Model code organizations Standards-Report of the NFPA In-House Task Group (NFPA,1995). This document established (pnvate) develop the basic code requirements, which are then adapted and adopted by numerous NFPA as a participant in the performance based c e arena.

g th guManx contabed m de legislative bodies at the State and local levels.

One common feature in the U.S. codes is the cument and suppon fmm tk m4mse task i

E'"E' '# #"'

" equivalency clauses," which allow for the acceptance of alternative approaches that meet the pursuing the conversion of their respect code or standard fmm prescriptive to performance.

intent of the prescriptive requirements and which are intended to allow flexibility and foster Currently, the two most active committees in this innovation.

area are Safety to Life and Atomic Energy.

Within the past few years, the Society of Fire Initial deviations from presen.ptive requirements Protection Engineers has initiated a number of were substantiated m the form of logical arguments, data from tests, or example (it was eff rts aimed at providing the engineering suppon NUREG-1521 5-4 March 1998

Developments and Practices Outside NRC and U.S. Nuclear industrv necessary for implementation of a performance-a collection of fire models, FPETOOL, to evaluate based code system. A fundamental activity in this the fire safety of the Govemment-owned or -leased area is the development of engineering practice buildings in its inventory (Stroup,1993). For each documents. These documents are intended to occupancy, a number of design fires, those that provide peer-reviewed guidance concerning would cause the most severe impacts on the appropriate processes and practices for conducting building and its occupants, are assumed. The fire a performance-based design. Specific initiatives scenarios are modeled to determine the effects on include establishment of several engineering task life safety, propeny, and mission. Finally, the groups to address issues such as fire model model (or models) is used to evaluate the effect of evaluation, manuals of practice, building code various protection schemes on the identified fire liaison, design team liaison, and performance safety risks. The GSA funds research necessary (Custer and Meacham,1997) In addition, SFPE is for the further development of FPETOOL and has providing educational support by conducting funded instruction at NIST for GSA personnel.

seminars, symposia, and short courses. The SFPE continues to publish technical guidance such as Training in the use of FPETOOL, CFAST, and the SFPE Handbook of Fire Protection other computer models is provided today in fire Engineering and the SFPE Journal of Fire protection engineering courses at the University of Protection Engineering (Meacham,1996).

Maryland, Worcester Polytechnic Institute, and other educational institutions. Many fire Prediction tools are slowly gaining acceptance protection engineering firms employ personnel within the regulatory community, panicularly for who are expert in the use of these models.

simpler problems, where expens can judge if the predictions are reasonable. liowever, for more Credibility of the prediction tools as an complex problems there is difficulty in equivalency method is still developing among understanding the uncertainties in a calculation.

regulators in the U.S. building industry. The need The National Institute of Standards and for specific models or calculational methods to be Technology (NIST) has proposed to relate the reviewed and sanctioned by independent bodies predictive uncertainty--including both the has been recognized as necessary to advance the calculational uncenainty and the uncertainty in adoption of performance-based requirements.

the impact data as it propagates through the Manuals of practice that lay out the proper calculation-to a design safety factor that will procedures (e.g., data sources, appropriateness of ensure that an undesirable result will not occur.

a model relative to its assumptions, the role of NIST is implementing an effort to develop the sensitivity analysis, accuracy, and uncertainty scientific understanding and calculational models estimates) are being developed.

to allow the adoption of performance-based fire safety engineering.

The following are descriptions of computer codes that have been developed and used in the U.S.

NIST (Snell et al.,1993) has proposed a three-building industry for performance-based fire level fire safety engineering framewcrk, in which protection analysis. The material presented for

" framework" is defined as a conceptual scheme, the codes is purely descriptive and no attempt has I

structure, or system. The first level is primarily been made to provide a critical analysis since the analytical, containing calculational methods for detailed documentation for the codes were not determining fire risks and benefits. The second reviewei and the codes (except for CFAST) were level, largely phenomenological, has too's for not run for any specific nuclear power plant predicting fires and for measuring the problems. The CFAST code was run for a specific performance of fire safety technologies or actions.

nuclear power plant issue, along with the The third level involves the knowledge, COMPBRN code, and the results including a measurement methods, and data needed to suppon critical analysis are presented in Chapter 6.

the tools.

The General Services Administration (GSA) uses March 1998 5-5 NUREG-1521

Developments and Peactices Outside NRC and U.S. Nuclear Industrv 5.2.1.1 The Program FPETOOL squared" formula,* or describing another FPETOOL is a collection of computer-simulated specific lly applicable heat-release rate curve.

procedures providing numerical engineering calculations of fire phenomena to the building FIRE SIMULATOR is a procedure that can designer, code enforcer, fire protection engineer predict the thermal environment from a fire using a one-room, two-zone, two-vent model with and fire safety-related practitioner. The latest cap bility to predict fire detection and sprinkler version incorporates an estimate of smoke conditions developing within a room receiving steady-state smoke leakage from an adjacent space. Estimates of human viability resulting CORRIDOR is a procedure that predicts the characteristics of a moving smoke (hot gas) front from exposure to developing condytions within the in a corridor. The procedure is formulated for room are calculated on the basis of the smoke spaces with large length-to-width ratios.

temperature and toxicity. There is no modeling of human behavior. An estimation of the reduction 3rd ROOM is procedure that predicts smoke m fire heat-release rate due to sprinkler suppression is also mcluded in the latest version.

conditions (toxicity and visibility) developing in a room and the subsequent reduction, in visibility and threat to human life.

FPETOOL (Deal,1995) is a compilation of several modules grouped into six categories.

These categories are The last three modules may be used sequentially.

FIRE SIMULATOR predicts fire-generated effects within the room of origin. Smoke outnow SYSTEM SETUP

+

• • Y FIREFORM a

infl w t the CORRIDOR module.

Smoke MAKEFIRF

+

FIRE SIMdLATOR c nditions predicted with the CORRIDOR module a

"S# * # "* # "

"' " I CORRIDOR I

"I 3rd ROOM

• 'I' E'""

SYSTEM SETUP is a utility routine. It allows the user to change file destination and source CFAST (Peacock et al.,1993b and 1997) is a directories, change operating units, and change multi-room zone model with comprehensive screen colors. The menu choices are presented capabilities. Some of its features are described above as they appear to the user.

bric0y in the sections that follow FIREFORM is a collection of quick procedures 5.2.1.2.1 Fires designed to solve primarily single-dimensional

\\Vithin CFAST, a Ore is a source of fuel that is questions. Such questions might be: How hot is released at a specified rate. This fuel release rate the ceiling jet 3 m (-10 ft) frorn the center of is then converted into enthalpy (the conversion plume impingement? How long will it take for 50 factor is the heat of combustion) and mass (the people to evacuate from the 7th floor of this building to ground level? When will this fuel conversion factor is the yield of a particular item exposed to the fire source ignite?

species as it burns). Burning can take place in the portion of the plume in the lower layer (if any), in MAKEFIRL, is a collection of routines for the upper layer, or in a door jet.

For an creating fire files. These files have three columns unconstrained fire, all of the burning will take place within the fire plume. For a constrained of data: time, fire heat-release rate, and fuel fire, burning will take place where there is pyrolysis rate. The user has the option of letting sufficient oxygen.

If insufficient oxygen is the program determine when the second item ignites, defining a fire according to a generic "t-

'This is one type of power-law growth for heat generation modeling.

NUREG-1521 5-6 March 1998 L

Developments and Practices Outside NRC and U.S. Nuclear Industrv entrained into the Sre plume, unburned fuel will the rectangular geometry of vents compared to the successively move into and burn in the upper round geometry of fire plumes. All plumes within l

layer of the fire room, the plume in the doorway to the simulation entrain air from their surroundings l

the next room, the upper layer of the next room, according to an empirically derived entrainment the plume in the doorway to the third room, and so relation. Entrainment of relatively cool, non-forth, until it is consumed or exhausted outside.

smoke-laden air adds oxygen to the plume and allows the fuel to burn. It also causes the plume The latest version of CFAST has the capability to to expand in the shape of an inverted cone as it independently track several fires in one or more moves upward. The entrainment in a vent is rooms of the building. These fires are treated as caused by bidirectional flow and results from a totally separate entities, that is, with no interaction phenomenon called the " Kelvin-Helmholz oPhe plumes or radiative exchange between fires instability." It is not exactly the same as a normal in a roen.

plume, so some error arises when this entrainment l

is approximated by a normal plume entrainment Like most currenene fire models, this version of algorithm.

CFAST does not cond a pyrolysis model to l

predict fire growth. Rather, pyrolysis rates for 5.2.1.2.3 Vent Flow l

each fire modeled define the fire history. The Two kinds of flow come through vents. The first similarity of that input to the real fire problem of is referred to as " horizontal flow." It is the flow interest will determine the accuracy of the that is normally thought ofin discussing fires. It resulting calculation. The user must account for encompasses flow through doors, ndows, and any interaction between the fire and the pyrolysis so on. The other is " vertical flow," and it can rate.

Future research should remove this occur if there is a hole in the ceiling or floor of a imutation.

compartment. This latter phenomenon is particularly impcrtant in three disparate cases: on 5.2.1.2.2 Plumes and Layers a ship, in the role of fire fighters engaged in roof Above any burning object, a plume is formed that venting, and fire propagation in typical is not considered to be a part of either layer, but containments for nuclear power plants.

that acts as a pump for enthalpy and mass from the lower layer into the upper layer (upward only).

Flow through normal vents is govemed by the For the fire plume, CFAST does not use a point pressure difference across a vent. Two situations source approximation, but rather uses an empirical give rise to flow through vents. In the first correlation to determine the amount of mass situation-usually thought of in fine problems-air moved between layers by the plume.

or smoke escapes from a compartment by buoyancy. The second type of flow is due to Two sources exist for enthalpy and mass transport expansion that is particularly imponant when between the layers, within and between rooms.

conditions in the fire environment are changing Within the room, the fire plume provides one rapidly. Rather than depending entirely on density source. The other source of mixing between the differences between the two gases, the flow is layers occurs at vents, such as doors or windows.

forced by volumetric expansion. The earlier Here, there is mixing at the boundary of the version of this model did not solve this pan of the opposing flows moving into and out of the room.

problem entirely correctly. In most cases, the The degree of mixing is based on an empirically differences are small, except for rapidly changing derived mixing relation. Both the outflow and situations. However, these small differences inflow entrain air from the surrounding layers.

become very imponant in a situation in which The flow at vents is also modeled as a plume flows are due to small pressure differences, such (called the door plume or jet), and the same as will occur with a mechanical verilation equations as those for the fire plume are used, system. Atmospheric pressure is about 100,000 with two differences. First, an offset is calculated pascals (Pa), and fires produce pressure changes to account for entrainment within the doorway; from 1 to 1000 Pa; to solve these interactions second, the equations are modified to account for March 1998 5-7 NUREG-1521

Developments and Practices Outside NRC and US Nuclear Industry correctly, we must be able to follow pressure species are produced in direct relation to the mass differences of = 0.1 Pa out of 100,000 Pa for the of fuel burned (this relation is the species yield overall problem, or IE4 for adjacent specified by the user for the fuel burning). Since compartments.

oxygen is consumed rather than produced by the burning, the " yield" of oxygen is negative and is 5.2.1.2.4 Ileat Transfer set internally to correspeud to the amount of Heat transfer is the mechanism by which the gas xygen needed to burn the fuel. Also, hydrogen layers exchange energy with their surroundings.

cyanide and hydrogen chloride are assumed to be Convective transfer occurs from the layer to the pr ducts of pyrolysis, whereas carbon dioxide, room surfaces. The enthalpy thus transferred in carbon monoxide, water, and soot are products of c mbustion.

the simulations conducts through the wall, ceiling, or floor in the direction perpendicular to the surface only. CFASTis more advanced than most Each unit mass of a species produced is carned m.

the flow to the various rooms and accumulates m models because it allows different material properties to be used for the cr' rg, floor, and the layers. The model keeps track of the mass of walls of each room (but all the walls of a room e ch species in each layer and knows the volume must be made of the same material). Additionally, f each layn as a function of time. W mass CFAST uniquely allows each surface to be divided by the volume is the mass concentration, composed of up to three distinct layers, which are which, along with the molecular weight, gives the treated separately in the conduction calculation.

c ncentration in volume percent or parts per This not only produces more accurate results, but milli n, as appropriate.

allows the user to deal naturally with the actual building construction.

The species concentrations are important in that they can be used to calculate the toxic impact of Radiative transfer occurs among the fire (s), gas the gases on persons trying to escape from the layers, and compartment surfaces (ceiling, walls, fire. This calculation, along with others, is carried and floor). This transfer is a f.metion of the ut in a set of programs called HAZARD I, in which CFAST is embedded.

temperature differences and the emissivity of the gas layers as well as the compartment surfaces.

5.2.1.2.6 Code Validation For the fire and typical surfaces, emissivity values only vary over a small rang'e. For the gas layers, however, the emissivity is a function of the NIST has tned to improve CFAS T so that when it concentration of species that are strong radiators:

is used withm the range of variables for which it predominantly smoke particulate, carbon dioxide, has been verified, dependable results are obtamed.

and water. Thus, errors in the species concentra-The CFAST model has been subjected to a wide tions can give rise to errors in the distribution of r nge f comparisons to experimental data. The enthalpy among the layers, which results in errors c mPans ns range from simple single-in temperatures and, consequently, errors in the c mpartment fires (Deal, 1990),

multi gg,3, compartments on a single floor and a seven story hotel (Peacock, et al.,1993a), to large aircraft 5.2.1.2.5 Species Concentration and Deposition hangers (Duong,1990, Davis et al.,1996b). For variables deemed of interest to the user of the When the layers are initialized at the start of the model, the CFAST model provided predictions of simulation, they are set to ambient conditions.

the magnitude and trends (time to critical These conditions are the initial temperatures conditions and general curve shape) for the specified by the user, and 23 percent by mass experiments, which range in quality from a few (20.8 percent by volume) oxygen,77 percent by percent to a factor of 2 to 3 of the measured mass (79 percent by volume) nitrogen, a mass values.

concentration of water specified by the user as a relative humidity, and a zero concentration of all other species. As fuel is pyrolyzed, the various NUREG-1521 5-8 March 1998

(

l

Developments and Practices Outside NRC and U.S. Nuclear Industri 5.2.1.3 The Program FASTLite In the case of a single room, CFAST can be used t e un e c ntent of th upper layer.

FASTLite is a one-room to three-room version of mafe the program CFAST, packaged veith most of the I".a taH smgk mom, md as an atrium, the results FIREFORM routines of FPETOOL on a CD-will be more accepted if the Heskestad plume m del (used by the NFPA 92B Guide) is used ROM disk. Both CFAST and FPETOOL are mstead of the "Zukowski" plume model normally described above. The FASTLite outputs can be used m CFAST (Zukowski er al., 1980/1981).

printed as tables or to a spreadsheet, and as graphs The amount of material entrained m, the plume of temperatures, layer heights, and burning rates could be in error for these tall plumes by a factor y

of 2 if the room is more than 10 m or so high.

1 This program is available as "FASTLite," Special 5.2.L5 Computational Fluid Dynamics (Field)

Publication 899 from the U.S. Department of

Commerce, NIST, Fire Modeling and Applications Group, Gaithersburg, Maryland The application of the techniques of 20899.

computational Guid dynamics (CFD, also called

" field modeling") to fire problems has been 5.2.L4 Codes for Simulating Smoke Travel rapidly increasing during the past decade since the During Fires application of this technique to the deadly King's Mathematical models are currently being E*""f 8 *.

n fire in London (Simcox et al,1989). This application provided m, sights developed to calculate smoke travel from fire that on the observed fire growth that could not be may occur in a non-critical area of the power plant drawn without the analysis or zone models. This to other areas in which operators and others must niethod of modeling smoke and heat flow requires perform their duties. This problem, of course, is that the region of interest be divided into a of major concern for life safety m building fires, collection of small rectangular boxes, or control as well as m nuclear power plant fires, so a large d

h Ws a @ mo m h degree ofinterest has resulted m, well-developed control volumes per room; a CFD model may have and validated models.

100,000 or more contgol volumes.

The best known model for smoke travel between Heat is released in several control volumes over interconnecting rooms is ASCOS, which is h M% Op W Mg of m desen, bed in the ASHRAE (American Society of m nwnmm, and energy) between control volumes Heating, Refrigeration and Air Conditioning is determined so that these three quantities are Engineers) publication " Design of Smoke c nsene menmm c nsenanon equauons Management Systems," Atlanta, Georgia (1993).

are determined by the Navier-Stokes equations.

However, the input routine for this model is somewhat tedious and it is easy to make errors.

These fluid Gow equations are expressed An improved program, with a graphical input g

g routine, designed for personal computers (PCs), is E""'.al differenn. l equations, and after some a

CONTAM. CONTAM (Walton,1994) lets the user draw the connections between rooms and inanipulati n are solved each time step for each of between rooms and the outside on a sketch of the the control volumes. Turbulent now problems Door plan (which need not be drawn to scale), and

• 1. Y. require the solution of additional equations.

enters these to the calculational software. Also, Obviously, considerable computer capabihty is requir d both to run the calculations and to leakages between rooms, or to the ceiling or the sp ay h mmhs.

floor, can be entered. Species such as acid gases, as well as vision-impeding soot, are carried by the ur current N nodels used for fire problems

" smoke." The user must specify the smoke output I

from the fire, as well as the heat output, as a JASMINE (W. (h Fire Research Station); LES

^'*

Bntish Harwell Laboratory);

Bntis i

function of time.

(NIST Building and Fire Research); and KAMELEON (Norwegian SINTEF NBL and March 1998 5-9 NUREG-1521

i Developments and Prcctices Outside NRC and U.S. Nuclear Industri Sandia National Laboratory).

5.2.2 Japan The Japanese have a significant initiative for I

The application of CFD to fire problems opens up the possibility of modeling smoke and heat flow developing Gre models. Beginning a decade ago, they developed a detailed methodology that can be around obstructions and m. complex geometries.

The impact of forced ventilation or wind on used to establish equivalency to the Building Standard Law of Japan. This method was smoke flow can easily be modeled. Recent developed in 1988 (Wakamatsu,1989) and has improvements have also allowed radiation been growing in use since. The number of " Article exchanges between the fire and the surroundings 88 Appraisals" has increased to hundreds per year, to be included. In some instances, simple chemistry can be m, cluded ia CFD calculations, although they are still limited to special projects but the scale size of the reaction region and the with unique requirements that could not be easily achieved under the prescriptive law.

present speed of com,.uters prevent the implementation of these calculations in room-size The Japanese are able to accomplish this because fires. Other Dre-related problems that can be meluded are the activation of heat eM smete they have a single, national code promulgated by the Ministry of Construction (MOC) that is detectors and the penetration of water ' prays enforced locally. The code allows equivalency, as through the fire plume.

do the U.S. codes, but the determination of eq alency msts & tk Emus, den de A lack of appropriate validation studies hinders Building Research Institute (part of MOC) assessing the accuracy of Held model calculations.

published the calculational method, it represented Currently, a study by NIST and the National Fire

.. sanctioned method" for establishing Protection Research Foundation is underway t equivalency. Further, a mechanism has been investigate the use of the Large Eddy Simulation established whereby the local authority can solicit (LES) model to analyze the interaction of the advice of MOC on the appropriateness of a sprinklers, vents, and draft curtains. As part of calculation, further adding to the comfort of the this effort, a number of full-scale tests are being authority having jurisdiction.

conducted to develop data for verification of the model results. Among other things, this modeling effort mvolves calculating fire growth, time c',

Published in four volumes, the method represents activation for multiple sprinklers, and the impact a manual of practice for evaluating the fire safety of the sprinkler spray on the burning commodity of a building. Volume i discusses the goals and (McGrattan et al.,1997a). Another effort, being objectives of achieving safety and presents several conducted by NIST with sponsorship from the case studies as examples. Volume 2 covers fire Prevention and containment. Calculation methods Mineral Management Service, is aimed at P2 ClinB 2 an Sm e Spread within a verifying the use of a versien of the LES model to predict the development and spread of smoke building are included along with typical data ne to Wonn h cakulations for most plumes from burning oil spills in the outdoors (McGrattan et al.,1997b). As the use of field buildings. An example calculation for an atrium models becomes more widespread, additional is included. In Volume 3, egress and tenabihty calculations are covered. Necessary data, verification efforts will no doubt be conducted.

including occupant charactenstics and loadings by A still more accurate way to calculate the smoke CCUPancy type, are given along with several l

examP e calculations. The fourth volume is a content at a given place in the room versus time would be to use a " field" model, such as FLOW-

• • ""*I

"'*~**IStant design containing design 3D or LES, which divides the room into thousands standards, calculation methods, and examples.

of zones. Typically, Geld models require computer For common assemblies, charts and simplified workstations. However, NIST is investigating the calculati ns are presented.

possibility of running field models on PCs to solve specific fire protection problems (Walton, Although the Japanese have no performance code, 1996)'

they do have a performance-based method that is officially sanctioned as providing equivalent NUREG-1521 5-10 March 1998

Developments and Practices Outside NRC and U.S. Nuclear Industrv designs. They have a manual of practice that The first step toward putting some flesh on these gives details of the calculation methods and all performance " bones" was a study by H. L necessary data, along with numerous examples.

Malhotra (1987) (then recently retired from the They have also established a system by which Fire Research Station) commissioned by the local authorities can receive assistance in Depanment of Environment. Malhotra considered evaluating the appropriateness of the calculation that the building fire safety objectives were in case they feel uncertain or uncomfortable in making that decision.

life safety prevention of conflagration a

The Japanese have now initiated the second phase property protection of their program to completely evolve to the performance-based building fire regulation system This particular tripartite split is notably very to replace the current prescriptive law. A research general. " Life safety"is so general as to be narly project on the development of assessment akin to "public welfare." Prevention of methods of fire safety performance (the level of conflagration is certainly important and essential, safety that must be reached by each requirement yet some quite unrelated issues are placed of the performance code)is ongoing.

together, that is, building construction, lot sizes and zoning, and fire fighting operations. Finally, 5.2.3 United Kingdom some people disagree that property protection, apnt from conflagration control, is a government In principle, the United Kingdom moved to a function.

performance-based model building code by adopting the Housing and Building Contrc! Act of To develop further details in his plan, Malhotra 1984 (United Kingdom.1985). This system examines, in his study, several building codes replaced presumptive requirements with broad from different pans of the world and proposes a functional statements. The basic regulation was model scheme for occupancy classifications. In then supplemented by a series of " approved general, this scheme is very similar to the one documents."These documents spell out a way by used in the Uniform Building Code and other which the intent of the regulation can be deemed traditional codes. Classifications are given for to be satisfied. It was understood that these such occupancies as residential, education, approved documents would then, in the long term, business, and factory. Note, however, that the constitute fire safety engineering guidelines. This traditional concepts of regulation according to was seen as requiring a long time and significant occupancy type are not founded on sound funding to accomplish. Thus, the first edition of engineering principles. A framework based on the approved documents consistej, essentially, of fire safety engineering concepts would demand a republished old prescriptive code. Compliance that such " top-level" classifications be based on with the old code, therefore, was deemed as (1) degrees of hazard, (?) degrees of risk, or compliance with the new regulation as well.

(3) similarity of firr environments. The traditional Other designs could be offered, however, if they occupancy classifications are simply based on were approved by the local building authority.

uninformed judgment, that is, judgment not Recently, approval authority for performance-supported by physics, statistics, or even case-trend based designs in housing construction has been analysis. The mest essential objectives of a removed from the local authorities and vested in rational, performance-based building code shou!d

" approved inspectors" (Rackliffe, 1998).

be to present the scientific bases for a " top-level" Enforcement remains the domain of the local building categorization scheme.

auth inties. The approved mspectors are private firms or individuals who are paid as outside M4hotra's scheme includes major engineering experts by the builder. They have the expertise to modules for judge the value of the design. Local authorities cannot appeal the decisions rendered by the the desiga of means of escape approved inspectors.

fire development within the initial space of

~

March 1998 5-11 NUREG-1521

Developments and Practices Outside NR C and U.S. Nuclear Industry fire origin fire model predictions through a round-rum fire propagation from room to room serics of blind fire model predictions (Jones, fire propagation from the burning building to 1996) which was initiated about March 1995. The a

another building international community has chosen a series of detection, fire fighting, and extinguishment nine scenarios, of generally increasing complexi-

+

fire safety management (c a,,..

staffing, ty, on which to evaluate the strorg and weak trainmg, maintenance of equipment) points of some 21 existing computer fire models and increase confidence in the use of fire model These more detailed building blocks are predictions. The scenarios are developed in some detail in Malhotra's' study.

Although conceptual planning of the principles of single plume under a hood fire protection has progressed in some ways since this study was issued, the detailed engineering single room with a door opening

+

concepts and voluminous references that he examines in connection with each of thesc single room with a door opening into a a

engineering modules represent a valuable startie corridor point for work in this area.

floor in a hotel or in a health care facility, or In 1994, the British Standards Institution (BSI) both issued a draft " British Standard Codu of P:acdce for the Application of Fire Safety Engineering atrium and a room opening into an atrium Principles to Fire Safety in Buildings"(94/340340 shopping mall IX'). This draft code was met with some negative comment because the document did not go further staircase in a multi-floor building than supply a collection of formulas. Recently, BSI published a " Draft for Development, DD 240, very large room Parts 1 and 2, " Fire Safety Engineering in Buildings." Pan 1 is a guide to the application of underground space, room ventilated only from fire safety engineering principles; Part 2 gives above guidance on the limits of applicability and confidence limits for the equations in Part 1. The Zone models that have been suggested for this original intention with the first publication in (multi year) round-robin evaluation include 1994 was to prepare a British Standard on Fire CFAST, FIRST (an updated IIARVARD code),

Safety Engineering. liowever, after considering the Japanese BRI-2, the French FLAMME-S2, the comments received on the draft code of WPI(another updated version of the IIARVARD practice, panicularly those concerning the current code), and i1 others. Eight CFD models are state of knowledge on the use of fire safety entered, including JASMINE (British Fire engineering BSI decided that it should first be Research Station), VESTA (French), and published as a Draft for Development before it KAMELEON (Sandia National Laboratory and could be given the status of a British Standard.

SINTEF (NBL Norway)). Only the first two The intent is to apply this document on a scenarios, of a single plume under an exhaust provisional basis, so that information and hood and a single inom with a door opening, have experience oa its practical applications may be been cansidered so far.

obtained.

About 1982-1985, a series of experimental fires 5.2.4 International Efforts for Code was carried out in Germany using a surplus Validation nuclear power plant containment. There have been several attempts to model the results, but because Currently, a working group under CIB W 14 of the complex geometry of the companrr.ents and l

(International Council for Building Research and ventilation factors, these attempts have been l

Development) has undenaken an effon to validate difficult. liowever, these containment scenarios l

NUREG-1521 5-12 March 1998

Developments and Practices Outside NRC and U.S. Nuclear Industry are planned to be the basis of a realistic new with international panicipation. On the basis of international program by a subcommittee of the what was teamed, a second-generation framework International Standards Organization. The plans (FDMS 2.0) now exists for recording and are for the modelers each to first use their fire assessing critically evaluated experimental fire model to try to predict what should have data (Portier,1994). It will be accessible by happened. Then the modelers will try to use each anyone from the Internet. Data will include both other's models. Finally they will be given the the results of large-scale tests and data obtained measured results of the experimental fires, and with bench scale and laboratory apparatus. It is asked to find out what modifications to their planned (Portier,1996) that NIST will implement models would be necessary to obtain accurate this comprehensive fire database management results.

system. It will be available in a format (FIREDATA) that can be readily inserted into fire The Society of Fire Protection Engineers has programs for validation of the programs, as well established a task group to address computer fire as for a range of other uses.

model evaluation. The goal of the task group is to evaluate computer models, intended for use in fire 5.2.5 Features of Some Fire Computer Codes safe:y engineering, on their applicability, use, and limitations within the evaluation and design Table 5.1 lists capabilities of some current processes. To minimize duplication of effort, the computer fire codes described above. Except for task group is using various ASTM guidance field models, however, none does a really documents,i.e., ASTM E 1355," Standard Guide adequate job of calculating the impact of a fire on for Evaluating the Predictive Capability of Fire heating and then igniting such targets as cable Models"; ASTM E 1472, " Standard Guide for trays, and probably no code accurately predicts Documenting Computer Software for Fire the chilling of the upper layer gas by the large Models"; and ASTM E 1591," Standard Guide for amounts of heat transfer surface and thermal Data for Fire Models," for the evaluation effort capacity of cable trays in that layer.

(Meacham,1996).

The following is a short description of the A collaborative international program between meaning of some of the column headings.

EPRI in the U.S. and EdF in France (Mowrer and Gautier,1997) was aimed at comparing the

" Wall Heat Xfer" refers to whether the heat lost to 1

CFAST, COMPBRN III FIVE, and MAGIC the wall is calculated in the program. Some codes discussed earlier with data from the programs only use an empirical estimate of the FM/SNL (NUREG/CR-4681 and NUREG/CR-heat remaining in the gas, thus greatly reducing 5384) and UUSNL (NUREG/CR-3192) series as the amount of calculation per time step. As well as a NBS 3-room serie:;(Peacock,1988).

mentioned above, most programs that do the calculation consider only the walls and ceiling as As pointed out above, real experimental data are heat loss surfaces, ignoring the effect of other needed to validate computer programs and the stmetures in the hot gas layer, such as cable trays.

techniques for using them. A large amount of data exists, but the data are scattered through the

" Lower Level Gas Temp?" refers to whether there literature and are difficult to assess unless the user is provision for upper layer gas to mix with or happens to remember what kinds of tests were radiate to heat the lower layer of gas.

carried out for a given program, and knows the name ef the author or agency, in addition, new in all cases, except for COMPBRN III, the " Fire" tests by a number of agencies continually create is entered as input. This column refers to whether new data.

it has a constant heat generation rate, or can vary with time, and whether there can be more than one About 1990, a first attempt at preparing a database fire in a compartment.

that would include some kinds of large fire tests was imtiated at the British Fire Research Station,

" Gas Concentrations?" must be specified as March 1998 5-13 NUREG-1521

Developments and Practices Outside NRC and U.S Nuclear Industry emissions from the fire vs. time if the program is code in the fire PRA studies initiated in 1993.

expected to keep track of them from compartment The goal of the French program is to advance the to compartment. Most of the programs listed on state of the art of fire models for nuclear plant Table 5.1 will perform that task. " Oxygen applications beyond the current state worldwide, Depletion" refers to whether the program will including the U.S.

shut off or otherwise diminish the fire if the oxygen concentration gets too low for combustion The review of developments in the U.S. and to take place. However, the data for modeling the foreign building industries indicated a notabk cffect oxygen depletion on the burning rate are move toward the use of performance-based

_j generally are available.

methods, and, to a limited extent, risk analysis to replace current prescriptive requirements.

It is assumed that any multi-room model has Recognizing the benefits of performance-based connections (doors) horizontally on the same level methods, several countries (New Zealand, between rooms, and doors or windows from Australia, Canada, and U.K.) have modified their rooms to the outside. Only some of the models building fire laws and regulations to make this can cause gas to flow vertically from a room to transition to performance-based regulation.

one above or below it. This is indicated in Australia and Canada are pursuing the use of risk

" Vertical Connections?" Likewise, any multi-analysis in conjunction with performance-based room model (except the smoke flow models) has methods for building fire protection design. More buoyant flow of gas from one room to another.

rexutly, the National Fire Protection Association Bet only some of them can add forced flow from in the U.S. has also initiated development of the heating, ventilation, and air conditiorung performance-based standards. Several insights (IIVAC) system ("HVAC Fans and Ducts").

m be gained from the experience of the building

]

industries for developing performance-based

" Detectors?" refers to whether the model will regulations for fire protection of nuclear power calculate the time at which a thermal detector plants.

(including the actuating strut in a sprinkler) or a smoke detector will actuate. The " Sprinklers?"

Since the early 1980s, notable developments have column refers to whether the model will throttle been made for fire safety engineering analysis for the fire as the sprinkler water impinges on it after building safety using fire models, particularly in the sprinkler strut actuates.

the U.S., U.K., and Japan. A number of computer codes have been developed and are currently Many other aspects of each model must be taken being used for analyzing building fire protection.

into account when selecting one for a particular Recently, an international collaborative effort case. With the current models, the general caution involving several countries has been initiated to is that the strengths and weaknesses of the model validate fire computer codes being used in the must be k nown to the modeler.

different countries.

Several international conferences are now held annually to present and 5.3 Conclusion share results and experiences. Other than effons in France, a similar level of international activity Review of developments in the nuclear industry in for developing the capability for performance-France reveal:d a significant effort and program based analysis for nuclear power plant fire underway to develop and use fire computer protection is not evident. One collaborative effort models for determining the risk from fire events.

between U.S. and French utilities to compare fine The French program includes research work for computer codes is noted.

fire code development and validation with tests, and application of the developed fire computer NUREG-1521 5-14 March 1995

___m I.E

C n

t o

n P

r i s

o r

ot s r g

a r

a pe n

h f

o f

f lu et itul C,

s C

s e

P n

n c e u

, pb L p r

i i

r iol m

e a

P f

u a

r mt n

t c &o s

e r

o m

o N

u op o

it u

s u

m bl o c F

n c e f

o t

ir o

S f

c a

r n

P d

o t

c ty t

E t

n u

t a

i ny n

s r

I E

n u

n o

p ai iC s

s a

r pS r

i&l n L A

e s

r s, a h,

d c

a o

k a

e i

d -

ed r s c

c e

,u i

O R m

i y

u te r

s h

n r

r f

l c

r t

n O i u

e n

h oe n

n pi e n y

m w

s p

p o ta c c e

e e

is i g E

A D S

s gma a T S

o e

e a

e e r

r r

u R

F E

Ini h

Gr n F

F D

t km?

s s

s e

e o

o e

o A

A r s pr Sl Y

Y N

N

?

?

Y N

N N

e

.cte?

s s

s s

s s

s e r e

e e

o e

e e

A A

o Dt Y

Y Y

N

?

Y Y

Y N

N C &

s A

t s

n c

s s

s s

s e

V u

e e

o e

e e

o o

o a

d I F D Y

Y N

Y

?

Y Y

N N

N I

oC l

r N

a r

c e t

i n?

R e

t nn s

s s

s s

s r

e e

o B

o e

e o

e e

u e o o p

VCit Y

Y N

P N

?

Y Y

N Y

Y 1

m h

o O

C C

-e e

lpn n

s s

s s

s s

s s

i

,e o

o e

e e

e e

A A

r e

e e

F 0D it Y

Y Y

Y Y

Y Y

Y N

N d

I.

e

?

s r

s a

e n

b c

v s n s

s s

s s

s s

s s

e a o e

e o

S GC Y

Y N

le e

e e

e e

o e

b Y

Y Y

Y Y

N Y

f a

o r

ie l)e d

t d

d d

d d

s d

p f

ip ie f

iic ie e ie e

ic c

o ip f lp f

ie ie e

u f

f f

r" e

lt i

k ict ict ic ic i

i c

t u

e o

el el e

e e

A A

S t

i p

m p

l S m S m S

S S

N N

pu pu p

p p

e F

F S

(

s 1

A

?

5 s

R t

ic e

P g

b t

r a

s f

s s

s s

c o

o e

o e

e e

e o

o o

c I

a T

I T N

N Y

Y Y

Y Y

N N

N e

s u

r

?

o el p

t l

l l

e m

s s

a a

a w v s e

e o

s e

o e

e o

A A

o e a e LL GT Y

Y N

d R

N R

R N

N N

a le l

t r

s s

s n,

s s

s s

s la e

e e

e e

e e

e e

o o

o e

I f WI X Y

Y Y

e Y

Y Y

Y N

N N

r c

s i

i 2

i i

s m

l t

/

tt oo 5

i i

lt w

w 1

u lt a

. o t

w u

u i

i e

e t

i NR 1

3 I

n i

h h

F F

2 h

h s

e r

r" r

r d

o d o d o

w o

e e

e i

e e

v Dl Dl e

wol w

e p

n n

n n

n e

e n

o t

y o

o o

r o

o Fi FiF o

teI e

F T

Z Z

Z P

Z Z

C" C"

Z Nk Nk T

R O

U h

C I

m T

L P

t I

W O

A S e a

S T

l E

h G

T Ok T

1

)

r g

A S

hl A

o w N V

S A

O S

E Cmo LD E

P S

O o

F A

OI I

L r

1 P

C FE CN F FE h

F3 L

FL A( F C

Sl ZfE @o u L. "

7Cga ir.

o

6 APPLICATIONS OF RISK-INFORMED, PERFORMANCE-BASED METHODS In a broad sense, risk-informed and performance-6.1 CATEGORIZATION OF METHODS based methods can be thought of as a means of AND APPLICATION AREAS providing an alternative option for implementing The following is a categorization of the methods regulatsoas that is more efficient m terms of and application areas. The experience with current expenditure of resources, while at the same time focusing proper attention on the nsk-sigmficant requirements is presented in each method category with summaries of the requirements and the aspects of the regulation. This means may exemptions to those requirements, including the potentially be achieved by an increase in risk-technical issues considered by the staff for informed discrimination offered by the granting those exemptions. As indicated in methodology presented earh,er m this report.

Chapter 3, which presents a detailed review of experience with current requ'rements, the The two main objectives of risk-informed and justifications provided for the exemptions, and performance-based approaches are bases for granting them, were mostly qualitative analyses and engineeringjudgment. The summary (1) to provide flexibility by emphasizing the safety objective rather than the means for

.f the experience is followed by a description of achieving the objective nsk-informed, performance-based methods that are now available. Detailed examples that apply (2) allocating resources to the most risk-signifi-the methods in several areas of current cant areas and minimizing resource allocation requirements are presented in Section 6.2, to areas in which safety benefit is minimal

" Applications."

In Chapter 3, a comprehensive review of 1351 6.1.1 Performance-Based Methods exemptions and deviations to current fire protection requirements and guidance documents The first general category of methods is those that was presented to determine the experience with would suppon performance-based approaches, but current prescriptive requirements and which areas are not necessarily risk-informed, i.e., these l

may be amenable to risk-informed, performance-methods will support implementation of less-based methods to improve the regulatory process.

prescriptive safety objectives, but do not directly This chapter presents several trial applications, or case studies, to examine the potential of risk-Application Areas informed, performance-based methods (discussed in Chapters 4 md 5) to provide new or improved

1. " Engineering Tools" for Evaluating Fire insights for fire protection analyses, and a more Dynamics and Use of Fire Computer systematic process to judge the acceptability of Codes Based on Zone Models l

attemative approaches in some of the areas identified in the exemption review. The Section Ill.G.2.a of Appendix R requires the use l

applications are presented to examine benefits, of 3-hour-rated barriers to separate redundant and illustrate the manner of potential applications.

trains. Structural steel forming a pan of, or The material in th's chapter may be used as supporting, these barriers must also be protected i

information toward the formulation of regulatory to provide a fire resistance equivalent to that of guidance for the applications presented below, but the barrier.Section III.O.2.b requires separation it will be necessary to funher define the specific of cables, equipment, and associated circuits of framework of the applications, including redundant trains to be accomplished by a identifying the bounds of validity for the methods horizontal distance of more than 20 feet with no tor specific cases, intervening combustibles. In addition, fire 1

March 1998 6-1 NUREG-1521 l

U

Applications ofRisMnformed. Performance-Based Methods detectors and an automatic suppression system and can be useful for analyzing unwanted fire must be installed in the area.Section III.G.2.c growth and spread (fire dynamics). The use of provioes another compliance method to protect these methods will require an evaluation of their safe-shutdown capability by enclosing one of the validity for specific applications. These analyses redundant shutdown trains in a 1-hour-rated fire can be mostly conducted by hand without a barrier, and providing fire detection and automatic computer program, cr sometimes with simple suppression in that area.Section III.F requires computer routines of fire correlations.

automatic fire detection in areas containing safety-

" Engineering tools" are available for calculating related systems.

an equivalent fire severity, adiabatic flame temperature of the fuel in comparisen to the A total 624 of exemptions have been given for damage temperature of the target, fire spread rate, unrated components (watertight doors and steel pre-flashover upper layer gas temperature, vent hatches), barriers with unprotected openings, flows, heat release rate needed for flashoven partial barriers or less-than-3-hour-rated barriers ventilation limited burning, and post-flashover (e.g.,

dampers and doors),

intervening upper layer gas temperature.

combustibles within the 20-ft separation, no automatic suppression with low fire loading and These tools can be used to evaluate the adequacy high compartment ceilings, no automatic fire of deviations from prescriptive requirements for detection in areas containing safety-related configurations with low fire loading, or to equipment, and no fixed fire suppression for areas establish the basis for fire barrier ratings, safe (e.g., control room).

separation distance, and need for fire detectors and suppression systems in protecting one train The staff considered that exemptions were for safe shutdown. Since these tools mostly i

acceptable for configurations with low fire employ bounding calculations, (it will be loading (including transient combustibles), if the necessary to examine this for each specific fire severity (measured in minutes) is much less application), results will be conservative but can (by a factor of 2 or more) than the installed provide useful information to indicate areas where barrier. Availability of fire detection, auto-fire protection features have been grossly suppression. barrier location, and room geometry overemphasized (or underemphasized).

were also considered for determining the adequacy of baniers. Manual actions for In cases in which hand calculations are replacing, restoring, or regaining control of a determined to be bounding and conservative but system being protected from a fire with barriers cannot be used to provide useful results, fire was credited when determining adequacy of the computer codes (e.g.,

FPETOOL, CFAST, barriers if detailed fire procedures for the actions COMPBR) can be used if more detailed were available and if the likelihood was high for calculations are necessary to support a more successfulimplementation of these actions. Fixed realistic assessment of the fire hazard and predict fire suppression was required unless the fire protection system response. These computer combustible loading was low, fire detection was codes are based on plume correlations, ceiling jet available, and the area was continuously manned phenomena, and hot and cold layer development or sufficient time was available for manual and can predict the temperature of targets exposed suppression considering a propagation rate of the to fires, detector and suppression system fire. Except for two exemptions, most of the actuations, and smoke level and transport during justifications provided by licensees with the fires. Complex computer codes are used in other exemption request, and bases for granting them by areas of NRC regulations, e.g. for siruulating the staff were based on qualitative analysis and thermal-hydraulic, neutronic, and severe-accident engineeringjudgment.

transients

" Engineering tools" based on the principles of

2. Reliability Methods thermodynamics, fluid mechanics, heat transfer and combustion have now become more available Section III.J requires emergency lighting units NUREG-1521 6-2 March 1998

Applications ofRish-Informed. Performance-Based Methods with a minimum 8-hour battery-powered supply 6.1.2 Risk-Informed, Performance-Based for all areas needed for the operation of safe-Methods shutdown equipment. These supplies are tested for performance to verify the capability to supply The second general category of methods is those 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of battery power. Several National Fire that would support performance-based and more Protection Association (NFPA) standards risk-informed approaches, i.e, methods that will prescribe methods and intervals for automatic fire support implementation of less-prescriptive and smoke detector, and suppression system performance criteria, and that analyze or utilize (including fire extinguishers, hoses, and pumps) risk information.

maintenance and surveillance.

1.

Use of Risk Insights in a Qualitative Using the 50.59 change processes, a few plants Manner have modified their fire detector and suppression system maintenance and surveillance intervals,Section III.J requires emergency lighting units and emergency lighting testing program.

with a minimum 8-hour battery-powered supply Exemptions are not required for these changes.

for all areas needed for the operation of safe-shutdown equipment.

The main issue considered by licensees in making the modifications to their emergency lighting A total of 39 exemptions have been given to allow program was whether an adequate level and no lighting in certain plant areas typically inside duration of illumination with high reliability containment or in the yard; some exemptions (including consideration of availability and applied to indoor areas outside the containment.

operability) was provided. Maintenance and The key consideration used by the staff for surveillance schemes for protection fire detectors determining if the exemption should be granted and alarms have been modified and set at optimal was whether emergency lighting was provided for intervals based on consideration of reliability and the fire area with sufficient duration so that performance. Results of the surveillance program manual actions that may be required to be are then analyzed to demonstrate that an adequate performed in the area, based on emergency plans level of reliability and performance has been and procedures, can be completed within that achieved, and if necessary, the established time. Although qualitative concepts similar to maintenance and surveillance intervals are those in human recovery models used in adjusted.

probabilistic risk assessments (PRAs) were provided as justification for the exemptions, more Several reliability-based (based on operating data) rigorous PRA models, including modeling of methods are available now and are being used in human recovery actions, were not submitted with other areas of NRC requirements. For example, the exemption requests.

NRC requirements in Appendix J of 10 CFR Part 50 allow licensees an option to formulate a The results of PRAs and other individual plant performance-based program for containment examination for external events (IPEEE) analyses, leakage testing (NUREG-1493). Such approaches including human recovery modeling, and other can be used to determine an optimal and adequate more limited analysis (e.g., using the FIVE maintenance and surveillance test interval for fire method) are now available and can be used in a protection detection and suppression systems.

qualitative manner to provide risk insights Reliability methods can also be used to regarding the impact of alternate approaches. An demonstrate that testing 8-hour battery-powered example is the use of fire PRA results, including supplies for performance at less than full capacity human recovery modeling, to develop the basis for (e.g.,5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) indicates a high reliability for their the plant emergency lighting program in lieu of performance at full capacity (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />). Currently, prescriptive requirements (e.g.,8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />' duration there is no guidance or standard for the use of for all plant areas containing safe-shutdown reliability m:thods in nuclear power plant fire equipment). Risk-significant accident sequences protection pmgrams.

(e.g., for fire-induced station blackout) can be March 1998 6-3 NUREG-1521

Applications ofRisk-informed. Performance. Based Methods examined to determine the need for emergency requires the capability to reach cold shutdown lighting. In some cases, lighting may be required (with onsite power only) within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

for more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

A total of 53 exemptions have been given for

2. Risk-Graded Approach approved repairs of hot-shutdown equipment that range from simple low-voltage fuse pulling (to Section III.G requires that all structures, systems, prevent apurious operation) to more complex and components (SSCs) of one safe-shutdown actions that involve lifting leads and attaching train be protected from fires by the same jumpers to permit local operations, and for the use measures, regardless of the extent of vulnerability of nonstandard system alignments over a of those SSCs to a fire or impact on plant risk if protracted time (more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) to reach cold they are damaged.

shutdown.

A total of 780 exemptions have been given The staff considered that exemptions could be (Section III.G) by the staff for SSCs that have a granted if one division was available free of fire low vulnerability to fires, or other means for damage with allowance for only simple repairs, coping with the fires are available so that one for which tools, materials, procedures, and safe-shutdown train is protected from the effects staffing were controlled and readily available, and of fires commensurate with the risk associated that required a time period for reasonable with fire damage to those SSCs.

assurance of success that was much less than the time period in which the component or system Fire PRA and other methodologies have inherent being repaired for safe shutdown would be in them screening processes that can progressively needed. The use of nonstandard systems for distinguish between and identify high-and low-achieving cold shutdown over a protracted time risk fire areas. The screening methods employed staff permitted the only ifit was demonstrated to in fire PRAs, and other methods such as FIVE, have a reasonable chance of success. However, can be used toward formulating a risk-graded fire the decisionmaking process only included protection program by identifying and focusing on qualitative analysis and engineering judgment.

critical fire arets. Categories, or grades, can be established for currently identified fire areas in PRA operator recovery models and delta-CDF plants. A higher level of fire protection could calculations are now available and can be used to then be extended to fire areas that contribute supplement the information used to determine the significantly to plant fire risk. This approach adequacy of alternative approaches. Regulatory would be in contrast to prescriptive requirements guides currently being deve! aped for that specify that all SSCs of one shutdown train be implementing specific changes to a plant's l

protected from fires by the same measures, licensing basis allows the use of delta-CDF as an regardless of the extent of vulnerability of those indicator of the acceptability of implementing SSCs to a fire or impact on plant risk if they are specific changes. Fire PRA methods can be used damaged.

to calculate the change in core-damage frequency (delta-CDF) for alternative approaches to fire

3. Delta-CDF Calculations protection, including for evaluating the role of operators for recovery actions. These methods are Section III.G.I.a requires that the installed fire useful for evaluating the extent to which repairs protection features be capable of limiting fire are appropriate to maintain one train of systems to damage so that one train of systems necessary to achieve and maintain shutdown conditions, and achieve and maintain the hot-shutdown condition the use of non-standard systems for shutdown.

is free of fire damage.Section III.G.I.b requires The methods can also be used to evaluate and that systems necessary to achieve and maintain compare alternate means of providing fire cold-shutdown must be repairable within 72 protection (by combining separation, fire barriers, hours.Section III.L contains the requirements for and detection and suppression) to safe-shutdown an alternative and dedicated shutdown system and systems.

NUREG-1521 6-4 March 1998 l

l

Applications of Risk-Informed Performance-Based Methods 6.2 APPLICATIONS 6.2.1 Performance Based Analyses The following applications were conducted and 6.2.1.1 " Engineering Tools" for Evaluating are presented to illustrate the benefits of applying Fire Dynamics-Bounding Analysis of Combustible Fire Loads the methods that are now available and the subject of this technical u: view:

In many cases, configurations with low fire A. Performance-Based Analyses 1 adings (including transient combustibles) can be distmguished from high-nsk areas through the use

" Engineering Tools" for Evaluating Fire of" engineering tools" that represent fire dynamics Dynamics-Bounding Analyses of in a gross manner. The following is an illustration Combustible Fire Loads f how simple tools can sometimes be sufficient to predict the degree of threat from fires by Reliability Methods Producing credible and useful results. A cable spreading room in a nuclear power plant toured by Establishing Surveillance Intervals the authors is used as an example.

Based on Performance and Reliability The room is about 6.1 m (20 ft) x 6.1 m x 5.2 m Optimizing Test Duration for (17 ft) high. The upper half of the room is Appendix R Emergency cr wded with cable trays, each of which has an Lighting array of cables. A fire can only occur with a

" transient" fuel, such as spilled cleaning fluid.

Considerations for the Use of Portable Assuming a worst-case situation in which the Lights for Outdoor Activities liquid fuel poolis directly below the lowest cable tray, a plume correlation m FPETOOL (a Fire Computer Codes Based on Zone c mpilation of correlations for fire protection Models-Analysis of Safe Separation calculations discussed in Chapter 5) can be used Distance to estimate the temperature of the plume at the 3.1-m height of the tray for a series of fire sizes.

B. Risk-Informed. Performance-Based if it is assumed that the wire insulation will stan Analyses to degrade at 200 C, and the fuel would burn

)

long enough for the insulation to reach the plume

{

Use of Risk Insights in a Qualitative Manner temperamre, the corresponding fire size from the correlation is 400 KW. If the fuel is gasoline Evaluation of Need for Emergency (m st solvents used for cleaning have a Lighting sigmficantly lower burning rate than gasoline, e.g., methyl alcohol burns at 1/4 the rate of Event Tree Modeling and Delta-CDF g soline), one can use correlations developed for Quantifications hydrocarbon pool fires in ti.e SFFE Handbook of Fire Protection Engineering to determine that the Analysis of the 72-Hour Criterion To p I w uld be about 1.1 m (3.5 ft) in diameter and Reach Cold Shutdown the liquid surface would burn at about 4.5 mm/ minute (7.5 x 105 m/sec) (from Figures 3-Evaluation of Loss-of-Offsite-Power 11.2 and 3-11.3 in the SFPE Handbook). The l

Assumption for Alternative or v lume of the fuel can be determined from the Dedicated Shutdown Capability f Ilowing correlation for the maximum pool diameter (Equation 11 in the SFPE Handbook):

l These applications an presented as examples in the next few sections. Details of the analyses for D =2[V'g'/y ;us 2

l l

some of the applict.tions are presented in m

Appendix D.

where g' is the effective acceleration due to 2

gravity = 9.8 m/s, y = fuel burning rate (m/s).

March 1998 6-5 NUREG-1521

Applications of Risk-Infonned. Performance-Based Methods d

2 Solving for V, V= 1.9 x 10 m = 0.2 liter.

equipment and installations in the plant.

Specified surveillance intervals similar to those in However, this pool, about 2.5 mm thick, will only the relevant deterministic and prescriptive burn for about 4 seconds, which is insignificant National Fire Protection Association (NFPA) compared to the time that would be required to consen<,us guidelines or standards have been heat the lowest cable tray to near the plume endorsed by the NRC in the past. The Oconee temperature. This examines the importance of Technical Specifications were examined and the this fire scenario; others will also need to be surveillance requirements were compared with the evaluated. These bounding calculations can relevant NFPA standards as shown in Table 6.1.

provide useful information toward plant decisions in terms of the degree of fire protection necessary Optimizing surveillance intervals in nuclear power for different configurations and thermal loads.

plants on the basis of performance and reliability considerations is an important objective because The tools allow using sorae information of the potential for reducing occupational representing the fire dynamics of the problem, and exposure received during the surveillance, can be used to prevent overemphasis (or especially within the reactor building, where underemphasis) that can occur when such inspections involve donning protective clothing, considerations are omitted and the hazard from all dosimetry, and decontamination of detectors that fire areas regardless of the fire source are equally are removed for inspection.

treated.

The impact of surveillance frequency on the Based on this type of analysis, plant procedures performance (reliability) of standby components need not control transient fuel below a cenain has beer-the subject of many reliability analyses volume for which it can be determined that the (NUREG/CR-5775). In a performance-based hazard is negligible. For such purposes, it will be testing approach, surveillance intervals are set necessary to determine that the correlations used based on performance and equipment reliability.

are valid for the specific application, and that If formal reliability methods are used, engineering results obtained are bounding for the spectrum of information is needed regarding the types and the fuel spills possible and the hazard from the spill.

extent of the faults detec:able by the surveillance Currently, a compilation of such tools for activities (surveillance effectiveness), and the apphcations in nuclear power plants does not probabilities or the failure rates associated with exist. Although a broad spectrum of applications the occurrence of such faults.

has not been explored in this study, it is judged that a sufficient number of applications are Applications in three areas are presented below:

passible and an effort to compile these will be (1) Methods ranging from simple analysis of useful by providing licensees additional flexibility performance data to using reliability models to in maintaining their fire protection programs.

optimia test and inspection intervals for fire and gas detectors, and fire valves and extinguishers; 6.2.1.2 Reliability Methods (2) A reliability approach for determining the optimal duration for Appendix R emergency This section presents the application of reliability lighting tests, and (3) Reliability considerations methods (feedback of basic performance for the use of ponable lights for outdoor activities.

experience or formal modeling) for determining surveillance and testing schemes for equipment 6.2.1.2.1 Establishing Surveillance Intervals and components in a nuclear power plant fire on the Basis of Performance and protection program. The NRC requires that each Reliability licensee :pecify in the plant's technical specifications or fire protection program the The authors visited Catawba, the newest Duke sury.:illance schedules for fire protection Power Company (DPC) plant, to investigate l

l NUREG-1521 6-6 March 1998

Applications ofRish-Infonned. Performance-Based Methods Table 6.1 Comparisons of Fire Protection Equipment Surveillance Surveillance Tech Specs NFPA Code Fire pumps,6000 gpm each NFPA 25 Functional test of pump Monthly Weekly Check proper valve alignment Monthly Weekly Verify flow >3000 gpm Annually Annually Complete system flow test 1-3 years Annually Sprinkler and spray system NFPA 13 Functional test Annually Annually (some valves)

Inspect spray area (no obstruction)

Refueling Monthly inspect spray header nozzles Annually Annually Fire hose stations NFPA 2S and 1%2 Visual inspection Monthly Monthly Remove and re-rack hose Annually Annually Check valve 1-3 years Hydrostatic test 1-3 years 1-3 years Visual inspection (reactor bldg.)

Refueling Annually Detectors NFPA 72 Test operability Semiannually, some parts Annually quarterly or semiannually Carbon dioxide systems NFPA 12 Check each valve Monthly Mfg. recommendation Check CO tank weight Semiannually Semiannually 2

Verify operation Refueling Annually Flow test (no blockage)

Refueling Annually initiatives being pursued there to optimize and Among several other initiatives, DPC examined improve the fire protection program. Although optimizing the surveillance interval for valves in there are some case-specific Appendix R fire protection systems.

At

Catawba, 1

requirements, the plant is considered to be a approximately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> a month (for both units)

Standard Review Plan plant for the purposes of are spent confirming fire protection system valve fire protection regulations. Since the fire positions. About 400 valve sites are inspected.

protection requirements were moved out of the The valves are locked and under operations key Technical Specifications into the Final Safety control. In 3 years, none of these valves have Analysis Repon (FSAR), most of the been found in the wrong position. Using the safety programmatic changes can be implemented with evaluation process, DPC has proposed increasing the 50.59 safety evaluation process. However, the the surveillance interval on the basis of past operating license requires that the Catawba fire experience. The inspection interval would change protection program be maintained as stated in the to quarterly, semiannually, and (f' ally) to m

Safety Evaluation Report (SER). Specific fire annually if the plant maintains a more than protection commitments that are cited in the SER 99 percent success rate. A similar approach was or as license conditions can require the license pursued for determining surveillance intervals for amendment process to implement a change.

fire extinguishers and other fire protection March 1998 6-7 NUREG-1521

i Applications of Risk Informed. Performance-Based Methods

\\

components. It is noted that although such by the reliability model developed for this study.

initiatives were pursued by DPC, these type of In the second step, the effectiveness of varioua initiatives are not typical in U.S. nuclear power test strategies m detecting the failures in terms of riants because of the lack of guidance and a probability of detection was determined. This is standard for implementing such performance-an important step because not every failure mode based approaches. These performance-based can be detected with one type of test. Thh is a applications can be used as a model for deviation from standard reliability models, which developing regulatory guidance.

assume a specific test is pc fect (detects all types of failure).

Finally, the parameters of the The use of reliability engineering models reliability models (including the uncertainties) supported by actual failure data for evaluating were estimated through statistical techniques.

appropriate test intervals for fire detectors has These parameters then were used in the reliability also been considered in a domestic nuclear power model for optimization of the test strategy.

plant. A study reponed for Nine Mile Point Nuclear Station Unit 2 (NMP2)is an example of The study concluded that the functional test such an activity (Bruce,1995). Fire and gas interval extended from quanerly to annually detectors in safety-related areas must be tested provides better reliability performance at a lesser periodically to detect dormant failures, that is, to cost if it is supplemented by daily self-verification check that they will respond if there is an actual and quarterly inspection. The imponance of demand. Currently, these detectors are sometimes expert judgment in the analysis, which was quite tested as frequently as every 3 months in most informal in this application, was noted. This plants (e.g., see Table 6.1). Records over a period study presents one approach for surveillance of five years of fire detector testing were utilized optimization using reliability performance to establish plant-specific fire detector failure analyses techniques. Such techniques and rates.

Three types of detectors were evaluations can be applied in a variety of considered-ionization, heat, and photoelectric situations in fire protection areas (e.g.,

detectors. The surveillance records covered 3 suppression surveillance) years of semi-annual test intervals, followed by 2 years of annual test intervals. An alternative An important note on the methods used for testing methodology was proposed and establishing surveillance intervals based on implemented by the utility based on a 10-percent performance and reliability is that they do not rotating sampling at the annual test interval, with involve the uncenainties normally associated with provisions for expanded sample population upon fire models and risk assessment, and therefore are discovering one or more detector failures. Again, subject to less limitations. Performance-based this type of initiative is not typically found in U.S.

methods have been succestrally demonstrated for nuclear power plants because of the lack of the testing of containment systems, isolation guidance and a standard for implementing such valves, and penetrations, and there is very little performance-based approaches.

difference between the performance-based analysis methods for such testing programs A study (Hokstad et al.,1995) published in compared to those that could be used for fire Reliability Engineering and System Safety by protection systems (e.g., fire valves, pumps, and SINTEF (Stiftelsen for Industriell og Teknisk detectors). Similar benefits for optimizing the Forskning), uses a detailed reliability model for testing program by fxusing on those components optimizing the test schemes for fire and gas that exhibit poor performance can be derived for detectors in a nuclear power plant. The study performance-based testing programs for fire was performed in three steps. In the first step, the protection systems.

detector failures were classified into random, test-generated, and test-independent faults.

The selection for this type of classification was driven NUREG-1521 6-8 March 1998

Applications ofRisk-informed. Perfonnance-Based Methcds 6.2.1.2.2 Optimizing Test Duration for 8-hour endurance test, we have to declare Appendix R Emergency Lighting them inoperable, and do a prompt repair.

We calculate that we spend about 30 Section J of Appendix R to 10 CFR Part 50 work days a year repairing these lights.,

requires that emergency lighting ur.its with an 8-hour battery supply be provided "in all areas The following analyses examines the benefit of needed for the operation of safe shutdown using reliability modeling to investigate the equipment and in the access and egress routes impact of decreasing the emergency lighting test thereto." The intent of this requirement is to doration from 8 to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> on the probability of allow safe evacuation and the fire fighting failure of emergency lights when demanded.

activities required to extinguish a fire in an area, and to facilitate operator actions in indoor and A variety of battery-operated emergency lighting outdoor locations if normal and ernergency plant units are available for use in nuclear power plants.

lighting are not available after a fire. The Depending on the battery type used in these units prescriptive requirement for an 8-hour duration of and the quality of the charger, they typically last lighting was based on conservative engineering from 10 to 20 years. Certain types of the batteries, judgment and was reasonable given the state of such as lead-calcium batteries, will have a much the art for fire assessments and probabilistic risk shorter lifetime if they are frequently discharged.

assessments when Appendix R was instituted.

The batteries usually are designed with about a Since that time, licensee experience with the 8 25-percent safety margin; that is, an 8-hour-rated hour battery requirement, both indoors and battery, when equalized and new, may have a outdoors, has prompted its reexamination.

discharge time of up to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. However, when the battery has experienced a full discharge, the Experience with this requirement is summarized rated capacity will drop proportionally to the as follows: Appendix R emergency lights are number of discharges for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or some other tested annually for full 8-hour rating. Many of interval. The potential for using risk information these lights (about 30 to 50 percent) typically fail to determine emergency lighting needs for during the test after 6 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The dominant important event scenarios is presented in Section 6.2.2.1.

failure mechanism is reported to be the depletion of the battery. The fraction of failures and, The rated durations of all types of batteries are a therefore, the cost for replacement and testing can str ng function of temperature (Institute of be significantly reduced if the duration of the test Electrical and Electromes Engineers, IEEE 446).

is reduced from 8 to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

There is a vast amount of information on the effect of severe temperature on battery rating The following is a quote from NUREG/CP-0129:

(American National Standards Institute (ANSI)/IEEE 450-1987 and ANSI /IEEE 485-At the Catawba nuclear station, where we 1983). Table 6.2, reproduced from ANSI /IEEE have a two-unit plant, we have a total of 485-1983, presents data showing the effect of 50 emergency lights for the fire temperature on battery capacity rating.

protection safe shutdown program. We purchased them with 8-hour illumination On the basis of the 40-percent failure reponed for rating, test them once a year per atada and th pmMng dscussion, th procedure, and what we fm' d is that about pr bability of battery failure as a function of 60 percent of them consistently fail this discharge duration is postulated to be represented annual test.* The 60 percent that fail by a normal distribution with a mean equal to the normally last 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />,7 hours, or even rated capacity **, and a standard deviation of 0.25 longer. But because they don't meet the

• • For a new ba:tery with no discharge, a safety

• Catawba has recently reexamined this failure rate.

margin of 10 percent on rated capacity is assumed, On the basis of newer information. Catawba now e.g., an 8-hour rating can last up to 8.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when estimates an ~40-percent failure rate.

the battery is new, March 1998 6-9 NUREG-1521

Applications ofRisbinformed. Perforr.:nce-Based Methods Table 6.2 Effect o" Temperature on Battery Capacity Rating

• Electrolyte Temperature Rating Electrolyte Temperature Rating i

Factor Factor

,p Mn.itiplier Multiplier 25

-3.9 1.52 80 26.7 0.98 30

- 1.1 1.43 85 29.4 0.96 35 1.7 1.35 90 32.2 0.94 40 4.4 1.30 95 35.0 0.93 45 7.2 1.25 100 37.8 0.91 50 10.0 1.19 105 40.6 0.89 55 12.8 1.15 110 43.3 0.88 60 15.6 1.11 115 46.1 0.87 65 18.3 1.08 120 48.9 0.86 70 21.1 1.04 125 51.7 0.85 77 25.0 1.00

• Source: ANS/IEEE 485-1983. Reproduced by permission of author.

(1) Correction factors were developed from manufacturers' published data.

(2) This table is applicable regardless of the capacity rating factor used and applies to all discharge rates.

multiplied by the rated capacity. As a battery fo derating as a result of each full

=

experiences a number of discharges, the rated discharge (0.05) duration decreases (typically 5 percent per discharge). With this information, the reliability f, (0) = one over the rating factor multiplier as a of emergency lights to operate for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when function of temperature 0 (from Table t

tested for 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> can be estimated. This estimate 6.2) can be compared with that of the 8-hour endurance test.

S safety margin (~0.25)

=

The rating of battery pack emergency lights is described below by a normal distribution with a The probability of failure of an emergency light mean r, and variance o defined:

demanded for D hours as a result of battery depletion then can be calculated from the

[r(1-n f H U,(0))

(6-1) cumulative normal probability; that is, r,

=

oo (S) (r.)

(6-2)

P (D) = N (D: r., c).

o

=

where In addition to the battery failures, an emergency light may fail intermittently, regardless of its manufacturer's rating plus 10 percent capacity. The intermittent battery failure rate is r

=

(e.g.,8.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for 8-hour rated) reported to be about 3.4E-2 per demand (Bento et al.,1985).

number of full discharges no

=

NUREG 1521 6-10 March 1998

Application ofRisk-informed Performance-BasedMethods The probability of failure of an emergency light as Figure 6.1 shows the failure probability (or a result of causes unrelated to battery depletion fraction of emergency lights failing during a test),

may be estimated from:

calculated using the above equations, as a function of years after installation for the P = % AT= P (6-3) f H wing cases: 8-hour rated,8-hour tested (8-R, L

d 8-T) and 8-hour rated, 5-hour tested (8-R, 5-T) at average temperatures of 77 *F (298 K) and 50 F where (283 K). The fraction oflights expected to fail during an 8-hour test at 77'F (298 ls) is about 40 A = random failure rate per year (6.8E-2) percent, which is consistent with Catawba's experience discussed above. The fraction oflights T = test interval (1 year) expected to fail during a 5-hour test at 77 *F is about 15 Prediction. percent on the basis of the model Pa = equivalent demand probability (3.4E-2 from earlier discussion)

As discussed in Chapter 7, for a unit with about 50 battery-operated emergency lights, 5-hour The preceding equations can be used for testing rather than 8-hour testing will result in calculating the probabihty of an emergency saving about 12 replacements a year. Figure 6.2 lighting failure (P); that is, P = P + Pa (D).

shows the probability of failure upon demand for t

the following cases: 8-hour rated, 8-hour tested, In Equation 6-1, n stands for the number of full and 8-hour rat:d,5-hour tested for an 8-hour and o

discharges. If the endurance test is performed for 6-hour demand at a temperature of 77'F. These a duration less than 0.75 rated value, it is not curves show that the reliability performance of the considered as a full discharge. When battery-two alternatives are comparable or equivalent operated emergency lights are installed, they are (maximum difference in reliability is less than 10 considered to be new (n, = 0). As the lights are percent),

tested annually, some would fail and would subsequently be replaced. After several years, the Finally, Figure 6.3 shows a comparison similar to population of the emergency lights m a given fire that in Figure 6.2, bet at an average temperature area will have different ages (i.e., n in Equation of 50 F (283 K). Here, the test duration becomes a

6-1 and t m Equation 6-4 will depend on the last mportant for a 6-bour demand, and the replacement). A detailed reliabihty model was temperature of the environment becomes an developed to estimate the fraction of the lights important factor.

with different age as a function of time from installation. This reliability model accounts for A formal uncertainty evalustion was conducted the probability of an emergency light failing at a for the preceding analyses to illustrate the given age and bem, g replaced. The model availability of techniques to assess the exhaustively calculates all possible combinations.

uncertainties in such reliability methods. This

<>8 M.8 T W r7F H> &R.5-T a 77F

• 8 R.8-T

• 50F

-C> 84.5 T W 50F 1D 0.9 0.8 E

0.7 b

0.6 l

0 os O

0.4, 3

0.3 l Ol'-

+

1

=

e

?

l o

e i

i O

1 2

3 4

5 NUteER OF YEARS IN TESTING Figure 6.1 l

Annual Test Failure Probability for Battery Operated Emergency Lights l

March 1998 6-11 NUREG-1521

Application ofRisk-Informed Performance-BasedMethods

+ 8-R.a TAD

• 0-RATAO

+ s-R ATAD

<> &R.5-T.6 0 1.0 09

, 08 i

0A G **

80.3 i

OJ:

0 0

01 l

0 8

2 3

4 6

NUMBER OF YEARS IN TESTING Figure 6.2 Demand Failure Probability for Battery-Operated Emergency Lights (77'F) e >RATAD

• FRATAD M RATA 0

+ C-RATAD 10 09 h 0.8 h0F 5**

_Al l*

t j 0.3 03

+

~

0.9 ;r 0

1 2

3' 4

5 NUWBER OF YEARS IN 1ESTING Figure 6.3 Demand Failure Probability for Battery-Operated Emergency Lights (50 *F) evaluation is presented in Appendix D.

discharge were made. Although this analyses Hypothetical distributions for the basic estimates that decreasing the test duration from 8 parameters were used in this evaluation due to the to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> has about a 10 percent impact on lack of resources to collect data from the plant reliability and a sensitivity of this reliability and manufacturer; however, such assumptions do impac! to temperature, this analysis and result not affect the illustration of the techn: ques which should be considered an illustration. In order to is the purpose of this report.

determine the real impact and extent of sensitivities, it will be necessary to collect plant The above analyses illustrates the type of data to test and verify the assumptions made in reliability techniques that may be employed, and this analysis.

the data necessary for providing additional insights when considering modifications to test 6.2.1.2.3 Considentions for the Use of Portable schemes based on performance, such as that for Lights for Outdoor Actisities emergency lights. Due to the limited scope and objective of the analysis presented, some This section does not present an analysis but i

assumptions regarding the distribution of the highlights some considerations for developing a probability of battery failure as a function of reliability model for the use of portable lights for discharge duration and the rated value below outdoor areas. Section 6.2.2.1 provides methods which the test may not be considered a full for determining the need for outdoor lights.

March 1998 6-12 NUREG-1521

}

Applications ofRisk-Informed. Performance BasedMethods Appendix R requires outdoor emergency lighting this requirement, including one that allows for to facilitate human actions that are required for separation of cables, equipment, and associated safe shutdown. A large number of outdoor lights non-safety circuits of redundant safe-shutdown may be required to get the proper level of trains by a horizontal distance of more than 6.1 m illumination necessary for cenain actions. The (20 ft) with no intervening combustible materials reliability and survivability of outdoor lights, or fire hazards. In addition, fire detectors and an especially in cold winter weather, are automatic suppression system must be installed.

questionable. Experience indicates that portable Analyses were conducted to determine results lights, maintained indoors, are a more reliable from the following three fire models for option than outdoor, fixed, battery-pack lights.

developing insights regarding the 20-ft safe-Furthennore, some of the human actions that may separation requirement: (1) FIVE-a compilation require the operator to go outdoors may not start of fire correlations in worksheets for use in until 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the fire damage has occurred screening fire areas; (2) COMPBRN IIIe-a fire and, depending on the scenario, may last beyond computer code developed for fast computations 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The use of portable lights on an as-for use in fire PRAs; and (3) CFAST-a fire needed basis will prolong the availability of computer code developed mainly for use in l

emergency lights.

modeling fires in buildings. These methods were described earlier in Chapter 4 and Chapter 5. The l

Relief from this requirement has been requested following is a summary of the study. Details of by utilities through submittal of exemption the analyses are included in Appendix D.

requests. These exemption requests were briefly discussed in Chapter 3 of this report. For example, A representative PWR emergency switchgear the Trojan Nuclear Power Plant submitted an room (ESGR) was used for the study. The room exemption request to use portable, emergency is 15.2 m (50 ft) x 9.1 m (30 ft) x 4.6 m (15 ft) battery-lighting units as an alternative to high. The room contains the power and permanent emergency battery-lighting units in instrumentation cables for the pumps and valves selected outdoor locations. Severe winter weather associated with motor-driven auxiliary feedwater was given as one justification for not using perma-trains, all three high-pressure injection trains, and nently installed battery-operated emergency lights both low-pressure injection trains. A simplified in outdoor areas.

elevation of the ESGR room, illustrating critical cable locations, is shown in Figure 6.4. The power A comprehensive review of available reliability and instrumentation cables associated with safe-databases indicates similar reliability for portable shutdown equipment are arranged in separate lights and fixed lights, as long as they are divisions and are separated horizontally by a maintained indoors, auwcharged, and under strict distance, D. The value of D is varied in this administrative control. The selection of one over evaluation. The analysis was conducted for the other is not based on reliability, but mainly on different elevations of Tray B so that it was either the type of the task and activity to be performed.'

in the ceiling jet sublayer or in the hot gas layer The potential need for additional personnel for for different cases.

holding and directing the light beam while a task is being performed is a consideration in The postulated ignition source is either a self-determining the effectiveness of portable lights.

ignited cable (as a result of a fault) or cable ignition as a result of a transient fire. Cable Tray 6.2.1.3 Fire Models and Computer Codes A is considered to be the source. Although, most Based on Zone Models-Analysis of rooms will be isolated by the automatic closing of Safe Separation Distance fire dampers and the shutdown of the ventilation system, an opening 2 m (6.5 ft) high x 0.2 m (0.7 NRC fire protection regulations require that one ft) wide was assumed to prevent pressure buildup train of systems necessay to achieve and maintain in the room and facilitate the use of the hot-shutdown conditions be free of fire damage.

COMPBRN and CFAST codes.

The regulation provides three options for meeting March 1998 6-13 NUREG-1521

Applications ofRisk-informed. Performance. Based Methods I

l lB l

l C1 3 FT I

I c2 6.5 R 3.5 FT l

I l

A l

o D (-20 FT) 7.5 FT n

Figure 6.4 Illustration of Critical Cable Locations in the Representative Emergency Switchgear Room The ESGR contains smoke detectors and a ceiling jet layer (see Table 6.3). The FIVE manually actuated Halon system. Assuming a screening method does not differentiate between performance criterion of I hour as the duration in the various separation distances in the hot gas which redundant trains should not be damaged, layer and only conservatively estimates, based an and considering the fire initiating frequency and adiabatic heating of the gas, the total energy suppression (including fire brigade) probability, it release needed to raise the average hot gas layer can be estimated that the resulting core-damage temperature to the threshold damage temperature, frequency (CDF) for this scenario will be 1.2E-5 In the present case, the total energy needed is per reactor-year. This damage frequency is used about 286 MJ, which is much less than 3150 MJ as a criterion to determine the adequacy of the corresponding to the energy released from a 3.5 safe separation distance.

MW fire during a 15-minute period. Therefore, none of the cases pass the screening criteria if the The FIVE method predicts that an effective fire target is the hot layer.

source intensity of about 6.5 MW is required to damage cables that are separated by 20 ft, and 3.5 MW if separated by 10 ft, for cables that are in the NUReG-1521 6-14 March 1998

Applications of Risk-informed. Performance-Based Methods Table 6.3 Summary Results From FIVE Analyses Effective Fire Ceiling Jet Target Damage Separation Intensity Temperature Temperature Distance kW K

K ft 3300 526 643 20 6500 643 643 20 7000 660 643 20 3500 660 643 10 6500 843 643 10 7000 871 643 10 The COMPBRN analyses predict (see Table 6.4)

In order to understand the reason for the that the effective fire intensity, capable of difference in the predictions of the CFAST and damaging iedundant cables separated by 6.1 m (20 COMPBRN codes, the availability of oxygen to ft), is about 4 MW for the representative support the burning rates predicted by configuration, and that damage occurs in about 12 COMPBRN (see Figure 6.5) was examined. The minutes. The COMPBRN code also predicts that CFAST code is capable of calculating the a cluster of two cable trays in one side of the room concentration of various species of air and (Case 5 listed in Table 6.4) will result in a peak combustible products in the hot layer region, burning rate of about 1.8 MW, which is not whereas COMPBRN does have a similar sufficient to damage cable trays separated by 20 capability. Using burning rates predicted by ft. The heat release rate predicted by COMPBRN COMPBRN, CFAST predicts that, at about 5 for Case 2 is given in Figure 6.5.

minutes, the hot gas layer descends to the level of the lowest burning tray and the concentration of A modified version of the CFAST code, which oxygen in the hot layer is below 10 percent accounts for radiation heat transfer to a target, was (ordinary air is 21 percent). Therefore, the heat utilized for this evaluation. The CFAST code release rate will not increase after 5 minutes l

requires input of the heat-release rate for the fire because of oxygen depletion and the fire would source. Values of 1 MW,2 MW, and 3 MW with eventually be extinguished when insufficient a linear growth taking 1, 2, and 3 minutes, oxygen is available to support combustion.

respectively, for the heat release rate were used Accordingly, the peak heat-release rate for this for three cases. The hot layer temperature, the specific case will be below 2 MW and the heat-radiative and convective heat transfer calculated release rate predicted by COMPBRN after 5 by CFAST, was used in a transient conduction minutes is overly conservative.

model for a thin slab to estimate the target surface temperature. Figures 6.6,6.7, and 6.8 show the Figure 6.9 shows a compar son of the results from hot layer and cable surface temperatures for a 1, the CFAST and COMPBRN codes for Case 2 (see 2, and 3-MW fire as a function of time.

Table 6.4 for case conditions). In this case, the Considering the critical damage temperature of heat-release rate due to fire predicted by 643 K and the extrapolation of the result shown in COMPBRN (Figure 6.5) is provided as input to Figures 6.6,6.7, and 6.8, a fire of more than 3 the CFAST code for the comparison analysis.

MW is required to damage the target cables at a 20-ft separation in less than I hour, and a fire less After the COMPBRN-predicted ignition of Tray than 2 MW will not damage redundant cables C2 at 5 minutes and Tray B (the target tray) at 10 separated by less than 6.1 m (20 ft).

minutes, Figure 6.9 shows that the hot gas layer March 1998 6-15 NUREG-1521 l

\\

(

l l

___________..__________-_____o

Applications ofRisk-Informed. Performance-Based Methods Table 6.4 Summary of COMPBRN Results Case 1 Case 2 Case 3 Case 4 Case 5

- (Base Case)

Tny D

I D

I D

I D

I D

I

1. Damaged (D) and Ignition (I) Time (minutes)

A 0

0 0

0 0

0 0

0 0

0 (Source)

C2 2

2 2

3 2

2 2

2 2

2 Cl 4

4 5

5 4

4 4

4 B

8 9

9 10 12 No 8

9 No No (Target)

II. Total Heat Release Rate at the Time of Target Damage Q, MW 4.8 4.0 8.2 4.7 1.8

• III. Description of Cases

. Pilot fire size (ft x 4x2 2x2 4x2 4x2 4x2 ft)

Door Open Open Closed Open Open Trays above pilot C1 and C2 C1 and C2 C1 and C2 C1 and C2 C2 only fire Target elevation 4.27 4.27 4.27 2.29 4.27 (m)

• Maximum heat-release rate with no danage to target cables.

NUREG-1521 6-16 March 1998 4

Applications ofRish-Informed. Performance-Based Methods 1

PWR ESGR 20 FT SEPARATION STUDf COMPBRN AND CFAST COMPARISON - CASE 2

~

k5 w

5 E*g E

5 R g ge f

f f

f f

0.0 2.0 4D 6.0 8.0 10.0 12.0 14.0 164 TIME (rmn)

Figure 6.5 COMPERN Predicted Heat Release From Burning Cables

-> HOT LAYERTEMPERATURE

-a-TARGET TEMPERATURE 550 20

@ 450 3

4 erw g 400 350 i

l I

f f

f f

f g

l 0

500 1000 1500 2000 2500 3000 3500 TIME (sec) i 1

Figure 6.6 l

.1 MW Fire Source Target and Hot Layer Temperature 1

Mach 1998 6-17 NUREG-1521

Applications ofRisk-Infonned. Performance-Based Methods

-e-HOT LAYER TEMPERATURE TARGET TEMPERATURE 650

____--==r

- E l.2 U 550 g

w C

500 ay 450 2w H

400 350 300d O

500 1000 1500 2000 2500 3000 3500 TIME (sec)

Figure 6.7 2-MW Fire Source Target and Ilot Layer Temperature

-e-HOT LAYER TEMPERATURE.

• TARGET TEMPERATURE 700 I=

650

_ _ _,,, p 600 E_y 550

?

\\

l e

SN E

l 2

450 l

N 400 350 300 L O

500 1000 1500 2000 2500 3000 3500 TIME (sec)

Figure 6.8 3-MW Fire Source Target and liot Layer Temperature NUREG-1521 6-18 March 1998 l

i l

Applications ofRisk-Informed. Performance-Based Methods PWR ESGR 2477 SDMADON 87UD(

ccesRuecrasicowussou. cast o

R cowsRu i

.=

crAsv E

h

~

e I

/

\\

l I'

/

\\

p ss g

/

i CD 2D 40 6D 6D 10.0 12D 14D 16D TIME 9 tun)

Figure 6.9 Comparison of Ilot Gas Layer Temperature temperature predicted by COMPBRN is much corresponds to a maximum cluster of three cable higher than that predicted by CFAST. This may trays.

be due to the conservative assumptions regarding heat losses from the hot layer in the COMPBRN The preceding paragraph illustrates the type of code, however, the reason for this large difference insights that 'may be drawn regarding the nature of in hot layer temperature was not examined further.

configurations that are more vulnerable to fire hazards, and the parameters important for such a On the basis of the preceding results, it is determination. An analysis of the validity and concluded that if the maximum cluster of source accuracy of the results is not presented here.

cables results in a heat-release rate less than about Chapter 5 and Appendix C contain some 2 MW, then redundant cables will not be comparisons of the results from computer codes damaged, even if they are separated by less than used here, COMPBRN and CFAST, with 20 ft (e.g.,15 ft). The dominant factor for all the experimental data. Judgments on the results of fire models for predicting damage to cables that the analyses for a specific problem should be are separated by 20 ft is the effective intensity of made once the validity and accuracy of the models the fire source, not the total combustible loading for that application are considered.

in the fire area.

6.2.2 Risk Informed, Performance-Based The preceding study illustrates the capability of Analyses these fire computer codes to evaluate alternative approaches to the 20-ft separation criteria, 6.2.2.1 Use of Risk Insi hts in a Qualitative h

although at different levels of resolution. The Manner-Evaluating Need for FIVE method is formulated for screening Emergency Lighting purposes, and it does not have sufficient resolution to address the problem in this The failure of battery-operated emergency lights evaluation ifit is assumed the target is in the hot when no sources of lighting are available may layer. Both COMPBRN and CFAST estimate that affect the following plant activities:

a fire of about 1.8 MW or less will not damage redundant cables with 20-ft separation. This fire fighting activities March 1998 6-19 NUREG-1521

Application of Risk Informed. Performance-Based Methods

+ local operator actions Outdoor Lighting

• repair and recovery actions needed to be There is not as much redundancy for outdoor performed during various scenarios. The design lighting as there is for indoor lighting. Usually and operation of the lighting system vary from available are lights fed from offsite power, plant to plant, but the following description Appendix R 8-hour lights, portable lantems, and provides a general overview.

security lights.

Indoor Lighting

"*#E*"#I There is a normal lighting system fed through the onsite distribution system from the offsite power From a safety perspective, emergency lights are grid. There is also an emergency power source used for two types of activities:

for the lighting system for all fire areas containing safe-shutdown equipment that is fed from Firefighting. Electric power can be lost to :he emergency diesel generators in case offsite power area that is on fire, thus jeopardizing fire fighting is lost. The control room typically has additional activities. In addition, smoke from the fire can emergency lighting powered by the station's de obscure visibility, thus posing further difficulties system.

in performing these activities. The function of the emergency lights is to increase the visibility in Because a fire could damage normal and both of these circumstances Table 6.5 based on emergency lighting for any area of the plant, the data in the Oconee PRA (Sugnet et al.,1984) battery-powered portable lights also are available assumes that most fires were extinguished within to facilitate access to and egress from the control I hour after they were discovered. Therefore, room, emergency switchgear rooms, diesel emergency lighting with a duration of more than generator rooms, and other areas.

I hour would be sufficient for this aspect of fire safety.

In accordance with the requirements of Appendix R, there is a post-fire emergency lighting system Repair of equipment, for safe shutdown.

for illuminating all areas needed for operation and Emergency lights will provide sufficient illumination for a minimum of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to enable for monitoring of safe-shutdown equipment, and to ensure access and egress routes thereto. It an Perator to reach the safe-shutdown equipment consists of self-contained 6-V or 12-V batteries and carry out the required functions or repairs. At and static charger units located in the area served.

m st plants, the redundant shutdown train is This post-fire emergency lighting system will I cated in a separate area and the lighting will not provide sufficient illumination for a minimum of be affected by the fire (even in case of a loss of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to enable an operator to reach the safe-ffsite power (LOSP) coincident with a fire, the shutdown equipment and carry out the required lighting in redundant areas is fed by onsite functions.

emergency power). Certain fire scenarios may affect the lighting in both areas; however, this Table 6.5 Mean Fire-Suppression Time Mean Fire-Suppression Time Cumulative (min)

Probability Probability 5

0.10 0.10 15 0.40 0.50 30 0.40 0.90 60 0 10 1 00 NUREG-1521 6-20 March 1998

Applications ofRisk informed. Performance-Based Methods would be limited to a plant-specific vulnerability.

and SBO scenarios, where other sources of in most plants, the most likely scenario for loss of lighting are unavailable. Outdoor lights are needed emergency lights would be a station considered for both the SBO and LOSP scenarios.

blackout (SBO) scenario induced by fire in such Indoor lights are considered for the SBO scenario.

areas as the switchgear room, since alternative Lack of illumination during these scenarios will sources of lighting would not be available.

prevent any recovery or repair or local manual actions.

Outdoor Emergency Lights Outdoor lights are normally fed from offsite If credit for all recovery and manual actions sources (usually a switchyard), and would not be (event names starting with RA, OP, and OE) is rem ved in an extended SBO scenario in the available in a LOSP transient. Hence, the I I ^"7 O *'

)' ' * #* 8" availability of emergency lights independent of will ccur. However, removing credit for all offsite power for outdoor areas, either in the form of ponable lanterns or permanently fixed lights, is recovery and manual actions in an extended LOSP scenari in the LaSalle PRA will not result in core important.

damage, unless two additional random failures The following is an example of how insights from ccur. Wrefom, the rnost stringent requirements risk analyses may be used in a qualitative manner.

f r emergency lights will stem from the SBO scenano.

The LaSalle Unit 2 PRA (NUREG/CR-4832, Vol.

1), directed under the Risk Methods Integration Since SBO (both internal and fire-induced) is the and Evaluation Program (RMIEP), is one of the most comprehensive PRAs conducted to date. In m j r c ntributor to the L.aSalle CDF, the n cessity f emergency lighting is warranted for particular, it contains a detailed fire risk assessment (NUREG/CR-4832, Vol. 9), which can areas that are affected by a fire or where operator be used to develop risk insights about this ctions will be required to recover from this Appendix R requirement. LaSalle Unit 2 was accident sequence. Various operator and manual selected for this example. The LaSalle PRA ctions are required, depending on the scenario of contained four analyses: intemal, fire, flood, and events. In the first 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, when plant de power seismic. The total mean core-damage frequency is n t depleted in an SBO scenario, operator (CDF) from all events reported in the PRA is crions will take place m the control room (or 1.01E-4 per reactor-year. Table 6.6 shows the rem te shutdown panel); potentially in the reactor relative contributions of accident sequences from core isolation cooling room if diesel generator the four analyses to the mean integrated CDF. It (DG)"2A" fails quickly as a result of DG cooling shows that, together, the internal and fire w tedaHum; in the switchyard to recover offsite I

contributions are 95 percent of the total CDF.

p wer; and in the emergency diesel generator l

room and the emergency switchgear room, to The greatest risk from the failure of the battery-recover onsite power. After 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (when operated emergency lighting (both indoor and ernergency de power is depleted), and up to about outdoor) is incurred during fire-induced LOSP 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> when containment integrity may be Table 6.6 Percentage of Total Core-Damage Frequency 1

Contributor Percent Fire 49 Internal 46 Flood 5

Seismic 0

March 1998 6-21 NUREG-1521

Application ofRisk-informed. Performance-Based Methods challenged, the reew.ery actions for offsite and alternatives that included the use of non-standard onsite power are also questioned in the PRA. The systems and repairs, and would require more than need (in terms of duration) for emergency lighting 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to reach cold shutdown, would provide can be determined from this risk-significant an equivalent level of safety. These requests for accident sequence.

exemptions were based on qualitative analysis and engineeringjudgment and have been accepted by The requirement for the duration of emergency the NRC (Chapter 6). Since the early 1980s, new lighting is a plant-and area-specific issue. Risk methods for fire PRAs have become available and insights regarding this issue can be drawn from a can be used to quantify, through delta-CDF plant-specific fire PRA to determine the time calculations, the impact of using alternative available for various manual and recovery actions methods for achieving the higher level safety on a fire-area-specific basis. Generally, the most objective. The following illustrates this method.

stringent demand for emergency lighting is Details of the analyses presented below are imposed by SBO and LOSP scenarios.

provided in Appendix D.

Emergency lighting may not be needed for manual and recovery actions in those areas for which The LaSalle fire PRA analysis for the fire area for redundant plant-specific lighting is available and the cable shaft room adjacent to the Unit 2, remains unaffected by the fire. An alternative Division 2, essential switchgcar room was used means of emergency lighting using a centralized for the purpose of this illustration. It was battery / charger unit may be acc :ptable for these postulated

• that the fire area contains equipment areas depending on the area-specific features.

associated with both trains of the residual heat removal (RHR) system, and that the fire darage The preceding analysis illustrates how is extensive and it will take more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to information from a fire PRA can be used in a restore one RHR train. This study adopts the qualitative manner to develop insights on the need LaSalle PRA assumption that a small fire and importance of emergency lighting for risk anywhere in the fire subject area will cause the significant and vulerable accident sequences. A rapid formation of a hot gas layer that causes all more detailed analp using plant-specific PRA critical cabling to fail. Prescriptive compliance information can be conducted for examining with the 72-hout requirement would necessitate critical areas for emergency lighting.

that one RHR train be removed from the fire area, or that it be protected. An attemative approach is postulated to include reestablishing the condenser 6.2.2.2 Event Tree Modeling and Delta.CDF (power conversion system, PCS) for long-term Quantification decay heat removal to allow sufficient time for the repair of one train of RHR shutdown cooling.

6.2.2.2.1 Analyses of the 72-Hour Criterion This apprcach would take more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to to Reach Cold Shutdown reach cold shutdown.

In order to limit the amount of repairs to equipment for achieving safe shutdown in the The LaSalle fire PRA used conservative event of a fire, current fire regulations of the U.S.

assumptions by excluding credit for operator NRC require that a pant have the capability to recover actions for modeling the subject fire area reach cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

since it was a non-dominant contributor to the Experience from the early 1980s in implementing fire-induced CDF. Therefore a more detailed this requirenant presented in Chapter 3 indicates that some U.S. plants found it difficult (it would be too costly) to meet this prescriptive

• It was necessary to assume some changes to the requirement and, therefore, requested that the U.S.

configuration of this fire area in order to allow data NRC be exempted from this requirement based on from the LaSalle fire PRA to be used for this qualitative arguments, which indicated that illustration. Therefore, this analysis does not model the LaSalle plant.

NUREG-1521 6-22 March 1998

Applications ofRisk-informed. Performance-Based Methods event tree (shown in Figure 6.10) was developed leading to core damage are quantified for both the for this example, which included manual actions prescriptive and alternate approaches. The final to recover PCs and RHR. The prescriptive result is given at the bottom of the figure, it is compliance case assumes one RHR train is ACDF = 8.0E-7.

removed from the fire area or otherwise protected.

Therefore, a failure of the containment heat The preceding example illustrates the PRA removal (CHR) function requires additional RHR method and the potential for using ACDF as a tool random failures. The estimated unavailability is tva ed evaluating the safety equivalence of an CHR = 1.lE-1. The ahernative case does not alternate coach to a prescriptive requirement.

protect the RHR system. All containment heat

.9 is the ca$e nor this example, alternate removal is assumed lost due to the fire, and CHR approaches can be expected to require 1.0. Operator actions to reestablish the reexamination of non-dominant sequences, and

=

condenser and to recover one train of RHR are use or a finer level of modeling resolution to key actions in this analysis. Detailed plant-credit certain operator recovery actions. The Specific human reliability analysis would be purpose of this example was no; to only determine required to accurately represent important t bottom-line ACDF (in any case this analysis is operator actions and potential systems not based on a real plant configuration or interactions. For illustrative purposes, failure conditions) but to show that a probabilistic estimates that are more conservative than values approach provides a systematic framework in normally used in PRAs were used for these which to identify key issues such as operator restorations for this study. The four sequences FIRE E ARLY CONTA34 RECOVER PCS HECOVER PCS LATE APV SEQUENCE CORE NTIATOR RPV MENT HE AT PCS OPERATES RHR CONTINUES IWECTION AND NE (FIRE AC)

INE ON R MOVAL (REC-PCS)

(PCfr200H)

(RECeRNR)

(PCS FDq (L.%h END-STATE FR (P2)

(A21 P. PRESCRIPTIVE t SUCCESS COMPUANCE CASE A. ALTERNt'WE 2 SUCCESS COMPWANCE CASE 3 SUCCESS 11Ed 4 SUCCESS 5 8E-3 16Ea 5 LATE 8 8E-10 8.0E4 CORE DAMAGE 1 1 E-1 (P) 7.1E 2 1.D ( A) t 6E 1 7 LATE o aE4 8 9E-7 7 6E-5 CORE DAMAGE 8 SUCCESS 21E 3 16N 9 LATE 2.9E 4 2 6E4 CORE 8 9E 2 IC EARLY E.9E4 6.9C4 CORE DAMAGE TOTAL CCF 70E4 7 8E4 l

l ACDF 8 0E 7 Figure 6.10 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Case Study--Quantified Event Trec l

l March 1998 6-23 NUREG-153I 1

[

i Application ofRisk-Informed Performance BasedMethods actions, exannine assumptions, sensitivities and damage to one or more emergency ac power uncertainties *.

sources. Since the mle requires licensees to postulate a 72-hour LOSP, the critical injection An important insight derived from the preceding and decay heat removal systems are without exercise is that most of the risk contribution power. Within the confines of the Appendix R comes from Scenario 10, which is unaffected by LOSP requirement, core damage is postulated.

the 72-hour issue. This type. ofinsight provides This generally regmres rerouting or protecting the an indication of the relative importance ofissues emergency ac power source to ensure compliance in the overall plant risk profile.

with the rule. Although all operating plants conform to th's requirement, continued industry Since the accident sequences in this application interest in the need to consider LOSP was evident involve key operator actions, the ability of current during the workshop on the prograra for the IIRA techniques to model the type of actions elimination of requirements marginal to safety involved in these sequences, which may involve (NUREG/CP-0129).

several operators over a longer period of time than normally evaluated in current PRAs, must be The following analysis illustrates how a fire PRA examined. Sensitivity studies, varying the human can be used to provide a systematic process to error probability (HEP), should be conducted to evaluating the Appendix R, LOSP-assumption determine if conservative and bounding values for requirement. The Limerick auxiliary equipment IIEPs are used to validate the insights drawn from room, as modeled in the fire PRA (NUS the analysis. The dominance of Scenario 10 to the Corporation,1983), is used for this illustration.

risk contribution, and the uncertainty of continued The auxiliary equipment room is located one floor injection after containment failure to the total above the main control room. This room contains uncertainty, provides an indication of the signal-conditioning components housed in steel

,ip Gcance of thc. uncertainty of the HEPs for cabinets, the associated cabling required for the Key (g'wlator actions.

control of all safety-related and balance-of-plant equipment, and the remote shutdown panet A 6.2.2.2.2 Evaluation of Loss-of-Offsite Power fire in this area could cause the evacuation of the Assumption for Alternative or centrol room and is expected to require local Dedicated Shutdown Capability

_ manual actions for plant recovery.

Section III.L of Appendix R requires that an The Limerick fire PRA examines the alternative and shutdown capability, if required by consequences of self-ignited cabinet and ceble criteria established in Section III.G, shall be able fires and transient combustible fires at various to function as intended with a LOSP. The need to critical locations throughout the auxiliary postulate LOSP,in conjunction with alternative or equipment room. For the purposes of this dedicated shutdown capability, has been a subject illustration,

however, a

single transient of discussion since the rule was promulgated. As combustible fire is postulated at Limersk location noted in Chapter 3, several exemptions for

b. A fire at this location is predicted to disable attemative shutdown (Section llIL) have t>een redundant systems by simultaneously damaging approved by the NRC staff. Noncompliance with cables in overhead conduit and the logic circuits the LOSP requirement generaily indicates that the in the cabinets. Only train D of the low-pressure plant-specific Appendix R analysis postulates ccolant injection (LPCI) system (which is served by Division IV ac power) and the capability to depressurize with non-ADS (aut matic

• The results of the uncertainty analysis for this dePressurization system) safety relief valves example is presented in Appendix D. It shows that (SRVs) is assumed available for early accident the uncertainty of this analysis is dominated by the mitigation. Closure of the main steam isolation uncertainty associated with continued injection after valves is expected as a direct result of the fire.

containment failure.

NUREG-:521 6-24 March 1998

offsite power by the fireauxiliaryequipmentrooma dcircuitry is located outsid A

lications frisk-info o

n e the interact assuming thereremains unaffected rmed. Performance B D (e.g. ions. The support systems for LPCI reestablishinjection will asedMethods are no I hour) core damage I circuit assumed to be unaffected b, emergency service result in early (less than (XHE, X, V)is succ train this f early RPV injectio w ter) are a

analysis illustration,containmcontainmen y the fire. In addition also which is essful, the tree examine dieselgeneratorcablin imethod, assu,mes the Divi i aimed at illustrating the n

ent heat removal s the alternate g s locatedin the vicinitys on IV emergency train D shutdow oflocation b*, and fire available SRVsn cooling (SD probability of damage.

the exchange,r to analysis predicts a high as emergen,cy service wateand the re train D The heat is event tree show not available. The stems such quantitative modelforthe an in Figure 6.11 is suppre'sion pool wil

)

continue to heat up to boili examined.

containme The first nalysis. Tw

]

a the cable tray contai incompliance with the LOS 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />),nt. At some point (in appro i assumes o cases are the P requirement; that isprescriptive sufficient to containment pressure mately cabling x

n ng emergency ac train IV repressurize close the SRVs. The RPV and components equipment roomis prot will be injection is and fail in the fire av ilable using the CRDLPCI. C a

will using theat location b. Theected from the effects ofauxiliary system. The containment hydraulic ev pressaize successent tree is quantified system hardware unavailability a

Rev.1, Part 3). The co(mPeach Bottom PRA ** y estim Bottomanalysis assumeand eventually ruptu tc the taking suction on the (includie from thes that allinjection system NUREG/CR-4550 Vol 4 3

e PRA fault tree ruptures. g LPCI) fail after theTh suppression pool models (NUREG/CR-5813)puterized Peach Bottom modified o examine the operation of th t

reflect tix prescriptive case configuration. Both and after containment fail e top event to are ac pow e CRD system before er are offsite compliance event, a plant-specific Pepump CR the alternativsupport system fault tree iassumed available. Theand emergency ure. (Although single-s sufficient early in the shown that it will p ac pow emergency acpoweapproachbyremoving lls further modified for er 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after scram )revent core damag er, a

After credit for core damage isaverted and this is. IfCRDinjectio at about a major fire in late core damage (in msuccess. A fa The operator willhave tlocation b, control roomauxiliary equ njection willconsidered a evacuation is m

assumed, The ore than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) result in train D. The event tmanually depressurizing the RPVo reestablishinje per reactor-year, DF for the base estimated C actions to reestablish RPV and using LPCI ree has loss ofacpowhigher at 1.32E-6 per re The lternativecase is 1.31E-6 separated the operator a

e hardware failures (X) and (V) because)theseinjection(XHE from actor-yearbecause ofthecaseis li s

rator is erredundancy. The CDFd actions only 1.E-8 per reactor y sily segregatedare interrelated and cann thelowprobability f ifference by system. A ora LOSP. As show in theares ev ot be ent tree, these results failure 0.1 probability assum i to n

pt on for peratorare dominated by XHE. Thecorresponding e

w as necessary to about 75 percent of the o

niicuration of this fire ar m'the Limerick fire PRA to bassume some changes to h total CDFforsequence accounts,or errc.

Unlike the eain te 72-hour to-cold-shutd stration. Therefor order to aHow dataregulatory costudy, this human error i each case.

imerick plant. e, this analysis does not me used for this own s

common to both the we approach. Sm. mpliance case odel both case studiesPredict the extent of fire the altemative in, since the p and rate thepmcess,urpose of this modeling, used o used to quantify thethe most readilyavail blanalysis is to the LOSP assump. Although one, o lamage is also use t

event tree.

e data because a

tion to be u d prejudge c

creating and quantifyingof the low probabilityo 98 6-25 an event tree llowof a LOSP, a

s one MREG-15if r

yased Methods of Risk *I"I"""'

esj '*$#

e

,;,,n g,- g, g

s

,na #

me succc55

.. psE CASE

,,,,,g4 g,gTE M ypE 8 8 gg., @ #

ypt4 W 3g.s W p

,p c-

, ca 4 *

,,4 2 83El &

6M4 v

ysh p, e

,as 65 M com gf ' l'

,a, wer Case Study uired by

~

Figure 6.1Iof Offsite Po value f assumptions reqidenti risk-Quantified EventTree for Loss-determine theregulations by which the assu o

iosin impact of the i ant current significant fire scenar w its impact on dom n h

scenario value,andexaminingt erisk signif d on the overall CDF.

may ha methodically sho ve on in accident sequences,anillustrates assumptiondevelopment and quantifi to how analysis used to preceding a fire PRA* can be The information from kEb accurate will requirerepresenting lications s and data app

' Plant-specificmodels f plant configuration March 1991 g'

o plant conditions.

6-26 gggEG4521

Applications ofRisk-informed. Performance-Based Methods _

All offsite power circuitry is located outside the reestablish injection will result in early (less than auxiliary equipment room ar.d remains unaffected I hour) core damage. If early RPV injection by the fire assuming there are no circuit (XHE, X, V) is successful, the tree examines the interactions. The support systems for LPCI train containment heat removal function (W). In this l

D (e.g., emergency service water) are also illustration, containment heat removal is limited to assumed to be unaffected by the fire. In addition, alternate shutdown coolmg (SDC) using LPCI this analysis, which is aimed at illustrating the train D, the available SRVs, train D heat method, assumes the Division IV emergency exchanger, and the required support systems such diesel generator cabling is located in the vicinity as emergency service water. Containment venting r

of location b*, and fire analysis predicts a high is not available. The suppression pool will probability of damage.

continue to heat up to boiling and pasurize the containment. At some point (in approximately The event tree shown in Figure 6.11 is a 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), the containment pressure will be quantitative model for the analysis. Two cases are sufficient to close the SRVs. The RPV will examined. The first assumes prescriptive repressurize.nd fail LPCI. Continued RPV compliance with die LOSP requirement; that is, injection is available using the CRD hydraulic the cable tray containing emergency ac train IV syste:n. The containment will continue to cabling and components in the auxiliary pressurize and eventually rupture. The Peach l

equipment room is protected from the effects of a Bottom analysis assumet, that all injection systems l

fire at location b. The event tree is quantified taking suction from the suppression pool using the system success criteria, and the (including LPCI) fail after the containment hardware unavailability estimates are based on the ruptures. The simplified tree uses the top event to Peach Bottom PRA** (NUREG/CR-4550 Vol. 4, examine the operation of the CRD system before Rev.1 Part 3). The computerized Peach Bottom and after containment failure. (Although single-PRA fault tree models (" ' REG /CR-5813) are pump CRD injection is not sufficient early in the modified to reflect the p; criptive comp'iance event, a plant-specific Peach Bottom analysis has case configuration. Both offsite and emergency shown that it will prevent core damage at about ac power are assumed available. The ac power 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after scram.) If CRD injection continues, support system fault tree is further modified for core damage is averted and this is considered a the altemative approach by removing all credit for success. A failure of CRD injection will result in emergency ac power.

late core damage (in more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

After a major fire in auxiliary equipment room The estimated CDF for the base case is 1.31E-6 location b, control room evacuation is assumed.

per reactor-year. The altemative case is slightly The operator will have to reestablish iajection by higher at 1.32E-6 per reactor-year because of the manually depressurizing the RPV and using LPCI loss of ac power redundancy. The CDF difference train D. The event tree has separated the operator is only 1.E-8 per reactor-year essentially due to l

actions to reestablish RPV injection (XHE) from the low probability for a LOSP. As shown in the l

the hardware failures (X) and (V) becuose these event tree, these results are dominated by the operator actions are interrelated and cannot be 0.1 probability assumption for operator error easily segregated by system. A failure to XHE. The corresponding sequence accounts for about 75 percent of the total CDF for each case.

Unlike the 72-hour-to-cold-shutdown case study, this human error is common to both the

• It was necessary to assume some changes to the regulatory compliance case and the alternative configuration of this fire area in order to allow data from the Limerick fire PRA to be used for this approach. Sm.ularly, the fire modeling, used to illustration. Therefore, this analysis does not model Predict the extent of fire damage, is also used in the Limerick plant.

both case studies. Although one could prejudge the LOSP assumption to be of marginal value

• • Again, since the purpose of this analysis is to because of the low probability of a LOSP, illustrate the process, the most readily available data creating and quantifying an event tree allows one were used to quantify the event tree.

March 1998 6-25 NUREG-1521

Application of Risk-informed. Performance-Based Methods CPE#ATORS MANUAL LPCID ALTERNATI RPV DUECTN C8UTICAL AUGN RPV OEPRESS (HARDWARE SHUTDOWN CONTINUES 8

CORE 0AnaAGE FREQUENCY l

1. UECTN fMAR RE N)

COOUNG A"

pgg (PE4 NY)

)

une) m m

em an

s. aAsE case aAse A. ALTERNAnvE 8"*5 suecass 725E4 fB) 725E4 (A) 323E 1 (B) uTE 147E4 IS7E4 3D4E-1 (A)

CORE DAAAAGE I88E4 8 EAHLY 12eE 7 2.53E-7

1. EIE4 (A)

M 10E4 EARLv EmE4 5mE4 6 69E4 gAj COR I

1. ^I EARLY 14E4 1AE4 CORE WJ TOTAL CDF IJ154 1J2E4 aCOF 1E4 Figure 6.11 Quantified Event Tree for Loss of-Offsite-Power Case Study I

j to methodically show its impact on dominant determine the value of assumptions required by accident sequences, and on the overall CDF.

current regulations by identifying the risk-significant fire scenarios in which the assumption The preceding analysis illustrates how may have value, and examining the impact of the information from a fire PRA* can be used to assumption on risk-significant scenario development and quantification.

• Plant-specific applications. will require accurate models of plant configurations and data representing plant conditions.

NUREG-1521 6-26 March 1998 l

L I

7 APPLICATION COST BENEFITS Chapter 6 examined the insights that could be staff rate of $76 per hour

• yields estimated drawn useful to the regulatory process utilizing licensee costs of $24,000 and $49,000 for performance-based, risk-hformed approaches for straightforward and complex technical selected aspects of current prescriptive and specification changes, respectively. These deterministic requirements. In this chapter, these estimates consist of nontechnical and technical methods are evaluated to see if implementation components. The nontechnical contribution would have economic benefits for licensees. This includes licensing effort, upper management chapter only provides information to indicate the review, and support to the NRC review process type and approximate amount of potential savings (e.g., meetings and submittals of additional using these alternate approaches. It is not intended information). The technical scope (and cost) of a to provide a cost-benefit analysis to support any technical specifications change is considered to be regulatory action.

equivalent to the licensee's technical evaltation for an issue of the same complexity.

Several case studies ce. be characterized as one-time events. These case studies are generally very The case studies and licensee initiatives presented plant specific and have limited industry-wide in Chapter 6 require varying levels of technical application.

Other case studies show cost effo t.

In recognition, the estimated licensee reductions for recurring costs, primarily technical levels cf effort for these regulatory surveillance. These alternate approaches are alternatives have been subdivided into three generally applicable to a large number of levels:

straightforward, complex, and very licensees.

complex technical evaluations.

Some of these case studies have beert Straightforward evaluations require a limited accomrnodated under the existing regulations, i.e.,

amount of technical input. The major technical through the exemption process, as a deviation, or effort might consist of determining the plant-as a safety evaluation under the Generic Letter 86-specific licensing bases with regard to a specific 10 license condition. Other altemate approaches, regulatory requirement. An example is the battery such as the application addressing the loss-of-capacity testing application discussed in Chapter offsite-power requirements for altemate or

6. On the basis of estimates, the technical effort dedicated shutdown, do not appear to have been associated with each of these examples is less implemented under the current regulatory than 2 weeks each, or $3,00(>-$5,000. The framework.

licensee's cost to process a straightforward technical specification change is $24,000, as The estimated costs of the technical evaluations developed above. By extension, this assumes that are adapted from information developed by the the exemption process entails a cost of ~$20,000 NRC to estimate licensee and NRC costs for for nontechnical support, i.e., a certain minimum technical specification changes (NUREG/CR-level of licensing effort is required, regardless of i

4627).

the issue's complexity.

l The estimated licensee costs are $18,000 for Complex evaluations require more significant l

straightfonvard technical specification changes technical input. The fire detector surveillance l

and $35,000 for more complex revisions. These application, which develops a plant-specific estimates are based on 8 and 16 staff weeks of reliability database, is one example of a comple::

utility technical, legal, management, and l

committee input at $55 per staff hour in 1988 dollars. Total costs are rounded to the nearest thousand dollars. Assuming a 1995 professional

• Inflated to 1995 dollars assuming wages kept pace with the long-term forecast for inflation. of 4.8 percent per year.

Starch 1998 7-1 NUREG-1521 l

l L

Apphcation Cost Benefits evaluation. The licensee's cost to develop and satisfied their design bases v.hile avoiding battery support a complex technical specification change capacity degradation caused by a full-discharge-($49,000) has been developed above. The capacity test.

nontechnical level of effort is again assumed to be

$20,000. The technical cost is, therefore, $29,000.

The approximate cost savings that could ensue The technical effort takes about 4 staff months from changing the 8-hour regulatory test (60 percent of the total). This is believed to be requirements is developed below.

It is a reasonable for this level of complexity, combination of the reliability projections of l

Section 6.2.1.2.2 and the plent-specific A third category, the very complex evaluation, has information from Catawba provided by Duke been defined to account for those issues that Power Company.

require stam-of-t5e-art probabilistic risk assessment (PRA) or fire modeling ana;yses. In The base case (T) develops a cost estimate for recognition of the significant effort required, the emergency lighting replacement for the current estimated trghnical cost has been increased by a regulatory requirement. A 40-percent battery factor of 2 to $58,000.

failure rate

• is assumed to be incurred during the yearly testing and maintenance. The failure of a The regulatory compliance requirements and the battery is defined as failing to satisfy the 8-hour-associated costs are not addressed here. They are rating requirement. The time required for the 8-additional plant-specific variables that could hour-capacity test is assumed to be abou: 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> somewhat reduce the cost savings developed per emergency lighting unit.*

below.

The alternative case (T') assumes that a 1-hour-7.1 EMERGENCY LIGIITING capacity test is appropriate for the majority (80 percent)* of the safe-shutdown lights. The The premature failure of 8-hour safe-shutdown rest of the lights continue to be required for a full emergency lighting as a result of full discharge 8-hour duration; however, they are tested for 5 surveillance testing was discussed in Section hours. In accordance with Section 6.2.1.2.2, the 6.2.1.2.2. That section developed a reliability failure rate is expected to be reduced to an approach for testing 8-hou -rated battery packs for equilibrium failure rate of about 15 percent per 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to avoid this type of failure.

year.

A second approach to this issue is being The time required for 1-hour-capacity testing is considered at the Catawba plant, as discussed in assumed to be I hour. The time required for the Section 7.6. The design basis for each light was 5-hour-capacity test is conservatively assumed to reviewed. In most plant areas, battery-operated require 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, i.e., the same as an 8-hour-safe-shutdown emergency lighting is not required capacity test.

for an 8-hour duration. For example, the lights that illuminate the path from the main control The following parameters are assumed for both room (MCR) to the remote shutdown, are required cases:

in the first few minutes after a fire in the control room. Once the operators have evacuated the Fifty safe-shutdown emergency lights are

=

MCR, these lights hav fulfilled their design installed in the unit

• function. Duke Power n mpany, the Catawba licensee, is examining the feasibility of C st oflabor is $43 per hour for tec menans?

redesignating the emergency lighting that is only required for the short term (i.e., less than 30 Replacement batteries cost $100 each.*

minutes) as 1-hour lighting. These lights would continue to have 8-hour-rated batteries; however, the annual capacity testing would be for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

This would assure that these emergency lights

• Catawba plant-specific values NUREG-1521 7-2 March 1998

Application Cost Bene /its Four hours oflabor are assumed for redesignated as 1-hour-rated lights. The replacing each failed battery.*

8-hour-capacity batteries are tested for I hour. The remaining 20 percent of the The cost estimate for the base case is the sum of lights (10 lights) retain their 8-hour three components:

requirement and are tested for 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> CI: The capital cost for battery replacement C3' (40 lights x 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> / light /ye -

=

x $43/ hour) + (10 lights 3 l

Cl 50 lights / reactor x 40% failure hours / light / year x $43/ hoer

=

rate / year x $100/ battery

$3,010/ reactor-year

=

$2,000/ reactor-year.

and

=

C1' + C2' + C3' T'

=

C2: The labor cost associated with unit

$5,480/ reactor-year

=

troubleshooting and battery replacement The projected annual savings is C2 50 lights / reactor x 40% failure

=

rate / year x 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> / failure T - T'

$11,890 - $5,480

=

x $43/ hour

$6,410/ reactor / year

=

$3,440/ reactor-year Assuming a remaining life of 20 years for this

=

unit, and constant annual savings, the present C3: The annual cost associated with the 8-value of the savings is about $55.000 per reactor hour-capacity test (10-percent discount rate) and $80,000 per reactor at a 5-percent discount rate.

50 lights / reactor x 3 C3

=

hours / light / year x $43/ hour Cost The Catawba licensee estimated that the

$6,450/ reactor-year

=

engineering effort that was required to investigate the design bases of each safe-shutdown The total estimated annual cost of the present 8-hour-test requirement for emergency lighting is emergency light and revise affected documents and procedures totaled about $3,000.

T Cl + C2 + C3

=

$11,890/ reactor / year This results in an estimated net savings per reactor

=

of $52,000 to $77,000 (at 10-percent and Similarly, the cost estimate for the alternative 5-percent discount rates, respectively).

case can be calculated as 7.2 THE 72-HOUR CRITERION TO REACH COLD SHUTDOWN C1' 50 hghts/ reactor x 15% failure

=

rate / year x $100/ battery Sxtion 6.2.2.2.1 examines an attemate approach

$750/ reactor-year to the Appendix R. requirement to reach cold

=

shutdown in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This application presents 50 lights / reactor x 20% failure a methodology that can be used to evaluate the C2'

=

rate / year x 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> / failure risk impact of a protracted time to reach cold x $43/ hour shutdown. Selected exemptions from this Appendix R requirement have been granted in the

$1,720/ reactor-year past, so the economic value of this approach may

=

be limited to the avoidance of the expenses of a C3': 80 percent of the lights (40 lights) are formal exemption request. However, at the other extreme, if this methodology can provide justification that a conforming plant modification is n t risk warranted, then the avoided cost can be

• Catawba plant-specific values March 1998 7-3 NUREG-1521

Application Cost Benefits l

substantial.

criterion of Appendix R. The costs are too plant specific. Rather, the intent is to convey that the Like most nuclear plant modifications, th its costs can be significant for this situation.

associated with this application to re compliance with the 72-hour cold-shuwown 7.3 COST EVALUATION OF FIRE requirement are highly plant specific.

The DETECTOR CASE application postulates extensive damage to both traia. W.e residual heat removal (RHR) system Section 6.2.1.2.1 discusses a study by SINTEF inat cannot be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This that looks at the feasibility of adopting a implies a degree of fire damage that is not limited performance-based surveillance testing approach to cabling. Major components must be protected.

f ir fire detectors. This section examines the For the purposes of Appendix R compliance, the approximate cost saving that could be realized costs associated with the installation of a 3-hour-from a change from an annual detector rated fire barrier were examined. The wall is surveillance (the base case) to a 10-percent assumed to be 4.6 m (15 ft) high and 6.1 m (20 ft) rotating sampling annual test interval (the wide, bisect the fi*c area, and separate the two attemative case).

RHR trains. A 1982 Sandia report (Dube,1982) provided an estimate that has been modified to The following parameters are assumed for both account for inflation (at 5 percent per year) and a cases:

factor of 2 to account for the additional seismic design and construction costs. For this case, the Approximately 2,000 detectors are installed in estimated cost of the fire wall construction is the plant.

about $160,000 in 1995 dollars.

Ten minutes is required for each detector for However, this is not the entire cost of the the surveillance.

modification.

Not considered are the costs associated with equipment relocation to The cost of labor is $43 per hour for accommodate the fire wall; potential heating, technicians.

ventilation, and air conditioning modifications; fire wall penetration protection for piping, The cost estimate for the base case (T)is:

cabling, ducting, and doors; and replacement power.

The latter consideration can easily T

2,000 detectors / reactor

=

dominate the total cost if the installation extends x 10 minutes / detector-year plant outage. In addition to the capital costs, this x $43/ hour modification would incur periodic surveillance and maintenance costs for the fire barrier

$14,333/ reactor-year

=

penetrations, dampers, and doors.

The alternate case, T' is:

The technical evaluation for this application consisted of extending a plant PRA to T'

2,000 detectors / reactor

=

accommodate a 200-hour mission time. A plant-x 10-percent sample specific technical evaluation would also examine x 10 minutes / detector-year plant capability, system interlocks, procedures, x $43/ hour and operator action. This'is considered to be a very complex technical evaluation. The cost of

$1,433/ reactor-year

=

this evaluation is $58,000, as discussed at the beginning of this chapter. The net avoided cost is, The estimated annual savings is:

therefore, $160,000-$ 58,000, or $ 102,000.

T - T'

$14,333-$1433

=

i This chapter does not purpert to present exact

$12,900/ reactor / year l

=

costs associated with compliance with the 72-hour

]

i NUREG-1521 7-4 March 1998 j

l

Application Cost Benefits Assuming a remaining life of 20 years for this unit 7.5 THE LOSS-OF-OFFSITE POWER and constant annual savings, the present value of REQUIREMENT FOR ALTERNATIVE the savings is about $110,000 per reactor (10-OR DEDICATED SHUTDOWN percent discount rate) and $161,000 per reactor at CAPABILITY a 5-percent discount rate.

The development of plant-specific individual Cost plant examinations of externally initiated events This is considered to be a complex technical (IPEEEs) in conjunction with the refinement of evaluation. The licensee's cost is estimated at fire modeling capabilities has enabled licensees to

$29,000, as discussed above.

Predict the consequences of a fire in a particular area. Not all of the fires in um that require Therefore, the net value of the savings ranges alternative shutdown capabilitj could induce a from $81,000 (10-percent discount) to $132,000 I ss of offsite power (LOSP). This section

{

(5-percent discount) per reactor.

examines the potential cost savings that could be associated with a performance-based approach to Please note, this estimate does not develop a this requirement. Although the fire protection projected detector failure rate for the purposes of requirements have been implemented and any modifications have been this cost estimate. It assumes the detector necessary plant.,

reliability target is readily attainable, i.e., no completed, additional nonconformances may failures are anticipated.

ceasionaHy anse as a result of an inspection ci a licensee self audit.

7.4 SAFE SEPARATION DISTANCE If, in the future, a licensee determines that a The safe separation analysis of Section 6.2.1.3 scenario requires altemative shutdown capability, presents a performance-based and risk-informed the approach of Section 6.2.2.2.2 can be used to j

approach to examine departures from the current determine if a fire-mduced LOSP is likely.

l regulatory requirements. The avoided cost of this If the LOSP is im.. d to rar. dom, m. depenhnt ute approach can range from the incremental cost of a formal exemption to the cost associated with events, a case can be made that the protection of physical plant modifications. Several licensees ne train of emergency power is not necessary.

submitted cost estimates for modifications to For the purposes of the case study in Section usure prescriptive compliance. The engineering 6.2.2.2.2, 6.1 m (20 ft) of cable tray wrapping is and installation cost for the modifications cited required.

were estimated at $420,000 and $3,350,000, respectively. Lost revenue was estimated at $24 This modification assumes that 6.1 m (20 ft) of nullion if immediate installation was required.

cable tray are wrapped at a cost of $30,000. The cost of seismic reanalysis or derating is not c nsidered. However, the technical evaluation to l

For the purposes of this case study, regulatory compliance assumes that the target cable trays are justify not protecting the cable tray is estimated to c st $58,000. This illustrates that for Imuted-wrapped with 1-hour-rated fire blankets. The cost of material, labor, and installations for this scope modifications, a hardware fix may s

s metimes be more economical, modification is estimated to be about $1,500 per foot of cable tray, or $225,000 total. Other A m re widespread application of this factors, such as seismic reanalysis or the need for a forced outage, are not considered. The net cost examination of the LOSP requirement is the savings for this modification is the avoided cost of Potential to reduce the number of emergency the modification as reduced by the cost of the very lights. The Catawba plant, as a result of its complex technical evaluation ($58,000), or about IPEEE, has detennined that the only fires that can

$167,000, induce a LOSP occur m the turbm, e building.

Fires in safety areas do not cause loss of offsite power. As a consequence, that licensee has March 1998 75 NUREG-1521

Application Cost Benefits estimated that about 40 percent (or 20 lights) of C2 20 lights / reactor

=

each unit's safe-shutdown lights will never be x 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> / light / year demanded for any fire in an area that can affect x $43/ hour safe-shutdown equipment. These lights generally illuminate the paths from the main control room to

$2,580/ reactor-year

=

the auxiliary shutdown panel or the standby facility.

C3: The capital cost of battery replacements The licensee has estimated that the elimination of C3 20 lights / reactor

=

these 20 safe-shutdown lights would reduce the x 40-percent failure rate / year recurring costs associated with surveillance x $100/ battery testing and the repair of the failed units.

$800/ reactor-year

=

The following additional parameters

• are assumed for this cost evaluation:

C4: The labor cost associated with unit troubleshooting and battery replacement Forty percent of the safe-shutdown emergency lights fail the annual capacity test.

C4 20 lights / reactor

=

x 40-percent failure rate / year The cost of labor is $43 per hour for x 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> / failure technicians.

x $43/ hour Replacement batteries cost $100 each.

$1,376/ reactor-year

=

The monthly surveillance test takes 8 minutes The total estimated annual savings is:

per emergency light.

T Cl + C2 + C3 +C4

=

The annual capacity test takes 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per

$6,132/ reactor / year

=

light.

Assuming a remaining life of 20 years for this unit Four hours of labor are assumed for replacing and assuming constant annual savings, the present each failed battery.

value of the savings ranges between $52,000 (10-percent discount) and $76,000 (5-percent The cost savings consists of the following avoided discount) per reactor.

costs:

Cost Cl: The labor cost associated with the The Catawba licensee evaluated this change as monthly surveillance part of the $3,000 engineering effort to 20 lights / reactor m es Enate most o% safe-shutdown lights to 1-

{

C1

=

x 8 minutes / month hour capacity. We will conservatively use the same e st for this effort.

x 12 Mshm x $43/ hour This results in an estimated net savings of P"'****

$1,376/ reactor-year

=

Please note that this cost savings is an C2: The labor cost for the annual capacity test independent estimate and does not credit an improvement in the annual battery capacity test failure rate that could be expected from a uction in test duration (see Secti'.6.2.1.2.2).

• These parameters are plant-specific values from l

Catawba Th.is wouM reduce the pmm %s

.a. she savings NUREG-1521 7-6 March 1998

Application Cost Benefits due to avoided failures (C3 and C4) by more than requirements for these detectors, originally in the 50 percent, to $38,000-557,000 per reactor.

technical specifications, were moved to the Therefore, the total estimated cost savings (at 5-selected license commitments section of the percent discount) if these two initiatives were FSAR.

implemented together is about $134,000 per reactor.

Each location was evaluated to determine which detector type would be most effective. Generally, 7.6 OTIIER LICENSEE INITIATIVES the smoke detectors were retained.

Approximately 350 detectors per unit were This section develops estimated cost savings for eliminated.

several initiatives by Duke Power Co (DPC). at the Catawba nuclear power station.

These Each location still has one detector. The next initiatives are discussed followed by an evaluation phase of this effort will focus on the need for of the cost savings.

detection at each location. Detection in the plant is laid out on a 20 x 20 grid. Most of these Fire Barriers detectors are not protecting redundant trains.

DPC believes the existing plant layout exceeds the When Catawba was under design and requirements of NFPA 72 and that some construction, barriers were specified on a additional detectors / locations can be eliminated.

conservative basis. Since the plant has a dedicated safe-shutdown system, many of these barriers are not needed from a regulatory compliance Fire Protection Valve Inspections perspective. The basis of each fire barrier in the Catawba site was recently reexamined.

At Catawba, approximately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> a month (for both units) are spent confirming fire protection Fire barriers were classified as not required, system valve positions. About 400 valve sites are insurance, or NRC committed. The barriers that inspected. The valves are locked and under are "not required" are not necessary to meet NRC operations key control. In three years none of regulations. In addition, their placement does not these valves has been found in the wrong position.

allow these barriers to effectively limit the spread Using the safety evaluation process, DPC has of fires. Approximately 80 barriers and 875 seals proposed increasing the surveillance interval in each unit were re-designated for insurance (loss based on past experience. The inspection interval control) purposes or determined to not be would go to quarterly, semiannually, and finally to required.

The remaining barriers generally an annual basis if they maintain a greater than 99-separate redundant analyzed safe-shutdown trains, percent success rate. This proposed change is separate the control complex from the rest of the presently being evaluated internally by the plant, enclose high hazard areas (e.g., the licensee.

switchgear room), separate safety from non safety areas. These barriers are designated as NRC-Emergency Lighting committed barriers. They remain in the fire protection program and continue to be subject to Each Catawba unit has about 150 emergency regular inspections and fire watches.

lights,50 of which are safe-shutdown lights. The safe-shutdown units are installed on paths from Smoke and IIcat Detectors the main control room to the auxiliary sh itdown panel and the standby shutdown system (within Catawba was designed to the Duke standard at the plant). Fires were postulated on these paths

)

that time, which utilized smoke and heat detectors and altemate routes were also lighted. Because of as companions. Duke subsequently realized that the high ambient temperatures in many locations, the plant has experienced a significant number of l

it had too many detectors. (The regulations failures during the annual 8-hour capacity test.

I require providing adequate detection and meeting NFPA requirements.) The inspection and testing DPC has examined the design basis / purpose of l

each light. The FSAR, SER, BTP, Appendix R March 1998 7-7 NUREG-1521 l

l Application Cost Benefits and the SBO rule were all reviewed. In general barrier in the plant were reexamined recently, only short-term lighting is required, i.e., to permit passage through an area or isolate letdown paths.

Approximately 80 barriers and 875 penetration In addition, the IPEEE demonstrated that fires in seals in each unit were not required to ensure j

safety areas did not induce losses of offsite power compliance with NRC fire protection regulations.

(LOOPS). Main generator fires were the primary These barriers and seals were redesignated and are cause of LOOP.

no longer subject to regular inspections or fire watches. The liccasce examined plant records, Most of Catawba's safe-shutdown emergency before and after the predesignation, to estimate lights do not need to function for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and these cost savings.

could be redesignated as l-or 4-hour ratings. The majority of these lights are not specified in the CI: Monthly Inspection Time SER and can be redesignated using the 50.59 About 5 percent of the barriers are process.

inspected each month to ensure that all barriers are checked once every 18 DPC believes this lighting predesignation would months.

result in a significant cost savings without any safety impact.

Approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> per month are being saved on the fire barrier and Fire Extinguishers penetration seal inspections.

When the Catawba fire protection plan was being C1 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> / reactor month

=

developed, NFPA10 was used to determine fire x 12 months / year extinguisher locations.

Over time more x $43/ hour extinguishers were added. At Catawba, about 6 staff days per month are expended for the monthly

$12,900/ reactor-year

=

extinguisher surveillance required by NFPA10.

(At Oconee and McGuire this surveillance takes C2: Fire Watches mach longer because those plants aren't bar In 1990, prior to the barrier predesignation, coded). DPC reexamined the basis for each each unit had about 260 fire watches.

extinguisher and their regulatory commitment (NFPA10).

Duke established that 80 (or Approximately 150 fewer fire watches per approximately 25 percent) of the extinguishers year are required after the predesignation.

could be removed from each unit without This is a 58-percent reduction. An violating the lic.nsing commitment. Once again average time of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per fire watch is the safety evaluation process can be used to delete assumed.

most of these extinguishers. The extinguishers that are credited in the SER would require an C2 150 fire watches / year

=

exemption request, however.

x 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> / fire watch x $43/ hour A second phase of this effort would increase the surveillance frequency of the exting':ishers that

$19,350/ reactor-year

=

remain in the plant. Since NFPA 10 is part of the licensing basis and it specifies surveillance C3: Barrier and Seal Repairs requirements, a license amendment may be Before the barrier predesignation, about 18 required to institute this proposed change.

repairs per year were required because of inadequacies discovered durhig the 7.6.1 Fire Barriers surveillance. Repairs were estimated to c st $200 each. The savings in repairs for When Catawba was under design and construction, fire barriers were specified on a the redesignated barriers can be estimated n the basis of the reduction in fire conservative basis. The design bases of each fire NUREG-1521 7-8 March 1998

Application Cost Benefits watches.

detector type would be most effective.

Approximately 350 detectors in each unit were C3 58-percent reduction in fire eliminated. The licensee estimated a modest time

=

watches savings of 1 minute per detector for the x 18 repairs / year semiannual visual inspection and 10 minutes for x $200/ repair the 18-month bench testing of each detector. This is a savings of about 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> per year (or about

$2,088/ reactor-year

$2,150 per reactor-year). For a 20-year remaining

=

life and constant annual savings, the present value C4: Anti-Contamination Clothine per reactor is $18,000 (10-percent discount) to Many of the fire barriers are in

$27,000 (5-percent discount). The licensee radiological control zones (RCZs) that estimated that the effort to implement this change require the use of" anti-Cs." This was about a week, or $3,800 at the $95 per hour predesignation initiative eliminated the rate for engineering. This results in a net savings need to go into several RCZs for barrier of $14,000-523,000 per reactor.

and seal surveillance. Eight sets of anti-Cs are saved. Avoided dose, dressout 7.6.3 Fire Protection Valve Inspections time, and radwaste disposal costs are not Catawba is evaluating a performance-based considered.

inspection methodology for the fire protection system valve alignments. The inspection would 8 sets / year x $30/ set C4

=

eventually reach an annual interval if more than a

$240/ reactor-year

=

99-percent success rate was maintained. Catawba Presently expends 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per unit for the The annual savings, T, is:

monthly valve inspection. The reduction m the annual surveillance interval is projected to save T

$12,900 + $19,350 + $2,088

=

$11.352 per reactor-year (l 1 mspections/ year x 24

+ $240 hours / inspection x 543/ hour).

l

$34,578/ reactor-year

=

The cost for this proposed change was estinated to & abut $3,000. The yearly trending cost was Assuming a remaining life of 20 years and a constant annual savings, yields a present value per

"*E.l**d m, this evaluation. The net lifetime reactor of $294,000 (10-percent discount rate) to s vmgs is $94,000-$138,000 at 10-percent and 5-

$431,000 (5-percent discount rate).

Percent discount rates.

Cost 7.6.4 Emergency Lighting The licensee uscd the 10 CFR 50.59 process to The emergency lighting initiatives at Catawba redesignated the fire barriers. The effort was a were integrated into the emergency lighting minor modification and was estimated to cost surveillance case study discussed earlier.

about $5,000.

7.6.5 Fire Extinguishers Therefore, the projected net savings is about

$289,000-$426,000 per reactor, dependin<, on the Removal of Selected Extinguishers discount assumption.

The basis for each fire extinguisher at the 7.6.2 Smoke and Heat Detectors Catawba plant was recently reviewed. The licensee found more fire extinguishers than I

Catawba was designed to the Duke Power required by its regulatory commitments. Of the Company standard which, at that time, specified approximately 230 extinguishers per unit, 80 can j

smoke and heat detectors as companions. Each be removed. This would result in an annual cost j

location was estimated to determine which savings attributable to avoided surveillance and i

l March 1998 7-9 NUREG-1521 l

l l

o

Application Cost Benefies maintenance costs. Although Duke Power intends

$2,000, to use these 80 extinguishers elsewhere in its system, this salvage value has been conservatively The estimated total savings (T) for this effort is neglected. The licensee estimated that the monthly surveillance takes 20 minutes (0.33 hour3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br />) for each T = ($130,000-$190,000)-$2,000 extinguisher and the annual maintenance costs

= $128,000-$188,000/ reactor

$20 exh.

Performance-Based Surveillance Initiative Cl: Monthly inspections Cl = 80 extinguishers removed / reactor Duke Power is also examining the feasibility of x 0.33 hour3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br /> / extinguisher / month instituting a performance-based surveillance x 12 months / year x $43/ hour program to replace the current monthly surveillance requirement. Duke anticipates

$13,622/ reactor-year extending this surveillance to semiannually. On

=

the basis of about 230 e7tinguishers remaining in C2: Annual Maintenance each unit, the following costs are noted:

C2 = 80 extinguishers / reactor x $20/ extinguisher / year Current inspection Cost C

230 extinguishers / reactor x 0.33

=

$1,600/ reactor-year hour / extinguisher surveillance

=

x 12 surveillance / year The annual cost savings is:

x $43/ hour

$13,622 + $1,600

$39,165/ reactor-year

=

= $15,222 per reactor-year.*

Projected Inspection Cost The present value of these savings is $130,000 C' =

230 extinguishers / unit x 0.33 (10-percent discount rate) to $190,000 (5-percent hour / extinguisher surveillance discount rate) per reactor.

x 2 surveillance / year x $43/ hour Cost

$6,528/ reactor-year

=

The safety evaluation process was used t nnual Cost Savines examine the impact of removing these fire C-C'

$39,165-$ 6,528

=

extinguishers. The licensee has estimated that the

$,637/reactonyear

=

total cost to implement this change will be about Assuming a remaining reactor life of 20 years and an implementation cost of $4,000, the present value of the net cost savings is approximately

$275,000-$403,000 at 10-percent and 5-percent discount rates, respectively.

• Like the fire barrier initiative, this effort has also reduced the number of RCZ entries for surveillance; however, the savings are neglected for this evaluation.

NUREG-1521 7-10 March 1998

8 REFERENCES

Alpert, R.L.,

and E.J.

Ward, " Evaluating British Standards Institution, " British Standard Unsprinklered Fire Hazards," Factory Mutual Code of Practice for the Application of Fire Research Corp., Norwood, Massachusetts, August Safety Engineering Principles to Fire Safety in 1982.

Buildings," 94/340340 DC, draft, London,1994.

American National Standards Institute / Institute of

, " Fire Safety Engineering in Buildings:

Electrical and Electronics Engineers, ANSI /IEEE Guide to the Application of Fire Safety 450-1987, "IEEE Recommended Practice for Engineering Principles," DD 240: Part 1, London, Maintenance, Testing, and Replacement of Large 1997.

Lead Storage Batteries for Generating Stations and Substations," New York,1987.

, Fire Safety Engineering in Buildings:

Commentary on the Equations Given in Part 1,"

ANS!/IEEE 485-1983, "IEEE DD 240: Part 2, London,1997.

Recommended Practice for Sizing Large Lead Storage Batteries for Generating Stations and Bruce, G.E., " Performance Based Fire Detector Substations," New York, July 1984.

Surveillance Testing-A Nuclear Plant Application,"

American Nuclear Society American Society of Heating, Refrigeration, and International Topical Meeting, Proceedings on Air Conditioning Engineers, " Design of Smoke Safety of Operating Reactors, September 17-20, Management Systems," Atlanta, Georgia,1993.

Seattle, Washington,1995.

Azarm, M.A., " Impacts of Underreported and Clarke, F.B., R.W. Bukowski, S.W. Steifel, J.R.

Event Screening on Fire Frequencies,"

Hall, and S.A. Steele, "The National Fire Risk Brookhaven National Laboratory Technical Assessment Research Project Final Report,"

Import JCN W-6276, Upton, New York, February National Fire Protection Research Foundation, 1998.

Batterymarch Park, Quincy, Massachusetts,1990.

Azarm, M.A., and T.L. Chu, "On Combining the Code of Federal Regulations, Title 10, " Energy,"

Generic Failure Rate Data for Probabilistic Risk U.S. Government Printing Office, Washington, Assessment," pp. 1525-1529 in Probabilistic D.C., revised periodically.

Safety Assessment and Management, Vol. 2, Elsevier Science Publishing Co., Inc., New York, Commonwealth Edison Co.," Zion Station Unit 1 1991.

and 2 Probabilistic Safety Study," NRC Docket Nos. 50-295 & 50-304, Zion, Illinois, September Beard, A., " Evaluation of Deterministic Fire 1981.

Models," Fire Safety Journal, Vol. 19, pp.

295-306,1992.

Consolidated Edison Company of New York, Inc./Halliburton NUS Environmental Corp.,

Bento, J.P., et al., " Reliability Data Book for

" Individual Plant Examination for Indian Point 2 Components in Swedish Nuclear Power Plants,"

Nuclear Generating Station," Buchanan, New Nuclear Safety Board of Swedish Utilities, York, August 1992.

Stockholm,1985.

Consumers Power Company, " Big Rock Point

Bertrand, R.,

et al.,

" Studies of Fire Plant Probabilistic Risk Assessment," Jackson, Development-Development of FLAMME-S Michigan, March 1981.

Compuie Code," Proceedings of ICONE 5:

Nuclear Advances Through Global Cooperation, Cross, R.B., et al., " South Texas Project Electric Nice, France, May 1996.

Generating Station Level 2 PRA and Individual March 1998 8-1 NUREG-1521 I

l

References Plant Examination," Houston Lighting & Power

, IPEEE Submittal Report for McGuire Company and Pickard, Lowe, and Garrick, Nuclear Station," Comelius, North Carolina, Palacios, Texas, August 1992.

November 1991.

Custer, Richard L.P., and Brian J. Meacham,

, EPRI NP-2751, " Fire Tests in Ventilated

" Introduction to Performance-Based Fire Safety,"

Rooms: Detection of Cable Tray and Exposure Society of Fire Protection Engineers and National Fires," J.S. Newman, Palo Alto, Califomia,1983.

Fire Protection Association,

Quincy, Massachusetts,1997.

, EPRI NP-7282, "COMPBRN IIIe: An Interactive Computer Code for Fire Risk Davis, W.D., and K. Notarianni, " NASA Fire Analysis," V. Ho et al., University of California at Detection Study," NISTIR 5798, National Los Angeles, May 1991.

Institute of Standards and Technology, Gaithersburg, Maryland, March 1996a.

EPRI TR-100370,

" Fire-Induced Vulnerability Evaluation (FIVE)," Palo Alto, Davis, W.D., et al., " Comparison of Fire Model California, April 1992.

Predictions With Experiments Conducted in a Hangar With a 15 Meter Ceiling," NISTIR 5927, EPRI TR-100443, " Methods of National Institute of Standards and Technology, Quantitative Fire Hazard Analysis," Palo Alto, Gaithersburg, Maryland,1996b.

Califomia,1992.

Deal, S.,

" Technical Reference Guide for EPRI TR-105928,

" Fire PRA FPETOOL Version 3.2,"

NISTIR 5486-1, Implementation Guide," December 1995.

National Institute of Standards and Technology, Gaithersburg, Maryland,1995.

Florida Power & Light Co., " Turkey Point Plant Units 3 & 4 Probabilistic Risk Assessment

, "A Review of Four Compartment Firet Individual Plant Examination," Final Report, With Four Compartment Fire Models," pp. 33-51 Florida City, Florida, June 1991.

in Fire Safety Developments and Testing, Proceedings of the Annual Meeting of the Fire Friedman, R., " International Survey of Computer Retardant Chemicals Association,1990.

Models of Fire and Smoke." Journal of Fire Protection Engineering, Vol. 4, pp. 81-92,1992.

Dube, R.A., "A Systematic Approach to the Identification and Protection From Fire of Vital Gallucci, R., and R. Hockenbury, " Fire-Induced Areas in Nuclear Power Plants," S AND 82-0648, Loss of Nuclear Power Plant Safety Functions,"

Sandia National Laboratory, Albuquerque, New Nuclear Engineering and Design, Vol. 64, pp.

Mexico, October 1982.

135-147,1981.

Duke Power Company, " Catawba Nuclear Station Garrick, B.J., et al.,

"Seabrook Station IPE Submittal Report," C;over, South Carolina, Probabilistic Safety Assessment," Pickard, Lowe, September 1992.

and Garrick, Inc., Framingham, Massachusetts, December 1983.

Duong, D.Q., " Accuracy of Computer Fire Models: Some Comparisons With Experimental Grand, A.

F., ed., " Fire Standards in the Data From Australia," Fire Safety Journal,16: 6, International Marketplace," ASTM STP 1163, pp.415-431,1990.

pp. 66-.67, American Society of Testing and Materials, Philadelphia, Pennsylvania,1995.

Electric Power Research Institute EPRI NP-2660,

" Fire Tests in Ventilated Rooms: Extinguishment Ho, V., et al., "COMPBRN III, A Fire Hazard l

of Fire in Grouped Cable Trays," Palo Alto, Model for Risk Analysis," Fire Safety Journal, Califomia, December 1992.

Vol.13, pp.137-154,1988.

1 NUREG-1521 8-2 March 1998 i

- References Hokstad, P., et al., "A Reliability Model for Protection Engineers, Gaithersburg, Maryland, Optimization ~ of Schemes for Fire and Gas 1997a.

Detectors," Reliability Engineering and System Safety, Vol. 47, pp.15-26,1995.

McGrattan, K.B., Baum, H.R., Walton, W.D., and Trelles, J., " Smoke Plume Trajectory From In Situ Institute of Electrical and Electronics Engineers, Burning of Crude Oil in Alaska: Field IEEE 446, "IEEE Recommended Practice for Experiments and Modeling of Complex Terrain,"

Emergency and Standby Power System for NISTIR 5958, National Institute of Standards and Industrial and Commercial Applications," 1987.

Technology, Gaithersburg, Maryland,1997b.

Jones, W.W.," Progress Report on Fire Modeling Meacham, Brian J., "The Evolution of and Validation," NISTIR 3835, National Institute Performance-BasedCodesand FireSafetyDesign of Standards and Technology, Gaithersburg, Methods," Society of Fire Protection Engineers, Maryland, May 1996 Boston, Massachusetts,1996.

Kaplan, S., "On a Two Stage Bayesian Procedure

Medford, M.O., Southem California Edison for Determining Failure Rate From Experimental Company, letter to the NRC, " Docket Nos. 50-361

-)

Data," IEEE Transactions on Power Apparatus and 50-362, San Onofre Nuclear Generating and Systems, Vol. PAA-102, No.1, January 1983.

Station, Units 2 and 3," March 13,1987.

i Keski-Rahkonen, O., and S. Hostikke, "CIB W14 Mills, L.M., Tennessee Valley Authority, letter to Round-Robin of Code Assessment: Design Report H.R. Denton, " Docket Nos. 50-259, 260, 261,"

of Scenario A," VTT Technical Research Centre March 27,1984, of Finland, Espoo,1995.

Mowrer, F.W., and B. Gautier, " Comparison of Lambright, J., et al., "A Review of Fire PRA Re-Fire Model Features and Computations,"

quantification Studies Reported in NSAC/181,"

Proceedings, 17th Post-SMIRT Conference, Draft Technical Report, Sandia National Lyons, France,1997.

Laboratories, Albuqu 'rque, New Mexico, April 1994.

Mowrer, F.W., and D.W. Stroup, " Features, Limitations and Uncertainties in Enclosure Fire Levin, J.P., and L.L. 'Kanz, " Fire Protection Hazard Analyses-Preliminary Review," NISTIR Database, FIREDAT User's Manual," Scientech 5973, National Institute of Standards and Inc., Rockville, Maryland, January 1995.

Technology, Gaithersburg, Maryland, March 1998.

Malhotra, H.L., " Fire Safety in Buildings,"

Building Research Establishment, Gerston, United Nakaya, I., and Y. Hirano, " Japan's Approach l

Kingdom,1987.

Toward the Building Code and Standards of a New Generation,"

Proceedings of the Martinez-Guridi, G.,

and M.A.

Azarm, International Conference on Performance-Based

]

l

" Reliability Assessment of Electrical Power Codes and Fire Safety Design Methods, Ottawa, f

Supply to Onsite Class IE Buses at Nuclear Canada, September 1996, Society of Fire Power Plants " Technical Report FIN L-2505, Protection Engineers, Bethesda, Maryland,1998.

Brookhaven National Laboratory, Upton, New York, June 7,1994.

National Fire Protection Association, Fire Protection Handbook, Seventeenth Edition, pp. 6-

- McGrattan, K.B., A. Hamins, and D.W. Stroup, 76,6-77, Quincy, Massachusetts, July 1991.

" Sprinkler, Vent and Draft Curtain Interaction-Experim nt and Computer Simulation,"

, National Codes, NFPA 10 " Portable Fire Proceedings, Second Intemational Conference on Extinguishers," Vol.1, Quincy, Massachusetts, Fire Research and Engineering, Society of Fire 1997.

I

, March 1998 8-3

. NUREG-1521 L

References

)

NFPA 12,

" Carbon Dioxide Peacock, R.D., S. Davis, and B.T. Lee "An Extinguishing Systems," Vol.

1,

Quincy, Experimental Data Set for the Accuracy l

Massachusetts,1997.

Assessment of Room Fire Models, NBSIR 88-

3752, National Bureau of Standards, NFPA 13, " Sprinkler Systems, Gaithersburg, Maryland,1988.

Installation," Vol.1. Quincy, Massachusetts, 1997.

Peacock, R.D., W.W. Jones, and R.W. Bukowski,

" Verification of a Model of Fire and Smoke

, NFPA 25, " Inspection, Testing and Transport," Fire Safety Journal, Vol. 21, pp.

Maintenance of Water-Based Fire Protection 89-129,1993a.

Systems," Vol.2, Quincy, Massachusetts,1997.

Peacock, R.D., et al., "CFAST, the Consolidated

, NFPA 72, " National Fire Alarm Code,"

Model of Fire Growth and Smoke Transport,"

Vol. 4, Quincy, Massachusetts,1997.

NIST Technical Note 1299, National Institute of Standards and Technology, Gaithersburg,

, NFPA 72E, " Automatic Fire Detectors,"

Maryland, February 1993b.

Vol. 3, Quincy, Massachusetts,1991.

Peacock, R.D., et al., "A User's Guide for FAST:

NFPA 92B, " Smoke Management Engineering Tools for Estimating Fire Growth and Systems in Halls, Atria and Large Areas," Vol.

Smoke Transport," Special Publication 921, 10, Quincy, Massachusetts,1997.

National Institute of Standards and Technology, October 1997.

, NFPA 101, " Life Safety Code," Vol. 5, Quincy, Massachusetts,1997.

Pennsylvania Power & Light Company, "Susquehanna Steam Electric Station Individual

, NFPA 1962, " Care, Use and Service Plant Examination for External Events," Vol. 2, Testing of Fire Hose Including Couplings and 1994.

Nozzles," Vol. 9, Quincy, Massachusetts,1997.

Portier, R.W., " Fire Data Management System, Nuclear Safety Analysis Center, "A Probabilistic FDMS 2.0, Technical Documentation," NIST Risk Assessment of Oconee Unit 3," NSAC 60, Technical Note 1407, National Institute of Vol.1, W. R. Sugnet, G. J. Boyd, and S. R. Lewis, Standards and Technology, Gaithersburg, Electric Power Researc'n Institute, Palo Alto, Maryland, February 1994.

California, June 1984.

Portier, R.W., R.D. Peacock, and W.W. Jones, "A Nuclear Safety Commission, " Guide for Fire Prototype FDMS Database for Model Protection in Light Water Nuclear Power Reactor Verification," NISTIR 5835, National Institute of Facilities," Tokyo, Japan,1980.

Standards and Technology, Gaithersburg, Maryland, May 1996.

NUS Corporation, " Severe Accident Risk Assessment, Limerick Generating Station,"

Rackliffe, C.A., " Performance-Based Building Pottstown, Pennsylvania, April 1983.

Codes, the United Kingdom Experience,"

Proceedings of the, International Conference on Parkinson, W., et al., " Fire Event Data Base for Perfonnance-Based Codes and Fire Safety Design U.S. Nuclear Power Plants," NSAC-178-U1992, Methods, Ottawa, Canada,1996, Society of Fire Electric Power Research Institute, Palo Alto, Protection Engineers, Bethesda, Maryland,1998.

Califomia,1992.

Savornin, J., et al., " Analysis of Fire Risk in

" Fire PRA Re-quantification Studies,"

French Pressurized Water Reactors,"

NSAC-181, Electric Power Research Institute, International Conference on Thermal Reactor Palo Alto, California, March 1993.

NUREG-1521 8-4 March 1998

References Safety, Avignon, France October 2-7, 1988, Traw, Jon S., " Future Perspective of the U.S.

October 1988.

Model Building Codes," Proceedings of the International Conference on Performance-Based Simcox, S., N. Wilkes, and I. Jones, " Computer Codes and Fire Safety Design Methods, Ottawa, Simulation of the Flows of Hot Gases From the Canada, September 1996, Society of Fire Fire at King's Cross Underground Station," pp.

Protection Engineers, Bethesda, Maryland,1998.

19-25 in Institution of Mechanical Engineers, King's Cross Underground Fire: Fire Dynamics

, "NFPA's Future in Performance-Based and the Organization ofSafety, London,1989.

Codes and Standards--Report of the NFPA In-House Task Group," National Fire Protection Siu, N., and G. Apostolakis, "A Methodology for Association, Quincy, Massachusetts, July 1995.

Analyzing the Detection a-1 Suppression of Fires in Nuclear Power Plants,' Nuclear Science and U.S. Atomic Energy Commission, WASH-1400 Engineering, Vol. 94, pp. 213-226,1986.

(now NUREG-75/014), " Reactor Safety Study:

An Assessment of Accident Risks in U.S.

Snell, J.E., V. Babrauskas, and A. Fowell, Commercial Nuclear Power Plants," Washington,

" Elements of a Framework for Fire Safety D.C.,1975.

Engineering," pp. 447-456 in Proceedings of j

Interflam 93, The Fourth International Fire U.S. Depanment of Commerce, "FASTLite,"

Science and Engineering Conference, Interscience Special Publication 899, National Institute of Communications Limited, London,1993.

Standards and Technology, Building and Fire Research Laboratory, Fire Modeling and Society of Fire Protection Engineers, The SFPE Applications Group, Gaithersburg, Maryland,

{

Handbook ofFire Protection Engineering, Second 1996.

Edition, Vol. 3, pp. 201 and 203, Bethesda, Maryland.

U.S. Depanment of Defense," Military Handbook, Reliability Prediction of Electronic Equipment,"

Steckler, K.D., et al., " Fire Induced Flows MIL-HDBK-217E, January 1990.

Through Room Openings-Flow Coefficients,"

NBSIR 83-2801, National Bureau of Standards, U.S.

Department of Transportation, Washington D.C.,1984.

" Combustibility of Electrical Wire and Cable for Rail Rapid Transient Systems," DOT-TSC-Stroup, D.W., "Using Computer Fire Models To UMTA-83-4-1, May 1983.

Evaluate Equivalent Levels of Fire and Life Safety," Proceedings, Symposium of Computer U.S.

Nuclear Regulatory Commission, Applications in Fire Protection Engineering, AEODIS97-03, "Special

Study, Fire Worcester Polytechnic Institute, Worcester, Events-Feedback of U.S.

Operating Massachusetts, June 1993.

Expedence," J.R. Houghton, June 1997.

Stroup, D.W., "Using Field Models to Simulate

, Branch Technical Position APCSB 9.5-1, Enclosure Fires," SFPE Handbook of Fire

" Guidelines for Fire Protection for Nuclear Power Protection Engineering, Second Edition, National Plants Docketed Prior to July 1,1976."

Fire Protection Association,

Quincy, Massachusetts, pp. 3-152 to 3-159,1995.

, Branch Technical Position CMEB 9.5-1,

" Guidelines for Fire Protection for Nuclear Power Sullivan, K., et al., " Inspection Techniques for Plants Docketed Prior to July 1,1976," Appendix Post-Fire Safe Shutdown of Nuclear Generating A.

Stations,"

Technical Report A-3270-1.

i Brookhaven National Laboratory, Upton, New

, Elimination of Requirements Marginal l

York, January 1989, to Safety-Solicitation of Pubhc Comments,"

l f

March 1998 8-5 NUREG-1521

References Federal Register, Vol. 57, p. 4166, February 4, Safe Shutdown Systems (10 CFR 50, Appendix 1992.

R)," February 13,1984.

, " Fire Protection Program for Operating

, Memorandum from L. Joseph Callan to Nuclear Power Plants," Final Rule 10 CFR Pan Commissioners, " Preliminary IPEEE Insights 50 Federal Register, Vol. 45, p. 76602, Report," January 20,1998.

November 19,1980.

NUREG-0500,

" Recommendations

" Safety Goals for the Operation of Related to the Brown's Ferry Fire," February Nuclear Power Plants:

Policy Statement,"

1976.

Federal Register, Vol. 51, p. 28041, August 4, 1986.

, NUREG-0675, Supplement 23, " Safety

, Generic Letter 81-12, " Fire Protection Evaluation Report Related to the Operation of Rule (45 FR 76602, Novemt>er 6, 1980),"

Diablo Canyon Nuclear Power Plant, Units I and February 20,1981.

2," June 1984.

. Generic Letter 83-33, "NRC Positions on

, NUREG-0781, Supplement 4, " Safety Certain Requirements of Appendix R to 10 CFR Evaluation Report Related to the Operation of 50," October 19,1983.

South Texas Project, Units 1 and 2," July 1984.

, Generic Letter 85-01, " Fire Protection NUREG-0800 (formerly NUREG-Policy Steering Committee Report," January 9, 75/087), " Standard Review Plan for the Review of 1985.

Safety Analysis Reports for Nuclear Power Plants-LWR Edition," July 1981.

, Generic Letter 86-10, " Implementation of Fire Protection Requirerrents," April 24,1986.

, NUREG-1150, Vol.1," Severe Accident Risks: An Assessment for Five U.S. Nuclear

, Generic Letter 88-12, " Removal of Fire Power Plants," Vol.1, December 1990.

Protection Requirements From Technical Specifications," August 2,1988.

NUREG-1493, " Performance-Based Containment Leak-Test Program," September

, Generic Letter 88-20, " Individual Plant 1995.

Examination for Severe Accident Vulnerabilities-10 CFR 50.54(f)," November 23, NUREG-1547/NISTIR

5842, 1988.

" Methodology for Developing and Implementing Alternative Temperature-Time Curves for Testing

, Generic Letter 88-20, Supplement 4, the Fire Resistance of Barriers for Nuclear Power

" Individual Plant Examination of Extemal Events Plant Applications," L.Y. Cooper and K.D.

(IPEEE) for Severe Accident Vulnerabilities-10 Steckler, August 1996.

CFR 50.54(f)," June 28,1991.

, NUREG/CP-0129, "Proceedmgs of the

,IEInformation Notice 83-41 " Actuation Workshop on Program for Elimination of Require-of Fire Suppression System Causing Inoperability ments Marginal to Safety," M. Dey, F. Arsenault, of Safety Related Equipment," June 22,1983.

M. Patterson, and M. Gaal, September 1993.

IE Information Notice 83-69, NUREG/CP-0138, " Proceedings of

" Improperly Installed Fire Dampers at Nuclear Workshop 1 in Advanced Topics in Risk and Power Plants," October 21,1983.

Reliability Analysis," October 1994.

, IE Information Notice 84-09, " Lessons Learned From NRC Inspections of Fire Protection NUREG-1521 8-6 March 1998

References

, NUREG/CR-2258, " Fire Risk Analysis NUREG/CR-4627, " Generic Cost for Nuclear Power Plants," M. Kazarians and G.

Estimates: Abstracts From Generic Studies for l

Apostolakis, September 1981.

Use in Preparing Regulatory Impact Analyses,"

Rev.1, E. Claibome, F. Sciacca, G. Simon, and G.

. NUREG/CR-2300, "PRA Procedures Baca, February 1989.

l Guide," January 1983.

, NUREG/CR-4679, " Quantitative Data on

, NUREG/CR-3192, " Investigation of the Fire Behavior of Combustible Materials Found Twenty-Foot Separation Distance as a Fire in Nuclear Power Plants: A Literature Review "

Protection Method as Specified in 10 CFR 50, S.P. Nowlen, February 1987.

Appendix R," D.D. Cline, W.A. von Riesmann, and J.M. Chavez.,1983.

NUREG/CR-4681,

" Enclosure Environment Characterization Testing for Base

, NUREG/CR-4230, " Probability-Based Line Validation of Computer Fire Simulation Evaluation of Selected Fire Protection Features in Codes," S.P. Nowlen,1987 Nuclear Power Plants," M.A. Azarm and J.L.

Boccio, May 1985.

, NUREG/CR-4832, " Analysis of the LaSalle Unit 2 Nuclear Power Plant:

Risk

, NUREG/CR-4330, " Review of Light Methods Integration and Evaluation Program Water Reactor Regulatory Requirements:

(RMTEP), Summary," Vol.1, A.C. Payne, Jr., July Identification of Regulatory Requirements That 1992.

May Have Marginal Importance to Risk," Vol.1, M.F. Mullen, W.B. Scott, W.B. Andrews, W.E.

. NUREG/CR-4832, " Analysis of the Bickford, AJ. Boegel, W.W. Little, PJ. Pelto, and LaSalle Unit 2 Nuclear Power Plant:

Risk T.B. Powers,1986.

Methods Integration and Evaluation Program (RMIEP), Internal Fire Analysis," Vol. 9, J.A.

, NUREG/CR-4550, " Analysis of Core Lambright, D.A. Brosseau, A.C. Payne, Jr., and Damage Frequency: Surry Power Station, Unit 1 S.L. Daniel, March 1993.

Extemal Events," Vol. 3, Rev.1, Part 3, SAND 86-2084, M.P. Bohn, J. A. Lambright, S. L. Daniel, et

, NUREG/CR-5088, " Fire Risk Scoping al., Sandia National Laboratories, December Study: Investigation of Nuclear Power Plant Fire 1990.

Risk, Including Previously Unaddressed Issues,"

J.A. Lambright, S.P. Nowlen, V.F. Nicolette, and

, NUREG/CR-4550, " Analysis of Core M.P. Bohn, Sandia National Laboratories, January Damage Frequency: Peach Bottom Unit 2 Internal 1989.

Events," Vol. 4 Rev.

1, Part 1,

A.M.

Kolaczkowski, W.R. Cramond, T.T. Sype, KJ.

, NUREG/CR-5384, "A Summary of Maloney, T.A. Wheeler, and S.L. Daniel, Sandia Nuclear Power Plant Fire Safety Research at National Laboratories, August 1989.

Sandia National Laboratories, 1975-1987," S.P.

Nowlen,1989.

. NUREG/CR-4550, " Analysis of Core Damage Frequency: Peach Bottom Unit 2 NUREG/CR-5775,

" Quantitative Extemal Events," Vol. 4, Rev.1, Pan 3, S AND86-Evaluation of Surveillance Test Intervals 2084, M. P. Bohn, J.A. Lambright, S. L. Daniel, et Including Test-Caused Risks,"

I.S. Kim, S.

al., Sandia National Laboratories, December Martorell, W.E. Vesely, and P.K. Samanta, 1990.

November 1991.

, NUREG/CR-4598, "A User's Guide for

, NUREG/CR-5813, " Integrated Reliability the Top Event Matrix Analysis Code (TEMAC),"

and Risk Analysis System (IRRAS) Version 4.0:

R.L. Iman and MJ. Shonencarier, August 1986.

Reference Manual," Vol.1, K.D. Russell, M.K.

March 1998 8-7 NUREG-1521 l

l

References McKay, M.B. Sattison, N.L. Skinner, S.T. Wood, 1965, Her Majesty's Stationery Office, London, and D.M. Rasmuson, January 1992.

1985.

. SECY 83-269," Fire Protection Rule for Wakamatsu, T.," Development of Design System Future Plants," July 5,1983.

for Building Fire Safety," pp. 881-898 in Proceedings of the Second International

, SECY 93-028, " Institutionalization of Symposium on Fire Safety Science, Hemisphere Requirements Marginal to Safety," February 5, Publishing Corp., New York,1989.

1993.

Walton, G.,

"CONTAM 93 User Manual,"

, SECY 93-143, "NRC Staff Actions to NISTIR 5385, National Institute of Standards and Address the Recommendations in the Report on Technology, Gaithersburg, Maryland, March the Reassment of the NRC Fire Protection 1994.

Program," May 21,1993.

Walton, W.D., K.B. McGrattan, and J.V. Mullin,

, SECY 93-167, " Regulatory-Analysis

" ALOFT-PC: A Smoke Plume Trajectory Model Guidelines of the U.S. Nuclear Regulatory for Personal Computer," pp. 987-997 in Commission," June 14,1993.

Proceedings,19* Arctic and Marine Oilspill Program (AMOP) Technical Seminar, Vol. 2,

, SECY 94-090, " Institutionalization of Environment Canada, Ottawa, Ontario,1996.

Cor.tinuing Program for Regulatory Improvement," March 31,1994.

Zukowski, E.E., T. Kubota, and B. Cetegen.

"Entrainment in Fire Plumes," Fire Safety United Kingdom," Housing and Building Control Journal, Vol. 3, pp.107-121,1980/1981.

Act of 1984," Statutory Instrument (SI) 1985, No.

I NUREG-1521 8-8 March 1998

L l.'

l Appendix A RZVIEW OF FIRE PROTECTION LITERATURE i

CONTENTS l

Pace A.1 INTRODUCTION.............................

A-1 A.2 INTERNATIONAL PROGRAMS FOR RESIDENTIAL AND COMMERCIAL FIRE CODES..............

A-1 A.3 CONCLUSIONS..........................

.... A-10 A.4 BIB LIOG RAPHY.............................................

.... A-l l Figures A.1 Outline of Fire Engineering Design Procedure

... A-3 A.2 A Risk Assessment Submodel...................

.. A-4 A.3 The Japanese Evaluation Procedure......

... A-6 March 1998 A-iii NUREG-1521

APPENDIX A REVIEW OF FIRE PROTECTION LITERATURE A.1 INTRODUCTION eventually to performance-based codes for general use. The performance-based New Zealand code is A number of countries are developing, or already already the only official code in that country. The have adopted, performance-based fire codes. One Japanese effort is a major project for the Ministry of the benefits is designs to achieve fire safety that of Construction and the Building Research are better or less expensive than prescriptive Institute.

Details of the performance-based codes. Generally the goal is " equivalency" with methodology are being finalized during the design the prescriptive code, although it is realized that, of major Japanese govemmental facilities.

in most cases, the effectiveness of the existing code is not known. Where possible, designers If good data on fire losses exist, the performance using performance-based methods are instead codes are tested against those data. If the data do basing designs on qualitative " objectives" and not exist, the calculations are tested against quantitative " requirements." Expenise to confirm calculated fire safety in buildings built to the that these goals have been met exceeds the existing codes, which are assumed to provide an qualifications of people involved in traditional acceptable degree of fire safety. As a result, the code enforcement. The Japanese Ministry of necessity of quantifying fire safety with such Construction, in the forefront of this effort, uses sensitive concepts as the value of human life is panels of experts and local officials to review precluded.

performance-based designs submitted for approval. In New Zealand, an aggressive effort is Performance codes require that the fire safety under way to enhance what code officials know.

design be tested against a set of criteria and scenarios which depend on the occupancy class of Performance-based design is now feasible because the structure. So there are differences in the of the state of the art of fire prediction rooms, ventilation, ignition sources, and calculations, probabilistic risk assessment (PRA) framework for analysis, as well as differences in i

techniques, and plant experience for ignition and the criteria for success. On the other hand, there j

suppression probabilities. This is illustrated in are many similarities, such as the mathematical one reference (Bateman et al.,1993), which models available for use, fire growth curves, and utilizes many of the techniques required for the concepts of hazard and risk. In this appendix, performance-based design to update PRAs of two the methodologies being developed for existing nuclear power plants, performance-based regulation of residential and commercial occupancies in various countries are Most of the references chosen for this review presented.

were published between 1989 and 1996, illustrating the modern surge of intnest in and A.2 INTERNATIONAL PROGRAMS capability of performance-based fire safety FOR RESIDENTIAL AND design.

COMMERCIAL FIRE CODES This introduction borrows heavily frc.m Bukowski Each country discussed below has a single (1993) in the Interflam 1993 Conference, held at national fire code and an organization to maintain Oxford University, March 30 through April 1, it, and has initiated the process of utilizing 1993. Many countries, especially the United performance-based design methods.

States, Japan, Aumlia, Canada, New Zealand, the United Kingdcm, Sweden, and Fmland, are New Zealand developing detailed methodologies which could be used to evaluate the safety (and thus the code Buchanan (1993) describes a new performance-equivalency) of innovative building designs.

based code introduced in New Zealand. The code These methodologies will initially supplement the requires specific fire engineering design for existing codes and will be used in innovative certain buildings and permits it as an option for all construction projects.

Success will lead March 1998 A-1 NURE'.",

Review of Fire Protection Literature buildings. As with other performance codes, th'e The ability of a design to continue to satisfy, New Zealand code was designed to given changes in the use of the structure,is known as " durability." Recognizing this problem, the (1) state its objectives clearly New Zealand code places a 10-year limit on the (2) specify performance requirements legal liability of the designer (Hunt, 1996).

(3) permit any solution that meets the Insurance companies are developing 10-year performance requirements insurance plans.

There is an important trr.deoff between accuracy A substantial educational effort is being and simplicity in the design process.

A implemented in New Zealand comprising a complicated code may give an illusion of accuracy periodic 5-day workshop and the establishment of that cannot be achieved. The New Zealand code a 1-year master of engineering degree at the is a major step in the right direction; it has University of Canterbusy, the latter for those who excellent structure but does not specify aheady have a relevant bachelors engineering quantification of performance or safety.

degree.

The 1991 New Zealand Building Act is concemed Australia and Canada with the health and safety of building occupants, These two countries are discussed together covering structural stability, access, user safety, because of the close coordination between their services, and facihties. Secondary concerns are professional staffs in the development of energy efficiency, fire fighting access, and the performance code methodology. Beck (1991) prevention of fire spread to other buildings. There describes the joint effort. This initiative is more are no controls on fire spread or damage within complicated than the New Zealand method, and the fire building.

has not yet been implemented. The method utilizes as a framework a central risk assessment The code uses a five-level structure:

model (FIRECAM) that evaluates quantitative information from six submodels as shown in Figure A.2.

(2) functional requirements (3) pufonnance A level of redundancy is required so as not to rely (4) verification method solely on a single component or subsystem, but (5) acceptable solution too much redundancy would be too costly. In a r cent Paper, Thomas and Bowen (1998) comment The first three are mandatory; the last two can that since " performance is somenmes impossible reference existing standards. Each fire must be to quantify, the code should be known as an analyzed in four categories:

" objective-based" code. Canada plans to publish

" intent" statements in 1998, and an objective-(1) outbreak of fire based code in 2001. A limitation is the maturity (2) neans of escape of technology, including calculation of fire (3) spread of fire growth, flame spread, combustibility of materials, (4) structural stability during fire and the use of models. Then it takes time to incorporate current knowledge into design.

A design guide to provide guidance to those Simple equations are likely to be adequate in making or reviewing specific designs to meet the many cases, rather than using complete models, code is being produced by a " study group " The overall strategy of the design guide is shown in The central FIRECAM uses event tree Figure A.I.

formulation; the timing from one event to another NUREG-1521 A-2 March 1998

Review of Fire Protection Literature l

DETERMINE GEOMETRY, ESTABLISH CONSTRUCTION, AND USE PERFORMANCE OFTHE BUlLDING REQUIREMENTS 1 r ESTIMATE MAXIMUM LIKELY FUEL LOADS 1 r ESTIMATE MAXIMUM LIKELY NUMBER OF OCCUPANTS ANDTHEIR LOCATIONS 1 r ASSUME CERTAIN FIRE PROTECTION FEAtt c',ES 1 r CARRY OUT FIRE ENGINEERING ANALYSIS MODIFY FIRE SAFETY FEATURES 1 r J k ACCEPTABLE PERFORMANCE NO YES 3 7 ACCEPT DESIGN (Source: Buchanan,1993. Reproduced by permission of author)

Figure A.1 l

Outline of Fire Engineering Design Procedure March 1998 A-3 NUREG-1521 L.

Review of Fire Protection Literature FIRE SMOKE DE'!ELOPMENT SPREAD SUBMODEL SUBMODEL FIRE RISK OCCUPANT SPREAD ASSESSMENT 4-COMMUNICATION 1

I SUBMODEL SUBMODEL SUBMODEL FIRE BRIGADE OCCUPANT COMMUNICATION AVOIDANCE SUBMODEL SUBMODEL Source: Beck,1991; reproduced by permission of author, Figure A.2 A Risk Assessment Submodel is supplied by the submodels. Two parameters are (1) The Building Fire Safety Model (Worcester used: the " expected risk to life" (ERL), that is, Polytechnic Institute, Worcester, fatalities over the expected life of the building, Massachusetts) and " fire-cost expectation" (FCE), that is, the aggregate of all costs over the life of the building.

(2) Building Code Assessment Framework (M.

ERL must be at least as good as the value from the Katzin et al., ASTM STP 1150 (1990) pp.

prescriptive code, and FCE must be less.

234-237)

Various available calculational codes are used in (3)

..T Fire Risk Assessment Model the submodels as applicable, but the authors have (riAZARD I) in some cases developed their own to increase speed and reduce calculating costs.

The (4) NRCC Fire Risk-Cost Performance parameters calculated and computer codes used in Assessment Model (National Research each of the submodels are described in the Council of Canada, Ottawa, Canada) reference. If a calculational model or data is not available, expert opinion is used. To date, The authors rejected the first approach because it calculations give estimates of risk to life safety remains probabilistic. The second was rejected that are significantly higher (worse) than values because it relies on historical data when the obtained by analysis of historical records.

specific data on innovative designs are not available, and it uses Delphi panels. Number 3 is Two recent papers on the Canadian method are not applicable to structural changes or to this type presented in Interflam 93, the Sixth Intemational of constmetion, so it was rejected. Number 4 was Fire Conference. Cornelissen et al. (1993) chosen because it minimizes the use of subjective consider four ways to look at the code input data. It is a systems approach using fire equivalency of three-story nonresidential, wood dynamics, building design, active and passive fire frame buildings. The buildings have 45-minute, safety features (and the cost of maintaining the 25-minute,10- minute, or 10-minute cadurance active ones), and human behavior. Building codes with sprinklers; 45 minutes is the code are used as the reference level of safety.

I requirement, but 10 minutes with sprinklers turns out to be much better. The four ways are Yung et al. (1993) also describe the use of the National Research Council of Canada (NRCC)

NUREG-1521 A-4 March 1998

Review of Fire Protection Literature Fire Risk-Cost Performance Assessment Model to Grubits (1993) repons comprehensive, specific evaluate various fires with door open/ closed and plans for performance-based fire regulation l

people awake / asleep, and compares various code-reform in Australia. Although 70 percent of the l

compliant designs. Cost was not evaluated in this Australian building code is fire related and it was l

study. Using the NRCC method, Yung determined recognized in 1989 that fire regulation reform was i

that a 1-hour wood frame building with a central needed, lack of funding prevented change. It is alann system connected to the fire department, expected that $0.5 million (or more) (Australian I

with or without sprinklers, is better than masonry dollars) per year will now be made available for without the active features.

the development of new, more flexible regulatory provisions. A 1-percent savings in building costs The NRCC model uses statistical data on fire is expected, corresponding to savings of $370 stans and time of start (awake / asleep). The model million (Australian dollars) per year. A risk then calculates fire growth, smoke spread, and assessment methodology will be used, with detector and sprinkler actuation. The fire is acceptable values of risk to life obtained by tmncated when the sprinkler actuates or the fire evaluating reference buildings. New material test brigade arrives. The egress time available is methods will be specified in which the data can be calculated as hazard time minus alann time. Yung used in performance calculations. Preference will considered six design fire (smoldering, flaming, be given to the latest generation of International flashover) times (door open, door closed). When Standards Organization (ISO) tests such as use of sprinklers activated, some of the flashover and the cone calorimeter.

flaming fires were rendered non-lethal. The worst situation is when the fire flashes over and the In a recent paper, Allen, Grubits, and Quaglia occupants are asleep.

(1998) comment that experience shows that the regulatory authorities need to participate in the The following models are used in the NRCC Fire evolution of performance-based codes, and that j

Risk-Cost Performance Assessment Model:

the cost savings in using such codes averages 5-6 percent of the cost of the building. In one (1) smoke movement model, which calculates building, in Brisbane, the saving was 8 percent.

time to untenable conditions at various places Richardson et al. (1993) describe the Canadian (2) fire detection model, which calculates smoke Building Code Assessment Framework for detector and sprinkler activation time and evaluating proposed code changes. It has two flashover time main parts: the Code Analysis Component and the Impact Analysis Component. The latter (3) occupant warning and response model, with contains a set of computational procedures and probability of warning from model 2 several sets of databases. The key computational procedure is based on a risk tree. At present, the (4) fire brigade action model Delphi technique is used to assign the probabilities to the risk tree branches. A massive (5) smoke hazard model support effort is needed to maintain this system.

(6) evacuation duration model, which calculates Richardson et al. suggest that, for the near future, the time to get all the people out parallel code paths be undertaken with a performance path for more demanding buildings (7) egress model and a prescriptive path for less complex buildings, such as housing. The 1995 National Building l

(b) boundary element model (wall endurance Code of Canada will be produced with a mixture between compartments) of prescriptive and performance requirements, and it is hoped a performance-based code will be (9) fire spread model based on model 8 and the produced by the year 2000.

fire brigade to estimate property loss March 1998 A-5 NUREG-1521

Review ofFire Protection Literature Prevention of fire spread to other buildings Japan According to Bukowski (1993), the Japanese A schematic diagram of the structure of the system is described in four volumes published in Japanese evaluation procedure is shown in Fig-1988 (in Japanese). The volumes consider ure A3. Wakamatsu (1989) describes the J8Panese effort in detail.

smoke control and evacuation safety

+

The Ministry of Construction organized a 5-year prevention of the outbreak and development research program in 1982 to develop a g7 g ~

performance design system. The effort inchided Professional staff from the Ministry, the Building fire resistance of the building structure

+

Research Institute (BRI), and two nonprofit SMOKE CONTROL PREVENTION OF FIRE RESISTANCE FIRE SAFETY

)

AND EVACUATION OUTBREAK AND OF BUILDING OF DWELLING SAFETY DEVELOPMENT STRUCTURE (CITY FIRE OF FIRE PREVENTION)

IGNITION AND l NOTE: THINLY UNED BLOCKS: PREDICTION" COMBUSTION BEHAVOR PROCEDURES OF MATER &ALS EXPOSED TO HEAT SOURCES THlCKLY LINED BLOCKS:" EVALUATION" g

BASED ON THE " FUNDAMENTAL REQUIREMENTS" PREVENTION OF OUTBREAM AND RAPID PROPAGATION OF FIRE I

EVACUATION HEAT GENERATION AT BEHAVIOR THE EARLY STAGE OF FIRE FIRE SUPPRESSION EFFECT OF SPRINKLER TOXICITY OF CCMBUSTON PRODUCTS I

SMOKE FIRE GROWTH AND HEAT LOAD TO MOVEMENT BEHAVIOR ATTHE FIRE NEIGHBORING IN ROOM OF DEVELOPED STAGE TE W ERATURg BUltDINGS FIRE ORIGIN OF FIRE IN ORGIN (OR DWELUNGS)

I I

GNITABluTY OF SMOKE FfRE SPREAD FROM TEM'ERATURE OUTSIDE MOVEMENT ORIGIN TO OTHER OF STRUCTURAL COMPONENTS OF FROM ORGIN SPACES (TO UPPER MEMBERS NEGHBORING BLDOS TO OTHER FLOORS OR (SURROUNDING SPACES ADJOINtNG SPACES)

COMPONENTS OF ORIGIN STRESS INTENSITY, DEFORMATION SECURITY OF OF STRUCTURAL FIRE SPHEAD TO EVACUATION SAFETY MEMBERS NEGHE ORING BLDGS I

STRUCTURAL DAMAGE I

PREVENTION OF SERIOUS PREVENTON SOCIAL TROUBLES OF CITY FIRE SECURITY OF FIRE FIGHTING ACYIDT*<" S Source: Bukowski,1993. Reproduced by permission of author.

Figure A.3 The Japanese Evaluation Procedure NUREG-1521 A-6 March 1998

Review of Fire Protection Literature Review ofFire Protection Literature organizations. More than 100 experts on fire

" Subjects of Predictive Methods for Fire Safety research and engineering, architects, and people in Design." The list, taken from Wakamatsu (1989),

related professions served on the committees.

names the fire, smoke, and structural effects that should be considered in a complete fire safety The purpose of this program is to develop a performance evaluation of a major occupied national evaluation method for fire safety in structure. NRC concerns for fire safety in nuclear buildings, rather than further improvement in fire power plants would encompass only selected safety. The Japan Building Standard Law is the subjects from this table.

appropriate level of fine safety. Specifications for the performance methods were decoded from Because of the wide range of expertise needed to specific articles of this law. The objectives of the deal with the broad range of fire safety concems law are listed, the Japanese organized five separate committees to develop the methodologies needed.

(1) prevention of fire outbreak Their responsibilities are detailed and the design (2) human safety in fire procedure trees of four of them are presented in (3) prevention of"public troubles" the Wakamatsu paper.

(4) prevention of propeny losses The methodology has actually been applied (as it An example of "public troubles" would be buming has evolved) to major structures planned in Japan.

down a neighborhood or interfering with another One of these is a " National Theater" (56,000 m2 tenant in the building.

(603,00 ft ) with three auditoriums, stores, and 2

other features similar to the Kennedy Center in Provisions for fire fighting and fire brigade Washington, D.C.).

The Japanese found they accessibility to a building are also taken as basic could use wood lining in the ballet and opera requirements. Fire f:ghting is required and is also theaters, which is not allowed under the expected to work as a " trump" when other prescriptive Building Standard Law.

measures do not control a fire.

Performance calculations are allowed under an The framework used to organize and document equivalency clause in the Japanese National Fire the approach and solution for each problem aree Code, but local code officials can have difficulty of fire protection engineering basically comprises deciding whether a performance design is indeed the following:

" equivalent." When these questions arise, the Ministry of Construction is consulted. The i

(1) fundamental requirements Ministry assembles a panel, consisting of people from its own staff, the Building Research Institute (2) technical standards for engineering (BRI), universities, and the affected local evaluation officials, to review the performance calculation and approve or disapprove.

(3) prediction method of relevant fire phenomena As previously mentioned, the Bukowski and Brabauskas (1994) paper presents as appendices (4) concepts of testing methods translations of the tables of contents of the four volumes of the Japanese report. The technical These, allowing for translation, are parallel to the summary was translated into English by its author, steps developed by Gross et al. (1975) at NIST for a prominent Japanese modeler, Dr. Takeyoshi performance-based regulation in building Tanaka (1989). Article 38 of the Japanese construction, and proposed by NIST as a Construction Code allows " equivalency" in l

framework for nuclear power plant fire safety.

designing safety features, so the four-volume set 1

is known as the " equivalency" report. Tanaka and Subjects of the proposed predictive methods (number 3 above) are in the list that follows:

March 1998 A-7 NUREG-1521

Review ofFire Protection Literature Subjects of Predictive Methods for Fire Safety Design

1. Combustion and fire behaviors 1.1 Ignition of combustible materials 1.2 Behavior of turbulent diffusion flame 1: Flame height 2: Temperature and velocity on axis of turbulent diffusion flame and fire plume 3: Amount of smoke included in turbulent diffusion flame and buoyant flow 4: Radiative energy from turbulent diffusion flame 1

1.3 Formation of smoke layer and ventilation l.4 Heat transmission at early stage of fire 1: Spread of burning area at early stage of fire 2: Radiative heat transfer to surroundings 3: Convective heat transfer to ceiling, wall, floor, and other surfaces exposed to fire 1.5 Flame spread 1: Velocity of upward spread of flame on vertical surface 2: Velocity of steady-state spread of flame on surface with arbitrary heat flux distribution 3: Vebcity of steady-state spread of flame on surface receiving constant heat flux 1.6 Effectiveness of automatic sprinkler 1: Response time of fire extinction equipment 2: Time required for fire suppression 3: Properties of fire extinguishing equipment 1.7 Burning behavior at developed stage of fire 1: Standard fire temperature prescribed in the enforcement order of the Building Standard Law 2: Models by Ingberg, Kawagoe, Magnusson, Babrauskas, Harmathy, etc.

1.8 Fire spread between buildings 1: Fire spread due to radiative heat transfer 2: Standardization of heat condition 3: Behavior of external flames 4: Behavior of flame rising up from a burning structure

2. Smoke movement and smoke control 2.)

Single layer models 1: Steady-state model for multiple compartments on multiple floors 2: Unsteady-state model for multiple compartments on multiple floors 2.2 Two layer model 1: Unsteady-state model for multiple compartments on single floor 2.3 Simplified model for evaluating smoke control systems

3. Evacuation behavior 3.1 Model of evacuee (properties, distribution, velocity of evacuees) 3.2 Model of evacuation spaces or routes (room, path, stairs, hall, vestibule, lines, and crowding) 3.3 Model of evacuatbn behavior 1: Start time of evacuation 2: Evacuees' movement in a unit space 4.

Fire resistance of building structure 4.1 Fire temperature as heat load to the structure (which is given on the basis on the line 1.7 " burning behavior at developed stage of fire")

4.2 Temperature of structural members 1: Model for reinforced-concrete members (one/two dimensional heat flow) 2: Model for steel structural members 3: Model for assembled structural members (for example, a structure assembled by reinforced-concrete slab and steel beams) 4.3 Thermal stress and deformation 1: Model for reinforced-concrete members 2: Model for steel structural members 3: Model for assembled structural members

5. Fire safety performance of dwellings 5.1 Evaluation safety performance for evacuation safety in dwellings 1: Evaluation of difficulty for evacuation 5.2 Evaluation model for performance of fire prevention Source: Wakamatsu,1989. List reproduced with permission of author.

NUREG-1521 A-8 March 1998

Harada (1998) have participated in an the Japanese. The designers, any consultants, and intemational " case study" in which the the local regulators work together from the participants designed (using three different inception of a project. The group decides on the methods) a four-story office building with an goals and requirements, the computer programs, atrium: (1) according to their prescriptive code, and other methodology to be used to solve each (2) according to a performance method, with problem. The group continues to work together as detectors and no sprinklers, and (3) with the project proceeds. The computer program most sprinklers and no detectors. The work required frequently used is a multiroom zone model 375 person-days, 225 for design and 150 for developed in Japan, BRI-2.

verification to Japanese standards. They did not use a complete computer model, but used simple S.E. Magnusson (1993) prepared one of the most mathematical correlations because the architects comprehensive papers combining classical on the team were not comfortable with the probability analysis with fire modeling. The computer models.

introduction to his paper discusses concepts, lists ISO documents circa 1985, and concludes that, In the performance-based designt they found they although progress in performance quantification is could remove limitations on the size of the fire being made, the ISO documents are not state of compartment, and some walls could be lighter the art.

than standard. They needed to increase the height of the atrium and provide water curtains for the S.E. Magnusson states, " Fire risk calculation glass atrium walls. They also found that, in a few comprises a wide range of deterministic and instances, the prescriptive design was inadequate.

probabilistic methods; Chapter 4 of the SFPE However, they fe't that for this ordinary building,

[ Structural Fire Protection Engineering]

the effort for the performance-based design was Handbook gives an excellent review. In this paper not worthwhile.

we will describe only two possible approaches:

the first a demand-supply, reliability-based

1. Nakaya (1993) presents an outline of the methodology originally developed for structural Japanese plans for the future. The Japanese engineering design, the second an event tree logic Building Research Institute has just started a new extensively used in chemical industry quantitative 5-year program on fire testing methods for risk analysis (QRA)."

i materials and stmetures that will meet the performance criteria. The new program will also This statement is followed by a very terse make contributions to the international presentation of reliability theory and QRA-based l

" harmonization" of testing and assessment design.

Parameter uncertainty analysis is l

procedures, so that the same products and described as follows:

procedures will be acceptable in many countries.

l These will be comprehensive and may help (1) List all parameters that are potentially i

industry to develop new types of products and important contributors to uncertainty in designs and allow engineers increased freedom in model prediction.

l fire safety design.

l (2) Specify the maximum range of each Nordic Countries parameter.

As can be seen from the list of references at the end of this appendix, a number of papers come (3) Subjectively adjust a probability distribution fro a symposium held at Espoo, Finland, in to the maximum range.

August 1993. The Nordic countries are cooperating in the development of a performance-(4) Derive quantitative statements about the based fire code that will eventually be adopted by effect of parameter uncertainty on model each country (personal communication from Matti prediction.

Kokkala, Fire Technology Laboratory, Technical Research Center of Finland, Espoo, September 29, (5) Rank the parameters with respect to their 1993).

The technique for design and for contribution to the uncertainty in model regulation is much less formal than that used by Prediction.

March 1998 A-9 NUREG-1521

Review of Fire Protection Literature Steps 1-3 require an expen with a complete Committee W14:

understanding of the model and the underlying database. In Magnusson's opinion, prospects for (1) Engineering Evaluation of Performance-applying fire safety engineering principles seem Based Systems-Chm.: R. Bukovsky, USA good on the component or subsystem level, and continued rapid development is expected.

(2) Verification of Computer Codes for Problems will arise when discussing to what Predicting Fire Development and Smoke extent accepted performance of all involved Movement-Chm.: Keski-Rahkonen, subsystems amounts to acceptance of the whole Finland building. He feels that a performance-based code at the whole-building level is probably more than (3) Thermal Response of Stmetures-Chm.:

5 years away. Much more work needs to be done Wickstrom, Sweden in the following areas:

(4) Laboratory Calibrations and completeness of analysis (identification of Measurements-Chm.: Hasemi, Japan all significant event sequences)

The following two new subgroups may be formed:

treatment of uncenainty Quantification of Uncertainty-Chm.:

relation between prescription and-Magnusson, Sweden performance-based parts of the code Codes for Fire Resistance in He lists a number ofitems for which preparatory Buildings-Chm.: Kruppa, France.-

work is being done for international pre-standardization and standardization.

W14 is carrying out a round-robin, currently on simple problems, to compare the results with Magnusson (1998) continues to pioneer in the 13 different fire models. Early results vary by a field o developing means to conven " hazard" to factor of 2.

r "ri&.

ISO Technical Committee 92, Subcommittee 4 Currently he is deriving safety factors (or (ISO /TC92/SC4), " Fire Safety Engineering," has uneenainty factors) for risk assessment by a the goal of developing reports containing the method called "First Order--Second Moment" framework for cost-effective, safe, environmentally analysis.- He creates an n-dimensional " failure benign, fire safety design. ISO does no research; surface" by a Monte Carlo series of calculations, instead its committees are weighted toward the

. then obtains indices for the relevant variables.

regulators, fire brigades, building designers, These are used to derive safety factors.

constructors, building managers, and insurers (Becker, 1998). ISO will also evaluate and International coordination activities on validate computational models.

performance-based fire safety design are proceeding under two organizations, the A.3 CONCLUSIONS International Council for Building Research and Development (CIB) and the International There is effon worldwide in utilizing the existing Standards Organization (ISO). CIB has created capability to predict fire and smoke spread and to four subgroups under Committee W14 to provide calculate the resulting hazards in performance-a strategic overview of fire technology needs over based fire codes. Generally, the degree of safety the next 10 years (Kokkala,1998). W14 has more desired is based on equivalency with the existing than 50 members from 30 countries, and organizes prescriptive codes, although it is recognized that, workshops open to all interested persons.

in some cases, improved safety could be attained.

Most developed countries, other than the United The following are the four subgroups under States, have national fire codes and governmental NUREG-1521 A-10 March 1998

Review of Fire Protection Literature organizations to administer them, simplifying the

Becker, W.,

"ISOfrC92/SC4 Fire Safety accommodation of political and policy changes.

Engineering-Present Activities and Future The Japanese Ministry of Construction, with help Strategy," Proceedings of the International from the Japanese Building Research Institute and Conference on Performance-Based Codes and universities, has extensive efforts.

Fire Safety Design Methods, Ottawa, Canada, September 1996, Society of Fire Protection Experience indicates that it is more difficult to Engineers, Bethesda, Maryland,1998.

develop and regulate performance-based designs than to use prescriptive codes. The performance-Buchanan, A.

H., " Fire Engineering for a based process requires more technical expertise Performance-Based Code," Proceedings of the and analyses. The qualitative requirements, the Sixth International Conference on Fire Safety, quantitative criteria to meet these requirements, Interscience Communications Limited, London, and finally, the method of evaluating whether the 1993.

criteria have been met must be developed. In general, one must examine the effects of a number Bukowski, R., "A Review of International Fire of fires of the largest feasible size in each of Risk Prediction Methods," Proceedings of the several feasible locations to see if the selected fire Sixth International Conference on Fire Safety, protection provisions will provide safety. In order Interscience Communications Limited, London, to verify the design, records or commentary is 1993.

{

needed at each step. Most authors feel they can calculate. the hazard created by a design, but not Bukowski, R., and V. Babrauskas, " Developing the rist Because of uncertainties, factors of Rational Performance-Based Fire Safety safety should be applied to the results of the Requirements in Model Building Codes," Fire design. These are related to risk.

and Materials, Vol.18, No. 3, pp.173-191, May/ June 1994.

A.4 BIBLIOGRAPHY l

I Bukowski, R., and T. Tanaka, "Toward the Goal Allen, H., S. Grubits, and C. Quaglia, " Reflections of a Performance Fire Code," Fire and Materials, on Ten Years of Fire Safety Engineering in Vol.15, No. 4, pp.175-180,0ctober-December Australia," Proceedings of the International 1991.

Conference on Performance-Based Codes and j

I Fire Safety Design Methods, Ottawa, Canada, Bukowski, R.W., " Setting Performance Code September 1996, Society of Fire Protection Objectives-How Do We Decide What Engineers, Bethesda, Maryland,1998.

Performance the Codes Intend," p. 555 in Proceedings of Interflam 96, The Seventh l

Bateman, K., W. Parkinson, S. Oh, and J. Haugh, International Fire Science and Engineering "The Impact of Updated Fire Events Data and Conference, Cambridge, England, March 1996.

Modeling Techniques in the Electric Power Research Institute Fire PRA Method on Two Comelissen, A.A., G.V. Hadjisophocleos, and D.

Nuclear Power Plant Fire Risk Studies," Science Yung, " Risk-Cost Assessment for Non-Residential Applications International Corp., Los Altos, Buildings," pp. 427--435 in Proceedings of California,1993.

Interflam 93. The Fourth International Fire Science and Engineering Conference, Interscience Beck, V.R., " Fire Safety System Design Using Communications Limited, London,1993.

1 Risk Assessment Models: Developments in Australia,." International Association for Fire Gross, J.G., et al., " Interim Performance Criter;a Safety Science, pp. 46-59 in Proceedings of the for Solar Heating and Combined Heating / Coning 3rd International Symposium (G. Cox and B.

Systems and Dwellings," prepared for Department Langford, eds.), Elsevier Applied Science, of Housing and Urban Development by National Loadon and New York,1991.

Bureau of Standards, U.S. Government Printing Office, Washington, D.C., January 1975.

March 1998 A-11 NUREG-1521

)

J Review of Fire Protection L.iterature

Grubits, S.J.,

" Fire Regulation Reform in National Fire Protection Association," HAZARD Australia," Nordic Fire Safety Engineering I," Quincy, Massachusetts Symposium, Espoo, Finland, September 1993, i

, Life Safety Code, Quincy, Massachusetts.

Hunt, J. H., " Performance-Based Codes: The New Zealand Experience," Proceedings of the Inter-National Institute of Standards and Technology, 1

national Conference on Perfonnance-Based Codes

" Interim Performance Criteria for Solar Heating and Fire Safety Design hieshods, Onawa, and Combined Heating / Cooling Systems and Canada, September 1996, Society of Fire Dwellings," U.S. Government Printing Office, Protection Engineers, Bethesda, Maryland,1998.

Washington D.C., January 1,1975.

Katzin, M., et al., " Fire Hazard and Fire Risk Richardson, J.K., I. Oleszkiewicz, and D. Yung, Assessment," STP 1150, American Society for "Toward a Performance Fire Cooe in Canada,"

Testing and Materials, Philadelphia, Nordic Fire Safety E.-gineering Symposium, Pennsylvania, pp. 234-237,1990.

Espoo, Finland,1993.

Kokkala, M., "CIB W14 Activities to Promote Tanaka, T., "A Performance-Based Design for Performance-Based Fire Safety Design,"

Fire Safety in Buildings," pp. 151-175 in Fire Proceedings of the International Conference on Safety and Engineering: International Symposium Performance-Based Codes and Fire Safety Design

Papers, Warren Center for Advanced Afethods. Ottawa, Canada, September 1996, Engineering, University of Sydney, Australia, Society of Fire Protection Engineers, Bethesda, 1989.

Maryland,1998.

Tanaka, T., and K. Harada, "A Case Study Using Magnusson, S.E., " Performance-Based Codes,"

the Performance-Based Design System in Japan,"

pp. 413-425 in Proceedings ofInterflam 93, The Proceedings of the International Conference on Fourth International Fire Science and Performance-Based Codes and Fire Safety Design Engineering Conference, Interscience hiethods, Ottawa, Canada September 1996, Communications Limited, London,

1993, Society of Fire Protection Engineers, Bethesda, Bethesda, Maryland,1998.

Maryland,1998.

Magnusson, S. E., "How to Derive Safety Factors,"

Thomas, R., and R. Bowen, " Objective-Based Proceedings of the International Conference e t Codes: The Canadian Direction," Proceedings of Performance-Based Codes and Fire Safety Design the International Conference on Performance-Afethods, Ottawa, Canada, September 1996, Based Codes and Fire Safety Design hiethods, Society of Fire Protection Engineers, Bethesda, Ottawa, Canada, September 1996, Society of Fim Maryland,1998.

Protection Engineers, Bethesda, Maryland,1998.

Meacham, Brian J., " Performance-Based Codes Wakamatsu, T., " Development of Design Syn m and Fire Safety Engineering Methods:

for Building Fire Safety," pp. 881-898 m Perspectives and Projects of the Society of Fire Proceedings of the Second International Protection Engineers," Proceedings of the Symposium on Fire Safety Science, Hemisphere International Conference on Performance-Based Publishing Corp., New York,1989.

Codes and Fire Safety Design hiethods, Ottawa, Canada, September lb6, Society of Fire Yung, D., G. Hadjisophocleos, and H. Takeda, Protection Engineers, Bethesda, Maryland,1998.

" Comparative Risk Assessment of 3 Story Wood Frame and Masonry Construction Apartment Nakaya, I., "Our Activities Toward Performance-Buildings," pp. 499-508 in Proceedings of Based Fire Regulation in Japan," Proceedings of Interflam 93, The Founh International Fire the Nordic Fire Safety Engineering Symposium, Science and Engineering Conference, Interscience Espoo, Finland,1993.

Communications Limited, London,1993.

NUREG-1521 A-12 March 1998

1 l

l l

Appendix B CONTRIBUTION OF FIRE TO FREQUENCY OF CORE DAMAGE IN OPERATING NUCLEAR POWER PLANTS: A DATABASE l

1 i

t L.

l ll.

1 I

l L

CONTENTS Paze B.1 INTRODUCTION................................................................ B-1 B.2

SUMMARY

REVIEW OF SITES WITH FIRE ANALYSES........................... B-1 B.3 DETA1T Fn REVIEW OF A BOILING-WATER REACTOR FIRE PRA................. B-3 B.3.1 Intemal Events........................................................ B -3 B.3.2 External Events....................................................... B-3 s

B.3.3 -

Conclusi on.......................................................... B -9 B.4. DETATI Fn REVIEW OF A PRESSUR17Fn-WATER REACTOR FIRE PRA............ B-9 B.4.1 Intemal Events..................................................... B-9 i

B.4.2 Extemal Events..................................................... B-9 l

B.4.3 Concl usion...................................................... B - 14 B.5 REFERENCES.............................................................. B-14 Tables B.1 Plant Core-Damage Frequency (CDF)............................................ B-2 B.2 Dominant Peach Bottom Fire Area Contributors to CDF.............................. B-4 B.3 Dominant Accident Sequence Contributors to CDF................................... B-4

- B.4..

Control Room Fire Scensrio 1-Factors and Distributions........................... B-7

' B.5 Control Room Fire Scenario 2-Factors and Distributions............................ B-7 B.6 Emergency Switchgear Rooms Fire Scenario-Factors and Distributions................ B-8 B.7 Dominant Suny Fire Area Contributors to CDF................................... B-10 B.8 Dommant Accident Sequence Contributors to CDF................................. B-10 B.9 Auxiliary Building Fire Scenario-Factors and Distributions........................ B-11 B.10 Cable Vault / Tunnel Fire Scenario-Factors and Distributions........................ B.12 l

B.11 - Control Room Fire Scenario-Factors and Distributions............................. B-13

(

B.12 Emergency Switchgear Room Fire Scenario-Factors and Distributions................ B-14 1

i-t I

i 1

March 1998 B-iii NUREG-1521

APPENDIX B CONTRIBUTION OF FIRE TO FREQUENCY OF CORE DAMAGE IN OPERATING NUCLEAR POWER PLANTS: A DATABASE B.1 INTRODUCTION

(

the locations at which the impact of fire is more important This appendix describes a database of the contribution of fire to the frequency of core The sites that follow are presented in order of damage in operating nuclear power plants.

descending percentage of fire contribution to Section B.2 presents the database with a summary annual CDF.

review of fire's contribution to core-damage frequency (CDF). Section B.3 presents a detailed Indian Point Unit 2 review of a boiling-water reactor (BWR) whose fire contribution is significant. Section B.4 The total mean CDF for Indian Point Unit 2 is presents a detailed review of a pressurized-water approximately 9.6E-5 per reactor-year.* The reactor (PWR) whose fire contribution is calculated annual CDF due to fire is 6.5E-5, or significant. Section B.5 contains a list of about 68 percent of the total. The impact of fire is references, important in the electrical tunnel, switchgear room, and cable spreading room.

B.2

SUMMARY

REVIEW OFSITES WITII FIPE ANALYSES Limerick Unit 1 The contribution that fire makes to annual CDF is The total mean CDF for Limerick Unit 1 is 4.4E-5 summarized in Table B.I. From this table, it can per reactor-year for all initiators. The total annual readily be seen that fire makes an important contribution to core damage, from all fires in all contribution to CDF at some plants (Limerick and zones, is 2.3E-5 or about 53 percent of the total LaSalle Unit 2).

CDF. All of the three most dominant contributors to CDF are fire-induced sequences. Fires in the This study searched 48 sites (in several cases, two 13.kV switchgear room, the safeguards access plants at the same site are grouped in an area, the control rod drive (CRD) hydraulic in.dividual plant examination (IPE) or.a equipment area, and the general equipment area probabilistic risk assessment (PRA)). Most of the contribute more than 80 percent of the fire-IPEs do not contain a fire analysis, and the only induced CDF.

external event analyzed is internal flooding. From the 48 sites searched,12 have a fire analysis LaSalle Unit 2 In this section, the 12 sites that have fire analyses The total mean CDF for LaSalle Unit 2 is 6.77E-5 are reviewed. Each of the sections that follow per reactor-year.

The estimated annual contains the following information about the site:

contribution to CDF from all fires in all zones is total annual CDF a

total fire frequency contribution to the total

• The Indian Point Unit 2 (IP2)IPE does not contain annual CDF external events analyses. The fire contribuu,on was taken from a report prepared by EG&G (EGG-2660) in 1991. The data in that report were based on a percentage of the total fire frequency a

contribution to the total annual CDF repon prepare'd in the 1980s, and the total CDF was calculated as the CDF from the IP2 IPE (3.13E-5) plus the fire contribution (6.5E-5). The percentage was calculated for this study using these values.

March 1998 B-1 NUREG-1521

Contribution of Fire to CDF: A Database Table B.1 Plant Core-Damage Frequency (CDF)

Fire Contribution Total CDF CDF of Fire to Plant (per RY)

(per RY)

Total CDF Reference Indian Point 2*

9.6E-5 6.5E-5 68 percent Indian Point 2 IPE (Consolidated Edison,1992)

Limerick 1 4.4E-5 2.3E-5 53 percent Limerick PRA (NUS,1983)

LaSalle 2 6.77E-5 3.2E-5 47 percent NUREG/CR-4832, Vol.1 l

Big Rock Point 9.75E-4 2.3E-4 24 percent BRP PRA (Consumers Power (BRP)

Company,1981)

Peach Bottom 1.1E-4 2.0E-5 18 percent NUREG-1150, Vol.1 l

Seabrook 2.3E-4 2.5E-5 11 percent Seabrook PRA (Garrick et al.,

1983) i Zion 6.7E-5 4.6E-6 7 percent Zion PRA (Commonwealth Edison Co.,1981)

Surry 1.96E-4 1.1E-5 6 percent NUREG-1150, Vol. I Oconee 2.5E-4 1.0E-5 4 percent Oconee PRA (Nuclear Safety Analysis Center,1984)

South Texas 4.4E-5 4.9E-7 1 percent STPIPEEE (Cross et al.,1992)

Project (STP)

Catawba 1 and 2 7.8E-5 3.4E-7

< 1 percent Catawba IPEFE (Duke,1992) i l

McGuire 7.4E-5 8.lE-8

< 1 percent McGuire IPEEE (Duke.1991)

• The Indian Point Unit 2 (IP2) does not contain external events analyses. The fire contribution was taken from a report prepared by EG&G (EGG-2660) in 1991. The data in that report were based on a report prepared in the 1980s, and the total CDF was calculated as the CDF from the IP2 IPE (3.13E-5) plus the fire contribution (6.5E-5).

The percentage was calculated for this study by using these values.

3.21E-5. Fires in the control room Division 2 Peach Bottom essential switchgear room, Division 1 essential switchgear room, and auxiliary equipment room Peach Bottonts total mean CDF is 1.1E-4 per 3

contribute more than 93 percent of the fire-reactor-year. The estimated annual contribution 1

induced CDF. Fires and internal initiating events to CDF from all fires in all zones is 2.0E-5, or are of roughly comparable importance in about 18 percent of the total CDF. The impact of detenni..ing the CDF. Fires contribute to about fire is especially imponant in the emergency 47 percent of the total CDF. Six of the ten switchgear rooms, control room, and cable-dominating sequences are fire-induced sequences.

spreading room.

Big Rock Point Seabrook The total mean CDF for Big Rock Point is 9.75E-The total mean CDF as calculated in the Seabrook 4 per reactor-year. The estimated annual PRA is 2.3E-4 per reactor-year. Fire contributes contribution to CDF from all fires in all zones is 2.5E-5, or 11 percent of the total CDF. The impact 2.3E-4, or about 24 percent of the total. The of fire is an important initiator in the control impact of fire is important in the station power room, theprimary component cooling waterpump room and cable penetration area within the area, turbine building, and cable spreading room.

containment.

NUREG-1521 B-2 March 1998 j

Contribution of Fire to CDF: A Detebase Zion McGuire The total mean CDF as calculated in the Zion The McGuire IPE estimated a total mean CDF of PRA is 6.7E-5 per reactor-year. This includes an 7.4E-5 per reactor-year. The calculated annual annual contribution of 4.6E-6 attributable to fire.

CDF attributable to fire is approximately 8.1E-8 Fim sequences compdse approximately 7 percent or less than I percent of the total. Major fire of the total CDF. The impact of fire is important sequences involve the control room or cable room in the auxiliary electrical equipment room and the where fires are assumed to fail the control circuits inner and outer cable-spreading rooms.

of redundant trains of equipment.

Surry B.3 DETAILED REVIEW OF A BOILING-WATER REACTOR Surry has a total mean CDF of 1.96E-4 per FIRE PRA reactor-year. The calculated annual CDF due to fire is 1.1E-5, which is approximately 6 percent of The boiling-water reactor (BWR) plant chosen for the total CDF. Fires in the emergency switchgear a detailed review is Peach Bottom, and the room, main control room, auxiliary building, and resource documents are NUREG-1150 and cable vault and tunnel are important contributors NUREG/CR-4550 (Volume 4, Part 3).

to the fire CDF.

B.3.1 Internal Events Oconee The total mean CDF from internal events is The total mean CDF for Oconee is 2.5E-4 per 4.50E-6 per reactor-year. Station blackout (SBO) reactor-year. The fire contribution to the mean contributes to this value with 2.2E-6, that is 48.9 annual CDF is 1.0E-5 per reactor-year. The fire-induced sequences at Oconee contribute about 4 percent of the total CDF. The SBO initiating frequency, from the internal events study, is percent to the total CDF. The fire analysis 0.079, which was taken from WASH-1400 identified one critical area, the cable shaft, which (U.S. Atomic Energy Commission,1975).

contains virtually all the control cables for the plant systems ofimportance.

B.3.2 External Events South Texas Project The overall fire-induced CDF for Peach Bottom Unit 2 is 1.95E-5 per reactor-year. The dominant The total mean CDF is 4.4E-5. The annual CDF contributing plant areas are the (1) control room, due to fire is 4.9E-7, or about 1 percent of the (2) emergency switchgear room 2C, and total CDF. As stated, only the control room (3) emergency switchgear room 2B. These three makes a significant contribution to the 1 percent areas constitute 75 percent of the total fire risk. In contributed by fire.

the case of the control room, a general transient occurs with smoke-induced abandonment of the Catawba Units I and 2 area. Failure to control the plant from the remote

{

shutdown panel results in core damage. For the 1

The total mean CDF for Catawba Units 1 and 2 is two emergency switchgear rooms, a fire-induced j

7.8E-5 per reactor-year. The calculated annual loss of offsite power and failure of one train of the l

CDF due to fire is approximately 3.4E-7, which is emergency service water (ESW) occurs. Random less than 1 percent of the total. The dominant failure of the other two ESW trains results in SBO sequences postulate a fire in either the control and core damage. Tables B.2 and B.3 summarize room or cable room that fails the control circuits the results of the fire analysis. Table B3 shows of redundant trains of equipment.

that the fire in the control room results in a l

l transient and a reactor scram and that the fires in the emergency switchgear rooms contribute to the SBO initiator.

March 1998 B-3 NUREG-1521

e l

I Contribution of Fire to CDF: A Database l

Table B.2 Dominant Peach Bottom Fire Area Contributors to CDF CDF/RY Fire Area 5th 50th 95th Mean Percentile Percentile Percentile Emergency switchgear room 2A 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency switchgear room 2B 3.6E-6 3.5E-9 2.0E-6 1.3E-6 Emergency switchgear room 2C 4.7E-6 4.2E-9 2.2E-6 1.7E-5 Emergency switchgear room 2D 7.4 E-7 4.6E-9 1.6E-7 3.0E-6 Emergency switchgear room 3A 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency switchgear room 3B 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency switchgear room 3C 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency switchgear room 3D 8.1E-7 5.3E-10 1.7E-7 3.3E-6 Control room 6.2E-6 4.2E-10 1.4E-6 8.0E-6 Cable spreading room 6.7E-7 9.lE-9 1.7E-7 2.3E-6 Total 2.0E-5 1.1E-6 1.2E-5 6.4E-5 Table B.3 Dominant Accident Sequence Contributors to CDF Sequence Fire Area Mean CDF/RY Emergency switchgear room 2A 7.4E-7 Emergency switchgear room 2B 3.6E-6 Emergency switchgear room 2C 3.6E-6 Emergency switchgear room 2D 7.4E-7 T BUU i

i Emergency switchgear room 3A 7.4E-7 Emergency switchgear room 3B 7.4E-7 Emergency switchgear room 3C 7.4E-7 Emergency switchgear room 3D 8.1 E-7 TUUXU Control room 6.2E-6 3 i2 i3 Cable spreading room 6.7E-7 Emergency switchgear room 2C 8.1E-7 U

Y W

i i

2 2 Emergency switchgear room 2C 2.7E-7 y

sequence (T U U X U ). Both of these scenarios Detailed Description of Fire Scenarios in 3 i2 i3 Areas That Are Main Contributors assume abandonment of the control room because of smoke from fire in a cabinet. Credit was given Contro/ Room for extinguishing the fire in the buming cabinet Two scenarios in the control room remained after quickly, since the control room is continuously sta Ue.

ne f th three ccanol room fnes in screening; both are based on a single transient the database led to abandonment of the contro!

NUREG-1521 B-4 March 1998

Contribution ofFire to CDF: A Database room. It was assumed that only 1 in 10 fires part of the Fire Risk Scoping Study (NUREG/CR-would not be extinguished before sufficient smoke 5088), an exhaustive cable tracing effort yielded i

was generated to force abandonment of the a number of subtle interactions between one control room, plant's control room and the remote-shutdown panel.

This factor (fg) was taken to be the best estimate l

of a maximum entropy distribution. As an upper Area ratios for fire involvement only considered bound,it was assumed that the next control room total cabinet area in the control room. This is fire that occurred would force abandonment, and based on fire data, which illustrate that the only thus, the probability would be 1 in 4. As a lower control room fires to date have occurred in control estimate it was assumed that only 1 in 100 control cabinets.

room fires would lead to abandonment. The l

Sandia large-scale enclosure tests (NUREG/CR-ControlRoom Fire Scenario 1: The first scenario 4527, Vol. 2) have demonstrated that smoke postulates a fire starting inside the reactor core l

engulfed a mocked-up control room because of a isolation coang (RCIC) cabinet and subsequent l

cabinet fire within 6 to 8 minutes from time to smoke release forcing abandonment of the control ignition, even with ventilation rates of up to 10 room. Procedures require that the reactor be room changes per hour. Therefore, these estimates manually scrammed, thus a T transient sequence 3

on abandonment probability given a cabinet fire arises. The RCIC system (U ) is not independent 2

are deemed to be reasonable.

of the control room, since it is not part of the remote shutdown system and is assumed to fail, Because of the cabinet configuration within the given a fire in its control cabinet. The control rod Peach Bottom control room and considering the drive (CRD) system (U ) is also not part of the 3

Sandia cabinet fire tests, the postulated fire was remote shutdown system and, thus, no credit is assumed not to spread or damage any components given for its utilization. The high-pressure coolant l

outside of the cabinet in which the fire started.

injection (HPCI) system (U) and the automatic i

All control room cabinets at Peach Bottom had depressurization system (ADS)(X ) are part of the i

penetrations through the cabinet bottom to the remote shutdown panel but are failed due to cable spreading room below. Also, these cabinets operator error, had enclosed backs and tops. In Sandia's cabinet i

fire tests, cabinets had open backs and enclosed The core-damage equation is as follows:

tops. Even in this configuration, fire did not spread to adjacent cabinets. Therefore, the cabinet

$cu = Aca f R, fa 4

area ratio factor (f ) was considered to be known 4

fairly accurately. As a lower bound, it was where:

l assumed that only one-half of the applicable i

cabinet could initiate a sufficiently large fire. An

$cu fire-induced CDF for control room

=

upper bound estimate assumed that all cabinet Scenario 1 l

areas could initiate the fire, but also assumed that a transient fire at a maximum of I ft (0.3 m) away Aca frequency of control room fires

=

from the cabinet in all exposed directions could cause the same damage to the cabinet and the f

area ratio of the RCIC cabinet to total

=

4 same release of smoke. In both control room cabinet area within the control room scenarios, the fire was assumed to totally disable the functions of the cabinet in which the fire started.

R, probability that operators will fail to

=

recover the plant from the remote Both fire scenarios assumed that the remote-shutdown panel shutdown system was independent of the control room. This assumption is potentially not -

fx probability that smoke will force

=

conservative, because the possibility exists that abandonment of the control room subtle interactions between the remote shutdown given a fire panels and the control room are still present. As March 1998 B-5 NUREG-1521

1 l

I Contribution ofFire to CDF: A Detabase probability that smoke will force Table B.4 gives the values of each of these factors f,

=

as well as their associated distribution and upper abandonment of the control room and lower bounds. For all lognormal and gamma given a fire distributed variables in Table B.4 and the following tables, the lower bound and upper Table B.5 gives the values of each of these bound represent the 5th and 95th percentiles of factors, as well as their associated distribution and the distribution, respectively, while the best upper and lower bounds.

estimate represents the mean value.

Switchgear Rooms Control Room Fire Scenario 2: The second fire As mentioned earlier, fires m. switchgear rooms scenario in the control room assumes that the fire 2C and 2B are important contributors and lead to is initiated in any cabinet other than the RCIC SBO scenarios. The discussion that follows cabinet. As in the first scenario, subsequent Presents a fire scenario in other switchgear rooms.

smoke release forces abandonment of the control The next sections then present the analysis for room. Credit is given for the RCIC system switchgear rooms 3D,2B, and 2C.

automatically cycling to control reactor level even though it is not controlled from the remote Emergency Switchgear Rooms 2A, 2D, 3A, 3B, shutdown panel. Therefore, the RCIC system (U )

2 and 3C: For all five of these fire areas, the must randomly fail, which adds the Q,cie term in scenari is similar. This sequence (T,BU,) was an the core damage equation. As in the first scenario, SBO caused by a fire-mduced loss of offsite the reactor is manually scrammed (T ) and the 3

Power (T ) and a random loss of the emergency i

HPCI system (U ) and ADS (X) are failed i

i service water (ESW) system. This random (failure because of operator error at the remote shutdown n t related to the fire itself) loss of ESW caused panel. Also, no credit is given for the CRD system an SBO because ESW provides cooling for all (U ), since it is not part of the remote shutdown 3

f ur diesel generators. Thus, the emergency onsite panel.

power system (B) failed. ESW also provides room C ling for the HPCI system (U,). The HPCI The cere-damage equation is as follows:

system will fail in approximately 10-12 hours E"d

1. • • "D"*"d

&cu = Acn (1-f ) R, Qacic f, battery depletion caused by the SBO.

where:

These areas are all similar in that the primary s urce f fire is electrical switchgear within the

&cu fire-induced CDF for control room

=

fire area. Therefore, the fire frequency was developed for electrical switchgear rooms, and area ratios were for only the cabinet area within Aa c

frequency of control room fires

=

the room. A valid mechanism for spread of fire utside these cabinets was required to develop a (1-fr) = area ratio of all cabinets other than RCIC cabinet to total cabinet area hot gas layer which would fail offsite power. A lP ant-specific look at these switchgears showed within the control room that m the case of all breaker cubicles, many small probability that operators will fail to cables passed through the top at one penetration R,

=

and, furthermore, that this penetration was recover the plant from the remote shutdown panel inadequately sealed. There are ventilation stots at the bottom of the cabinets; therefore, given a fire, a chimney effect could occur and it was assumed Q,cic = random failure of the RCIC system (failure not related to fire) that there would be a 50-percent chance of the fire exiting the top. Furthermore, a cable mn exists directly above these penetrations, which would add more fuel to the fire.

NUREG-1521 B-6 March 1998

Contribution ofFire to CDF: A Dctcbese Table B.4 Control Room Fire Scenario 1-Factors and Distributions Lower Best Upper Bound Factor Distribution Bound Estimate Ac, Gamma 1.2E-7 2.33E-3 6.2E-3

{

f Maximum entropy 0.01 0.02 0.028 4

R.,

Maximum entropy 6.4E-3 6.4E-2 0.64 f,

Maximum entropy 0.01 0.1 0.25 Table B.5 Control Room Fire Scenario 2-Factors and Distributions Lower Upper Factor Distribution Bound Best Estimate Bound Aca Gamma 1.2E-7 2.33E-3 6.2E-3 (1-f)

Maximum entropy 0.49 0.98 1.0 4

R, Maximum entropy 6.4E-3 6.4E-2 0.64 f,

Maximum entropy 0.01 0.1 i

0.25 Since this fire scenario requires that the cable run operated valves (AOVs).

directly above the 4160-V switchgear ignites to add sufficient fuel to form a hot gas layer within These failures were developed as part of the the entire room which then fails offsite power internal events analysis of Peach Bottom and are trunks J57 and J58, the area ratio factor (f ) was identical except for the postulated mission time of i

4 the ratio of 4160-V switchgear area to total the emergency diesel generators (DGHWNR 16HR).

i cabinet area within the fire area. A measurement A 16-hour mission time was assumed for the of this ratio yielded a best estimate of 0.9 for this diesel generators because offsite power trunks J57 maximum entropy variable. As a lower bound, and J58 were irrecoverably lost due to fire only the centermost cubicle was postulated to be damage Peach Bottom SBO procedures specify.

capable of failing offsite power and thus, an area given failure of the emergency diesel generators, ratio of 0.1 was assessed. For an upper bound,it that portable generators be transported to the site.

was assumed that the most probable source of fire It is felt that within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a portable generator was the high-voltage 4160-V cubicles and not the will be in place and cabling will be run to provide other lower voltage cabinet. This led to an upper some core cooling and, thus, prevent core damage.

bound of 1.0. The percentage of cabinet fires (fs)

Failure of the diesel generators at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> and that would be large enough to exit the top of a subsequent boiloff from the core would lead to cubicle was felt to equal approximately unity on core damage in approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if portable the basis of Sandia fire testing experience. Thus, power and core cooling were not in place.

a tight maximum entropy distribution for the severity ratio factor was postulated. The The core-damage equation is as follows:

percentage of fires Q(Tc) that are manually extinguished before requisite damage occurs was

$cu Asca f f Q(Tc) Qtsw fa

=

4 3 evaluated previously. The term that represents random failure of the ESW system (Qesw) can be where:

represented by the following: failures of the emergency diesel generators, a failure to recover

$cu fire-induced CDF for each of the

=

one diesel generator within 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, a failure to five switchgear rooms 2A,2D,3A, manually align emergency service water, and 3B, and 3C common-cause failures of certain ESW air-l March 1998 B-7 NUREG-1521

i Contribution of Fire to CDF: A Detabase i

frequency of switchgear room fires selected ESW AOVs; for emergency switchgear 1 c,

=

3 room 2B, Qtsw requires an ESW check valve ratio of 4160-V switchgear to total failure in addition to the failures described above f

=

4 cabinet area within the fire area for room 3D.

percentage of cabinet fires that Emergency Switchgear Room 2C: Three scenarios f

=

3 would be large enough to exit survived screening for this fire area. The first was the top cubicle the SBO scenario described before with fire-related failure of offsite power and ESW pump B.

Q(Tc) = percentage of fires that are not For the other two sequences, SBO does not occur manually extinguished before and other random failures lead to long-tenn core requisite damage occurs damage scenarios. The core damage equation for all three scenarios is identical to that discussed for random failure of the emergency emergency switchgear room 2A, except Qtsw is

Qts,

=

service water system replaced with QRAM for the latter two long-term sequences to reflect that different random failures percentage of fires that exit the top are necessary to lead to core damage.

fa

=

of a switchgear cubicle Scenario I: In this case, the Qts, term is similar Table B.6 gives the values of each of these factors to that for ESW room 2B.

as well as their associated distribution and upper and lower bounds.

Scenario 2: Scenario 2 is a long-term (approximately 30-hour) core damage sequence.

Emergency Switchgear Rooms 3D and 2B: The The HPCI system (U ) and low-pressure coolant i

scenario is identical to the one described injection (LPCI) system (V ) succeed, but core 3

previously. However, some fire-related failures of damage eventually occurs because of failure of all the ESW also occur. For emergency switchgear modes of the residual heat removal (RHR) system room 3D, the fire fails power to the ECW pump, (W,W,W ). Fire-related failures are to offsite i 2 3

while for room 2B, power is failed to ESW pump power,4160-V ac bus C, and indirectly to 24-V ac A. These fire-related failures, coupled with bus C. This fire-induced damage fails the suction additional random failures, lead to a loss of the path logic to the shutdown cooling (SDC) system ESW system and subsequent SBO.

(W ) and one of two injection paths for the 2

suppression pool cooling (SPC) system (W ) and i

The only modification to core damage equation the containment spray (CS) system (W ).

3 B.1 would be to the Qtsw term. For emergency Additional random failures to the emergency switchgear room 3D, Qts, consists of failures of diesel generator fail the other injection path for two emergency diesel generators, a failure to the SPC and CS systems. Containment venting recover one train of emergency ac power within (Y)is failed t,y loss of the instrument air system 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, and the common-cause failure of cooling and, given a loss of offsite power,the Table B.6 Ernergency Switchgear Rooms Fire Scenario-Factors and Distributions Lower Upper Factor Distribution Bound Best Estimate Bound Asca Gamma 5.8E-7 2.7E-3 5.7E-3 f

Maximum entropy 0.1 0.9 1.0 A

fs Maximum entropy 6.4E-3 6.4E-2 0.M Q(r)

Maximum entropy 0.52 0.77 1.0 c

f, Maximum entropy 0.05 0.5 1.0 NUREG-1521 B-8 March 1998

Contribution of Fire to CDF: A Database turbine building cooling water (TBCW) system is failnres, coupled with fire-induced loss of offsite failed. The alternate cooling system, reactor power. In all eight emergency switchgear rooms building cooling water (RBCW), is never aligned (four for both Units 2 and 3), both trains (J57 and because of random failure RBC-XHE-FO-SWCH.

J58) of offsite power are routed. In each of these The CRD system (U ) is also failed because of a areas, breaker cubicles for the 4.1-kV switchgear failure to switch woling.

have a penetration at the top, which has many small cables routed through it. These penetrations The terms Asca, fa, fs, @o), and their associated are inadequately sealed, allowing the fire to distributions are identical to the scenario spread to cabling that is directly above the described for emergency switchgear rooms 3D switchgear. This cabling is a sufficient fuel source and 2B.

for the fire to cause a rapid formation of a hot gas layer, which would then lead to a loss of offsite The term Qaxsoou consists of various failures of power. Since both offsite power and the emergency diesel generator D in conjunction with emergency service water systems are lost, a a switch failure that precludes critical RBCW station blackout would occur, which would also system alignments.

fail all containment heat removal. A number of possible modifications can be envisioned, The core-damage equation is as follows:

including the following:

1

&cu = Asca f fs Q(4) fa Qarsoou more adequate seals for the penetrations on j

4 a

top of the 4.1-kV switchgear cubicles where all factors are as previously defined.

spraying fire retardant on the cabling Table B.6 gives the values of each of the terms as located directly at;sve 4.1-kV switchgear well as their associated distributions.

B.4 DETAILED REVIEW OF A Scenario 3: As was the case for Scenario 2, long-PRESSURIZED-WATER-term (approximately 30-hour) core damage REACTOR PRA occurs. The HPCI system (U ) and the low-i pressure core spray (LPCS) system (V ) succeed, The pressurized-water-reactor (PWR) plant 2

but core damage eventually occurs because of chosen for a detailed review is Surry Unit 1, and failure of all decay heat removal modes of the the resource documents are NUREG-1150 and RHR system (W,W,W ). The CRD system (U )

NUREG/CR-4550, Volume 3. Part 3.

i 2 3 and containment venting system (Y) fail for reasons identical to those in Scenario 2. However, B.4.1 Internal Events fire-related damage to emergency bus C fails one injection side'of the SPC, CS, and SDC systems, The total mean CDF from internal events is 4.0E-l and random failures fail the other injection path.

5. Station blackout (SBO) contributes to this The core damage equation is identical to that for value with 2.74E-5, that is,68.5 percent of the Scenario 2. The only modification is the equation total CDF. The SBO initiating frequency, from for the term Qaxyoou. In this scenario, Qarwoou the intemal events study, is 7.0E-2, which was consists of the same RBCW switch failure plus taken from NUREG-1032.

failures of RHR train B.

l B.4.2 External Events B.3.3 Conclusion The overall fire-induced CDF for Surry Unit 1 is The Peach Bottom fire risk results present a 1.13E-5 per reactor-year. The dominant picture reasonably similar to the internal events contributing plant areas are the (1) emergency and seismic results. The fire-induced CDP is switchgear room, (2) auxiliary building, (3) dominated by fire damage to the emergency control room, and (4) cable vault / tunnel. These service water system in conjunction with random four areas comprise 99 percent of the total fire March 1998 B-9 NUREG-1521

__________________D

Contribution ofFire to CDF: A Databme auxiliary building (2.18E-6) risk. In the case of the emergency switchgear e

control room (1.58E-6) room, cable vault / tunnel, and auxiliary building, cable vault / tunnel (1.49E-6) a reactor coolant pump seal loss-of-coolant accident (LOCA) leads to core damage. The fire itself fails cabling for both the high-pressure Table B.8 shows that fires in all four of the main injection (HPI) and component cooling water areas contribute to the transient initiator.

(CCW) systems, resulting in a seal LOCA. For the control room, a general transient with a Detailed Description of Fire Scenarios in Areas subsequent stuck-open power-operated relief That Are Main Contributors valve (PORV) leads to a small LOCA. Failure to control the plant from the auxiliary shutdown Auxiliary Building panel results in core damage. Tables B.7 and B.8 One fire scenario in the auxiliary building summarize the results of the fire analysis. Table remained after screening. This scenario was a B.8 shows that the main contributors are large fire on the 13-ft elevation that irrecoverably emergency switchgear room (6.09E-6) damaged power or control cables for both the HPI Table B.7 Dominant Surry Fire Area Contributors to CDF CDF/RY Fire Area 5th 95th Mean Percentile Median Percentile Emergency switchgear room 6.09E-6 3.93E-9 3.15E-6 1.98E-5 Control room 1.58E-6 1.20E-10 4.68E-7 6.95E-6 Cable vault / tunnel 1.49E-6 6.51E-10 6.99E-7 5.79E-6 Auxiliary building 2.18E-6 5.32E-7 1.59E-6 5.64E-6 Charging pump service water 3.92E-8 1.43E-10 5.66E-9 1.58E-7 pump room Total 1.13E-5 5.37E-7 8.32E-6 3.83E-5 l

l Table B.8 Dominant Accident Sequence Contributors to CDF Sequence Fire Area Mean CDF/RY Emergency switchgear room 6.09E-6 T D WD, Auxiliary building 2.18E-6 3 3 Cable vault / tunnel 1.49E-6 Control room 1.58E-6 T QD, Charging pump service water 3.92E-8 3

pump room l

NUREG-1521 B-10 March 1998 1

---

-.-.J

Contribution of Fire to CDF: A Database and CCW systems. These fire-related failures with and lower bounds. For all lognormal distributed no additional random failures required led to a variables in Table B.9, the lower bound and upper reactor coolant pump seal LOCA. The recovery bound represent the 5th and 95th percentiles of for this particular scenario required the operation the distribution, respectively, while the best l

of two manual HPI system cross-connect valves estimate represents the mean value.

located in the immediate vicinity of the large fire.

No recovery was allowed until 15 minutes after Cable Vault / Tunnel the fire was extinguished.

The one remaining scenario that survived The core-damage equation is as follows:

seeening is similar to the one described for the auxiliary building in that the postulated fire

&cu = A f, fs Q(Tc) R*

irrec verably damages power or control cables for m

both the HPI and CCW systems, leading to a seal where:

LOCA.

I fire-induced CDF for the auxiliary Credit was taken for the automatic carbon dioxide

&cu

=

(CO ) system suppressing the fire before critical building 2

damage occurred. COMPBRN predicted 3 frequency of auxiliary building fires minutes' time to damage for this particular 1

=

scenario. The automatic CO system is actuated 2

=

area ratio within the auxiliary by fixed-temperature heat detectors at 190 'F (361 I

f, building where critical damage K). One heat detector is located at the end of the occurred critical area ofinfluence for this scenario. Two others are located so that ventilation flow would severity ratio (based on generic f rce the hot gas layer in their direction. The f

=

3 combustible fuel loading) for a large system actuation delay time to allow for fire evacuation is 30 seconds. Therefore, the heat detectors must respond to fire ignition and the CO system must suppress the fire within Q(Tc) =

percentage of fires in the suppression 2

database that were not manually 2.5 minutes to prevent entical damage. For these extinguished before the COMPBRN-reas ns, system reliability data for automatic CO2 predicted time to critical damage suppression systems were modified to account for occurred this relatively short time to prevent critical damage.

i R,

failure to cross-connect the Unit 2

=

HPI system to either prevent a seal Operator recovery for tlu.s scenano is similar to LOCA or mitigate its effect that for the auxiliary building scenario, except that the fire is not in the immediate vicinity or even in Table B.9 gives the values of each of these factors the same fire area in which the local recovery as well as their associated distribution and upper actions must take place. Also, since no control Table B.9 Auxiliary Building Fire Scenario-Factors and Distributions Factor Distribution Lower Bound Best Estimate Upper Bound A,

Gamma 0.027 0.066 0.16 f

Maximum entropy 2.4E-4 6.3E-4 1.1E-3 4

fs Maximum entrepy 0.19 0.30 0.67 Q(Tc)

Maximum entropy 0.69 0.80 1.0 R,,,

Maximum entropy 0.19 0.26 1.0 March 1998 B-11 NUREG-1521

Contribution of Fire to CDF: A Database room operators respond to the fire itself, the same upper and lower bounds.

recovery value for operator action was applied as was used in the internal events analysis.

Control Room The core-damage equation is as follows:

One scenario survived the screening process for the control room. As was the case for the auxiliary

&cu = Acsa fx fs Q(Tc) QAero R, building and cable vault / tunnel, no additional random failures were required to lead directly to where:

core damage. This scenario was a fire interior to benchboard 1-1 leading to the spurious actuation of

$cu

= fire-induced CDF for the cable one PORV located on this benchboard. Because of vault / tunnel the cabinet configuration within the control room and considering Sandia cabinet fire tests, the fire A sa

= frequency of cable vault / tunnel fires was assumed not to spread or damage any c

components outside of benchboard 1-1. However, fx

= area ratio within the cable vault / tunnel because of the Sandia large-scale enclosure tests where critical damage occurred (where smoke engulfed a control room within 5-10 minutes of time from ignition within a cabinet even f

= severity ratio (based on generic with ventilation rates of up to 10 room changes per 3

combustible fuelloading) hour), this scenario postulates forced abandonment of the control room and subsequent plant control Q(Tc) = percentage of fires in the database that from the auxiliary shutdown panel located in the were not manually extinguished t efore emergency switchgear room.

the COMPBRN-predicted time to critical damage occurred Credit was g:ven for extinguishing the fire quickly within benchboard 1-1, since the control room is continuously staffed. None of the four control QAvro = probability of the automatic CO2 system not suppressing the fire before room fires in the database led to abandonment of the COMPBRN-predicted time to the control room. It was assumed that 10 percent critical damage occurred of all control room fires would result in abandonment of the control room, and a factor of R,

= failure to cross-connect the Unit 2 10 reduction in control room fire frequency was the HPI system to either prevent a seal modification made to allow credit for continuous LOCA or mitigate its effect occupation.

Table B.10 gives the values of each of these factors, as well as their associated distribution and Table B.10 Cable Vault / Tunnel Fire Scenario-Factors and Distributions Factor Distribution Lower Bound Best Estimate Upper Bound Acsa Gamma 3.E6 7.E-3

0. 5 fx Maximum entropy 0.011 0.025 0.047 f

Maximum entropy 0.50 0.99 1.0 3

Q(tc)

Maximum entropy 0.69 0.80 1.0 Qwro Maximum entropy 0.50 0.70 0.90 R,

Maximum entropy 4.4E-3 0.044 0.44 l

NUREG-1521 B-12 March 1998

i Contribution ofFire to CDF: A Database The area ratio for fire involvement was developed successfully recover the plant from by comparing the area of benchboard 1-1 to the the auxiliary shutdown panel total cabinet area in the control room. This is warrented because fire event data show that all fa probability that operators will not

=

control rocm fires have occurred within electrical successfully extinguish the fire cabinets. Therefore, this is postulated to be the before smoke forces abandonment of most likely fire ignition source within the control the control room room.

Table B.11 gives the values of each of these l

Once the control room is abandoned, operators factors as well as their associated distribution and l

would control the plant from the auxiliary upper and lower bounds.

siiutdown panel. However, PORV indication is not provided at this panel and in conversations Emergency Switchgear Room with the utility it was learned that the PORV

" disable" function on the auxiliary shutdown One fire scenario remained for the emergency panel is not electrically independent of the control switchgear room after screening. This scenario room. Therefore,it was assumed that the PORV was a fire that damaged either power or control disable function would fail and, consequently, the cables for HPI and CCW pumps, thus leading to a operators would be in a high stress recovery reactor coolant pump seal LOCA. No additional mode.

random failmes were required for this scenario to lead directly to core damage.

The core-damage equation is as follows:

As was the case for the cable vault / tunnel and

&cu = Aca f R, fa auxiliary building, recosery from this scenario 4

was by cross-connecting HPI from Unit 2. The where:

fire itself would not affect local auxiliary building recovery actions. Therefore, similar to the cable

&cu fire-induced CDF for the control room vault / tunnel, the same probability for recovery

=

was used as in the internal events analysis.

A frequency of control room fires

=

ca The core-damage equation is as follows:

f ratio of benchboard 1-1 area to total

=

4 cabinet area within the control room

$cu = A ca Q(:c) R,(f, fs, + f fs2) s 4

42 R,

probability that operator will not where:

=

Table B.11 Control Room Fire Scenario-Factors and Distributions Factor Distribution Lower Bound Best Estimate Upper Bound Aca Gamma 1.2E-6 1.8E-3 7.4E-3 f

Maximum entropy 0.028 0.084 0.12 4

R, Maximum entropy 7.4E-3 0.074 0.74 f,

Maximum entropy 0.01 0.1 0.25 March 1998 B-13 NUREG-1521

Contribution of Are to CDF: A Database fire-induced CDF for the emergency B.4.3 Conclusion

$cu

=

switchgear room The overall fire-induced CDF for Snrry Unit 1 is frequency of emergency switchgear 1.13E-5 per reactor-year. The dominant con-1 c,

=

3 room fires tributing plant areas are the following: (1) emergency switchgear room, (2) auxiliary percentage of fires in the database building, (3) control room, and (4) cable Q(Tc)

=

that were not manually extinguished vault / tunnel. These four areas constitute 99 before the COMPBRN-predicted time percent of the total fire risk.

to critical damage occurred In the case of the emergency switchgear room, failure to cross-connect the Unit 2 cable vault /tuanel and auxiliary building, a R,

=

HPI system to either prevent a seal reactor coolant pump seal LOCA leads to core LOCA or mitigate its effect damage. The fire itself fails cabling for both the HPI and CCW systems, resulting in a seal LOCA.

area ratio within the emergency fy

=

switchgear room for a small fire For the control room, a general transient with a where critical damage occurred subsequent stuck-open PORV leads to a small LOCA. Failure to control the plant from the severity ratio (based on generic auxiliary shutdown panel results in core damage.

fsi

=

combustible fuel loading) of small fires B.5 REFERENCES area ratio within the emergency Commonwealth Edison Co., " Zion Station Unit I fu

=

switchgear room for a large fire and 2 Probabilistic Safety Study," NRC Docket Nos. 50-295 and 50-304, Zion, Illinois, September severity ratio (based on generic 1981.

fs2

=

combustible fuel loading) of large fires Consolidated Edison Coinpany of New York, Inc1Halliburton NUS Environmental Corp.,

Table B.12 gives the values of each of these

" Individual Plant Examination for Indian Point factors, as well as their associated distribution and Unit 2 Nuclear Generating Station," Buchanan, upper and lower bounds.

New York, August 1992.

Table B.12 Emergency Switchgear Room Fire Scenario-Factors and Distributions Factor Distribution Lower Bound Best Estimate Upper Bound 'I Asag Gamma 2.0E-5 8.0E-3 0.017 fu Maximum entropy 0.02 0.039 0.099 fsi Maximum entropy 0.33 0.7 0.81 fu Maximum entropy 0.051 0.10 0.24 fs2 Maximum entropy 0.19 0.30 0.67 Q(ta)

Maximum entropy 0.67 0.80 1.0 R,

Maximum entropy 4.4E-3 0.044 0.44 NUREG-1521 B-14 March 1998

Contribution ofFire to CDF: A Database Consumers Power Company, " Big Rock Point 1032," Evaluation of Station Blackout Accidents Plant Probabilistic Risk Assessment," Jackson, at Nuclear Power Plants," P. Baranowski, June Michigan, March 1981.

1988.

Cross, R.B., et al., " South Texas Project Electric

, NUREG-1150, Vol.1, " Severe Accident Generating Station Level 2 PRA and Individual Risks: An Assessment for Five U.S. Nuclear Plant Examination," Hanston Lighting & Power Power Plants," December 1990.

Company and Pickard, Lowe and Garrick, Inc.,

Palacios, Texas, August 1992.

NUREG/CR-4527, Vol.

2, "An Experimental Investigation of Internally Ignited Duke Power Company, " Catawba Nuclear Station Fires in Nuclear Power Plant Cabinets, Part IPE Submittal Report," Clover, South Carolina, III-Room Effects Tests,"

Sandia National September 1992.

Laboratories, Albuquerque,NewMexico, October 1988.

"IPE Submittal Repon for McGuire Nuclear Station," Cornelius, Nonh Carolina, NUREG/CR-4550, Vol. 3, Part 3, November 1991.

" Analysis of Core Damage Frequency, Surry Power Station, Unit 1, External Events," Sandia Garrick, B.J.,

et al.,

"Seabrook Station National Laboratories, Albuquerque, New Probabilistic Risk Assessment," Pickard, Lowe, Mexico, December 1990.

and Garrick, Inc., Framingham, Massachusetts, December 1983.

, NUREG/CR-4550, Vol. 4, Part 3,

" Analysis of Core Damage Frequency: Peach Nuclear Safety Analysis Center, NSAC60, Vol.1, Bottom Unit 2 Extemal Events," Sandia National "A Probabilistic Risk Assessment of Oconee Laboratories, Albuquerque, New Mexico, Unit 3," Palo Alto, California, June 1984.

December 1990.

NUS Corporation, " Severe Accident Risk

, NUREG/CR-4832, Vol.1, " Analysis of Assessment, Limerick Generating Station,"

the LaSalle Unit 2 Nuclear Power Plant: Risk Pottstown, Pennsylvania, April 1983.

Methods Integration Program and Evaluation Program (RMIEP), Summary," July 1992.

U.S. Atomic Energy Commission WASH-1400 (now NUREG-75/014),

" Reactor Safety

, NUREG/CR-5088, " Fire Risk Scoping Study-An Assessment of Accident Risks in U.S.

Study: Investigation of Nuclear Power Plant Fire Commercial Nuclear Power Plants," October Risk. Including Previously Unaddressed Issues,"

1975.

Sandia National Laboratories, Albuquerque, New Mexico, January 1989.

U.S. Nuclear Regulatory Commission, NUREG-March 1998 B-15 NUREG-1521

l l

1 l

l l

l l

l i

1 i

i I

l Appendix C l

FIRE MODELING UNCERTAINTY

\\

\\

r I

t l

l i

i t

l

CONTENTS Pace C.1 INSIGHTS REGARDING THE UNCERTAINTIES IN COMPBRN me............. C-2 C.I.1 Case 1: Source Fire Heat. Release Rate of a Case-S Cable Tray............................... pecific IEEE-Rated

.........................C-3 C.I.2 Case 2: Transport of Thermal Environment for a Given Fire Source IIeat Release Rate............................................... C-4 C.I.3 Case 3: Integrated Verification of COMPBRN m and COMPBRN me Using Fire Test Data................................................. C-6 C.2 A PROPOSED TREATMENT FOR FIRE MODELING UNCERTAINTY............. C-9 C.2.1 Model: A Simple Definition.......................................... C-14 C.2.2 Model vs. Parameter Uncertainty..................................... C-14 C.2.3 How To Quantify Modeling Uncertainty................................ C-15 C.2.4 Decisionmaking U:.ler Uncertainty.................................... C-17 C.2.5 Considerations of Uncertainties in Fire Modeling......................... C-18 C.3 S UMMARY............................................................. C-19 Figures C.1 COMPBRN-Predicted Heat Release From Burning Cables...................... C-4 C.2 Comparisons of Hot Gas Layer Temperatures..................................... C-5 C.3 Comparisons of Target Cable Tray Temperatures................................. C-5 C.4 Simulation of SNUUL Experiment 1......................................... C-10 C.5 Simulation of SNUUL Experiment 2.......................................... C-11 C.6 Simulation of SNUUL Experiment 3............................................ C-12 C.7 Simulation of SNUUL Experiment 4.......................................... C-13 Tables C.1 Heat-Release Rate (HRR) Predicted by COMPBRN for Case 1 of Safe-Shutdown Distance Case S tudy....................................................... C-3 C.2 Physical Property Parameters.................................................. C-7 j

C.3 Model Parameters.......................................................... C-7 C.4 User-Specified Variability Factors in COMPBRN me.............................. C-8 March 1998 C-iii NUREG-1521

(

APPENDIX C FIRE MODELING UNCERTAINTY As discussed in Chapter 4 and further illustrated made on the basis of value-impact evaluation in Chapter 6, risk-informed and performance-bas-of the change in risk and other factors.

ed approaches may result in the adoption of alternative methods for compliance on a plant-Regardless of the analysis type, the following specific basis. The justifications for the use of issues regarding the sources of uncertainties need such alternative methods may cc,me from the to be addressed:

following four types of analyses:

(1) availability and quality of information about (1) Cases in which the equipment contained uncertainties in the input variables to the within a fire compartment may have an model and in the parameters used in the insignificant contribution to core damage model frequency or risk even if all the equipment is damaged as a result of a single-exposure fire.

(2) accuracy of the model, excluding any input variability discussed above (2) Cases in which data analyses and reliability modeling are used to show that the The uncertainty distribution, associated with input performance of an alternative design is variables and model parameters (Issue 1), is equivalent to or better than the base case.

estimated using measurements or monitored data Examples are the relaxation of the through application of the Bayes method (Kaplan, surveillance interval and modification of 1983). Computer software is widely used for surveillance strategy as discussed in Chapter these types of uncenainty analyses for both risk-6.

informed and performance-based models. This technology has been utilized for more than a (3) Cases in which deterministic analyses (fire decade in various probabilistic risk asseents modeling) reject or accept a given and reliability studies.

hypothesis. As an example of the case study on the separation distance between The uneenainties in input variables and the model redundant cable trays, it was shown that the parameters are propagated through an integrated redundant cables will not be damaged if they model using Monte Carlo sampling techniques.

are separated by more than 4.6 m (15 ft) and Variance reduction techniques and stratified as long r.s the peak heat release rate of the sampling strategies have been extensively used to fire source is below 2 MW. For this case propagate the uncertainties in an efficient manner.

study, when the performance measure is Software such as in the IRRAS computer code defined as damage to redundant cable,4.6-m (NUREG/CR-5813)) and the COMPBRN (EPRI (15-ft) separation and 6.1-m (20-ft)

NP-7282)) code have already implemented these separation will provide equivalent techniques for uncertainty propagation. Other performance.

methods, such as discrete probability propagation and moment propagation, have been used less (4) Cases in which none of the above three extensively.

analyses by themselves could result in a justifiable decision; however, if integrated The accuracy of model prediction (Issue 2),

systematically they could provide the excluding the variabilities of the input and model necessary justificatia. In the integrated parameters, is entrenched in code validation. In analyst s, the measure estimated is typically most cases, simplifying assumptions have been the change in core damage frequency incorporated to reduce the code's development (ACDF) or risk, and the decision may be effort and to facilitate the large number of runs March 1998 C-1 NUREG-1521

FireModeline Unceminty usually required for risk-informed and release rate as a function of time, and the other i

performance-based evaluations.

deals with the thermal environment as a result of J

l the fire, including radiation, to the target object to Two methods of validation are usually proposed.

estimate the damage time. Also discussed was The first is the comparison of the code predictions that the COMPBRN series is perhaps the only to those of another validated code that is more available computer code that attempts to model comprehensive and suffers from fewer simplifying both phenomena. Other computer codes, such as assumptions. The other method requires CFAST and FPETOOL, currently model the comparison of the code predictions to available thermal transport phenomenon and accept the fire measurements obtained through a well-heat release rate as a function of time as input.

4 instrumented experiment.

FIVE (fire-induced vulnerability evaluation) methodology and worksheets are similar to the in any case, exhaustive comparisons of the latter group of codes, but do not model the fire l

existing codes to either experiments or a more source strength, although some guidelines are comprehensive code are not generally feasible provided for simple cases, because of the large number of case mns that may be necessary or the cost associated 'cith new The sources of initiating fires in nuclear power experiments and/or additional computer runs.

plants vary: cable fire, oil fire, transient fire, Various statistical methods are available to cabinet fire, etc. Experience accumulated from provide an estimate of the inaccuracies of the code earlier fires and fire tests show large variability in prediction using a small set of validation runs fire heat release rate even for the same type of fire (such as clustering methods).

source. For example, a cabinet fire involving high-voltage equipment is fundamentally different Currently, expert judgments are used in most from fires initiated in cabinets containing low-cases to determine the accuracy of the code voltage equipment. Earlier fires in nuclear power predictions in light of the limited experimental plants have shown that cabinet fires involving data available. One method used in the building high-voltage equipment generate tremendous industry, albeit informal, aggregates the results of amounts of heat, some due to electrical energy those fire experiments (or actual fire events) that converted to thermal as a result of electrical faults.

are judged to be representative of the case under In contrast, a slow, smoldering fire may occur in study, in order to refine the code estimates. The cabinets containing low-voltage equipment. Also, aggregation process is based on the weighted various tests performed by the Electric Power mixture of all results.

The closer the fire Research Institute and Sandia National experiment represents the case rur, :be higher Laboratories have shown that heat-release rate would be its weight. This is also the case for the from cable tray fires is a complex phenomenon, computer codes for evaluating fire propagation depending on many parameters, such as cable times.

orientation, cable location, ventilation, and size of the initiating transient fire.

C.1 INSIGHTS REGARDING THE UNCERTAINTIES IN COMPBRN The heat-release rate of a fire source is a complex P ysical phenomenon and, given the current state-h IIIe of-the-art modeling techniques, one may expect This section contains a preliminary discussion of large uncertainties associated with the code the potential un-certainties in the COMPBRN Prediction. Typically, simplified bounding code. As discussed in Chapter 4, fire modeling estimation using a surface-controlled burning rate codes have been used in estimating the time it model has been utilized in the computer codes, takes for fire to damage critical components if the such as COMPBRN, to ensure the conservative fire is not suppressed. Also discussed was the fact estimation of the fire impact. Because of the that a fire modeling code generally simulates two conservative nature of such modeling, there may major phenomena. One phenomenon deals with be cases in which the heat release rate is the strength of the fire source in terms of heat significantly overpredicted. In these cases, the NUREG-1521 C-2 March 1998

1 Fire Modeling Uncertainty peak heat release rates and the associated ranges long, at a range from 0.9 MW to 2 MW for a well-of variation (uncertainty) may be subjectively ventilated room.

determined in light of past occurrences of fire or i

fire tests and used as input to the code.

To further analyze the availability of oxygen to support the buming rates predicted by To gain some insights on uncertainty issues COMPBRN, an input deck for the CFAST code regarding fire modeling, the following three cases was developed. The CFAST computer code is are discussed:

capable of evaluating the concentration of various species of air and combustible products in the hot (1) source fire heat-release rate of a case-layer region. According to the CFAST run, at specific Institute of Electrical and about 5 minutes, the upper hot layer descends to Electronics Engineers (IEEE) 383 rated the level of the lowest burning tray. The cable tray concentration of oxygen in the hot layer at 5 minutes was estimated to be below 10 percent (2) transport of thermal environment for a given (ordinary air is 21 percent). Therefore, the heat-fire source heat-release rate release rate will not increase any further because of oxygen depletion and the fire may die down (3) integrated verification using fire test data shortly. Accordingly, the peak heat-release rate for this specific case will be below 2 MW and the C.1.1 Case 1: Source Fire Heat-Release Rate heat-release rate predicted by COMPBRN after 5 of a Case-Specific IEEE-Rated Cable minutes may be overly conservative.

Tray The preceding discussion gives an example of the The specific case selected for this analyses is Case level of conservatism embedded in the 1 described in Section 6.2.1.3 (see Table 6.4), in COMPBRN code and shows the role of the which the size of the pilot fire is 1.2 m (4 ft) x 0.6 analyst in determining the heat-release rate from m (2 ft) in the lowest cable tray. Details of this various sources, considering the complexity and case study is provided in Appemdix D.

the uncertainties associated with this issue. The COMPBRN predicted a total heat-release rate, heat-release rate is the driving force for the plume which is given in Table C.I. In an earlier stud, mass flow rate, the ceiling jet Qaperature, and (NUREG/CR-4230), similar fire scenarios were finally, the hot layer temperature which is driven analyzed using the old version of the COMPBRN by energy balance. The fire heat-release rate is code and the conclusion reached was that the heat-dependent on the initial fire size, the growth of release rate predicted by the code was fire by propagation and ignition of additional unrealistically high. On the basis of the amount of combustibles, and the heat-release rate from these oxygen available in the plume for the maximum additional combustibles. There is a large height of the flame, the study concluded that the variability in initial fire size which typically is l

peak heat-release rate will be limited to 2.5 MW, categorized into three categories-small, medium, or about 0.83 MW for a cable tray. On the basis and large. Each category has a probability of of the fire tests reported in EPRI NP-2660 and occurrence estimated using the earlier data. The EPRI NP-2751, one may also arrive, for the peak size of fire, associated with each category itself heat-release rate for a cable tray 15 m (-50 ft) 1 Table C.1 Heat Release Rate (HRR) Predicted by COMPBRN for Case 1 of Safe-Shutdown Distance Case Study Time 0

1 2

3 4

5 6

7 8

9 10 (Minutes)

HRR (MW) 0 0.1864 0.242 0.357 0.895 1.512 2.598 3.472 4.741 7.30 14.06 March 1998 C-3 NUREG-1521

i FireModeling Uncenainiv PWR ESGR 20.FT SEPARATION STUDY COMPSRN AND CFAST COMPARISON. CASE 2 I

lE iy0 g

5.

f I

I f

j 0.0 2.0 4.0 0.0 8.0

?0.0 12.0 14.0 16.0 i

I Figure C.1 COMPBRN-Predicted Heat Release From Burning Cables is an uncertain quantity and typically is assigned the CFAST code. Using this heat-release rate, the to some extent subjectively. This initial fire size CFAST predicts temperatures of the hot gas layer may engulf additional combustibles which result and the target cable tray, and the height of the hot in additional fire growth. The heat-release rate gas layer is compared with that predicted by l

currently is simply calculated in COMPBRN and COMPBRN.

some of the codes reviewed on the basis of complete burning of vaporized combustible which Figure C.1 illustrates the COMP 3RN-estimated is empirically measured (surface burning rate).

heat-release rate. According to the COMPBRN The availability of oxygen, and its impact on code, the heat released by a burning fuel element limiting the buming rate, sometimes referred to as is determined by three parameters: combustion ventilation-controlled buming or method-of-efficiency, heat of combustion, and mass burning oxygen-depletion calorimetry, is not typically rate. The first two parameters are user-specified modeled. This results in a very conservative input data. (The values used in the present estimate for buming rates in stacked cable trays analysis are 0.7 and 0.265E8 J/kg (-11,400 that are located near the ceiling.

Bru/lb) for the two parameters, respectively.)

Since the forced ventilation model is not used in C.I.2 Case 2: Transport of Thermal the present study, the mass burning rate is Environment for a Given Fire Source governed by the fire surface area, a specific Heat Release Rate burning rate constant (0.43E-2 kg/m -sec (8.9E-2 2

4 lb/s /ft)), and a surface-controlled burning rate The " transport of thermal environment" routines constant (0.4E-6 kg/J (0.001 lb/Bru)). Because of in the COMPBRN computer code were compared the simplified physical model and the requirement to the CFAST code for Case 2 of the " safe of several user-controlled input parameters, the separation distance" case study of Section 6.2.13.

COMPBRN-estimated heat-release rate may The oxygen-starvation routine of CFAST was involve some degree of uncertainty as just switched off to allow this comparison.

discussed.

Case 2 is the case in which the size of the pilot Comparisons of hot gas layer temperatures are fire is reduced to 0.6 m x 0.6 m (2 ft x 2 ft).

shown.in Figure C.2, which shows that the two Because the pilot fire is not simulated in the predictions agree very well for the first 6 minutes CFAST code, the total release rate due to fire After the COMPBRN-predicted ignition of predicted by COMPBRN is provided as input to NUREG-1521 C-4 March 1998

Fire Modeline Uncenainty l

PWR ESGR 2r FT bel % RATION STUDf I

coweRu Awo.c r cowesou.cAss 2 R

co w,Rn o

g crAsT E-I=

~

{R g

\\

E"

/

g R

RO 24 4.0 64 S.0 10.0 12.0 14 4 16.0 TM pinn)

Figure C.2 Comparison of Hot Gas Layer Temperatures PWR ESGR 20.FT SEPARATION STUDr I

COMPSRN AND CFAST COMRWSON-CASE 2

=!

oOwsRu e,

gE cT

}

\\

go

,a w

s go

~

i o

I ke' O.0 22 42 8.0 8.0 104 12.0 14.0 16.0 TIME (nm)

{

Figure C.3 Comparisons of Target Cable Tray Temperatures March 1998 C-5 NUREG-1521

Fire Modelin.e Uncertainty tray C2 at 5 minutes and tray B (the target tray) at.

The physical property data are needed to define 10 minutes, the hot gas layer temperature the behavior of the fuel. Table C.2 gives the 14 f

predicted by COMPBRN is much higher than that property parameters required as input to the code.

predicted by CFAST. CFAST predicted a much Some of the properties, such as heat value, lower elevation of the hot / cold gas layer interface damage and ignition temperatures, specific than did COMPBRN. The thicker hot gas layer buming rate constant, ref!ectivity, and absorption probably contributed to the lower temperature in coefficient, are significant in the damage time the hot region predicted by CFAST.

assessment. A reasonable estimate of these parameters is essential for the COMPBRN Figure C.3 compares the target cable tray analysis.

temperatures. In the COMPBRN analysis, the target is located at an elevation of 4.27 m (9.4 ft)

The model parameters used as inputs are needed above the floor. Because it is within the hot gas to represent the uncertainties of the simplified layer region, it receives radiative and convective physical models in the code. These parameters heat transfer and is heated up continuously as are related to the physical modeling of heat illustrated in Figure C.3. The target reaches the transfer, forced ventilation, doorway, enclosure user-specified ignition temperature of 733 K walls, and flame / plume entrainment. The seven (860 *F) at about 10 minutes, from which time the model parameters and the COMPBRN-suggested target remains at the constant ignition values are given in Table C.3. Many of the temperature. In the CFAST analysis, the target is suggested values were determined by comparisons located at an elevation of 3 m (9.8 ft) from the with experiments.

floor, the same elevation as the pilot fire source.

CFAST shows that the target temperature The variability factors are provided by the code to increases from an initial 300 K (81 *F) to about allow users to multiply the results of various 437 K (327 *F) during the first 5 minutes when models by a specified modification factor. Since the target is outside the hot layer and the dominant these factors are introduced to modify such values heat transfer mechanism is radiation heating.

as the burning rate, flame height, heat transfer, Because CFAST does not model the ignition of and temperature, they are expected to be able to the target cable tray, the target temperature play an important role in the assessment of fire increases continuously and reaches a peak of growth. The 14 variability factors and their about 957 K (1263 *F) at 13 minutes. In general, default values are listed in Table. 8.4. All default the target temperature follows the heat-release rate values were used in the present analysis.

given in Figure C.I.

C.I.3 Case 3: Integrated Verification of Finally, the CFAST code has an option to COMPBRN III and COMPBRN IIIe terminate fire growth if sufficient oxygen is not Using Fire Test Data available in the room. This option was not used in the present comparison study.

Verification of the COMPBRN III code is described by Ho et al. (1988) and is important Uncertainties of COMPBRN IIIe because the code utilizes approximations that go beyond some of the other two-layer codes. These The quasi-static twa-zone approach used in Sre mclude not calculating the heat loss to the walls of models such as in COMPBRN code involves a the compartment, but instead assigning a fraction large degree of uncertainty in simulating the of the heat of combustion to the loss (mostly by process of fire growth. To address the radiation) from the plume, and assuming that the uncertainties, the code provides many user-fire bums typically through surface-controlled specified input parameters that can be adjusted to burning with a specified combustion efficiency.

perform uncertainty or sensitivity studies. These Gas concentrations are not calculated. These parameters include physical property data for simplifying assumptions have an important combustible materials, model parameters, and benefit, as described in EPRI NP-7282. The variability factors.

program runs very fast, making it feasible to NUREG-1521 C-6 March 1998

Fire Modeling Uncertainty Table C.2 Physical Property Parameters Suggested Values Property Parameters Cable Oil 2

Density, kg/m 1710 900 Specific heat, J/kg/K 1040 2100 Thermal conductivity, W/m/K 0.092 0.145 Heat value. MJ/kg 20.6 46.7 Pilot ignition temperature, K 773 400 Spontaneous ignition temperature. K 776 486 l

Damage temperature, K 623 Ventilation-controlled burning rate constant 0.11 0.11 Specific buming rate constant, kg/m -sec 0.0043 0.061 2

Surface control burning rate constant, kg/J 0.18 x 10 0.2 x 104 4

Combustion efficiency 0.7 0.9 l

Fraction of flame heat released as radiation 0.4 0.45 l

Absorption coefficient for flame gases,1/m 1.4 1.4 Reflectivity 0.2 0.35 Table C.3 Model Parameters Suggested Model Parameters Value Heat transfer coefficient for heat transfer in a flame, W/m /K 22 2

Convective heat transfer coefficient outside of hot gas layer, W/m /K 10 2

l Coefficient of inflow air through doorway 0.6 Coefficient of discharge for doorway 0.7 Absorption coefficient of hot gas (1/m) 1.3 Heat transfer coefficient for ceiling and for objects in the hot gas layer, W/m /K 10 2

(Buoyant plume entrainment_ coefficient

• 2.0 1

• The buoyant plume entrainment coefficient

= 2.0 for pool fire unaffected by enclosure

= 1.5 for pool fire next to a wall

= 1.25 for pool fire at a corner l

March 1998 C-7 NUREG-1521 l

l

Fire %deline Uncertainty Table C.4 User-Specified Variability Factors in COMPBRN IIIe Variability Factors Default Value Ventilation-controlled burning rate 1.0 Fuel-surface-controlled burning rate 1.0 Flame height for horizontal fuel 1.0 Flame height for vertical fuel 1.0 Radiative heat flux interchange 1.0 i

Buoyant plume temperature 1.0 Convective heat transfer coefficient for venical surface in plume 1.0 Convective heat transfer coefficient for horizontal surface in plume 1.0 Gas layer local temperature 1.0 Heat transfer to self fer sertical fuel 1.0 Heat transfer to adjacent fuel 1.0 Heat flux from ceiling hot gas layer 1.0 Heat flux from re-radiation from walls and barriers 1.0 Mass burnout fraction 1.0 l

assign distribution functions to the imprecisely (Steckler et al.,1984). Rathe<;, the flow.t into and known input variables, and to make multiple runs out of the doorway were integrated according to to obtain a Monte Carlo distribution of the results the measured temperature profiles. Ho et al.

for use in risk analyses. It is imponant to evaluate (1988) assume for these runs that the fraction of how well the program is able to predict the the heat of combustion lost by radiation is 0.15, environmental parameters important in a nuclear which is reasonable for a methane flame that power plant companment fire. The verification produces no soot.

process (Ho et al.,1988) used two sets of data from the literature. The first set (Steckler et al.,

Data from NUREG/CR-3192 are used to test the 1984) involved carefully instrumented tests using capability of COMPBRN III to predict hot gas a constant methane bumer fire to cause buoyancy-layer temperature, heat flux to cables in a cable driven flows out of and into a doorway. The tray at a 6.1-m (20-ft) distance from a pan of results were characterized by calculated inflow buming heptane, and temperatures of the cables.

and outflow coefficients.

The burning rate, in some tests, did change with t.me because, depending on the size of the When the same doorway was used with different doorway, the air in the room could become rates of burner heat rebase, the inflow vitiated with oxygen. Figures C.4 through C.7 coefficients varied from 0.73 to 1.60 and the show how the layer temperature, heat flux, and outflow coefficients varied from 0 69 to 0.90.

cable jacket temperature vary with the four COMPBRN III closely reproduced the different doorway sizes and show the COMPBRN experimental upper layer temperature, layer height III predictions for various assumed combustion in the room, and layer height in the doorway, if efficiencies. In all cases, the assumed fraction of the correct doorway coefficients were used (Ho et heat lost from the plume by radiation was 0.4, a al.,

1988). This is more than a simple reasonable number for a flame-producing soot. A demonstration that COMPBRN III does the combustion efficiency of 0.85, also a reasonable arithmetic correctly, however, because a two-layer value for a liquid pool fire, seems a good average.

model had not been used for the experiment The results of verification indicate good NUREG-1521 C-8 March 1998

l Fire Modeline Uncertainty agreement between the test and the code occurring during a fire scenario are quite complex.

prediction.

It is also accepted that the current fire modeling computer codes provide a somewhat simplified Note that for both sets of verification data, the picture (in varying degrees) of the phenomena situation is consistent with the assumptions of involved. Therefore, it would be quite natural to COMPBRN III. The fires were reasonably identify a large number of deficiencies in such constant at heat-release rates that resulted in codes when applied to a specific fire scenario.

relatively low upper-layer temperatures, below Acknowledging the existence of uncertainty is 600 K (621 *F). Fires in compartments smaller preferable to ignoring it, but there is a danger that than those in nuclear power plants are generally such codes will not be utilized because of not constant but grow with time, and the upper-unresolved uncertainty issues. A deterministic layer temperatures frequently exceed flashover approach to this problem is to limit the utilization

]

levels (about 870 K (ll10 *F). Thermal radiation of the code to only those fire scenarios or case is, of course, a function of the fourth power of the runs in which the uncenainties are judged to be absolute temperature. COMPBRN III results will small, therefore justifying its applicability. There l

need to be validated for scenarios during which are two fundamental flaws with such an approach:

fire grows with time, or tl.e upper layer reaches a (1) asserting whether the uncenainties are small or temperature greater than ~650 K (711 *F).

not implies that they are quantified and (2) identifying a comprehensive set of C.2 A PROPOSED TREATMENT FOR configurations and parameters for which a FIRE MODELING UNCERTAINTY computer code, comprising many models and submodels, could be effectively used may not be The preceding sections of this chapter discuss the possible without severely limiting the application specific contributors to the uncertainties in the domain of the code.

results of a fire PRA. These sources of uncenainties are identified for those modeling Contrary to the deterministic approach, the tools and data commonly used in recent fire probabilistic approach requires that modeling PRAs, and they may not be applicable to more uncertainties be quantified in a formal manner for advanced tools and data which could be used in each case run and the decision be left to the user such analyses. The sources of uncertainties are in light of variabilities of the results predicted.

artificially categorized in two groups-modeling However, the probabilistic approach cannot be j

and data uncertainties. "Modeling uncertainties" utilized unless we proceed beyond the current mainly refers to those sources of uncenainties that haphazard, qualitative treatment of the modeling stem from commonly used fire propagation uncenainty. Although the rationale for the models. Error in code predictions for those cases probabilistic approach has long been accepted, that involve phenomena beyond the applicability there is little or no consensus on the of the code assumptions are also treated as methodologies to be employed.

i i

additional contributors to uncertainties. This l

proposal did not attempt to formally quantify the This section proposes an approach for evaluating uncertainties or to explicitly differentiate between modeling uncertainties. In this approach, uncenainty, variability, and inaccuracy in code modeling uncertainties are estimated at the lowest prediction.

level of modeling at which experimental data are available and are propagated through the various Identifying the sources of modeling uncertainties interconnected modules. This section also in currently available fire propagation computer contains a perspective on modeling vs. data codes, but not quantifying them, has resulted in a uncertainties as it pertains to fire propagation general mistrust in fire code predictions. This is modeling. It also discusses some approaches for in contrast to the misleading precision of the formal evaluation of such uncertainties and, more current fire regulations. It is well accepted in the importantly, practical uses of code predictions in technical community that the fire combustion, a decisionmaking process.

fluid mechanic, and heat transfer phenomena l

March 1998 C-9 NUREG-1521 1

Fire Modeling Uncertainty i

1 - SN!JUL DATA 2-COMPBRN lli (n = 0.7) 3 - COMPBRN lli (n = 0.85) 4 - COMPBRN lil (n = 1.0) 600 4

~G g 300 _r

/2......... ~~*

l m

m h 400 _ /1 g-x m

u I

m m

H x

x W

4 - 500 1.... -

g my

___..............* **3 2

o x

400 x Q

c R5 e.

m 3

20 $

6

>i

ad B

3 4

x r

3 4

s..... _... :..

7./

2 1

0 O 300 600 900 TIME (sec)

Reproduced From NUREG/CR-3192 Figure C.4 Simulation of SNI/UL Experiment 1 NUREG-1521 C-10 March 1998

Fire Modeling Uncertainty 1 - SNIJUL DATA 4 - COMPBRN 111 (n = 1.0) 2 - COMPBRN 111 (q = 0.7) 5 COMPBRN 111 (q = 0.7) 3 - COMPBRN lli (n = 0.85)

C COMPBRN lli (n = 1.0) 600 4

'.f'**'..*~.....-

7

,..,...... ~'.<*

-3 f

M 500 2f,.'

6 S

/

ui

-e E

1l:

5 400 E.,

E 4

,N 1

m

,,............3........

w 3

.... -~

500 m

6 w

3.*

}

2 e

W h

e,.

5 g

a^

E m

/

B e

m 300 o

=0

>E "3d 8

.?.

4.rs

-w.

-; *

• v.. *. -... '

2

..,/,./..*......,s/

y,

.. *l \\ l 5

4

,,,q.

1l 0

O 300 600 900 TIME (sec)

Reproduced From NUREG/CR-3192 i

Figure C.5 Simulation of SNIJUL Experirnent 2 l

March 1998 C-11 NUREG-1521 1

I

i i

Fire Modeling Uncertainty 1 - SNUUL DATA 2 - COMPSRN 111 (n = 0.7) 3 - COMPBRN lli (n = 0.85) 4 - COMPBRN 111 (n - 1.0) 4

~

_ ~~~

l r5 600

?

-f o

500 i,. -

ig tr

/

-i:

w 400 12 I

E 600 p

g

-/

,w 5

300 g

3 g

s00 y

w a

4 m

g 400 g

3 m

C Y

~

e o

1. /

~

300 m

am<

o a.

12 XD 4

l:......:..-

g

- (

Q g

- [2

/.t,

./

8

-r

,l \\....~....-.i 4

8 0 O 300 600 900 TIME (sec)

Reproduced From NUREG/CR-3192 Figure C.6 Simulation of SNUUL Experiment 3 NUREG-1521 C-12 March 1998

Fire Modeling Uncertain 2r l

1 - SNUUL DATA 2 - COMPBRN 111 (n = 0.65) 3 - COMPBRN lli (n = 1.0)

M m.

g g

./

s00 g

l 1/

e l

400

/

57 W

W g

300 i

E to<

500 O

p us g

. =.. * *. * *,...

W 400 x0 1.*

~a 6

W a

W b

o

~

a h

8 3r B

x 2

(.

4*.

.p I

I f

I f

l 3

g g

g y

a g

g 0

300 600 900 TIME (sec)

Reproduced From NUREG/CR-3192 Figure C.7 i

Simulation of SNUUL Experiment 4 i

i March i998 C-13 NUREG.1521

Fire Modeling Uncertainty C.2.1 Model: A Simple Definition should be noted that to neglect some contributors, one may not need to know the universal form of l

A model is a mathematical description of a theory, the operator L. For example, one may choose to l

neglect all influencing variables of a short-term sometimes under certain restrictions or assumptions, which can explain a set of transient if the objective of the model is to experimental observations and predict the results evaluate the long-term transient response. Here, of a similar experiment not yet observed. Models the modeler neglects the effect of the short-term have a specific objective which defines what the transients and the associated influencing variable model will predict, and a minimum set of only on the basis of the objective of the model, restrictions that are required for the prediction to but not necessarily on the basis of universal form be valid.* Several models can be developed for a of the operator L. La reality, the universal form of given theory depending on the objectives chosen operator L is only known for a few fundamental for the model and the restrictions imposed on the theories.

theory. Therefore, some models can have wider applications than others if they contain less Given the objective and the influencing variables restrictive assumptions and simplifications.

(Y and X), and a set of experimental measurements of X and Y, the analyst completes the model by C.2.2 Model vs Parameter Uncertainty selecting appropriate forms for L and proper statistical estimates for a. There is obviously an A model has a mathematical form (shown by an interplay between the form L an:1 the parameter operator L(.) ) containing input variables **

vector set a. Generally for any given L, statistical represented by vector X, an output variable shown estimates for a and their associated uncertainties by vector Y, and parameter variables (a part of can be obtained. For this reason, many believe data uncertainty) given by vector a : Y = L (X, that the uncertainty in a model structure L can a).

always be represented by parameter uncenainties.

Using the same argument, the parameter The theory upon which a model is based typically uncertainties could also be represented by the identifies the relationship of the influencing model uncertainty. This interplay between the (input) variable X on the output variable Y. The parameter and model uncertainty could allow the first question of concern is the question of aggregation of both types of uncertainties in a completeness, i.e., are all the influencing variables form of either the parameter or model uncertainty accounted for in the model? In almost all of the for a domain for which experimental data are models used for engineering calculations, some observed. However, if the model is used for its influencing parameters am not accounted for. The primary objective, which is the prediction of the modeler usually neglects some contributors to output variables for a domain ofinput variables X facilitate obtaining a solution to the model. This for which no experimental data are available, the greatly influences the domain of model form of the operator L can significantly change applicability. However, the modeler assures that, the prediction or the extrapolation of the for the domain of the app'icability, the effects of experimental results. In this case the modeling such approximations are small and can be uncenainties (represented by different forms of accounted for by the parameter's uncenainties. It the operator L, e.g., L ) would not be captured by j

the parameter uncertainties. Generally, parameter uncenainties are more imponant for interpolations

• As an example, a model can be constructed on the within the experimental domain (since parameter basis of the conservation of the momentum in a uncertainties are estimated and adjusted to reflect buoyant fluid with an objective to predict the the variations in the existing experimental results),.

mean velocity assuming a top hat velocity profile whereas modeling uncertainty would be more for the fluid as typically used for semi-empirical imponant in extrapolation outside the experimental formulation of the fire plume.

results. It would be also a matter of convenience and consistency to differentiate between the

• • More generally referred to here as influencing variables.

model and parameter uncertainties for both NUREG-1521 C-14 March 1998

Fire Modeling Uncertainty interpolation and extrapolation of the uncertainties in initial and boundary conditions, experimental results.

and the inaccuracy of numerical algorithm are referred to as " data uncertainty." The modeling The operator L can take the form of a function, a uncertainty, therefore, deals only with the various set of partial differential equations, integral acceptable forms of the operator L.

equations, or a combination thereof. When operator L describes a process with initial and C.2.3 How To Quantify Modeling boundary conditions, another source of Uncertainty uncertainty enters the results. In most modeling applications to PRAs, the initial and boundary Formal methodologies are currently available to conditions are uncertain. An example of the initial evaluate the parameter uncenainties and the condition could be the ambient temperature in a variability in initial and boundary conditions room when a fire starts. The room temperature (referred to as " data uncertainty"). However may vary significantly throughout the year research results and formal methods for evaluating (seasonal variation). Therefore, this initial modeling uncertainty are sparse and application condition would be uncertain since fire could results do not exist. A framework recently occur at any time of year. Another example proposed by Apostolakis (see NUREG/CP-0138) related to fire PRA would be the initial size of the is commonly referred to as the P(M) framework.

transient fire as the initial condition for fire In this framework model, uncertainty is measured propagation modeling.

The uncertainties by a probability distribution over a given set of l

associated with initial and boundary conditions in model operators L,. As discussed in the workshop PRA applications are typically irreducible (see NUREG/CP-0138), a number of difficulties uncertainties (or what is usually referred to as that can arise from such an interpretation of l

" variability"). That is, collecting more detailed modeling uncenainty and its subsequent infonnation from the fire events in nuclear power quantification. We therefore propose, albeit plants may not necessarily reduce the informally, another approach for interpretation l

uncertainties in the initial fire size, but may and quantification of the model uncertainty. In l

provide better estimates on its uncertainty this

approach, model uncertainties are parameters. The uncertainties associated with decomposed and treated at the basic module levels initial and boundary conditions are currently being of a computer code. The code is typically treated as a part of data uncertainty in some fire considered as a number of modules and i

computer codes. In other fire analyses, the submodules that are integrated by proper uncenainties of the initial fire size are not assignments of outputs of one or more explicitly accounted for. In these analyses, a submodules to the inputs of other modules.

maximum credible initial fire size is typically Various sources of uncenainties, including the selected to show the capability of the fire modeling uncertainty, then are propagated from protection systems. This is similar to use of one module to another to arrive at the final models in design applications, where the initial uncertainties of the code predictions. To do this, and boundary cor.ditions are typically assumed, we define a new random variable y to represent i

rather than formally addressed.

the modeling uncertainty for each module. That is The last source of uncenainties in modeling prediction could result from the use of numerical Y = L (X, a )+y (C--1) algorithm and nodalization (or discretization) for solving the model. Such numerical inaccuracies The probability distribution for mndom variable y could be generally reduced. These inaccuracies could be conditional on X, or on some distance are not expected to contribute significantly to the measure of X. An example of a distance measure

'l uncertainties in model prediction for most of the could be a Euclidean distance of X from those l

commonly accepted codes.

values of X that are observed by experiments (Euclidean distance of a point from a cluster of Generally, the parameter uncertainty, the experimental ooints). Other measures of distance

{

March 1998 C-15 NUREG-1521 J

Fire Modeling Uncertain 2v could be envisioned, especially those that are Engineering and scientific considerations can be normalized. An alternate form of Equation C-1 used to explore the characteristics of R for the 3

l may be written by expressing y by a residue-domain of application for each module based on I

random-variable Rx and the expectation of the the experimental information that is available.

operator L over all values of a. That is Treatment of modeling uncertainty at the module level also facilitates the use of both the available Y = L (X, a )+ Rx{E,[L(X,n)]}

(C-2) experimental results and the results from more rigorous modular codes for the determination and Taking expectations over a and the residue calibration of the characteristics of R. These j

variable Rx from both sides of Equation C-2 for modular uncertainty characteris-tics then can be a given value of X results in propagated through an integrated code to arrive at a distribution for the plausible code predictions, Eo(Y) = E, [L(X,a)) + E(Rx){ E, [L(X,a)]}.

accounting for all known uncertainties.

Now if we consider the existence of a model L*

This approach relies heavily on the results of for which the E(Rx) is zero (sometimes referred to experiments for each module rather than on the as a best-estimate model), then for any model L results of integral tests. The results of integral j

with the associated residue function R, the tests are used mainly for validation to show that 3

following expression holds:

the test results are within the uncertainty ranges of the code pn: dictions and that the code predictions E( R ) = (L* - L )/L; (C-3) are unbiased. On the contrary, the experimental j

j results for each module are directly used to Equation C-3 basically describes the close estimate both the modeling and the parameter relationship of the expectation of R; with the uncertainties. Each module can be generally degree of bias embedded in the selected model categorized into one of the three groups that for the module under study. For a conservative follow:

model, this is referred to as a safety factor. The degree of bias in a model simply results from a (1) Pirysically based module: This is a modeling conservative assumption. As an example, heat module for which the underlying physics is losses may only be considered through the ceiling well understood, and the uncertainties and not for the side walls in a fire model.

mainly stem from model simplification, Obviously, such an assumption introduces numerical algorithms, and the uncertainties conservatism which will eventually result in associated with initial and boundary overestimations of the temperature and the conditions.

thickness of the hot layer. The variance of R;is similarly related to the mathematical (2) Semi-empirical module: This is a modeling approximation of the underlying physical module for which the influencing variable phenomenon. As an example, the solution of a can be identified and a qualitative heat conduction model for the temperature profile relationship (but not the exact equation) in a finite slab could be approximated by between input and output variables can be neglecting the second-order and higher order established, e.g., pressure and temperature terms in the appropriate expansions. Such an are monotonic. Here the experimental results approximate raodel could be used to obtain an can be used to determine the most estimate for slab heatup calculations (change of appropriate functional form and its mean temperature vs. time). Therefore, a simpler associated uncertainties.

model may underestimate the variance of the results compared to a more accurate model if only (3) Empirical module: This is a modeling parameter uncertainties are considered. The module for which the level of physical variance of R,, therefore, should be larger in a less understanding is poor and consensus is not rigorous model to compensate for this established among experts.

The underestimation of variance.

experimental results are typically sparse in NUREG-1521 C-16 March 1998

Fire Modeline Uncerwiniv this category. Therefore, the experts may decisionmaker evaluates the technical details propose different models-each with of the various modules within the model or different implications. The proposed P{ M,)

the computer code. The focus is to identify framework discussed earlier would be most the scope of the modeling and how it suited for this category. Sparse experimental compares with the phenomenon ofinterest in data may be used to appropriately weigh the scenario. The analyst checks that the different expert judgment. Another approach methods used are well documented, their that is more consistent with our earlier limitations are well known, and so forth.

framework is to take the average of all the This step basically establishes the credibility functional forms proposed by the expens, of the model and its applicability, and to show the variation among experts by the distribution of the residue variable R.

(2) Quantitative considerations: Here the 3

The prior distribution for R; obtained in this decisionmaker evaluates the summary results manner then could be used in a Bayesian of the computer code. This evaluation is updating routine to arrive at the posterior typically done by model verification and uncenainty distribution for each module validation. Verification and validation when sparse test results are available.

typically involve comparing the code summary results with the results of more A computer code may contain several modules in sophisticated codes or experiments. In most each category defined above, depending on the cases, this type of evaluation results in code state-of-the-art knowledge for the phenomena or model calibration. Every computer code represented by the modules. Some thermo-has a set of tuning parameters that can be hydraulic codes may contain mostly category I adjusted to result in a closer estimate of modules, whereas some severe-accident codes

" reality." Here the word reality is enclosed may contain several inodules in categories 2 and by quotation marks to indicate that reality

3. A fire propagation computer code is expected refers to results that are more acceptable to to have modules that belong to each of the the analyst (e.g., from a more sophisticated preceding three categories. For example, the code) and that are expected to be a more plume module would be category 1, cable damage accurate representation of the tme outcorne.

criteria would be category 2, and burning of the Other ways of calibration involve the cables and the associated heat-release rate may be introduction of bias factors reflecting the considered as the category 3 module at the present degree of the conservatism or time (see discussion in Sections C.1 and C.2).

unconservatism in the code models.

Calibration of the models and the computer C.2.4 Decisionmaking Under Uncertainty codes are application specific. It is generally expected that, for a set of applications or When a modelis used to predict the outcome of a scenarios which involve similar initial and scenario of interest, a decision can be made to boundary conditions as well as comparable either accept or reject the final outcome. As an ranges of influencing variables, the example, a computer code may be used to calibrating and biases factors remain estimate the peak cladding temperature for a given unchanged. Such calibrations typically result scenario of interest and to compare it with an in an unbiased or a best-estimate code.

acceptable criterion (i.e.,2200 *F). If the results of the code indicate that the cladding temperature (3) Probabilistic considerations: Here the never exceeds the criterion, then a decision may decisionmaker is concemed with the final be made that the plant can safely respond to that decision for the specific scenario analyzed, transient, However, to arrive at that decision the on the basis of the summary results analyst typically evaluates the following generated by the code. The decisionmaker considerations:

(perhaps the regulator) is aware that the results generated by the code are accurate (1) Qualitative considerations: Here the within a certain error bound. In our earlier March 1998 C-17 NUREG-1521

Fire Modeling Uncertainty example, if the code predicts a peak cladding concentration of combustible products, humidity, temperature of 2150 'F, compared to the and other thermohydraulic characteristics, such as 2200 *F criterion, the regulator may decide gas temperature and velocity. A fire computer that the criterion is not met. (The regulator in code is typically written in modules or submodels a sense believes that the code prediction is that are integrated by proper assignments of not accurate within 50 *F.) This problem is outputs of one submodel to the inputs of other traditionally treated informally in an ad hoc modules. Various sources of uncertainty, manner with the use of safety factors. The therefore, are propagated from one module to regulator commonly uses either a another in an integrated code. The modeling conservative criterion (e.g.,2000 *F instead uncertainties for each module, therefore, should of 2200 *F) or a conservative analysis with cover large ranges of the influencing variables. As the use of a multiplier. In some cases, both noted earlier, the dependence of modeling are used. Probabilistic analysis, on the uncertainty (i.e., mean and variance) with the contrary, is a formal methodology that values of the influencing variable should be quantifies the uncenainties from both the accounted for with some kind of normalized model and data, and it allows an estimation distance measures.

Various sources of of the probability that a decision is true experimental and analytical data are typically (confidence level).

Conse-quences of available at the sub-model level to estimate the decision alternatives may be evaluated and parameters of the modeling uncertainty compared formally, and the final decision distribution. The formal evaluation of modeling can be optimized on the basis of a given cost uncertainty is both costly and time consuming.

function, if so desired. In most cases, a Therefore, the analyst should focus on the major regulator is interested in the outcome that sources of this uncertainty. Section 8.2 illustrates has a high level of confidence (95 percent or a process to characterize the major sources of more).

For this reason, uncertainty modeling uncertainties in current fire computer evaluation should become an integral part of codes where the study should focus. It is the decision process.

sometimes more beneficial to substitute more comprehensive models (if available and practical)

C.2.5 Considerations of Uncertainties in Fire for deficient code modules, rather than formally Modeling estimating the resulting modeling uncertainties.

As an example, for a fire computer code, it might A fire modeling computer code for use in fire risk be more prudent to model the effect of the oxygen assessment in nuclear power plants should provide availability for predicting fire heat-release rate, the following minimuminformation:

rather than treating it as a source of uncertainty.

Both subjective evaluation and sensitivity runs are time of activation of fire detectors helpful to decompose and prioritize the sources of uncertainties and to identify those areas of time of activation of fire suppression modeling that can be easily refined.

l a

systems j

In addition to performing uncertainty analyses at time of damage of critical targets and the submodel level, some authors have equipment recommended evaluating modeling uncertainty at the code level when integrated test results are l

time of flashover available. Methods such as the use of mixture I

a distribution were recommended by the Nuclear time of barrier failure and propagation to Safety Analysis Center in NSAC 181. We feel that a

other rooms integral test are important for code verification I

and for understanding the interactions among I

time of fire burnout various phenomena involved in the scenario. The results of integral tests, when decomposed to These objectives are met by predicting the local different phenomena and submodels, could be NUREG-1521 C-18 March 1998

Fire Modeline Uncertain 2r used in the approach discussed here to estimate additional combustibles. Current computer codes both the raodeling and the data uncertainty.

are judged to perform sound analyses of thermal environments, and some may carry formal C.3

SUMMARY

uncertainty evaluation. On the other hand, current codes either do not model the source fire heat-Various uncertainty issues associated with risk-release rate or the treatment is valid only under informed and performance-based approaches certain conditions. In any case, the heat-release specific to fire protection requirements are rate of the fire source, knowing the current state discussed in this chapter including those with fire of the an, may be best estimated conservatively by modeling. Many fire protection requirements may using simplified engineering evaluation, be evaluated without the need for fire modeling subjective judgment, and extrapolation of actual (e.g., surycillance issues and system issues). For fire events or fire tests.

these cases, the issue of uncertainty can be formally addressed and incorporated in the Some definitions for modeling and data decisionmaking process. In other cases in which uncenainties are proposed in Section C.3. Several evaluation of the requirement necessitates the use sources of data uncertainties, i.e., parameter of fire modeling, the portion of.'ae modeling that uncertainty and uneenainty of initial and predicts the fire heat-release rate was boundary conditionsm are identified. The current differentiated from the portion that predicts the treatment of data uncenainties is summarized and thermal environment. Larger uncertainty ranges different sources of modeling uncertainties are associated with the predicted heat-release rate resulting from assumptions, approximations, than with the thermal environment. The heat-simplifications, and numerical algorithms are release rate is the driving force for the plume mass discussed. An approach is proposed on the basis flow rate, the ceiling jet temperature, and finally, of decomposition of uncenainties to the most the hot layer temperature that is driven by energy basic level of modeling and aggregation of the balance. The fire heat-release rate is dependent uncenainties using the current uncertainty on the initial fire size, the growth of fire by propagation techniques.

A process for propagation and ignition of additional decisionmaking under both modeling and data combustibles, and the heat-release rate from these uncenainty is also presented.

(

l March 1998 C-19 NUREG-1521

1 Appendix D i

APPLICATIONS OF RISK-INFORMED, PERFORMANCE-BASED METHODS 1

J l

l l

J CONTENTS P

-_ age D.1 FORMAL UNCERTAINTY EVALUATION FOR ANALYSES FOR OPIIMIZING TEST DURATION FOR APPENDIX R EMERGENCY LIGHTING.................. D-1 D.2 FIRE MODELS AND COMPUTER CODES BASED ON ZONE MODELS-ANALYSIS OF SAFE SEPARATION DISTANCE................................ D-6 D.2.1 Importance of the Case Study.......................................... D-7 D.2.2 PWR Case Study.................................... -............... D.7 D.2.3 Su mmary......................................................... D-18 D.3 ANALYSIS OF THE 72-HOUR CRITERION TO REACH COLD SHUTDOWN....... D-21 D.3.1 B ackground...................................................... D-22 D3.2 B WR Case Study................................................... D-22 D.3.3 Uncertainty Analysis............................................... D-30 D.3.4 S u mmary........................................................ D-3 1 i

Figures D.1 Uncertainties in All Random Parameters......................................... D-4 D.2 Uncertainties in Parameters F, a, and in Temperature t............................. D-4

' D.3 Uncertainties in Parameters F, and in Temperature t............................... D-5 l

D.4 Uncertainties in Temperature t................................................. D-5 D.5 Failure Probability for Battery-Operated Emergency Lights (8-Hour Mission Time, 8-Hour-Rated Battery)........................................................ D-6 D.6 Blustration of Critical Cable Locations in the Representative Emergency Switchgear Room (Confi guration 1 ).......................................................... D D.7 Failure Probability of Suppression vs. Time for Manually Actuated Halon Systems...... D-11 D.8 Failure Probability of Suppression vs. Time for Automatically Actuated Suppression..... D-11 D.9 2-MW Fire Source Target and Hot Layer Temperature............................ D-19 D.10 ' 2-MW Fire Source Target and Hot Layer Temperature............................. D-19 D.11 3-MW Fire Source Target and Hot Layer Temperature............................. D-20 D.12 72-Hour Case Study-Event Tree for Case 1.................................... D-24 D.13 72 Hour Case Study-Quantified Event Tree for Case 1............................ D-25 l

D.14 72-Hour Case Study-Event Tree for Case 2.................................... D-28 D.15 72-Hour Case Study-Quantified Event Tree for Case 2............................ D-29 D.16, Cumulative Probability Function for Case 1................................... D-32 D.17 Cumulative Probability Function for Case 2..................................... D-32 I

l-Tables -

u D.1.

FIVE Worksheet 2 (Fire Intensity = 6.5MW).................................... D-13 D.2 Summary Results From FIVE Analyses..................................... D-16 D.3 Mcdific i Parameters Used for COMPBRN IIIe................................. D-16

' D.4 '

Summary of COMPERN Results............................................. D-17 D.5.

Distributions of Terms for Core-Damage Equation for Fire Area AC................ D-2 6 March 1998 D-iii NUREG-1521

l i

APPENDIX D APPLICATIONS OF RISK-INFORMED, PERFORMANCE-BASED METHODS D.I FORMAL UNCERTAINTY Formal and defensible uncertainty evaluation for l

EVALUATION FOR ANALYSES this case study would require the availability of i

FOR OPTIMIZING TEST specific test data to estimate the parameters of the DURATION FOR APPENDIX R models. Such parameters are not currently EMERGENCY LIGHTING available even though they could be obtained either from the manufacturer or by a set of tests, The case study presented in Section 6.2.1.2.2 as discussed later. Regardless of the availability of shows that reducing the duration of annual testing the specific data, an uncertainty evaluation could from 8 to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> could reduce the number of still be performed using subjective estimates on battery replacernents, while at the same time, their the uncertainty range of these parameters. For this reliabilities would only marginally change. The demonstration, the following discussion will analysis assumed that the actual battery rating is concentrate on the first modeling module. The normally distributed and the parameters for the modeling parameters and modeling assumptions normal distributions were subjectively assigned that are subject to variation are identified, using the available engineering information and followed by a discussion of the sources of test data (see Equations 6-2 and 6-3). Formal uncertainties and the specific test data that can be uncertainty analysis was not performed since used to estimate the expected variations.

some of the engineering data were qualitative and not amenable to formal quantative uncertainty The actual rating of a rechargeable battery can be l

evaluation. However, it is felt that it would be described by the following expression:

important to demonstrate the uncertainty i

evaluation methodologies in this section by Actual Rating = Manufacturer's Rating asdgning quantitative values to those measures x Margin Factor x Effect where only qualitative information is currently of Previous Discharges avaMable.

x Effect of Temperature j

The analyses for this case study consists of three Manufacturer's Rating modules:

The following assumptions are made for the l

(1) semi-empMcal models to determine the manufacturer's rating:

l failure probability of an emergency light l

when demanded for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of continuous Modeling Assumption: Coefficient operation, given several previous full discharges Parameter Uncertainty: None (This is actually the name-plate rating.)

(2) reliability replacement models to determine j

the expected number of full discharge tests Margin Factor l

that each unit (out of a population of l

emergency lights) could have experienced, The following assumptions are made for the accounting for replacement after failure margin factor:

(3) reliability integration models to determine Modeling Assumption: Coefficient = 1 +

the failure probability for the minimum number of emergency lights required for a Parameter Uncertainty: The uncertainty a

successful demand would represent the variation in margin for March 1998 D-1 NUREG-1521

RiskJnformed. Performance-Based Methods different manufacturers and for the same Effect of Temperature manufacturer, but different manufacturing batches. In most cases, the manufacturer or The effect of temperature on the rating is the batch records may not be available and estimated on the basis of empirical cell-size both sources of variability should be included correction factors tabulated in ANS/IEEE 485-in the analysis. Testing different types of 1983 (see Table 6.2). The effect of temperature is batteries to failure would provide the the reciprocal of the correction factor shown in necessary information for estimating this this table.

factor. For this anulysis, the parameter p is subjectively assumed to be lognormally A quadratic curve fit to the data in the table distributed with the mean of 0.15 and an error resulted in the following dependence of the factor of 3.

correction factor on the temperature: Correction 2

Factor = 1.4 - 0.02157 t + 0.0002181 t,

Effect of Previous Discharges Mean square error is less than 3 percent for each The number of full discharges is expected to coefficient of the quadratic function, i.e., this reduce the battery's capabilities. Generally, function excellently approximates the data. The batteries that are fully discharged (based on their actual temperature in the room at the time of manufacturer's rating) more than 20 times are not demand is a stochastic variable which varies from considered reliable. The relationship between the one room to another, and depends on the heating, number of discharges and the effect on battery ventilation, and air conditioning (HVAC) system rating is not clear. The relationship could be and temperature control at the room, the seasonal presented through a concave, linear, or convex variation of the outside temperature, and the curve. A linear model was used in the previous location of the plant and its associated climates.

point estimate calculations.

This type of information is easily obtainable for a given room. For this case study the following Modeling Assumption: The effect is shown by assumptions are made:

a family of curves based on the value of a:

Modeling Assumption: Empirically based between 0.2 and 1.8, as follows:

models (1 - No Fo )*

Parameter Uncertainty:The equivalent where temperature at the time of demand is assumed No = the number of demands to be normally distributed with the mean of 18 F, = the discharge coefficient.

and standard deviation of 8 *C.

Parameter Uncertainty: The uncertainties Using a Monte Carlo simulation and the associated with the above parameters developed model, the uncertainty in the battery represent the design and manufacturing rating for different numbers of tests is evaluated.

variability in the useful life of a battery in Also, a probability of failure of an 8-hour-rated terms of the number of discharges in a battery-operated emergency light with 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of controlled temperature environment. The mission time is calculated.

following subjective uncertainty distributions are assigned to the above parameters:

The present model contains four uncertain parameters: parameter p in the margin factor, a:

is uniformly distributed between 0.2 parameters Fo and a, defm' ing effects of previous and 1.8.

discharges, and temperature t variations.

F,: is lognormally distributed, with the Although, from a modeling point of view, mean of 0.05 and an error factor of 2.

uncertainties in these four variables are treated No: is the number of discharges and is not a similarly, they are quite different from a physical stochastic parameter.

point of view. We can categorize these NUREG-1521 D-2 March 1998

Risk-Informed. Performance-Based Methods uncenainties in two groups:

Case 4: Uncertainties in temperature t irreducible uncertainties or variabilities Uncertainty is removed in the margin factor 9, which cannot be eliminated (variance cannot then in the modeling parameter a, and then in the be reduced to z ro) by additional data, parameter F,. Figures D.1 through D.4 are graphs experiments, and tests an.d representing Cases 1, 2, 3, and 4, respectively.

For instance, Figure D.3 shows that with 11 reducible uncertainties which can be demands, the mean average rating equals 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

eliminated if sufficient tests are carried out, There is an irreducible uncertainty in this value:

i.e., these random variables can be reduccd to with 5-percent probability, the actual rating equals deterministic values if a sufficient amow of zero. Comparing Figures D.3 and D.4, we see that data is available.

the random coefficient F, contributes significantly to the uncenainty in the actual rating. When there Evidently, temperature variations should be are more than 10 tests, and there is an uncenainty classified as irreducible uncenainties, unless a in F., there is at least a 5-percent chance that the 3

temperature control system is installed. Also, actual rating equals zero. However, without j

variability in parameter F in effects of previous uncenainty in this random value, the 5-percent 6

discharges cannot be reduced to zero because of quantile does not reach the zero value.

variabilities in physical processes and in manufatMng parameters (e.g.,

quality of Finally, the probability of failure of a battery-materials, dimensions). An uncertainty in the operated light with an 8-hour mission time (8-modeling parameter a can be reduced to zero if hour-rated battery) is evaluated. Figure D.5 there are sufficient failure statistics i.e., we can presents this probability as a function of the find the best modeling parameter a. Parameter p number of tests; the probability ranges fron) 0.4 to in the margin factor can be treated in both ways:

1. It equals 0.4 for a new battery and 1.0 if the variability of this parameter cannot be reduced to number of tests exceeds 10. These values are zero; nevertheless, we can find some low bound slightly higher than the battery failure rates for this parameter, like a 5-percent quantile, and estimated earlier without formal treatment of use it as a deterministic value in the reliability uncertainty. The present study assumes a large evaluations.

temperature variation in the room (rather than the fixed temperature of 77 *F assumed earlier) and The Monte Carlo simulation of the battery rating generally uses lognormal distributions (which uses the model presented in the previous section.

result in more conservative estimates of the The simulation code was implemented with the mean). With such major differences between the MATHEMATICAL package. The number of tests two approaches, it is quite encouraging that the (8-hour discharges) were varied N, = 0,1,...,20 results are so close. Figure D.5 does not present

, and different statistical characteristics of the uncertainty bounds because the model does not rating (mean value, 5th, 25th, 75th, and 95th include uncenainties in the means and variances percentiles) were evaluated. To address the impact of the random values. The current assumption in of uncenainties, four cases were analyzed:

the model is that we know the distribution parameters exactly.

However, including Case 1: Uncenainties in all random parameters uncertainties in parameters of the uncertainty distributions allows us to evaluate uncertainties in Case 2: Uncenainties in the parameters F, and failure probabilities. Using conservative estimates a (which define the effects of previous for distributions, we can obtain conservative discharges) and in temperature t estimates for the failure probabilities. The conservative estimates are preferable for most Case 3: Uncertainties in the parameter F, and practical applications with highly reliable in temperature t components and systems.

March 1998 D-3 NUREG-1521

Risk-Informed. Performance-Based Methods

+ 5-TH QUANTILE +25-TH QUANTILE -*- MEAN +75-TH QUANTILE 095-TH QUANTILE 12 10 8j,

4 6

g c-4 3

2 L

0

- 0 0 0 0 0 0 0 P

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 NUMBER OFTESTS Figure D.1 Uncertainties in All Random Parameters

+5-TH QUANTILE -e-25-TH QUANTILE -A-MEAN 75-TH QUANTILE 95TH QUANTILE 12 10 8j E

8 cc 4

i

~

0 0 0 0 0 - ? ? ? 9 0

1 2

3 4 5 6 7 8

9 10 11 12 13 14 15 16 17 18 19 20 NUMBER OF TESTS Figure D.2 Uncertainties in Parameters F., a, and in Temperature t NUREG-1521 D4 March 1998

Risk-informed. Perforn:ance-Based Methods

+ 5-TH QUANTIE -e-25-TH QUANTil -DEMEAN -D-75-TH QUANTIE O 95-TH QUANTIE l

12 10 8 d 1

3 4

Q 6

e 4

8 2

s 0

. t t t t.

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 NUMBER OFTESTS Figure D.3 Uncertainties in Parameter F, and in Temperature t

+ 5-TH QUANTIE -e-25 TH QUANTILE -m-MEAN O75-TH QUANTIE 095-TH QUANTid 12 10 8j 9

6 g

e 4

2 0

O 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 NUMBER OFTESTS Figure D.4 Uncertainties in Temperature t March 1998 D-5 NUREG-1521

Risk. Informed. Perfonnan e. Based Methods 1.0

-0 0 0 ? ? ? ? ? ? ?

I O.9 0.8 0.7 E

0.6 8

tr 0.5 n.

E 0.4 <

od 0.3 N

0.2 0.1 0

O 1

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 NUMBER OFTESTS

)

l l

Fiyre D.5 l

Failure Probability for Battery-Operated Emergency Lights (8-Ilour Mission Time,8 Hour-Rated Battery)

D.2 FIRE MODELS AND COMPUTER hazards. In addition, fire detectors and an 4

CODES BASED ON ZONE automatic fire suppression system shodi be I

MODELS---ANALYSIS OF SAFE installed.

SEPARATION DISTANCE (3) Enclosure of cable, equipment. and The fire protection requirement of safe-shutdown associated non-safety circuits of one capability is contained in Section III.G of r:dundant safe-shutdown train in a fire Appendix R.Section III.G requires that one train barrier having a 1-hour rating. In addition, l

of systems necessary to achieve and maintain hot fire detectors and an automatic fire j

shutdown conditions from either the control room suppression system should be installed.

)

or emergency control station (s) be free of fire damage. This requirement is met using one of the Finally, if none of the items in (1) through (3) are following strategies:

complied with, altemative or dedicated shutdown capability independent of the fire area under (1) Separation of cables, equipment, and consideration should be provided. At many two-associated non-safety circuits of redundant unit sites, cross-connection between safe-i safe-shutdown trains by a fire barrier having shutdown systems is considered as an attemative j

a 3-hour rating.

shutdown capability. The time required for

)

manual alignment of the cross-connections has i

(2) Separation of cables, equipment, and been a major issue during mid-loop operation in associated non-safety circuits of redundant PWRs.

safe-shutdown trains by a horizontal distance of more than 6.1 m (20 ft) with no The purpose of presenting this case study is to intervening combustible materials or fire evaluate technical methods available to examine NUREG-1521 D.6 March 1998

Risk. Informed. Performance-Based Methods the risk significance of the 20-ft horizontal domestic PWR and does not represent a specific separation criterion and for alternative plant. The case study is designed to be as realistic performance-based approaches.

as possible and at the same time allow a demonstration of various technical features in the D.2.1 Importance of the Case Study framework.

As discussed briefly in Chapter 3, several licensees have selected strategy 2, but have A representative PWR emergency switchgear m (ESGR)is selected for this case study. The r

requested exemptions from the requirements associated with 6.1-m (20-ft) separation or room is 15.2 m (50 ft) x 9.1 m (30 ft) and 4.6 m areawide automatic suppression. In almost all (15 ft) high. The room contains the power and cases, some combination of low combustible instrumentation cables for the pumps and valves loading, a high compartment ceiling, or negligible associated with motor-dnven auxiliary feedwater mtervening combustible materials is used as (AFW) trains, all three high-pressure injection Justification.

(HPI) trains, and both low-pressure injection (LPI) trains. The steam generator power-operzted relief Several exemption requests were reviewed. The valves and the turbine-driven AFW trains are following two exemption requests gave specific unaffected by a fire in this area. The power and cost estimates for justifying the burden to the instrument cables associated with safe-shutdown utthty if the exemption was not approved:

equipment are arranged in separate divisions and are separated horizontally by a distance, D. The (1) Cable rerouting and an altemative power value f D is varied for this case study.

source for either high pressure coolant A simplified elevation of the ESGR, ilitstrating mJecum Ucact rC 2 85 lau nc 8 ar estimated to cost about S420,000 for critical cable locations, is shown in Figure D.6.

engineering and installation. Although it is The postulated igmtion source is either a self-likely that a modification of this magnitude ignyted cable (as a result of a fault) or cable could be deferred to a refueling outage, igmtim (as a resuk of a nansknt fim). He cpe immediate installation would require a tray referred to as " tray A," located on the right forced outage. One licensee has estimated a side of the room at an elevation of about 2.3 m potential loss of revenue of $24 million, (7.5 ft) above the floor, is considered to be the based on a 2-month forced outage, swme. ga es for se redundant na h are contained m another tray (referred to as " tray B,,

(2) The cost for installing full area automatic the target). Tray B is separated from tray A by a suppression and detection, sealing the open horizontal distance, D, as shown m Figure D.6.

penetrations, and installing 1-hour-rated fire The horizontal distance is varied in the sensitivity barrier and wraps in one fire area is analysis. Three elevations are assumed for tray B.

estimated to be $3,350,000. Similarly, on Firstway B is located 2.0 m (6.5 ft) above tray A the basis of a 2-month outage, lost revenue (i.e.,0.3 m (1 ft) below the ceiling). This choice is made because, according to the FIVE of $24 milhon is also a possibility.

M B is in Wi@ su%er D.2.2 PWR Case Study when the ratio of height of target above fire source to the height from the fire source to ceiling The importance of this case study in terms of is greater than 0.85 (6.5n.5 = 0.87 in Ais case).

potential cost savings, therefore,is expected to be eced, tray B Mocated U m (3.5 ft) above tray i

significant if such issues arise as a result of plant A. This implies that tray B,s outside the ceiling i

audits or inspections or self-examinations.

jet sublayer but withm the hot gas layer. Third, tray B is at the same elevation as tray A.

The objective of this case study is to demonstrate the feasibility of the approaches discussed in the The configuration and scenario discussed here will be analyzed using the FIVE, COMPBRN IIIe, earh.er chapters of this report. The case study described here is representative of a typical March 1998 D-7 NUREG-1521

Risk-Informed. Performance-BasedMethods l

l8 l

l c1 3 FT I

I c2 6.5 R 3.5 FT l

A D (-20 FT) 7.5 FT l

Figure D.6 Illustration of Critical Cable Locations in the Representative Emergency Switchgear Room (Configuration 1) and CFAST codes. In performing the analysis it deep, the average insulation weight is about 44.6 is assumed that kg/m (30 lb/ linear foot). Hence, the assumed mass implies that there are about 305 m (1,000 ft) of Other cable trays containing critical and non-cable trays in the room. Assuming that the heat of critical cables are located directly above tray combustion of the insulation is about 20.6 A.

megajoules (MJ)/kg (8850 Bru/lb), the total heat released is 280,050 MJ (265,500,000 Bru). For a 2

2 No combustible material inte:venes between floor area of 139.4 m (1,500 ft ), the fire load is 2

2 trays A and B.

2,010 MJ/m (177,000 Bru/ft ). If the linear value 2

2 of 15.1 MJ/m / min (1,333 Bru/ft / min) (908 2

2 The ESGR has a small wall opening about MJ/m (80,000 Bru/ft ) for the 1-hour American 2.0 m (6.5 ft) high and about 0.2 m (0.7 ft)

Society for Testing and Materials fumace test) wide.

developed by the National Fire Protection Association (NFPA) is used, the equivalent fire During a fire, most rooms will be isolated by the severity is about 133 minutes. This is considered automatic closing of fire dampers and the to be a high fire severity, shutdown of the ventilation system upon the detection of ignition. The assumption of an All ESGRs contain fire protection systems. In this opening for the ESGR is a consideration that study, it is assumed that the ESGR contains smoke facilitates the use of both the COMPBRN and detectors and a manually actuated Halon system.

CFAST codes. An opening is needed to ensure no The smoke detectors are spaced 9.1 m (30 ft) apart pressure buildup in the room.

as recommended by NFPA 72E. The Halon system is capable of totally flooding the space The major fuel source is assumed to be insulation with a 7-percent concentration of Halon and can on cables installed in trays located in the upper maintala a concentration of at least 5 percent for section of the room. A typical PWR ESGR could a 10-minute period. Passive fire-retardant coatings contain about 13,608 'kg (30,000 lb) of on cable trays and conduits is not assumed for this combustible insulation. Assuming that the cable study. It should be pointed out that the impact of trays are 61 cm (24 in.) wide and 7.6 cm (3 in.)

actuation of the fire suppression system in NUREG-1521 D-8 March 1998

..__.a

l l

Risk-Informed. Pe;formance-Based Methob l

controlling the fire cannot be treated by the for IEEE-rated cables. On the other hand the conventional deterministic tools (i.e., FIVE, FIVE methodology does not consider self-ignied j

COMPBRN, and CFAST).

cable fires (assigns a zero frequency). More recent PRAs assume that a short in a power cable For the fire scenario discussed here, the only (if not isolated) can produce enough heat to cause available equipment is associated with early decay a sustained ignition. They report, on the basis of heat removal and no injection system is available.

recent plant data, a frequency of 3.4E-8 per foot The core, therefore, will eventually uncover as a of cable tray per reactor-year (NUREG/CR-6144, result of cooldown and primary shrinkage unless Vol. 3, Pt.1). Similarly, for externally ignited one train of HPIis recovered.

cables, a value of 2.9E-8 per foot of cable tray per i

reactor-year is reported. The associated error The previous discussion conservatively assumes factor for these estimates described by a that all equipment within the fire area is damaged lognormal distribution is about 3.0. The frequency as a result of the fire. The probability of such an of a large fire initiated in an MCC is estimated to

{

event occurring is evaluated through a detailed be 1.8E-5 per reactor-year with an error factor of performance-based approach. This evaluation

10. A higher frequency is reported for relay involves cabinets, namely,6.2E-5 per reactor-year with an error factor of 3. Finally, the probability of determination of fire initiating frequency transient fires for areas similar to the ESGR is reported to be about 1.4E-3 per reactor-year with determination of fire suppression probability an error factor of about 3.

both for automatic and manual suppression This case study assumes an ESGR with 1,838 ft of detailed modeling of fire propagation and the cable trays, five MCCs, and five relay cabinets, associated timing and considers transient fires to obtain a mean fire initiator frequency of about 2.0E-3 per reactor-This evaluation is performed using conventional year with an error factor of about 4.

This PRA techniques: COMPBRN IIIe (EPRI NP-frequency does not include the area ratio fraction 7282), FIVE methodology (EPRI TR-100370),

for transient fuels. The most credible transient and finally the CFAST code (Peacock et al.,

fires must be within 3 ft of the source cables in 1993b) developed by the National Institute of order to ignite the cables. This assumption results l

Standards and Technology.

Various in a critical area ratio fraction for transient fires of configurations for cable layout and combustible 0.2; that is, the transient fire initiator frequency is loadmg to obtain sufficient generic insights bsed to be reduced by a factor of 5. This will result in on state-of-the-art analyses have been considered.

a fire initiator ft.quency of 8.8E-4 per reactor-i year with an error factor of about 3.

Fire Initiating Frequency Determination of Fire Suppression The representative fire area for this case study is Probability similar to an ESGR. The room contains mainly cable trays, motor control centers (MCCs), and As described earlier, this area is equipped with a relay cabinets. The fire initiating frequency will manually actuated Halon system and a smoke account for self-ignited cables, externally ignited detector system. A fire in this area is most likely cables as a result of maintenance, welding to be detected either by smoke detectors or by an activities, transient fires, and cabinet /MCC fires.

employee. The detection time for similar areas (NUREG/CR-4230) is expected to be less than The frequency of self-ignited cable fires for IEEE 2 minutes. Once the fire is detected, it may be fire-retardant cables has been a source of controlled by manual actuation of the Halon uncertainty in past PRAs. The Limerick PRA system. The time required for this manual action (NUS Corporation,1983) reduces the self-ignited is estimated to be less than 15 minutes, and the cable fire frequencies by a factor of 1/3 to account unavailability of the Halon system, from the same March 1998 D-9 NUREG-1521

Risk-Informed. Performane. Based Methods reference, is estimated to be 0.08 with an error likely would not damage the redundant cables in factor of about 2.

Finally, if the fire is not less than I hour. Three different methodologies controlled by the Halon system, it will eventually were used-the FIVE method, COMPBRN IIIe, be extinguished by the fire brigade. The empirical and the modified CFAST code-to provide a data for the probability of failure of the fire spectrum of different results. The utilization and brigade to suppress the fire, P., in time, t, is the results of each model are as follows.

expressed thrc, ugh a Weibull probability distribution (NUREG/CR-6144, Vol. 3, Pt.1); that FIVE Analvsis is, The FIVE screening methodology was applied to determine the magnitude of the effective fire P, = exp [- (t/f,,) ',]

(D-1) intensity that can damage redundant cables that are separated by a distance (e.g., about 6.1 m where, typically, values of f, and o, are 20 (20 ft)). A heat loss factor of 0.7 is included in minutes and 0.5 (unitless), respectively, for most the FIVE method. The FIVE fire screening areas in nuclear power plants.

methodology considers three general scenarios.

For the present case in which the target cable is Reliabih.ty models can be used to arrive at the separated from the source cable by a horizontal overall failure probabihty of suppression distance of about 6.1 m (20 ft), analyses were accounting for detection, autosuppression, and performed using Worksheet 2 (see Table D.1) manual suppression as a function of time; outlined in EPRI TR-100370. Three cases were Figure D.7 shows the failure probability considered. In Case 1, the target is located in the suppression for this case study with the associated ceiling jet sublayer region, that is,0.3 m (1 ft) uncertamty hnuts. Note that the break point in the g9 7

,g gg curves is a result of the finite timing for manual peak fire intensity must be estimated from which actgtion of Halon systems. Figure D.8 shows a the ceiling jet temperature is evaluated. If the smular grap.h wherein one considers an automatic ceiling jet temperature exceeds the threshold suppression system with fast actuation of less than damage temperature of the target (assumed to be 2 minutes instead of the manually actuated Halon 643 K (698 *F)in this study), the scenario being

'YS***

evaluated does not pass the basic FIVE screening Process. The results of the FIVE analyses are From the information presented in these figures shown m, Table D.2. At a separation distance of and considering the fire initiator frequency of about 6.1 m (20 ft), the entical fire mtensity is about 8.8E-4 (as discussed previously), a total about 6.5 MW (22.2 million Bru/hr), above which damage probability of 1.2E-5 (corresponding to the ceiling jet temperature exceeds the assumed suppression probability of 1.5E-2 in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) can cable damage temperature. When the separation be obtained. It therefore has to be shown from the distance is reduced to about 3 m (10 ft), the fire propagation modeling that the redundant enucal fire intensity is reduced to about 3.5 MW equipment is not damaged within I hour to ensure (1

m mn Btu /hr).

a CDF bdow 1.2E-5 per reactor-year for this fire scenario. Note that the 1-hour time limit is In Case 2, the target elevation is reduced to 1.2 m imposed mainly by the non-suppression

( ft) below the ceiling. The target is outside the probability curve given in Equation D-1 as reported in NUREG/CR-6144. Use of other non-ceihngjet sublayer, but withm the hot ga kyer.

suppression probability curves may result in much For this situation, FIVE estimates the total energy shorter time limits than 1 bour.

release needed to raise the average hot gas layer temperature to the threshold damage temperature.

This quantity then is compared with the total Fire Propagation Models energy available m the exposure fire fuel. If the The fire propagation models discussed next are t tal energy available exceeds the energy needed used to determine the maximum cluster of cables to raise the hot gas layer temperature to the and the resuhing peak buming rate that most damage temperature, the scenario does not pass NUREG-1521 D-10 March 1998

Risk-Informed. Perfannance-Based Methods

-e-MEAN VALUE

-c-UPPER BOUND

-O-LOWER BOUND 025 02 I

h 0.15 t

0' I

0.05 2

0 O

10 20 30 40 50 60 70 s

TIME (nun)

)

Figure D.7 Failure Probability of Suppression vs. Time for Manually Actuated Halon Systems

+ MEAN VALUE

-*- UPPER BOUND

-O-LOWER BOUNO 0.12 0.1 0.08 i

b l 0.06 8

c.

0.04 0.02 O

g O

10 20 30 40 50 60 70 j

TIME (men) i Figure D.8 Failure Probability of Suppression vs. Time for Automatically Actuated Suppression l

March 1998 D-11 NUREG-1521

Risk-informed. Performance-Based Methods the screening process. For the present case, the parameters were the default values recommended total energy needed to raise the hot gas layer by the code. Most of the cable propeny temperature from an initial 300 K (80.6 *F) to the parameters are the same as those used in EPRI damage threshold of 643 K (698 *F)is about 286 NP-7282. Only three property values were hU (0.27 million Btu). The total energy available, modified as shown in Table D.3 (NUREG/CR-however, depends on the time of exposure to fire.

4230; NUREG/CR-4679).

The total energy available is about 3,150,5,850, and 6,300 MJ (3.3, 5.5, and 6.0 million Bru)

The cable damage and ignition temperatures are during a 15-minute period at fire intensities cf 3.5, assumed to be 643 and 733 K (698 and 860 *F),

6.5, and 7 MW (11.9, 22.2, and 23.9 million respectively. Five cases, including a base case Bru/hr), respectively. 'Ihe total energy available (Case 1) and four sensitivity studies, were is based on an adiabatic heating of the gas (i.e., no examined. The cases are summarized in Table heat loss from the fire source). Since the total D.4. In the base case, it is assumed that the source energy available is much larger than the total tray A (referred to as " pilot fire" in COMPBRN energy needed, none of the cases can pass the analysis) is located at an elevation of 2.29 m screening process. This calculation is not affected (7.5 ft) above the floor. Two cable trays are by the separation distance.

located directly above tray A. Tray C1 is 1.98 m (6.5 ft) and C2 is 1.07 m (3.0 ft) above the pilot In Case 3, the target elevation is further reduced to fire. Since the flame height predicted by the the elevation of the source, that is,2.29 m (7.5 ft)

COMPBRN code is about 1 m (3.3 ft), tray C2 is below the ceiling. According to the FIVE likely to be within the pilot flame region and tray methodology, the target is still within the hot gas C1 to be within the flame region of tray C2 if tray layer region. The result is identical to that of Case C2 is buming. Length of the pilot fire is assumed 2.

to be 1.2 m (4 ft) in the base case (i.e., two elements according to the nodalization modeled in An example of FIVE-predicted results, for 6.5 this study). Each element is 0.6 m (2 ft) long and MW (22.2 million Btu /hr), is presented in the 0.6 m (2 ft) wide. The target tray (tray B) is form of Worksheet 2 as Table D.I.

separated from tray A by a horizontal distance of 6.1 m (20 ft) and is located at an elevation of 4.27 In summary, the FIVE methodology predicts that m (14 ft) above the floor (about 1.98 m (6.5 ft) an effective fire sot rce intensity of about 6.5 MW higher than tray A and 0.3 m (1 ft) below the (22.2 million Btu /hr) is required to damage cables ceiling). An opening about 2 m (6.5 ft) high and that are separated by 6.1 m (20 ft) if the cables are about 0.2 m (0.7 ft) wide is assumed for this case.

in the ceilingjet layer. Similarly, a source fire of 3.5 MW (11.9 million Btu /hr) is sufficient to COMPBRN predicted that trays C2. id C1 damage redundant cables that are 3 m (10 ft)

(located directly above tray A) are damaged at 2 apart. When the cables are in the hot gas layer, and 4 minutes, respectively. At the time of FIVE does not differentiate between the various damage, one element of each of the two trays is separation distances and predicts a total of 286 MJ also ignited. The fire spreads longitudinally along (0.27 million Bru) heat release for cable damage, the trays and, in about 8 minutes, six elements of therefore requiring more detailed calculation to be each tray are ignited. The large fire causes damage performed by COMPBRN.

and ignition of tray B, which is separated by a horizontal distance of 6.1 m (20 ft). COMPBRN COMPBRN Analyses predicts transient burning rate, total heat release rate, and the temperatures of tray B and the hot Point estimates of cable damage and ignition gas at the time when tray B is damaged. The times were determined by using the COMPERN buming rate is about 0.25 kg (0.55 lb) per second IUe computer code. The code requires a number and the corresponding heat release rate is about of model parameters and cable physical properties 4.8 MW (16.4 million Btu per hour).

as input data. In the present study, all model NUREG-1521 D-12 March 1998

Risk-Informed. Performance-Based Methods Table D.1 FIVE Worksheet 2 (Fire Intensity = 6.5 MW)

PWR ESGR 20-ft separation, heat releu,6.5 NW, case-1 2

Worksheet 2: Target - outside-plume Scenario I target damage threshold temperature 643.0 K 2 height of target above fire source 2.0 M 3 height from fire source to ceiling 2.3 M 4 ratio of target height / ceiling ht.

.9 5 long. distance from fire to target 6.1 M 6 fong distance to height ratio 2.7 M 7 enclosure width 9.1 M 8 height to width ratio

.2 9 peak fire intensity 6500.0 K'W 10 fire location factor 1.0 11 effective heat transfer rate 6500.0 KW 12 plume temperature rise at ceiling 2195.5 C 13 ceilingjet temp. rise factor at tg

.2 14 ceilingjet temp. rise at target 342.5 C 15 critical temperature rise at target 343.0 C l

16 critical-ceiling jet t rise at targ

.5 C Critical temp rise > ceiling jet temp rise !

Dox 16 becomes the critical average temperature rise.

The following calculations are used to evaluate the critical combustible loading needed, to achieve this average temperature rise.

l 17 Qnet/V to achieve temp rise in 16

.6 KJ/M3 18 Calculated enclosure volume, V 318.6 M3 19 calculated critical Qnet 186.0 KJ 20 estimated heat loss fraction

.7 l

21 estimate of critical Qtot 619.9 KJ 22 estimate of actual Qtot 5850000.0 KJ This scenario does not pass the screening procedure!

Farther analysis is required i

PWR ESGR 20-ft separation, heat release = 6.5 MW, case-2 2

Worksheet 2: Target - outside-plume Scenario 1 target damage threshold temperature 643.0 K 2 height of target above fire source 1.1 M 3 height from fire source to ceiling 2.3 M 4 ratio of target height / ceiling ht.

.5 Target is beneath the ceiling jet sublayer i

Go to Box 14 l

l March 1998 D-13 NUREG-1521 L

Risk. Informed. Performance-Based Methods Table D.1 (cont'd.)

5 long. distance from fire to target 6.1 M 6 long. distance to height ratio 2.7 M 7 enclosure width 9.1 M 8 height to width ratio

.2 9 peak fire intensity 6500.0 KW 10 fire location factor 1.0 11 effective heat transfer rate 6500.0 KW 12 plume temperature rise at coiling 2195.5 C 13 ceilingjet temp. rise factor at tg

.2 14 ceiling jet temp. rise at target

.0 C 15 critical temperature rise at target 343.0 C 16 critical-ceilingjet t rise at targ 343.0 C Critical temp rise > ceiling jet temp rise !

Box 16 becomes the critical average temperature rise.

The following calculations are used to evaluate the critical combustible loading needed to achieve this average temperature rise.

17 Qnet/V to achieve temp. rise in 16 269.1 KJ/M3 18 Calculated enclosure volume, V 318.6 M3 19 calculated critical Qnet 85727.3 KJ 20 estimated heat lose fraction

.7 21 estimate of critical Qtot 285757.8 KJ 22 estimate of actual Qtot 5850000.0 KJ This scenario does not pass the screening procedure!

Farther analysis is required!

PWR ESGR 20-ft separation, heat release = 6.5 KW, case-3 2

Worksheet 2: Target - outside-plume Scenario j

1 target damage threshold temperature 643.0 K 2 height of target above fire source

.0 M 3 height from fire source to ceiling 2.3 M 4 ratio of target height / ceiling ht.

.0 Target is beneath the ceilingjet sublayer Go to Box 14 5 long. distance from fire to target 6.1 M 6 long. distance to height ratio 2.7 M 7 enclosure width 9.1 M 8 height to width ratio

.2 9 peak fire intensity 6500.0 KW 10 fire location factor 1.0 11 effective heat transfer rate 6500.0 KW 12 plume temperature rise at ceiling 2195.5 C 13 ceilingjet temp. rise factor at tg

.2

'4 ceilingjet temp. rise at target

.0 C 13 critical temperature rise at target 343.0 C 16 critical-ceilingjet t rise at targ 343.0 C l

l I

NUREG-1521 D-14 March 1998 i

I

Risk-Infonned. Perfonnance-Based Methods Table D.1 (cont'd.)

Critical, temp > ceilingjet temp rise !

Box 16 becomes the critical average temperature rise.

The following calculations are used to evaluate the critical combustible loading needed to achieve this average temperature rise.

17 Qnet/V to achieve temp rise in 16 269.1 KJ/M3 18 Calculated enclosure volume, V 318.6 M3 19 calculated critical Qnet 85727.3 KJ 20 estimated heat loss fraction

.7 21 estimate of critical Qtot 288757.8 KJ 22 estimate of actual Qtot 5850000.0 KJ i

This scenario does not pass the screening procedure!

Farther analysis is required PWR ESGR 10-ft separation, heat release = 6.5 NW, case-la 2

Worksheet 2: Target - outside-plume Scenario I target damage threshold temperature 643,0 K 2 height of target above fire source 2.0 M 3 height from fire source to ceiling 2.3 M 4 ratio of target height / ceiling ht.

.9 5 long. distance from fire to target 3.0 M 6 long. distance to height ratio 1.3 M 7 enclosure width 9.1 M 8 height to width ratio

.2 9 peak fire intensity 6500.0 KW 10 fire location factor 1.0 11 effective heat transfer rate 6500.0 KW 12 plume temperature rise at ceiling 2195.5 C 13 ceilingjet temp. rise factor at tg

.2 14 ceilingjet temp. rise at target 543.7 C 15 critical temperature rise at target 343.0 C 16 critical-ceilingjet t rise at targ

-200.7 C Ceiling jet temperature rise exceeds the damage threshold temperature !

This scenario does not pass the screening procedure !

i l

1 l

March 1998 D-15 NUREG-1521 L__ _ _-____--__

Risk-infonned. Performance-Based Methods Table D.2 Summary Results From FIVE Analyses Effective Fire Ceiling Jet Target Damage Separation Intensity Temperature Temperature Distance kW K

K ft 3500 526 643 20 6500 643 643 20 7000 660 643 20 3500 660 643 10 6500 843 643 10 7000 871 643 10 Table D.3 Modified Parameters Used for COMPBRN IIIe Heat value 26.5 MJ/kg Surface control burning rate constant 0.4E-6 kg/J Fraction of flame heat released as radiation 0.48 In Case 2, the size of the pilot fire is reduced to effect on the target. The target damage and 0.6 m x 0.6 m (2 ft x 2 ft). However, the damage ignition times are identical to that of the base and ignition of the target are only delayed by I case.

minute. Apparently the size does not have a significant effect on fire growth. The total heat-Finally, tray Cl is removed from the analysis in release rate at the time of damage is about 4 MW Case 5. Only tray C2 is located within the pilot

(-13.6 million Btu per hour).

flame region and is damaged and ignited at 2 minutes, similarly to the base case. Because no Case 3 assumes that the ESGR has no openings.

other caH tray is located above tray C2, COMPBRN modeled this scenario as a closed-COMPBRN predicts no upward fire propagation.

door fire; that is, the entire room is in the hot gas The fire in tray C2 propagates slowly along the layer. In this situation, the target damage time is tray. At 10 minutes, three elements of tray C2 delayed to 12 minutes, at which time the total heat have ignited and the total heat-release rate is 1.8 rc! case rate is about 8.2 MW. However, no MW (6.1 million Bru per hour). At 14 minutes, ignition of the target is predicted because the only one element of tray C2 is still burning and target temperature does not reach the assumed the total heat-release rr is reduced to 1.1 MW cable ignition temperature (733 K (860 'F)). This (3.7 million Bru per hourj. COMPBRN predicts is probably due to the modeling of a closed-door no damage to tray B (target) because of the low fire in the COMPBRN code.

heat-release rate. The results of the base case and sensitivity studies are summarized and compared

~The elevation of the target is reduced to 2.29 m in Table D.4.

(7.5 ft) in Case 4. This is the same as the elevation of the pilot fire. The change of elevation has no NUREG-1521 D-16 March 1998

Risk-informed. Performance-BasedMethods Table D.4 Summary of COMPBRN Results l

Case 1 Case 2 Case 3 Case 4 Case 5 Tray D

I D-I D

I D

I D

I I. Damaged (D) and Ignition (I) Time (minutes)

A 0

0 0

0 0

0 0

0 0

0 (Source)

C2 2

2 2

3 2

2 2

2 2

2 C1 4

4 5

5 4

4 4

4 B

8 9

9 10 12 No 8

9 No No (Target)

II. Total Heat Release Rate at the fime of Target Damage Q. MW 4.8 4.0 8.2 4.7 1.8

• III. Description of Cases Pilot fire size (ft x 4x2 2x2 4x2 4x2 4x2 ft)

Door Open Open Closed Open Open Trays above pilot

' C1 and C2 C1 and C2 C1 and C2 C1 and C2 C2 only fire a

Target elevation 4.27 4.27 4.27 2.29 4.27 (m)

• Maximum heat release rate with no damage to target cables.

COMPBRN analyses predict that the effective fire accounts for radiation heat transfer to a target, was intensity, capable of damaging redundant cables utilized for this case study. CFAST requires the separated by 6.1 m (20 ft), is about 4 MW (~ 13.6 heat-release rate of the source fire as input. To

)

million Bru per hour) for the representative arrive at a meaningful heet-release rate for the fire i

configuration. COMPBRN also predicts damage source, a radiation model was implemented in the I

time of about 12 minutes. These results are MATHEMATICAL computer package. The heat obtained when a sufficiently large opening is flux at distance, D, due to radiation, was modeled assumed and therefore oxygen is always available using the following equation:

for combustion in the room. Furthe more, COMPBRN results show that the cluster of two q" = ( Cos 6 )( q,) [F/(4nD2 )] W/m2 cable trays in one side of the room will result in a peak burning rate of about 1.8 MW (6.1 million where Btu per hour), which is not sufficient to damage cable trays separated by 6.1 m (20 ft).

6 the angle between the tray and the fire

=

(

source i

CFAST Analyses the heat-release rate of the fire source qr

=

A modified version of the CFAST code, which March 1998 D-17 NUREG-1521

---

d

Risk-Informed. Performance-Based Methods the fraction of the heat-release rate 3 MW (10.2 million Bru per hour) is required to F

=

radiated (set to 0.4)*

damage the target cables at a 6.1-m (20-ft) separation in about I hour. Since the hot layer r

l li the separation distance of the target temperature and, therefore, convective heat

=

transfer, do not vary with separation distance, the To damage the IEEE-rated cables, an extemal heat only consideration is the radiative heat transfer, 2

2 flux of about 10 kW/m at the target cables was which is proportional to 1/D. For separation assumed. The 10 kW/m external heat flux is distances greater than 3 m (10 ft) and less than 6.1 2

reported in several studies (NUREG/CR-4679; m (20 ft), the hot layer temperature is a better U.S. Department of Transportation,1983) as a indication of damageability for the cables. This, sufficient heat flux to damage cables. For various in turn, limits the maximum size of the source fire separation distances, D, the corresponding value to 3 MW (10.2 million Bru per hour) to avoid of gr was estimated. The values of grof interest damage to the target cables.

ranged from 2 to 5 MW for damaging redundant cable trays at various distances; D. On the basis Results from FIVE, COMPBRN and CFAST are of this insight, the CFAST computer code was compared in Appendix C.

utilized with the source fire of 1 MW (3.4 million Btu per hour),2 MW (6.8 million Btu per hour),

D.2.3 Summary and 3 MW (10.2 million Btu per hour) to assess case study selected deals with a fire area the damage time for target cables. Extrapolation similar t the emergency switchgear room at a of the results allows sensitivity of target damage PWR plant where the 6.1-m (20-ft) separation time as a function of the heat-release rate of the criterion is not met; that is, the actual separation source fire.

between the cables associated with redundant trains is 4.6 m (15 ft). A large fire, damaging all The CFAST code was then utilized to model the the equipment in this area, will eventually lead to specific geometry of the case study, with the heat-core damage if repair is not credited. The release rate for the fire source of 1 MW,2 MW, performance-based approach demonstrates the use and 3 MW. The peak heat-release rate of the fire of the available fire methodologies. Application source (i.e.,1 MW, 2 MW, and 3 MW) was of the three different methodologies---FIVE, reached through a linear growth taking 1,2, and COMPBRN, and CFAST-resulted in limits on 3 minutes, respectively. The hot layer peak heat-release rates varying from 6.5 MW temperature, the radiative and convective heat (22.2 million Btu per hour) down to 3 MW (10.2 transfer calculated by CFAST, was used in a million Btu per hour) to cause damage tc transient conduction model for a thin slab t redundant cable trays. The damage time also estimate the target surface temperatures. Figures varied from 10 minutes up to I hour. A fire of 3-D.9, D.10, and D.ll show the cable surfac MW magnitude was estimated to take about I temperature for a 1, 2, and 3-MW fire as a hour to damage redundant cables that are function of time, separated by more than 3 m (10 ft). It was also shown that a fire of 2 MW (6.8 million Btu per These figures are for a separation distance of 6.1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) or less of the heat-release rate will not m (20 ft) and for target cable trays located inside damage the redundant cable trays. Considering a the hot layer. CFAST models the ceiling jet layer; heat of combustion of 25 MJ/kg (~107,000 however, none of the targets appear to be in the Btu /lb) and a surface-controlled specific mass loss ceiling jet.

2 2

rate of about 3 g/m -sec (2.21 lb/ft -hr) for cables that pass the Institute of Electrical and Electronics Considering the critical damage temperature of Engineers (IEEE) test-rated cabin, a 15-m (50-ft) 643 K (698 *F) and the extrapolation of the cable tray,0.6 m (2 ft) wide will have an effective results shown in these figures, a fire of more than heat release of about 0.9 MW (3 million Bru per hour). (ses Section C.1 for furtherjustification of this assumption.) Therefore, the source fire

• To be consistent with the COMPBRN runs.

limited to a maximum cluster of three cable trays NUREG-1521 D-18 March 1998 i

Risk-informed. Performance-Based Methods

• HOT LAYERTEMPEPATURE TARGET TEMPERATURE 550 l

l l

i 500 1

l

~

E 450 k

5 g 400 W

350 -

l 300 1 O

500 1000 1500 2000 2500 3000 3500 TIME (sec)

Figure D.9 1-MW Fire Source Target and Hot Layer Temperature

+ HOT LAYER TEMPERATURE

• TARGETTEMPERATURE 650 800

~

x2 4-N 550 Ew l

$m t

a:

W 450 b

1 w-400 350 33od 0

500 1000 1500 2000 2500 3000 3500 TIME (sec) l Figure D.10 2-MW Fire Source Target and Hot Layer Temperature 1

1 l

March 1998 D-19 NUREG-1521 l

l

Risk-Informed. Performance-Based Methods

-e HOT t.AYER TEMPERATURE e-TARGETTEMPERATURE I

7m 650

___ w cr 600 E

y 550 h500 w

I 450 le 400 350 300 E O

500 1000 1500 2000 2500 3000 3500 TME (sec)

Figure D.11 3-MW Fire Source Target and Hot Layer Temperature 1

is expected to produce a heat-release rate of less ceiling jet layer at various separation than 2 MW (6.8 million Btu per hour),

distances.

The dominant factor for all these methodologies (2) FIVE can screen out those areas with a low for predicting damage to cables that are separated combustible loading for targets within the hot by 6.1 m (20 ft) is the effective intensity of the layer. FIVE assumes that the hot layer fire source, not the total combustible loading in thickness is the distance between the lowest the fire area.- All fire sources with the effective exposure fire and the ceiling. Themfore, it is intensity less than the critical fire severity

• were too conservative for fires near the ceiling and screened out because of the low probability of not conservative enough for fires near the suppression failure. The critical fire severity is floor.

determined by use of the available fire propagation methodologies. Generally, the fire (3) COMPBRN IIIe is capable of simulating 1

propagation methodologies currently available are small-to moderate-sized fires. For large fires limited in scope and, at best, they are suited for (greater than 4 MW (13.6 million Btu per screening analyses. The following insights can be hour) in this case study) and for fast-growing drawn from this ca:e study:

fires, the results of COMPBRN are not consistent with those from CFAST.

(1) FIVE can determine the peak heat-release rate of a fire to cause damage at a target in the (4) CFAST is capable of simulating larger fires; however, the fire heat-release rate is to be estimated by the user from either

• The critical fire severity is defined as the effective experimental data or actual fire events.

intensity' that is predicted to cause damage to separated. redundant cables at I hour after fire The best estimate of the critical fire severity mitiation. This 1-hour duration is case specific and calculated for this case stud is a fire source with 7

meludes consideration of the reliability and effectiveness of the suppression mechanisms (both heat output of 3 MW (10.2 milh.on Btu per hour).

manual and automatic), as well as the conditional The performance-based analysis shows that if the core-damage probability, maximum cluster of source cables results in a NUREG-1521 D-20 March 1998

heat-release rate of 2 MW (6.8 million Bru per 1.

Fire protection features shall be hour) or less, then the redundant cables will not be provided for stmetures, systems, and damaged even if they are separated by less than components important to safe 6.1 m (20 ft)(e.g.,4.6 m (15 ft)). However, if the shutdown. These features shall be heat-release rate is about 3 MW (10.2 million Bru capable of limiting fire damage so per hour) or more, the CDF caused by fire is that:

estimated to be greater than lE-5. For this case study, the quantitative risk-informed approach (b) Systems necessary to achieve and estimates a ACDF of 5E-6 between the assumed mainhin cold shutdown from either configuration (4.6-m (15-ft) separation) and a the control room or emergency configuration in compliance with Appendix R.,

control station (s) can be repaired Section m.G (protection of safe-shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

capability). The fire propagation and results depend greatly on the specific configuration of the Section m.L, " Alternative and Dedicated case being analyzed. The reader is reminded that Shutdown Capability," subsections 1.d and e state:

the importance of this case study relies on the approach and demonstration of the inethodology, 1.

Attemative or dedic.ated shutdown not on the final case-specific conclusions.

capability provided for a specific fire area shall be sble to:

D.3 ANALYSIS OF THE 72 HOUR CRITERION TO REACH COLD (d) achieve cold shutdown conditions within SHUTDOWN 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; and This case study examines the Appendix R (e) maintain cold shutdown conditions requirement to achieve and maintain cold thereafter, shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of a fire. It is generally based on fire area AC as modeled in the LaSalle Furthermore, Section m.L.5 states:

fire PRA. The feasibility of an altemative approach to prescriptive compliance is explored 5.

Equipment and systems comprising using two levels of modeling resolution. Case I the means to achieve and maintain adopts the conservative modeling used by the cold shutdown conditions shall not LaSalle PRA. No credit is taken for any operator be damaged by fire; or the fire recovery actions. Case 2 models key operator damage to such equipment and recovery actions to reestablish and maintain the systems shall be limited so that the main condenser heat sink to allow extensive systems can be made operable and repairs to the residual heat removal (RHR) cold shutdown can be achieved system. The CDFassociated with the alternative within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. If such equipment approach is compared with the CDF assuming and systems used prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prescriptive compliance for each case. An after the fire will not be capable of uncertainty analysis is also performed to examine being powered by both onsite and the distribution of the ACDFs. This CDF offsite electric power systems difference can be used as one input in the because of fire damage, inde-assessment of an alternative approach to a pendent onsite power system shall prescriptive requirement.

be provided.

Equipment and systems used after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be The requirement to achieve and maintain cold powered by offsite power only.

shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of a fire is stated in two sections of Appendix R.

Section m.G, " Fire The purpose of this requirement is to limit the Protection of Safe Shutdown Capability,"

extent of fire damage to the systems that are subsection 1.b states:

necessary to achieve cold shutdown. The requirement in Section W.G has been clarified in March 1998 D-21 NUREG-1521

Risk-informed Performance-BasedMethods later NRC documentation to require the capability containment environment. A further restriction on to be in cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, as the cooldown rate is typically imposed to avoid opposed to actually requiring cold shutdown formation of steam in the upper head. Using this within that time. However, the capability to reach cooldown restriction and a conservative analysis, stable shutdown

• by alternative methods that the Rancho Seco licensee calculated that 205 require more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or offsite power or hours would be required to achieve cold-l Soth should be considered if it can be shutdown conditions, assuming effsite power was demonstrated that the analytical assumptions are unavailable.

appropriate and the additional risk is minimal.

The licensee for Beaver Valley Unit 1, a D.3.1 Background Westinghouse PWR, also received an exemption fr m Se ti n III.L. The licensee proposed an As discussed briefly in Chapter 3, several altemative shutdown capabihty that was licensees have requested exemptions from the independent of the RHR system and offsite power.

requirement to achieve cold shutdown within 72 Cold-shutdown conditions can be ach:eved and hours. This review did not identify a request for maintained by going to a solid steam generator. In uemption from the 72-hour cold shutdown this method, the steam generator receives makeup critetion for any BWR. The available decay heat water from the auxiliary feedwater system and removal systems in a BWR, RHR shutdown drains to the main condenser via the steam bypass cooling, the power conversion sys'.em, or alternate dump valves. The licensee has estimated that this shutdown cooling (using the safety / relief valve pr cess w uld require about 127 hours0.00147 days <br />0.0353 hours <br />2.099868e-4 weeks <br />4.83235e-5 months <br /> to achieve system and low-pressure coolant injection), have c Id shutdown. The exemption was requested on the capability to bring the plant to cold shutdown well before 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The intent was to use a the basis of a detemumstic engineering analysis.

PWR to illustrate this case study. A search of the Public document room (PDR) identified several In the aforementioned examples, unusual system PWR exemption requests. In addition, a previous configuration ad success paths were used. The available PWR WAs (both intemal events and Brcokhaven National Laboratory fire study for shutdown and low power operations at Surry Umt fire) do not model thea alternative paths to cold shutdown. The evaluate of an alternative 1 (NUREG/CR-6144, Vol. 3) identified fire areas with both trains of RHR affected. Finally, the approach to a prescriptive coinpliance measure PWR can stay in hot shutdown for long periods of requires detailed PRA modeling for each scenario.

time, especially without offsite power.

Although this exemption would have been a good case to illustrate the use of a risk-informed However, when the detailed PDR informatir was approach, these alternative cold shutdown paths received, the reasons for the various exen.ption c uld not be evaluated for the purposes of this requests were clarified. For example, several study without extensive additional modeling.

Babcock & Wilcox (B&W) PWR licensees have requested and received exemptions from the D.3.2 BWR Case Study requirement in Section III.L to achieve cold As stated previously, there do not appear to be any shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> independent of offsite requests for exemption from the 72-hour criterion power. The B&W design is such that pressurizer for BWRs. This implies that for every fire area, spray capability depends on operation of the BWRs have an undamaged train of cold-shutdown reactor coolant pumps, which, in turn, requires systems or that any fire damage can be repaired in offsite power.

If pressurizer spray is not a timely fashion. The LaSaP.e plant is a typical available, depressurization of the reactor and example. In the LaSalle PRA (NUREG/CR-4832, subsequent cooldown are determined by the rate Vol. 9), no fire areas contain both RHR trains.

of heat loss from the pressurizer to the Additional random failures of the undamaged RHR train are generally required to cause core damage. Therefore, the LaSalle plant conforms to

• Stable shutdown can be less restrictive than the the Appendix R requirement to have the capability technical specification definition for cold shutdown.

to be in cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

NUREG-1521 D-22 March 1998

l Risk-Informed, Performance-BasedMethods To illustrate an alternative approach, the LaSalle suppression pool cooling, containment spray, PRA analysis of fire area AC is used as a and low-pressure coolant injection surrogate. Fire area AC is the cable shaft room adjacent to the Unit 2, Division 2, essential containment venting a

switchgear room. This room is located in the auxiliary building. This case study postulates that The sequences associated with fire area AC for fire area AC contains equipment associated with both the prescriptive compliance and the both trains of RHR. The postulated damage in alternative cases are presented in Figure D.12.

j fire area AC is extensive, and it will take more This event tree uses the conservative modeling than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore one RHR train.

assumptions of the LaSalle PRA. The initiator, Prescriptive compliance assumes that one RHR FIRE-AC, is the estimated frequency of a i

l train will be removed from area AC or protected.

significant fire in room AC. The first branch of The altemate approach doe's not credit plant the tree examines the likelihood of early RPV I

modifications. Two levels of moceling resolution injection (top event E-INJ). Sequence 10 are examined for this case study. In accord with represents early core damage caused by random the conservative modeling assumptions of the failures of early RPV injection. Given successful LaSalle PRA for a fire in area AC, Case 1 does early RPV injection, the containment heat not credit any operator recovery actions. Early removal function is examined (top event CHR).

reactor pressure vessel (RPV) injection is Sequence 1 is a successful end-state and maintained for most of the sequences. However, represents one path to cold shutdown after a fire random or fire-induced losses of decay heat in room AC. If containment heat removalis not removal are assumed to cause containment failure available, the core damage heat will cause a due to overpressurization in about 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br />. The containment overpressure failure in about 27 resulting harsh environment in the reactor hours. The tree estimates the probability of the building can fail RPV injection and cause late failure for continued RPV injection given the core damage.

severe environment in the reactor building caused by primary containment failure (top event L-INJ).

Case 2 uses a finer level of modeling resolution.

Sequence 8 represents continued injection.

Manual recovery actions to reestablish Although the reactor is not in cold shutdown, it is containment heat removal are included in the considered to be a successful end-state. Sequence event tree model.

9 models the loss of RPV injection after containment failure.

l The difference in core-damage frequency (ACDF)

I between the prescriptive compliance case and the The quantified event tree for the conservative alternative approach for fire area AC is examined modeling case is presented as Figure D.13. The for each level of modeling resolution.

estimation of each top event is discussed below.

l l

Case 1-Conservative Modeling Assumptions Initiator FIRE-AC l

The prescriptive compliance case assumes that The probability of damage to critical equipment in RHR train B is either removed from fire area AC a fire area can simply consist of an estimate of the or suitably protected. Protection could entail initiator frequency of a significant fire in separation or fire barrier (s). Fire-related damage conjunction with the assumption that all fails all or parts of the following LaSalle systems:

components in the fire area are failed.

If l

warranted, this simplification can be replaced by main feedwater a more realistic performance-based analysis that can refine the fire initiator frequency or examine condenser (due to main steam isolation valve fire propagation and suppression probabilities (see e

(MSIV) closure)

Chapter 4).

train A of RHR including shutdown cooling, March 1998 D-23 NUREG-1521

Risk-infonned. Performance-Besed Methods CONTAIN-FIRE EARLY RPV MENT HEAT LATE RPV SEQUENCE INITIATOR INJECTION REMOVAL INJECTION AND (FIRE-AC)

(E-INJ)

(CHR)

(leINJ)

END-STATE I

1 SUCCESS 8 SUCCESS 9 LATECORE DAMAGE 10 EARLY CORE DAMAGE Figure D.12 72-Hour Case Study-Event Tree for Case 1 Event The fire analysis is adapted from the LaSalle fire critical fire-induced damage occurs PRA (NUREG/CR-4832, Vol. 9). The probability area ratio within fire area AC of a significant fire in fire area AC (FIRE-AC) can fm

=

be represented by:

where a significant fire can damage the critical components FIRE-AC = A ux farc Q fac fs (D-2)

A severity ratio for a significant fire fs

=

where The LaSalle fire modeling has determined that a auxiliary building fire frequency small fire anywhere in fire area AC can ca:ise the Axux

=

rapid formation of a hot gas layer that fails all area ratio of fire area AC to that of critical cabling. Therefore, the room-specific area f xc

=

4 the auxiliary building term (fac) and the severity ratio (fs) are both 1.0.

probability that the fire will not be Similarly, very little credit can be taken for Q

=

manually suppressed before the manual fire suppression activities (Q = 0.99)

NUREG-1521 D-24 March 1998

Risk-Informed. Performance-Based Methods CONTAIN-CORE DAMAGE FIRE EARLY RPV MENTHEAT LATE RPV SEQUENCE FREQUENCY INITIATOR INJECTION REMOVAL INJECTION AND (PER R-Y)

(FIRE-AC)

(E-INJ)

(CIIR)

(L-INJ)

END-STATE (PI)

(A1) l 1 SUCCESS

{

I f

1.lE-1(P) 8 SUCCESS 7.8E-5 1.0(A) 1.6E-1 9 LATE CORE l

DAMAGE 1.4E-6 1.2E-5 8.9E-2 10 EARLY CORE DAMAGE 6.9E-6 6.9E-6 l

P=

prescriptive compliance case TOTAL CDF 8.3E-6 1.9E-5 A=

altemative compliance case aCDF 1.lE-5 Figure D.13 72-Hour Case Study-Quantified Event Tree for Case 1 I

because of the comparatively short time before early RPV injection is: E-INJ = 8.9E-2. This critical damage occurs. Table D.5 presents the value is applicable to both the prescriptive best< stimate values of all terms in Equation D-2 compliance and the alternative case.

for fire area AC, as well as their associated distributions. Therefore: FIRE-AC = A cx f44cQ Containment Heat Removal (CHR) 4 f f = 7.8E-5 per reactor-year AC 5 Containment heat removal is also a functional Early RPVInjection (E-IN./)

event that could credit different systems. For this case study, this top event is approximated by one Early RPV injection is a functional event that train of the suppression pool cooling mode of consists of systems and combinations of systems RHR, as modeled in the IRRAS version of the that can satisfy immediate and longer term core LaSalle PRA.

makeup requirements. For the purposes of this case study, early RPV injection has been The prescriptive compliance case assumes that simplified by crediting the high-pressure core one train of RHR is removed from fire area AC or spray (HPCS) system. The Integrated Reliability otherwise protected. Therefore, a failure of the and Risk Analysis System (IRRAS) model of the CHR functiou requires additional RHR random LaSalle Unit 2 PRA (NUREG/CR-5813) is used failures.

l to estimate the HPCS system unavailability. The logic model and the failure data in the IRRAS The estimated unavailability is CHRei = 1.lE-1 model remain the same. The failure probability of March 1998 D-25 NUREG-1521

(

Risk-Informed. Performance-Based Methods Table D.5 Distributions of Terms for Core-Damage Equation for Fire Area AC Factor Distribution I Best Estimate Lower Bound Upper Bound im Gamma 0.049 8.50E-3 0.12 fm Maximum entropy 1.60E-3 3.20E-4 8.00E-3 Q

Maximum entropy 0.99 0.46 1.0 fy.

1.0 f,

1.0 Source: LaSalle fire PRA (NUREG/CR-4832, Vol. 9).

The alternate case does not protect the RHR For room AC the alternative case assumes that all system. All containment heat removal is assumed decay heat removal is lost due to fire damage.

lost due to the fire, and CHRii = 1.0.

Furthermore, no recovery actions are credited.

The result is a CDF of 1.9E-5 which is dominated Late RPVinjection, (L-INJ) by the late core-damage sequence number 9. The The failure of late RPV injection is due to the severe environment in the reactor building after In order to minimize the effects of modeling containment failure. Although other systems, such assumptions on the ACDF, it is important to use as the controi rod drive hydraulic system, may be the same level of resolution to model the available, consistent with the LaSalle PRA the prescriptive and alternative approaches. For assessment of RPV injection after containment example, if the alternative approach credited failure conservatively considers only the HPCS operation action, but the prescriptive case did not, system. This assumption will conservatively a minimal ACDF could be developed. In that accentuate the importance of the 72-hour case, modeling disparities could mask the true requirement in the analysis results. This failure impact of the alternative approach.

estimate is derived from the IRRAS model of the LaSalle PRA: L-INJ = 1.6E-1.

In the typical PRA analysis, the sequences or areas that are not major contributors to core This injection unavailability estimate is applicable damage are generally not modeled in detail.

to both the prescriptive and the alternative cases.

Conservative assumptions are used to allow analytical resources to be dedicated to the more Figure D.13 provides the CDF for a significant detailed modeling associated with the dominant fire m. room AC using the modeling assumptions accident sequences. Case 1 demonstrates that non-of the LaSalle PRA.

dominant sequences m a fire PRA may not be m deled in sufficient detail to permit their use in The prescriptive compliance case assumes the B a reahstic assessment of the increase in core-train of RHR is isolated from the effects of the damage frequency associated with an alternative fire. Both of the contributing sequences require approach. The next section uses a more realistic, additional random (non-fire) failures to reach core m re detailed model that examines operator damage. This results in a CDF of 8.3E-6 per recovery of the containment heat removal function mactor-yead in the 27-hour time period preceding containment failure.

• The simplifying assumptions used herein result in a Case 2-Refined Modeling Assumptions CDF contribution that is approxima'.ely one order of magnitude higher than the LaSalle fire PRA analysis of area AC.

As stated before, the LaSalle PRA used NUREG-1521 D-26 March 1998

Risk-laforrned. Pedormance. Based Methods conservative modeling assumptions for the non-human reliability analyses are required; however, dominant contributors to the fire-induced CDF.

current state of the art in HRA techniques may Therefore, the Case 1 ACDFis not realistic. The limit such analyses. For illustrative purposes, time available (~27 hours) before containment conservative failure estimates were used for these failure allows ample opportunity for the recoven restoration actions.

of the comainment heat removal function. It is appropriate to examine these recovery efforts by This case examines the alternative of l

revising the Case 1 event tree.

reestablishing the condenser for long-term decay l

heat removal to allow sufficient time for the repair l

Case 2 will model the recovery of the power of one train of RHR shutdown cooling. In conversion system when containment heat accordance with the definition of stable shutdown, j

removal is unavailable because of the postulated long-term operation of the PCS or continued RPV fire (alterative case) or because of random failures injection after containment failure are also (prescriptive compliance case). Given successful considered successes.

operation of the power conversion system (PCS)

)

for 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />, this case also models RHR repair to The accident sequences for Case 2 are presented permit cold shutdown.

in Figure D.14. The higher level of modeling resolution results in 10 sequences. Sequence 1 From a PRA perspective, Case 2 presents two represents successful early RPV injection (E-INJ) modeling challenges. Like Case 1, the successful and sucqessful containment heat removal (CHR) end-states include both stable and cold-shutdown after a fire in area AC. It is the same as Sequence configurations. However, Case 2 considers much I of Case 1. Sequence 10 describes the near-term longer mission times, based on plant-specific and failure of RPV injection. It is an early core-accident-sequence considerations. One successful damage sequence and is also the same as its end-state is cold shutdown after the repair of one counterpart in Case 1.

RHR train. This process is estimated to require 1

200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> to reach cold shutdown. An e!!crnative Unlike the previous case, given a CHR failure, success path considers long term operation of this event tree models the reopening of the MSIVs the PCS, resulting in stable shutdown at 400 or main steam line drain valves (REC-PCS) to hours.

recover the containment heat removal function. A failure implies ultimate containment failure.

The typical PRA must be reevaluated and Sequences 8 and 9 are conceptually similar to extended to accurately capture potential systems those described in Case 1. Sequence 8 evaluates interactions and important ' operator actions. '" tis continued RPV injection despite the harsh case uses simplifying assumptions and focuses on environment in the reactor building caused by the long-term PCS operation. A plant-specific containment failure. Sequence 9 results in late analysis is necessary to examine plant capability, core damage because of an environmentally system interlocks, procedures, and operator induced failure of RPV injection.

actions.

1 Given successful PCS recovery, the tree examines Second, many PRA models can be expected to the operation of PCS for 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> (PCS-200H).

place an emphasis on operator action. In this If this top event is not successful, the harsh instance, the operator actions to reestablish the environment due to containment overpressure-condenser and to recover one train of RHR are zation failure again challenges RPV injection.

critical issues. Although Case 2 examines these Sequence 6 assumes injection continues.

actions for both the prescriptive compliance and Sequence 7 represents late core damage due to alternative approaches, there can be differing late RPV injection failure.

failure estimates, depending on the context. To accurately estimate the likelihood of success and The successful operation of PCS for a mission to minimize uncertainty, detailed plant-specific time of 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> will allow one train of RHR to March 1998 D-27 NUREG-1521

Rish-Informed. Performance-Based Methods FIRE EARLY CoNTAIN-RECOVER PCS RECOVER PCS LATE RPV SEoUENCE INinAToR RPV MENT HEAT PCS OPERATES RHR CONTINUES INJECTloN AND (FIRE-AC)

INJECTION REMOVAL (REC-PCS)

(PCS-200H)

(RECcRHR)

(PCrr430H)

(L-lhu)

ENDSTATE (E-IKI)

(CHR) 1 SUCCESS 2 SUCCESS 3 SUCCESS 4 SUCCESS 6 LATE CORE DAuAGE 6 SUCCESS 71 ATE CORE DAMAGE 8 SUCCESS 9 LATE CORE

]

DAMAGE

_j 10 EARLY CORE DAMAGE Figure D.14

72. Hour Case Study-Event Tree for Case 2 be repaired (top event REC-RHR). Successful critical cabling. As before (see Equation D-2),

repair and operation of RHR will allow cold FIRE-AC = 1 cx fxte Q f c fs.

3 i

shutdown to be reached (Sequence 2). If RHR cannot be repaired, continued PCS operation is Since the geometry of fire area AC, the time to examined.* Sequence 3 represents stable damage the critical cables, and the auxiliary shutdown using the PCS in lieu of RHR. If PCS building fire frequency remain unchanged, the fails during this extended mission time, continued values of Table D.6 are appropriate and FIRE-AC RPV injection after containment failure is again

= 7.8E-5 per reactor-year.

modeled as Sequences 4 and 5.

Early RPVinjection (E-INJ)

The quantified event tree for Ca2 2 :s presented as Figure D.15. The top events are discussed The early RPV injection top event is unchanged below.

from Case 1. The failure probability of early RPV injection is E-INJ = 8.9E-2.

Initiator (FIRE-AC)

Containment Heat Removal (CHR)

The LaSalle fire modeling of area AC has determined that a small fire can cause the rapid The CHR functional event is identical to that used formation of a hot gas layer that can fail all in Case 1. The estimated unavailability for the prescriptive approach is CHRP2 = 1.1E-1.

• A mission time of 400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br /> is arbitrarily assumed.

NUREG-1521 D-28 March 1998

Risk-informed. Performance-Based Methods FIRE EARLY CoNTAW-RECOVER PCS RECOVER PCS LATE RPV SEQUENCE CORE INITIATOR RPV MENT HEAT PCS OPERATES RHR CONTINUES INJECTION AND DAMAGE (FIRE-AC)

HJECTioN REMOVAL (RECPCS)

(PCS-200H)

(REC-RHR)

(PCS 400H)

(L-Ittl)

END. STATE FREoVENCY (E-INJ)

(CHR)

(PER R-Y)

(P2)

(A2)

P. PRESCRIPTIVE I SUCCESS COMPLIANCE CASE A. ALTERNATIVE 2 SUCCESS CoMPLIAt:CE CASE 3 SUCCESS 1.1 E-1 4 SUCCESS 5.8E-3 1.6E-1 5 LATE 8.8E-10 8.0E4 CORE DAMAGE 1.1E 1 (P) 7.1E 2 1.0 (A) 1.6E-1 7 LATE 9.8E4 8.9E-7 7.8E4 CORE DAMAGE 2.1E-3 9 LAfti 2.9E4 2.6E4 CORE DAMAGE 8.9E-2 10 EARLY 6.9E4 6.9E4 CORE DAMAGE TOTAL CDF 7.06 4 7.8E4 I

ACDF 8.0E-7 Figure D.15 72-Hour Case Study-Quantified Event Tree for Case 2 Since the alternative approach does not protect the (NUREG/CR-5813)is used to evaluate the PCS.

f RHR system, CHRu = 1.0, as before.

The logic model and the failure data in the IRRAS model remain the same. The failure of the PCS to l

Failure To Recover the PCS (REC-PCS) operate for a 200-hour mission time is PCS-200H

= 7.1E-2.

PCS recovery is necessary to ensure long-term decay heat removal. A plant-specific human Failure To Recover One Train of RHR (REC-reliability analysis is required to estimate the RHR) failure probability of this recovery action, but this kind of analysis is outside the scope of this case Normally, recovery efforts are required to be study. A value of 2.lE-3 has been adopted from completed in shorter times than the 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> the LaSalle PRA. It represents the failure to assumed here. When a comparatively short manually open the main steam line drain valves to amount of time is available for recovery actions, depressurize the RPV: REC-PCS = 2.1E-3 human error generally domicates and any hardware failures that could prevent the recovery Failure of the PCS To Operatefor 200 Hours are inconsequential. In our case, however, the (PCS-200H) 200-hour time window results in a low estimate of the human error rate. The failure to recover RHR The IRRAS model of the LaSalle Unit 2 PRA is dominated by hardware failures and is March 1998 D-29 NUREG-1521

RisMnformed. Performance-Based Methods approximated by the CHR top event, i.e., the range of values that the outcome is likely to unavailability of a single train of wppression pool assume. That requires an uncertainty analysis.

cooling. No additional repairs are assumed.

Therefore, the failure to recover RHR is 1.1E-1 This section will summarize an uncertainty for both the prescriptive compliance and the evaluation that was performed for the 72-hour alternative approaches, REC-RHR = 1.lE-1.

case study. A ACDF distribution as a function of cumulative probability is developed for each case Failure of the PCS To Continue To Operate After study. The uncertainty ranges for the two cases 200 Hours (PCS-400H) are compared. In lieu of the point estimate, a conservative percentile value of the ACDF is If RHR is not recovered and cold shutdown chosen to reflect the various sources of cannot be reached, the continued operation of the uncertainty.

PCS to maintain stable shutdown is also credited.

For the purposes of this study, this event The uncertainty analysis for this case study is considered only the failure of atirculating water relatively straightforward, primarily because no pump, the failure of a mechanical vacuum pump, credit is taken for fire modeling.** Only PRA and the potential for the loss of offsite power techniques were used to compare the prescriptive during the additional mission time of 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />.

compliance and the attemative approaches. Risk an assessments such as LaSalle fire PRA routinely A plant-specific analysis would include analysis of plant capability, system interlocks, include formal uncertainty analyses, and the procedures, and operator actions, PCS-400H = 5.8 techniques are well established. The uncertainty E-3.

information for this case study was generally adopted from the LaSalle PRA (NUREG/CR-Late RPVInjection (L-INJ) 4832).

.,_mai volumes of this analysis are devoted to parameter estimation, the human The failure of late RPV injection (HPCS)* is due reliability evaluation, and the uncertainty analysis.

to the severe environment in the reactor building after containment failure. This failure estimate is The LaSalle PRA calculated an uncenainty unchanged from Case 1, imponance for each of the dominant sequences.

L-INJ = 1.6E-1 For a fire in room AC, the percent reduction in the uncenainty of log risk is dominated (-88 percent)

The evaluation of all the headings of the event by the uncenainty associated with equipment tree of Figure D.14 is presented in Figure D.15, survivability after primary containment and the four sequences leading to core damage are overpressurization failure. Parameters that are quantified for both the prescriptive and the related to fire initiation and propagation are altemative approaches. The final result is given at relatively small contributors to the uncertainty the bottom of Figure D.15;it is ACDF = 8.0E-7.

importance. In general, most of the parameter distributions in the LaSalle PRA are assumed to D.3.3 Uncertainty Analysis be log normal, although several basic events used other distributions or user-specified distributions.

Thus far, this case study has used mean values to For the purposes of this case study, the latter evaluate the t_CDF of alternative approaches to events are approximated by the lognormal prescriptive regulation. However, point estimates distributions so that the IRRAS code could be do not reflect the inherent variability in the data used to calculate the uncenainty range for each and modeling uncertainties. One of the chief case.

criticisms of a point estimate model is that the result does not provide an understanding of the

• • This case study adopts the LaSalle PRA assumption

• Consistent with the LaSalle PRA, the failure of RPV that a small fire anywhere in room AC will cause injection after containment failure conservatively the rapid formation of a hot gas layer that causes all considers only the high-pressure core spray system.

critical cabling to fail.

l l

NUREG-1521 D-30 March 1998

i Risk-informed. Performance-BasedMethods The IRRAS code is used to calculate the CDF shutdown can be achieved. PRAs also examine uncertainty for this case study. One thousand public risk, but different assumptions are used.

CDF samples are generated for each of the Postulated failures are not subject to regulatory sequences presented in Figures D.13 and D.15. A constraints,i.e.,"a single active failure." Success FORTRAN program and a spreadsheet are used is also defined differently. The typical Level I to combine each sample and generate 1,000 ACDF 100-percent-power PRA considers various values for each case.

transitional end-states to be successes, even though cold shutdown has not been reached.*

/

j The distribution of the ACDF using conservative These stable shutdown end-states do not pose

(

l modeling assumptions (Case 1) is presented as additional challenges to key critical safety i

Figure D.16. Unlike the point estimate of 1.lE-5 functions and the core is expected to remain developed earlier, this distribution provides a feel intact. From 2 PRA perspective, these sequences I

for how much the ACDF can vary. One way to are not dominant and additional modeling will not account for the distribution is to specify a significantly change the CDF or the analytical confidence level instead of a point estimate. For insights.

{

example, a 90-percent confidence criterion results in a ACDF value of 1.5E-5.

This basic difference between the regulatory and the PRA definitions of success needs to be Figure D.17 presents the cumulative probability addressed for risk-informed and performance-distribution for the ACDF using refined modeling based regulation. Is it necessary to specify cold assumptions (Case 2). The 90th percentile ACDF shutdown as the only successful end-state? On for Case 2 is about 1.lE-6.

the other hand, is it appropriate from a regulatory perspective to allow the failure of a major fission Normally, cases that use more detailed modeling product barrior such as the containment or the fuel and that take credit for additional human actions rods? As part of the PRA process, screening have greater uncertainty bands when compared to analyses are generally performed to identify the simpler, more conservative models. However, as major contributors to risk (c,r CDF for the Level 1 shown in Figures.D.16 and D.17, the uncertainty PRA). Dominant initiators, systems, and bands between the 10-percent and the 90-percent sequences are identified for more detailed confidence limits are roughly comparable. This is evaluation. Dominant sequences may utilize attributable to the dominance of the uncertainty several detailed system fault trees for a single top associated with continued injection after event; human errors might be quantified using a containment failure This tends to mask the simulator; and recovery actions are developed, recovery uncertainty associated with Case 2.

quantified, and credited where appropriate. Non-dominant sequences generally are quantified using In general, we would expect cases that feature the conservative screening assumptions. For higher levets of modeling resolution, particularly example, Case 1 of this case study considered those that credit human actions, to have greater only HPCS for RPV injection, and recovery uncertainty bands. However, the use of a actions were not credited.

conservative confidence limit will capture this increased uncertainty.

As illustrated by this case study, alternate approaches can be expected to require D.3.4 Summary reexamination of non-dominant sequences. Case This case study examines the safety impact of 2 uses a finer level of modeling resolution to alternative approaches to the 72-hour criterion to credit certain operator recovery actions, events reach cold shutdown. Several key considerations are summarized below:

The fire regulations in 10 CFR Part 50 are designed to protect the health and safety of the

• A 12 vel 2 PRA might define success as core damage, but no release occurs because the containment public by helping to assure that safe cold remains intact.

March 1998 D-31 NUREG-1521

Risk-informed. Performance-Based Methods 1.0 0.9 POINT ESTIMATE = 1.1 E-6 0.8 0.7 1

j 0.8 l

MEDLAN - 1.2 E4 l

0.5 0.4 I

0.3 0.2 0.1 f I t t f il fiff f I f f illtf f f I llitif f f I ll f it!

I f f if f t!

g, 1E@

1E48 1E-07 1E-06 1E 06 0.0001 0.001 DELTA CORE DAMAGE FREQUENCY (ACDF)

Figure D.16 Cumulative Probability Function for Case 1 1.0 0

0.9 POINT ESTIMATE. 8.0 E-7 0.8 C

0.7 0.6 MEDIAN. 6.9 E-8 0.5 10.4 0.3 0.2 0.1

' 'T 0

1 E-11 1E-10 1E49 1E4B 1E 07 1E45 IE45 0.0001 DELTA CORE DAMAGE FFIEQUENCY (ACOF)

Figure D.17 Cumulative Probability Function for Case 2 NUREG-1521 D-32 March 1998

Risk. Informed. Performance. Based Methods that are commonly modeled in current PRAs.

" continued RPV injection after containment However,long-term operation of the PCS is also failure." As a " rare" event, the uncenainty band modeled in Case 2. To the best of our knowledge, was established primarily by expen opinion.*

• this has not been considered elsewhere.* Finer levels of modeling resolution, crediting Within the regulatory context, the reliance on increasingly obscure operator actions and unusual expert opinion for events that dominate system configurations, could h ve been employed uncenainty should be assessed. This is not an herein. The consistent application of risk-intractable problem; a suitable confidence band informed performance-based initiatives will could be specified. For example, in this case require a consensus on the level of modeling study, a A core damage criterion of IE-5 could be resolution that is appropriate.

satisfied at 99-percent confidence level for case 2.

This could be construed as a probabilistic safety Section D3.3 presents the uncertainty analyses for margin. Ahernatively, different modeling this case study. The results are presented as assumptions could be employed to avoid the probability distributions of the ACDF that help the dominant source of uncertainty.

reader to assess the variability of the input. A 90-percent confidence limit was chosen for This case study uses ACDF as a tool toward illustrative purposes.

evaluating the safety equivalence of an altemative approach to a prescriptive requirement. Several This case study was particularly suitable for issues have been raised for funher evaluation.

uncertainty analysis because it did not credit any These issues notwithstanding, a probabilistic fire modeling and was strictly a PRA exercise.

approach provides a consistent framework in Unlike fire modeling, PRA uncenainty analysis which to identify key issues, examine sensitivities, techniques are well established.

and evaluate the safety equivalence of an altemative approach to a prescriptive requirement.

This analysis is dominated by a single event,

• • The experts provided input on containment failure locations and sizes. This information was used to

• Probably because it would be considered stable calculate time-temperature profiles for various shutdown as discussed above.

reactor budding locations.

March 1998 D-33 NUREG-1521

_ - _ _ _ _ _ _ _ _ _ _ _. _