NURLG/CR-2258

UCLA-ENIG-8102

Fire Risk Analysis for Nuclear Power Plants

Prepe 'ed by M. Kazanians. G. Apostolakis

Sch-,ýoI of Engineering and Applied Science

Univet's~ty of California

Prepa red for

U.S. Nuclear Regulatory Commission
Availability of Reference Materials Cited in NRC Publications

Most documents cited in NRC publications will be available from one of the following sources:

1 . The NRC Public Document Room, 1717 H Street., N.W.

Washington, DC 20555

2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission.

Washington, DC 20555

3.The National Technical Informfation Service. Springfield, VA 22161

Although the listing that follows represents the moIority of documents cited in NRC publications, it is not

intend.ed to be exhaustive.

Refere r,,ed documents available for Inspection and copying for a fee from the NRC Public Document

Room include NRC correspondence and internal NRC memoranda, NRC Office of Inspection and Enforcement bulletins. circulars, Information notices, inspection and investigation notices, Licensee Event

Rc~ports , vendor reports and correspondence; Commission papers; and applicant and licensee documents

an,~orrespondence.

iThe, lowing documents iw the NUREG series are availabie for purchase from the *C 'GPO Sales ProIgrarrv formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC

b~ookiels and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal

Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and

technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to t he Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as

books. journal and periodical articles, transactions, and codes and standards. Federal Register notices,

federal and state legislation, and congressional reports can usually be obtained from these libraries.

IDocuments such as theses, dissertations, foreign reports and transla~tions, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited. ISingle copies of NRC draft reports are available free upon written request to the Division of Techinical Information and Document Control. U.S. Nuclear Regulatory Commission, Washington, DC 20555.
NUREG/CR-2258

UCLA-ENG-s3102

RG, XA

Fire Risk Analysis for Nuclear Power Plants

Manuscript Comnpleted: May 1981

Data Published: September 1981

Preptered by

M. Kazarians, G. Apostollakis

School pf, Engineering and Applied Science

Ulniversi&: olf California

Los.6n4,. CA 90024

Preapred for

Division of Risk Analysis Office Of NLuC16 Regulatory Research

U.S. Nuclear Regu..atory Commission

Was.hington, D.C.205

NRG. FIN' 86280.

ABSTRACT

A methodology for evaluating the fr~quency of'

severe consequences due to fires in nuclear power

plants is presentei. The methodology produces a 1 :

of accident scenarios and '-.hen assesses the frequer.'

of occurrence of each.' Its. framework is given in

.six steps. In the first two steps, the accident

,:cenarios ar .e identified qualitatively and the potential of fi res to cause initiating events is investigated. the last four steps are aimed at quantification. The frequency of fires is obtained for different

compartments in ,~uclear power plants using Bayesian

A-echniques. The res'zl.ts are compared with those of

diassical methaas and the variation of the frequera'ies

with time is. also examined. The combined effects of

fire growth, detection, and suppression on component

failure are modeled. The susceptibility of cables to

fire and their failure modes are discussed.. Finally,

the limitations of the methodology and suggestions for

further research arv given.

ACKNOWLEDGMENT

we would like to than~k Nathan 0. Siu for the Stirnu-,

latlrng discus'sions that we have had with him during

the preparation of this work iand also acknowledge the

information and comment s provided by the staff of

Pickard, Lowe and Garrick, Inc., and in particular

D. C. Bley, J. W. Stetkar and D. W. Stillwell. Finally,

we t"-Ink G. Klopp of Commonwealth Edison Company for

his useful comments.

* Jr

CHXA P

CHAP]

* TABLE OT CONT.LNTS

* Page

?ER 1 INTRODUCTION AND SUMMAR.Y..............

1.1 Introduction......................................

.2 Summary..... ..................................... 6

'ER 2 SCENARIO IDENTIFICATION.........................11

2.1 Analysis of the Initiating Even!:..........s

I2.1.1 General Remarks . . . . . . .1).

2.1.2 Example: LOCA in a PWE.. 12

2.1. 3 Initiating Events of a PW . ......... . 21

'2. 2 Analysis of the Mitigating Functions'.. 21

2.2.1 The Mitigating Functions. ............ 21,

2.2.2 Reactivity Control . . ........................... 22

* 2.2.3 Deca;- Heat $Removal for a POR . . . .. 23

2.2.4 Coolant Inventory and Pressure . 24 - 2.2.5 Example: Ac~cident Mitigation i~i a PWR 24

2. 3 Combining Initiatking Events with Mitigatinig

Functions........................................30

2.3.1 Sc%4aro Identification . . . . .. PP3

2. 3'.2 Example: Scenarios for a Cable Spread?-

ing Room Fire of aPWR .................. 31

2.4 On the Definition of Fire Location........39

2 .5 on Fires as the Cause of the Initiating

Events . . ... . . ........ ... ... .... ... ... ... ... .... ....... 42

2.6 On the Details ofthe Scenario~s.........43

ER 3 QUANTIFICATION .. .. .. .. .. .... .... 45

3.1 IntrodLtction . . .. .. .. .. .. .. .... 45

3.? The Frequency of Fires....... ..... .... 45

3.2.1 Introduction .. .. .. ... . .. . . . 48

3.2.2 Data .......................... . . . . . 49

3.2.3 Bayesian Calculations ... . . . . . 54

3.2.4 Sensitivity Analysis . ... . . . . . 63

3.2.5 The Choice of Poisson Likelihood . . . 66

3.2.6 Comparison with Frequencies Results .. 67

CHAPT

11

iii
Page

3.2.7 Normal Apprc-ximation.. .. ............. 72

3.2.8 Frequency-Magnitude Relationship . 74

3.2.9 Uncertainties in the Frequency of

Fires.........I...................* 75

3.2.10 On the Extrapolation of the Results

to O-her Areas ........................ 76

3.3 Representativz Cases for Fire Gx-owth

Analysis ..................................... 79

3.4 Fire Growth Analysis.........................87

3.4.1 Growth Analysis.....................88

3.4.2 On Ignition and Pilot Fires . . . . 91

3.4.3 Detection Time .. .............................. 93

3.4.4 Suppression Time.............96

3.4.5 Fire Duration............ 100

3.5 Component Failure Under Fire Conditions . 102

3.5.1 Introduction..............102

3.5.2 Electrical Cables............102

3.5.2.1 Failure Modes of Electrical

Cables ...................... 102

3.5.2.2 Cable Failure Frequency . 107

3.5.2.3 Relative Frequencies of the4

Failure Modes . . . . . . . JJ110

3.5.2.4 Duration of a Failure Mode. 112

3.5.3 Other Components. .................... 113

3.5.4 Effects'of Extinguishing Agents on

Component Availability . . . . . . . 115

3.5.5 Smoke Damage .......................... 116

3.G Frequency of a Sequence of-Events . . . . . 117

F 'F 4 CCNCLUDING REMARKS .... ....... . 129

F'iE F *C ES . . . . . . . .. .. .. .. . ..... ... . 136

Aft i ."T A. FIRE INCIDENCE DATA .. ............. . . . 141

A.) Data from American Nuclear Insurers . 141

A.? Data from the HTGR Study . . . . . . . . . 148

References . . . . . ... . . . . . . . . . 1149

iv
APPENDIX B.

APPENDIX C.

C. 1

C.2

C. 3

APPENDIX D.

D. 1

D. 2

APPENDIX E.

E..1

E.2

E 3

CALCULATION OF COMPARTMENT YEARS.

DATA ON DETECTION TIME FOR DIFFERENT FIRE DETECTORS........

Smoke Detectors............ .. .. ..

Heat Detectors..........

Nuclear Plant Experience

References......

DATIA ON FIRE SUPPRESSION .....

Data from the BTQR Study .....

Fire Suppression Test Results...

References .......

DATA ON CABLE FAILURE TIME . ...

Introduction ......

Fire Tests . .. .. .. .. ...

Data ..... .. .. .. .. .. ...

ReferenCes ............

Page

15nl

158

15?

159

160

161

163

163

16.5

167

167

167

170

175

V
LIST OF FTGUEfES

Pag e

Figure 2.1

Figure 2.22

Figure 2.3

Figure 2.4

- Simplified Diacýram cf the

Piping of the- Main Cooiant.

Loops in a PWR...... .. .. ....

- Simplified Diagram of the

Control Circuitry for opening

an RHR Isolation MOV.....

- Top Structure of the Fault

Tree for Large LOCA .....

- Fault Tree for one RHR

Isolation MOV Transfer Opeih

13

16

18

19

25

46-

59

Figure 2.5 - Simplifier-i Evernt- Tree for

Tran'sient Events...... .. .. ..

Figure 3.1

Figure 3.2

Figure 3.3

Figure 3.4

Fig ure 3.5

Fi gure 3.6

figure 3.7

Figure 3.8

-Block Diagram for Quantifying.

Fire' Scenarios.... .. .........

-The Prior and Posterior

Densities for the Control

Room arid Cable Spreading Room

-The Pi~or and Postorior

Densitl$es for the Co~ftainment,

Diesel, Turbine Building And

Auxiliary*Building...... .. .. ....

- Cable Routing of Some Speciflii"

Cables Inside the outer Cablt4

Spreading Room..... .. .... ....

- Cable Tray Conf iguration in the

Zion Cable Spreading Rooms ....

- Cabinet Position., in Auxiliary

Electrical Equipment Room and a

Partial List of the Contents...

- Distribution of Tr which Includes

Parameter and Modeling

Uncertainties ..........

- A Sample of Cable C:oss

Sections...................... . .

39

84

86

90

105

vi
i, . f 1' SU R ES

Pag e

Simr-lified schematic Diagram

of the Control Circuit ef a

Solenoid Valve that Operate:3

an Air-Operated-Valve . . . . . . 106

'it.

,%ii
LIST OF TABLES

Page

Table 2.1

Table 3.1

Table 3.2

Table 3.3

- Fire Initiated Scenarios

a for a PWR . . . . . . .. . .. 37

- Statist".cal Evidence of Fires in.

LWRs (As of May 1978) . . . . . ..

- Distribution of the Frequency

of Fires . ... . . . . . . .

- Comparison of Posterior

Distrih ,-.ions for Gamma and

Log-iirmal Prior Distributions

52

58

65

Table 3.4

Table 3.5

Table 3.6

- The Number- of, Fires #,.the,...

Reactor Years-and the ~-

.Frequency of Fire Incidents

in the Overall Plant for

Two Time Periods . . . . . ....

- Fire Duration in the Inner

or Outer Cable Spreading

Rooms in Zion*... ...

- FPistogram Derki~yed from

Figure 3.7 for-jFire Growth

to Second Divid4ion . * ...

68

103

123

Table 3.7

Table 3.8

Table 3.9

Table A.l1

Tab>-- A.2

-Histogram for the Frrgquency

of Falling Part of a Sequence

of Event Due to Fire in the

Cable Spreading Rooms ..

- Histogram for the Conditional

Frequency of (Containment

zvent Tree) Ent#-ry State G Given

a Fire in thje Cable Spreading

Rooms . . . . . . . . . .*

- Histogram for the Frequency

of State G Due to a Fire in

the Cable Spreading Rooms.

- Number of Fires and Plant

Status *. 0 0 .a * . .

- Number of Fires and Location

of Fires in Nuclear Facilities

of all Types . . . . . . ...

* *

* *

125

127

128

143

144

viii
Table B.1-

Table D. 1-

LIST OF TABLES (Continued)

Operating Years of Some Areas

or Compartments in Light Water

-Reactors in the United States

at the end'of May 1978 .

Frequency Distribution of "Time

to. Bring Fire Under Control't

'from Reference D.1 for the

Commercial operation Phase

/

Pag e

153

.164

a ?

ix

1. IN2RODUCTION AND SUMMARY

1.1 Introduction

This study presents a methodology for evaluati ng

the frequency of consequences due to fires (fire risk)

in nuclear power plant's. These consequences can bedefined in terms of the extent of release of radionuclides into the environment. The main source of

the radionuclides is the core of the reactor [1] and

only accidents can lead-to -large -ýreleasesi,-- For this-to

happ en, both the reactor vessel and the containment

mustY be breached and the core Imust be severely damaged.

Thus!, we concentrate on analyzing scenarios that

involve fire incidents which can lead to core damage

and. containment failure. M.

Similar to any risk study, the methodology identifies a comprehensive list of scenarios and then assesses

the frequency of occurrence of each. This process

requires knowledge about almost all aspects of a fire

incident (that is, ignition, progression, detection

and suppression, characteristics of materials urder

fi-re conditions, etc.) as well as the plant safety

functions and their behavior under accident conditions.

Fire research is a multidisciplinary effort that

is being v1gcrously pursued in many count~ries around

the world and which covers a large spectrum of topics

(for example, physics of combustion, flame behavior in

1
compai~trents, and fire detector response characteristics). The level of sophistication of the tools used

varies greatly. Very few sources have looked into the

probabilistic aspects of fire incidents and, especially, the public risk stemming from these occurrences.

This is true for the fire risk in nuclear power plants.

many fires have occurred in th ese plants [2) and concern about them as a potential common cause event has

been g reatly increased since the well-known Browns

Ferry fire [31. Marty regulatory actions followed this t

incident. A special review grbup from the Nuclear

Regulatory Commission (NRC) analyzed it In detail (4].-

The Reactor Safety Study [5] also investigated the

chances of that incident leadinj to core meltoby

postulating various failure scenarios. Referen~ce 2

used their approach in performing a parametric study

and found that the conditional frequency of core melt

could have been as high as 0.03. Referenceý 5 found

that the unconditional frequency is about 1 x lo-5

inci dents per reactor year.

The NRC has requested all utilities to submit a

fire protection analysiq report (4) which evaluates

each plant with respect to fire protection guidelines (6). Although the information given varies from

plant to plant, basically they have all enumerated the

administrative actions taken against fires aind have

2
listed for each compartment the existing safety-. ated

items, th e fuiel loading (Btu/ft2 , the type of fuel,

the fire protection equipment, etc. Based on these

studies, changes have been recommended and safe shutdown methods are analyzed Reference 7 is an example.

This is a success-oriented analysis of the different paths to sitfe shutdown. It starts with the

plant at full power and assures that, reactivity control

and core cooling are achieved and that tempeyr ture ard

p-easUre indicators are availabl~e during a fire incident. .Credit has been given to manual actuations

(at pump or valve locations), sp ecial cables, and

special fire detection and suppression systems. These

reports provide valuable informatlon about the 1-ire

hazard in each plant.

Three studies evaluate the fire risk of nuclear

power plants. The first study was a part -of. the Clinch

River Breeder Reactor (CRBR) Risk Assessment Study 181.

The second study Js part of the High Temperature GasCooled Reactor [9] risk assessment study conducted by

the General Atomic Company (10). The third study Is

one performed at the Rensselaer Polytechnic institute

(RPI) [11 12). In all of these studies, the critical

locations for fires are Identified qualitatively and

the frequencies are given In terms of point estimates,

although certain upper bounds are sometimes evaluated.

3
The CRBR study was the first attempt in this

direction. It use failure modes and effacts analysis

to identify critical locations and covers all types of

.fire (cable tray, oil etc.) including sodium fires.

Event trees and fault trees are used to estýýblish fireinitiated sequences leading to core melt.

The fire ri~.k study for an HTGR plant (101 is a

small part of a larger ef fort whereintevrl HTGR

risk is assessed. Its inclusion was instigated by the

Browns Perry incident. The authors recognize that,

except for some special aspects, the general features

of risk assessment methodologjy are also applicable to

fires. Very detailed data on indiyidual fire incidents

%~ave been collected as part of theiA work. In

Section A.2 of Appendix A,. we review the information

provided., They have used the data to obtain fire

occurrence rates and analyze fire progression characteristics. Their data Includes estimates on the

physical size and duration of the firts. From this,

they establish a distribution for the extent of fire

c rowth.

The HTGR report also proposes a methcd similar to.

failure modes and effects analysis to ident~fy the

critical locations within a plant, celIled "Fire

Location and Progression Analysis* (FLPA). As part of

this methodology, for every. area, information Is

4
collected about the fire loading, the components and

their potential failure modes (cause d by fire), etc.

Then, the critical locations are chosen judgmentally.

Subsequently, the authors look into the sequences of

events that can be caused by fires and eliminate

several areas by comparing two frequencies for the same

sequence of events. one frequency is due to fires and

the other Is due to causes other than fires. They have

found that the cable spreading room poses the...largest

fire risk and the frequency of core heatup is 10-5 pet

reactor year.

Two reports are published from the Renaselleer

Polytechnic Institute study (11,12]. The first one

presents a detailed analysis of dat collected from

i,nsurance companies and regulatory Adies. in

Section A.i of Appendix A, we have tabulated part of

their results. The authors have looked at many

different aspects of the data and have also proposed

models for ranking systems, components, and fire zones.

For this, they have defined im~portance measures which

are linked to some conditional frequenci es; for

example, the frequency of fire occurrence, tho fraction

of fire&b of a certain type, etc.

In Refereisce 12, the second report from the XPI

work, the-auth',r has developed a m-ýthod for analyzing

loss of safety functions In a boiling water reactor (BWR)

5
due to fires. He mrodels the systems by succt~ss trees

and the fires by event trees. The event trees are used

for modeling the time-dependent characteristics of a

fire. The first event (the initiating event) is ignition, The second and third events question the

success of detection and suppression activities,

ýrespectively. The fourth event concerns propagation.

Once again, the success of detection and suppression

isqetire.in the fifth and si~xt.-h.z~evenlts.,;.-:z-Tbe ý--

exiting states of the event tree are labeled as

wComponent-ilost,' which denotes that'several vital

components have failed due to the fire. This report

presents a very detailed discussion on detection and

suppression. The plant locations areg-analyzed one at a

time and a .failure-modes-and-effects-analysis type of

approach such as that used in the CRBLR and HTGR studies

is employed. The worst case fires for-,each fire are

identified and fire scenarios are quantified using

point values for the frequencies.

1.2 Sumr

The main goal of the methodology presented In this

study Is to identify the dominant contributors to fire

risk. A contributor is defined as a sequence of events

(a scenario) that begins with a fire and terminates

with the release of radionuclides ti, the environment.

There r-* basically two parts to the problem:

6
first, the identification of the scenarios and second,

their quantification. The framewoi.k of the methodology

is given in six steps. These ar-. the building blocks

of any sophisticated algorithm which cah be developed

to use more efficient methods for obtaining the dominant conributors.

The first two steps are for scenario identification and they are discussed in Chapter 2.

Step 1I Initiating events are analyzed to*-see how

fires can cause them (Section 2.1).

Step 2 - The mitigating functions for the initiating events of Step I and accident sequences are analyzed to see how the fires can affect tbem. The result

of thi~s step is a list of scenarios (sea tSection 2.2) .

These two steps cover the first part (i.e.,

scenario identification) of the problem. Event trees

and fault trees are the main tools here. Examples are

cited from the Zion and Indian Point Fire Risk

Studies (13,14] where the p!roposed methodology is

imtplemented. We take f ires as the cause of the

initiating events (a perturbation In the balance of

plant). We have~ examined the possibility of experiencing a large LOCA due to fires 'n a pressurized

water reactor. The accident mitigating functions are

modeled in a simple manner. The critical locations are

identified by qualitative arguments which are based

7
mainly on the safety-related items that can be affected

by fire in the area.

The remaining, steps are aimed at quantification

and are described in Chapter 3. The general model is

given in Section 3.1.

Step 3 - The frequency of fre incidents In different compartments is obtained (see Section 3.2).

.Bayesian methods are used in this step. This data

coms ailyfrom i~nsurance sources.,and. th rQ1*ul. are

compared with classical methods. The variation of the

frequencies withý,time is also examined.

Step 4 - Fire growth analysis is performed and

conditional frequencies of affecting rel~evant components are obtained. The effects of detectjpn and suppression are taken Into account (see SecticlI 3.4.1 for

fire growth, ?.4.3 for detection, 3.4.4 for suppression, and 3.6 for obtain~ing the conditi~onal frequency).

Step 5 - Conditional frequency of accident

sequences given a fire is derived (se e Section 3.5 for

component failures when affected by fire an~d 3.6 for

deriving the con ditional frequency.)

Step 6 - Unconditional frequencies of accident

sequences are derived (see Section 3.6).

In Section 3.3# we establish representative fire

scenarios based on the components in the event sequence

to limit the scopeof fire growth analysis. Amodel is

a
proposed for the conditional frequency of failing a.

known set of components within a room. It takes into

account the periods for growth of fire, detection, and

suppression. These are estimated in Section 3.4. The

model also includes the failure freque.icy of the components, given that they are exposed to fires. in

Section 3.6, we show how the difference fre~quencies of

the methodology are assembled and the unconditional

--~'~Th~~freifeicy--of some -severe con se que n cei-tave. -

In this work,, we f Ind that human error is an

important part of a fire analysis because: (1) manual

activation of componenzs is possible when they become

disconnected from the control room due to cable fires,

and (2) when Instrumentation-related compon*.hts are

affected by a fire, the operators may react' o

erroneous information on the control board. In the

latter case, the question of completeness of-the

analysis becomes important.

It Is important to note that the occur renze of

fires and thieir effects on plant safety are very

complex issues which have not attracted the attentio n

that other parts of risk assessment have in the

literature. It is natural, therefore, that assumptions,

usually conservative, have to be made for the analysis.

to be completed. Effects of smoke, external fires,

secondary fires, flooding due to water-type

9
extinguishers, and fires caused by earthquakes are not

addressed in this study. The limitations of the

proposed approach as well as suggestions for future

work are discussed in Chapter 4.

The details of the fire incident data are described in Appendix A. The total nui~nt-er of yeears for

different compartments in power plants under commercial

operation is computed in Appendix B. The Iresponse time

_-bf t-heL'-fire' detectors and the suppressio tiear

discussed in Appendices C and D, respectively. A

literature survey on cable fire tests is presented In

Appendix E.

10
2. SCENARIO IDENTIFICATIONJ

,1,11S chapter covers the fir3c anrl second steps of

the algorithm described in the preceding '-hapter. aThe

main goal is to identify scenarios in terms of component failure modes an~d their physical locations. The

initiating events are an~alyzed first. The mitigating

functions of each initiating event are analyzed next.

The information obtained is then combined to define

fire6 -related:-scenyavlos which -.are- given. in terms ot.o:.f .- 11

components, their failure modes, and the cause of

failurý.

2.1 Analysis of the Initiating Events

2.1.1 General Remarks

Tht list of initiating, events (IEs) developed

for other parts of'a probabilistic risk assessment

should be' used here (15). Rleference 15 gives a comprehensive list of thes~e events for PWRs and BWRs. We

can devide them into two broad groups: f irst, the loss

ofA coolant accidents (LOCA's) where the core coolant is

discharged from an opening in the cooling system, and

second, the transients where the existing balance is

perturbed (e.g., reactc-r trip). In this step (Step 1

we determine how a fire can cause an 1E. Note that a

fire is taken as the cause of the initiating event and

not the initiating event itself. The tfelaticonship

between tires and IEs can be foc:.-d by constructing

11
fault trees for t.iese events. This is illustrated by

an example.

2.1.2 Example: LOCA in a PWR

The possibility of a large loss of coolant accident at the Zion station is studied in this example. A

large !,OCA is an opening larger than 6 inches in equlva.-ent diameter in the primary side (fcr a PWR).

Figure .::. _,so~w~s-,.the _pr-i-ary:-loovps:of .-one of the units..;: 4<~..

Frcic- this figure, we conclude that there are only two

ways ir which a large LOCA can occui--a pipe break in*

one of the larger pipes, and spurious opening of the

Residual Heat Removal (RHR) isolation valves. These

are motor operated valve~s (MOVs) RH8701 and RH8702. ip

ThefaiureJ te ceckval~ves is judged to be less

likel,, than pipe failures because, in all cazei, at

least two check walves in series should fail.

Figure 2.2 shows a simplified diagram of the control A4 rcuit for opening one of the isolation valves.

I)arts of the circuit that do not affect the 'open"

signal are not shown here. The compartments or zones

throv'gh which the circuit passes are also shown. The

conti-. switch and the pressure interlock could be

bypassed if segments A at.d B of the wires in the cable

spreading rooms or the 14CC room touch each other, thus

closir3⁄4g the circuit and energizing coil 0W whicb would

open the val-ve. In Section 3.5 where cable failures

12
I,.

R8OO1 D

RcCGWlA

R4!8701 P118702

.-Tigure 2. la Figre .laSimplified Diagram of Piping of the Main* Coolant Loops
SO V-456

MOV.RtC8OOA

SOV455C

MOV.RCROM9I

(PRESSURIZER

Figure 2.1b Simplified Diagram of Pipingv of the Main Coo-.ant Loops
EXCFSS LETDOWN

HEAT EXCHANGER

Figure 2.1c Simplified Diagram of Piping of the Main Coolant Loops
POWE R

POWER

- -1 r

L

44, ft

ii

II

Ii

0

Ii

- - - if-- -~-1 CONTRA ROOM INSTRUMENT PACK

iROOM

CONTRMl

SWITCH 1,

PRESSURE : ( NTCUOLOCK

INTERLOCK CRUTRY

RELAY OR SWITCH It' CLOSED POSITION

T RELAY OR SWITCH IN OPEN POSITION

~.4

0%

- - - -.2L - - J LiJ

101

VAI VE

MOTOR

CONTAINWENT

L. - -

RE LA? COIL

Figure 2.2 - Simp'.ified Diagram of the Control Circuitry for Opening an

RHR Isolation MOV (RH8701 or RH97O2)
are discussed, we call this failure mode a "hot short.'

For MOV RH87Ol, wires A and 8 are in the same cable.

For MOV R,38702, they are in different cables but in

the same tray. The cables for the two valves are in

different divisions.-

Based on this information, the fault tree of

Figures 2.3 and 2.4 is.' constructed. Note that the

basic events are shown. only in terms of component

failure modes.- heCa's~-~iose- S .paey

The locations where a f ire may cause the top event

(i.e. , large LOCA) can.-now be Identified. This list

follows and Includes the failures to which they would

lead:

9 Cable BpreadIiO Room: Wires A and 8Bof both

'i I.

MOVs contact ea h other

*MCC Room: Wires A and B of both MOVs contact

each other or no. 52 breakers of both MOVs

transfer closed

* Control Room and Instrument Rack Room: Control

switch and pressure inter-lock switch of both

NOVs transfer closed.

Two things should be pointed out here. First, two

sets of information are given--the location of the fire

(the cause of failure) and the components that It could

affect. Both are necessary In the quantification

process. Second# in some cases only part of the fault

17
1~

-500L

-I0LV

I'-

'aS

ED

-h

I-L

4~

4-0

'I

I.. U

'aLS0

I..S

qE.%

Iis
a a 0

$701 71

M2 T2

WTThAWTEAEAS momSPE VICUESc.o

FigurED 2.::altTe :L OeSRIslto VTase

e-Open

19
tree is affected by a fire. For example, a control

.room fire can fail the control switches. However,

failure of the pressure interlock switches due to other

causes is also necessary for the top event to occur.

Two conclusions can be drawn: (1) location cut sets

can be defined similar to minimal cut sets, and (2) the

fire location (the failure cause) should be-specified

when only partial failures can be achieved. The latter

-is very important fo-r-a-s-equenceo-f events because it

should be specified if the initiating event is caused

~by a fire.

In Section 3.5, we find that pipes and valve

bodies are not susceptible to fires. Valve motors

would fail as is and woul&,)not move spuriously.

Breakers and relays would fail in their deenergized

mode and, in this design, it is the open position.

Control switches fail in their current status. Thus,

the control room and Instrument rack room-related

failures (i.e., two relays and two switches transfer

closed) cannot Ibe caused by a fire. . Hot shorts" In

the cables in the cable spreading room or MCC room are

the most likely path to larg e LOCA. We have mentioned

Ecarlier that, for MOV.RH8702, the two wires Aand B are

in different cables but In the same tray. We judge It

to be very unlikely that these two wires would come in

contact with each other before touching any grounded

condu'-tor.

20
Thus, by qualitative arguments, we have reduced

the niumber of fire locations to two. We developed this

fault tree for illustrative purposes. In~ reallty, it

,is very unlikely tk~at the valves could be, unseated

given that the motors are energized becausie there is a

tremendous pressure difference across the gates and Lhe

motors are underpowered :by design.

2.1.3 Initiating Events in a PWR

For a simple app!'6~tfW-ý'we6 Ag ed'tthbt- all LOCAs

be ;inalyzed in a manner similar to that given in

Section 2.1.2. For transients, one may conservatjve~1y

assume that when a safety-re~lated component is

affected, reactor trip resulti thus, a transient.

There are areas in a p1 .-nt th~f do not contain safetyrelated components, but a fire In them may lead to

reactor trip. For example, the balance of plantrelated items are in such areas. However., since

safety-related items are not affected, safe shutdown

can be achieved Independently of the fire.

2.2 Analysis of the Mitigating Functions

2.2.1 TheMitigating.Functions

The detailed event trees (ET) and fault trees (FT)

that are constructed for risk analysis could be used

here. These give the most comprehensive list of

sequences that experts can envision. These trees lead

us to a vory large number of sequences in such a manner

21
that the efficiency of the methodology becomes important. Chapter 4 discusses this issue. Here we propose

a simple approach.

For a PWR, the fundamental functions necessary for

safe shutdown are summarized in Reference 7 as:

*a. Maintaining a condition of negative reactivity,

b.. Removing reactor decay heat, and

c. Monitoring and controlling the primary system

coolant inventory and pressure."

.The containment heat removal functions are also

important [16], because they determine how the released

radionuclides are contained within the containment.

The availability of these functions should be questioned along with the decay he~t removal in item (b)

above. In the following subsections, these, mitigating

functions are discussed in general terms and then

they are illustrated collctively by an example.

.2.2.2 ReactivityControl

Reactivity control is the first thing that should

be checked for fire vulnerability in Step 2. Similar

to the initiating events, we can do this by constructIng a fault tree. The fire locations, the components,

and their failure modes should be Identified. For the

two power plants that w6 have looked intol, that is,

Zion and Indian Point, the electronic and electrical

c i:ponents will lead tu raector trip upon deenergization.

22
Thus, reactor scram always occurs by at least human

intervention if not due to the fire itself. The possibility of fires at the mechanical components of this

system on top of the reactor vessel has not been stud~ed.

2.2.3- Decay Heat Removal for a PWR

The systems used for mitigating a small LOCA and

alof the transients are basically the same [l1-6.

They require the availability of the scram system, high

prssreprimary cooling systems,-and s-econdary'coo~ling

systems. If both cooling functions fail, core melt

will ev Ientually occur. The small'LOCA sequences become

different from the transients when the molten core

leave3 the vebsel. In transients, the pressurc of the

pri~mary system stays very high betause there is no

bl.sedino'capability except for the safety relief

valves that blow steam into' the containment. Thus,

there is a large pressure difference between.,the vessel

and the containment when the vessel is -breached by the

molten fuel. In the case of a small LOCA, this pressure difference would not be as high; therefore, the

form of radiation releaze (release category) would be

different.. in both cases, conL~inment heat removal is

necessary. Small LOCAs will require containment heat

removal sooner than the transient events..

in the case of a large LOCA, negative reactivity

is Inserted by the loss of coolant. Heat removal

23
should be provided almost immediately. The low pressure injection systems provide this function. Containment heat and iodine removal are necessary for safe

shutdown in addition to maintairing containment integrity.

2.2.4 Coolant Inventory and Press-re

The monitoring of coolant inventory and pressure

is an essential part of the safe shutdown pr-ocess. The.

related components are typically transducers, electronic circuits, and electrical cOmponents', The essential parameters in a PWR are the pressurizer level and

pressure [7].

The control of coolant inventory and pressure is

achieved by the same systems as in decay'heat removal.

2.2.5 Example: Accident Mitigatioc4'n in a PWR

Figare 2.5 gives the event tree used in the Zion

Fire Risk Analysis (13]. The event tree is based on

the assumption that reactor trip has been successful.

The secondary side cooling Is prov ided by the auxiliary

feedwater system (AFWS) which has three trains.. Eaci.

train has one pumir that can deliver adequate flow for

decay heat removal. Two of the pumps are motor-driven.

The third Is turbine-driven and uses the steam of the

main steam generators. All valves are air-operated and

fail open upon loss of power to the solenoid valves.

The primary side coolant bleed and feed consists

of the power, operated relief valves (POR~s) on top of

24
AUJXILIARY

REACTOR FffDWA7E~

EVENT TOWP SYSTEtd

AIIIIIIIVIATIQ*4 AT AFWS

PRIMARY

COOt.ANT/

BLEEtD AND RECIRCULATION COPE!

;E7.0 co~l ING M.-LT

PC/OF "cc

SMELT CONTAINMENT CONTAINMENT CONTAtNME14F

SEQUENCE FAN COOLERS SPRAY FVI'4T IRSE

NO. CF . SEKI STATES

No

POO

(I)

YES (3)

E

F

G

F

G

H.

YES

Figjure 2.5 Simplified Event Tree for Transient Events
the pressurizer for oleading, and charging or safety

injection' (GI) pumps for feeding. The charging pumps

can inject coolant at high pressure whereas the shut-

,off head of the SI pumps is lower, 1,500 psig. Both

sets of pumps take suction from-the rebfueli~ng water

tstorage tank (RWST). The suction and injection P~ines

of the SI pumps are normally open. However, for the

ýcharging pumps, two parallel motor operated valves

isolate the suction under normal conditions. The

injection side is open. Figure 2.1 shows the PORVs.

,They are air operated vlv~s PCV456 and PCV455C. The

MIOVs upstream of these two, that is, RC8000A and

RCBOOOB, are called PORV block salves. All four are

normally closed and automatic control systems do not

'control them.

The containment heat removal fu. 'tion is provided

by two systems--the containment spray systeu i nd the

fan coolers. Depending on the availabi.lity of these

systems, containneent event tree entry ctates E, F, G or H

result. The worst state ib H where radiation 'release

is a certainty. There are three trains in the containment spray system. Each train consists of a pump that

,:an deliver 3,000 gpm, and several valves. Two of the

pumps are motor driven and the third is diesel eng ne

driven. The diesel fuel and batteries for startup are

in the same general area as the pump. There are two

26
mQVs downstream from each pump. One of them is normally closed. All three pumps take suction from the

RWST. The system is activated by simultaneous signals

from SI and contrinment high-high pressure or SI and

manu'a; spray.

There are five fan coolers Inside the containment.

They operate at high speed under normal conditions.

All.'shift-to 'the low speeOd-accident mode upon an SI

signal. Containment air is drawn through the filtration plenums and cooling coils and back Into the

containment. The low fan speed is necessary to ensure

that-the fans are not overloaded by the increased mass

of the containment air. The coils are cooled by the

service water system.

,-,he availability of these systems In a transient

event tree is questioned inly when core melt has

occurred.

Sequence Number I This is a success sequence

whe&-.e core melt does not occur. If at least one AFWS

train Is available, decay heat can be removed adequately. The pr-imary makeup is not a critical function unless the he at rem~oval rate cannot be controlled.

if the system Is overcooled, the primary pressure and

level may drop so that the core would become uncovered.

AFWS flow control Is manual (from the control room,).

27
The operators need pressurizer level and pressure

indications for this purpose.

Sequence Number 2 - This is a success sequence

also; however, the auxiliary feedwater system is

unavai'lable. At least one of the four pumps (two

charging and two SI) can provide adequate cooling flowý

into the core. The primary coolant bleed and feed

PC/BF is manually controlled. The goal of this mode of

.opeza-ti.o.n. is, .to ,d~epressurize.-th-e primary side without

achieving saturation conditions. The pressurizer

pressiore and level indicators provide the necessary

information.

The RWST would become exhausted in about 10 hours.

At that stage, the valving should be changed to allow

for recirculation cooling. This mode of operation uses

the RHR pumps In addition to those in the injection

phase. The RHR pumps take suction from the containment

sump where the coolant that was discharged from the

PORVs is collected. The coolant passes through the RHR

heat exchangers where it is cooled by the component

cooling water system, then It is routed to the suction

side of the high pressure pumps (SI or charging). This

phase of heat removal provides long-term cooling.

Sequence Number 3 -This is a core melt sequence

where the AFWs and Recirculation Cooling System have

failed; however, the primary c~oolant bleed and feed is

28
successful. Thus, core cooling failure occurs beyond

10 hours after the accident and i't takes more than

60 minutes to core damage inception. At that point,

the primary system, may be at low pressure. This depends

on how: the bleed and feed was performed. The pressure

level affects the release categories. in Figure 2.5, we

have ccnservatively assumed that the system is

pressurized when-core melt'occurs.

The following two: observations are in orderFirst, the timing in this sequenice of events is long

such that the restoration of failed systems can be a

significant contributor. Seco nd, more detailed

scenarios are necessary; otherwise, only conservative

measures can be considered.

Sequence Number 4'- This is a core melt, sequenc~e

where both AFWS and PC/BF have failed. if both fail at

reactor trip, It would take about 4.5 hours for core

melt to occur due to a total loss of, heat removal. The

system Is assumed to be pressurized when the molten

fuel breaches th vessel.. At this point, the'containment press~ure would rise, the fan coolers would switch

to the accident mode and depending upon wh'ether SI

signal exists, the corta.Anment spray system would be

activated. Note that the timing is much shorter In

this sequence of events than the previous one.

29
2.3 Combining Initiating Events with Mitigating

Functions

2.3.1 Scenario Identification

Simlahlr to the approach :n the Fire Hazard Analysis [173, we perform our analysis one location at a

time. -For each location we check the following:

(1) Can at least one of the LOCAs be caused by a

fire (see Section, 2.1)?

(2) Are there any safety-related items? If so,

assume that a reactor trip has occurred and

safe shutdown is necessary.

(3) Can reactor trip be defeated due to a fire?

(4) if the answers to items (1) and (2) are

affirmative, identify the systems for safe

shutdown (Section 2.2.1) and sequences that

will lead to core melt ar~d radiation rele ase

(see Section 2.2.5 for an example).

(5) Identify the components of the safety systems

that are necessary for their o peration and

that are inside or oL,.side the location.

In Item (5), we identify a series of scenarios.

Each consists of a location where a fire can occur, a

sequence of events in terms of an Initiating event,

systems and release ca tegory or containment event tree

entry state, the components (equipment, etc.) of this

sequence that can be affected by the fire, and co.2ponents

30
of this sequence t. f2-annot be affected by the fire.

If, in item (3), it is found that reactor trip can

be affected by a fire, then mort detailed analysis

would become necessary. It would be important to know

how much negative reactivity can be inserted and what

heat removal rates would be necessary. Quantification

of tl'is event may he p us decide if further analysis is

warranted. The approach, given in i'tems (4) and (5)

will le~ad ,us toward -the- desired .:scenarios.

2.3.2 Example: Scenarios For a Cable Spreading Room

Fire of a PWR

The cable spreading room (CSR) of the, Zion station

is stu died in this example. There are two CSRs for

each unitf,,called, the inner and outer cable spreading

rooms. The control and instrumentation cables of

almost all safety-related items are routed through the

inner room. There is no safety-related reactor shutdown and cooling equipment in these rooms except, for

cables (7,18). The out er room 6ontains some power

cables in addition to those of the inner room. These

cables are 4,160V power feeds to auxiliary feedwater

pumps B and C, power cables to both centrIf ugal

charging pumps and both safety injection pumps, 4,160V

power feeds to Service Water Pumps, and 4,160V power

feeds to three component cooling pumps.

Following the steps given in Section 2.2.1 we first

31
check forz LOCAs. In Sectian, 2.1.2, we found that a

large LOCA was extremely unlikely. By inspecting

Figure '.1, we conclude that a medium LOCA is impossible because there are no openings with an equivalent

diameter of.2 to 6 inches. A small LOCA is a possibility (through-.the PORVs); however, it is likely to be

terminated. within3o.minutes-because the hot shorts

(see Section 3.5.2.1 on Cable Failure Modes) will

be~ome open circuits. When this happens, th-e airoperated PORVs would close, thus ttrminating the LOCA.

Failure of the valves to close due to other reasons

may pose problems. This will be further Investigated

during the quantification. Therefore, we conclude that

only a small LOCA may occur, and that requires an

independent failure in addition to the fire.

Transients would occur because many safety-related

cables could be affected. Although the assumption of

rcactor trip in item (2) may not hold for some areas

(e.g., SI pump room), It is an appropriate one to make

for the cable spreading room. Many instrumentation and

control cables are linked with the balance of plant and

safeguards control systems. Their failure would definitely upset the existing balance, and so a transient

would oe Instigated.

Thus, so far,, we have found that transients are

highly likely and there is some chance for a small

32
LOCA.' In both cases, reactor trip is necessary. In

Section 2.2.2, we found that the latter could not be

prevented by a cable spreading room fire. Now,

.item (4) follows. In Secti',.n 2.2.5, the mitigating

functions for a transient were studied based on the

event tree of Figure 2.5. A similar event tree applies

t~, small LOCM'.ý The -only 'differenfceý Is in the containment everit tree entry states. For a LOCA, the primary

system may not be pressurized when the molten core

leaves the vessel. Fiqure 2.5 shows that,. for each

initiating events, we have two core melt sequences.

Before the sequences are studied, we investigate

the manner in which the thrte mitigating' systems or

functions can be affected by a CSR fire. The auxiliary

feedwater system (Section 2.2.5) has all of its control

and power cables routed through this room. All the

closed valves are air operated and of the fail-open

type. Therefore, they will open when their control

cables fail In an open circuit mode. The two motordrivers pumps can. be started manually at the pump

iocatiorn if their control cables are lost. However, if

their power cables are affected, that pump train would

be totally lost. The turbine-driven pump is an

exception because the tire may start it by simply

causing an open circuit In the control cable of the

stearm line stop valve. Furthermore, there are no power

33
cables to this pL'mp; therefore, its operation is

independent from the control room. In summary, both

motor driven pump trains of the AFWS are susceptible to

a CSR fire and the turbine-driven train can be assumed

as totally independent.

The primary coolant bleed and feed consists of two

parts--bleedingý by I the- -PORS -and- -f."-ding by the

charging or the S;I- p:um-ps. .The po wer -a:n d control cables

of all these items (with the associated valves) pass

through the cable spreading room. Therefore, this 'mode

of operation is completely susceptible to a CSR fire;

moreover, if the power cables are lost, local manual

action would be Ineffective.

The availability of the recirculation mode of

opera~tion is questioned after bleed and feed has been

performed successfully for more than 10 hours. This

mean~s that not all control functions are lost to the

fire. Also, In view of the fire loading and past

experience with fires in nuclear power plants -

(Section 3.2)t it is judged to be quite unlikely that

the fire would still be burning by this time. Vi~er,

the failure of recirculation cooling should be attributed to causes other than the fire. Human error at

switchover may be affected; however, the long time

period to any adverse situations would-reduce the

i 4

i mpa ct.

34
Oiily the control -cables of the containment spray

(CS) and containment fan cooler (CF) systems are routed

through the cable spreading room. Since the power

cables remain unaffected, all three CS pumps can be

started manually from outside the control room-. Each

ýtrain has a normally clo3ed MOV that should be opened.

If their control cables are lost, they can be opened

manually only at the valve location. The timing__is

important he.re because .t.e contq;ainment spxjay. becomes

essential only when the molten czre has left the vessel. At that point, the containment high4.-high pressure

signal would be initiated and, If an SI signal already

exists, the containment spray start signal would also

be generated. Again, human intervention becomes

important because the SI signal and even the manual

containment spray signal can be Initiated by the

operators based on their judgment about ar~cident

progression.

The fan coolers are located inside the containment. Any damage to their control cables woulo. only

fail them as they are; that is, they would not switch to

low speed. Under normal conditions, they are running at

high speed. If they fail to switch to the accident

mode, that Is, low speed, they may eventually fail due

tu high load caused by the steam in the air. I f the

control cables are lost, the operators cannot Intervene

in their operation.

35
Now we have enough informationr to develop scenari o:. We start with the transients, sequence number 3,

and containment event tree entry state E (see Figure 2.5).

The failed systems are AFWS and reci rculatin. -cooling.

For AFW4 we found earlier in this section that two

motor-driven pump trains could be affected by a CSR

fire and the turbine--dr'i'v~e'n ýýpýiit w~a-s tiotally independent. The recircula~tion-c.ool-ing .was also--fo-und to L-e

totally ir~dependent from the fire. The remaining three

systems (or functions) are assumed availaible. The

first linc -" Table 2.1 depicts this scenario.

The remaining scenarios can be identified in a

similar manner. Table 2!.1 shows some of them~. The

f irst column of that table is simply a number assigned

to each scenario. In the second column, the causes of

failure are given. In this example, we have listed the

fire in the cable spreading room, human error due to the

fire and other causes. The latter covers a broad gamut

of failure causes including human trrors that are not

affected by the fire. The remaining entries are

aligned such that they are in the same line as the

corresponding cause of failure. Note that fires are

listed as one of the causes. The remaining cclum~ns

correspond to the events In the event tiree of

Figure 2.5 and they show the failure mode or state

of each event. The core melt sequence number and

36
TABLE 2.1 -Fire Initiated Scenarios for a PWRý

I .

I

CAble

spreadfr4

fire lot

cable

TIAPIr(lft

Ii Mlhf! NrEILIAS

Failure of

botli motor

driven pup"o

failure of

turbine

frailur o

both Pow,

drivon ovamp

failure of

train

M~4I AlI?

M910 I MDrr

R!CIfnLtf- I COP = 1",I TI(Al (A10.11M SI'llM(

No.

~-.--.J---------i- -t- -4 P

CONiTAIM"T ICO 1AIZICT ICOPTAIWEINT SPRAY FIAom CO ttS EVENT TREE II ENTRY STATE

SKaCct C

falls

-4 i-# I

occurs 3

la,

-J

Other

C.'ses The whoel

fail%

Loss of O- ~trel to III

pwos and NO'S

Failure to manually

act ivaet at least 1I stri

Begeas$

.hill to

fientd

S

CAble

Othe

Cap, 4

Error

Pf"Aire of

both motor drI *on PUMS

fail"?* of turbl-*

driven trai

Tho whole 1:1t1am 3

4 -

3

Less of can- Irol to all tPjwt and

failure to

activato at lI @at I train

Failure to ,%If% to

Accden

N

failure of tavrbift

driven treain

The whole system

fa lls
TABLE 2.1 -Continued

15IWRI~O CASEO ymweit"uy AjIRRIAg ipilal REIRCM7T COW tT CONIAINKM CCRTAIUWKT COh1TAIPWNT

go. Flt'RJ 114Tl~tFING rCVDwAYER jCOOt ART T10O4 COWN14C, Sl'EP(m SPRAY FARI COMtERS EVERY TREE (Y(41 SvSlEN eltIe 9 O ENTRY STATE

fire In Occurs fatlvre of ~Failure of NSIA Success Success Cable both motor Mas&a I 1

9Jthev al fO oAI ;i Ea.WS tU'bn

driven trAln ___________________

fire in lkcwrt failure of frailure Of N/A tms of conf- Faivrt:.to CAtiO both, motor 1PODVI 9 al1 trol to all shift to SVO1 dgfq'. p.dosicka'q'n1 a pt--s and a cc (dent lclSI P.P PlOYS

S r reo, # Failurt to anual I

activate at least ItraIM

Ot W Failure Of

Cbji~ tu'iA"

t - I I - I - I - ~ - - I
containment entry state are given~ to make it easier to

trace the sequence back to the event treeý.

2.4 ,On the Definition of FIre Locations

In the preceding sections of this chapter, the

location of a fire or compartments wvhere fires can occur

are mentioned without formally defining them. On the

other hand, in all ozir examples, we have not constide~red

teposs~ibilifty 'f fires propagatin9frp-n-oiiat

ment to another. This assumption of nonpropagation is

very impor~tant in simplifying the methodology. The

impact is obvL..us. For example, in Table 2.1 we basically have two causes: first, those related to the fire,

i.e., the fire location and the human error; and second,

all other causes. Actually, the human error is linked

to the f ire because -.t is related to manual operation of

equipment failed by the fire.

A fire location should be enclosei by distinct

fire barriers. More precisely, the boundaries of a

location should be chosen such that the frequency of

s~urpassing its threshold fire resistance would be very

low. Furthermore, the f-equeniry of loss of penetration

seals during commercial power generation should be very

low. The requirement of power operation is important

because accident analysis -is mainly focused on this

phase and, during other pha--s (e.g. , refueling), some

penetration seals- may be removed ir the, course of

implementing changes.
Our judgment is that a 1-hour oi, better fire

barrier is adequate in~ view of the t ,pically low fire

loadings in safety-relattvd c-omp-F-t- its. The possibility of smoke propagation and waLer .gression

should be taken into account. One ma ink that these

restrictions would lead to a smell numu., of absurdly

iLPlocations. This should bt: a-vfýded...by judgmet.!ntaly hosigbound:.ries that dc fhot-at~i: -som __o.

1-hae aforementioned conditionsY. '

Example -The inner cable spreading r--.om that was

chosen as an example !n Section 2.3.2 has the following

characteristics [18].

e The floor is a 6-inch thick,, structurally,

reinforced concrete slab on unprotected steel

beams. It is the roof of the laboratory area.

Fire can only propagate from below to the cable

spreading room. Such a fire would be very

large and its freq~uency should be very low. We

*did not include the laboratory area as part of

the-cable spreading room.

e The east wall is 24-inch structurally reinforced

concrete with solidly Imbedded steel columns.

This wall is- shared with the týurbine building.

* The other three walls are c,-: 11-5/8 inch hollow

concrete blocks with the holes filled solidly

with mortar. They are shared with the outer

40
cable spreading room and the-itairwell. All of

the beams are als o protected.

9 The roof is 6 inches-thick, structurally reinforced concrete, and is supported by steel

beams which are covered by 2 inches of concrete

or gypsum. It is 12 feet above the floor and

Iss, ttae floor slab of the control room.,.

* Both..doors (south and north-w wls) -b.v..e a16týý-.

least a 1-1/2 hour fire rating. Thýey` are

closed almost all of the time.

e The elictrical penetrittions are: sealed with

Inorganic fibe r insulating material and covered

with flamem,%stic.

*Fire dampers are installed in the ducts penetrating the walls. These are 1-1/2 hour fire

rated steel, activ~ted by fusible links at 1601F

Reference 18 gives more detailed information.

Smoke or extinguishii.. agents (such as C0 2 ) may propagate to other areas until the dampers close due to a rise

in temperature. The control room ventilation system is

independent from this area. Water ingression- to the

cable room has only one source--the control room. The

chances of using water are, small because the primary

extinguishing agentL available In this area are C02 and

dry chemicals. The penetration seals would also act as

a barrier.

41
Thus, we can consider the inner cable spreading

room as a fire location. That Is, we can assume that

cable failures due to fire in this room are independent

from other component failures. However, when smoke

propagation or fires in the laboratory areas are considered, the validity of this assumption should be

double -checked.

2._5 -On Fires' as Causes of the Initiating Events.

in Sections 2.1 and 2.2, the...given--4xamples -are

geared toward fires that cause an initiating event and,

at the same time, affect the mitigating sys tems. this

is an adequate approach if the IE has a small frequency

of occurrence due to other causes. This may not always

be the case. For example, the lo3s of offsite power to

the Indian Point Power Station has a median of 0.14 per

year (95th percentile Is 0.6 per year). It takes

4.5 hours for core melt to occur in case of total

blackout and loss of turbine-driven auxiliary feedýwater pump. There are three diesel generators that

receive automatic start signals upon loss of offsite

power. There are also three gas turbine gen~erators near

the site that can be started manually.'

The diesel generators are housed In the same

building. They are divided by 1/8-inch aluminum

partitions which are erected as oil splash shields.

At one end of this building, the control cabinets of

42
all three diesels are located. A 14-foot high concrete

wall separates these cabinets from the Oies,ý:s. Simnultaneous fa~ilure of all three diesels may be caused by a

single fire, either in the engine area or corntrol board

area. It is judged that the latter is more l.1kely

because it requires a much smaller fire -than that of

the engine area. Failure of the gas turbines and delay

in. r es t o ring .the off site power should be due to causes

. ~the.~tanthat f~ire.

Thus, the simultaneous occurrence of a diesel

generator building fire (not an initiating event) and

independent occurrence of a loss of offsite power (an

initiating event) would lead to station blackout.

There are more than 4.5 hours available to power back,

either by restoring the offsite power or starting one oZ"

the three gas turbine gener ators.

2.6 on the Details of the Scenarios

In Section 2.3, we showed how to identify scenarios but we did not discuss the level of detail that

should be sought. For example, in Scenario Number I of

Table 2.1, we point out the possibility'of losing two

AFWS trains to a single fire, but we have not elaborated In terms of all possible combinations of components. obviously# more detail entails more work. our

judgment Is that, for 'a simple approach, -the scenarios

should be stated in gross terms--trains of components,

43
supercomponents, or even whole systems. When these are

quantified, bounding met~hods should be used. Based on

those numbers, one can then judge 'if more detailed work

is warranted.

- - -~.J ,-

44
3. QUANTIFICATION

3.1 Introduction

In this chapter, we describe a method for q rtitying the scenarios obtained In Chapter 2. The

simtplest and very conservative approach would be to

take the frequency of fires at a physical-location as

the frequency of failure of all components within that

J,9atQn.., o~r.-some areas,. this would result .in -unreapsonalyhih -core melt or radionuclide rlaefe

quencies. Therefore, a more detailed model is

warranted.

In Ch'apter 1, we identified the major steps for

quantification as part of the general methodology

(Steps 3 through 6). Figure, 3.1.shows a block diagr am

abased on these steps and gives an overall picture of the

quantification process. It references the related sections wichin this chapter where detailed,~escriptions

ire given. There is some dependence among the different blocks In the diagram that Is not shown in

Figure 3.1. For example, at *the representative'cases

forfire growth analysis," we need some knowledge about

the fire growth history (I.e.# growth, detection, and

suppression). One can use iterative methods to further refine certain parts of the quantification

process. Suc h methods would certainly depend on the

specifics of the problem.

45
FIGURE 3.1 Block Diagram for Quantifying Ft~ro icenarlos
References 10 and 12 have developed probabilistic

models for the frequency of core melt due to fires.

There have also been two other studies but with much

narrower scope where the Browns Ferry fire incidents

were an~alyzed (1,2].

Reference 10 focuses mainly on the cable spreading room fires. The minimal cut sets that contain

cables passing tbro~ugh- this -room are identified by

iad~ t~e ed event tree:.analysis. Telyu --

these cables is drawn to see what distances should be

considered for fire growth' modeling. Geometric

fractions are combined with a growth model and the

conditional frequency of core melt is obtained. By

using geometric fractions, it Is assumed that fire

occurrence is. uniformly distributed, across the floor of

the cable spreading room. For the growth mode.~., it is

assumed that: (1) all cables below or above a burning

cable are also burning, and (2) the maximum radii, of

the base of the fires are expo~nent~ially. d istr ibuted.

The mean maximum radius is obtained from the fire

incident data In nuclear power plants.

In Reference 12# the basic model is similar to the

one which we propose here; only the differences aro

highlighted. Frequentist methods are used to assess the

mean and the bounds of the frequencies. The frequency

of ignition of sus tained fires is attributed~ only to

47
the fuel type. An ex tensive model is developed for the

effects of fire detection and suppression. Some of the

results of this reference are used in this study. The

fragility of the components has not been addressed..

Instead, total failure is assumed given that the fire

has engulfed an item.

3.2 The Frequency of Fires

3.2.1 Introductl6h

-~Distributions for the frequency of fires in

nuclear power plant compartments are assessed in th~is

section. These distributions will be used as inputs to

fire risk analysis which will analyze the effects of

these fires on the accident sequences that may lead to

core meltdown.

The analysis is Bayesian (19,201. The frequency

of fires is treated as an unknown quantity and its

distribution expresses our current state of knowledge

about the values of that frequency. An important

factor that shapes our state of knowledge is the

observed frequencies in the past. Thus, a significant

part of the work Is to investigate the available

statistical experience and to decide what Information

it contains. We then use Bayes- theorem to formally

incorporate this experience in our body of knowledge.

Estimates of t.. frequency of fir..s are also derived

using frequentist methods and the results are compared

48
with those of the Bayesian methods.

The' data is described in. Section 3.2.2. That'

section also gives the reasons behind our choice of

compartments. Appendices A and B give a detailed

account of the data used. Section 3.2.3 describes the

Bayesian calcul'ations. The prior distribution is gamma

and the likelihood is Poisson. Table 3.2 gives the

results. .The. uncertainties. in the frequencies are of

the state-of-knowledge-type. Section 3.2.4 shows that

a lognormal prior has minimalI impact on the final

resul't. In Section 3.2.5, we find that, after the

Browns Ferry fire incident,' the overall frequency of

fires has increased. The frequentist (classical

Approach) methods for uncertainty 'analysis give comparable results in Section 3.2.6. The magnitude of

fires represented by the frequencies of Table 3.2 are.

discussed in Section 3.2.7. Finally, in Section .3.2.8,

the t ype of uncertAinties covered by the distributions

are clarified.

3.2.2 Data

Data on fires In Light Water Reactors (LWRs) have

been analyzed in several studies [1,10,11,21,22,231.

Although they have been done Independently, they have

some common aspectsj, e*g., some of the sources of data

are the same. For example, almost all studies have used

data from the Nuclear Regulatory Commission. Some have

49
also used data from the insurance industry. All have

reported the overall frequency of fires within a small

range of 0.11 per reactor year. These studies give

tables of-date on various features of fire incidents,

e.g., causes of fires, components involved, systems

affected, location of fires, etc. Reference 22 gives

the most detailed tabulation. Reference 10 has included

data on the size, shape, and duration of the fires, and

i-t. -also dis-cusses-:-the -methods used for detection- a-fidextinction.

There art. two kinds of information needed: (1) the

nu mber of fire Incidents that have occurred in specific

compartments during comm,ý.rciai operatioti, and (2) the

n-imber of compartment years that the nuclear power

industry has accumulated. A compartment year is defiaed

as 1 calendar year of use of a specific compartment in

commercial operation. Reference 23 is our main source

for the first part. Most of its data comes from reports

of insuran~ce inspectors to American Nuclear insurers

(ANI), although other sources are also used, e.g., the

U.S. Nuclear Regulatory Commission. While the NRC

requires the reporting of fires that, in some way,

affect the safety of the plants A?41 has more stringent

requirements In the sense that all fire events must be

reported [23). It Is still not clear, however, whether

all the potentially signific~dkt events are reported and

50
what cor.stitues an insignificant fire. In Refercnvce 23,

incidents in all nuclear facilities are classified in

several ways, e.g., according to the locdtion of occurrence, the mode of suppressicn, the cause of fire, etc.

These tables do not provide data readily appli-.

cable to our model (see Section 3.2.3). This is

because those tables for the incidents during comnierciaL. -o e.tq.- -a types of facilities includIng educational reactors, reprocessing plants, etc.

Furthermore, the tables on specific facility types

cover all phases of plant life (i.e., construction,

operation, etc). The number of incidents is derived by

comparing several tables. Appendix A gives a detailed

account of this derivation. The results are given In

the first column of Table 3.1.

The time period covered by the ANI data starts In

January 1955 (which is essentially the beginning of the

nuclear power Industry In the U.S.) and ends on May 31,

1978. .Thus the compartment years are computed by adding the age of all compartments (within a certain category of compartments) of units that were in commercial

operation by the end of May 1978. The age Is defined

as the time between first commercial operation~and the

end of May 1978 (or date of decommissioning).

Reference 24 and the Final Safe.-y Analysis Reports

(FSARs) [251 are consulted for the dates of commercial

51
--TABLE 3.1.-%,. .St~atistical Evidence of Fires in L~

(As of May 1978)

Number Number ofi

Area of Fires Compartment Years _ _ _ _ _ _r T

control Room 1 288.5

Cable spreading Roo~m 2 301.3

Diesel Generator 10 593.0____

Containment 5 337

Turbine Building 9 295.3

Auxiliary Building_ _10 303.3

51.1
operation and th.ý number of each compartment type per

unit. Appendix B giv es a detailed listing of the

number of compartment types in each plant and their

ages. The resulting compartment years are given in the

se~ond column of Table 3.1.

The choice of different classes of compartments is

partly dictated by the data available an! partly by how-

-typical a given compartment is.. The l-at t er. i.s.an

important factor -bec-ause -po~wer- plants do not have

similar layouts. This is particularly true when PWRs

and BWRs are compared. We have identifiiEi s:ix areas,

typically found In nuclear power plants. These are:

the control room., the cable spreading room, the diesel

generator, the containment, the turbine building and

the auxiliary building. By diesel generator, we mean a

unit comprised of a diesel engine and an at.tached

generator.

In most plants, the first th~ree areas are zingle

compartments. Howev~r, the remaining three are typically large buildings within which are many compartments. Table 3.1 gives t.he cumulative age of these

areas. The differences In age are mainly due to the

fact that the units in some multiunit plants share some

of these compartments. The only area that the units do

not share is the containment; thec'efore, the containment years (i.e., 337 years) are equal to the reac-tor
years. The large experience years for the diesels is

expected &oec~ause almost all plants have at least two

diesel generators.

3.2.3 Bayesian Calculations

We must now construct the distributions of the

frequency of fires in the variou's areas that we have

identified. The fundamental tool that enables us to

incorporate the statistical evidence that-we-have

assembled inito our state of knowledge is Bayes'

theorem which we write as

WE 0TX)(EX (3.1)

L(E/X)

whe re

,r' (AlE): probabil'ity density function of A given

evidence E (posterior distribution)

7T~A): probability density function if X prior to

having evidence E (prior diý,rlrbution)

L(E/X) : probability of the evidence given A (like1lihood function).

A model for the occurrence of fires is th~e-Poisson

distribution (see Section 3.2.5), i.e., the likelihood

function is

L(E/AL) = e- T (AT) r (3.2) r!

54
wher~e r and T are given in Table 3-1.

The prior distributions should reflect our state

of knowledge prior to obtaining the evidence contained

in Table 3.1. That knowledge, we feel, is vague.

While we know that the frequency of fires in reactor

c ompartments cannot be large, say 10 per compartment

year, we are unaole to say with high confidence what

..the values of this frequency ar~e.__ -Tber-efoxe-,, .the-prior,,

distributions will: be-diffuse over ,a wide range of

possible values of X .At this point, there is no,

compelling reason for us to, choose a particular ;family

of prior distributions e). :ept thal we would like them

to be of a standird type because they can be easily

visualized via their parameters and they are 'less

complicated to manipu*.ate. Also, they should be skewed

to the left because, in nuclear power plants, the

quality of fit-t protection is good.

Lognormal and gamma families of distributions.

comply with our requirements. The former fits our state

of knowledge better'because the bulk of the distribution

is around the median and, for given 95th and 50th percentiles, the 5th percentile is not unreasonably low

as in the case for cjamma distribution. However, to

facilitate the calculation of the integral In Bayes'

theorem, we choose the gamma family of distributions

which is conjugate with respect to the Poisson

55
di.stribution; i.e., the posterior distribution is also a

gamma distribution. In Section 3.2.4, we will see that

ti~is choice does not have significant impact on the

posterior distribution. The gamma distribu~ion is

IT(X W ~ exp(-AX) (3.3)

where at and 0 are the tw3 parameters of the distri-

-but-ion. A consequence ot th-e c-o-n~jug-a't-e !pro-per~t'y i-s

that 7r' (X/E) is also of the form of Fquation .(3.3)

with parameters

a' = +r (3.4)

and

93 Pj+T. (3.5)

The prior knowledge is represented by the pair

(a,j3) and the evidence by (r,T). The greatest

possible ignorance is represented by the values a = C

3nd P3- 0 '[19) in which 7TrO) is proportional toX1

(this is equivalen t to saying that tn'Xis uniformly

distributed over the whole real line). For our

purposes, we feel that. the distributiona of complete

ignorance does not give appropriate weight to values of

A in thee neighborhood of I per compartment year; therefore, we will use slightly more conservative prior dist r ibut ions.

For the control and cable spreading rooms, we take
a=0.182 and 0.96 which yield a gamma distribution

with characteristic values

A5=5 x 10-8; X50 1.5 x 10-2 x =9 1.0;

00=0.21 (mean value)

For the other areas, we. wish to give more weight.

to higher values of A and we choose a = 0.32 and

=0.29. 'The prior distribuition. has-chbarac~teristi-c

values

0 5=2.1x10- 4 X 50 0.30 ;X95 5; <X> 1.11.

These distributions cover a wide range of values

for the frequency of fires, thus expressing our vague

prior knowledge.

We can now use Bayes' theorem to derive the posterior distributions for each area using the evidence of

Table 3.1 and Equations (3.4) and (3.5). The results

are shown In Table 3.2..

We observe, that the. evidence reduces the dispersion of the prior disstributions significantly. For

example, even for the weakest evidence (Cantrol Room,

r=1, T-288.5) the 90% intirval of the posterior dis--

tribution Is (3.1x10 4, l.2x10-2 ) while that of-the

prior distribution Is (5 x 10-8, 1.0). Figures 3.2 and

3.3 show the prior and posteric~r distributions.

Reference 26 is a summary of this section, The resLA.t-:

57
TABLE 3.2 - Distribution of the Frequency of Fires (Events Per Room Year)

Area I I I P a 6 x 05 A 50 A 95

L,

Prior 0.182 0.96 5XI0- a 1-00-O 1.0 0.21 Cop-trol Room P~osterior 1.181 289.i.6 3-0-4 3.0 10 I1.2x00-2 4.xd

Cable Spreading Prior 0.182 0.96 5XO1)I 1002

Ro"Posterior 2.182 302.26 I.t4xfln 3 6.2x T7 3 .7x00-2 720

Diese r.ineretor Prior 0.32 0.29 2. Ixlfl- 0.30 501.11

Posterior 10.32 593.29 9-SX10 I./X10 2.7x1D 17l

tont.)iewint Prior 0.32 (.29 2.IuIO 0.30 . 5.0 1.11

Poster;or 5.32 3' .29 6.2E00-3 1.4x00-2 :2.8xlO 2 I.6x10'

TbieSfdg Pr~or 0.32 0.29 2.IxllO 0.30 5.1.11

P~osterior 9 ~; 2qS.59 I.100O 3.6. C, S.OX10 1.2c00"

Auxil1arv Building Prior 0.32 0.29 2.100 -4 0.3v .5.0 1.11

Posterior 10.32 V33.59 ;.9xlo0 3-3,002 .5-39102 3.4010-2
200

160

120

so

40

spreading

ROOM

0. Ios 0.01 0101S

events per '10CatlOn' year

Figure 3.2 The prior and posterior densities for the control room

and cable spreading room.

0 V

0.01 0.0., 0.0100. 0 06

events pti 'IOtaton, Year

FiQurc 3.3 The prior and posterior dens-ities for the containment,

diesel, turbine building and aux~iiry build~inci.

59
i.jr diesels given in Table 3.2 have been modified since

the publication of that referenc~e.

The special computer programn MDGAMMA (27) was used

to calculate the percentiles of Table 3.2. There are

also approximate miethods that can be used for the same

purpose. Depending on the values of a and 13, the

approach of Reference 28, or chi-square distribution,

can be used.

For a<3, Reference 28 -gi ve s .the f ol low ing

equations:

0 1 (3.6)

y(a) = o.05F(0+l) l/0- 1 (3.7)

0+

X 50 X 0 5 C(G50) (3.8)

X 95 X0 5 C(0,95) (3.9)

where C(a,1) is a function of a', the shape parameter

in the gamma distribution and the percentile. it Is

tabulated in Reference 28. r( 0+1) is the gamma

60
function which can be obtained from Sterling's asymp-*

totic series [28] for positive values greater than 1.0:

Ik x -X _ 2 7r 4 Fix 12x 2 3 [ X 288x 51840x

-' 571 + ... 1sx*(3.10) 249320

Example -For the control room we have:

a= 1.182 and P=2894.46.

Both satisfy the above given conditions. From

Equations (3.10), (3.7), and (3.6) we obtain:

1-(2.182) - 1.091

y(1.182i 11.254

X5= 3.07 x 10- 4 ry-1.

By interpolating the data given in Reference 27,

we obtain:..

C(l.182, 50) - 10.011

and from Equat~ion (3.8)

X50 3.07 x 10-3 ry-1.

Similarly,

C(1.182, 95) a 38.808,

and

61
)1 95 = 1.19 x 10O3 ry-1 .

Note that these approximate percentiles are very

close to those in Table 3.2.

For a >3, the chi-square approximation can be used.

A gamma distribution with a and parameters can be

approximated by a chi-square distribution (301 where

t Ihe random variable is X 2X2kj and the number of

degrees of freedom (Z)is equal to the integer closest

to 20

Example - For the auxiliary-building we have

a = 10.32 and -303.59

The number of degrees of freedom is:

L, 20 - 20.64 21.

The chi-square percentiles with 21 degrees of freedom

are found in Reference [29]:

2

XO.05 (21) - 11.6

2

X0* 50 (21) - 20.3

2

X0 * 9 5 (21) - 32.7.

Using 2V

X ~(3.-11)

we find the percentiles of the frequency of fires to be

62
)LO5 1 191 x 10-2 ry-1

=k~ 3. 34 x 10-2 ry'1

=\ 5.35 x 10-2 ry -

Note that thes e approximate percentiles are-very close

to those in Table 3.2.

If chi-square tables are not available, Poisson

tables may be used [30]. The closest i ntegers of a and JS

are the number of events (k) and un-its of time (77), and for

the Ith percentile we have

00 7* n

i E.~ eI( * (3.12)

n=kI

Reference 29 also tabulates this summati~on. The:

mode, mean, and variance of a gamma distribution can be

found from:

Mode = -- fr la(3.13)

Mean -(3.14)

Variance,- a 2(3.15)

3.2.4 Sensitivity Analysis

To test the effect of the particular form of the

prior distribution that we have used on the posterior

distributionsi we repeat the calculations with lognormal pri or distributions. The lognormal distribution

63
7rT(X) = 1 exp (3.16)

where I' and o are its parameters.

For the, cable spreading and control rooms, the new

prior distribution is lognormal with 11= -4.2 and

0=2.55 having the following characteristic values:

05 2.2 x 10 4;A50 ~l ; g 95. 1.0

< A> =0.39,

i.e., the distribution has the same X5 0 and X9 5 as

*tie original -gamma prior distribution but it is less

dispersed. Its shape is shown in Figure 3.3.

The Bayesian calculations must now-be carried out

numerically because the lognormal distribution is not

conjugate with respect to the Poisson distribution

which still serves as the likelihood function.

Table 3.3 compares the posterior distributions.

We observ.- that the use of a lognormal prior dis-

.tribution does not significantly affect the posterior

distributions. This is to be expected because both

prior distributions represent a fairly vague prior

knowledge, thus the posterior distributions are dominated by the statistical evidence.

For the other zooms, the lognormal prior

distribution is chosen with parameters ga -1.20 and

o- 1.71., Its characteristic values are:

64
Table 3.3. Comparison of Posterior Distributions

for Gamma and Lognormal Prior Distributions

65
A0 5 1 .8x10-2 A5 0 =ý 0. 30;

X95 5. 0; <A\> = 1.3.

Again, the posterior distributions are insensitive

to the new prior distribution. For example, for the

turbine building we get

.)0 5 1.7x10-2 A5Qo 3.x=

*X9 5 a5.0XI 2; <6> - 3.2x10-2 .

3.2.5 The Choice of a Poisson Likelihood

T he choice of a Poisson likelihood function

implies Chiat the frequency of fire occurrences is

constant in time. It can be- argued1, however, that

earlier fire incidents have offered valuable lessons

and have resulted in major improvements in the safety of

the plants from the fire standpoint. This is particularly true for the Browns Ferry incident (41 which.. is

considered as one of the most significant safety-re~ated

incidents in the history of the nuclear industry. In

reaction to that, the NRC has enfo rced a detailed plan

for fire protection evaluation and updating based on the

lessons learned [31). As 4 result, in many power

plants, the fire protection provisions have been

upgraded which prompts us to think that the frequencies

could be decreasing with time, an effect that would be

similar t o the "burn-in' region of the bathtub curve.

A simple test is performed to check this notion.

66
The time period is divided into two parts--one starts

on the first of January 1968 and ends on the end of

December 1975, the other starts on the first of January

1976 and ends or, end of May 1978. The distribution of

the frequency of fires for the overall plant is computed

using Bayesian methods described in Section 3.2.3.

Noninformative prior di~stributions (i.e., a= 0,

=0) and the Poisson .iikelii.ood are used. The incidence' data comes from Reference 10 (see Section A.2 of

Appendix A for more detail) and the containment years of

Table B.1 of Appendix B are utilized as unit 'years. The

results are shown in Table 3.4.

Conttary to our expectations, we find that the

overall frequency has slightly increased in recent

years. We believe that this is due to the fact that,

since the Browns Ferry incident, the fire reporting

criteria have become more stringent. Co~nsequently,

some of the fires that are being reported today would

nave gone unrnoticed prior to that Incident because

their impacts wete minimal~. In any case, Table 3.4

shows that the increase In frequency is very amall.

3.2.6 Comparison With Freguentist Results

We demonstrate here that, since our posterior

distributions are domi.ýated by the statistical evidence, the methods -&' frequentist statistics give

67
Table 3.4 the Nurber of Fires, the Reactor Years

and the Frequency of Fire !hcidents

in the Overall Plant for Two Time Periods

Period

Frequency (per

rcactor year)
results that are numerically close to those of the

Bayesian calculations. We use as examples the control

room (weakest evidence) and the turbine building.

The maximum likelihood est~i-ate of the frequency

of fires is

r (3.17)

and it is'.to be compared 'wi-th- the mean value of the

posterior gamma distribution

Equation (3.18) shows that, when the evidence (r,T)

dominates the prior knowl, ee.ge (04j3). the two estimates

of Equations (3.17) and (3.18) are approximately the

same. Numerically, we get

Control Room

=3.47x10 1 ;. <x> =1.182 4.08x10-3

28-8.5 289.4-6

Trurbine Building

== 3.05x10 2j <;k> 9. 3.15 x0

.As expected, the agreementl in the case of the t' cbine

building (stronger Evid2!nce) is better although, for

the pu-.rposes of risk analysis, the agreement of the

estimates in both areas is satisfactcry.
We next compare confidence intervals. The classical 90% confidence interval for X is [321.

X2(2r) X 12 (2r+2)

2T 2T

where ~(2r) is the lOOIth percentile of a chi-square

distribution with 2r d egree~s of freedom. In the

present case, I=0.10 and we get.

Control Room

2 () 0.103, X2 =9.43;

X0 0 5 (2 0 95

Bayesian interval: 3.1 x 10-4 - 1.2. x 10-2

T-urbine Building

V 2.5 (18) = 9.9 2. c (20) 31.4

1.6 x 10-2 <A< 5.3 x 10-2.

Bayesian intervAl: 1.7 x 10-2 _ 5.0 X 10-2

The agreement is, again, better for the turbjine

building. Even though the frequentist and Bayesian

intervals are approximately t~ie rame, their Interpretation are f.~rsdarnentally different. In the Bayesian

approach, the value of tha frequency A zhat will be

revealed after many years of experience is unknown and

the probability that this val.ue is In the stated

-11
interval is 0.90. in the frequenti.t approach, A has

a fixed but unknown value, and the interval itself is

random. If we envision many samples over the same

period T and calculate the confidence intervals, then

90% of these intervals will contrin the unknown value

of A.

The reason why the two intervals are approxima3tely

the same can be seen when we establish the relation

between the gamma distribution and the chi-squiare

distribution. It can be shown [301 that, if Xa'is a

positive integer, then the variable 2Ap'has a chisquLre distribution with 2al degrees of freedom.' In

the case of the control room, .2a'= 2.364ý-2=2r and

j'290.26=- T; therefore, the Bayesian confidence

interval can be calculated by

X 2 (2r) X 12 (2r)(.0

2T 'Z

then

1.8 x 10-4(A 1.0 X 10-2

which is the frequentist result (Equation 3.19), except

that the upper bound here is evaluated for 2r degrees

of freedom. -The use of 2r .+ 2 degrees of freedom in

Equation 3.19 stems from' the notion that an additional

fire incident may have occurred right. at the termination

7 1
of. the time period. This gives larger upper and lower

bbunds. It is normal practice [32] to choose the widest

interval, thus Equation (3.19) results. For the case of

smallest r (i.e.,r -1) the difference is not large

(l.Ox10- 2 versus l.6x10-2 ). For larger values', it would

be smaller. of course, if the prior beliefs -Jere

significant, the parameters a and 6 of the prior distribution would be comparable to r and T, thus invali--

dating the approximations a '=r and P' T *In this case,

the Bayesian and frequentist results would be

.numerically different.

3.2.7 Nornial Approximation

The normal distribution can be used as an approximnation of the posterior distribution. It can be shown

(19] that, for strong evidence, the posterior distribution is approximately normal with mean equal to the

maximum likelihood estimate and variance given by

-2 A2, ln a 2 1neXT T2 3.1

# ~ 3 = ri T J1n[ r' (3.21

T T

Thus, the variance'iB*

2 r (3. 22)

This must be compared with the variance of the gamu'a

-71-
posterior distribution, i.e.,

Var (A) a+~ r (3.23)

(+T) 2

Similar to the mean value, Equation (3.18),

Equation (3.23) shows that when th- evidence (r,T)

dominates the prior knowledge (0,P), the two estimates

i.e., Equations (3.21) and (3.23) are approximately

equdl. Again, we use the control room and the turbine

building as numerical examples.

Control Room

.Tkle mean. and staridard deviation (square root of

varianc~e) are:

288 .5 X xi2 10 ry', 1 1 = f 3.5 x. 10 -

The percentiles are found using:

XI= >+ ZP(3.24)

where ZIis the Ith percentile of standard normal

d irtr ibut ion.

A 5 3.5 x 10-3 - 1.64~5 x 3.5 x 10-3 _ -2.23 x 10-3

X9 5 - 3.5 x 103+ 1.645 x 3.5 x 10- 3 9.1 x 1-

Bayesiani interval: 3-lxlO-4 - .2x10-4

Turbi.-e Buildinjg

<X~~--9- 3.0 x 10- 2 25. 2.02 x 10-2

X 0 5 .3.0 x 10- 2 _ 1.645 x 1.02. x 10-2 -1.37 x 10-2

X(, 3.0 X- 102 + 1.64r, x 1.02 x 12 4.70 x ()- 2

7 I
Bayesian Tnterval = 1.7 x 10-2 50 1 -a2.

Obviously, the lower bound for the control rooti. is

unacceptable. This means that the evidence (one fire

incident) is not sufficiently strong an~d -the shape of

this posterior can~not be approximated by this normal

distribution. On the other hand, for the turbine

building, the evidence (nine fires in 195.3 years) is

rather strong-.and the approximate bounds are quite

close to the exact values.

3.2.8 Frequency-Magnitude Relationshi p

Fire is a frequency-magnitude phenomenon like

earthquakes, tornadoes, etc. By this, we mean' that, to

describe the events accurately, we need their frequency

of occurrence and a measure of their magnitude

(severi-y). For example, for earthquakes, a welldefined scale for the magnitude is the Richter scale.

Unfortunately, such a scale has not yet been established

for fires. This lack of a measure for the magnitude of

fires necessarily inroduces a certain degree of

fuzziness into the i.nalysis.

The data covers a large spectrum of fires. our

judgmnent is that there have been many small tires that

have not had any significant impact, and consequently,

have not been reported. Thus, a lower bound should be

envisioned for fire severities represented by the

frequencies of Sect i-cm 3.2.3. Thes wý:vs-~r'Thuts of this
bound (physically) cannot be easily determined. It will

be further. discussed when these frequencies are applied.

3.2.9 Uncertainties in the Frequency of Fires

Ideally, in this chapter, we should have assessed

the, distribution of the annual rate* of fire occurrence

at every point in a given power plant. In the literature, we usually find that the frequency of fires for

the overall plant is assessed using industry-wide data.

one such frequency is given in Table 3.4 (the last

col umn). There, we have pooled the fire data on the

different plants into one piece of evidence (r,T).-

Ideally, the evidence should be in terms of (r ij, Tij)

where i specifies the power plant and j specifies the

fire location. Obviously (r,T) are the sum over all I

and j of (r1 jo1 Tij). This pooling of evidence into one

implies that all nuclear power plants are beli~eved to

have the same fire behavior.

The resulting distribution depicts our state of

knowledge uncertainty and does not give any information

on the plant-to-plant or the within-the-plant variability. Note thijt, for larger (r,T), the resulting distribution becomes narrower (compare Colum~ns I and 2

with 3 in Table 3.4). This Is consistent with our

interpretation because, with more evidence, our

uncertainty about the exact value of the frequency

becomes smaller.

75
in this study, we have broken down the mentioned

summation into specific locations, i.e., we have summed

over all i's only, and groups of j's that represent the

desired areas (e.g., turbine building). The. same implications can be drawn here, i.e., all similar locations

in all power plants have the same fire behavior; The

results are ý,hown in Table 3.2.

Again, the distributions depict our state-ofkn~owledge uncertainty. They do not show the plant-toplant variability. That is, one cannot take the lower

portions of the distributions as representing the

better quality (from a fire kiaizard standpoint) power

plants. We interpret this distribution as representing

our uncertainty about the mean frequency of fires in

those compartments.

3.2.10 On the Extrapolation of the Results to other

Areas

Or'ly a limited numtber of areas are studied in this

chapter. The extrapolation of the results to compartn'ents not covered in Table 3.2 car. be done using judg'-

ment. We illustrAte this by two examples.

Example I - AuAi.,ary Electrical Equipment Room at

the Zion Station

The auxiliary electrical equipment (AEE) room

contains the logic circuits, small transformers, and

relays for automatic control systems, interlocks, and
instrume~otation. These are installed in metal cabinets. The room also contains the battery chargers

and inverters, The cable trays are near the ceiling.

There are no power cables in the room..

This room is not typical of all nuclear plants.

Consequently, data on fire incidents is not available.

The fire loading in the room is very low (5,300 lbs. of

cable insulation In the cable trays and 5,200 lbs. in

the cabinets and panels). it is a controlled area in

that permission of the shift supervisor is required to

enter the room, which happens fairly often (on the

average once every 2 days). All cf the components

except for those which are battery-related are

typically installed in the control rooms. Thus, we

judge that the room Is fairly similar to the control

room; therefore, we can use the distribution for the

frequency of fires In those rooms. L1

Example 2 - Primary Auxiliary Building, Fan House,

and Control Building at the Indian

Point Station .

The primary auxiliary building, fan house and

control building house equipment that Is typically

found in the auxiliary building of other plants. Thus,

we can assign one distribution (that of the auxiliary

ba'ildings) to the collection of these three buildings.

The fraction of auxiliary building fires that would

77
occur in each area is estimated judgmentally based on

the following observations:

" Both portions of the cable tunne~l have identical characteristics except that,ln one of them,

a sprinkler system is installed.

* In the switchgear room, equipment with moving

parts (air compressors) and breakers for electric power are installed.

*There are more than 25 compartments in these

three buildings that have characteristics'

similar to these three fire zones.

*The most conservative situation is when all

auxiliary building fires are assigned to these

three fire zones.

We take the most conservative case as the upper

bound (the 95th percentile). We believe that fireS 4re

more likel';- to occur in the switchgear room than the

cable tunnels. Thus we chose 0.5 for the upper bound

for the switchgear room and 0.25 for each portion of,

thc tunnel. Note that their sum equals to 1.0.

For the lower bound we use

*L 0.04

which implies that all compartments experience

identical fire occurrence rates. it may be conservati~ve for the cable tunnels and optimistic for the

78
switchgear room. In both cases, we believe that the

real fractions are closer to the lower bound than the

upper bound. Therefore, a lognormal distribution is

chosen to describe our state of knowledge uncertainty

about these fractions.. :For the switchgear room, it has

the following characteristic values:

Q0 0.04, 050 =0.14# Q95 0.5

(Q> =0.19

For each portion of the Cable Tunnel, it has the

following characteristic values:

Q5= 0.04, 05 0 0.10, Q9 5 0.25

<'Q>= 0.12

3.3 Representative Cases for Fire Growth Analysis

Ideally, after the components of a scenario are

identified, we silould perform fire growth analysis for

all points in t~he f ire location to see which f ires

would lead to compo~nert failure. The results should

then be combined with the frequency distribution of

fires igniting at those points. Also, if there is more

than one set o f components att~ibuted to the same

accident sequence, special precautions should be taken

to avoid double-counting. obviously, this would entail

large amounts of computation. We sugge st that it be

replaced by a bounding approach where only a few cases

are chosen, such that the dist ance between fire locatihon!- nr.A component l'ncations. is minimized. Ease of

~LI
failure of the components should be also considered.

For example, pipes are not as suscept~ible to fires as

cables or switchgear. Thus, their contribution to the

sequence can be dropped from the analysis. our idea of

a bounding analysis may be better understood through

the following two examples.

Example 1. - Inner and Outer. Cable Spreading Rooms

in the Zion Station.

Figure 3.4 shows thL. routing of some of the cables

relevant to the scenarios described in Section 2.3.2 and

Table 2.1. It does not show the vertical separation of

the cable trays. The design criteria in the Zion station [A)] requires that: (1) power, control, and

instrumentation cables be placed it, separate trays; and

(2) the redundant divisions be separated by at least

4 feet vertically and 3 feet horizonta'oy. The latter

has not been followed In the cable spreading rooms.

There, the vertical separation between two trays could

be smaller. However, as part of the~ separation criteria, solid covers (or barriers) are provided for

power cable trays wherever they run below a control or

instrumentation tray or the separation is less than

that stated above. A similar barrier is provided for

control and instrumentation cables wherever the separation of redundant channels becomes less than

it inches.
clft :I , .I'.*.e, rr..fl V PVCV *PIA

by) Pol ap, .Pw'

cf-.0 t C~- (Q: ( P. toVo( Ic~ h

tWo. C0 . & qSO 0W.tROt .1-S PtW 10

W*J' C1(C)

I ~ *IS$* * (~) co wl t~o t coosE ' itFiu.3.4 -Cable Poutinci of Som'e Specific Cables Inside the Outer Ca ble Spreading Room
T deally, we should pstulate fires at different

points in the cable spreal".ng rooms and study the fire

growth and, consequently, cable failures from that

point. As mentioned earlier, we replace this with a

bounding analysis. obviously, are as where many cables

cross one another Are the prime candidates here. We

have identif~ied. three ýýmajo~r-ý:z.ones- (see the rectangles

in Figure 3.4 designated as X, Y, and Z). If a fire

occurs *in area X, a small LOCA may cccur. However,

most of the cables relevant to small LOCA mitigation

are far from that fire zone.

If the fire occurs in areas Y or Z, a transient

initiating event is imminent. The power cables to both,

chasging- pumps and both motor-driven auxiliary feedwater pumps can be affected. Also, the control cables

to all fan coolers and two containment spray pump

trains can be affected. The PORVs, safety injection

pumps, turbine driven auxilt ar'y feedwater pump, and one

containment spray pump may not be'.affected. The

unavailabiiity of this equipment may also increase

significantly because we have not identified all the

control and Instrumentation cables in the area. The

effect of these cables on the systems, especially via

the operator in the control room, Is not known to us.

We see that many scenarios can be identified

within one tire zone. The notion of scenario here is

82
slightly different than that ot Chapter 2. There, it

included a list of components, their failure modes, and

the causes of the failures. In this section, we add

the time history of the f ire growth as part of the

scenario. To simplify the matter, we judgmentally

define a representative case for fire growth as:

1. Trans ien-týJ-els-ign ite-,and form a 12x12-inch

(base measurements) pilot fire on top of the

cables ir~ a horizontal cable tray (Tray 1 odft4--tý'J:'"'"t."-

Fig u c- 3.5).

2. Tahere is another tray parallel to, and 4 feet

.:bove, the first one (see Figure 3.5).

3. The time for the ignition of the Lipper cables

due to the firi growth is 4ssessed (for the

reason on this choice of growth time, see the

following sections).

4. When the cables of the upper tray ignite, then

all the cables of the marked area (i.e.. X, Y

or Z of Figure 3.4) are assumed to have

failed. This Is because t*.-e fire Is rather

large when the second cable tray ignites and

the additional time to a third, tray or beyond

is very short.

83
04 0T

DIV 148 0.2 1N

H-12 IN.

Figure 3.5 Cable Tray Configuration

Cable Spreading Roam

in the Zion

84
Example 2. - Auxiliary Electrical Equipment Room

in the Zion Station

In Section 3.2.10j, we described the type of

equipment that eixists In the Auxiliary Electrical,

Equipment (AEE) roomi. Wigure 3.6 shows the position of

th~e metal cabinets and battery-related equipment. Only

a partial list of.:the circu-its-and their corresponding

cabinets is provided in that figure. Reference 2

ciescribes -how f ires in the AEE room may lead to

severe consequences. it is found that fire-- in areas

A and 8 (circled in Figure 3.6) would inflict the

most serious damage to the safe shutdown process by

failing the circuits Inside the cabinets on the two

sides of the aisle.

Using judgment, we define the repre'sentative case

for fire growth as:

1. Transient. fuel Ignites In one of the noted

areas (the amount of burning fuel is discuscid

in Section 3.4.)

2. The fuel is on the floor.

3. The position of the center of the fire Is on

the centerline of the two facing cabinets.

4. The position of the center of the fire is uniformly distributed in the anisle portion and

the fire does not occur Inside a cabinet.

85
eM.TtAt Lipor

c,.CLAY, MAD CtAe?11

fie013 LI O. M 

Lems.Ce eLe

0, el PO~re UR

0~"g em 0* JC earn S'ee Une

ElOM01 UfII PRESS UREAN MII OLUL."to at V(9 V, "0*100ACGeC

ems'~~~O emeS 3e S.mU

cMfSor

List~ of4 theConent
5. The air temperature inside the-far cabinet

(farthest from the flames) is of interest. In

Section 3.5, we find that, for temperatures

higher than 260OFp circuit failure becomes very

likely. We conservatively assume that the

cabinet' air temperature is the same as that of

the circuits.

3.4 Fire Growt h ;Analy 1sis....

There are three parts to the problem of fire

growth: the fir~e growth Itself, detection, and suppression. Ideally, these processes should be a6nalyzed together because growth and suppression interact with one another very closely. As a fire grows,

the chances for applying some extinguishing agent

become greater. As more suppressant is applied, the

fire would grow less vigorously and eventually wouldl

start to decrease in size.

A simple and conservative model is proposed ina

this study. Fire growth analysis is performed separately from the suppressionI, analyi-As (see

Section 3.4.1). We assume that fires are not affected

Ly the~ extinguishing agents until the time of successful exctinguishment. The goal of growth analysis Is to

find the probability distribution of the growth period

which is defined by the representative cases ,-f

Section 3.3. The result is combined with the time to

8 7
complete suppression and the frequency of the scenario

(the fire related part) is obtained. The time to

complete suppression is the sum of two time periods--

detection and suppression (given detection). Some,

preliminary thoughts are given about the. char~icteristics

of these two time periods' (i.e., detection and suppression) in Sections 3.4.3 and 3.4.4. Statistical

data is used in assessing their s um.

3.4.1 Growth Analypi2

The goal of this part is to establish the probability distribution of the growth period without considering the effects of suppression activities. A

physical model for fire growth 1j&85 been developed in

Reference 33. The input to this model includes the futl

type and its distribution within the room among other

compartment parameters. The output is a multitude of

response surfaces which give the growth time as.a function of input parameters and the heat content of the

pilot fuels. The different curves represent our state

of knowledge uncertainty about the Input parameters.

The pilot fuels, the fuels upon which the fire burns

initiall y. are emphasized here because'they are used to

model ignhition as noted In Reference 33. The followIng example Illustrates the approach. it Is summarized

from that reference.

Be
Example - Cable 3preading Room fires in the Zion

Stat: on

In the' first ex.,'mple of the previous section

(Section 3.3), we defined a representative case for fire

growth in the cable spreading rooms of the Zion station.

Figure 3.5 shows the cable tray configuration that is

an3lyze~d. As part of the represenitat~ve case, we

assume that a .12x12-inch pilot fire is established on

top of the cables In Tray 1. The objective is to

assess the time for the fire to propagate to Trays 2

and 4. Figure 3.7 shows the result [33]. The probaability is a measure of our state of knowledge uncertainty about the input parameters and modeling of

fire pr4.;agation. Note the large uncertainty band.

The distribution of pilot fuel heat content (Q P

used in this example is as follows:

pBetu Probabilit y

400 0.10

2.,000 0.44

10,000 0.44

40,000 0.02
CL)

900

R v I gO&~
3.4.2 On Ignition and Pilot Fires

in Reference 33, the process leading to initial

fire is not modeled because the frequ~ency of fires can

be estimated from the available data discussed in

Section 3.2. In that reference, it is assumed that a

small, established fire, which we call a pilot fire,

already exists in the area of interest. For example,

ii. the cable spreading room~s of the Zion station, we

assumed It to be on top of the cables In'Tray I of

Figure 3.5. Two pieces of information are necessary

here: (1) the type,, and (2) the amount of ,the comnbustibles in the pilot fires. From the Fire Protection

Repotts (17), we can find the installed fuel contents

of a compartment. In addition to these, there might be

transient fuels whose quantities are subjectively estimated because little statistical data exists about

them.

Before further discussion, we consider what types

of material and what quantities constitute the transtent fuels. We cite the following quotations from different sources. For-cable trays, Reference 34 mentions *a review of past cable tray fires indicates

that trays are a collection place for combustible waste

materials auch as lunch wrappers or oily wiping

clothi.0 The heat contents 'of these Items are estimated to be about 200 Stu and 5,000 Stu, respectively.

91
In the Fire Protection Evaluation Reports (17],

the amount of transient fue'I.s is also estimated. For

a general area in the plant, the Zion Fire Protection

Report [18] states (page 2.1-2): "transient fire loads

are unidentified combustibles, defined as being equivalent in Btu content to the fire load that would be

contributed by the combustion of a 55-gallon drum of

lubricating oil or greater-as defined in the fire area

analysis." However, the analysis becomes more speciffic

when individual a tea re-'anA1-Yzed;- For-example, for

cable spreading rooms, it is stated that (p. Z.3-16):_

'transient loads are not considered in this room,

since it is a controlled area.*

The Indian Point F ire Protection Report (35]

defines three levels of transient fuel loading defined

In terms of type and amount of the fuels., For example,

Type 1 transient fuels include 5 pounds of wood,

2 pounds of paper, and 3 pounds of plastic with a total

heat content of 76,000 Btu. The most severe case is

called Type 3 which concains 15 pounds of wood,

8 pound., of paper# 8 pounds of plastic, 5--pounds of oil, .

and 10 pounds of arease; the total heat content Is

433#000 Btu. it is Interesting to note that, for the.

cable spreading room, It is judged that Type 3

transient fuel louoing applies.- The lubricating oil

may be present because the motor-generator sets of the

92
Reactor Protection System are installed in that area.

in both cases (Zion and Indian Point), the fire loading

is given for a compartment as a whole ard its density

per unit floor area is not specified.,

From this information, we judge that, in areas

;ýhere machinery with lubýricating o-il is installed, the

F--,dominant fuel for the pi lot f ires i s o il _(e.g.. the

diesel -generator areas or pump 'areas). In other location-s, the transient f uelsý ar-ei :the mainh co6n-tributors to

the p~ilot fires. Among such areas, we Cdr. mention the

cable' spreading rooms in Zion where the combustibles

(cables) are not readily flammable and the auxiliary

electrical equipment room in Zion which is kept very

clean and to which access is strictly controlled.

For the models of Reference 33, the pilot fires

are expressed in terms of a pro~bability distri-bution

of their heat content and the type of fuel. one

such distribution is given in the example of the previous section. The first two lowest values (i.e.,

400 and 2,000 Btu) are judged to be' fueled by cellu-

* losi- mat~erials such as wood and paper. The higher

values are *attr~uted to lubricating oil.

3.4.3 Detection Time

'The objective of this section is to assess the

time It takes after fire ignition for the plant personnel to -- ecome aware of the fire. A fire can be

93
oJ P ther by thiý -'I~ or by automatic

vction ,ystemns. in fferences 10 and 12, we find

'.,at about 7D percent of the fires that occurred during

the cperati,,rial phase of the nuclear power plants wec-i

detected by humans. This is an avzray;e fraction and

specific cases could be quite uifferent. For example,

in areas where access is normally restricted, this

.fraction may be much sma.Ller. Un'fortunately, ,the data

:::ýa~vai~lable..to us is not classifiedbyth cbnton of

detection mode and location.

The time for fire detection by hum~ans would be

almost instantaneous in the incidents where they are

the cause of the fire or when the area has significant

tiirv uq h-t ra f fic. The detection time may be longer (if

they are not started by hiumrans) for very small fires,

smcic~de-ing fires, or restricted areas such as the

cable sprealing room.

The remaining 25 percent of the fires were

detected by automatic systems. There are many-types of

.fire detectors-and detecting systems. These-are

described In References 36 through 40'. The detectors

commonly used In nuclear power plants are sensitive to

smoke. Reference 41 develops an ei~pression for heat

sensing devices. In Appendix C. rome test results for

".he response times of smoke and heat detectors are

quoted. These teats were performed in residential and

94
hospital environments. Power plant environments could

be very different [401 because the compartments in

nuclear power plants are generally large and air flow

patterns are very different.

From those tests,.we can see that there is a

finite likel ihood that the detectors would not respond

at all. This, of couiz...e, depends on a~multitude of

.parameters such as Lhe air flow character-istics-o-f!-

ttecompartment, the si-.e of rel:e'as-e'd "ýa-riti~c4--esý,"

detector type, arnd availability of the- detector itself.

it should be~noted that, In about 50 cases which

References 10 and 11 have studied, all fires were

de tected before self -extinguishmert. Obviously, the,

-frequency of such events would al so depend on~ the

magnitude of the fires. A large fire shc~uld have a

vanishingly small frequency of remaining-undetected.

Due to lack of data, there is no cloar-cut

appioach in assessing fire detection-time. .The information given in this section and in Appendix C should

be used judgmentally for more specific cases.

Example - Cable Spreading Rooms in the Zion

Station

The cable spreading rooms are controlled access

areas where work Is not done under nor~mal operating

conditions. The roor-s are provided with Ionizationtype smoke dentector& that annunciate in the control

95
room. They are positioned in a square lattice that

measures about 20 feet on each side.

We judge (conservatively) that detection is solely

dependent on the automatic system and credit is not

given to human presence. It is very licely that the

fire would be detected within the first 5 minutes. We

do -not agree with the large probability of no response,.ýý!

ýfoUnd in 'Apý endix C.' We believie -'thaif"iE it fss anfshingly small because fires relevant to this study

(which means fires of rather significant severity)

would eventually fail some cables such that they would

di.ýturb the indicators on the control boards in the

control room, thus prompting the operators who would be

searching for the cause of the disturbance. We believe

that, within 60 minutes, it is extremely likely that the

fire would be detected.

3.4.4 Suppression Time

The suppression time is loosely defined is the time

period between fire deccction And total exýinguishment.

Many para-meters influtnce this time period.- For

example, the extinguishing agent and system, severity of

fire, nature of fire, accessibility of the fire zone,

etc. Similar to detection, fires can be extinguished

either manually or automatically.

in the data given In References 10 and 11, we find

z.hat about 801 to 90% of the fires in nuclear power

96
plants were extinguished manually. it should be added

here also that suppression time is a function of fire

severity.

Very few sources have studied fire suppression

time. Thus, In deriving the frequency distribution for

suppression time, subjecti ve judgment should be exten-

.sively. employed. Appendix D provides information that

qcaii6ep Us to assess -these dsrbtos Ir h--.

first part of that appendix, we find 'some* *e'stima tes o-bn

suppression time. The second part shows that the

uncertainties must be very-large, and in the last one,

failure to extinguish is discussed.

In Section D.1 of that appendix, we find two

distributions for the time between detection and

putting the fire under control. one distribution is

for the overall plant and the other is for electrical

fires. Both are based on data given .&n Reference 10

which are In most cases, estimates by experts. These

data did not spec.'fy the type of extinguishing agent or

system used and, In all cases, the fire Is eventually

extinguished.

The two longest suppression times occurred at the

Browns Ferry power plant. The last one (24-hour duration) Is the charcoal adsorber fire Incident of the

off gas system on July 18. 1977 [42). The other suppression time (7 hours) belongs to the veil-known cab...

97
spreading room fire (3]. In that incident, the main

reason for delay was the operator judgment about not

applying water to an electrical fire.

,In Section D.2, fire suppression test results are

giv':n., From the data of.-that section we conclude that:

(1) there should be a large variation in suppression

time; and (2) even in the cases of large fires, the

physcalprocess of extinguishment can be short -given -

~--~that::zthe---necessary- -equipment and personnel -la-cde-9s9es'*brereadily, available.

Several sources [12,36,43-45] have studied theeffectiveness of the extinguishment systems. In all

cases, it has been expressed in terms of a fraction;

however, the definitions are not uniform. We interpret

them as the complementary frequency of failure tc,

extinguish. For sprinkler systems, a sufficiently large

data base exists. The overall effectiveness of all

types of sprinkler systems and all types of conditions

varies between 88 percent (the Factory Mutual experiience, see Reference 43) and 99 percent (the kustralian

experience# see Reference 44).

For extinguishing systems other than sprinklers,

lower effectiveness fractions are generally reported and

the data is very sketchy. For example, for carbon

dioxide type extinguishers, the effectiveness fraction

Is about 50 percent. in Reference 12, an extensive

98
treatise on these types of extinguishing systems and

agents is given.

Example -Cable Spreading Rooms in the Zion

Station

In the examples of the previoL's chapters and

sections, we have analyzed some of the different

a-spects ofI-fre incident In the inner and :outer. cable.

~sprad ..rooms of 2~ ion station.'8ie up'pesoisexamined here.

Portable extinguishers are located in these rooms.

A marnual hose stati~vn is in the outer cable spreading

room and has access to t.ie inner~ room. A Halon primary

suppression systt.m with a C02 backing is also

installed.

In Section 3.3, we find that areas Y and Z (Y is in

the out-= *:oom and Z In the innc-.r) of Figýure 3.4 are

the most damaging locations for fires. Both are easily

accessible because they are close to the entry doors

from the stairwell and cable densities are rather low.

in a cable spreading room f Ire, the main burning fuel

would be the cables; therefore, the growth rate would

be relatively slow. Thus, It Is vecy liklely that the

fire would not be large at the time the perscnnel would

attempt to extinguish It. IHowet er, on the other hand,

due to burning cables the fire would be producing

large amounts of smoke and Impede the accessibility of

In fire area.

99
3.4.5 Fire Duraticrn

We define fire duration as the time between

ignition and com~plete suppression. It is the sum of

two time periods, detection and suppression. ideally,

we should define a third period in between these two

which would represent the time it takes after detection

to s~ta~rt., Applyin%-.:an extinguishing agent. For example,:

-this---wotzld be -the -tiure-between fire alarms--oundin-g-'ih 7*"'

te control room anrd operators. applying~ tie -C,02 orto a

fire. In the previo us section, suppression time is

defined such that it covers this middle period also.

The suppression time and detection time are not

independent random variables. Thus, in deriving the

probability distribution of the fire duration, one

should use the joint distributions of the two random

variables. In the following example, we use the

statistical data given in Appendix 0 ~for this purpose.

Example -Cable Spreading Rooms, Zion Station

in the examples of Section 3.4..3,, and 3.4.4, we

describe the detection and suppression mechanisms in

case of a fire In the 'Inner or outer cable spreading

rooms. In Section 3.4.3,, we hbve found that the

majority of fires In nuclear power plant.. are detected

manually and also, If the detection is not manual, a

good majority of them would be detected automatically

within a few minutes (see Appendix C). in Table D.1 of

100
Appendix D, we find that 54 percent of the fires that

have occurred in nuclear power plants Involving electrical insulation were suppressed within 18 minutes.

Furthermore, in the example of Section 3.4.4, we have

found that the critical axeas of these cable spreading

rooms are easily ac!:essible. Based on these arguments,,

we cho-se.40 and 30 .-percq.ent for the average fire du'ration f_ 5-and 1.5 mi~nute-s,r-espectively. We believe

that the former Is more likely than the latter because -.

there are good chances that the fires are caused by the

personnel themselves.

1r. Table D.1 of Appendix D, we find that 29 percent

of fires involving electrical Insulation took about

1/2 hour to be brought under control and, similarly,

for 16 percent of those fires, It took more than 1 hour.

Thus, this table suggests a slowly decreasing upper tail

for the distribution of the fire duration. We believe

that, for the cable spreading rooms of the Zion station,

it (the' tail portion) decreases rather rapidly because the

data base for Table D.1 Includes the Browns Ferry incident

(3]. The fire had st opped propagating In the earlier

stages In that Incident and further damage was not being

inflicted. Furthermore, we do not believe that s-ih a

long delay (7 hours) in suppression is likely to occur

today in light of the lessons learned frou. that Incident.

Therefore, ye chose 20 percent and. 10 percent for the

101
average fire durations of 1/2 and 1 hour, respectively.

This histogram is shown In Table 3.5. It gives our

state-of -knowledge uncerltainty about the average fire

duration.

3.5 Com~ponent Failure Under Fire Conditions

3.5.1 Introduction

The effects of fires on components typically found

in power plants are d"iscuEsed in this section.

-Ex~posue -.;beat. is our main concerni. Effects of-...* e.

or extinguishing agents are discussed for only some

limited cases.

in the following section, the failure of electrical

cables Is discussed; their fail',re mode.~ are identified (Section 3.5.2.1) and frequencies of failure alre

analyzed (Section 3.S.2.7 through 3.5.2.9).

In Section 3.5.3, the failures of other components are

analyzed and, in the last two (Sections 3.5.4 and

3.5.5), the effects of extinguishing agents and smoke

are discussed.

3.5.2 Electrical Cables

3.5.2.1 Failure Modis of Electrical Cables

many different types of cr~bles are generally used

In a nuclear power plant. In muost of the parts of a

plant, they are laid horizontally In cable tra ys and,

in some areas# they may be ro'hted through metal conduits. The power cables are usually of a single

102
Table 3.5 Fire Duration in the Inner or outer

Cable Spreading. Rooms in Zion

Average 

Fire Duration-Cmliv Cu u at v

(Minutes) Probability Probability

5 0.4 0.4

15 0.3 0.7

30 0.2 0.9

60 0.1 1.0

103
conductor-type with large core (the copper conductor)

to outer-diameter ratio. The control or Instrumentation cables are generally smaller in diameter and may

have two or more conductors (wires). Figure 3.8 shows

several cable cross sections. Several failure modes

may occur depending on cable construction, circuit

design, and the adjacent .cables. Two classes of failur~e.

modes *are' identifled. Thefirst class (or failure

mode) wih chiwe* -call "open circuit" consists of fa11 u~

that lead to loss of functionability. That is, the

signal (or pow'er) does not reach its destination; for

example, a grounded power cable or a shorted control

cab le. The second group, called Ohot short," consists

of failures that cause an inadvertent action; f')r

example, the large LOCA occurrence described In the

example of Section 2.1.2. Figure 3.9 is another

example. Here, If wires A and B contact each other,

the solenoid valve would open and the air operated

valve would change position. These wires could be in

the same cable (see Figure 3.8).

We believe ti-at these two failure modes (hot short

and open circuit) are Important In fire risk analysis.

Other failure modes lead to one or the other. For

example, circuit disjunction,, when a cond'ictor (wire)

experiences severe damage (eeg., melting) and its continuity is lost, Is an open circuit. In the case of

104
Conductor

Insulation

Jacket

Singe -1 2-Condmictor

14-Conductor

Figure 3.8

7-Conductor

A Sample of Cable Cross Sections

105
r 

A -- i I - ------

MOTOR I A I ~~~CONTROL 1 i

L ------- ------ - -I - -

I CONTROL

ROOOM I SOLEN~OLENOIDIL ~

I '3SPREADING

0 IR SOLENID

OPERATED 0 VALVE

'AVIR S

OPEATE

I ~-#---( AIR SUPPLYI

I ~VALVE I

LOCATION

Figure 3.9 -Simplified Schemati.- Diagram of the Control Circ~uit of a Solenoid Valve

Thait dperates an Air-Operated-Valve,_

i
a grounding, when a conductir contacts another grounded

conductor, the outcome is the same as circuit disjunction. When two not-grounded wires contact each other,

the outcome would depend on their positiori in the

circuit. The possibi lity of secondary fires is a

different situation and may also be important. It is

discussed further in Chapter 4.

*Open Circuit" .is; the -dominant failure mode.

because all- conductors -w-ill- eventually contact the

grounded cable tray. The 'Hot Short* cannot exist with

grounded wires'. Therefore, it will eventually lead to

O0pen Circuit" as more insulation decom~pose or melt

away. However, the outcome of a *hot short,"m (e.g.,

energization of the motor operator of a valve) may not

be reverzed because, some circuits are designed such

that the command signal *Is locked into the circuit and

another signal is necessary to reverse the action.

3.5.2.2 Cable Failure Frequency

Fire exposure can be translated as heat.-flux to

the cable by radiation and convection. Depending on

its position with respect to the fire, one or the other

becomes important. In both cases, some heat 'flux would

be impinging on the cable surfac'e and its overall temperature would be rising from its preaccident level.

Certainly, the temperature distribution within the

cable would not be uniform. The outer surface would be

107
very hot and the inner section would be cooler because

the copper conductor would conduct the heat away to the

cooler parts of the cable. Beyon~d a certain temperature level, the materials will change state or decompose chemically. Thus, as certain seczxons of the

cable reaci, this threshold temperature, they will

experie ice drastic phiysical chan~ges. abedamage

starts Pt$- this ,poi-nt-. ..-RowKev-ert- cýircuit fail ure would

be de ldyed, dependingj on the shape arnd characteristics

of the cablE~s. For e~xample, the jacket may' be damaged

but the insul,,tor would 6till te in functional form~.

The exact modeling of these processes involves very

complex formulations and its solution could be

extremely time consuming if not impossible.

Severn3. parameters are very important in thesi.

processes; these are: impinging heat flux, heat

losses, threshold temperature for failure, materilz1

behavio~r ut high temperatures, and time (to allow the

termpý,- ature to rise due to the heat flux).-.The cable

failure time is a function of these parameters and the

direction of dependence is quite obvious. For example,

under higher heat fluxes, time to failure should become

shorter. We call these parareters impact parameters.

In the preceding subsection, we identified two

failure mouev--open circuit and hot short--and we

concluded that the latter eventually leads to the

108
former if the cables continue deteriorating. These

.arguments imply that there should be three frequencies:

(1) the frequency of cable failure given that it is

exposed to flames, (2) the fraction of these failures

that lead to a certain failure mode, and (3) the

duration of the failure mode. in this subsection, we

concentrate on the first fr 'equency.-

Many cbeir etbae-beowpelfo 'd by the

manufacturers, utilities, and regulatory bodies. Their

results are summasrized, In Appendix E. In almost all

tests, cable failure time is recorded and very few have

reported the impinging heat flux or cable temperature.

The cable failure time can be easily incorporated into

our model for fire growth and -7omponent failure. 'The

following observations summar! ~e our state of knowledg~e

about cable failure time:

*In reported cable fire tests, the failure t~me

ranged from 1.0 to 20.0 riinu~tes and, in tiome

cases, failure did not occur. .In Appendix E,

we give further details on these test results.

* Most of the cables failed between 5 and

10 minutes.

*In many instances, different fire tests (not

necessarily cable fire tests) have resulted in

contradictory conclusions.

109
e The cable fire tests performed so far have only

modeled limited variations of fire incidence

cLnaracteristics.

The last two observations imply that simple

statistical manipulations of the data may yield

incorrect results because, they may well be representting ony a limited set.ffr seais Furthermore, the time tor falr--r esre~r themoment the cablei' wereti mimer edin the flames. However, in the case of a growing fire, a cable may

be partially deteriortated due to the Impinging heat

fluxes before the flames have reached it. This

introduces a degree of fuzziness In the exact definition of failure time because# ultimately, the time

between component failure and fire ignition should be

obtained. Because of these two limitations, we choose

to use the growth period to represent-",the time betweeni

ignition and 7~able failure. The result Is certainly

conservative.

3.5.'2.3 Relative Frequencies of the Failure Modes

OHot shorts" are very specific failure modes

because they require very specific sets of events. For

example, we saw that,, In Figure 3.9,-wires A and 9 should

contact each other to cause this type of failure.

Also, frequency of this event depends on their location

relative to each other. They could be In separate

110
cables or in a multiconductor cable. The number of

wires in the ldtter is Importanit also (see Figure 3.8).

For example, the relative frequency should be large for

a two-conductor cable when compared to a sevenconductor one because, for the latter, conductors from

other circuits may cause other effects.

Data on *hot shortt are very sketchy. In the.

.-.Browns Ferry fire incident ,,1ýýsome.-aystems- ti.- (ma4inl y

ECCS) started spur iousl-y'- inh the- first' half hour.

However, the fraction of cables that led to this is not

known. Another source is the cable fire tests (see

Appene~x E for a discussion on these tests). In some

bonfire tests, the cables were hung over a burning

bucket of oil (as compared to laying them on a cable

tray). Shorting of the conductors was observed

extensively; however, circuit disjointment rarely

occurred. This shows that there is a significant frequency (on the order of 0.1 or larger) that wires In

a mul-ticonductor cable would contact one another before

touching the grounded tray. However, since only specific wires can form a 'hot short," then Its frequency

Muust be lover and must depen~d on the relative position

of the wires concerned. For a multiconductor cable that

contains both of the wires, we judge that the frequency

Is-less than 0.2. We express our state of knowledge

ill
iancertainty by a lognormal distribution with the 5th and

95th percentiles at 0.01 and 0.2.

The characteristic values are:

Q5- 0.01, "J50 - 0.045P 09 5 -0.20

PQ- 0.068.

The relative frequency of open circuit is the

complement of the frequency of 'hot short.* The

-character istic val uet.-are: ---

05-10.80, Q50 0-"'S Q 5i09

ag- 0.932.

3.5.2.4 Duration of a Failure Mode

As mentioned earlier, *open circuit* is the

dominant failure made and, when occurred, would not

change (most probably) into other failures. However,

further deterioration of the'A'nsulating materials would

cause the hot shorts to become open circuits. In the

Browns Ferry incident, the spurious signals occurred

mainly In the first half hour. We believe that the

time for *hot short* loading to "open circuit" is

distributed normally with 5th and 95th percentiles at

5 and 35 minutes.

Example - Termination of Small LOCA

In Section 2.2.70, It-is found that a small LOCA

may occur due to the spurious opening of two airoperated valves. These valves are designed to faill

closed. This means that upon loss of air pros-sure,

112
they transfer to the closed position., This is also the

deenergized position of the solenoid valve. The latter

would eventually occur due to *hot shortsw turning into

*open circuits.' Thus, the small LOCA will terminate

(almost certainly) within 40 minutes of Its occurrence.

No severe consequences can occur within this time

period,-even if all of the cooling systems become

unavailable.

3.5.3 Other Componen-ts'lInstrumentation and control circulis usually

consist of -electronic coniponents (such, as amplifiers

and bistables), small transformers, and relays. They

are grouped together because %',hey are normally found In

the same location Inside metal cabinets. The behavior

of the electronic components changes with 'temperature.

Some circuits may be designed such that these changes

are compensated. Thus, the effect, of temperature on

solid state devices d epends on their. components and

circuit design. The typical operating temperature is

about 38*C (1000F) and th~y can withstand a temperature

rise of up to about 1250C (26C.) (46). It has been

observed that their failure rate increas es dramatically

with temperature 147) and the Instrumentation circuits

drift considerably, thus giving erroneous Information

to the control room operators.

The effect of fire on this type of electrica:.

113
components can be modeled by co ponent temperature

level. The time element of 'the heating process is no')-

included because, in Reference 33, it is found that, for

components Inside a metal cabinet end a fire outside

the cabinet, the component temperature rises to an

equilibrium.

Unlike electrical cables, we do not have any fire

test results for this type of electrical components. In

the first paragraph of this subsectioni, we have

summarized the P~vailable Inf-qrmation.

By electrical equipment we mean such items as

pumps and valves that need electrical power to perform

their function. Their failure mechanism is very

similar to cables because It Involves insulation

deterioration. The power cables to this equipment are

its weakest part. These cables are usually run In

metal conduits when they leave a cable tray and meet

the component. The power cable would fail before the

internals of the component because the conduit would

act like an oven and expedite the failure process.

Pipes are generally filled with water; therefore,

they would not fail due to a fire because of the large

heat sink that water provides. Dry pipes are likely to

fail If they become exposed to flames for a long time.

114
3.5.4 Effects of Extinguishing Agents on Component

Availability

The only extinguishing agent that may interfere

with the operation of a component is water. Its

electrical conductivity is the main source of'trouble.

Halon and C02 ate in gas form and most likely would not

interfere with component operation except, for such

equipment as the diesel generatcors that need air for

normal operation.

Application of water on cable fires has been discussed extensively in Reference 48. Based on the

information given In that source, we make the following

conservative judgments:

(1) If a cable Iis affected by the flames, then

cable failure due to water application is a

certainty.

(2) The relative frequency of experiencing a "hot

short' or an Oopen circuit* is the same as that

give~n in Section 3.5.2.3

(3) The duration of failure Is infinite for both

failure modes. That Is, *hot shorts* would

not turn Into *open circuits* because the

Insulation would stop deteriorating after

exting uishment.

115
(4) If a cable is intact (i.e., the flames have

not affected it yet), water would not have

any Impact on its operation. Splices may be

susceptible to water but .th~is failure mode

would not have a significant contribution

because only bad splices would fail. Usually,

there are very f ew spl ices along a cable

tray.

Susceptibility of the electrical equipment to

water spray depends on its design. -Electrical motors

can fail; however, they could be encased in a manner

such that water cannot reach them. Transformers are

similar to motors. Switchgear and motor control centers are highly susceptible to water. The cabinets

in which they are located usually have waterproof

features.

3.5.5 Smoke Damage

The extent of smoke damage depends on.,the burning

material, For example, burning PVC cables emit

chloride acid which is extremely corrosive. in one

fire Incident 149], a cable fire caused extensive damage

to relays and switchgear about 40 feet away from the

combustion zone. We believe that the impa ct. of. smoke

would not fail components within the first few hours

after the fire Incident. Thus, they do not pose an

immediate threat to plant safety. However, Its impact

116
on operator effectiveness is crucial and should be

addressed separately.

3.6 Frequency of a Sequence of Events

In this section, we propose formulations for the

frequency of severe consequence Is due to fires. A model

is suggest ed for evaluating the fraction of fires that

could propagate'and fail components. Some parameters In

both models have not been quantified yet. We have

included them for the sake of completeness and to show

how they fit into the overall picture..

The frequency of a sequence of events, #S, can be

written as the product of three frequencies: the frequency of fire occurrence, 0.; the conditional frequency of fires failing part of the sequence given

that a fire has occurred,#/; and the frequency of

occu~rrence of the remaining events of the sequence due

to other causes, Oo. The mathematical expression would

be

(3. 26)

$ F S/F 0

The quantification of the latter (i.e.,0 ) is extensively

discussed In studies such as References 13 and 14. The

first frequency (e.*)was discussed in Section 3.2

and the second one (i&e.D#5/7) is analyzed here.

Two competing phenomena determine the fraction

(frequency) of fires that would cause ai sequence of

117
events (or part of It). These are, on the one hand,

fire growth and component f~iilure 'processes and, on the

other hand, fire detection and suppression. We call the

latter fire duration. If the first one occurs sooner

than the other one, then the sequence would-materialize.

Thus, we model these processes in terms of their

governing time periods, i.e., component failure period,

detection period, etc. In the scenarios of Chapter 2,

we found that a fire may cause some portion or the whole

seqL'ence of events. in the rest of this section, we

refer to both as "sequence of eventr'. or "sequenc e."

we .define the component failure time, TiG as the

time after Ignition when component i fails and TGF as

the time after ignition that the sequence occurs. The

latter occurs when the last component of the sequence

fails. We can write:

TGF all components j GO4F 3.6

of the sequence

Define Tr as the time to failure measured from the time

the flames reach the component. The growth period is

given In terms of the time It takes for fla~mes to reach

component Ip TG, after Ignition. Then Tar can be

written as:

Ti a i +4i(.7 TGF a GF +T.(.7

lie
The fire duration,. TFD. Is the time from ignitior.

to final extinguishment and is the sum of three time

periods: detection (TD),. application (TA)" and

suppression (TS). Detection period is the time that It

takes for the personnel to become aware of the fire.

The application period is defined as. the time between

detection and inception of extinguishment efforts. The

suppression period is obviously the time that it takes

to put out the fire after exposing it to anextinguishing agent. Thus, we can w rite:

TFD MTD + TA + TS. (3.28)

Certainly, these are dependent random vari abics and

have the fire growth characteristics as the common

denominator.

The sequence of events only exists when TGF <TFD.

Thus, the frequency that we are Introested In:,

* -/ fr4 equence IFire) (3.29)

fr (T G - TFD " ).

To quantify this frequency, we need to have detailed

information about each vari'ble. That is, their

statistical variations should be known. From the

available data In most parts# we get the mean values

for these time periods and we assume that the fire

119
duration is distributed exponentially with mean TFD*

This implies that the frequency of extinguishing the

f ire within the time period t' - t, given that it is'

not extinguished by the. time t, is independent of t.

The available data (see Section 3.4.4) doas not contradict with this assumption.

The fraction of fires that propagate and lead to

the sequence is equal to the frequency of fire duration

exceeding the time to sequence occurrence. For the

latter, we use the mean time, T GF' thus ignpring the

statistical variations in the component failur'e and

fire growth processes. We can write:

'OI exp rGF )(3 .30)

Equation (3.30) 1-, derived for components such as

cables whose failure is modeled in terms of mean time

to failure. In the following exam~ple, we Illustrate an

&pplication of a simplified versio'n of the proposed

model.

Example -Inner and Outer Cable Spreadlnc, Rooms of

the Zion Station

In the example of Section 3.3, we found i repreresentative case for fire growth analysis. Accordingj

to that case,, if two cable trays In two certain areas

(areas Y and 2 of Figure 3.4) within these rooms become

engulfed in a fire, a transient would occur and the

120
power cables to botn charging Pumps, both motor-driven

auxiliary feedwater pumps, the control cables of all

containment fan coolers, and two of the three

conta.-itnent spray pump trains would be affected. In

Table 2.1, we find several scenarios for the Cable

spreading rooms. We can see that part of Scenario

No. 8 agrees with the above list. The turbine-driven

aux~il~iary feedwater pump, the PORVS, the SI pumps, and

one containment spray train may remain unaf fLcted.:-

However, operator action during the course of the

transient is very important because the information on

the control board may become severely affected by the

.fire. in our scenario analysis, we did not look !nto

the instrumentation and control cables Their failure

may cause conflicting or erroneous information on the

controI board. We conclude that the unavailability of

these components, physically unaffected by the fire,.

may be dominated by human 'error. The only exception

here is the turbine-driven auxiliary feedwater pump

that would certainly start upon cable fail-ure, even it

the operators had interfered with its operation

originally. For this, we conclude that for core melt

to occur the turbine-driven pump should be unavailable

during the fire incident. If the unaffected containment spray pump tr.An rema~ns available, then the

containment event tree entry st3te G would result

121
because all of the fa n coolers would be failed by the

f ire. Then, 'Equation- 3.25 should be modified to

G OF OS/FP0HE TD (3.31)

where

OHE =the unavalilability of the unaffected

- componets !due- to other causes, exceptfor the turbi-ne-driven auxiliary

feedwater pump,

#TD -the unavailability of the turbine-driven

auxiliary feedwater ,,imp due to all

causes.

Equation' (3.30) should be used for *S/F* First,

we eva'uate T GF from Equation (3.27). TI re is only

one growth period, rG, for all of the cables be iuse of

the way the representative case is d'efined. Then we

define

G G (3.32)

and its distribution is plotted in Figure 3.7.

Table 3.6 gives the histogram that has been derived

from this distribution. For mean time to cable

failure, we conservatively assume that

-0, for all i. (3.33)

122
Table 3.6 Histogram~ Derived from Figure 3.7

f6 or ire 'Growth 'to -Second Division----,

123
Then,

7,GF= TG (334)

The average fire duration (TrFD) is evaluated in the

example of Section 3.4.5 and it is presented in

Table 3.5.

Now we have all the information necessary for

Equation (3.30). The histog~ram of Table 3.7 is the

reutof"-applyi~ng' -the t-wo -histog rams of Table 3-i5 and . ... -. - %7

3008 to that equation.' It depicts our uncertainty ab'6ut

O/tthe fraction of fires that would cause a

transient and fail the power cables to both charging

pumips, both motor-driven auxiliary feedwater pumps, the

control cables to all fan coolers, and two out of the

three containmient spray pump trains.

The availability of the remaining mitigating

components due to human error (as a consequence to the

control board response to the cable fire) is judgmentally assessed. We believe that Okis lognormally distributed with a medium of 10-2 and an

error factor of 10. The unavailability of the turbinedriven pump, #TD' is found in Reference 2. It is also

lognormally distributed with a mean of 5.8 x 102and

variance of 7.3 x 10-5. The frequency of cable

spreading room fires, #F, is given In Table 3.2. We

multiply these four histograms in two steps. First, we.

multiply the first three to get the conditional

124
Table 3.7. Histogram for the Frequency

~o~F~al~iffirtofa Squ~ence of Events

due to Fire in the Cat, le Spreading Rooms

Frequency Probability Cumulative

(* ) Probability

< 0-6 0.156 0.156

4.5xl1 5 0.102 0.258

1.9x10-3 0.116 0.374

9.7x10-3 0.094 0.468

5.9x10-2 0.100 0.568

0.14 0..094 0.662

0.17 0.118 0.780

0.48 0.149 0.930

0.76 0.070. 1.00

125
frequency of sequence occurrence given that a fire has

occurred. The result is shown in Table 3.8. This Is

then miultiplied with the frequency of fires and the

unconditional frequency of sequence occurrence is

obtained. The result is presented by Table 3.9.

126
Table 3.8 Histogram for the Conditional Frequency

of (Containment Event Tree) Entry State G

Given a Fire in the Cable Spreading Rooms

Frequency Probability cumulative

Probability

(10 -1 0.050 0.050

3.4xl10 1 0 0.103 0.153

5.6x10 8 0.115 0.268

1.2x10-6 0.101 0.369

7.8x10 6 0.119 0.488

2.8x10-5 0.103 0.591

7.9x10-5 , 0.107 0.698

l.8x10 4 0.118 0-815

5.lx 10-4 0.112 0 ..927

2.3xl10 3 0.073 ý1.000

127
Table 3.9 Histogram for the Frequency

Due to a Fire in the Cable Spreading

of State G

Rooms

.Fre uency Probabi lit' Cumnulative.-.-

(ry )Probability

<10-10 0.160 0.160

4.3xl10 1 0 0.108 0.268

8.3x10-9 0.109 0.377

4.5x10-8 0.101 0.478

1.5x3.0 7 0.111 0.589

4.6xl10 7 0.119 0.708

1.2xl10 6 0.107 0.815

3.5x1-6 * 0.111 0.926

1.7xl10 5 I 0.074 1.00

128
S.- 0 a

4. CONCLUDING REMARKS

A method for, assessing the frequency of radionuclide release from nuclear power plants due to fires

is described *In this report. Special attention is

given to simplicity and expressing. the uncertainties In

all parts of the methodology. Similar to all other

methodologies used In probabilistic risk assessment

studies,. we f~irst ýidentif~y a .ik.Ist of- accident

scenarios and. then quantify them. A scenario in this

case Includes the location of the fire, the. time

history of the fire (i.e.# growth# detection, and

suppression), the components that the fire can affect,

and other components such that their simultaneoiis

failure would cause an Initiating event and lead to

radionuclide release.

In Section 1.2, we have summarized the methodology

in' six steps and we have further expanded them in

Sections 2.3.1 and 3.1. The objective in defining

these steps was to show how th e different parts-of the

methodology relate to each. other. Certainly, not all

paths of Interaction are Identified. There Is a

potential for improving on our suggested steps and

defining an algorithm of a more wechanistic nature. In

this chapter, we first present oiar conclusions from

this study and then giv~e a general discussions about the

methodoloqy. The factors leading to conservatisms and

129
nonconservat~isms, and areas for future work are highlighted.

.The element of time is an important factor in

scveral parts of this methodology. In one example

where system failures were considered, the recirculation system is called upon several hours after fire

ignition. Thus, it is very likely that the fire, wo~uld

be out by then and the systemn would be restored (if it

i s af f ectedb the-1 4ie) .n:the quant if Ica t ion o f

fire-induced failures, time is an integral part of the

model. The component failures and fire suppression are

two competing, time-dependent phenomena. If the suppression time surpasses the failure time# then component failure is imminent.

A fire risk study is extremely plant specific.

For example, In the cable spreading room of the Zion

station, w( concentrated on the exact location of

certain cables (Figure 3.4). This plant specificity can be partially attributed'to -the fact that a

fire risk study Is a locatioi,-dependent event analysis.

Although there Is a large similarity among the same

type of plants (e~g., PWRs) there are still large

differences In plant layouts.

in the examples that we have discussed '- this

study, human error plays an Important role. In some

scRnarios, human actions at the component location are

130
crucial and In some other scenarios, some component

failures are attributed to human error from the control

room due to inaccurate information on the control board

(caused by the fire).

In Chapter 2 we have used simplified event trees

for event sequences and have analyzed the systems

related to each event in terms of their major components. This is in contrast with other parts of

probabilistic. ,rii;-1c *-isse;3smi.nt studies -where detailed

event trees and fault trees are used. Several computer

codes have been developed to analyze fault trees in the

context of common cause events (501. They stop short

of identifying multiple common cause events and carryIng the results further into the event tree sequences.

A simple extrapolation of these algorithms can give us

our desired results. However, the volume and time

necessa ry to carry out this task may become limiting

factors. We certainly need the detailed event trees

and, fault trees to clearly understand. the workings of

the power plant as a whole and the individual systems.

However, the merits of directly using these tr~eks In

the fire risk analysis needs examination.

in Identifying the scenarios, we inspected each

compartment In the plant to see how a f ire there could,.

lead to radionuclide release. To limit the scope of

the task', we chose for Inspection those compartments

131
that contained safety-related items. The other areas

were not inspected based on the premise that components

necessinj for safe shutdown are not affected. If this

assumption is not valid, it certainly would introduce

nonconsturvatism to the results. This point needs

further investigation.

Another source of nonconserv~atism lies in the

definition' of a compartment. We did not investigate

the possibility "of. failinig the ~barriers that enclose a

compartment. These barriers are penetration seals,

walls, doors, etc.

There are several other sources of nonconservatism related to fire incidents that we have

not included In this study. These are: smoke propagation, extremely large fires, secondary fires, flooding due to water type fire extinguishing systems, and

fires due to earthquakes. The impact 'oo smoke on the

availability of equipment may not have short term

impact. However, it can certainly reduce the effectiventss of the operators In fire fighting In

manipulating components locally and, more Importantly,

in the control room.

The only source for extremely large fires Is oilstored in large amounts. In most cases, the oil is

located in areas where safety-related Items are not

Installed. However, It may affect those items by

132
failing fire barriers, a subject that has not been

addressed here. Another source Is an aircraft crash or

other large external fires.

The secondary f ires may be caused by shorts in

electrical circuits. For example, if. two wires of a

circuit short across a load, then the resulting high

current may cause overheating of the other loads In

other locations. Flooding cap o~ccur only due to wate~r

type suppression systems and Inadequate drainage systems. Earthquakes may cause fires through electrical

components or flammable liquid. This aspect of fire

enalysis should be performed within the context of an

earthquake risk analysis.

The quantification process of a scenario is

divided into three basic elements: the frequency of

fire occurrence in a compartment, the conditional

frequency of component failures g~iven the fire, and the

frequency of component failure due to causes other than

the direct Impact of the fire. The first frequency-has

been assessed, based on statisticz on fire Incidents,

independently from the other two conditional frequencies.

Furthermore, these frequencies of fire occurrence are

derived from evidence'collected from all United States

nuclear power generating stations. They are average

frequencies and do not nocessarily reflect the conditions of a specific power plant. For example, It Is

133
debatable whether the inclusion of some actual fire

occurrences, e.g., the Browns Ferry fire, is appropriate

when the cable spread,*ng room of a specific plant is

being analyzed.

The 1a,!k of a quantitaitive measure for the magnitude of fire is another limiting factor in any fire.

risk analysis. It has raised the most difficulties in

the development of the quantification parts of t'..is

methodology. We have used qualitative arguments to

relay our understanding about the spectrum of fire's

that are covered by the frequencies derived in

Section 3.2. If such a measure could be defined, the

exponential model that was used in Section 3.6 could be

replaced with a more sophisticated model. Then, an

integral equation could be defined wherein the above

defined product of the three frequencies could be

integrated over all tire severities.

The evaluation of the conditional frequency of

component failures given that a fire has occurred

involved f ire propagation, detection, suppression, and

component failure. our treatment of these factors Is

very crude. We modeled them by their duration and

combined these time periods In an exponential distribution to obtain the desired conditional frequency. it

Is not clear If the choice of an exponential distribution Is conservative in this case. However, we took

1 34
However, we took other conservative measures such as

the assumption of cable failure upon iqnition.

Certainly, further research is needed concerning all

four factor's (i.e., propagation-, detectiort, etc.).

More information about the first three (i.e.,

propagation, detection, and suppression) will allow us

to better model the interaction between propagation and

suppression.

The failure mode-, of some components~ may~be different when exposed *o fires than in normal usage. For

relays and switchgear, their susceptibility and fai~u're

modes when exposed to f _'res is not clear. In some cases

similar to cables, their failure mode may depend on

their specif ic applications and circuit configuration.

We have found it very important to clearly de'fine the

behavior of some of the components. -For example, in

the cable spreading room fire, we assume that the cor1-

trol board indicators misinform the operators. because

of cable failures. However, we do not elaborate on

exactly how this misinformation ir, produced.

The examples used In this study have focused'only

on PWRs. There are differences among different facility types. However, we believe that the methodology

has general applicability.

135
REFERENCES

1.U.S. Nuclear Re,7ulatory Commissi a~, Reactor

Safety Study: Ana Assessment of Acc .erl Risks in

U.S. Commercial Nuclear Power Plants,* -A.SH-l4Oc0

(Nt2REG-75/).1) 1, October 1975.

2 Kazarians, M., and Apostolaki-s G. 'Oni Fire

Hazard in 'Nuclear Power Plants,', Nuci. Eng. Des. 4-/,

157-3 6G (1978)

3'. Regulatory Investigation Report its Fire in Cable

Spreading Room~ and Rerctor Builcing on March 22,

'975 at Browns Ferry Units 1 and 2, (July 25,

4. U.S. Nuclear Regulatory Commission, Special Review

Group, "Recommendations Rlelated to Browns Ferry

Fire, '(NLREG-0050, 1976.

5. U.S. Nuclear Regulatory Commission, "Analysis. of

Comments on the D'raft WASH-1400 Report,' Appendix XI,

WASH-1400 (NUREG-75/C14), October 1975.

6. U.S. Nuclear Regulatory Commission, OGuidelines for

Fire Protection for Nuclear Power Plaits,o ýAppendix A,

APCSB 9.5.1, August 23, 1976..

7. Attachment I to letter f rom D. L. Peoples to

H. R. Denton of thf- U.S. Nuclear Regulatory Commission,

Commonwealth Edison Company, April 30, 1980.

8. 'Clinch River Breeder Reac.,- Risk Pssessment Study,'

CRBRP-l, March 1977.

9.HTGR Accident Initietion and Progressi .;,'Anal ysis'

ERDA Report, GA-A13617, November 1975 and DOE Report

GA-A15000, April 1978.

10. Fleming, K. N., Houghton, W. T. and Scaletta, F. P.

'A Methodology for Risk Assessment of Major Fires and

its Application to an HTGR Plant,' G?-A15402, General

Atomic Company, 1979.

11. Ilockeribury, R. W., and Yeater, M. L. ODevelopment and

Testing~ of a Model for Fire Potential in Nuclear Power

P",,ants,' NUREG/CR-1819,, XA,RC, U.S. Nuclear Regultory

commission, November 1980.

136r
IL~. Gallucci, R. H. V., "A methodology for Evaluating the

Probability for Fire Loss of Nuclear Power Plan~t

Safety Functions,f A Doctoral Dissertation, Rtenssellaer

Polytechnic Institute, Troy, New York, May 1980.

13. "Probabilistic Safety Study,, Zion 1 and 20 to be

published by Pickard, Lowe and Garrick, Inc., Irvine,

California and Cormmcnwealth Edison Inc., Chicago,

1981.

14. l~ndian Point 2 and 3 Probabilistic Safety Study* to

be publishec' by Pickard, Lowe and Garrick, Inc.,

Irvine, Cal~fornia, Consolidated Edison of Ne w

York, InL., and The Power Authority of the State of

New York, 1981.

15. U.S. Nuclear Regulatory Commission. OReactor Safety,

Study," Appendix It WASH-1400 (NUREG-75/014), October

1975.

16. Bley, D. C., Pick ard, Lowe and Garrick, Inc., personal

communication, 1981.

17. Fire Protection Evaluation Reports produced by

Utilities in response to Nuclear RZ-Oblatory Commission

request. For example, see Reference 18.

18. Zion Station Fire Protection Report, Commonwealth

Edison Company, Chicago, April 1977.

19. Lindley, D. V., Introduction to Probability and

Statistics from a Bayesi~an-Viewpoint: Part 2.

Inference, Cumbridge University Press, 1970.

20. Apostolakis, G., "Prcy: ibility and Risk Assessment:

The Subjectivistic Viewpoint and Some Suggestions,

Nuclear Safety# 19, 305-315, 1978.

21. Buckley, 3. L., et al, OEvaluation 'of Fire *Hazards in

Nuclear Power Generating Stations,' Factory Mutual

Research, P14RC Serial No. 22512,' May 1976.

22. Sideris, A. G.,, Hockenbury, R. W.,, Ysater, 1. L., and

Vesely, W. E., ONuclear Plant Fire incident Data

File,' Nuclear Safety, 20, 308-317, 1979.

23. Hockenbury, R. W. and Yeater, M1. L., wDevelopment and

Testing of a Model for Fire Potent'ial In Nuclear Power

Plants,' Progress 'qeport to USNRC,, Renssellaer

Polytechnic institute, 1978.

137
24. Nuclear News, 23, 80-85, 1980.

25. Final Safety Analysis Report, a report filed at

Nuclear Regulatory Commission by utilities for each

nuclear power plant.

26. Apostolakis, G., and Kazarians, M. "Frequency of

Fires in Light Water Reactor Compartments,,' CONF800403/V-I, Proceedings of American Nuclear Society,

Knoxville, Te-nnessee, April 6-9, 1980.

27. IMSL Library 1, Reference Manual Vol. 1 and 2,

International Mathematical and Statistical Libraries,

Inc., IMSL. LT8l-0005.

28. Mosleh, A., and Apostolakis, G. *Some Properties of

Distributions Useful In the Study of Rare Events,* to

be published in IEEE Tr~nsiactions on Reliability.

29. Selby, S. M. (editor), Standard Mathematical Tables,

23rd edition, CRC Press Inc.# Clevelandg, Ohio, 1975.

30. Mann, N. R., Schafer, R. E. and Singpurwalla, N. D.

Methods for Statistical Analysis of Reliability and

Life Data, John Wile-y & Sons, Inc., New York, 1974.

31. wFire Protection Action Plan; Status Summary Report,'

U.S. Nuclear Regulatory Commission, October 31, 1977.

32. Green, A. E., and Botirne, A. 3. Reliability TechnolM Wiley-Interacience, 1972.

33. Siu, N. 0., OProbablistic Models of Compartment

Fires,* UCLA-ENG-8090, University of California, Los

Angeles, 1981.

34. Bhatia, P., *Silicone-Rubber-Insulated Cables for

Calvert Cliffs Nuclear Power Plant," Nuclear Safet, 16,

No. 6, 1975.

35. *Review of the Indian Point Station Fire Protection

Program,' Rev. 1 Consolidated Edison Company of New

York ard Power Authority of the State of New York,

April 1977.

36. tfire Protection Hand book, 14 Ed.,, National Fire

Protection Association# Boston, Massachusetts,

1976.

37. Jensen, P., Fire Protection for the Design Professional, Cahners -book-s, MaS-sachusetts, 1975.

138
38. Cholin, R.. R., 'Reappraising Early Warning Detection,'

Fire Journal., March 1975.

39. Solomon, E. E. and Reiss, M. H. *The Requirements

and Design for Combined Ionizat.ion/Photoelectric

Smoke Detectors," Fire Journal, September 1979.

40. Berry, D. L., "Nuclear Pcwer Plant Protection Fire

Detec~tion (Subsystems Study Task 2),'

NUREG/CR-0488, SAN4D 78-1373, Sandia Laboratories,

March 1979.

41. Alpert, R. L., 'Calculation of Response Time of

Ceiling-Mounted Fire Detectors,' Fire Technology,~

No. 3 # 1972.

42. Mays, G. T., 'Browns Ferry Charcoal Adsorber Incident.,8 Nuclear Safety Vol 20, No. 1, January/

February 179,pp. %82.

43. Miller, M. J., 'Risk Management and Reliability,'

presented at Third International System Safety.

Conference, Washington, D. C., October 17-21, 1977.

44. Marryattj, H. W.j, Fire-Automatic Sprinkler Performance in Australia and New Ze-aland, 1886-19687

Australian Fire Prot-ectlon Association, Melbourne,

1971.

45. Mioeling, D. S., Sideris, A. G. and Hockenbury, R. W.

"Reliability of Fire Protection Systemvs in

Nuclear Power Plants.' CONF-80004O3ý-,V-I, Proceedings

of American Nuclear Societ, Knoxville, Tennessee,

April 6_-T,_1980.

46. Harper, Handbook of Components for Electronics,

McGraw Hill-,1977.

47. OMilitary Standardization Handbook', MIL-HDBK-217C,

Department of Defense, April 1979.

48. *Water as a Means of Cable Fire Protection and

optional Effects Experience,' EPRI NP-1193, TPS 77-

745, EPRI, Palo Alto, California, October 1979.

49. LaFetra, F. E. and McGowan, E. 1. 'Power, Control,

and Instruuentation Cable for Nuclear Fueled Power

Plants," IEEE Ta1insactions on Nuclear Science,

Vol. NS21 No. 1, February 1974.

139
50. Rasmuson, D. M., et al, "Comrcan II-A, A Computer

Program for Automated Common Cause Failure

Analysis," EG&G Idaho, Inc., Idaho Falls, Idaho,

TREE-1361, May 1979.

.14n
APPENDIX A - FIRE INCIDENCE DATA

The details of the data used in different parts

this study are given In this appendix. The two main

sources are References A.1 and A.2 which are discussed

individually in the following sections. Both references offer more Information than what is discussed

here. In both cases, only the U.S. nuclear experience

is collected.

A.1 Data from American Nuclear Insurers

The American Nuclear Insurers. (ANI), in conjunction with the Rensselaer Polytechnic Institute, have

organized a data file system where information about

fire incidents In nuclear power plants is stored. most

of their data come from reports of Insurance inspectors which contain location, cause, combustibles, means

of detection, and extinguishment of fA~xe. The financial loss and plant status are also reported. Their

other sources are the U.S. Nuclear Reg'ulatory Commission and local government regulatory bodies. The

insurance reports contain more information because they

also include less severe fires than the regulatory

records.

The period of January 1955 through May 1978 Is

covered by the data. A total of 214 incidents In all

types of facilities (including nonpower generzeting

141
facilities) are reported. of these, 158,occurred in

commercial nuclear power plants.

Our main interest is in fire Incidents during

commercial operation of light water reac~tors. *Table 13

of jAeference A.1 is very close to what we need. it

gives statistics on different aspe-.ts of fire incidents

during the operational phases of all types of nuclear

facilities. Table A.2 shows one part of Table 13 of

that report. Table A.1 provides the number of fires

duriig di~fferent operational modes and facility-types..

The fikqt column covers all facility types and comes

f rom Table 13 of the Ak4I report. The next three

'columns come from Tables 14 and 15 of the same report.

In these tables (similar to Table 13), fire Incident

statistics are given for the two types of LWRs, that

is, pressurized water reactors and boiling water

reactors. However, in both cases, aJa, phases of

plant life are covered.

The data m~y have some omissions. The a uthors of

that report acknowledge this. We quote (page 8):- sit

must be indicated that the data .. contains certain

errors or omissions.*

In the following discussion, the data used in

Section 3.2 4.s derivad from Table A.2. 'All facility.-

types are Included Inx that table whereas, In

Section 3.2., we present the results as thoughi they are

142
Table A.1 - Number of Fires and Plant Status

All Light Water Pressurized Boiling

Types Nuiclear Water Water

Of Generating Reactors Jleactors

Facilities Plants

Normal

Operation 42 40 21 19

Hot Shutdown 2 2 2. 0

Cold Shutdown 1 0 0 0

Refueling or

Extended

Outage 3 1 0 1

TOTAL 48 43 23 20

143
Table A.2 - Number of Fires arnd Location

of Fires in Nuclear Facilities of all Types

m -

.Location No. of Fires

Containment1

Reactor Building 6

A-;xiliary Building 111)

Turbine Building 9,

Diesel Generator Room 1.0

Control Room1

Cable Spread ing Room 2.

R elay Room 2

Radwaste Building 1

Switch yard I

Warehouses 1

Temporary Building 1

Yard 1

Outside Structure -1

Offsi te 4

TOTAL 51

1.

144
specific to LWRs. our judgment is that this discrepancy does not have a large impact. and, in all cases,

it results In larger frequencies which are conservative. The following observation s support this concl Iusion:

e The total number of fires In Table A.2 is 51

and in Table A.l# we f Ind that the total number

of LWR fires during the operational phase is 43.

Thus, the difference Is not large and most of

the fires occurred at some LWR.

* other types of power plants (high temperature

gas-cooled reactors HTGRs and fast breeder

reactors, FBRs) have a small contribution to

the data. For all phases of plant life, there

are two and four cases for HTGRs and FBRs,

respectively.

*The areas for which frequencies are computed

In Section 3.2 are typical of power plants.

The number of fires used in Section 3.2 is derived

here by comparing those of Table A.2 with Tables 14

through 20 of the ANI report. Note that the latter

tables cover all phases of plant li fe, that is,, they

include the construction phase.

Control Room - only one case Is found In Table A.2.

There are zero cases In all nonLWR facilities. Therefore, this one case definitely occurred in an LWR.

145
However, it is not clear which type of LWR it was

because one is reported for each type (BWR and PWR) in

Tables 14 and 15 of the ANI report.

Cable Spreading Room -two cases are found in

Table A.2. Both occurred at LV!Rs because zero incidents are reported for al) other facilities. one of

the two occurred at a BWR. We believe that this one is

the Browns Ferry fire incident of March 1975. The

other occurred at a PWR.

Diesel Generator Room -Ten cases are found in

Table A.2. Th~re are zero cases in all nonLWR facilities. Six cases occurred at BWRs and four cases at

PW Rs. All LWR incidents are during commercial operation. This is expected because most of the diesel

fires occur during testing [A.31 which is periodically

performed during commercial operation.

Containment -Table A.2 gives one case in the

containment and six cases In the reactor building. We

judge that both mean the same thing, which is an area

where the reactor and some equipment necessary -for core

heat removal during normal operation are located.

Thus, we conclude that there were seven Incidents In

containments (or reactor buildings). Not all f them

occurred at LWRs. The following table shows the number

of Incidents in differen t facility types at all phases

of plant life.

3.46
1%

NUMBER OF FIRES

Facility Total Total Con- Reactor

Type All Commercial taininent Bldg.

Phases Operation

Educational/

Research 27 _____ --- 0 2

BWR 62 20 4 7

PWR 96 23 10 10

HTGR 2 0 1 1

FBR 4 3 01 2

Other 23 __ __ __ __ ___ __ __ ___ __

For the educational or research facilities, the

evidence is not conclusive because the number of fires

during the operational phase is not given. For the

HTGRs, we conclude that the two incidents did not occur

during commercial operation. Fo~r the FBR, at least one

of the two had occurred during this phase and there Is

a good chance that the other one was also during co mmercial operation. In light of the uncertainties about

the two incidents In the educational facilities and the

second incident in the FBR, we judge that two of the

seven fires occurred In nonLWR plants. Thus, five

fires have occurred in containments of LWRs.

Turbine Building - Table A.2 gives nine cases In

the turbine buildings. There were no fires reported in
facilities other than the LWRs, except for one case in

educational or research facilities., It is not clear at

which stage (construction or operation) this fire

occurred. Therefore, we use nine incidents in our

frequency calculations.

Auxiliary Building -In Table A.2 we find ten

fires reported in auxiliary buildings. There are no

fires reported in auxiliary buildings at facilities --

other than LWRi,. Thus, we use ten incidents in our

frequency calculations.

A.2 Data fror the HTGR Study

in a study of the risk to the public from an HTGR,

General Atomic Company collected data on~fire incidents

In nuc.lear power plants and used it in assessing the

contribution of these events to the overall risk. The

data came from Reference A.4 and is tabulated in

Reference A.2. We used their data In Section 3.2.5 to

check how the fire occurrence rate varies with time.

The data covers all LWR 'Incidents during commercial

operation, except for hydrogen explosions In the off-gas

systems. That is because these events are typical of

LWRs and would not occur in the HTGRs. The time period

that is covered by this data ends In May 1978. The

beginning of this time period is not well defined. in

Reference A.2. There a re no data points for the years

before 1968. We judge that It starts with the Inception

of nuclear power production in the United States.

14S
References

A.1l Siderif . A. G. , and D. C. Garlington, "Nuclear

Plant Fire Inciden~t Data Analysis," Ame~rican

Nuclenr Insurers, Farmnington, Connect icut (1978).

A.2 Fleming, K. N., W. T. Houghton, and F. Ir. Scaletta,

"A Methodology for Risk Assessment of Major Fires

and its Application to an HTGR Plant,"m GA-A15402,

General Atomic Company (19794).

A.3 Kazarians, M., and G. Apostalakis, "On the Fire

Hazard in Nuclear Power Plants," Nuclear

Ingineering and Design, 47, ).57-16P (11968).

A.4 Verna, B. J., "Nuclear-Power Experience, Inc.,

P. -0. Box 5,44, Encino, California (.available by

subscription).

149
APPENDIX B - CALCULATION OF COMPARTMENT YEARS

This appendix shows in de'Lail how we obtain the

number of years for the control rooms, the cable

spreading rooms, the diesel generators, the containments, the turbine buildings, and auxiliary buildings

in the light water nuclear generating plants of the

United States that were operating commercially by the

end of May 1978. The number of compartment years is

defined as the time period between the f irst day of

commercial operation and the end of May 1978 (or date

of decommission~ing). Table &;,.I gi~res a detailed

aCCOL.-' 'A the compartment years a~d number of the

above listed areas or compartments for every power

plant. Reference B.1 gives the date of first commercial operation. The number of compartmnent types

for L~ch plant is found In its Final Safe~ty Analysis

Report (FSARs--see Reference B.2).

The available information is not complete.

Therefore, the following assumptions are used during

the construction of Table B.1.

o in Reference B.1, the date of commercial

ope~ration is given in terms of the month and

the year; for example, 2/75 (i.e.,

February 1975). We assume that operation began

on the last day of that month. Thus, the

,compartment years listed in Table 8.1 are

150
smaller than the actual ones. The final result

is slightly conservative because it increases

the computed frequency of fires.

*In almost all multiunit plants, the operating

time of 'the units Is not the same. -This is

simply because they start commercial operation

at different dates For shared facilities (e.g.

control room, turbine building) the largest

number of years is assigned assuming that the

facility was completed when. the first Unit~went,

into commercial operation.

e Again, for multi...nlt plar...s, the age of the

oldest unit Is given to the first two diesel

generator rooms.

* Only two plan':s, Indian Point Unit I and

Humboldt Day, were decommissioned before

Ma y 19 5 In both cases, the date of decommissioning is assumed to be the last day of the

last month in which they generated electr ic ity..

Gray Books [8.31 were used for this purpose.

e Plants ot~jer than LW~s are not included in the

list. Consequently, the Shipping Port plant Ja

light water breeder reactor) and Hanford-N (a

light water-cooled, graphite moderated reactor)

art no' in Table 8.I.

151
0 In cases of inadequate information, two diesel

generators are assigned to the single unit

plants.

References

B.1 Nuclear News, 23,.,80-85 (1980)

B.2 F.,nal Safety Anal,.sis Report, a report filed at

the U.S. Nuclear Regulatory Commission by

utilities for each nuclear power plant.

B.3 "Operating Units Status Report, NUREG-0020,.

U. S. Nuclear Regulatory Commission.

152
TABLE 3. 1. OPERATING YEARS Oft SOIhE AREAS OF COMPARTMENTS IN LIC14T WATER REACTORS IN THE UINITE[D STATES AT THE END OF MAY, 1978.

a I

OU IAT N MBEFR AN11D OPERAA T 11.G Y EA RS OF THME ARItEA S

PLAINT MAKE 9 COnMERC1 CONTROL. POO SPREADINGs DIM~ GENER. CONTAINMENT TURBINE SLOG. AUXILIARY BLOG.

foco- O.OPERATING NO. JOPERATING NO. OPERATING NO. OPERATING NO. OPERATING NO. DER.ATING

MISO)YEARS YFARS YEARS YEARS YEARS YEARS

YR-M YR -MO YR -MO YR -MO YR -O " R - MO

I 11e0-vr valley I 4/77 1 1-1 1 -1 2 20(-0) 1 I-I I 1-1 I 1-1

I Big Rock Polint 12/62 I 15-5 1 15-5 2 20(5-5) I 15-5 I 15-5 I 15-5

3 Brown% Ferry 1 8/74 I 3-9 1 3-9 2 2x(3-9) I 3-9 1 3-9 I 3-9

4 Brwn Fe, ry 2 3/75 I 3-2 I 3-2 2 2x(3-2) 1 3 -2 I 3-2 1 3-2

S Bromns Ferry 3 3/77 1 I-2 I 1-2 2 2x(I-2) I 1-2 I 12 I 1-2

6 Brunaswick I 3/77 shares WY'D2 I I-2 2 2xf1-2) I 1-2 1 1-2 hares W/02

7 Brun~swick 2 11/75 I 246 I 2-6 2 2x(2-6) 1 2-6 1 2-6 I 2-6

I Calvert Cliffs I 5/75 1. 3-0 I 3-0 2 2X(3-0) I 3-0 1 J 3-0 I 3-0

9 Calveti Cliffs 2 4/77 shares w/o$ 1 I-1 1 I-I 1 I-I hare w/11 shar-! w/il

10 Cooler 7/74 I 3-10 1 .1-10 2 2x(3- 10) 1 3-10 1 3-10 1 3-10

11 Cvvstal liver 3 3/77 1-2 1 0-2 2 2x(I-2) 1 -1-2 I 1-2 1 1-2

I? Davis gn.s 11/77 0-6 1 0-6i 2 2K(0-6) 1 0-6 1 0-6 I 0-6

I) Donald C. Cooti 8/75 1 2-9 I 2-9 2 2x(2-9) 1 2-9 I 2-9 I 2-9

14 Dresden 1 8/60 1 17-9. I 17-9 2 2x0I7 9) .1 17-9 1 17-9 1 17-9

15 Dresdenl 2 8/70 I 7-9 1 7-9 2 lx(7-9) 1. 7-9 I 7-9 17-9

!6 Dresde,. 3 10/71 shares 1W/02 twt1 w/12 1I 6-7 - 1 6-7 NW5 w/02 shares W/02

(Subtotal) 63-10 66-1 137-8 72-8 65-0 63-10
$

TABLE 1.1 (CONTINUED)

N U M S A ND 0PER AAT 71N10 YE ARAS OF T HE ARaEA S ATE OF CONTRO ROO CABLE PLANT NNWK a cOsmCI. CONiTROL ROOM SPREADING DIESEL CENER. CONTAINMENT TURBINE BLOG. A¶UXILIARY BLDG. 0 UNI1T NUMBER (DECO", Room _____ ___ ____ _____

IIO)NO. OPERATING NO. OPERATING NO. OPERATING NO. OPERATING NO. OPERATINf. NO. OPERATING

YEARS YEARS YEARS YEARS YEARS YEARS

Yot .iO YR-MNo YR -no YR-MNo YR- MO YR- MO

I? Duame Arnold 5/74 .1 4-0 1 4-0 2 ZX(A0) 1 4-0 1 4-O I -

Is Edwin I. Notch 1 12/75 1 2-5 1 2-5 2 2X(2-5) I 2-5 I 2-5 1 2-5

19 rt calhoun 6/173 1 4-1l 1 4-l1 2 2x(4-11) I li-li 1 A-Il I A-11

20 K~dwmock 1/6.8 I 10-4 1 10-4 2 2RO(10) I 104-1 I 10-4 1 10-4

a1 0*-oodt Bay 3 0/6) I I-li 1 12-lI 2 2x(I2xII) 1 12-I1 I 12-11 1 12-11

7/76)

22 Indian Point 1 0/62 1 12-0 I 12-0 2 2x(12-0) I 12-0 I 12-0. I 12-0

10/74)

23 Indian Point 2 7/74 1 3-10 1 3-10 I 3-10 . 1 3-10. 1 3-10 I 3-10

2k India" Point 3 8/76 1 1-9 1 1-9 3 lx(I-9) I 1-9 1 1-9 I 1-9

25 JOWS V~tZpat7iCk 7/75 I 2-;0` 2-10 2 2A(2-10) 1 2-10 1 2-10 I 2-10

26 Jos.to M. Fancy I 12/77 I 0-5 1 0-5 2 2X(0-5) 1 0-5 I 0-5 1 0-5

27 Rewaurtt 6/74 1 3-11 I 3-11 2 2X(3-11) I 3-11 1 3-1.1 I 3-li

28 Lo Cresse,1 11/6.9 I 8-6. 1 8-6 2 ?x(8-6) Is B-6 I 846 I 8-6

29 Ma Ino Yankee 12172 I 5-5 1 5-5 2 2x(5-5) I 5-5 I 5-5 I 5-5

30 Nlillsgmn* 1 12/70 I 7-S I 7-5 2 2R(7-5) I 7-5 I 7-5 1 7-5

3; IIIstone 2 12/75 VOw . wil I 2-5 pt a/l 2-5 share w#il 1 2-5

31 tIcaIIo7/71 I 6-10 1I 6-10 2 2x(6-IO) 1 6-10 I 6-10 1 6- 10

(Subtotal) 87-6. 89-11 172-11 09-lI 87-6 89-i1
TABLE 0.1 (CONTINUED)

N U MBE R AND 0P ERItA T ING YE A RS 0OF *T ME A REfAS

DATE OF CABLE

PLANT mu.K 9 COMMERVIL CONTROL ROOM SPREADING DIESEL GElIER. CONTAINMENT TURBINE BLDG. AUX~ILIARY SLOG.

,t UNIT NUMBER OPEIRATI ON POO" OPERA _ NO___ W7__ No- OE 39(DECOM- No. P(RT~INC NO. J)PERATING NO. OPRTIM, NO JOPEkATING i~OPERWT1 N. OEAING

MISSION) YEARS YEARS YEARS YEAPS YEARS YEARS YR -MO YR -Mo YR -No YR -Mo YR -Mo YR -Mo

33 W~ fePoint I 12/69 1 B-S 1 8-5 2 2~(-) I 8-5 1 8-5 1 8-5

34 auclear On* I 12/74, 1 3.-5 1 3-5 2 2x(3-5) 1 3-5 I 3-5 I 31-5

35 Oconee 1 7/73 I 4-10 1 4-10 0 1 4-10 1 U..l0 1 I.-i0

36 foc@... 2 9/74 shares Will I1 3-8 0 1 3-8 W w/IlWl

37 Ocorwe.3 1 7/74 I 3-5 1 3-5 0 1 3-5 1 w/oI 1 I 3-5.

33 Oys . er Creek 1 12/69 1 9-5 1 3-5 2 2X(8-S) 1 8-5 8-5 1 8-5

34 Palisades 12/71 Ge 65 1 6-5 2 2X(6-5) 1 6-5 1 6-5 I 6-5

40 Peach Bottom 2 7/74 I 3-10 1 3-10 2 2x(3-10) I 3-10 1 3I10 I 3-10

41 Peach Bottom 3 12/74 hares W/82 shares will 2 2x(3-5) I 3-5 hap"s w/o. 2 1 3-5

*2 P.ilgrim 1 12/72 I 5-5 I 5-5 2 2x(5-5) I 5-5 1 5-5 1 5-5

43 on;pt .ach I 12/70 1 7-5 1 7-5 2 2x(7-5) I 7-5 I 7-5 1 7-5

41. Point Beach 2 10/72 hares w/81 shares will shark t.il 1 5-7 %ha W/111 0-s w/#%

45 Prairie Is. I 12/73 1 4-5 I 4-5 2 2,i(h45) I 4-5 I 4-5 I -

44, Prairie Is.. 2 .12/74 saret will shares w/01 shams w/fll .3-5 hams w/lZ I 3-5

k7 Quad cities .1 8/72 1 579 .I 5-9 2 -x(5-9) I -9 I 9-9 1 1 5-9

(Subtotal) 61 -4 65-5 '13-10 77-10 58-4 68-7
TABLE 0.1 (CONTINUFD)

N NUMBE fR A ND 0OPEfR AT I WMG Y EARItS O F 7 HE A RE A S _____

DATE OF CABLEI PLANT NAME £ COMMfRC'tl CONTROL ROOM SPREADING DIESEL GENER. CONTAINMENT TURBINE BLDG. AUXILIARY BLDG. c UNIT NUM~BER (OECD"I- ___ ____ ROOPI zMISSION) I O OEAIG N. OEAIGN. OEAIG No. OPERATING NO. OPERATING NO. JOPERATING

YEARS YEARS YEARS YEARS YEAr.S YEARS YR- "O YR -MO YR -MID YR- No YR-NMO YR -MO

48 Quad - Cities 2 10/72 shores v/1l hares Wi11l share w/1l 1 5-7 sham wi1l hares l

%9 Rnoech., Seca 4/75 1 3-1I I 3-Il 2 2x(3-1.1) I 3-11 1 3-1l 1 3-11

50 Robert E. WIowa 3/70 1 8-2 I 8-2 2 2x(R-2) 1 8-2 1 9-2 I 8-2

51 *43binson 2 3/71 I 7-2 1 7-2 2 2x(7-2) I 7-2 1 7-2 I 7-2

52 Salem I 12/76 I I-S 1 1-5 2 20~-5) I 1-5 I 1-5 I 1-5

53 San 0ftofr* 1 1/68 I. .10-4 1 10-4 2 2,i(104) I 10-4 1 10-4 1 10-'.

54 St. Lucie I 12/76 I 1-5 I 1-5 2 2x0I-5) 1 1-5 I 1-5 I -5

5S Suwre I 12/72 I 5-5 I 5-5 2 2X(5-5) I 5-5 1 5-5 I -

56 Surry 2 5/73 shares W/81 hares w/ll I 5-0 I 5-0 sham w/l sham will

57 Three M4; e IS. 1 9/74 1 3-0 I 3-8 2 2x(3-8) I )38 I 3-8 1 3-8

58 Trojan 5/76 1 2-0 I 2-0 2 zd2-O) I 2-0 1 2-0 1 2-0

59 turkey Point 3 12/72 I 5-5 1 S-5 2 290S-5) I* 5-5 I 55 1 5-5

60 Turkey Point 4 9/73 hares W/o 3 shares w/#3 6ares Iw/ll I li-8 1 4-8 w/#3

6I Verm.ont Yankee 111/72 1 5-6 1 5-6 2 2x(S-6) I 5-L~ I 5-6 1 5-6

(Subtotal) 56- 5-5 118-10 69-8 59-1 54-5

I-a

141
TABLE 3.1 - CONTIUUIDIo

a.

PLANT SMAGI t

UNIT "SMEA

DATE Of

COImtERC'L

WvE".-

MISS ION)

M U 0 SI K AND OPERAT I HG YE ARS OF THE ARLAS R A N D 0 P E It A 7 1 N G Y E CAVLt

SPREADING

ROOM

DIESEL GENER. CONTAINMENT TURBINE SLOG.

A It S 0 F T H E A A k A S

AUXILIARY SLOG.

CONTROL ~F MOON DIESEL GEHER. CONTAI NHENT TURBINE BLOC. AUXILIARY BLDG. MU. 1 urtn. ZWI~VTT3 *YU 9 ~ T ~WW1YTh~ ~ ~ T UrE~Mi ..... .

Iflu .~ t ~ MU. V ~ITWTYT~ tjr LflM I I ulU I ~ I ,.nemA~, urcnn, gnuup I ~ I ~TIT~T 

YEARS

YRt - HO

YEARS

YR -MO

MU.

YEARS

YR - MO

YEARS

YR - MO

YEARS

YR - Ho

YEARS

YR - mo

621 Ya"Ito 1 6/61 1 16-11 Ji 16-11 2 1 20(6-11) 1 16-11 1 16-1111 16-11

__ Zion 2 12/73 pos W/0l 1111 -5 1 1 204*-5) 1 I 41-5 I 11-5 [ -

(Soubtotal) 21-10 26-3 57-5 2613 26-3 26-3

Frm63-10 66-I 137-8 72-8 65-0 63-10 prevlousa 87-6 89-I1 112-11 89-1I 87-6 89-1I

61-11 65-5 113-10 77-1I) 58-11 68-7

54-5 54-5 113-10 fig-$ 59-1 510-5

TOTAL. 288-5 301-3 593-0 337 295-2 802-3

l.fl

-3
APPENDIX C - DATA ON DETECTION TIME FOR DIFFERENT FIRE

DETECTORS

C.1 Smoke Detectors

Three sources are used in this appendix for

deriving the probability distribution for the response

time of smoke detectors. These are References C.1,

C.2, and C.3. We quote from the first one (page 46):

"Response time of the detectors under ... test conditions have varied from 16 t~n 55 seconds for ionization detectors, and 91 to 310 seconds for photoelectric

detectors.0 The test conditions mentioned here simulated a residential compartment.

In Reference C.2, we find response times for

different detectors of both heat and smoke-sensitive

types. An average-@ize residential home was used in

their tests. The detectors camne from different manufacturers. The test fires covered a large gamut of

severity. The results show that, in about 70 percent

of the cases, the detectors responded w~thin the first

5 minutes, and in about 15 percent they responded In

more than 15 minutes. in about 10 percent of the

cases, the detectors did not respond at all. We believe

thot, because of low ceiling heights, these test

results are undprestima-tes for nuclear power plant

compartment conditions.

158
Reference C.3 gives data on test fires in hospitdl

rooms. Also In these tests, in about 70 percent of the

cases, the detectors responded within 5 minutes.

Howevere most of the responses (about. 50 percent) were

in the first 1 minute. In about 25 percent of cases,

the detectors did not respond at all. This shows that

compartment related parameters'have significant impact

on detector performance.

C.2 Heat Detectors

In the study of Reference C.2,, heat sensing

devices were also used. The response times were. much

longer than those of smoke detectors. In about

30 percent of the cases, the heat detectors responded

withir. 15 minutes; and in about 70 percent of the

cases, they did not respond at all.

In Reference C.1, we find 84 to 144 seconds as thetypical response times for the rate of rise hea~t

detectors. These results correspond to a residential

compartment.

Reference CA4 reports on experiments with high

challenge fires. The tests simulated large fires in

large compartments such as warehouses and varied the

height of the ceiling and type o.f combustibles. One of

the main observations was that the sprinkler heads (in

almost all cases),opened after the flames reached the

ceiling. The time tor the first sprinkler head opening

159
has been measured. It varies between 50 seconds to 10

minutes.

-.3 Nuclear Plant Experience

In the data given In the HTGR fire risk study [C.5],

a column titled "Interval Prior to Detection" is shown

where only five cases are given. These cases are

described below:

(1) Detection time 20 minutes; mode of detection

manual. An electrical insulation fire with

electrical origin had occurred in some cabinets at Peach Bottom Unit 3, April 1977.'

Fire was put under control in 6 minutes.

(2) Detection time 30 minutes; mode of detection

manual. It occurred on May 1976 in Browns

Ferry Unit 1 and combustible solids were

ignited. Inplant fire fighters put out

this fire in 20 minutes.

(3) Detection time I hour; detection mode automatic. Thi Is the charcoal adsorber explosion incident of July 1977 at Browns Perry

Unit 3 [C.61. Fire was burning Inside the

charcoal adsorber beds for 2 hours until it

was self-extinguished.

160
(4) Detection time 2 hours; detection mode

manual. Electrical insulation caug~ht fire

due to electrical causes in July 1972 at Quad

Cities Unit 2. Fire self-extinguished in a

few minutes after discovery.

(5) Detection time 3 hours; detection mode

manual. Expansion joints caught fire at

Robinson Unit 2 in April 1974. Fire was

extinguished in 15 minutes by the in plant

f ire f ighters.

References

C.1 Jensen, *Talking Fire Protection Systems," Fire

journal, January 1975.

C.2 *Home Fire Alarm Tests, Fire Journal, July 1971.

C.3 Waterman, T. E., J. G. Degenkolb?,,;and C. W. Stickney,

*A Study - Early warning Fire Detection Performance

in the Hospital Patient Room,O Fire Technology 10,

o.4,, (1974).

C.4 Troup, E. W. J., 'The High-Challenge Fireball - A

Trademark of the Seventies," Fire Tech, Vol. 6,

No. 3# August 1970.

161
C.5 Fleming. K. N.,1 W- T. Houghton, and F. P. Scaletta,

'A Methodology for Risk Assessment of Major.

Fires arid Its Application to an HTGR Plant,"

GA-A15402, General Atomic Company (1979).

C.6 Mays, G. T., *Srovpns Ferry Charcoal Adsorber

Incident," Nuclear Safety, Vol. 20. No. 1,

PP. 78-82, January-February 1979.

1t2?
APPENDIX D DATA ON FIRE SUPPRESSION

There are very few sources that have investigated

the suppression time for fires. In most cases, the

overall effectiveness of the extinguishing system has

been questioned. In the followinj subsections, we

discuss the data given by these few references.

D.1 Data from the HTGR Study

In Secticn A.2 of Appendix A, we discussed the

f ire data used in the HTGR Study by Genieral'Atomic

Company (D.1]. The data includes a column entitled

"Time to Bring Fire Under Control." 'Based on the

numbers of that column, we have derived the two frequency distributions of Table D.1; one uses all the

cases that occurred when under commercial operation and

the other uses those cases that involved electrical

insulation (also under commercial operation.) We

believe that the numbers in that column represent the

time between fire detection and fire growth inhibition.

It is after the detection time becausce the adjacent

column is entitled *interval Prior to DetectionO and,

in some caszs, it contains numbers larger than-the

previous column. Thus, the distributions of Table D.1

depict a period that is certa*inly smaller tlaar' fire

duration. Also, it should be noted that the time

periods given In Reference D.1 are, in most cases,

estimates by experts and not a result of actual time

measurements during the fire incident.

163
TnIBLE D.1 FREQUENCY DISTRIBUTION

OF "TIME TO BRING FIRE UNDER CONTROL."

FROM REFERENCE D.1 FOR THE COMMERCIAL 'JPERATIOI'. DHASF.

All Cases Cases Where -I- ______________Electrical Insulation

* was Involved

Timec Frequency Cumulative Frequency Cumulative

_________ ~ )Frequency Frequenr~y [ 0 10 10 12 12

3min 8 18 24 36

6mn25 4.3 12 46

12min 17 60 6 54

ISmin 9 69

30 min 11 80 23 77

42min 4 84 6 83

I hour 488 6 89

1-3 hours 4 92 6 95

1-5 hours 2 94

2 hours, 2 96

7 hours 2 98 5100

24 hours 2 100
D.2 Fire Suppression Test Results

Reference D.2 presents the results of several

tests that were conducted in two small compartments to

measure the minimum water requirements for suppresslo.l.

They allowed the fire to reach flashover and attacked

it about 30 to 120 seconds after that, They concluded

that the amount of water used strongly depends on the

type of furnishings invol1ved in the fire and the

techniques used by the fire fighters. They have tabulated the flow rate of the water, total water used

to control the fire, and also total water used to

complete extinguishment. By complete extinguishment,

they meant suppression of all visible flames

(smoldering may still have been in progress). From

their data, we have computed the time to bring the f ire

under control, which varies from between 15 seconds to

2 minutes. Also, we have computed the I-ime to total

extinguishment and this varies from betwe~en

1/2 to 4 minutes. The following observations-are i.)

order:

(1) Even though the tests were in a controlled

environment mnd the variations Irn the methods

used were limited, the suppression time has a

significantly la:ge variation (about one

order of magnitude).
(2) The time periods are short because adequate

extinguishing equipment was available at all

times of the experiment.

References

D.1 Fleming, K. N., W. T. Houghton, and F. P. Scaletta,

*A Methodology for Risk Assessment of Major

Fires and its Application to an HTGR Plant,"

GA-AI5402, General Atomic Company (1979).

D.2 Salzberg, F., F. J. Vodvar*' and G. L. Maatman,

"Minimum Water Requirements for Suppression of

Room Fires,"-Fire Tech., Vol. 6, No. 1, pp. 22-28,

February 1970.

I v i
APPENDIX E DATA ON.CABLE FAILURE TIME

E.1 Introduction

The data on failure tine comes from sources that

.have conducted cable fire tests. The conditions of

these tests in some instances have been quite different. Therefore, we first discuss their history very

briefly (Section E.2) and then summarize the relevant

results (Section E.3).

E.2 Fire Tests

Many fire tests have been developed in recent

years by various organizations to measure the different

aspects of a fire incident. Most of these measure only

one phenomenon, e.g., ignition temperature, flamniabil-'

ity, fire spread, etc. Reference E.1 provides a review

of these tests and classi fies them as those that test

f or: (a) ease of ignition, (b) surface flame spread,

(c) heat release, (d) fire endurance., (e) smoke evolution, and (f) combustion productC. Most of these tests

are designed for small samples. in many instances, it

has been proven that fuel geometry, quantityj and

ambient conditions have severe &Zfects on the fire test

results 'fE.2, E.31. Pull scale tests have been devised

also to observe these-effects. Reference E.1 lists

facilities that perform such tests. It has been found

that reproduc'ing the same tert result is very difficult. This is -ttributed to the large number of

:I f -
parameters that have significant impact on the time

history of a fire. For example, the ignition process

is only partly controlled by the fuel area being

exposed to heat, uniformity of exposure, drafts in the

room, duration of exposure, ancO the heating rate.

The same types of problems exist in cable fire

tests. In recent years some tests have been

specialized for cables only. The nuclear industry has

been the main motive behind these developments.

Reference E.4 summarizes some of these tests. Benchtype fire tests using short lengths of single cables

have been used to determine the flammab~ility of the

cables. Also, large scale tests have been devised to

Letter simulate real fire conditions and overcome the

erronemus conclusions stemming from the small scale

tests.

Independent tests have been carried out by the

different factions of the industry: the manufacturei-s [E.51, the utilities [E.61, and the regulatory

bodies (E.7,., From these tests, standards have

emerged rE.41. The most Impor..ant standard for cable

testing is the IEEE Std 383-1974 1-E.8) where a vertical

set of cables is *xpe'sed to a 70,000 Stu/hr heat source

with a flame temperature of 1500"F. Reference E.4

describes the activities that helped to develop this

IEEE standard.
By reviewing these tests, their results, and Some

relevant literature, we have learned that:

(1). Grouped cables pose a. special fire hazard

(E.9,E.lO].

(2) The position of the cables is important.

Cables in vertical trays pos- a larger hazard

for propagation [E.11).

(3) Tray construction plays a role too. in'

totally closed trays (top and bottom closed)

and conduits, circuit failure occurs sooner

than in cables In open-type trays. Although

c able Ignition Is delayed, combustion is 'nore

severe (E.41. This Is because the clo~sed

tray or conduit acts like an oven.

(4) The density of cables (number of cables per

unit width of tray) in horizontal, open

bottom trays affects their flayrmmability.

This has to do with volatile gases being able

to pass through the trays and burn at upper

layers.

(5) Deep -seated fires ma y occur (E.12,E.13J.

These are hard to put out. This is especially true for nonwater extinguishing

agents (E.14).

169
(6) The heat release-rate of the donor fire (the

ignition source) may make a difference.

Reference E.13 quotes cxperiments where a

70,000 Btu/hr donor fire did not reproduce

the real incident of fire propagation,

whereas a 210,000 Btu/hr fire did so.

(7) Corrosion effects may also become important.

In a cable fire incident described in

Reference E.13, the corrosive gases given off

by the cable insulation or jacket'(occurs at

high temperature) corroded electrical

contacts and relays some 40 feet away.

(8) Finally, the currently existing standards and

test procedures still cannot accurately

determine the degree of fire retardancy of

the cables.

E.3 Data

;Ln this section, we summarize the results available to us. Most of the tests referenced here-are

designed for investigating t.ammabili~ty.* However, what

we are interested in is the time to circuit failure.

Fortunately, many experimenters have recognized the

need for this piece of information and have ree-orded It

in addition to flammability-related information. In

the main text, Section 3.5.2.2, the time to cable

170
failure is defined as the time between flames engulfing

the cable and its failure (the failure modes are discussed separately). In all the tests, the cables were

immersed into flames. Also, all the conductors were

subjected to voltage and circuit integrity was checked

with some light bulbs. Failure time was measured from

the ignit ion of the donor flames until the light

went out.

The Boston Insulated Wire Company ha~s-tested its

own cables according to different standards and procedures [E.51. In Reference E.5, seven types of cables

are tested by exposing single cables to a Bunsen

burner for 5 minutes with a flame temperature of about

16000F. Two of the cables shorted in 2 and 6 minutes;

the others experienced extensive damage but did not

short out. In another test, oil-soaked burlap was

burned next to several runs of the same cable on a

vertical tray. PVC Insulated cables shorted In

3-1/2 and 4-1/4 minutes. Bostrad 7 (a brand. name)

cable did not short for the 19-1/2 minutes that the

flames existed. Flame temperature Is unknown. In

controlled bonfire tests, r bundle of cables Is suspended over a bonfire for 5 minutes. Cross linked,

polyethylene CPR nylon jacket and Bostrad 7 shorted in

1-1/2 to 3 minutes. Bostrad 7S (a brand name) did not

171
short in these 5 minutes. Radiation effects are also

investigated in this reference.

Reference E.6 summarizes the results of the tests

that were performed by Baltimore Gas and Electric 'Company to choose appropriate cables for their Calvert.

Cliffs Nuclear Power Plant. In their tests, the cable

trays were loaded with one layer of test cables,

allowing 1/2 diamet er of space between cables, and

no more than 15 cables per trzy. Transil oil in a

5 gallon can was burned for 5 minutes. Flame

temperature was about 18000 F. Forty-five types of

,control cables and twelve types of power cables were

tested in this way. The majority of the cables shorted

af ter the r'i1 can was removed. The results are shown

in terms of the following histon',am:

Time to Short Fraction Cumulative

.(Minutes) Percent Fraction1-5 14 14

5-10 46 60

10-15 26 86

15-20 3 89

> 20 11 100

'From these tests, it was concluded that silicon

rubber-insulated control cabler with glass-braid

fillers and asbestos-b-raid jackets have better flame

172
retardance characteristics than the others. Six such

cables were subjected to this test and only one failed

(at about 15 minutes). Also, two other control cables

did not fail in 20 minutes. Both were silicone

insulated and the jackets were of PVC (poly vinyl

cnloride) and Neoprene.

O~konite Company has performed a series of cable

fire tests that helped the development of the IEEE Std.

383-1974 [E.8]. They are discussed in Reference E.4.

Only control cables were subjected to those tests.

Some of their results are given in the following-.

*Neoprene cables in a vertical tray are subjected to burning burlap soaked in Oil. it

burned for about 20 minutes. The flame

temperature was about 1200OF and short,s

occurred between 7 and 16 minutes.

*The same neoprene cables in a :,ertical tray are

subjected to bur'ning-propane gas.- They burned

the propane for 20 minute3. The flame temperature was about 1500'PF and shorts occurred

between 6 and 8 minutes.

*A set of control cables was subjected to two

levels of burner heat release rates

(70,000 Btu/hr and 210,000 Btu/hr). The cables

shorted between 10 and 21 m~inutes. For the

173
second case (210,000 Btu/hr) they shorted

between 6 and 11 minutes.

*Similar to Ruference E.6, they found that

silicone insulated cables with glass braid

jacket do not short. However, the jacket was

charred and the core damaged. They had applied

the flames for 20 minutes.

The scientists at the Sandia Laboratories have

conducted some cable fire tests to investigate the

effects of fire-retardant coatings [E.15]. These are

special compounds that are sprayed (or applied by

trowels) on top of the cables. These tests are part of

a larger study entitled "Fire Protection Research

Program." Five different coatings wete used on a

ý.sinole horizontal cable tray. Propane burners were

installed underneath the tray. it was applied in

cycles of 10 minutes, 5 minutes on arod 5 minutes off,

for six times. In seven out of ten tests, the cables

had not shorted at the end of the sixth cycle. in the

remaining three cases, they shorted between 15 and

26 minutes. In the same setup, they made three

additional tests without applying any coating. In two

cases the cables had passed the IEEE .383 test and

shorted In 5 and 9 minutes. In the third case, the

cable had not passed the IEEE test and shorted in

6 minutes.

174
References

t.1 Hilado, C. j. *Flammability Tests, 1975: A

Review," Fire Technolo~gy, 11, No. 4,

November 1975.

E.2 Smith, E. E., "Relation of Performance Tests to

Actual Fires," Fire Tech~nology 12, No. 1.

February 1976, pp. 49-54..

E-3 Wilson W. 3.,, OLarge Scale Fire Tests," J. Fire

and Flammability, 7, January 1976, pp. 112-124A

E.4 Mcllveen, E. E.# 'Fire Retarlant Cable Systems,"

IEEE Transactions on IndustryApplications,

Vol. IA-li, No. 3, May/June 1975.

E.5 'Flame and Radiation Resistant Cables for Nuclear

Power Plants,' Boston Insulated Wire and Cable

Company, Report B901, September 1969.

E.6 Bhatla,, P.0 'Silicone-Rubber-Insulated Cables for

-Calvert Cliffs Nuclear Power Plant#O Nuclear

.Safety. 16, No. 6, 1975.

E.7 Klamerus, L. J.0 OFire Protection Research

Program at Sandia Laooratories,' CONF-800403/V-1,

Proceedings of American Nuclear Societ , Knoxville, Tenness~e, April 6-9, 1980.

175
E.8 "Type Test of Class IE Electr~c Cables, Field

Splice-,," IEEE Std. 383 (1974).

E.9 Hedlund, C. F., *Grouped Combustible Wires and

Cables," Fire Journal 60, March 1966.

E. 10 Oldendorf, L. E., "The Gro-up Electrical Cable

Fire Problem," Fire J. 65, November 1971,

pp. 42-45.

.E.11 Baker, F.' E. and Sh epherd, R. E., "Fire Testing

of Electrical Cables and the Benefits of FireRetardant Paints,* Fire Technology 7,

Nu. 4 1971.

9.12 Krause, F. K.,"Burning Characteristics of

Horizontal Cable Trays," Seventh Water Reactor

Safety Research Information Meeting,

Gaithersburg, iAaryland, November 9, 1979.

E.13 LaFetra, F.E. and McGowan, E. J. "Power- Control

and Instrumentation Cable for Nuclear Fueled

Power Plants," IEEE Transactions on Nuclear

Science, Vol. NS21, No. 1, rebruary 1974.

E.14 Cholin, R., "How Deep Is Deep? Use of Halon 1301

on Deep-Seated Fires,* fire Journal, March 1972.

176
NR PCD .3,35

47 7 7) U.S NUCLEAR REGULATORY COMMISSION

BIBLIOGRAPHIC DATA SHEET

1. REPORT NUMSE F% J~ssiF'tdby DOC)

NUREG/CR-2258

UCLA-ENG-8102

4 TITLE Ar,- SUBTITLE (A-Id Volume Noa., ilapp: priare) 2. I'Leai' blank)

FIRE RISK ANALYSIS FAIR NUCLEAR POWER PLANTS 3. RECIPIENT'S ACCESSION NO.

'7. ALIT .;R (S) 5. DATE REPORT COMPLETED

MONT TNA M. K,,zarians and G. Apastolakis ____Ma y 1981

ý3 PE RF ORMING OflGANIZATIC*4 NAIVE AND IPAAILING ',DDRESS (1nclud Zip Cade) DATE REPORT ISSUED

Schorel of Engineering and Applied Science SepTemberR

Un-lvvrsi.'y of California Spebr1981

Lo!s Angeles, CA 90024 6iLravir blonli

12. SPCN~SORIN(- ORGANIZATION NAME AND MAILING ADDRESS lfinclude Zp Cod*) 1.ejEC/AKWRKUI O

Offi-ze of Nuclear Regulatory Research

Divinion of Risk Analysis 11. CONTRPACT NO

U.S. Nuclear Regulatory Comm~ission NRC FIN No. 86284

Wash~ington, D.C. 20556

13. TYPE OF REPORT PERIOD CO" ERE) (inclusive UaesJ

Tec hn -4cal1 10/1/80 VI5M/8

15. SUPk'L'jMENIARY NOTES 14. (Loave blank)

6.ABC ACT £200 words or less)

A met'hodoiogy for evaluating the frequency of severe consequences Adue to fires in nuclear

poweýH'rýpl ants is presented. The m~ethodology produces a list of ac0'tjent scenarios mng,ther- assestes the frequency of occurrence of each. !ts framework is giv~ln in six steps In the first two sceps, the accident scenarios are identified qualitatively and the

potential of fires to cause inittiating events is investigated. The last four steps are aimed at quantification. The trequency of lires is obtaired for different compartments in nuclear power plants usine Bayesion techniques. The results are compared with those

of classical methods and the variation of the frequencies with time is also examined. The combined effects of fire growth, detection, and suppressi~on on component failure a re modeled. The susceptibility of cables to fire and their failure modes are discussed. Finblly,,the limitations cf the methodology and suggestions for further research are given.

17 KE Y WORI.S AND) DOCLUMENT ANALYSIS 17. DESCAIPTORS

Fire Risk'

Accident Scenarios

Fire Risk ..ialysis

Fire Growth Analysis

1 7b IC)E NTII It AS'OP[ N F NrDD It RMS

114 AV~AlL ABI IT SI All M0INT igSt 9 CuR.TV LL A! frA.I e~popil 121 NO0 Of PArptS

Uri] imi ted U CR

W~l 'it P ~i t e d I t d I PRI)