NUREG/CR-6738

SAND2001-1676P

 

Risk Methods Insights

Gained From Fire

Incidents

Sandia National Laboratories

 

U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Washington, DC 20555-0001
 NUREG/CR-6738

 SAND2001-1676P

 

Risk Methods Insights 

Gained From Fire 

Incidents

Manuscript Completed: August 2001

Date Published: September 2001

Prepared by:

S.P. Nowlen, Sandia National Laboratories

Dr. M. Kazarians, Kazarians and Associates

F. Wyant, Sandia National Laboratories

Sandia National Laboratories

Albuquerque, NM 87185-0748

Kazarians and Associates

Glendale CA 91205

H.W. Woods, NRC Project Manager

Prepared for:

Division of Risk Analysis and Applications

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

NRC Job Code Y6037
__

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

-_

NRC Reference Material Non-NRC Reference Material

As of November 1999, you may electronically access Documents available from public and special technical

NUREG-series publications and other NRC records at libraries include all open literature items, such as

NRC’s Public Electronic Reading Room at books, journal articles, and transactions, Federal

www.nrc.gov/NRC/ADAMS/index.html. Register notices, Federal and State legislation, and

Publicly released records include, t o name a few, congressional reports. Such documents as theses,

NUREG-series publications ; Federal Register notices; dissertations, foreign reports and translations, and

applicant, licensee, and vendor documents and non-NRC conference proceedings may be purchased

correspondence; NRC correspondence and internal from their sponsoring organization.

memoranda; bulletins and information notices;

inspection and investigative reports; licensee event Copies of industry codes and standards used in a

reports; and Commission papers and their

attachments.

substantive manner in the NRC regulatory process are

maintained at--

NRC publications in the NUREG series, NRC

regulations, and Title 10, Energy, in the Code of

Federal Regulations may also be purchased from one

of these two sources.

1. The Superintendent of Documents

U.S. Government Printing Office

Mail Stop SSOP

Washington, DC 20402-0001

Internet: bookstore.gpo.gov

Telephone: 202-512-l 800

Fax: 202-512-2250

2. The National Technical Information Service

Springfield, VA 221614002

www.ntis.gov

l-800-553-6847 or, locally, 703-605-6000

The NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852-2738

These standards are available in the library for

reference use by the public. Codes and standards are

usually copyrighted and may be purchased from the

originating organization or, if they are American

National Standards, fromAmerican National Standards Institute

11 West 42nd Street

New York, NY 10036-8002

www.ansi.org

212-642-4900

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: Office of the Chief Information Officer,

Reproduction and Distribution

Services Section

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

E-mail: DISTRIBUTION@nrc.gov

Facsimile: 301415-2289

Some publications in the NUREG series that are

posted at NRC’s Web site address

www.nrc.gov/NRC/NUREGS/indexnum.html

are updated periodically and may differ from the last

printed version. Although references to material found

on a Web site bear the date the material was

accessed, the material available on the date cited may

subsequently be removed from the site.

Legally binding regulatory requirements are stated

only in laws; NRC regulations; licenses, including

technical specifications; or orders, not in

NUREG-series publications. The views expressed

in contractor-prepared publications in this series

are not necessarily those of th e NRC.

The NUREG series comprises (1) technical and

administrative reports and books prepared by the

staff (NUREG-XXXX) or agency contractors

(NUREG/CR-XXXX), (2) proceedings of

conference s (NUREG/CP-XXXX), (3) reports

resulting from international agreements

(NUREG/IA-XXXX), (4) brochures

(NUREG/BR-XXXX), and (5) compilations of legal

decisions and orders of the Commission and

Atomic and Safety Licensing Boards and of

Directors’ decisions under Section 2.206 of NRC ’s

regulation s (NUREG-0750).

DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government.

Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or

implied, or assumes any legal liability or responsibility for any third party ’s use, or the results of such use, of any

information, apparatus, product, or process disclosed in this publication, or represents that its use by such third

party would not infringe privately owned rights.
NUREG/CR-6738

SAND2001-1676P

Risk Methods Insights

Gained From Fire

Incidents

Manuscript Completed: August 2001

Date Published: September 2001

Prepared by

S.P. Nowlen, Sandia National Laboratories

Dr. M. Kazarians, Kazarians and Associates

F. Wyant, Sandia National Laboratories

Sandia National Laboratories

Albuquerque, NM 87185-0748

Kazarians and Associates

Glendale , CA 91205

H.W. Woods, NRC Project Manager

Prepared for

Division of Risk Analysis and Applications

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

NRC Job Code Y6037

iii

ABSTRACT

This report presents the findings of an effort to gain new fire probabilistic risk assessment (PRA)

methodology insights from fire incidents in nuclear power plants. The study is based on the review

of a specific set of 25 fire incidents including fires at both U.S. and foreign reactors. The sequence

of actions and events observed in each fire incident is reconstructed based on the available

information. This chain of events is then examined and compared to typical assumptions and

practices of fire PRA. The review focuses on two types of actions and events. First are events that

illustrate interesting insights regarding factors that fall within the scope of current fire PRA methods.

Second are events observed in actual fire incidents that fall outside the scope of current fire PRA

methods. Fire PRA insights are then drawn based on these observations. The review concludes that

the overall structure of a typical fire PRA can appropriately capture the dominant factors involved

in a fire incident. However, several areas of potential methodological improvement are identified.

A few factors are also identified that fall outside the scope of current fire PRAs including the

occurrence of multiple initial fires or secondary fires, multiple simultaneous initiating events, and

some aspects of the smoke control and human response assessment.

v

CONTENTS

ABSTRACT ............................................................. . iii

FORWARD .............................................................. . vii

ACKNOWLEDGMENTS ................................................... . ix

1.0 INTRODUCTION ...................................................... . 1

1.1 Problem Statement and Objectives .................................. . 1

1.2 Organization of Report ........................................... . 2

2.0 METHODOLOGY ..................................................... . 3

2.1 Overall Approach ............................................... . 3

2.2 Identification of the Fire Incidents for Review .......................... . 3

2.3 The Review Process ........................................... . 4

2.4 Elements of a Fire Scenario ....................................... . 6

2.5 Quality and Completeness of Available Information ..................... . 9

3.0 SELECTED FIRE INCIDENTS .......................................... . 10

4.0 INSIGHTS .......................................................... . 13

4.1 Fire Initiation ................................................. . 18

4.1.1 Self-ignited Cable Fires .................................... . 18

4.1.2 Simultaneous Ignition of Multiple Fires ........................ . 19

4.1.3 Secondary Fires ......................................... . 21

4.1.4 Fire During an Outage .................................... . 22

4.2 Fire Propagation ............................................... . 22

4.2.1 Barrier Failure and Room-to-Room Fire Spread ................. . 22

4.2.2 Propagation of Fire Effects to Adjacent Compartments ............ . 24

4.2.3 Smoke in the Control Room ................................ . 26

4.2.4 Large Turbine Building Fires ................................ . 29

4.2.5 Significant Cable Fires..................................... . 30

4.3 Fire Detection and Suppression ................................... . 32

4.3.1 Availability of Suppression System ........................... . 32

4.3.2 Fixed Suppression System Overwhelmed by the Fire .............. . 33

4.3.3 Fire Duration ........................................... . 34

4.4 Equipment Damage ............................................ . 38

4.4.1 Spurious Actuation of Equipment ............................ . 38

4.4.2 Cabinet Fires ........................................... . 40

4.4.3 Damage vs. Suppression Timing ............................. . 41

4.4.4 Structural Failure from a Fire ............................... . 41
vi

4.5 Impact on Plant Safety Functions .................................. . 42

4.5.1 Impact on Multiple Safety Trains ............................ . 42

4.5.2 Severe Degradation of Core Cooling Capability ................. . 44

4.5.3 Human Error Events ...................................... . 46

4.5.4 Credited Human Recovery Actions ........................... . 48

4.5.5 Multiple Events from the Same Root Cause .................... . 50

4.5.6 Non-Safety Related Areas and the Use of Internal Events PRA Model . 50

5.0 CONCLUSIONS ...................................................... . 52

5.1 General Insights ............................................... . 52

5.2 Specific Methodological Insights .................................. . 54

5.3 Availability and Quality of Incident Data ............................. . 58

6.0 REFERENCES ....................................................... . 59

APPENDICES:

Appendix 1 - Analysis of San Onofre, Unit 1 Fire on March 12, 1968 .......... . A1-1

Appendix 2 - Analysis of Mühleberg Fire on July 21, 1971 ................... . A2-1

Appendix 3 - Analysis of Browns Ferry 1 and 2 Fire on March 22, 1975 ........ . A3-1

Appendix 4 - Analysis of Greifswald, Unit 1 Fire on December 7, 1975 ......... . A4-1

Appendix 5 - Analysis of Beloyarsk, Unit 2 Fire on December 31, 1978 ......... . A5-1

Appendix 6 - Analysis of North Anna, Unit 2 Fire on July 3, 1981 ............. . A6-1

Appendix 7 - Analysis of Armenia NPP Fire on October 15, 1982 ............. . A7-1

Appendix 8 - Analysis of Rancho Seco Fire on March 19, 1984 ............... . A8-1

Appendix 9 - Analysis of South Ukraine, Unit 2 Fire on December 15, 1984 ..... . A9-1

Appendix 10 - Analysis of Zaporizhzhya, Unit 1 Fire on January 27, 1984 ...... . A10-1

Appendix 11 - Analysis of Kalinin, Unit 1 Fire on December 18, 1984 ......... . A11-1

Appendix 12 - Analysis of Maanshan, Unit 1 Fire on July 1, 1985 ............ . A12-1

Appendix 13 - Analysis of Waterford, Unit 3 Fire on June 26, 1985 ........... . A13-1

Appendix 14 - Analysis of Fort St. Vrain Fire on October 3, 1987 ............ . A14-1

Appendix 15 - Analysis of Ignalina, Unit 2 Fire on September 5, 1988 ......... . A15-1

Appendix 16 - Analysis of Oconee 1 Fire on January 3, 1989 ................ . A16-1

Appendix 17 - Analysis of H. B. Robinson, Unit 2 Fire on January 7, 1989 ..... . A17-1

Appendix 18 - Analysis of Calvert Cliffs, Unit 2 Fire on March 1, 1989 ........ . A18-1

Appendix 19 - Analysis of Shearon Harris Fire on October 9, 1989 ........... . A19-1

Appendix 20 - Analysis of Vandellos, Unit 1 Fire on October 19, 1989 ........ . A20-1

Appendix 21 - Analysis of Chernobyl, Unit 2 Fire on October 11, 1991 ........ . A21-1

Appendix 22 - Analysis of Salem, Unit 2 Fire on November 9, 1991 .......... . A22-1

Appendix 23 - Analysis of Narora, Unit 1 Fire on March 31, 1993 ............ . A23-1

Appendix 24 - Analysis of Waterford, Unit 3 Fire on June 10, 1995 ........... . A24-1

Appendix 25 - Analysis of Palo Verde, Unit 2 Fire on April 4, 1996 ........... . A25-1
vii

FOREWORD

The design and operation of commercial nuclear power plants (NPPs) include multiple defenses to

reduce the likelihood and consequences of potential fire-initiated accidents. These defenses include:

S administrative programs (to reduce the likelihood and potential severity of fires)

S detection and suppression systems and programs (to rapidly extinguish any fires that might

occur)

S separation of safe shutdown equipment trains (to reduce the potential effects of a fire on key

plant systems) and

S operating procedures and training (to deal with potential fire-induced losses)

Because of these defenses, the frequency of fire-initiated accidents is not expected to be large.

Indeed, to date, there have been no fire-induced core damage accidents in the history of commercial

nuclear power.

However, neither the existence of defenses nor the lack of fire-induced core damage accidents imply

that such accidents cannot occur, nor do they demonstrate that fire is necessarily an unimportant

contributor to a given plant's risk profile. To develop fire risk estimates that can be used in

plant-specific decision making, models reflecting the design and performance of the plant's defenses

against fire must be used.

The models used by current fire probabilistic risk assessments (PRAs) incorporate plant- and

area-specific considerations of the defense elements mentioned above. To address key areas of

uncertainty identified by reviews of fire PRAs, including those performed as part of the Individual

Plant Examination of External Events (IPEEE) program, the Office of Nuclear Regulatory Research

(RES) initiated a fire risk research program in 1998. One of the tasks in that program involves the

review of actual nuclear power plant fire events to determine if these events indicate any areas of

weakness in the current overall fire PRA approach or in any elements of that approach.

This report reviews selected nuclear power plant fire events to gain insights on current fire PRA

models and methods. The events were selected to address fires that posed significant challenges to

nuclear safety, significant challenges to fire protection, or significant challenges to key elements in

fire PRA. Because the events were been selected to identify potential issues rather than to make

quantitative statements concerning the likelihood of various phenomena or events, the event selection

process did not employ any formal sampling scheme. Furthermore, because of the rarity of serious

nuclear power plant fire events and the associated scarcity of detailed information on such events, the

selection process included events which occurred several years ago and events which occurred

outside of the United States.

Despite the uncertainties introduced by these features of the study, this report provides a useful

perspective on the individual elements of a current fire PRA. It indicates which elements of fire PRA

appear to appropriately address observed phenomena and identifies a limited number of areas where

fire PRAs may need to be expanded. In addition, the report provides a useful perspective on the

overall structure of current fire PRAs, by indicating that this structure appears to adequately address
viii

all issues identified. In other words, the lessons learned from the event review can be incorporated

through improvements in specific fire PRA elements, and do not imply any significant revisions to the

general fire PRA approach currently being used. 

The staff believes that the information contained in this report will be useful to a broad variety of

readers. The staff will use the report's insights when performing any future fire risk assessments, and

will consider the report's recommendations when updating the current NRC fire PRA research plan.

Furthermore, the staff will broadly disseminate the report, recognizing that the report's detailed

discussions of individual events may be useful in applications outside of the report's scope (e.g., in

the identification of fire safety lessons, in the identification of key factors in the general treatment of

plant operator responses to challenging events).

Mark A. Cunningham

Chief, Probabilistic Risk Analysis Branch

Division of Risk Analysis and Applications

Office of Nuclear Regulatory Research
ix

ACKNOWLEDGMENTS

This study was performed as Task 5 of the USNRC Office of Research (RES) sponsored Fire Risk

Methods Program. The USNRC program technical lead is provided by H. W. ‘Roy’ Woods. The

contributions of Dr. Nathan Siu, also of USNRC/RES, to the development of the study approach and

objectives are also gratefully acknowledged.

Many colleagues and friends assisted us in gathering information about various incidents. Special

thanks are due to Mr. Enric Pla, and Ms. Marika Sarkisova who spent many hours researching and

compiling valuable information that were otherwise not available in the open literature. Thanks are

also due to Ms. Ana Gomez-Cobo, Ms. Hiroko Tezuka, Mr. Stefan Brosi, Mr. Jouko Martilla, Mr.

Dennis Bley, Ms. Marina Rowekamp and Mr. Mika Yli-Kauhaluoma who assisted us in obtaining

information about various incidents. We also thank Andrew Minister of Pacific Northwest National

Laboratory (PNL) for his assistance in the review and revision of this report, particularly as related

to certain of the fire incidents documented for plants in the former Soviet Union. Also assisting the

review process were Robert Kalantari of Engineering Planning and Management Inc. (EPM), Susan

Cooper of Science Applications International Corp. (SAIC), Mohamad ‘Ali’ Azarm of Brookhaven

National Laboratory (BNL).

Introduction

1

 The term “fire PRA” will be used in this report to represent the analysis of nuclear power

plant fire risk using quantitative probabilistic methods.

1

1.0 INTRODUCTION

1.1 Problem Statement and Objectives

Methods of probabilistic risk assessment (PRA) for the analysis of fire incidents (fire PRA)1 have been

developed primarily during the last two decades.[1-6] These methods have seen extensive application

in both individual plant risk assessment efforts and in the Individual Plant Examination for External

Events (IPEEE) initiative. One source of information that has influenced methods development and

the quantification of certain input values for fire risk analysis is actual fire experience in nuclear power

plants, especially that of U.S. plants. Fire experience has been widely used to identify anticipated fire

sources and for statistical evaluation of such analysis parameters fire initiation frequency and fire

duration.[3,4,7-10] In the regulatory arena, nuclear industry fire incidents have been reviewed to

establish root causes and to assess the potential need for additional fire protection features or new

fire protection approaches. However, none of the previous studies has used fire incidents to glean

insights into the underlying assumptions, methodology and results of fire PRA. That is, none of the

previous studies has examined the chain of events observed during actual fire incidents in an attempt

to glean insights into the current fire PRA practice.

This report presents the analysis and results of a study of a select set of fire incidents from a fire PRA

perspective. The study was done as part of a research project sponsored by the U.S. Nuclear

Regulatory Commission (USNRC).[11] The study objectives are defined as follows:

S Identify key fire risk and fire PRA insights from serious U.S. and international nuclear power

plant fires.

S Develop recommendations for fire PRA improvements and areas for further investigation.

In this study, 25 fire incidents were examined for insights regarding various aspects of the overall fire

PRA process; that is, methodologies currently employed, underlying assumptions of those

methodologies, and supporting data. In order to reach the first objective of the study, this review

in effect is seeking the answer to the following three questions:

S How do fire incidents verify (or contradict) various elements of fire scenario models as

developed in current fire PRAs?

S Does the actual fire experience lend any insight into the current areas of methodological

debate? 
Introduction

2

S Do actual fire incidents indicate the existence of any new phenomena that have not been

considered in past PRAs?

In selecting the events included in this review a large number of fire events were considered.

However, no attempt was made to ensure an exhaustive search of all fire incidents in any specific

context (see Section 2.2 for further discussion of the completeness of the selected incident set).

Furthermore, no attempts have been made to perform statistical analyses of various fire PRA analysis

parameters based on this review. While event reviews often take on these tasks, this was not the

intent of this particular study. Rather, a select set of fire incidents was reviewed in order to glean

insights into the completeness and validity of current PRA methods and assumptions. Each fire

incident in the review set either involved a severe fire in the traditional context of fire protection, a

fire that challenged nuclear safety, and/or a fire that provides some specific insight into current fire

PRA methods and assumptions.

1.2 Organization of Report

Section 2 provides a description of the methodology used in reviewing each fire incident. Section

3 identifies the incidents that were reviewed in this study. The insights gained from various incidents

are given in Section 4. Final conclusions, summary of insights, and recommendations are presented

in Section 5. Section 6 cites the referenced documents. Individual incident reviews are provided in

Appendices 1-25 (both the Table of Contents and Table 3.1 provide a cross reference of events to

appendices).
Methodology

2A note on terminology: This report distinguishes between “incidents” and “events” in the

following manner: “Incident” refers to the overall fire occurrence from beginning to end. 

“Event” refers to the individual actions and occurrences within the overall incident that make up

the observed “chain of events.”

3

 The only challenged fire barrier was the incomplete penetration seal that was the ignition

point for the fire which quickly spread through a gap in the incomplete seal.

3

2.0 METHODOLOGY

2.1 Overall Approach

The approach used in this study can be divided into the following steps: identification of fire incidents,

collection of relevant information, chronological listing of the chain of events, analysis of the incident,

and identification and consolidation of insights.2 Based on observations made in the course of the

reviews, a set of topical categories were identified and the final results were presented in terms of

these categories. The topical categories are based on the different elements of fire PRA methodology.

 Note that in the development of insights only qualitative arguments are used. That is, because the

incidents reviewed do not represent a complete set in any given context, no attempts are made to

derive specific statistical insights. In a very few cases broad insights associated with the apparent

relative frequency of certain types of events are drawn.

2.2 Identification of the Fire Incidents for Review

All of the fire incidents reviewed in this study occurred in the nuclear power industry. Three

categories of incidents were considered. The first category is large or severe fires. These are fires

that led to severe or widespread damage. This group reflects fires that were severe in the traditional

context of fire protection, and in particular, in the context of property protection/loss.

The second category is fires that led to a significant challenge to nuclear safety. This includes fires

that impacted more than one train of safety equipment. While there is some overlap between the first

and second categories (i.e., large fires that also challenged nuclear safety) the two sets are not

identical. In a small number of cases relatively modest fires, from a traditional fire protection

standpoint, led to significant nuclear safety challenges. An example of this is the 1975 Browns Ferry

fire. While that fire significantly challenged plant safety, it was not especially severe from a traditional

fire protection standpoint. The fire was initiated in and affected a small area within the cable

spreading room. Numerous cables within a relatively confined region of a second adjacent

compartment were also burned. However, the fire did not lead to any substantial challenge to plant

structures, nor were fire barriers seriously challenged.3 Furthermore, a number of the identified large

fires did not present serious challenges to nuclear safety.
Methodology

4

The final category of incidents is “interesting fires.” These are generally small fires that had little or

no safety impact but demonstrate some important insight into fire PRA methods and assumptions.

That is, most of the fires in the final category did not cause major damage nor challenge nuclear

safety. These incidents are included if they involved an interesting chain of events or unusual

phenomena, particularly if the observed behaviors are relevant to current areas of methodological

debate or if they involve events considered very unlikely given current methods and assumptions.

The incidents were selected for review using the information provided in a number of different

sources. Sources of information included articles published in the open literature[12-16], USNRC

documents[10,17,18], the Sandia National Laboratories (SNL) fire incident data base[19], and the Electric

Power Research Institute (EPRI) fire incident data base[20]. A large number of incidents were

reviewed during the selection process (for example, 492 in [10], 498 in [17], 354 in [19] and 753 in

[20]). It must be noted that there is considerable overlap among these data bases. The incident

descriptions provided in these sources were reviewed and a determination was made about the

applicability of each incident to the current study based on the selection criteria described above.

A comment on the completeness of the incident set chosen for review is appropriate. An attempt was

made to select as complete a set of fires leading to a significant challenge to nuclear safety as was

practical. Ultimately, the authors are confident that all such incidents have been included. With

regard to the severe fires, since the sources of information used in selecting fire incidents are focused

primarily on U.S. plants, it is not clear whether all large fires were captured. Furthermore, for a small

number of known fire incidents the authors were unable to obtain sufficient information to support

the objectives of this review, and these incidents have not been included. An example is the 1984

turbine-generator fire at Maanshan in Taiwan. This fire is covered in the study, but only in very

limited detail due to a lack of publicly available information (see Appendix 13). Based on discussions

with fire experts and cross checks with sources other than the nuclear industry itself (e.g., the

property insurance industry), it has been concluded that the majority of the large fires that have

occurred in the nuclear industry are addressed in this study.

With regard to the “interesting” fires, it is not possible to claim completeness. The selection of

interesting incidents was based primarily on the authors’ judgement supplemented by input from

colleagues and reviewers. Most certainly there are many other minor fire incidents that would

illustrate particular points of interest. The scope of this effort was simply not sufficient to attempt

to capture all such incidents. 

2.3 The Review Process 

The analysis of a given fire incident started with the collection of relevant information. In some cases,

this involved direct interaction with knowledgeable individuals. The chain of events that had occurred

was studied carefully to ensure that, to the extent possible, every detail of the specific occurrences

(events or elements of the incident) observed, the principal root causes, any special conditions

prevailing at the time of the incident, the physical characteristics of the plant and the nature and

arrangement of the plant systems were understood. Each incident was then reviewed from two
Methodology

5

perspectives. First, looking at the chronological chain of events, we asked how fire PRA would

model the specific occurrences observed. Second, looking at the different elements of a fire scenario

as modeled in fire PRAs, we asked how each of those elements was realized during the incident.

It may be noted here that the approach used in this study to select the events for review is quite

similar to the incident screening methodology proposed for the USNRC Accident Sequence Precursor

(ASP) project.[21] Both ASP project and the current study attempt to gain PRA insights from an

actual incident. In the ASP effort, an incident is considered as sufficiently interesting to warrant

analysis based on a screening process that considers incident features such as the occurrence of an

initiating event, loss of a safety system, degradation of multiple safety systems, an unusual level of

severity, observance of unique behaviors, and/or an unusual or unexpected plant response. Similar

criteria were applied to the selection of events in the current study. However, the approach used in

the current study differs from ASP study in one important area. In the current study, no attempt is

made to estimate the conditional core damage probability associated with a given event. That is, the

ASP study included methods to quantify the conditional probability of core damage given the physical

plant damage realized in the incident. The current study has made no attempts to perform an analysis

of this type.

For the current study, the first step in the analysis of an incident was to document the observed chain

of events. That is, each incident was broken down into a chronological sequence of elemental parts

(the chain of events). The available documents were carefully reviewed to ensure that each specific

occurrence observed in each incident was recorded and cataloged in the proper chronological order.

When the exact timing of an occurrence could not be established, the order of occurrence in the

overall chronology was surmised based on the information available.

Once the chain of events was established, the next step in the analysis was to examine each elemental

occurrence, or event, to assess whether or not (and if so how) a typical fire PRA would have

addressed the event. From this process many methodological elements of fire PRA were verified as

being a reasonable reflection of actual experience. In a few cases, issues, conditions, or events that

are not typically addressed in a fire PRA, or are assumed to be highly improbable, were identified.

For example, in some of the incidents an electrical upset led to ignition of fires in more than one area

of the plant. Fire PRA methods do not address multiple fires; hence, these incidents illustrate a fire

related condition that currently lies outside the scope of a typical fire PRA (see further discussion of

this topic in Sections 4.1.2 and 4.1.3).

A third step in the analysis reversed this view of the fire incidents. A fire PRA is based on a

probabilistic analysis of fire scenarios. Each fire scenario typically starts with the ignition of a

combustible material and ends with damage to some set of plant equipment. Included in the

quantification of each scenario is the likelihood that core damage will result from the fire damage,

including the impact of the fire and fire damage on operator effectiveness. Each fire scenario can be

described in terms of a set of phenomena and specific events. To support the third step in the current

analyses, a standardized list of phenomena and events that are considered in a typical fire PRA

scenario analysis was developed (see Section 2.4 for this list). This listing was then used like a
Methodology

6

CDF f

i Ped j i P

j

CD k i j

i k

=























∑ ∑ , | ∑ : | , 

checklist against the chain of events for each incident reviewed. That is, for each item in the list, the

chain of events for an incident was reviewed to see how the specific phenomena described in that item

were manifested in the actual fire incident. Insights were gained by comparing what had actually

happened to what is typically considered or assumed in a fire PRA. Thus, the current framework for

developing fire scenarios in a fire PRA was reviewed to determine whether or not the overall

framework itself, the associated analysis assumptions, and the assumed significance of each scenario

element to the outcome of the overall scenario are consistent with the experience from the actual

incidents. 

For those incidents for which sufficiently detailed information was available, and where the incident

was of sufficient complexity to warrant this treatment, the above two approaches were explicitly

documented via two matrices (e.g., see Appendix 3). One matrix compares the elements of the

incident’s chain of events to typical PRA practice. The second matrix compares the elements of a

typical fire PRA scenario to the events observed during the actual incident. Within each matrix,

significant findings are identified as appropriate.

2.4 Elements of a Fire Scenario

The main objective of a PRA is to estimate the frequency of occurrence of such adverse plant

conditions as core damage, radio-nuclide release, etc. This is done by identifying chains of events in

terms of equipment failures and human errors that may lead to a demand for safe shutdown of the

reactor, and/or compromise the ability of the plant to achieve safe shutdown. Systematic methods

are used to identify the potentially risk significant chains of events. A fire PRA is conducted by

identifying fire scenarios that may affect the safe operation of the plant (through impacts on

equipment and human actions), and estimating the frequency of occurrence of those scenarios.[1-3]

The primary output of a fire PRA is typically the estimated frequency of a fire leading to core

damage. This value, the fire-induced core damage frequency (CDF), can be expressed as the product

of three terms. These three terms are (1) the frequency of the postulated fire or class of fires (fi), (2)

the conditional probability that the postulated fire will cause damage to some set of plant equipment

(Ped,j|i), and (3) the conditional probability that given the postulated equipment damage the plant

operators will fail to recover the plant and core damage would result (PCD:k|i,j). This is expressed

mathematically as:

Each of these three terms is quantified based on the consideration of a number of specific underlying

factors. For the purposes of this study, the fire PRA process has been considered in the context of

these underlying factors. That is, this study has sought insights at a more detailed level of PRA

analysis. The definition and quantification of the underlying factors is accomplished through the

development of detailed fire scenarios as implied by the summation terms in the above expression.
Methodology

7

A fire scenario is a specific chain of events that starts with the ignition of a fire and ends either with

successful plant shutdown or core damage. The fire is postulated to occur at a specific location in

a specific fuel package and progresses through various stages of fire growth, detection and

suppression. Along the way, the fire damages some set of plant equipment (most often electrical

cables). For a given fire source, the analysis may postulate damage to different sets of equipment

depending on how long the fire burns and how large the initial fire is presumed to be. The postulated

or predicted fire damage either directly or indirectly causes an initiating event (such as a plant trip,

loss of offsite power, or loss of coolant accident (LOCA)). The possible plant responses to each

initiating event are characterized by a set of event trees (or fault trees). Each path through the tree

represents one sequence of events that may be realized depending on whether or not other random

equipment failures occur and on operator actions. Each event path ends either with recovery of the

plant to a safe state (most commonly hot or cold shutdown) or with core damage.

More specifically, the fire scenario first establishes the potential for a fire to occur in a given location

and involving a specific fire source. The scenario then follows two parallel and competing processes;

namely, fire growth, detection, suppression and eventual extinguishment on one hand and equipment

and cable exposure, component or system damage, and operator response on the other hand. The

following is a list elements, i.e., the underlying factors, considered in the development of fire

scenarios in a typical fire PRA analysis. Note that the list has been divided into three major elements

consistent with the three term model presented in Equation (1).

Fire Initiation Frequency:

Combustibles, ignition sources and ignition

S Presence of combustible materials or flammable materials 

S Presence of an ignition source

S Uniting of the fuel and ignition source and ignition of the fire 

Conditional Probability of Fire Damage:

Fire growth and propagation

S Fire growth within the combustible material or component of original ignition

S Fire propagation to adjacent combustibles

S Development of room effects (plume, ceiling jet, and hot gas layer) within the

compartment of origin

S Propagation of effects of the fire or fire effects (i.e., hot gas, flames, and/or smoke) to

adjacent compartments

Fire detection and suppression:

S Automatic fire detection

S Presence of a local automatic fire detection system

S Operability of the detection system

S Sounding of an alarm in the control room, locally and/or at other locations
Methodology

8

S Manual fire detection

S Detection by personnel in the area where fire occurs

S Operators detect/suspect fire based on plant behaviors

S Plant personnel alerted / fire notification (operators alerted, a fire incident is

declared, alarms are sounded, etc.)

S Automatic/fixed fire suppression

S Presence of a fixed fire suppression system

S Operability of the suppression system

S Automatic activation of fire suppression system

S Dispersion of fire suppressant inside the fire area

S Manual fire suppression 

S Intervention by on-scene personnel

S Activation of, and response by, the plant fire brigade

S Manual activation/recovery of a fixed suppression system

S Manual application of a fire suppressant

Equipment and cable exposure and damage

S Damage to equipment and cables by heat and smoke

S Additional damage as fire continues to burn and propagate

S Impact on plant safe shutdown equipment

S Impact of suppressant on the fire

S Electrical equipment failure from exposure to water

S Adverse impact on equipment from the cooling effect of CO2

S Flooding of compartments because of discharged fire water

Conditional Probability of Core Damage:

Independent failures

S Aggravation of safe reactor shutdown and core cooling after the occurrence of the fire

because of special plant or equipment conditions (e.g., open penetration seals) present

S Degradation in plant response because of random equipment failures upon demand or

equipment unavailable because of testing or maintenance activities

Plant and operator recovery actions

S Response of automatic systems to the effects of the fire

S Response of the operators in the control room based on indications and alarms on the

control board

S Impact of smoke or other influences on the operators

S Proper plant control by operators and safe shutdown

In reviewing each of the identified fire incidents, the above listed specific fire scenario elements were

considered. That is, insights were specifically sought in each of these identified areas. Ultimately,

insights were developed in many of these areas, though not all. This is covered in detail in Section 4.
Methodology

9

2.5 Quality and Completeness of Available Information

The information available for each of the incidents initially considered for inclusion in this study varied

from a few lines in a sketchy summary of an incident report to a full discourse with the persons who

were present at the time of the incident. It is interesting to note that even in the case of those

incidents for which a large amount of information was available, many questions remained

unanswered. Certainly, the availability of detailed information was instrumental to obtaining useful

insights and contributed substantially to the authors’ confidence in the associated findings and

conclusions. However, a lack of complete information did not pose a serious obstacle in allowing

us to glean useful insights. That is, even with relatively sketchy information on a given incident, some

interesting insights could typically be obtained. In only a very few cases were known incidents

excluded due to a lack of information. It is, however, likely that additional insights would have been

obtained and that in some areas more definitive conclusions could have been reached if more

complete information on some of the incidents had been available.

In a few minor cases conflicting information was discovered. In all such cases, mismatches did not

undermine any of the insights and conclusions cited here. As the quantity of information increased

for an incident, it became easier to understand the chain of events that took place and to discern the

reasons underlying the observed chain of events. Overall, a higher quantity of information greatly

facilitated the process of gleaning insights. Also, a higher quantity of information allowed for cross

checking of facts and findings (for example between information sources), increasing the authors’

confidence in the accuracy of the information and in the validity of our own findings and conclusions.
Selected Fire Incidents

10

3.0 SELECTED FIRE INCIDENTS

Twenty-five fire incidents are included in the current review. These incidents include both U.S. and

international incidents. Table 3-1 presents a list of the incidents included in this review. The list is

presented in simple chronological order and presents the name of the plant, country, incident date and

the basis for selecting the incident for review. Detailed descriptions of each incident and the

references upon which these descriptions are based are provided in the appendices. The numbers

provided in the first column of Table 3-1 refer to the specific appendix that provides the detailed

description and analysis of each incident reviewed. 

Table 3-1: List of incidents included in the review.

App.

#

 Plant Country Date of

Incident

 Reason for Inclusion

1. San Onofre, Unit 1 U.S. March 12,

1968

Self-ignited cable fire that led to

changes in industry’s approach to

sizing of cables (a similar Feb. 1968

fire is also considered.)

2. Muhleberg Switzerland July 21, 

1971

First known large turbine building fire

in a nuclear power plant

3. Browns Ferry, Units 1 and 2 U.S. March 22,

1975

Cable spreading room and reactor

building fire that challenged nuclear

safety and led to important changes in

USNRC fire protection regulations

4. Greifswald, Unit 1 GDR /

Germany

December 7,

1975

Switchgear and cable fire leading to

station blackout and stuck open

PORV

5. Beloyarsk, Unit 2 USSR /

Russia

December 31,

1978

Large cable fire that started in the

turbine building and spread to other

areas of the plant - caused severe

damage to the control building and

main control room panels - damaged

redundant trains

6. North Anna, Unit 2 U.S. July 3, 

1981

A severe fire involving a large

transformer that did not affect any

safety related components or electrical

circuits.

7. Armenia Nuclear Power Plant,

Units 1 and 2

USSR /

Armenia

October 15,

1982

A large cable gallery fire that severely

impacted core cooling capability,

caused a station blackout and severed

power sources to several parts of the

plant.
Selected Fire Incidents

Table 3-1: List of incidents included in the review.

App.

#

 Plant Country Date of

Incident

 Reason for Inclusion

11

8. Rancho Seco U.S. March 19,

1984

Hydrogen fire and explosion in the

turbine building

9. South Ukraine, Unit 2 USSR /

Ukraine

December 14,

1984

Cable fire inside containment that

propagated to a large area

10. Zaporizhzhya, Unit 1 USSR /

Ukraine

 January 27,

1984

Large cable fire lasting nearly 18

hours that damaged several areas of

the plant.

11. Kalinin, Unit 1 USSR /

Russia

December 18,

1984

Large fire in the turbine building

involving multiple initial fires on a

power cable.

12. Maanshan, Unit 1 Taiwan July 1, 

1985

Large turbine building fire

13. Waterford, Unit 3 U.S. June 26, 

1985

Main feedwater pump fire involving 

operator error leading to loss of

redundant trains

14. Fort St. Vrain U.S. August 16,

1987

Large turbine building fire involving

hydraulic oil that affected control

room habitability via smoke ingress

15. Ignalina, Unit 2 USSR /

Lithuania

September 5,

1988

Large, self-ignited cable fire confined

to one room that damaged a number

of cables - extinguished by the

automatic fire suppression system of

the room

16. Oconee, Unit 1 U.S. January 3,

1989

Fire in a non-safety related switchgear

led to human error in proper control

of the cooldown rate of the reactor.

17. H. B. Robinson, Unit 2 U.S. January 7,

1989

Hydrogen fire at multiple locations

during an outage because of

maintenance crew error

18. Calvert Cliffs, Unit 2 U.S. March 1,

1989

Incident with multiple initial fires

including a small fire in the control

room

19. Shearon Harris U.S. October 9,

1989

Incident with multiple initial and

secondary fires involving one of the

main transformers and electrical

equipment in the turbine building
Selected Fire Incidents

Table 3-1: List of incidents included in the review.

App.

#

 Plant Country Date of

Incident

 Reason for Inclusion

12

20. Vandellos, Unit 1 Spain October 19,

1989

Large turbine building fire that

damaged a water pipe expansion joint

which led to flooding of the turbine

and auxiliary buildings

21. Chernobyl, Unit 2 USSR /

Ukraine

October 11,

1991

Large turbine building fire caused by

back-feeding of a generator from the

grid - the roof of the turbine building

at the location of the fire collapsed

from the heat

22. Salem, Unit 2 U.S. November 9,

1991

Turbine building fire caused by

turbine blade failure and ejection

23. Narora Atomic Power Station,

Unit 1

India March 31,

1993

Large turbine building fire caused by

turbine blade failure - fire led to

station blackout and control room

abandonment for two units

24. Waterford, Unit 3 U.S. June 10, 

1995

Switchgear fire that burned the

vertical cable drop, jumped over a fire

stop, and propagated in a horizontal

tray overhead

25. Palo Verde, Unit 2 U.S. April 4, 

1996

Incident involving multiple initial

fires including a small fire in the

main control room
Insights

13

4.0 INSIGHTS

The majority of the incidents analyzed in this study were included because they caused significant

damage to some part of a nuclear power plant. However, only six of the reviewed fire incidents led

to significant challenges to nuclear safety (see Section 4.5.2). One additional event would have led

to such challenges had the plant been in operation. Other incidents were included in the study

because they demonstrated phenomena that are rarely modeled in a fire PRA, are relevant to a current

area of methodological debate, are considered unlikely or illustrate a complex chain of events.

Analysis of these phenomena revealed insights that are potentially relevant to fire PRA methods,

underlying assumptions and data. In this section, a consolidated listing of various insights and a

discussion of the potential implications for fire PRA are provided.

The presentation of insights is organized into five sections (Section 4.1 through Section 4.5) based

on the elements of a typical fire PRA analysis as discussed in Section 2.4 above. Recall that a typical

fire PRA addresses three primary topics based on the three-term model (Equation (1)); namely, the

fire initiation frequency, the conditional probability of equipment damage given the fire, and the

conditional probability of core damage given the fire-induced equipment damage. Many of the

insights gained are related to the second topical area, the conditional probability of fire damage.

Hence, insights in this area have been further divided into three sub-topics; namely, fire propagation,

fire detection and suppression, and equipment damage.

Fire initiation covers issues related to ignition of fire, fire occurrence frequency analysis, the

possibility of multiple fires from a common cause and the possibility of a fire leading to secondary

fires. Related insights are presented in Section 4.1. Fire propagation includes issues related to fire

growth, propagation to adjacent combustibles and adjacent compartments, smoke propagation and

barrier failure. Issues related to the occurrence of large fires are discussed as part of this category.

Related insights are presented in Section 4.2. Fire detection and suppression addresses the availability

and effectiveness of fire suppression systems, the possibility of fixed suppression systems being

overwhelmed by a fire and, more generally, the duration of fires. Insights in this area are presented

in Section 4.3. Insights relating to the possibility, timing and modes of fire-induced equipment

damage are discussed in Section 4.4. Section 4.5 covers insights relating to the impact of fires on

plant safety including issues related to plant response to equipment failure, fires that challenged

nuclear safety and operator actions. 

A summary of the incidents reviewed is presented in Table 4-1. This table identifies each incident,

calls out some of the salient points for each, and identifies some of the specific areas of interest

identified in the incident review. The bases of assignment of different sub-categories to each incident

are provided in the Appendices and are summarized in the sections that follow.
07-Feb-68 Penetration area

12-Mar-68 Switchgear room

2 Muhleberg Switzerland 21-Jun-71 Turbine oil system 

failure Turbine building No No No

3 Browns Ferry US 22-Mar-75 Open flame Reactor and control 

buildings No Yes* No

4 Greifswald, Unit 1 GDR 05-Dec-75 Electrical short Control building* No* No* No

5 Beloyarsk, Unit 2 USSR 31-Dec-78 Turbine oil system 

failure Turbine building No Yes (8) No

6 Fort St. Vrain US 16-Aug-80 Turbine oil system 

failure Turbine building No No No

7 North Anna, Unit 2 US 03-Jul-81 Transformer fault Yard No No No

8 Armenia NPP USSR 15-Oct-82 Short in power circuit Cable Tunnel (and 

Turbine Building) Yes Yes Yes

9 Rancho Seco US 19-Mar-84 Hydrogen release Turbine building No No No

10 South Ukraine, Unit 2 USSR 14-Dec-84 Shorts in cables Containment No Yes Yes

11 Zaporozhye, Unit 1 USSR 27-Jan-84 Electric Panel Control building No No Yes*

12 Kalinin, Unit 1 USSR 18-Dec-84 Breaker fails to open Service water pump 

area Yes No Yes

13 Maanshan, Unit 1 Taiwan 01-Jul-85 Turbine blade 

ejection Turbine building No No No*

14 Waterford, Unit 3 US 26-Jun-85 Manufacturer error Turbine building No No No

15 Ignalina, Unit 2 USSR 05-Sep-88 Cable failure Control room No No Yes

16 Oconee, Unit 1 US 03-Jan-89 Switchgear failure Switchgear room No No No

17 H. B. Robinson, Unit 2 US 07-Jan-89 Hydrogen release Turbine building Yes No No

18 Calvert Cliffs, Unit 2 US 01-Mar-89 Electrical panel and 

solenoid

Control building and 

turbine building Yes No No

19 Shearon Harris US 09-Oct-89 Bus duct ground 

fault

Turbine building and 

yard Yes Yes No

20 Vandellos, Unit 1 Spain 19-Oct-89 Turbine blade 

ejection Turbine building No No No

21 Chernobyl, Unit 2 Ukraine 11-Oct-91 Grid back feed into 

generator Turbine building No No No

22 Salem, Unit 2 US 09-Oct-91 Turbine blade 

ejection Turbine building No No No

23 Narora Unit 1 India 31-Mar-93 Turbine blade 

ejection Turbine building No No No

24 Waterford, Unit 3 US 10-Jun-95 Breaker failure to 

open Switchgear room No No No

25 Palo Verde, Unit 2 US 04-Apr-96 Short to ground Control room and 

auxiliary building Yes No Yes

Appendix #

Plant Country Date

Cable overheated

Fire Initiation

Cause of Fire

Building or Room 

of Origin

Multiple Fire

1 San Onofre, Unit 1 US No No Yes Self Ignited Cable Fire

Table 4-1 Summary of Incident Review Results (page 1 of 4)Secondary Fire

14
2 Muhleberg

3 Browns Ferry

4 Greifswald, Unit 1

5 Beloyarsk, Unit 2

6 Fort St. Vrain

7 North Anna, Unit 2 

8 Armenia NPP 

9 Rancho Seco 

10 South Ukraine, Unit 2

11 Zaporozhye, Unit 1 

12 Kalinin, Unit 1

13 Maanshan, Unit 1 

14 Waterford, Unit 3 

15 Ignalina, Unit 2

16 Oconee, Unit 1

17 H. B. Robinson, Unit 2

18 Calvert Cliffs, Unit 2

19 Shearon Harris

20 Vandellos, Unit 1

21 Chernobyl, Unit 2

22 Salem, Unit 2

23 Narora Unit 1

24 Waterford, Unit 3 

25 Palo Verde, Unit 2 Appendix #

Plant

1 San Onofre, Unit 1

Yes Yes* Yes* No No No No No No

No Yes Yes Yes No Yes Yes No No

Yes No* No* No* No* Yes Yes Yes No*

Yes Yes Yes Yes Yes Yes Yes Not Known Yes*

Yes No Yes Yes No No No No No

Yes No No* No No No No No No

Yes Yes Yes Yes No* Yes Yes Yes Yes*

Yes No No No No No No No No

Yes Yes Yes No No No (4) Yes No Yes*

Yes Yes Yes Yes No* No (4) Yes Yes(4) Yes*

Yes No* No* No No No No No No

Yes No* No* No* No* No No No No

No No No No No No No No No*

Yes No No No No Yes Yes No No*

No No Yes Yes No No (3) No No No

No No No No No No No No No

No No No Yes* No No No No No

No No No No No No No No No

Yes No Yes Yes No Yes Yes No No

Yes No No No No Yes Yes No No

Yes* No No* No No No No No No

Yes Yes Yes Yes Yes Yes Yes Yes Yes

No No Yes No No No No No No

No No No Yes (7) No No No No No Smoke Propagated to Other Severe Fire (1) Fire Propagated Compartments to Other Compartments

No

Nuclear Safety

Table 4-1 Summary of Incident Review Results (page 2 of 4)

No No

Fire Protection

No No No* No No Smoke in the Control Room Control Room Evacuation

Challenging Fire 

(2)

Multiple Safety 

Systems 

Impacted

Loss of All Core 

Cooling for Some 

Period

Loss of All 

Instrumentation

No

15
2 Muhleberg

3 Browns Ferry

4 Greifswald, Unit 1

5 Beloyarsk, Unit 2

6 Fort St. Vrain

7 North Anna, Unit 2 

8 Armenia NPP 

9 Rancho Seco 

10 South Ukraine, Unit 2

11 Zaporozhye, Unit 1 

12 Kalinin, Unit 1

13 Maanshan, Unit 1 

14 Waterford, Unit 3 

15 Ignalina, Unit 2

16 Oconee, Unit 1

17 H. B. Robinson, Unit 2

18 Calvert Cliffs, Unit 2

19 Shearon Harris

20 Vandellos, Unit 1

21 Chernobyl, Unit 2

22 Salem, Unit 2

23 Narora Unit 1

24 Waterford, Unit 3 

25 Palo Verde, Unit 2 Appendix #

Plant

1 San Onofre, Unit 1

Last Damage

Fire Under 

Control

Fire Out

No -- -- <0:05

No* -- -- 0:39

No Yes -- -- 2:07 Yes No No

Yes No* 5:10 6:55 7:25 Yes Yes No

No* No* -- -- 1:32 Yes* No* No*

No* Yes -- 17:05 21:40 Yes No* No

No No 0:09 -- 0:16 Yes No No

Yes Yes* -- 1:00 >1:00 Yes Yes Yes

Yes No 2:50 6:05 7:03 Yes No No

No No* -- -- 0:14 No Yes No

Yes* No -- -- 8:00 Yes No No

No* No -- -- 17:50 Yes Yes No

No* No -- 1:46 2:52 Yes Yes No

No* Yes* -- -- 10:00 Yes No No*

No No -- -- 0:10 Yes Yes No

No* No 0:18 -- 0:38 No Yes No

No No -- -- 0:59 Yes No No

No No -- -- very short Yes* No No

No No -- -- very short Yes No No

No No -- -- 2:40 Yes Yes No

No Yes 1:54 3:51 6:21 Yes Yes Yes

Yes Yes -- 3:31 6:10 Yes No* No

No No* -- -- 0:15 Yes Yes No

No Yes 0:30 1:30 9:00 Yes No* No

Yes No 0:10 1:24 2:37 Yes No* No

No No -- -- very short Yes No* No

Table 4-1 Summary of Incident Review Results (page 3 of 4)

Indications of 

Spurious Equipment 

Actuation

Included Some 

Strucural Damage (5)

Fire Detection and Suppression

Time to . . . . [hr:min] (6)

Manual 

Suppression 

Used

Automatic 

Suppression 

System

Suppression 

System 

Overwhelmed

No Yes No No

16
Notes for Table 4.1:

Table 4.1 Summary of Incident Review Results (page 4 of 4).

(3) The Oconee fire is not classified as challenging because no safety systems were 

lost to the fire itself. However, an operator error did lead to an overcooling transient.

(4) At the time of the fire, the plant was not yet in operation. Had the plant been in 

operation, a severe nuclear challenge would have been experienced in the judgement 

of the authors.

(1) "Severe" is in the context of traditional fire protection; that is, a severe fire impacts 

a large area or caused extensive damage 

(2) "Challenging" is in the context of nuclear safety; that is, a fire is challenging if it 

created a demand for safe shutdown systems and rendered such systems unavailable

(7) In this case, the smoke observed in the control room was due to the small 

simultaneous fire that occurred there rather than due to movement of smoke about the 

plant.

(8) The secondary fire at Beloyarsk involved the explosion of an oil-filled transformer. 

The exact cause of this event is not known.

* - Entry is based on the judgement of the authors

(5) Structural damage is defined as deformation or collapse of a structural element.

(6) All time periods reported here are measured from the moment that some indication 

of an abnormal condition was received by plant personnel.

17
Insights

4Practically all fire events analyzed in this study involving a Soviet-designed plant occurred

before the break-up of the Soviet Union. Therefore, these plants are referred to as Sovietdesigned plants.

18

4.1 Fire Initiation

4.1.1 Self-ignited Cable Fires

Electrical cables are often considered as a source of fires in fire PRA because they carry electric

power (a potential source of ignition) and are constructed of materials that can sustain combustion.

A fire that initiates from a cable, either due to a fault in the cable or due to a current overload, is

referred to as a self-ignited cable fire. Special precautionary measures are incorporated in the design,

selection and installation of cables in nuclear power plants that will tend minimize the probability of

such events (i.e., limits on ampacity (current carrying capacity) and requirements to use low-flamespread cables in new installations). Self-ignited cable fires are commonly assumed to be very low

probability events. Therefore, occurrence of such fires is of particular interest.

Self-ignited cable fires have occurred at San Onofre in the U.S., and at various Soviet4-designed

plants (e.g., Armenia, Kalinin, South Ukraine and Zaporizhzhya). The Palo Verde fire reviewed in

this study may also be considered a self-ignited cable fire. The Browns Ferry (1975) fire may also

have included a secondary fire (in the main control room, see Section 4.1.3 for a description of this

secondary fire) that can be categorized as a self-ignited cable fire. It appears that in all cases the

ignition was the result of either a cable electrical design overload (i.e., inadequate cable design),

mechanical damage to cables or excessive current due to other electrical faults. It is interesting to

note that, as shown by the fire incident at Ignalina, a self-ignited cable fire may occur in circuits with

a voltage level as low as 220VAC.

The incidents reviewed in this study involving self-ignited cable fires at Soviet-designed reactors

caused substantial to very large fires (i.e., they were not minor fires). In some cases the fires

ultimately impacted a large collection of cables and/or plant areas, and had a major impact on the core

cooling capability. Of the U.S. incidents known to the authors, only the San Onofre (3/1968) fire

has shown significant fire propagation beyond the initiating cable. In that case it was reported that

three horizontal stacked cable trays were burning at the time that the fire brigade arrived on the scene

(several minutes after the apparent time of ignition). The fires observed in the other U.S. incidents

have all remained very small (i.e., the ensuing fires have not propagated beyond the initiating cable).

None of the self-ignited cable fires in U.S. plants led to a substantial nuclear safety challenge.

This sharp difference between the U.S. and Soviet experience indicates that there are likely substantial

differences between the U.S. and Soviet plants that are impacting this behavior. It can be argued that

if significant differences did not exist, that is, if the frequency and behavior of self-ignited cable fires

were similar, then based on the experience in Soviet designed plants there should have been several

occurrences of substantial self-ignited cable fires at the U.S. plants by now. This is because U.S.
Insights

5Note that Task 3 of the USNRC/RES Fire Risk Methods research program, JCN Y6037,

is specifically addressing the question how self-ignited cable fires are treated in fire PRA.[11]

19

nuclear power plants have logged close to three times as many reactor-years as have plants in the

former Soviet Union. Hence, one would nominally anticipate several significant self-ignited cable

fires in U.S. plants if the factors leading to the initiation and growth of such fires were substantially

similar. The available evidence contradicts this; hence, there is likely some substantial differences

between the U.S. and Soviet-designed reactors that would account for this difference. The

differences are likely rooted in cable manufacturing and materials selection, installation and

maintenance practices, and electrical design characteristics. Based on this argument, one can

conclude that the Soviet reactor experience relating to self-ignited cable fires may not be directly

relevant to plants in the U.S. and should be extrapolated with caution.

Very few events involving self-ignited cable fires were identified in the initial screening of fire

incidents for this study. This nominally confirms, at the least for U.S. plant applications, the basic

understanding in fire PRA that such fires are low frequency events. It is also noteworthy that San

Onofre, apparently the only plant in the U.S. that has experienced a propagating self-ignited cable fire,

was a relatively old plant (commercial operation began in 1968 and the plant is now permanently shut

down). San Onofre was constructed before the development of the cable flammability standards

currently applied to U.S. reactor cables (the flammability test included in IEEE-383).[22] This

nominally confirms typical fire PRA assumptions that a propagating self-ignited cable fire is more

likely to occur in older style cables than in modern low-flame-spread cables. The San Onofre

experience does illustrate that, at the least for the older style pre-IEEE-383 cables, the possibility of

a self-ignited cable fire with the potential to propagate to nearby fuels (e.g., nearby cable trays)

cannot be dismissed. The fact that several significant self-ignited cable fires involving Soviet-designed

plants were identified is perhaps of greater interest to PRA analysts working with non-U.S. plants

than it is to U.S. plants. Overall, current methods of analysis are capable of dealing with such fires,

but the underlying assumptions and methods of analysis may warrant further review.5

4.1.2 Simultaneous Ignition of Multiple Fires

All current fire PRAs are conducted based on the assumption that, at any given time, only one fire

ignition will occur. This has been recognized in past reviews as a potential weakness of existing

methods.[23] Although, some fire PRA methodology sources have addressed multiple fires (e.g.,

Reference [24] uses the methodology presented in Reference [25] for this purpose), it has commonly

been assumed that the occurrence of multiple fires, while possible, is a very low probability event.

Several of the incidents reviewed here involved simultaneous ignition of multiple fires. That is, fire

appeared at two or more distinct plant locations, within a very short time period, due to a single root

cause. Most of the current methodologies do not address the occurrence possibility of multiple

simultaneous fire incidents because there is no basis established for predicting under what conditions

such fires might occur.
Insights

20

Several incidents (Armenia, Kalinin, South Ukraine, H. B. Robinson, Palo Verde, Shearon Harris and

Calvert Cliffs) demonstrate that multiple fires can occur. The common element in most of these

incidents is a common electrical connection. Since an electrical circuit may be connected via cables

to several items in different and potentially remote compartments, a circuit fault that impacts the

cables may impact several locations. Case examples identified in this review are as follows:

S In the cases of Palo Verde and Calvert Cliffs, a short in a circuit led to sparks, smoke and

signs of ensuing fire ignition at two separate locations that were considerably far apart but

were linked by the same faulty electrical circuit. In both incidents, the fires remained very

small and did not propagate substantially. Also in both incidents, one of the areas effected

was the main control room.

S During an outage at H. B. Robinson, because of a maintenance crew error, a high pressure

hydrogen gas source (the generator hydrogen) was connected to the plant air system. The

air system was being used at various points to power air tools and other applications. As a

result, several minor fires were ignited in the turbine building. This is the only identified

multiple fire incident that did not, at some level, involve a common electrical circuit.

S The fire at the Armenia plant was caused by a faulty breaker in a power circuit. This fault

caused a power cable to overheat and catch fire at several places in more than one room.

This led to rapid propagation of the fire into two adjacent rooms and the loss of many of the

plant power, instrumentation and control cables.

S At Kalinin, there were three ignitions on three different items at three different locations.

When control circuits and breakers failed, a service water pump motor started rotating in the

wrong direction and started sparking. This led to a cable fire nearby. Also, a switchgear

cubicle associated with the pump caught fire. Finally a 6 kV power cable inside the turbine

building feeding the switchgear caught fire at several locations along its length. In this case,

all ignitions took place inside the turbine building, and the common link was association with

the same electrical system.

S At Shearon Harris, ground faults near the “B” main transformer eventually led to three

different fires at two general locations. Two of these fires are regarded as simultaneous fires

(the third is considered a secondary fire, see Section 4.1.3). The ground fault caused low

voltage bushings in the transformer to crack spilling transformer oil which ignited. The

electrical disturbance cascaded to the transformers neutral conductor which was not designed

to withstand the imposed voltage. Electrical current arced through an insulating tape opening

holes in the generator hydrogen piping. This led to a hydrogen leak and fire. 

The identification of several incidents in which there were multiple initial fires suggests that the

statistical frequency of these incidents may not be as low as previously assumed. Hence, it may be

appropriate to further investigate incidents of multiple fire initiations to better understand the

circumstance that lead to such fires, and to more clearly define the potential risk implications. If the
Insights

21

risk implications are potentially significant, then some development of appropriate analysis methods

would also be needed.

4.1.3 Secondary Fires

Secondary fires are considered as distinct from multiple initial fires (see Section 4.1.2 above). Note

that the simple or direct spread of fire from one fuel package to another (for example, from one cable

tray to another adjacent tray) is not classified as a secondary fire ignition. Rather, a secondary fire

as defined here is a fire ignited as the result of some mechanical or electrical failure caused by the

initial fire. Case examples identified in this review are as follows:

S In the Armenia fire, a generator and start-up transformer caught fire due to shorts caused by

the initial fires in the cable galleries. The generator breaker closed due to cable faults and

allowed the generator to rotate in the motor mode. The start-up transformer exploded and

the generator failure led to a turbine oil fire that damaged a significant area of the turbine

building. In this incident the secondary fires were very severe. 

S At South Ukraine a cable fire started inside the containment due to mechanical damage to

power cables (the initial fire). In addition, relay coils were found burning in panels outside

of the containment (a set of secondary fires). The fires involving the relays were attributed

to fire-induced shorts in the associated control cables within containment. In this case, the

secondary fires did not propagate and had little impact.

S Also at South Ukraine, secondary fires were ignited in rooms adjacent to the initial fire room

within the containment. In some of these cases, there was apparently no direct flame spread

path and the secondary ignitions are attributed to the spread of hot gasses alone. It is

postulated here that the hot gasses caused failure of energized cables in the adjacent space,

and the resultant arcing was sufficient to ignite the cables. This would be consistent with test

data from Sandia National Laboratories (SNL).[26] In the SNL tests it was observed that cable

electrical shorting led to ignition of the cables during air-oven tests. The SNL report

concluded that the failure of an energized electrical cable might lead to fire propagation. This

incident appears to confirm this observation.

S In the Browns Ferry (1975) fire a large number of cables associated with penetrations

between the cable spreading room and the reactor building burned. There are indications in

the congressional record that a small secondary fire was ignited in the main control room.[27]

The fire was apparently quite minor, and was quickly suppressed by an operator, who

reported seeing smoke coming from the panel, using a hand-held extinguisher. This

secondary fire had no apparent impact on the chain of events observed. Cables shorting in

the larger fire may have led to current overloads on a cable leading into the main control room

panels and in turn to a secondary fire.
Insights

22

S At Shearon Harris, in addition to multiple simultaneous fires (see Section 4.1.2), the hydrogen

fire (caused by the initial electrical disturbances) impinged on the generator housing leading

to a secondary oil leak and fire.

S At Beloyarsk, while the primary fire was associated with burning turbine lube oil that spread

into a cable shaft and the control building, at one point an oil-filled transformer also ruptured

and the oil caught fire igniting additional cables in the area. The cause of this secondary

transformer fire is not known (possibilities would include direct fire exposure or electrical

faulting).

Secondary fires, similar to multiple fires (see Section 4.1.2), are not modeled in a fire PRA. Most

current methodologies do not address this issue. There is currently no basis for estimating when, how

often, and where secondary fires might occur. Without such a basis, PRAs will be unable to

quantitatively assess the risk implications of secondary fires. It may be noted that if a methodology

existed for identifying secondary (or multiple initial) fire scenarios, current fire PRA methods could

be used to establish their plant impact and risk significance. Given that a number of such cases were

identified, a study to assess the potential risk implications, similar to that recommended for multiple

initial fires in Section 4.1.2 above, may be appropriate.

4.1.4 Fire During an Outage 

During a major outage, when the reactor is in cold shutdown, a plant’s configuration is commonly

altered to accommodate repair and maintenance activities. Under such conditions, the fire risk profile

is quite different from the conditions of normal plant power operation. For example, the

H.B. Robinson, January 7, 1989 incident demonstrates that new hazards may be introduced into the

plant. In this incident, a hydrogen source was erroneously connected in such a way that hydrogen

back-fed into the plant compressed air system. This error created a potential for hydrogen explosion

and fire at several locations of the plant that would otherwise be considered free of major

combustibles. Several small fires were observed, though none was ultimately significant. This

scenario could only happen during an outage when the turbine is shutdown. Relatively few shutdown

fire PRAs have been performed to date. In a shutdown fire PRA it may be appropriate to consider

the possibility of such special conditions and the potential for introduction of fire sources and fuels

not present during power operations.

4.2 Fire Propagation

4.2.1 Barrier Failure and Room-to-Room Fire Spread

The incidents reviewed illustrate that fire can spread past fire barriers, including room-to-room fire

spread, even when the initial fire is not overly severe. Case examples identified in this review are as

follows:
Insights

23

S At Waterford 3, a non-safety related switchgear fire propagated up along a vertical cable riser

and then horizontally along an intersecting cable tray. The fire stopped its progress on the

horizontal trays at a fire stop constructed within the cable tray. However, a similar fire stop

existed in the vertical section of the cable trays that proved to be ineffective. The fire

propagated past this barrier. (This case did not involve any room-to-room spread of the fire.)

S From the information available on the cable fire at Zaporizhzhya, it can be inferred that at one

point the fire overwhelmed existing and intact fire barriers and propagated to adjacent areas.

S During the fire at South Ukraine hot gases and flames damaged the seals in the ceiling of the

initial fire compartment, opened a path for fire spread and caused the cables in the upper

compartment to start burning. Also at South Ukraine fire spread to an adjacent compartment

apparently due to the spread of hot gasses alone rather than via a direct path of flame

propagation (see Section 4.1.3 for further discussion of this behavior).

S At Armenia, open hatchways, open doors and unsealed cable penetrations allowed the fire to

propagate from the cable gallery into a cable shaft.

S At Browns Ferry, the fire initiated in the cable spreading room and initially involved the

readily combustible and exposed polyurethane foam of an incomplete cable penetration seal.

The fire propagated immediately through a gap in the penetration seal into the adjacent

reactor building. This spread was enhanced by air flow through the penetration seal gap

caused by the negative pressure in the reactor building. In this case the penetration seal was

not complete (i.e., the seal was still under construction and lacked non-combustible cover

panels). Hence, the implications for a completed seal system cannot be directly inferred.

S At Beloyarsk, the fire began in the turbine building and propagated into the adjacent control

building via open cable penetrations and other openings. In the control building, the fire

propagated upwards inside cable shafts and spread through open cable penetrations and

leaking or open doors and hatches into various adjacent areas. The fire also propagated into

the control panels of the Main Control Room (MCR) and caused damage there.

In fire PRAs it is assumed that all barriers are designed and constructed properly and that they can

confine the effects of a fire such that the likelihood of propagation beyond the barrier is very small.

This assumption is typically verified by a walkdown of the plant conducted in the early stages of a fire

PRA. In fire PRAs barrier failures are modeled probabilistically. That is, a typical fire PRA will

assume a nominal random failure probability for a fire barrier element given a substantial fire exposure

(typically a value of on the order of 0.01 is cited as a conservative estimate of the probability of

failure per demand). The incidents reviewed in this study point out that some attention to the specific

condition of the barriers (e.g., incomplete or degraded barrier seals and left open doors) is warranted.

Plant walkdowns should be able to identify these special conditions.
Insights

24

Several of the fires reviewed involving Soviet-designed plants experienced significant room-to-room

fire spread. It is concluded, however, that these incidents are not proper examples of the anticipated

behavior in U.S. plants. In these specific incidents unsealed or poor quality cable penetrations were

cited as a significant factor in the observed fire spread. In one case (Armenia) open doorways and

hatchways were also cited as contributing to fire spread. The only case of room-to-room fire

propagation experienced to date in a commercial U.S. reactor is the 1975 Browns Ferry fire. In this

case, the spread of fire from the cable spreading room into the reactor building is directly attributable

to the incomplete nature of the cable penetration seals at the time of the fire and the air pressure

difference between the two sides of the wall. The experience of the authors would support a

conclusion that there is much more attention to detail paid to fire barrier penetration seals in the U.S.

While there is a statistical likelihood that a fire barrier penetration might be found degraded or

missing, the experience in the Soviet-designed plants illustrates far more significant problems in this

regard than that experienced in the U.S. It should also be noted that the current operators of the

Soviet-designed plants now recognize the importance of intact and quality fire barriers to plant safety.

Considerable effort has been, and is being, expended to ensure that fire barrier penetrations are

appropriately sealed at reactor sites in the former Soviet Union.[28]

Fire PRA methods are capable of identifying potentially risk significant room-to-room fire

propagation or fire damage scenarios. Most fire PRAs will include a specific analysis of room-toroom fire scenarios. In most cases in the U.S., these scenarios are ultimately found to be of little risk

significance. In part, this can be attributed to typical practice with regard to defining fire zones and

fire areas. The defined fire zones or fire areas often encompass several inter-connected

compartments. As a result, a fire analysis involving such fire zones or areas may inherently include

the possibility of fire propagation to several compartments. It would appear that the adverse

experience in the Soviet designed reactors can be attributed to a lack of attention to sealing

penetrations and maintaining fire barriers intact (e.g., open doors and open hatchways). Considerable

attention is given to the topic of fire barriers and penetration seals in U.S. reactors.[29] Also, an

integral part of fire PRA methodology is a detailed walkdown of the plant. Communication paths

among compartments and often the as-built condition of the fire barriers are specifically addressed

in those walkdowns. Also, the possibility of hot gas layer propagating from one compartment to

another is included in fire PRA methodology (e.g., Reference [3] addresses this issue). Hence, it

appears reasonable to conclude that current methodology for the analysis of room-to-room fire spread

in U.S. reactors is adequate.

4.2.2 Propagation of Fire Effects to Adjacent Compartments

Several fire incidents addressed in this study included propagation of fire effects (e.g., hot gases

and/or smoke) to areas of the plant other than the compartment where the fire originated. (This

section will address the spread of smoke and heat between general plant areas. See Section 4.2.1 for

a discussion of the spread of actual fire past fire barriers and Section 4.2.3 for a specific discussion

of smoke movement impacting the main control room). Indeed, in many of the major incidents

reviewed there was some substantial propagation of smoke to adjacent areas. In the cases involving

Soviet-designed reactors, the lack of, or deficiencies in, fire barriers and barrier penetration seals was
Insights

25

a significant contributing factor to fire, heat, and smoke spread from compartment to compartment.

Case examples identified in this review are as follows:

S At Muhleburg, dense smoke spread throughout the turbine building. Ultimately, the longterm indirect impact of the fire was considerably more extensive than direct heat damage.

The hydrochloric acid vapors generated in the process of burning PVC cable insulation and

interaction with moisture impacted a large set of equipment. Ultimately some of the

electronic equipment, pump motors, 380VAC motor control centers, switchgear and some

of the mechanical equipment had to be replaced because of chloride deposits and corrosion.

S During the Browns Ferry fire, parts of the reactor building remote from the fire were filled

with dense smoke such that several attempts to manually adjust valves failed.

S At Beloyarsk, the fire started in the turbine building and rapidly propagated into several areas

in the control building (as noted in Section 4.2.1 above). Smoke spread through the various

rooms hampered fire fighting efforts.

S At Armenia, the fire initiated simultaneously in two compartments. However, open

hatchways, open doors and unsealed cable penetrations allowed the fire to propagate to a

cable shaft and ultimately allowed smoke to enter the control room.

S At South Ukraine during the containment fire, two propagation scenarios are of particular

interest. First, hot gases propagated from one compartment, via openings, into an adjacent

compartment and caused the cables in the second compartment to catch fire. No direct path

for flame spread apparently existed. In this study, it has been surmised that the secondary

ignition may have been the result of arcing in thermally failed energized cables. Second, hot

gases and flames damaged seals in the ceiling of the source compartment, opened a

propagation path, and caused the cables in the upper compartment to start burning.

S At Zaporizhzhya, the fire started at or near an electrical cabinet. It propagated, via burning

cables, into cable shafts. The cable penetration seals were not complete or were intentionally

opened for maintenance at the time of this incident (the plant was still under construction).

Also, from the information provided, it appears that at one point the fire overwhelmed

existing intact fire barriers and propagated to adjacent areas. The fire propagated to a large

number of areas and affected almost all elevations of the control building.

S At Vandellos, where ejected turbine blades caused a rupture in several oil lines and a large oil

and hydrogen fire, smoke from the turbine building fire entered the control room and several

other parts of the plant. Automatic fire suppression systems were activated in areas remote

from the actual fire due to smoke. Furthermore, plant personnel had to wear self-contained

breathing apparatus (SCBA) to enter certain areas of the reactor building to manually adjust

flow control valves (note that these manual actions were successful as discussed further in

Section 4.5.4).
Insights

26

S At Narora, where similar to Vandellos, ejected turbine blades caused an oil spill and fire, the

fire propagated along a set of cable trays towards a wall separating the turbine-generator area

from a control equipment room. Because of ineffective fire barriers, the fire entered the

control equipment room.

S At Waterford (1995) a dense plume of smoke reportedly billowed out of the switchgear room

where the fire was burning when the door to that room was opened.

For the Soviet-designed reactors smoke spread was a significant factor in each of the fire incidents

reviewed in this study. It was also a significant factor in the Vandellos and Narora fires as well. The

primary impact of smoke spread was the hampering of operator recovery actions and fire fighting

activities. In one case, the spread of heat and smoke alone is attributed with causing fire spread to

an adjacent compartment. The U.S. experience also includes incidents where smoke has propagated

from the room of fire origin to other plant areas. However, none of the cases in U.S. reactors led to

significant damage or other adverse effects, although some hampering of operator actions is evident

(e.g., Browns Ferry and Section 4.2.3 below). 

The incidents, both in the U.S. and abroad, demonstrate that the propagation of smoke from one area

to another can have a significant impact on the progression of the events. Several incidents led to the

ingress of smoke into the main control room, although only one case (Narora) actually led to control

room abandonment (see Section 4.2.3). 

Smoke movement is not explicitly modeled in current fire risk assessments. While there are models

available that can predict smoke movement, these models are not typically applied to nuclear plant

risk assessments. As mentioned above, smoke prevented mitigative actions in the Browns Ferry fire

and complicated recovery actions during the Narora and Vandellos fires. Current PRA

methodologies, through human error analysis, have provisions to address this issue.

In the specific case of smoke movement and fire suppression actuation, as a result of the USNRC

attention to the issue of adverse environmental effects on fire suppression systems[30], few fire

suppression systems in the U.S. are currently designed to actuate on a smoke detector signal alone.

Hence, actuation would typically require that a substantial quantity of heat find its way from room-toroom (to activate a fusible link or other heat detector). This review is inconclusive on this particular

problem. As noted above, in the case of Vandellos fire suppression systems in areas not directly

involved in the fire were activated. It would appear that smoke movement and smoke detectors were

the cause of these actuations.

4.2.3 Smoke in the Control Room

In several incidents, both in U.S. and non-U.S. plants, smoke has entered the control room as a result

of fires elsewhere in the plant. In some cases the smoke does appear to have affected the operators’

effectiveness. Case examples identified in this review are as follows:
Insights

27

S At Browns Ferry, some smoke from the cable spreading room did enter the control room.

Short term air packs were available for the operators. An air hose was brought in to pump

fresh air into the control room. Operator actions were not seriously impacted.

S At Beloyarsk, where the fire started in the turbine building and propagated into the control

building, the smoke in the control room was so heavy that it adversely affected the operators.

There were also reports that the fire actually propagated to the control room and caused some

damage there. However, the operators were ultimately successful in preventing any core

damage. The actions that the operators took and the locations of those actions are not

provided in the available information. It does appear that at least some operators did man the

control room throughout the event.

S At Fort St. Vrain smoke from the turbine building fire found its way into the main control

room. The smoke was initially drawn in through ventilation system intakes located in the

turbine building. The ventilation system was switched to smoke purge mode which isolated

this source, but smoke continued to enter the control room. The smoke did not lead to

control room evacuation and apparently did not cause any significant adverse effects on the

operators. Breathing apparatus was available for the operators, although some reports state

that not enough masks were available so they had to be shared between operators.

S During the Armenia fire, smoke entered the control room via a cable shaft. Although the

operators remained in the control room at all times and continued to monitor and control the

plant, the smoke apparently was relatively dense and made habitability difficult.

S At Zaporizhzhya, smoke apparently spread to most areas of the control building including the

main control room. The plant was not in operation at the time of the fire so there was no

impact on plant operations.

S At Oconee 1, a non-safety related switchgear caught fire and caused damage to the integrated

control system (ICS) and tripped several important, but non-safety related, pieces of

equipment. One report states that smoke found its way into the control room and affected

the control room operators.[31] This reference states that the burden on the operators was not

inconsequential because of integrated control system failures, presence of the fire in the plant,

smoke in the control room and other problems. 

S Reports of the fire at Calvert Cliffs do cite smoke in the main control room as one factor that

contributed to the operator error that led to the overcooling transient. No information is

provided as to how, nor how much, smoke made its way into the control room.

S During the Vandellos fire, the control room ventilation system drew in smoke-laden air from

the turbine building. Smoke entered the control room in the first few minutes of the fire.

SCBAs were made available to the operators, but no one felt the need to wear them indicating

that the quantity of smoke must have been relatively low. In a short time, plant personnel
Insights

28

provided portable fans for the control room, pumped fresh air into that room and cleared the

room of smoke.

S At Narora, smoke entered the main control room through a ventilation system connection

with the turbine building and from a fire inside the control equipment room that was adjacent

to the control room. Smoke ingress took place rather rapidly. The operators had to leave

the main control room about 10 minutes into the accident and were not able to re-enter for

about 13 hours.

In the incidents reviewed, with the exception of Narora, the operators managed to take the proper

actions from the control room despite adverse environmental conditions. In a typical fire PRA it is

assumed that if smoke enters a compartment, no credit can be given to operator actions within that

compartment. In the case of the control room, few fire PRAs have explicitly considered smoke

ingress into the main control room from fires outside the control room, although the impact of smoke

arising from fires initiated in the main control room is explicitly considered.

It appears that the typical PRA treatment of operator actions in general plant areas impacted by

smoke (i.e., not crediting such actions) would be conservative when applied to actions that take place

in the control room. The experience demonstrates that even given significant smoke ingress into the

control room, operators can continue to operate the plant from the control room. However, it would

also appear that smoke ingress into the control room from general plant fires is more likely than is

inherently assumed in current fire PRAs. Several incidents involved substantial smoke ingress, and

some the use of self-contained breathing apparatus (SCBA) by operators. In a number of these cases

some operational difficulties are reported as a result of smoke in the control room. However, only

under very severe conditions did smoke alone lead to main control room abandonment (i.e., Narora).

Fundamentally, existing human reliability methods are capable of dealing with smoke and donning of

SCBA as performance shaping factors (this is discussed further in Section 4.5). What is lacking is

a basis for predicting when and how much smoke might find its way into the main control room in

any given fire incident and specific guidance regarding modification of human error probabilities to

reflect smoke effects or use of SCBA. Typical PRA practice assumes that fires outside the control

room will have no impact on operator reliability for actions that take place in the main control room.

The experience appears to contradict this assumption. That is, the experience shows that smoke from

ex-control room fires may well reach the control room and may lead to some increase in the

probability of human error.

No fire PRA known to the authors has postulated that smoke ingress into the main control room from

an ex-control room fire could lead to abandonment and use of alternative shutdown. Rather, main

control room abandonment scenarios typically arise from a fire-induced loss of control functions (due

for example to a fire in a cable spreading room) and/or due to smoke from fires within the main

control room itself. The Narora incident in particular illustrates that a large plant fire may cause

control room habitability problems even if the fire is outside the main control room. Clearly, plant
Insights

29

specific configuration features (such as ventilation intake locations, ventilation strategy, and proximity

of the control room to the fire) would impact this potential.

4.2.4 Large Turbine Building Fires

All of the more severe fires reviewed in this study, with the exception of Browns Ferry fire and

certain cable fires at nuclear power plants in the former Soviet Union (see Section 4.2.5), occurred

on the power production side of the plant, and most of these occurred inside the turbine building.

Turbine blade failure leading to lube oil line rupture is the root cause of the most significantly

damaging turbine building fires (e.g., Salem, Vandellos, Maanshan, and Narora). In some cases the

release of hydrogen also played a role (e.g., Vandellos and Maanshan). Fort St. Vrain and Muhleberg

involved a leaking oil system that eventually led to a large fire. In two cases (Armenia and Chernobyl

2) the off-site power grid back-fed into a turbine generator causing bearing failure, lubricating oil

spills and fire in the turbine building. In the case of Armenia, the turbine hall fire was actually a

secondary fire caused by short circuits induced by the initial cable fire.

The presence of large quantities of oil and hydrogen are important contributors to the severity of the

reviewed turbine building fires. Very large quantities of hot oil may be released into the turbine

building in a very short time period. In several cases, the installed fire suppression systems were

unable to control the fires. Spillage of the oil also plays an important role in the progression of the

fire in that oil cascading from the point of the spill to other areas was a factor in some of the incidents

(e.g., Vandellos). 

The majority of large turbine building fires identified in this review have occurred outside the U.S.

Fundamentally, the main features of turbine buildings are similar between U.S. and foreign plants.

Therefore, non-U.S. incidents should be considered as applicable to U.S. plants. These incidents

illustrate that the consequences of fire in the turbine building can be substantial in terms of the amount

of equipment damaged, smoke generation, smoke propagation to other areas, and threats to the

structural integrity of the building itself. However, they also illustrate that not all such fires will

present a significant challenge to nuclear safety. For example, while the Vandellos fire caused

extensive damage and ultimately led to permanent closure of the plant, the fire presented few nuclear

safety challenges. In contrast, the Narora fire illustrates that turbine building fires can, under different

circumstances, present a severe challenge to nuclear safety. (See Section 4.5 for a further discussion

of fires leading to nuclear safety challenges.)

In fire PRAs, the risk significance of turbine building fires has been found to be highly plant-specific.

In many plants, there is little or no safety related equipment and no important cables inside the turbine

building. In these cases, the turbine building is generally screened out as being risk insignificant.

However, other analyses have identified turbine hall fires as risk significant (e.g., the Millstone and

Quad Cities IPEEE fire analyses).[6] In general, the perception among fire risk analysts has been that

turbine building fires, while potentially severe from a traditional fire protection perspective, are

unlikely to be risk significant. This perception is clearly undergoing some appropriate change.
Insights

30

The incidents reviewed in this study indicate that it may be prudent to pay more attention to the

turbine building than is typical of current practice. One may need to examine the potential that a very

severe fire, potentially impacting adjacent compartments, may cause structural damage to the turbine

building itself. This may impact on other adjacent structures. The incidents also demonstrate a

potential for failure of large components nominally considered invulnerable to fire damage leading

to other hazardous conditions (e.g., failure of a large water pipe joint and subsequent flooding of the

turbine building and reactor basement as occurred at Vandellos). Finally, the incidents illustrate that,

depending on the plant configuration, a turbine building fire may lead to a station blackout.

Therefore, it appears appropriate for a fire PRA to pay special attention to the possibility of severe

turbine building fire incidents, and to the potential chain of events that may ensue. 

4.2.5 Significant Cable Fires

Several fires have occurred involving a large quantity of cables. The fires of this type reviewed in this

study did cause the unavailability of a large number of safety related systems and equipment. The

only such incident in the U.S. is the fire at Browns Ferry (1975). As noted above, in classical fire

protection terms, the Browns Ferry fire was not especially severe; that is, the fire remained confined

to a relatively small area and did not threaten either the plant structure nor the intact fire barriers.

The Browns Ferry fire is considered significant because it led to a significant challenge to nuclear

safety. Outside the U.S. however, several severe cable fires have occurred. Prominent among these

fires are incidents at plants in the former Soviet Union (Armenia, Beloyarsk, South Ukraine,

Zaporizhzhya, and Ignalina).

The fire at Browns Ferry demonstrates that given a sufficient initial source of readily combustible fuel

(the polyurethane foam in this case) in close proximity to a large concentration of cables in open cable

trays, a self-sustaining and propagating cable fire may result. In this case the fire did propagate both

horizontally and vertically igniting and damaging numerous cables. Furthermore, cables inside

conduits running near the burning cable trays were also damaged.

It would appear that the fire at Greifswald bears some substantial similarity to the Browns Ferry fire.

In this case the fire again appears to have been of moderate severity in the context of classical fire

protection and yet there was apparently a significant challenge to nuclear safety as a result of the fireinduced cable damage. The fire was extinguished within a relatively short time (92 minutes) in

comparison to other cable fire events that have persisted for several hours. There is relatively little

information available on this incident so the actual physical extent of the fire damage is unknown.

An important insight to be taken from these two incidents is that even a relatively modest fire

occurring at a critical location can lead to substantial challenges to nuclear safety. This is often a

central finding of fire PRAs; that is, fires that occur near a location where critical cables for redundant

trains of safety equipment converge (a cable “pinch point”) are commonly identified as dominant fire

risk contributors. In these cases while the likelihood of a fire of sufficient magnitude occurring in just

the right location may be small, the consequences of such a fire may be severe and the overall risk

contribution may be significant. These two events confirm this aspect of fire PRAs, and also confirm
Insights

6

 There has been only one fire in a U.S. plant that could be considered a large cable fire

(Browns Ferry 1975), and in that case damage was comparatively limited. U.S. plants have a

total experience base of over 2000 years. The experience for Soviet-designed plants includes at

least five large cable fires in less than 1000 years of experience.

31

the value of ensuring adequate physical separation of redundant safety trains (such as is specified in

the 10CFR50 Appendix R requirements).[32] 

The switchgear fire at Waterford, although small in terms of area of damage, may also be considered

as a cable fire of special interest, although there was no direct challenge to nuclear safety as a result

of the fire-induced cable damage. In that incident, a non-safety related switchgear failed

catastrophically and ignited the cables above the cubicle where the fire started. The fire propagated

upwards and then horizontally damaging a number of cables in the cable riser and in the impacted

horizontal cable tray. The fire did “jump” past a fire stop in the vertical riser tray but was halted by

an in-tray fire stop in the horizontal tray. The Waterford incident demonstrates that under special

circumstances (i.e., given a sufficiently energetic exposure source), it is possible for IEEE-383 lowflame-spread cables (it is assumed by the authors that the cables at Waterford were IEEE-383

qualified based on the plant’s construction dates) to sustain a fire and propagate it along a vertical

riser, and into a horizontal cable tray. 

None of the cable fires observed to date in the U.S., including the 1975 Browns Ferry fire, have led

to physical damage as extensive as that seen in large cable fire incidents in the Soviet-designed plants.

This study has surmised that differences in the materials used in the construction of the cables,

penetration seal characteristics, construction and maintenance practices, openings among

compartments and electrical circuit design characteristics were important factors contributing to the

severity of the cable fires in the Soviet-designed plants as compared to those observed in U.S. plants

under nominally similar conditions (e.g., San Onofre, Waterford (1995), and Browns Ferry).

In the case of Armenia, the fire was initiated by a short in the power circuits. The fire started inside

cable galleries, propagated rapidly and became a large fire (including a secondary turbine building oil

fire, see Section 4.2.2). In the case of Beloyarsk, the fire started in the turbine building due to a break

in the oil system, but propagated to cables and from there into the control building. In that fire many

cables were damaged at several locations of the control building. Perhaps the only comparable case

in U.S. industry experience is the Browns Ferry fire, and even in that case the extent of the fire

propagation and damage was not nearly as severe.

While this study has not attempted to develop specific fire event frequencies, it would nominally

appear that the statistical frequency of large cable fires is about an order of magnitude lower6 in U.S.

plants than it is in Soviet-designed plants. The difference in the frequencies of severe cable fire

occurrences between the U.S. and Soviet-designed plants may likely be attributable to two factors

in particular. First is the use in the U.S. of low-flame-spread cables. In the Soviet-designed plants

cables apparently are able to support and propagate fire more readily than will the cables currently
Insights

32

used in U.S. plants. Second is the close attention paid in the U.S. to the sealing of all fire barrier

penetrations and openings. For several of the Soviet incidents, the presence of unsealed barrier

openings (in one case the plant was still under construction) allowed fire (and smoke) to spread

virtually unchecked from room to room (see Section 4.2). Other potential factors include electrical

maintenance and design practices and compartmentalization practices. It must be noted that no

significant cable fires for Soviet-designed plants were identified in this review since the mid 1980s.

This coincides with efforts in these plants to apply fire retardant coatings on their cables and to

upgrade the status and quality of their fire barriers.[28]

4.3 Fire Detection and Suppression

4.3.1 Availability of Suppression System

In some of the incidents reviewed here, the automatic fixed suppression system failed to function.

In these cases the suppression system failures occurred because the system was switched to the

manual mode and/or because the systems control or power cables were damaged by the fire itself

before the system could actuate. For example:

S There was a fixed foam system in the cable galleries at the plant in Armenia. The system’s

control switch was turned to the manual position at the time of the fire. The control cables

for the system were damaged in the first few minutes of the fire and this rendered the system

inoperable for the entire length of the incident despite attempts to manually actuate the

system.

S At South Ukraine, the fixed suppression system for the containment was switched to manual

mode at the time of the fire. The operators apparently failed to switch it back to automatic

or to manually actuate the system after the existence of the fire was verified. The reasons for

this failure could not be determined.

In fire PRAs, fixed fire protection systems are modeled using a reliability value obtained from generic

industry sources. Plant specific analysis of the design condition, specific failure modes, and control

switches of the system is often not conducted, although some exceptions can be cited (e.g., [9]). It

is also inherently assumed that the fire protection systems are independent of the impacted fire area;

i.e., fire protection system failures are random rather than fire-induced. It would appear that U.S. fire

detection and suppression system standards may not require that independence from the protected

space be assured in all applications (the fire pump standards are the one apparent exception). Further,

in the U.S. nuclear industry full compliance with general industry fire protection system design

standards cannot be assumed without verification. Hence, fire protection systems should be examined

carefully as a part of the fire PRA to ensure that a fire in any given area does not hold the potential

to render the system inoperable.

This would be of particular concern if manual recovery of a fixed suppression system is being

credited. Indeed, this observation is also indirectly relevant to one area of current methodological
Insights

7Note that Task 2 of the USNRC/RES Fire Risk Methods research program, JCN Y6037,

is specifically addressing fire detection and suppression modeling practices for fire PRA.[11]

33

debate arising from the EPRI Fire PRA Implementation Guide (the PRA Guide).[3] One of 16 generic

Requests for Additional Information (RAIs) raised with regard to application of the PRA Guide to

IPEEE analyses cited potential concerns for the dependency between manual fire fighting and manual

recovery of a fixed suppression system.[33] This insight raises an additional potential concern

regarding manual recovery of a fixed system. That is, a fire may burn for some time before manual

recovery is attempted. Fire damage during that time may render the system inoperable and

unrecoverable.

Overall, this experience illustrates a behavior that is not considered in current fire PRAs; namely,

fixed fire suppression systems may be damaged and/or rendered inoperable by a fire. Some additional

consideration of how fixed fire suppression systems are credited in fire PRAs appears warranted.7

In particular, it would be prudent for fire PRAs to assess the potential for loss of a fixed fire

suppression capability due to fire damage. Due to timing considerations, the potential for loss of

system function before actuation would be of particular interest in the analysis of manually actuated

fixed fire suppression systems and where recovery of an automatic fire suppression system is

considered.

4.3.2 Fixed Suppression System Overwhelmed by the Fire

Relatively few of the fire incidents reviewed in this study involved the actuation of fixed fire

suppression systems. However, in the majority of cases, when activated fixed fire suppression

systems did control the fire as designed. However, in a few cases the suppression system was

overwhelmed by the fire. That is, although the fixed suppression system functioned as designed, the

fire was so severe that the system was unable to control the fire. Case examples identified in this

review are as follows:

S At Vandellos, the lubricating oil and hydraulic oil storage tanks caught fire. Both tanks were

protected by a deluge system. The lubricating oil storage tank fire was brought under control

with the assistance of hose streams from the fire brigades. However, the hydraulic oil storage

tank, despite the activation of the deluge system, burned completely because the fire was too

severe.

S At Beloyarsk, although this is not explicitly stated, from incident descriptions provided in

available sources it may be inferred that in several places the fixed fire suppression systems

activated, but were not adequate to control or suppress the fire.

S The available information about the Chernobyl fire indicates that the suppression systems did

actuate as designed. Reports also state that due to excessive usage, the fire water pressure

was not sufficient to allow the fire fighters to reach the ceiling with their hose streams. Since
Insights

34

a large team (63 persons) was required for close to six hours to extinguish the fire, it can be

inferred that the fixed suppression systems were not effective and perhaps were overwhelmed

by the fire.

S At North Anna, a fault in a main transformer caused severe transformer damage and an oil

spill and fire. The oil fire was too severe for the deluge system although the system did

activate as designed. Plant and outside fire brigades had to intervene to control the fire. 

In fire PRAs it is commonly assumed that fixed fire protection systems are properly designed and

installed. In some cases specific assessments may be undertaken to identify design features that might

delay actuation (such as beam pockets or detectors and sprinkler heads located on pendants below

the ceiling). However, it is widely assumed that if a fixed suppression system actuates, the fire will

be brought under control and/or extinguished very quickly. In particular, it is commonly assumed that

no further fire damage will be realized given actuation of a fixed fire suppression system (see further

discussion in Section 4.3.3).

The incidents reviewed here demonstrate that there could be situations where the system operates as

designed, but is rendered ineffective by the sheer magnitude of the fire. Certainly this requires a very

severe fire that can only be caused by the presence of a large quantity of highly combustible fuels.

This would typically apply to the turbine building, near large oil-filled transformers, or other areas

where large quantities of flammable liquids are stored. Fire analyses for such areas should carefully

consider the potential for a prolonged fire even if the fire suppression systems actuate as designed.

4.3.3 Fire Duration

In a fire PRA, a parameter of critical interest is the likelihood of controlling the fire before a critical

set of equipment and cables are damaged (i.e., the time that fire stops propagating and will cause no

further damage). For the larger fires addressed in this study, this time period (time to fire control)

has ranged from one to 17 hours. The total duration (time to fire extinguishment) for several of the

reviewed fires was rather long, including fires that lasted from six to over 24 hours. This is generally

well beyond the maximum probable fire duration typically assumed in a fire PRA.

There were several incidents, in particular, where manual fire extinguishment was delayed for a long

time. Case examples identified in this review are as follows: 

S In the case of the Browns Ferry fire, effectively the fire was burning in two compartments:

the cable spreading room and a reactor building compartment adjacent to the cable spreading

room. The fire in the cable spreading room was immediately recognized and was brought

under control by the fixed CO2 system and manual efforts. On the reactor building side, the

fire was in an inaccessible location well above the floor, and only hand held extinguishers

were initially applied which failed to suppress the fire. Application of water on the electrical

cable fire was, however, delayed close to seven hours. There were apparently concerns for

both fire fighter safety and the potential systems impact that might result from water-induced
Insights

35

shorts involving the damaged electrical cables. The reactor building side fire was extinguished

quickly once water was applied.

S At South Ukraine, fire fighting efforts were delayed in large part because of the need to first

reduce containment pressure. It took more than four hours after plant personnel realized that

a fire was burning inside the containment before the fire brigade gained access to the fire area.

Furthermore, this case involved a fire in an inaccessible group of cable trays and a cable shaft.

It took the fire fighters more than three hours after entering the containment to extinguish the

fires completely. 

S At Waterford 3 (1995), the suppression activities were delayed for two non-related reasons.

First, the shift supervisor insisted on personnel observing flames before declaring the existence

of a fire and calling out the fire brigade. This took more than a half hour for operators to don

self contained breathing apparatus, to enter the smoke filled room, confirm the existence of

the fire, and report back to the main control room. Second, the fire brigade resisted the use

of water and attempted to use non-water agents (hand-held extinguishers) repeatedly for more

than one hour which failed to put out the fire. The fire was extinguished rather rapidly when

water was finally applied.

S In the case of Oconee, effective fire suppression was also delayed by more than 40 minutes

by repeated attempts to suppress the fire using hand-held fire extinguishers. Once water was

applied, the fire was quickly suppressed.

S The fire at Beloyarsk lasted for over 17 hours. The main reason for the long duration was

apparently the presence of heavy smoke blocking access to and visibility of the fire locations.

This implies that the fire had grown to a substantial size before fire fighters arrived on the

scene. The response was also hampered by the extensive and rapid propagation of the fire

into adjacent areas so that a large fire fighting force had to be deployed. Electrically active

cables and extremely cold weather were also cited as having hampered fire fighting efforts.

S The fire at Zaporizhzhya lasted for over 17 hours. The main reason for the long duration was

apparently the presence of heavy smoke. In this case lack of knowledge about the plant

layout by members of the off-site fire brigade also contributed to fire duration.

S It took more than three hours to bring the turbine oil fire at Chernobyl under control and

close to six hours to completely extinguish the fire. Factors in this case were the severe initial

intensity of the fire coupled with the early structural collapse of the turbine building roof.

S Several other turbine building fires were reviewed. In those fire incidents, fire fighting

activities started a short time after ignition but because of the severity of the fire several hours

were needed to bring the fire under control.
Insights

36

There are four specific factors that can be cited from these incidents as having led to an extended fire

duration:

S In several fire incidents, the initial severity of the fire hampered fire fighting efforts (for

example, the large turbine building oil fires and some of the rapidly growing cable fires). 

S In other cases difficulty in clearly identifying fire locations due to heavy smoke, unfamiliarity

with the plant, or difficulties in approaching an identified fire location interfered with fire

brigade effectiveness.

S In some incidents (i.e., Browns Ferry, Waterford 1995 and Oconee), initial unsuccessful

attempts to extinguish the fire using hand-held extinguishers delayed effective fire fighting.

S In some incidents (i.e., Browns Ferry, Waterford 1995, and Oconee) there were decisions

made by management (in at least one case apparently based on written procedures, Waterford

(1995)) that contributed to an extension of the fire duration. These included reluctance to

declare the existence of a fire and reluctance to apply an effective suppressant (water) in a

timely manner. It may be argued that the latter is dependent on the failure to control the fire

by other means (e.g., use of hand-held extinguishers). In these cases it would appear that a

fire that might have been suppressed quite quickly (within minutes) was instead allowed to

burn for a prolonged period (from well over an hour to several hours). Delays in initiating

effective fire fighting activities because of procedural requirements or management decisions

are not generally considered in PRA models.

These incidents illustrate that various factors may delay the activation of the fire brigade, even for

severe fires, and compromise their effectiveness once called out. There are currently two approaches

commonly applied to assess manual fire brigade response in fire PRAs. The implications of these

insights depend on which approach is being applied as follows:

S Under the first approach, a curve characterizing the probability of suppression versus time

based on historical fire incident data is used to model the possibility of failure to suppress

within a given time period.[3,5] The fire suppression time distribution is statistically compared

to the critical damage time (either a point estimate or a distribution) to estimate the likelihood

of critical damage occurring. This approach has one clear advantage in that it inherently

includes the observed delays in decision making, failure of initial attempts, etc., because these

are factors in the underlying incident data. However, the approach also has distinct

disadvantages because fire duration data is actually rather sparse. This limits the analyst’s

ability to parse the data to reflect different fire sources or to address specific plant features.

Hence, adaptation of the generic suppression probability curves to a specific fire scenario may

not reflect the impact of location specific conditions.

S Under the second approach, the duration of a manually-suppressed fire is based on the time

it takes for the fire brigade to reach the scene ready with equipment. This is, in turn, typically
Insights

8

 These issues are being addressed as part of Task 2 of the USNRC Fire Risk Methods

research program, JCN Y6037.[11]

37

based on fire brigade practice drill response times. Under this approach it is common to

assume that the fire brigade will be called out immediately upon initial indications of, or

detection of, a fire. It is further assumed that fire fighting efforts will be immediately effective

once initiated and that the fire will be brought under control within, at most, minutes. This

approach has the advantage of being both plant-specific and case-specific. However, these

methods as currently applied do not explicitly consider the types of decision making delays

or effectiveness issues highlighted by the incident review preformed here.

Given this perspective, some additional refinement of manual fire fighting assessment methods

appears appropriate. For example, the observations noted here might be addressed for the methods

based on drill times through inclusion of an additional manual suppression failure probability or by

assessing some probability of substantial delays in response times. However, the basis for such a

refinement is currently lacking. A refined method might also be developed using a hybrid of the two

currently applied methods, that is, use of historical probability curves adjusted to reflect case-specific

assessments of brigade practices and fire scenario factors.8

Overall, typical PRA estimates of fire duration would not bound most of the fire incidents reviewed

in this study. This is mitigated to some extent by the observation that for most fire scenarios

considered in fire PRAs the critical damage occurs in a relatively short time frame, and subsequent

fire damage is not risk significant. (Damage timing is discussed further in Section 4.4.3.) However,

in many cases noted in particular in the IPEEE process fire scenarios were screened as risk

insignificant based on relatively short fire duration estimates (e.g., assumptions that any fire anywhere

in the plant would be suppressed within 10-15 minutes) despite the observation that a longer duration

fire might cause more risk-significant fire damage.[6]

Based on this incident review, it can be concluded that long duration fires do occur, although the

probability of occurrence is not known. For various reasons, fire suppression activities may be

substantially delayed or ineffective. Fire PRA methodologies presented in References [3] and [5]

include time to suppress probability curves that give very small probabilities to fire durations greater

than one hour base on U.S. experience. Since fire durations of up to 24 hours have been recorded

in the nuclear power industry, and several of the fires reviewed in this study lasted for several hours,

those curves may need to be revisited or a methodology developed to account for plant- or scenariospecific conditions that may lead to long duration fires. The failure to account for long duration fires

may well miss risk significant fire scenarios. While a significant unsuppressed fire may occur with a

lower frequency, the consequences of such fires may sufficiently severe that the overall risk

contribution is still significant. Fire risk methods are clearly capable of dealing with long-duration

fires. However, it must be noted that scenario specific analysis of the suppression activities is seldom

done in a fire PRA.
Insights

38

4.4 Equipment Damage

4.4.1 Spurious Actuation of Equipment

One area of current debate centers on the potential that fire-induced damage to cables might lead to

spurious equipment operations rather than simply a loss of function, and the relative likelihood that

one or more such events might be observed during a fire. Spurious actuations were observed in a

number of the fire incidents reviewed here. Case examples identified in this review are as follows:

S In the Armenia fire there were three reported spurious actuations and other control and

indication problems, all apparently caused by fire-induced cable failures:

S The main generator breakers were closed inadvertently due to fire damage to the

associated control cables. This led to the non-operating generators being connected

to the grid and in turn to secondary fires in one of the turbine-generators and in the

start-up transformer.

S One of the diesel generators spuriously disconnected from its emergency loads

apparently due to control cable damage. Attempts to correct the failure during the

fire were not successful.

S One feedwater pump spuriously started following damage to a cable, apparently, in

the control circuits. In this last case, the fault that actuated the pump by-passed the

normal start logic allowing the pump to start without first starting the lube-oil pumps.

Hence, the pump ran for some period without proper lubrication. The fault also bypassed or defeated the normal control room start/stop functions and operator attempts

to shut down the pump from the main control room failed. The pump was ultimately

secured by electrical technicians who isolated the pump from the power bus manually.

S Neutron flux and other reactor related instrumentation indicated conditions that may

not have been the actual conditions of the reactor. This was likely because many of

the instrument cables were degraded and/or failed by the fire. These indications led

to the actuation of various emergency signals.

This incident is one of the few incidents where there is specific information indicating that

multiple spurious actuations actually occurred during a fire.

S In the Ignalina fire there were a number of cases where equipment was lost due to spurious

trip signals caused by the failure of instrument and control cables. These included the

following events:

S The Control Room received oil level alarms for one of the main coolant pumps and

the pump tripped automatically. Cable faults in the oil level indicator and alarm

circuits are suspected to be the cause of the trip (rather than an actual drop in oil

inventory).

S Instrumentation and control cable faults led to the opening of supply breakers for two

normal 6kV buses and two essential (non-safety) buses.

S Control cable damage tripped Transformer 5 and prevented it from taking up the

loads for these buses.
Insights

39

S At Chernobyl, a conductor-to-conductor short in a multi-conductor cable attributed to cable

damage from poor cable pulling practices during construction led to spurious closure of a

generator breaker, grid back-feed into the generator, generator rotor failure, turbine oil and

generator hydrogen release and a large fire. In this case, a cable failure caused spurious

component operations that in turn caused the fire. 

S At the Waterford (1995) fire, the event sequence log and the control room operator

observations indicate erratic behavior in the position indication of a breaker or a pump. There

is no verification in the incident report regarding the behavior of these items in the field.

Hence it is not clear if these are spurious indications only or are, in fact, spurious operations.

S During the Browns Ferry fire incident several spurious component and system operations

were reported. For example, the control room received indications that the Residual Heat

Removal, Core Spray and High Pressure Core Injection systems had started. A recent review

revealed that conductor-to-conductor short circuits within the associated system control

cables damaged by the fire were the most plausible explanation for the cited behavior in at

least two of the reported spurious system actuation events.[34]

In summary, it can be concluded that spurious actuation of equipment or electrical control circuits

may have taken place during at least four of the reviewed incidents. The Armenia fire appears to

provide the most conclusive evidence, and in particular, evidence that multiple spurious actuations

are possible to occur. A recent study of circuit failure modes appears to lend credibility to these

findings.[34] These events can either result from, or lead to, a fire. With the exception of Chernobyl,

for which the investigators could identify the specific wires that caused the spurious actuation of the

breakers, the precise electrical failures that led to spurious actuations have not been discussed in the

available incident reports. Hence, it is not possible to conclusively pinpoint the specific circuit failures

that led to these conditions. It is also not possible on the basis of this study to estimate the likelihood

of such effects being observed in any given fire. It may be added that several other fire incidents

reviewed in this study involved control and instrumentation cables. However, from the information

provided for the incidents, it is practically impossible to infer whether or not spurious actuations took

place. 

Fire PRA methods are capable of dealing with spurious component actuations, and efforts are

currently underway to improve the available methods of analysis.[34] Perhaps the most challenging

aspect of this problem for the PRA analyst is the need to include potential cable failures and the

resulting systems effects into the internal events PRA models. Internal events models do not typically

consider cables and their potential failure because the random failure probability of cables is

considered very small. Nonetheless, the fundamental framework of a current fire PRA is capable of

capturing and quantifying such spurious operation events as a result of fires.[34]
Insights

40

4.4.2 Cabinet Fires 

Electrical cabinets, especially high voltage switchgear, are commonly identified in fire PRAs as one

of the important sources of fire ignition in nuclear power plants. One current area of debate that

arose from an USNRC sponsored review[33] of the EPRI Fire PRA Implementation Guide[3] (hereafter

referred to simply as “the Guide”) was related to the potential that a fire initiated inside of an

electrical panel might propagate outside the panel. The Guide had recommended that closed

electrical panels (panels with no openings or vents) could be screened as ignition sources; i.e., that

the potential for propagation of fires outside the panel was sufficiently small that screening was

appropriate. In the IPEEE reviews, this was commonly cited as an area of potential weakness in

licensee submittals.[6] Reviewers expressed concern that some electrical panel fires might propagate

outside the panel; hence, screening of such sources might eliminate a potential fire vulnerability from

the assessment.

There was only one fire incident in the reviewed incidents that clearly involved a substantial cabinet

fire; namely, Waterford (1995). The Waterford incident demonstrates that a fire initiated within a

switchgear panel can propagate to the outside of the switchgear boundary and ignite cables above the

panel. In this case, the top of the panel was damaged by the fire. The fire propagated up into the

cable risers above the panel (cable drops into the panel), and ultimately to an overhead horizontal

cable tray. It is not clear whether the damage to the panel top was the result of heat or direct effects

of the apparently energetic switchgear fault (e.g., damage may have resulted from pressure or

shrapnel from the switchgear failure). In this incident the fire also caused damage to a horizontally

adjacent switchgear cubicle.

It must be noted that at Waterford the fire burned for over an hour and only two adjacent cubicles

were severely affected. Other nearby cubicles suffered damage only to their external surfaces from

reflected radiative heat. However, the fire also damaged the vertical riser cables for a distance of

about 10 feet above the panel, and the intersecting horizontal tray for a distance of about eight feet.

The incident demonstrates that panel fires can lead to external fire propagation. In this particular case

the consequences of the fire were modest because the panels were not safety-related. However, as

noted above, fires impacting safety-related switchgear are commonly found to be important risk

contributors. Therefore, careful attention to the potential for fire spread outside of a switchgear panel

(or other electrical panel), which may impact additional trains of equipment, is confirmed to be an

important aspect of a fire PRA.

A second potential case is the fire at Greifswald. The available information appears to imply that the

fire started in a 6kV switchgear panel and propagated outside the panel to overhead cables. This

cannot, however, be confirmed given the available information. For example, it is also possible that

the fire started in the cables due to a cable overload.
Insights

41

4.4.3 Damage vs. Suppression Timing

As discussed in the previous sections, in fire PRA, a parameter of critical interest is the likelihood of

controlling the fire before critical damage occurs. In the events reviewed in this study the time to the

last observed risk-significant equipment damage (i.e., beyond this time no additional cables or

equipment of importance to risk were damaged) varied widely. Indeed, this time can be significantly

shorter than the time that the fire was declared as under control. For the fires reviewed here the

critical damage time period ranged from ten minutes to five hours (see Table 4-1). For example, in

Waterford (1995) all damage apparently took place in the first ten minutes of the fire, but the fire was

not brought under control until over an hour later. During the Browns Ferry 1975 fire, most fireinduced failures occurred during the first hour of the fire. However, it is interesting to note that more

than five hours after fire initiation, one additional failure that impacted the core cooling process took

place (a solenoid valve serving the four active relief valves failed). 

Table 4-1 includes estimates of the time to last damage, fire control and fire extinguishment. All of

the reported times are estimates based on the information provided for each incident. Blank spaces

represent cases for which sufficient information was not available. From a comparison of the time to

last damage and the time to fire control, it can be concluded that long damage times may occur in a

fire incident. Conversely, time to the last risk significant cable/equipment damage may be significantly

shorter than the time to complete extinguishment, and in many cases it is also shorter than the time

to fire control as well. Two of the events were extinguished by an automatic suppression system with

no manual fire fighting intervention. The remainder (i.e., 23 events) included manual actions. In

eight of the 23 events, fixed automatic suppression systems activated but manual actions were needed

to control and extinguish the fire. 

In the screening phase of a fire PRA it is commonly assumed that all cables and equipment within a

compartment are damaged. This is a conservative approach (appropriate to screening analyses) under

which fire durations are not factored into the screening analysis. The observations outlined above

would have no impact on this type of screening analysis. However, these observations will have a

bearing on the detailed analysis of the un-screened fire scenarios. In some past fire risk studies,

scenarios have been quantified assuming that if a fixed fire suppression system actuates, any fire

damage will not be risk significant. From the information provided in Table 4-1, it can be concluded

that damage may occur well before the suppression system can effectively suppress the fire and that

consideration should be given to the cables and equipment within the damage zone of the fire.

4.4.4 Structural Failure from a Fire

There have been a few fire incidents where structural elements were severely affected by the fire. In

all cases, the incidents occurred on the secondary (power generation) side of the plant. Case

examples reviewed in this study are as follows:
Insights

42

S At Muhleberg, where a turbine oil connector failed and caused an oil spill and a large fire,

some of the structural elements of the turbine building roof deformed and other structural

damage was inflicted.

S At Beloyarsk, the turbine building roof collapsed within a few minutes of fire ignition.

S At North Anna, the transformer fire affected the turbine building. The outside wall of the

turbine building was sprayed with burning transformer oil apparently leading to some damage

to the building exterior cladding. 

S At Chernobyl, similar to Beloyarsk, the turbine building was destroyed because of a turbine

oil fire.

S Parts of the turbine building at Narora also experienced structural damage. Turbine-generator

support structures and a portion of the slab around the turbine-generator set suffered damage

from the intense heat.

S At Vandellos a deflagration of hydrogen caused damage to the movable ceiling above the

point where fire had occurred.

Structural damage due to fires is not generally considered in a fire PRA. The risk significance of

turbine building structural damage beyond the loss of the equipment in that building is certainly very

plant specific. In many cases, structural damage may have no direct risk importance. However, for

areas where that potential exists (e.g., the turbine building) it may be appropriate to consider the

potential impact of a structural failure on subsequent plant recovery actions. Fundamentally, it would

appear that the consideration of structural failure is possible within the framework of an existing fire

PRA (i.e., consideration of additional damage or the potential for fire spread to adjacent areas due

to barrier failures). However, no guidance for this type of assessment currently exists.

4.5 Impact on Plant Safety Functions

4.5.1 Impact on Multiple Safety Trains

The reviewed events did include a number of incidents where multiple safety trains were impacted

by a fire. As noted by Houghten[10] and others, fires impacting multiple safety trains are rare

occurrences. In the U.S. only the fire at Browns Ferry on March 22, 1975 affected multiple safety

trains.[10] However, in non-U.S. plants there have been several incidents where multiple safety trains

have been affected. In particular, in the Soviet-designed plants there have been several large cable

fires where a large number of safety systems have been affected. Case examples involving damage

to redundant safety trains reviewed in this study are as follows:

S In the case of the Armenia fire, a station blackout resulted from the fire and it lasted several

hours. 
Insights

43

S During the fire at Greifswald, the fire also caused a station blackout and led to loss of all

active means of cooling the reactor core. These conditions persisted for at least five hours.

S For the South Ukraine fire, it is stated in available reports, that if the reactor had been

activated prior to the incident (the plant was at the last stages of construction), the safety of

the reactor would have been impacted severely.

S In the case of Zaporizhzhya, several electrical trains were affected.

S In Beloyarsk, one reference has stated that it was only fortuitous that core damage did not

occur.[12] 

S At Narora, a station blackout resulted from a turbine building fire because there was little

separation between cables for both trains of the power distribution system. The blackout also

rendered the alternate shutdown capability inoperable for one of the two units.

S At Chernobyl, the fire affected all high pressure feedwater pumps, some due to direct fire

damage and the rest because they were taken off-line (de-energized) to allow fire-fighters to

attack the fire. In this case, fire damage, other independent failures, and the strategy selected

by plant management for reactor cooling worked together to cause difficulties in the

operators’ attempts to ensure adequate core cooling (no core damage was experienced in this

incident).

In all of these cases, the operators played an important role in ensuring that at least one core cooling

path remained functional or was recovered. This is discussed further below in the more general

context of operator recovery actions. Fire PRA methodologies are specifically designed to explicitly

model multiple train failures. The incidents given above would be properly addressed in a typical fire

PRA.

These cases all involved fires that directly affected redundant safety trains. However, indirect effects

of a fire may lead to an impact on redundant trains as well. This has been observed in two cases:

S At Oconee, one train of non-safety switchgear was involved in the fire, and the second train

was de-energized to allow the use of water for fighting the fire in the first switchgear. Thus,

effectively two opposite, albeit non-safety, trains of a system were taken out of service due

to the fire.

S A similar incident took place at Chernobyl, when all electrical panels related to main and

emergency feedwater were de-energized to allow the fire fighting activities in the area.

Current fire PRA methodologies include provisions for analyzing the actions that should be taken by

the fire brigade. As a part of this analysis, special conditions such as de-energizing an undamaged
Insights

44

component could be addressed. However, in the experience of the authors, no analysis to date has

explicitly considered the potential that operating equipment would be purposely taken off-line in order

to allow for fire fighting activities. Rather, a typical fire PRA will credit the operation of any and all

systems not actually damaged by the fire. The incidents reviewed here indicate that it may be

appropriate to review fire fighting procedures specifically to ensure that the possibility of indirect

equipment loss (purposeful shutdown) is captured.

4.5.2 Severe Degradation of Core Cooling Capability

In six of the fire incidents reviewed here, not only were redundant trains were affected (see Section

4.5.1), but the core cooling function was severely degraded by a fire. This observation is directly

linked with the loss of redundant trains that occurred at Browns Ferry 1975 fire, at Narora and during

several of the cable fires at Soviet-designed plants. Case examples reviewed in this study are as

follows:

S In the case of the Browns Ferry fire, all of the normal core cooling functions were lost. The

operators boosted the flow rate on a CRD pump with a flow capacity of 130 gpm to provide

core cooling. This approach was not, at the time, included in the plant procedures. Use of

the CRD pump provided time for the plant personnel to restore normal core cooling functions

(initially a condensate booster pump).

S The fire at Greifswald burned for about 92 minutes causing a station blackout and the loss of

all active means of cooling the core. As a result, a pressurizer relief valve opened and failed

to close (stuck open PORV). This situation persisted for at least five hours and led to

depletion of the secondary and primary side coolant inventories. The plant was ultimately

recovered through initiation of low pressure pumps (upon loss of pressure trough the stuck

open PORV) and installation of a power cross-tie to the sister unit (Unit 2) and recovery of

one auxiliary feedwater pump.

S Armenia experienced a station blackout during a fire that lasted for several hours. The large

heat capacity of the steam generators provided time for the plant personnel to lay down a

temporary cable from a diesel generator to the motor windings of a high pressure injection

pump.

S At Narora, a station blackout resulting from a fire of several hours duration was also

experienced. Again, steam generator capacity had an important role in allowing the operators

ample time to take proper recovery actions. In this case, they opened the fire water system

connections into the steam generators and started the diesel engine driven fire water pumps.

Even this capability was temporarily lost when both fire pumps failed simultaneously. The

capability was restored when one fire pump was recovered.

S For Beloyarsk, little information is provided as to how the reactor was controlled and core

cooling was maintained. However, the conditions were certainly very severe. As mentioned
Insights

45

earlier, one reference stated that it was “only fortuitous” that core damage did not take

place.[12]

S During the Chernobyl turbine building fire, core cooling functions were never completely lost.

However, all high pressure feedwater pumps became unavailable. The operators chose to

follow a rapid cool-down strategy. This, augmented with failure of the Steam Dump Valve

to close completely (a failure independent of the fire), caused the water pressure, and

therefore the temperature, to drop rapidly. The water contracted and the level in the Steam

Drum (the source of water for the circulating pumps of the core) dropped below the

measurable level. For about 15 minutes, until makeup water was restored, it was not clear

if core cooling remained adequate.

In addition, there were two fire incidents that, while the fires occurred just prior to plant start-up,

should also be included as having had the potential to severely degrade core cooling functions.

S The fire at South Ukraine began inside containment during a pressure test of the containment

structure and ultimately damaged numerous cables. While the reactor was not activated at

the time of the fire incident, the damage caused by the fire would have severely challenged

the safety systems.

S The fire at Zaparozh occurred during the final stages of plant construction. The fire

destroyed many of the plant control, instrumentation and power cables damaging all three

safety divisions of core cooling equipment. Hence, had the plant been in operation at the time

of the fire, nuclear safety would have been challenged.

In fire PRAs, explicit consideration is given to the potential that multiple or redundant safety

functions might be lost due to fire. Indeed, this is the central premise upon which fire PRA is based.

Hence, in a fundamental sense, these events should be captured by existing PRA methodologies. In

particular, the majority of the nuclear safety challenging fires reviewed here involved fires that

damaged numerous safety-related cables. Fire PRAs often identify such fires as dominant

contributors to fire risk. A typical fire PRA would likely have identified the impacted cable areas and

the lack of train separation in these cases as significant potential contributors to fire risk.

One common element in each of these incidents that ultimately prevented core damage was the action

of operators. This is discussed further below. Given that in a typical fire PRA no credit is generally

given to actions taken outside the established procedures, if the above mentioned incidents were to

be modeled in a PRA, in almost all cases, a very high conditional core damage probability (CCDP)

would be assigned given the observed fire damage. The fact that none of these incidents actually led

to core damage demonstrates that fire PRAs use conservative assumptions, in particular with regard

to operator recovery actions and strategies.
Insights

46

4.5.3 Human Error Events

The possibility of human error events is commonly recognized as an important aspect of PRA in

general. The incidents reviewed in this study confirm the importance of this perception in the context

of fire PRA. Case examples reviewed in this study are as follows:

S In the Waterford (1985) incident, a main feedwater pump caught fire. The plant operator at

the scene called the control room with the wrong pump tag number. This error resulted in

the un-damaged pump being shutdown from the control room.

S In the H B. Robinson incident, during an outage a maintenance crew connected a hydrogen

source to the plant compressed air system in error. The compressed air system was operating

at a lower pressure than the hydrogen source. Hydrogen entered the compressed air system,

was distributed to pipes throughout the plant, and exited the system at several locations

(wherever the compressed air system was being used within the plant). The escaping

hydrogen caught fire at various points where ignition sources were present.

S At Chernobyl, a fire involving one turbine generator led to a reactor trip. Operators failed to

isolate the second turbine generator from the power grid. Hence, upon loss of the steam

supply source, the generator acted as a motor drawing power from the grid for approximately

20 minutes. In this case, the error had no impact on the chain of events. However, it was

similar behavior occurring in the first generator that led to the initial fire.

S During the Oconee fire, operators failed to close a main feedwater valve on reactor trip.

Initiation of high pressure injection ultimately led to an overcooling transient.

S During the 1995 Waterford switchgear fire, operators failed to promptly declare a fire. The

plant procedures apparently did call for operators to verify the presence of flames before

declaring a fire emergency. However, the failure to declare a fire given the reports of “heavy

smoke” issuing from the switchgear room is considered a human error event in the context

of a fire PRA. This error led to a substantial delay in activating the fire brigade.

The operator errors in the above examples occurred after the fire had ignited. In three cases reviewed

in this study errors by plant personnel preceding the fire have either led to fires or have compromised

the effectiveness of the fire response as follows:

S At Browns Ferry (1975), the fire was ignited by a technician who allowed the lit candle that

he was carrying near penetration seals to touch unprotected seal material. Several fires

involving the same ignition scenario, albeit all of no significant consequence, had occurred

prior to the incident on March 22, 1975. Plant management and operators failed to take note

of the earlier events and to disallow further usage.
Insights

47

S At South Ukraine, the fixed fire suppression system for the containment had been switched

to the manual actuation mode (disabling automatic initiation) sometime before the fire

occurred. Plant personnel apparently also failed to switch the system back to its automatic

mode or to manually actuate the system after the existence of the fire was verified.

S At Armenia, the fixed suppression system for the cable gallery where the fire started was

switched to the manual actuation mode (disabling automatic initiation) prior to the event. Fire

damage to associated system cables rendered the system inoperable relatively early in the

incident. Repeated attempts to manually actuate the system failed.

These events demonstrate that errors by plant personnel, including both operators and maintenance

technicians, may complicate the chain of events of an incident. Complications involved in the cited

incidents include the loss of a redundant train not impacted by fire damage due to operator error,

errors in the handling of post-fire safe shutdown activities, and fires involving unexpected ignition

(i.e., a candle) or fuel (i.e., hydrogen) sources that would not be expected to exist in an area under

normal circumstances. In the case of the inoperable fire suppression systems, the error-caused system

failures (i.e., leaving the systems in manual mode) were likely a significant factor contributing to the

ultimate severity of those incidents. That is, in each case early intervention by the fixed fire

suppression system would likely have limited fire damage substantially. Similarly, delays in initiating

effective fire response during the Waterford (1995) incident also likely allowed for more fire damage

than might otherwise have been realized.

It is interesting to note that some of the human error scenarios described above (Robinson and

Waterford (1985)) can be categorized as errors of commission. That is, the operators took an action

that further complicated the situation or created a new undesired condition for the plant. The

remaining case examples involved errors of omission. That is, operators failed to take an action that

would have contributed to mitigation of the incident.

In general, current PRA methods are capable of identifying and quantifying risk significant human

actions. In general, the same methods used in the analysis of internal events are applied to the fire

analysis. The ability to identify and quantify errors of commission is a widely recognized weakness

of the existing methods. The incidents reviewed confirm that both errors of omission and errors of

commission are an important aspect of fire PRAs. Efforts are underway to improve PRA human

factors analysis methods, and in particular, to address the process that leads to errors including errors

of commission.[17] The methods under development shift the focus from human errors to “human

failure events” based on a concept of an “error forcing context.” That is, the approach presumes that

people are led to take a particular action, or to not take an action, based on the context of information

with which they are presented. This approach can address both errors of omission and errors of

commission. Efforts to apply this approach to fire are ongoing. 
Insights

48

4.5.4 Credited Human Recovery Actions

With regard to credited human recovery actions, insights were developed in two major areas. The

first relates to crediting actions not cited in plant procedures. A typical fire PRA would not credit

actions unless they are included in the plant emergency response procedures. In a number of the

incidents reviewed here operators successfully implemented actions that were not a part of the plant

procedures in order to recover the plant. Examples from the review are the following:

S In the incident at Armenia, operators routed a new power cable from a diesel generator

directly to a pump in order to bypass fire-damaged cables and overcome, in effect, a station

blackout condition.

S During the fire at Greifswald, operators routed a power feed from the sister unit to overcome

the Unit 1 station blackout and recover one auxiliary feedwater pump.

S In the Browns Ferry fire, among other actions, operators tapped into containment electrical

penetration feeds to obtain critical plant readings bypassing fire-damaged cables. They also

relied on a CRD pump to provide core cooling make-up flow, an approach that was not, at

the time, included in the plant procedures.

S In the incident at South Ukraine, the operators correctly diagnosed the presence of a fire

inside the containment despite the failure of the fire detection system (based on increasing

containment pressure).

S At Narora, the plant suffered a loss of all power, main control room abandonment and loss

of the alternate control functions. Nonetheless, operators took appropriate actions to recover

the plant. This included manually aligning borated water flow into the core and using a diesel

engine driven fire pump to provide water flow into the steam generators. These actions

ensured reactor shutdown and primary side cooling.

It would appear from the current review that operators can, and will, take actions that are not in their

procedures if that is what is needed to prevent core damage. Hence, PRAs seem to be conservative

in this regard.

The second area of insight is the impact of smoke and fire on operator recovery actions. This review

identified both successes and failures in this regard; that is, some attempted actions could not be

completed due to fire effects, but in a number of incidents operators have successfully completed

actions despite adverse conditions. Case examples identified in this review are the following:

S During several of the incidents (Browns Ferry, Beloyarsk, Armenia NPP, Zaparozhye, Fort

St. Vrain, Oconee, Calvert Cliffs, Vandellos and Narora) smoke from fires in other areas

found its way into the main control room. The quantity of smoke varied substantially. With

the exception of Narora, in each of these incidents the operators remained in the control
Insights

49

room. In some of these cases it would appear that the smoke did have some adverse impact

on operator performance (Oconee, Narora, Beloyarsk). Narora is the only known incident

where a fire led to forced abandonment of the main control room.

S During the fire at Beloyarsk, operators performed successfully under very harsh conditions

that included the spread of fire into the main control room.

S At Vandellos, operators wearing SCBA entered smoke filled compartments in order to

manually manipulate critical valves. These actions were successful.

S During the Browns Ferry incident, parts of the reactor building filled with dense smoke. This

smoke prevented operators from manually opening certain valves that were needed to

establish torus cooling.

In this regard current PRA practices were shown to be somewhat dichotomous. On the one hand,

fire PRAs commonly assume that no operator actions (other than fire fighting) can be taken in an area

impacted either directly or indirectly by a fire. Nominally, this would include both areas where a fire

is actually postulated and areas that become smoke-filled as a result of a fire elsewhere. On the other

hand, fire PRAs rarely give explicit consideration to smoke movement. It is unlikely that the smoke

movement observed during some of these fire incidents would have been predicted in a PRA analysis

of corresponding scenarios. Hence the dichotomy - most PRAs would not credit actions in smokefilled areas but would also fail to explicitly consider what plant areas might become smoke-filled

during any given fire.

Given this perspective one can conclude that current PRA methods contain elements that may lead

to conservative assumptions (assuming no credit for actions in smoke-filled rooms) while other

omissions (the failure to explicitly consider smoke movement) may lead to some optimism. Achieving

a proper balance between these two aspects of the analysis may require some added attention. It

would appear clear that simply applying the human reliability values from the internal events PRA

analysis, a practice applied in some of the IPEEE analyses in particular, is not appropriate for fires.

In current practice, it is more common to apply performance shaping factors (PSFs) to reflect an

increased probability of failure for manual recovery actions in the event of fire. These are often

applied only to actions that take place outside the main control room. That is, actions that take place

inside the main control room are commonly considered unaffected by fires that occur outside the

control room. The PSF approach does have the potential to address probabilistically the potential

that smoke spread might lead to operator errors or prevent some recovery actions. This could also

include the potential for smoke ingress into the main control room as well. However, current

guidance does not explicitly discuss potential smoke spread problems as an aspect of the PSF

quantification. Some additional development of these methods, and in particular refinement explicitly

for fire PRA, may be appropriate.
Insights

50

4.5.5 Multiple Events from the Same Root Cause

Several incidents have demonstrated that, under special conditions, it is possible to experience more

than one major event at the same time. Examples identified in this study are as follows:

S The Vandellos incident was initiated by a turbine blade failure. Fragments of the ejected

blades cut through turbine lube oil piping leading to a major turbine building fire. Fireinduced damage to a flexible joint in the main circulating water system piping allowed a very

large quantity of seawater to enter the turbine building. This water flooded the lower levels

of both the turbine and reactor buildings to a depth of about 32 inches.

S Both the Narora and Salem incidents were also initiated by a turbine blade failure. Again, in

both cases this initial failure led to oil and hydrogen release, and a large fire.

In a typical PRA, only one initiating event is assumed to occur at any given time and it is assumed that

all initiating event categories are independent. That is, a typical fire PRA would consider fires alone

and would not, for example, consider fires coincident with internal flooding or a turbine blade ejection

event. At most, a typical fire PRA might qualitatively assess the potential for flooding due to fire

suppression water, but even in those analyses potential flooding concerns are not addressed

quantitatively. The above mentioned incidents, and Vandellos in particular, point out the possibility

that fires may occur concurrent with other initiating events. Some additional attention to such events

in PRA may be warranted. It should be noted here that multiple events were only observed in turbine

building related fire incidents. 

4.5.6 Non-Safety Related Areas and the Use of Internal Events PRA Model

In a typical fire PRA, a fire scenario that can only affect non-safety related equipment and cables is

considered risk insignificant. Such fires are widely screened out without a detailed analyses. Oconee,

Waterford and North Anna were such fires; that is, if a fire PRA had considered these fires, they

would have likely been screened in the initial stages of the analysis.

In the case of Oconee however, the chain of events that followed the switchgear fire led the reactor

into an overcooling condition. The significance of this incident lies in the actions that the operators

took from the control room. It is not clear how much the operators were influenced by the fire itself.

The fire must have had some effect on the operators as it created a condition in the plant that was

somewhat unpredictable (given failure of part of the integrated control system (ICS)). Also, one

report states that some smoke got into the control room and cites this as a factor in the operator

errors observed.

There are some similarities between the Oconee and the North Anna fire incidents. At North Anna

a main transformer failed catastrophically and the ensuing fire damaged non-safety related cables.

Although only non-safety related components and cables were involved, a spurious safety injection
Insights

51

signal was received. In that incident, the operators carefully monitored and controlled the core

temperature decrease.

In most fire PRAs, fire scenarios are retained during initial screening if they have the potential to

either damage safe shutdown equipment or lead to a demand for safe shutdown (a plant trip). It is

uncommon for a fire PRA to look for ways that a fire in non-safety related areas of the plant might

lead to unexpected plant conditions. It is effectively assumed that the fire is just another cause for

the failure of non-safety related cables and equipment of that location so that the experience would

be reflected in internal events analysis random failures.

The event trees, fault trees and the list of initiating events developed in the internal events PRA

analysis are commonly used in fire PRAs to establish which components are risk significant and to

quantify core damage frequencies for various fire scenarios. To make the event trees and fault trees

manageable, simplifying assumptions are made in the internal events analysis based on the combined

likelihood of a given sequence of events. As a result many event sequences may be screened out from

the event tree and fault tree models based on a perceived low likelihood of occurrence. These

screening assumptions may not be valid for all fire scenarios.

For example, overcooling of the reactor (an overcooling transient) may occur if several diverse events

take place simultaneously (typically a combination of random equipment failures and operator errors).

The required sequence of events is often found to be a very unlikely in the context of an internal

events PRA. Hence, overcooling transients may not be represented in the final plant sequences

quantified in the risk study. The Oconee fire incident demonstrates that the assumption of

independence among nominally diverse events may not be valid when fire is involved as a potential

common cause source of equipment failures and/or operator error. At Oconee the switchgear failure

caused two reactor coolant pumps to trip while feedwater control was lost due to failure of the

Integrated Control System (ICS). The fire may also have affected the control room operators (smoke

got into the control room and it took close to an hour to extinguish the fire), who did not pay close

attention to cold leg temperature drop and allowed the reactor to cooldown at a rate greater than

what was specified in the technical specifications. This implies that fire PRAs may need to more

carefully examine the simplifying assumptions used in the development of the internal events plant

response models to ensure that those assumptions are appropriate to the fire analysis as well.
Conclusions

52

5.0 CONCLUSIONS 

This study has reviewed a select set of fire incidents that have occurred at nuclear power plants

around the world in order to glean insights relevant to fire PRA practices, methods, and assumptions.

The objectives of the review were to:[11]

S identify key fire risk and fire PRA insights from serious U.S. and international nuclear power

plant fires, and

S develop recommendations for PRA improvements and areas for further investigation.

Indeed, insights have been gained relevant to fire PRA methodologies, assumptions and data. The

overall conclusions of this study are provided in Section 5.1. Conclusions and recommendations

related to specific topical areas are discussed in Section 5.2. The incident review process also

provided some insights about the quality and usefulness of fire incident reports. Comments regarding

this matter are provided in Section 5.3.

5.1 General Insights

This review has provided numerous insights regarding the validity, accuracy and applicability of fire

PRA methods, data and scope. The review has confirmed many of the assumptions made and

conclusions reached in a typical fire PRA including the commonly held perception that fires can

challenge plant safety. It was found that in many situations fire PRAs apply conservative

assumptions. However, the incidents also included behaviors and chain of event sequences that have

not been considered in past fire PRAs. In general, in the judgement of the authors, the identified

analysis omissions would not seriously compromise the overall conclusions of a complete and quality

fire PRA as currently applied to U.S. plants.

It appears from the incident review that, in general terms, there are substantial differences in the

progression and outcome of fire incidents between Western and Soviet-design plants. These

differences are likely a reflection of differences in design, construction and maintenance practices and

materials selection, particularly as related to cables and electrical systems. Indeed, it would appear

from the incidents reviewed that, historically, the likelihood that a fire might substantially challenge

plant safety appears much lower for U.S. plants than for Soviet-designed reactors. (As noted below,

the Soviet-designed plants have undergone significant fire safety upgrades.) As a result, the fire PRA

omissions identified in this review would have a more substantial impact on a PRA conducted for a

foreign reactor design than they would on U.S. fire risk assessments.

This review identified six fires that have seriously challenged nuclear safety at an operating reactor.

In the US, the only such fire incident was the 1975 Browns Ferry fire. Since that time, many plant

improvements specifically aimed at enhancing the fire safety of U.S. plants have been implemented.

These improvements derive primarily from implementation of the 10CFR50 Appendix R requirements

that were a direct result of the Browns Ferry fire. The lack of any fires that have significantly
Conclusions

53

challenged nuclear safety at any plant in the U.S. since 1975 is likely a reflection of these fire

protection enhancements.

For the Soviet-designed reactors, this review identified four fires occurring between 1978 and 1988

that presented equal or perhaps greater safety challenges than the Browns Ferry incident. (Two

additional fires that occurred during the final phases of plant construction would have challenged

nuclear safety had the plants been in operation at the time of the fires.) In each of these incidents, the

post-fire recovery efforts benefitted from reactor design features that allowed a substantial time

(several hours) to recover core cooling functions before the onset of core damage. It is also

noteworthy that no major fire events in Soviet-designed plants since 1988 were identified. Since the

mid-1980s substantial effort has been made to upgrade fire safety at plants in Russia and other

countries with Soviet-designed reactors. This includes the application of fire retardant coating on

cables, upgrading of fire barriers, improved fire suppression systems, and improved protective gear

for plant operators and fire fighting personnel. As with the U.S. improvements, this may be a

significant contributing factor to the lack of fires leading to a significant nuclear safety challenge since

1988 for the Soviet-designed plants.

The sixth seriously challenging fire event took place at the Narora plant in India in 1993. Narora is

substantially different from either U.S. or Soviet designs. It can be argued that of all the fires

reviewed, this incident led to the most serious nuclear safety challenge. None of the fires reviewed

actually led to any reactor core damage.

The review has identified important lessons in conducting fire PRA and points to areas where

improved fire PRA methods and data may provide added benefits. Some refinements in fire PRA

methodology may be appropriate. The incidents have demonstrated that smoke propagation can

impact the effectiveness of the operators and fire fighters. Current fire PRA methods remain weak

in their treatment of smoke effects. Turbine building fires and fires involving non-safety related areas

of the plant are generally screened out in the initial stages of a fire PRA. Reviewed incidents indicate

that complications from such fires (e.g., smoke propagation and operator error during plant

shutdown) may lead into event sequences otherwise considered as very unlikely. There is a potential

that such sequences, which are typically screened out in the internal events analysis, may not be

picked up in a fire PRA.

The review has also identified some gaps in current fire PRA methodology. In particular, current

methods do not address the possibility of multiple initial fires, secondary fires and multiple initiating

events. Several fire incidents involved multiple fires ignited at different locations of the plant due to

a single root cause (multiple initial fires). In a few cases, additional fires ignited due to damage

caused by the original fire (secondary fires). Current fire PRA methodologies do not include an

explicit provision for identifying such fire scenarios. Also, a fire incident may be a part of an event

involving several distinctly different hazards (or initiators). For example, several incidents involved

a turbine blade ejection incident leading to a fire, and/or involved a fire concurrent with substantial

plant flooding. These types of events are not included in the scope of a typical fire PRA.
Conclusions

9Self-ignited cable fire analysis methods are being addressed separately under Task 3 of

this program (JCN Y6037).

54

5.2 Specific Methodological Insights

Based on this review several specific methodological insights were gleaned. Several empirical

observations were also made relating to the strengths and weaknesses of current fire PRA

methodologies. These insights and observations are summarized below. The insights are categorized

by the elements of a fire PRA analysis (see Section 2.4).

Fire Initiation

S Fires may occur concurrently at different locations within the plant. Fires may occur

simultaneously as the result of a common root cause (multiple initial fires) or as the result of

the damage caused by an initial fire (secondary fires). Current PRA methodologies are

generally capable of addressing concurrent fires. That is, it is possible to postulate multiple

fires and assess the cumulative impact of damage from each fire. However, no basis has been

established for predicting under what conditions such fires might occur. Some additional

examination of such events may be warranted to assess their potential risk importance

(frequency and consequence). If such events are found to be potentially risk important, then

some additional methodological development would also be needed.

S Electrical faults have led to self-ignited cable fires, even in the case of relatively low power

(220VAC) circuits. Current PRA methods are capable of dealing with such fires. However,

much uncertainty remains regarding relevant phenomena and the potential for creating a self

sustaining fire. Therefore, the underlying assumptions and methods of analysis warrant

further review in particular in the areas of occurrence frequency, the impact of various circuit

characteristics (e.g., voltage level), how cable type influences the possibility and rate of fire

growth, and methods for partitioning the general fire frequency to specific cables, fire areas,

or fire scenarios.9

Fire Propagation

S IEEE-383 qualified cables may sustain combustion and propagate the fire given a sufficient

exposure source. This confirms the need to model propagation of such fires in a fire PRA.

S Certain of the fires at Soviet-designed plants readily propagated along both horizontal and

vertical cable trays. Nominally similar initial fires in U.S. plants were seen to propagate less

readily, and none (including Browns Ferry) led to comparable physical fire extent or damage.

It would appear that the potential for rapidly growing cable fires was higher for Sovietdesigned plants than for U.S. plants, likely as a result of cable material selection and

construction practices. (As discussed above, conditions at the Soviet-designed plants have
Conclusions

55

changed substantially since the fires identified in this review. Various fire protection upgrades

have been implemented that will likely reduce the fire hazard substantially.)

S In the Soviet-designed plants a number of fire incidents involving inter-compartment fire

spread were identified. In almost all such cases, faulty fire barrier elements or a lack

appropriate fire barrier penetration seals facilitated the propagation of fire and smoke to

adjacent compartments. For U.S. plants, only the Browns Ferry fire involved intercompartment fire spread, and that case involved an incomplete penetration seal. This

confirms the importance of fire barriers to fire safety, and illustrates that plant specific

conditions dictate the possibility of fire spread to adjacent compartments. Such factors are

typically considered in a quality fire PRA as a part of plant walk-downs.

S In at least one case room-to-room fire propagation was observed due to the spread of hot

gasses only (i.e., in the absence of a direct flame spread path). In this case the fire spread may

have been the result of the fire-induced failure of an energized cable. Electrical arcing leading

to ignition of secondary fires as a result of cable failure has been observed in testing[26], but

is not considered as a mechanism for fire spread in current fire PRAs. Consideration of this

effect would require modification of the computer fire models used to predict cable fire

growth behavior.

Fire Detection and Suppression

S For long-duration fires, four factors were observed that influenced the duration of fires before

suppression: a delay in initiating the fire fighting activities, use of ineffective extinguishing

media during initial attacks on the fire, the initial severity of the fire, and inaccessibility of the

fire. Current methods for treating fire suppression in a PRA would not fully capture all such

effects. Some review of these methods may be warranted.9

S Poor decision making or distractions from ongoing events can delay the activation of the fire

brigade, even for severe fires. The implications of this insight depend on which of the two

commonly applied approaches to manual fire brigade response assessments is being applied

in the fire PRA:

S Use of a generic curve characterizing the probability of suppression versus time based

on historical fire incident data inherently includes these factors, but these methods

have not, in the PRAs which have used them, been adjusted to reflect to plant- or

scenario-specific factors.

S Methods that base the timing of manual fire fighting on fire brigade practice drill

response times do not explicitly consider these factors.
Conclusions

10Fire suppression analysis methods are being addressed separately under Task 2 of the

USNRC Fire Risk Methods research program (JCN Y6037).

56

Given this perspective, some additional refinement of manual fire fighting assessment methods

may be appropriate.10

S Once fire fighting is initiated, plant personnel may still make repeated attempts to extinguish

a fire using ineffective suppression methods (such as hand-held gaseous fire extinguishers).

Various events illustrate a continued reluctance to use water on electrical fires. In fire PRA,

it is often assumed that once initiated, manual fire fighting will be promptly effective. Some

additional treatment of the possibility of ineffective or delayed fire brigade response may be

warranted.

S Reduced visibility caused by smoke can seriously affect fire fighting effectiveness. Current

fire PRAs do not explicitly model smoke propagation. Hence, the plant specific conditions

that may lead to smoke impacting fire fighting activities are not considered in a typical PRA

analysis.

S The availability of automatic fire detection and suppression systems can be compromised by

the fire itself, or by human errors prior to the fire event. Plant specific conditions contribute

to such situations. Plant walk-downs are one vehicle by which these conditions may be

identified. However, current PRAs would generally not include explicit consideration of these

factors. Generic fire protection system reliability estimates may inherently include such

failures, but would not account for the relevant plant-specific factors.

S Significant equipment losses may occur early in a fire (e.g., well before fire control or final

fire extinguishment), but may also occur after a prolonged time. Hence, it is important for

fire PRAs to consider a range of possible fire durations including long duration fires (i.e., in

excess of one hour). That is, it is important to correctly characterize suppression time

distributions. PRAs that fail to consider long duration fires, and as a result limit the assumed

extent of fire damage, may miss significant fire risk contributors.

S Related to the preceding insight, fire damage can occur despite successful operation of fixed

fire suppression systems. Some fire PRAs assume that successful operation of a fixed fire

suppression system will control the fire and prevent additional damage to critical cables and

components. This assumption may not be valid, in particular, for a congested area (such as

cable spreading room or cable vault area), where the fire suppression system may be blocked

by large equipment (such as in the turbine building), or where the initial intensity of the fire

is sufficient to overwhelm the suppression system (such as in a large oil fire).
Conclusions

11Circuit analysis and the spurious operation of equipment is being addressed separately

under Task 1 of the USNRC Fire Risk Methods research program (JCN Y6037),

57

Equipment Damage

S A number of the fire incidents did include indications of spurious equipment actuations and

other circuit effects as the result of fire-induced cable damage. This issue is the subject of

current debate, in particular, with regard to the appropriate scope of the assessment and the

conditional probability of spurious actuations or other circuit effects. Few fire PRAs have

attempted a comprehensive treatment of fire-induced circuit fault effects beyond loss of

function. Existing fire PRA methodologies can be adapted to address the possibility of

spurious actuation of equipment.11

S Structural failures may occur in a severe fire, and this may cause additional damage. Such

failures are of particular relevance to the turbine building where large quantities of

combustible materials are present. Fire PRAs do not typically consider structural damage as

a possible outcome of a severe fire. Some re-assessment of screening methods, and in

particular as applied to the turbine building, may be warranted.

S Additional hazards may result from, or occur simultaneously with, a fire. This includes

flooding (e.g., due to fire-induced expansion joint breaks), major equipment failures (e.g.,

turbine or transformer failure), pressure/shock effects (e.g., hydrogen release and

deflagration) and shrapnel damage (e.g., turbine blade ejection or shrapnel caused by

energetic electrical faults). Current PRAs seldom consider simultaneous occurrence of

multiple hazards. 

Impact on Plant Safety Functions

S Redundant safety equipment may be rendered unavailable through indirect fire effects. For

example, operators may shut down operable equipment to facilitate fire fighting. This was

noted in particular during fires in Soviet-designed plants where procedures call for deenergizing electrical equipment before attempting manual fire suppression. Hence, this

appears to be a plant specific phenomenon (based on plant fire fighting procedures). Current

fire PRA methodologies could be adapted to address such scenarios. For example, an analyst

might assign an increased “random” failure probability for the redundant train to reflect this

potential. However, a technical basis for incorporating such equipment losses has not been

developed.

S In fire PRA, fires affecting non-safety related components are often screened out without a

detailed review of the potential impact on balance of plant functions and the operator actions

that may ensue. At least one event has demonstrated that such a fire may adversely influence

operator actions and may cause entry into accident sequences nominally considered to be of
Conclusions

58

very low likelihood (i.e., in the internal events analysis). Current fire PRA methodologies can

address such scenarios. This may, however, require a more thorough review and assessment

by the fire PRA analyst of the simplifying assumptions applied in the development and

screening of plant accident sequences during the internal events analysis.

S The fire incidents included cases where fire effects (heat and smoke) prevented successful

completion of attempted operator actions. However, the events also included cases where

operators played a critical role in ensuring core cooling under very difficult conditions. PRA

methods were generally seen to be conservative in this regard and would not have credited

operator actions taken during some incidents that were, in fact, successful.

S Several of the reviewed incidents involved smoke from ex-control room fires entering the

main control room. While only one case (Narora) required abandonment of the main control

room, in various cases smoke was cited as having impacted operator effectiveness. Current

PRAs commonly assume that fires outside the control room will not impact the reliability of

operator actions that take place within the control room. These assumptions may be modestly

optimistic.

5.3 Availability and Quality of Incident Data

The availability of quality information for a given fire was instrumental to achieving the objectives of

this study. At practically all stages of this study, as more detailed information on each event became

available, the number of relevant and interesting insights obtained increased. The most useful

information was typically obtained from narrative descriptions of the fire, through discussions with

knowledgeable individuals and through the reconstruction of the detailed time line or chain of events

for each fire. This reinforces what is very well known among those who conduct accident

investigations and accident analyses; namely, the details of an incident are extremely important and

the recording or cataloging of incidents using a formatted reporting structure often masks information

that at some later point may be of specific interest. This illustrates that in cataloging incident reports,

it is extremely important to maintain the details of an incident to facilitate future analyses of the

incidents rather than to rely only on pre-formatted or standardized incident reporting forms. Standard

form-based reports often will delete any extended incident narratives. For example, only an extremely

detailed incident reporting form (which is not typical of the fire events data bases currently available

or under development) would capture such important insights as multiple and/or ineffective

suppression attempts using hand held extinguishers before the application of water, subtle aspects of

operator responses to the situation, or the difference between multiple and secondary fires.
References

59

6.0 REFERENCES

1. N.O. Siu, “Fire Risk Assessment for Nuclear Power Plants”, SFPE Handbook of Fire

Protection Engineering, 3rd Edition, Society of Fire Protection Engineers, publication

forthcoming.

2. M. Kazarians, N. O. Siu, and G. Apostolakis, “Fire Risk Analysis for Nuclear Power Plants:

Methodological Developments and Applications,” Risk Analysis, 5, No. 1, 33-51, 1985.

3. W. Parkinson, et al., Fire PRA Implementation Guide, Electric Power Research Institute,

EPRI TR-105928, December 1995.

4. "Fire-Induced Vulnerability Evaluation (FIVE) Methodology Plant Screening Guide,"

Professional Loss Control, EPRI TR-100370, April 1992.

5. Lambright, J., S. Nowlen, V.F. Nicolette, and M.P. Bohn, Fire Risk Scoping Study:

Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues,

NUREG/CR-5088, USNRC, January 1989.

6. A. M. Rubin, et. al. “An Update of Preliminary Perspectives Gained from Individual Plant

Examination of External Events (IPEEE) Submittal Reviews”, Nuclear Engineering and

Design, 194 (1999) 225-250.

7. Kazarians, M., and G. Apostolakis, "Modeling Rare Events: The Frequencies of Fires in

Nuclear Power Plants," presented at the Workshop on Low Probability/High Consequence

Risk Analysis, Arlington, Virginia, June 15-17, 1982.

8. Siu, N. and G. Apostolakis, “A Methodology for Analyzing the Detection and Suppression

of Fires in Nuclear Power Plants”, Nuclear Science and Engineering, 93, pp.213-226 (1986)

9. J.A. Lambright, et.al., Analysis of the LaSalle Unit 2 Nuclear Power Plant: Risk

Methodologies Integration and Evaluation Program (RMIEP); Internal Fire Analysis,

NUREG/CR-4832, Volume 9, USNRC, March 1993.

10. James R. Houghton, “Special Study - Fire Events - Feedback of U.S. Operating Experience”,

U.S. Nuclear Regulatory Commission, AEOD/S97-03, June 1997.

11. N. Siu, H.W. Woods, S.P. Nowlen, A. Mosleh, "The U.S. Nuclear Regulatory Commission's

Fire Risk Research," PSAM 5, International Conference on Probabilistic Safety Assessment

and Management, Osaka, Japan, November 27-December 1, 2000.

12. Heikki Aulamo, Jouko Martilla and Heikki Reponen, “The Full Stories on Armenia and

Beloyarsk”, Nuclear Engineering International, July 1995.
References

60

13. “Turbine Oil Fire in a Nuclear Power Plant,” Schaden Spiegel, pp. 73-83, March 1973.

14. “Fires in Turbine Halls and Nuclear Power Plant Safety”, ASSET/IRS Activity, International

Atomic Energy Agency, Vienna, Austria, December 11-13, 1991.

15. E. Pla, “Fire at Vandellos 1: Causes, Consequences and Problems Identified”, Fire and Safety

‘94, Barcelona, Spain 5 - 7 December, 1994.

16. Report of the ASSET Mission to the Chernobyl Nuclear Power Plant, International Atomic

Energy Agency, IAEA-NENS/ASSET/92/A/03, June 22-26, 1992.

17. Technical Basis and Implementation Guidelines for A Technique for Human Event Analysis

(ATHEANA), NUREG-1624, Rev.1, USNRC, May 2000.

18. Licensee Event Reports (LERs) - a form report that is often accompanied with a narrative

text submitted by the licensees to the U.S. Nuclear Regulatory Commission after the

occurrence of a reportable event per regulatory requirements. LERs are maintained in a

searchable data base by Oak Ridge National Laboratory.

19. W. Wheelis, User's Guide for a Personnel Computer Based Nuclear Power Plant Fire Data

Base, NUREG/CR-4586, USNRC, August 1986. 

20. W. Parkinson, et al., Fire Events Database for U.S. Nuclear Power Plants, Electric Power

Research Institute, NSAC-178L, December 1991.

21. Budnitz, R. J., H.E. Lambert, G. Apostolakis, J.K. Salas, J-S Wu, M. K. Ravindra, A

Methodology for Analyzing Precursors to Earthquakes-Initiated and Fire-Initiated Accident

Sequences, NUREC/CR-6544, USNRC, April 1998. 

22. IEEE Standard for Type Test of Class 1E Electric Cables, Field Splices, and Connections

for Nuclear Power Generating Stations, IEEE-383-1974, Approved Apr. 30, 1975.

23. C. Ruger, J.L. Boccio and M.A. Azarm, Evaluation of Current Methodology Employed in

Probabilistic Risk Assessment (PRA) of Fire Events at Nuclear Power Plants, NUREG/CR4229, USNRC, May 1985.

24. “Treatment of Internal Fires in Probabilistic Safety Assessment for Nuclear Power Plants”,

Safety Reports Series No. 10, International Atomic Energy Agency, Vienna, Austria 1998.

25. Reactor Core Protection Evaluation Methodology for Fires at RBMK and VVER Nuclear

Power Plants, DOE/NE-0113, Rev. 1, USDOE, June 1997.
References

61

26. S. Nowlen, An Investigation of the Effects of Thermal Aging on the Fire Damageability of

Electric Cables, NUREG/CR-5546, USNRC, May 1991. 

27. “Browns Ferry Nuclear Power Plant Fire”, Hearings Before the Joint Committee on Atomic

Energy, Congress of the United States, 94th Congress, September, 1975.

28. Based on review comments provided by Andrew G. Minister, Project Manager of the

International Nuclear Safety Program at Pacific Northwest Laboratory in a letter to Nathan

O. Siu, USNRC/RES, June 16, 2000.

29. C.S. Bajwa and K.S. West, Fire Barrier Penetration Seals in Nuclear Power Plants,

NUREG-1552, Supp. 1, USNRC, January 1999.

30. USNRC Generic Issue 57, “Adverse Impact of Fire Suppression Systems”: see e.g.,

Information Notice 83-41, “Actuation of Fire Suppression Systems Causing Inoperability of

Safety-Related Equipment,” USNRC, June 22, 1983.

31. USNRC Licensee Event Report #26989002, “Fire in 1TA Switchgear Due to Unknown

Cause”, Oconee Nuclear Station, Unit 1, Event Date January 3, 1989.

32. Code of Federal Regulations, Volume 10, Part 50, Appendix R, “Fire Protection Program for

Nuclear Power Facilities Operating Prior to January 1, 1979,” U.S. Federal Government,

1980.

33. USNRC internal memorandum from Alan M. Rubin to Distribution, “EPRI’s Response to

Generic Request for Additional Information (RAI) on the fire PRA Implementation Guide”

January 31, 2000.

 34. J. LaChance, S. P. Nowlen, F. Wyant and V. Dandini, “Circuit Analysis - Failure Mode and

Likelihood Analysis,” A letter report to the USNRC, SNL, May 8, 2000, available through

the USNRC Public Document Room under memorandum from Thomas L. King,

RES/DRAA, to Gary M. Holahan, NRR/DSSA, and Michael E. Mayfield, RES/DET, dated

June 13, 2000, RES File Code RES-2C-1.

1Note that ‘Ansul’ is a manufacturer trade name rather than a fire suppressant. This is a

quote from the applicable report and no further information on the nature of the fire suppressants

used is provided.

A1-1

Appendix 1 - Analysis of San Onofre, Unit 1 Fire on March 12, 1968

A1.1 Plant Characteristics

San Onofre Nuclear Generating Station Unit 1, located near San Clemente, California, was a

Westinghouse Pressurized Water Reactor (PWR) with a 436 MWe (net) rated capacity. It started

commercial operation in 1968, was permanently shutdown in the 1980s, and has since been

decommissioned. [ref. A1-3].

A1.2 Incident Progressions and Implications for Fire PRA

Two similar incidents involving self-ignited cable fires took place within a short time [Ref. A1-1].

On February 7, 1968, San Onofre 1 experienced a cable fire adjacent to a containment penetration

and on March 12 of the same year another cable fire occurred in a 480-volt switchgear room. 

Although, the focus of this review is on the March 12 incident, because of the similarities between

the two incidents and the short time difference, it was deemed appropriate to describe the first

incident here as well. 

At 4:45 p.m. on February 7, 1968, the unit was operating at 380 MWe and performing core

depletion tests. All of the pressurizer heaters had been on for 96 hours when the operator noticed

that the heaters were not actually operating. At about the same time, the control room received a

480-volt bus ground alarm and a loud noise was heard in the control room and the lights flickered.

At 4:47 a security officer reported a fire at the Southeast side of the containment. The reactor

operator transferred the No.1 480-volt bus to the #3 480-volt bus which caused ground

indications on both buses. The reactor operator then transferred the 480-volt buses back to their

normal sources. The #1 480-volt bus ground cleared when the Group C pressurizer heater

breaker was opened. (A clear indication of a ground fault on the heater power cables.)

At 5:10 p.m. the reactor and turbine (generator) were manually tripped. No spurious equipment

operations were noted during the incident and there was no apparent effect on the reactor

shutdown/cooldown efforts. Fire fighting was initiated immediately and the fire was very quickly

reported to be under control at 4:47 p.m. (just two minutes from the first signs of the presence of

fire). The fire was fought with CO2 and Ansul 1 portable extinguishers. 

On March 12, 1968, San Onofre 1 experienced another cable fire, this time in a cable tray in the

No.2 480-volt switchgear room. At the time of the fire incident, the unit was operating at 380

MWe when, at 12:21 a.m., several alarms were received in the control room including: “Intake

Structure Hi Level,” “480-volt System Ground,” “Station DC Bus Ground or Low Voltage,” and
A1-2

“Hydraulic Stop Gate Trouble.” These were followed shortly by a “Sphere Heating and

Ventilating System Trouble” alarm. 

At 12:25 a.m., the annunciator panels for the “turbine-generator first out, auxiliary, and electrical

boards” were lost. An auxiliary operator reported smoke in the No.2 480-volt switchgear room. 

At 12:27 a.m., operators observed blue arcing above the east door window of the No.2 480-volt

switchgear room.

At 12:32 a.m., fire was observed in three cable trays above the east door. 

The reactor was tripped at 12:34 a.m., and began unit shutdown actions at 12:37 a.m. The No.2

480-volt bus was cleared by over-current relay operation. 

At 12:35 a.m., assistance was requested from the closest outside fire department, which happened

to be a Marine Corps Fire Department.

At 12:45 a.m., 24 minutes after the first control room alarms were received, the Fire Department

arrived on the scene. The electric motor driven fire pumps would not start. Therefore, the started

the gasoline engine driven backup emergency fire pump (12:56 a.m.). 

The fire was declared extinguished at 1:00 a.m., 39 minutes after the initial control room alarms. 

During cooldown efforts following the fire, it was determined that the coolant boron

concentration was decreasing instead of increasing as expected, and the cooldown was suspended

for 3 hours and 40 minutes until the problem was diagnosed and fixed.

Post-fire investigation revealed that power and/or control circuits were affected for RHR suction

and discharge valves, the CCW heat exchanger outlet valve, the South primary plant makeup

water pump, and three annunciator panels. Damaged cables rendered the following equipment

electrically inoperable:

- Safety injection recirculation valves

- West recirculation pump and discharge valve

- Electric auxiliary feedwater pump

- Safety injection train valves (West train MOVs)

- Refueling water pump discharge valve to recirculation system

The following equipment was lost due to the relay cutout of the No.2 480-volt bus:

- West RHR pump

- South transfer pump

- Boric acid injection pump

- Boric acid storage tank heaters & boric acid system heat tracing

- South primary plant makeup pump

- Flash tank bypass valve

- East and West flash tank discharge pumps
A1-3

FAULT

Isc0

Isc0

13.4 AMPS Isc2

Isc2

Isc2

Isc2

36.8 AMPS

43.4 AMPS

13.4 AMPS

36.6 AMPS

42.7 AMPS

46.6 AMPS

46.6 AMPS

46.6 AMPS

80 A

Isc2

Isc2

480 V

BUS

480 VOLT

SWITCHGEAR

PRESS. HEATER

DIST. CABINET

CABLE TRAY PRESSURIZER

HEATERS

Figure A1-1: Schematic of Pressurizer Heater Circuits.

- Center component cooling water pump

- Several other MOVs

A1.3 Incident Analysis

While the first incident had only a minimal impact on the plant, a large number of components

were rendered unavailable in the second incident. A sufficient number of components and systems

remained available to allow for orderly shutdown and core cooling. At least one of the alarms

received in the control room was apparently spurious. This is the “Intake Structure Hi Level”

alarm. An operator reporting from the intake structure found no reason for this alarm to have

sounded.

In terms of the fire cause, there are many similarities between the two incidents. The investigation

concluded that the most probable cause of both fires was thermally and mechanically stressed

cables, coupled with the use of individual fuses to provide for clearing of faults on each phase of

the three-phase 340-volt circuits. It also appears that the cables were undersized for their design

current loads under their actual installations conditions.

The initial fault is thought to have been a cable-to-cable, phase-to-phase hot short involving two

separate power feeds from the same three-phase power bus. The fusing configuration allowed

back-feeding of fault current through the un-faulted phases of each power feed which led to an

even more severe over-current condition for the conductors. Figure A1-1 provides a schematic of

the power circuit for the pressurized heaters. In that figure, ISC0 depicts the initial short circuit

after cable failure and ISC2 is the subsequent short circuit current back-fed through the heaters. 

Note that the portion of ISC2 passing through the intact fuses is below the continuous rating of

each fuse.
2Note that self-ignited cable fires are being addressed separately under Task 3 under this

project (USNRC JCN Y6037).

A1-4

Both incidents involved self-ignited cable fires. They are important because they are the earliest

fire incidents at a nuclear power plant where self-ignition of cables resulted in extensive

equipment damage and loss of operability of equipment. While the first incident saw little or no

fire spread, the second incident saw fire spread to three cable trays that were “totally burned for

15 feet.” Investigation of the incidents led to recommendations that urged industry to re-examine

cable qualification and to raise the standards for establishing cable ampacity limits and for

improving the flammability behavior of cables. Since the time of this fire, cable ampacity

standards have improved substantially and now explicitly address cable tray applications. Cable

ampacity standards are now widely recognized and applied. Further, a flammability standard was

incorporated into IEEE-383, the general nuclear cable qualification standard [Ref. A1-2]. Most

cables used in current U.S. reactors are required to meet this standard.

In both incidents, the fire did not cause complete loss of core cooling capability, core damage,

radiation release or any injury to plant personnel or the public. The available sources do not

discuss in detail fire fighting activities, occurrence of hot shorts (other than the initial cable-tocable fault that initiated the second incident), the nature of other circuit failures or operator

actions in response to the failures caused by the fire.

It may be argued that given the vast changes that have taken place since 1968 (improved ampacity

standards, improved standards for cable flammability, enhanced fire protection features, etc.),

some aspects of the San Onofre fire incidents are not applicable to fire PRA today since the

conditions of that plant at that time were not representative of current conditions of nuclear

power plants in the U.S. The one exception is the insight related to self-ignited cable fires. These

incidents do illustrate that such fires can occur, can propagate, and can lead to severe

consequences. However, this is likely only applicable to older plants in the U.S. since improved

cable flammability standards have been in effect for the industry since 1975. In fire PRA is it

common practice to assume that self-ignited cable fires are possible for older style “unqualified”

cables, but that such fires are not possible for cables that pass the IEEE-383 flammability standard

(“qualified” cables). The lack of any severe self-ignited cable fires after the San Onofre incidents

provides important evidence supporting the validity of these assumptions.2

A1.4 References

A1-1 “San Onofre Nuclear Generating Station Unit 1, Report on Cable Failures - 1968,”

Southern California Edison Company, San Diego Gas & Electric Company, publication date

unknown, but circa 1968.

A1-2 “IEEE Standard for Type Test of Class 1E Electric Cables, Field Splices, and Connections

for Nuclear Power Generating Stations,” ANSI/IEEE STD 383-1974.

A1-3 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A2-1

Appendix 2 - Analysis of Mühleberg Fire on July 21, 1971

A2.1 Plant Characteristics

Mühleberg is a single unit BWR type nuclear power plant located near Mühleberg, Switzerland.

The unit has two identical turbine generators (A and B) rated at 162 MWe per generator for a

total of 324 MWe for the plant. The plant started commercial operation in October, 1972. At the

time of the incident, the plant was undergoing initial power ascension and pre-operational tests. 

Testing of the turbine-generators at 50% of rated power had been completed at the time of the

incident. [ref. A2-5].

A2.2 Summary of the Chain of Events

The chain of events described in this section is based on References [A2-1] and [A2-2]. It was

found that there are differences in the description of the chain of events between these two

sources. Therefore, the authors of this report had to inject their own interpretation of the

available information.

On July 21, 1971, about 21:18 p.m., the plant was in operation and the power level was being

ramped up when the oil pressure in turbine B dropped and the feedwater pumps tripped on high

water level in the reactor. The Reactor Core Isolation Cooling (RCIC) system initiated.

It was later determined that a loosened screwed-on pipe was the cause of an oil leak. The pipes

and the screw joints had been inspected only 15 minutes before the incident and no oil leaks were

reported. The turbine tripped. A partial scram took place initially, which was later followed by a

full scram. 

The leaking oil ignited and started a fire under the turbine. The exact cause of ignition is not

known. It is suspected to be either sparks from a valve limit switch (the loosened pipe was near a

valve assembly), hot surfaces of a fluorescent lamp, hot surfaces of valve housing or autooxidation caused by the oil soaking into the asbestos insulation on the valve housing. (The latter

phenomenon was later shown to be plausible in laboratory settings.)

The exact time of fire ignition cannot be determined. The fire was discovered by a mechanic who

was outside the turbine building and sensed a pressure wave. From this, one can infer that a form

of deflagration or explosion may have taken place. Given a leak in a high pressure oil line, one

plausible explanation is that as the leak developed, some quantity of oil was released as a fine mist

which then ignited causing a minor explosion. However, neither of the available reports is clear

on this subject. The mechanic telephoned the control room immediately. About 21:19, the local

fire department was alerted. Given the timing of the oil pressure drop and reporting of the fire, it

would appear that the fire was detected quite promptly. 

At 21:24, three members of the operating crew entered the turbine building with breathing

apparatus and discovered that the lights were out and dense smoke was filling the building. 
A2-2

At 21:32 the unit generator was tripped by the operators.

At 21:40 head count of the personnel was completed (all were accounted for).

At 21:43, about 24 minutes after notification, the local fire department arrived at the plant.

At 21:53, the fire brigade entered the turbine building wearing self contained breathing apparatus

(SCBA).

The fire was initially confined to an oil fire beneath turbine B, but propagated into two cable trays

also located underneath the turbine. Exhaust fans were used to remove the smoke from the

building. As smoke started to clear an open fire was discovered on top of the oil tank. Initially it

was thought that the oil tank had caught fire. However, it was soon discovered that the fire in the

cable trays underneath the turbine had propagated horizontally to a cable duct above the oil tank

through openings in the wall. The duct was located in the section of the building adjacent to the

turbine.

At 22:02, the fire brigade, using a ladder from a ladder-truck, started spraying water on the ceiling

of the turbine hall.

Fogging nozzles were used to fight the fire. Also, the exhaust fans had to be shutoff because of

the potential for exposure to open flames.

At 22:15, additional plant personnel, who were trained in the use of SCBA, entered the turbine

building and assisted in fire fighting activities.

At 22:56 it was noticed that the fire propagated upwards onto the upper parts of the turbinegenerator set. 

At 23:25 (about 2:07 hours after receiving first indications of an abnormal condition) the fire was

brought under control.

At 00:30, on July 22, the fire fighter’s work was completed.

It must be noted that the fire did not damage any safety related cables and equipment. The

operators managed to initiate and maintain shutdown cooling properly and without any major

difficulties. 

Figure A2-1 is a simplified layout drawing of the plant that shows the area where fire occurred. 

Note that the single lines extending between various items depict cable routes. Item 2 in that

figure is the turbine-generator B, item 4 is the two motor generator sets, items 5 and 6 are the

non-safety switchgear and item 7 is the cable “bridge” (as noted in Reference [A2-1]) between the

reactor and turbine buildings.
A2-3

 Figure A2-1 Location of Fire at Mühleberg (from Reference [2-1])

Extensive damage was inflicted on the turbine building itself. It is estimated that 75% of the roof

covering, 60% of the windows and 50% of the paintwork were severely damaged. Some of the

purlins of the building were deformed, concrete surfaces near the turbine B, a number of gratings

and wall insulation slabs were damaged. Aside from cables and electrical equipment, little direct

damage was sustained by major mechanical equipment. Some peripheral items, insulation and

piping were found to be damaged. However, the cables and electrical equipment sustained

extensive damage. Turbine instrumentation, control panels, lighting equipment and 3000 kg of

PVC cables were found to be severely damaged. 
A2-4

Indirect impact of the fire was considerably more extensive than direct heat damage. The

hydrochloric acid vapors generated in the process of burning PVC cable insulation and interaction

with moisture impacted a large set of equipment including in particular electrical devices (the

switchgear equipment located in the turbine building as noted in Figure 2-1) and electronic

devices. Although on the day after the fire the electrical equipment was sprayed with a

neutralizing agent, the electrical and electronic equipment were still later found to be affected by

the corrosive effects of hydrochloric acid. Ultimately some of the electronic equipment, pump

motors, 380VAC motor control centers, and some of the mechanical and electrical equipment had

to be replaced because of chloride deposits and corrosion.

A2.3 An Analysis of the Incident

The fire incident at Mühleberg is the first known large fire in a nuclear power plant occurring at a

time when the reactor was already active (i.e., excluding construction fires). Although it did not

impact any safety equipment, it caused extensive damage to a large set of equipment and cables. 

The fire was (apparently) detected promptly and reported to the control room by plant personnel. 

Fire fighting was initiated promptly and performed effectively.

This is one of few nuclear power plant fires where structural elements, especially the roof

coverings, sustained some direct fire damage. In this incident the potential effects of a PVC cable

insulation fire are clearly demonstrated. In a fire PRA, the impact of smoke on equipment is

rarely modeled. Recent tests at Sandia National Laboratories [References A2-3 and A2-4] have

demonstrated that electronic equipment may fail from exposure to smoke. At Mühleberg it is

clearly demonstrated that a range of electrical and electronic equipment is susceptible to the

effects of a corrosive smoke. However, from the available information it can be inferred that the

smoke/corrosion damage was a slow process and susceptible equipment remained functional

during the course of the fire. Such effects are typically assumed not to be risk significant since

safe shutdown is assumed to be achieved (or failed) within a relatively short time period. This

incident does not contradict these assumptions.

A2.4 References

A2-1 “Turbine Oil Fire in a Nuclear Power Plant”, Schadenspiegel, 16th, March 1973. 

A2-2 Von H.R. Lutz, “Der Turbinenölbrand im Kernkraftwerk Mühleberg”, Der

Maschinenschaden, pp. 96-102, Vol. 45, 1972. 

A2-3 T. J. Tanaka, Effects of Smoke on Functional Circuits, Sandia National Laboratories,

prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-6543, SAND97-2544, October

1997.

A2-4 T. J. Tanaka, “Measurements of the Effects of Smoke on Active Circuits”, Fire and

Materials, 23, 103-108, 1999.

A2-5 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A3-1

Appendix 3 - Analysis of Browns Ferry 1 and 2 Fire on March 22, 1975

A3.1 Plant Characteristics

Browns Ferry nuclear power plant is a three unit BWR located near Decatur, Alabama. At the

time of the fire, Units 1 and 2 were in the very last stages of obtaining their operating licenses. 

Unit 3 was still under construction. Each unit is rated at 1,067 MWe. Units 1 and 2 have a

shared control room and cable spreading room (CSR) while unit three is a separate unit. 

[Ref. A3!4].

There has been much written about the 1975 CSR and Reactor Building (RB) fire that occurred in

Browns Ferry Unit 1. As a result, there is wide-spread knowledge throughout the international

community regarding this incident. It is not our intent to repeat past discussions. The discussion

that follows will focus on those events within this incident that have direct relevance to the

objective of this study; namely, to develop fire PRA insights.

A3.2 Chain of Events and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (References [A3-1] and [A3-2]). If the precise timing and the

order of an event is not known, the time of occurrence is not specified. However, it is included

at an order of presentation based purely on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided. Unless otherwise noted, the event descriptions refer to events impacting

Unit 1.

Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

Prior to

the

incident

The power cables for two 480 VAC boards from

opposite safety trains were routed during

construction, erroneously, inside the same cable

tray. (Regulatory Guide 1.75 which was in

effect at the time disallows this practice.)

In a fire PRA, error in routing of cables is not

taken into consideration. The actual discovery

of such a construction error is rare. No other

such incidents are known to the authors. 

Therefore, the assumption used in fire PRAs

should generally be considered as acceptable. 
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-2

Prior to

the

incident

Polyurethane foam was used at Browns Ferry to

seal penetrations. Polyurethane is a flammable

material. After filling a penetration with

polyurethane, it was coated with Flamastic 71, a

non-flammable fire retardant coating material. 

The combination had been tested and shown to

meet fire resistant standards.

It is inherently assumed in a PRA that

penetration seals are not a significant fuel

source. Silicone foam is now the predominant

seal material. Silicone is technically

flammable, but it burns quite poorly. The use of

polyurethane foam at Browns Ferry is not

considered to have significant implications for

current fire PRAs.

Prior to

the

incident

The plant was operating with some of its

penetration seals incomplete. Depending on the

seal, their integrity was violated (e.g., as a part

of additional construction/maintenance activity),

had not been fully leak tested and/or the

intended Flamastic 71 coating was not applied. 

Also, the cable penetration seals for openings

between the CSR and control room were still

under construction.

In a typical fire PRA, the probability of a

penetration being open is assumed to be about

1x10-3-1x10-2 per penetration. The possibility of

a large number of penetrations being incomplete

is not considered likely. For a power plant that

is several years into commercial operation this

assumption should remain valid. Browns Ferry

was a new plant just completing construction. 

Hence, this condition is not considered relevant

to current fire PRAs for mature plants.

Prior to

the

incident

Workers were checking incomplete CSR - to -

RB seals for leaks using candle flame to detect

air flow (the RB was under negative pressure).

Introduction of an ignition source such as a

candle into a plant is not considered in fire

PRA. However, this practice would be

explicitly disallowed at plants today. Hence,

this aspect of the incident is not considered

relevant to current PRA practice.

Prior to

the

incident

A CO2 suppression system was installed for the

CSR, but during construction metal plates were

installed under the breakout glass for manual

system initiation device. This would have

prevented manual activation of the system. Fire

protection system inspections by TVA personnel

had not discovered the presence of the plates.

This is one example about how certain fire

protection features may not be available when

needed. Fire PRAs may credit manual actuation

of automatic systems, although this is not

currently common practice. The overall failure

probability currently assumed for fixed systems

should cover such events. 

~ -48:00 On or about March 20, 1975 two fires had

occurred in the CSR because of candle flame

usage. In one case a dry chemical extinguisher

was used. No reports were filed with the NRC

or internally except for a log entry. The second

fire was discussed in an operators’ meeting.

Fire PRAs do not consider pre-cursor events. 

Fire initiation frequencies are based on reported

fires. In this case, it is difficult to establish

whether there were one, two or three fires in the

CSR.

Prior to

the

incident

Units 1 and 2 were operating at 100% power

generating 1098 MWe. 
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-3

00:00

(fire

ignites)

At about 12:20 on March 22, 1975, a fire

ignited on the polyurethane foam inside a cable

penetration between the Unit 1/2 CSR and the

Unit 1 RB. The ignition source was a candle

that was being used to check for existence of air

currents. The foam was exposed to open air at

that time and was used as a penetration seal.

See note on use of candles above.

-- The workman who was using the candle tried to

put out the fire by beating on it with his

flashlight and later with some rags. The fire

continued to burn.

The workman did not promptly report the fire.

-- The same workman applied CO2 from a

portable CO2 extinguisher. The fire was not

affected and continued to burn. After attempts

by the CO2 extinguishers failed, portable dry

chemical extinguisher was used. This also

failed to put the fire out.

Repeated ineffective attempts to manually

suppress a fire are not typically modeled in a

fire PRA. It is commonly assumed that manual

fire fighting, once initiated, will be effective

within a very short time.

00:15 At about 12:35, the fire was reported to the

control room. Operators initiated the fire alarm

and announced the fire over the public address

system. 

The time to control room notification is

generally considered as the time for fire brigade

activation. In this incident, the workmen at the

fire location made several attempts to put the

fire out before reporting the fire. Therefore,

there was no delay in initiating the fire fighting

efforts, although there was a 15 minute

reporting delay, and as noted above, initial fire

fighting efforts were ineffective. A typical PRA

does not distinguish between the local detection

of a fire, control room notification, and

activation of the fire brigade. 

-- The Unit 1 operator making the fire

announcement, “walked the control panel”

looking for abnormalities (from Ref. A3-1).

Operator confusion due to erroneous

information on the control board is often

discussed in relation to fire PRA, but it is not

explicitly modeled under current methods. The

behavior of this operator is interesting to note

because it means that the operator was

cognizant of potential impact of a fire on cables

and electrical circuits and was looking for

abnormalities. Given that this was on of the

first major fires at an operating plant, this

awareness on the part of operator is laudable. 

For PRAs today one should expect that a control

room operator would be aware of the possibility

of abnormal indications on the control board

and would not fully trust the board. 
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-4

-- Fire had propagated through the penetration

into the RB side of the wall. The existence of

the fire on the other side of the wall was not

immediately recognized, but was later detected

by other plant personnel who observed smoke in

the RB.

Room to room fire spread is commonly

considered in fire PRAs. However, the

mechanism of spread (ignition within an

incomplete penetration seal) is rather unusual. 

Given a mature industry, such a mechanism is

unlikely to be manifested today.

-- Attempts were made from the RB side of the

wall to extinguish the fire. The fire was located

20-30 feet off the floor. Fire fighters had to use

ladders and in-place scaffolding to reach the

fire. Both CO2 and dry chemical portable

extinguishers were used. Dense smoke and

limited availability of breathing apparatus

further complicated the fire fighting effort.

Physical difficulties in fighting the fires is not

explicitly modeled in fire PRAs. Also, the

condition and availability of fire fighting

equipment (i.e., proper clothing, breathing

apparatus, ladders, etc.) are not modeled

explicitly. A general model is used that

probabilistically includes those conditions that

may hamper proper fire fighting. It should also

be noted that current rules for training and

equipping fire brigades are far more stringent

than the rules in place in 1975. Hence, some

aspects of this event (i.e., lack of adequate

equipment) may not be relevant to current risk

assessments.

~00:20 After initial attempts to extinguish the fire by

portable extinguishers (about 15 minutes)

proved to be futile, the manual fire fighting

efforts were stopped.

See note above regarding ineffective manual

suppression efforts.

~00:20 On the Unit 1 control panel, a “Reactor Low

Level Auto Blowdown Permissive” alarm was

received on the Panel (9-3) that contains the

Emergency Core Cooling Systems related

controls and instruments.

A second alarm was received “Core Spray, RHR

Pumps Running”. A third alarm “Core

Cooling System Diesel Generator Initiate” was

received.

Alarms kept coming, indicating that RHR, Core

Spray, HPCI, and RCIC pumps were all

running. The automatic depressurization alarm

came on and the ADS timer started. The

operator, based on normal conditions of the

reactor displayed on Panel 9-5, tripped these

pumps.

The recirculation pumps started running back,

thus reducing reactor power.

The various alarms and activation of the ADS

timer is an indication that equipment was

spuriously actuating. In this case, spurious

actuation of the ADS would have caused rapid

depressurization of the reactor into the

suppression pool. The operators apparently

reacted properly to the conflicting signals being

received in the control room, and took actions to

isolate equipment that had apparently spuriously

started.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-5

00:25 The automatic CO2 system was discharged into

the CSR.

Plant personnel apparently discovered and

removed the metal plates that would have

prevented operation (see note above) manually

recovering the fixed suppression system.

00:28 About 12:28pm, the RHR, CS and HPCI

initiated again. On panel 9-3, several lights (in

random pattern) brightened and then went dim.

Operators tried to shutdown the RHR and CS

pumps.

These may be indicative of additional spurious

operations of plant equipment although whether

these were simply indications or actual

operations remains a point of debate that cannot

be resolved here.

00:40 At 12:50, on Unit 2 control panel 9-7 (turbine

control panel) two annunciations were received 

about a delta-P on steam jet gas ejector filter

and off-gas air flow. Because of the fire, the

operator considered the alarms as erroneous.

This is a further example of how a control room

operator did not fully trust the control panel

indications knowing that a CSR fire was

underway. In fire PRA, explicit models are not

generally used to examine possible operator

diagnoses of the specific information displayed

on the board.

00:31 At 12:51pm, operators manually scrammed the

reactor from 704 MWe power level.

It is not entirely clear why operators delayed the

scram for 15 minutes after learning of the fire. 

In a fire PRA a scram immediately upon a

report of an unsuppressed CSR fire would

typically be assumed.

-- Diesel generators C and D had started and had

tied into their respective control boards.

Diesels A and B were idling and ready to tie in.

00:33 At 12:53pm, operators tripped the turbine

generator and two feedwater pumps. Operators

checked that all control rods had inserted and

started mid-range monitors. One feedwater

pump was kept running to maintain reactor

level and a turbine by-pass valve was left open

to allow use of the condenser as a heat sink.

-- 1A and 1B 250VDC , 1A and 1B 480VAC

MOV boards, 1A and 1B 480 VAC shutdown

boards, 120V Unit Preferred Power, Shutdown

Bus No.1 and both reactor protection buses were

lost.

The only remaining bus at this time was 1C

250V Reactor MOV board that provided power

to four relief valves.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-6

00:36 At 12:56, the operating main feedwater pump

tripped. It seems that the operators did not

realize this until a few minutes later when the

MSIVs tripped.

From the chain of events it can be inferred that

the control board became very active and it is

possible that the operators missed certain

events. Loss of main feedwater is a major

change in reactor condition and would have

been noticed in a short time. However, this can

be regarded as a case where operators were too

busy or were distracted by the impact of the fire

on the control board, and did not properly track

developments in the reactor cooling system.

-- HPCI and RCIC started automatically because

of loss of reactor level after the scram. 

7Operators turned these systems off. 

-- On the Unit 2 control panel, operators noticed

malfunctions on ECCS panel 9-3 and feedwater

panel. Unit 2 RB fans were switched to low by

the operators.

Typical fire PRAs consider the impact of a fire

only on a single unit, even if that fire occurs in

a common or shared plant area. In this case,

the second unit also experienced some

difficulties and was shut down. Simultaneous

demand for multi-unit shutdown may introduce

unique equipment demands that may not be

covered by current fire PRAs.

00:40 At 1:00pm Unit 2 control room operators

observed several annunciations regarding DC

power and that one reactor protection M-G set

had tripped. They proceeded to scram the Unit

2 reactor and initiate shutdown cooling. Unit 2

operator confirmed that all rods inserted.

00:41 At 1:01pm Unit 2 turbine was tripped from the

control room.

00:43 At 1:03pm the Unit 2 Main steam isolation

valves (MSIVs) closed.

The Unit 2 Reactor Protection System (RPS) 

was noticed to be inoperable, all three main

feedwater pumps were tripped by the control

room operator, and the MSIVs closed because of

RPS malfunction.

-- Control room operators for Unit 1 stated that

RCIC could not be started because the valves

were not functioning and HPCI would not start

from control panel 9-3.

Upon closure of MSIVs, reactor pressure

increased and the relief valves opened.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-7

-- The flow of the control rod drive (CRD) pump

for Unit 1 was increased to beyond 100 gpm

(this was the only high pressure pump available

to inject water into the reactor with a 130 gpm

capacity).

The operators used the CRD pump to overcome

a loss of high pressure coolant pumps. This

action was not a part of their operating

procedures. This innovative approach provided

a time bridge for later recovery of the core

cooling capability (a condensate booster pump)

and likely saved the plant from core damage. 

Innovative approaches beyond operating

procedures are not typically credited in fire

PRAs. If a procedure is not written for a

specific action, little or no credit is given to the

possibility that such actions will be taken. This

approach, given an incident such as Browns

Ferry fire, can be regarded as conservative.

-- Attempts were made to restore power to

electrical boards. 480 V shutdown board was

restored from the control room .

Attempts were made to restore power to a RCIC

valve, but the valve had a “dead fault” and

could not be operated.

00:49 At 1:09 p.m., the Athens, Alabama fire

department was called.

00:50 At about 1:10 p.m., attempts to put the fire out

from RB side was stopped. These efforts had

apparently been reinitiated at some point in the

event.

See note above about ineffective manual

suppression.

00:50 At 1:10pm, Unit 2 RCIC was initiated to supply

water to the reactor. HPCI was also initiated in

recirculation mode to relieve steam from the

reactor. Reactor water level was controlled via

RCIC. The CRD pump was verified to be

operating. The relief valves were operating

automatically.

-- Smoke and CO2 entered the Control Room

through unsealed floor penetrations when the

CO2 was discharged into the CSR pressurizing

the room. Scot Air Packs were used by some

operators, but those could only sustain air for

about 5 minutes. The operators went about their

business without breathing apparatus.

Smoke in the control room would be commonly

assumed in fire PRA to hamper control room

efforts. In this case, it would appear that the

smoke and CO2 were an annoyance, but not

particularly debilitating.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-8

00:55 Between 12:55 and 1:15pm, Unit 1 operators

noticed that nuclear instrumentation and about

half of the control rod drive position indications

were lost. Only four of the eleven remotely

operated relief valves were available.

Condensate and condensate booster pumps were

operable as well.

-- An air hose was brought into the control room

to supply fresh air.

01:00 At 1:20pm, on the Unit 2 side, manual control

over all relief valves was lost. However, the

relief valves continued to operate automatically

maintaining reactor pressure at 1020psig. 

RCIC and CRD pumps were supplying water to

the reactor.

01:00 At 1:20pm, Unit 2 diesel generator “D” tripped. 

Loss of power to a 480V shutdown board

occurred, which led to loss of all 480 V

shutdown and reactor MOV boards for about 45

minutes.

01:10 At about 1:30pm, it was realized that high

pressure injection via the CRD for Unit 1 could

not maintain the water level in the reactor. 

Decision was made to depressurize the reactor

to enable the use of condensate pumps.

-- The operators and management decided that if

the condensate pumps (working pressure 350

psig) could not be used, the RHR service water

could be lined up to take water from the river

and inject at 150 psig into the reactor. To do

this, two valves had to be manually opened that

were located at an area of the RB where the

smoke was not so dense.

This demonstrates how operators would work

together to plan out the use of available options

under fire conditions. In fire PRA, as

mentioned above, innovative recovery

approaches are not generally credited. Also, if

an area could be affected by smoke, little or no

credit is given to the possibility of manual

recovery actions (see further note below).

-- Operators ascertained that two out of three

condensate pumps and one out of three

condensate booster pumps were available. The

bypass lines around demineralizers and heater

were opened. 
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-9

01:20 At about 1:40pm, blowdown of Unit 1 was

initiated using 4 remotely operated relief valves

that remained operable from the control room. 

As the valves were being operated, the operators

watched the water level in the core to ensure

that it did not drop below top of active fuel.

The condensate and condensate booster pumps

provided water to the reactor. The water level

increased.

-- Control over feedwater pump bypass valve was

lost. It was left in the open position. This led to

an increase in reactor water level, which

reached above the measurable scale (i.e., +60

inches).

-- An operator was sent to the feedwater pump

bypass valve location to partially close the valve

and was instructed to remain there to make

valve adjustments as directed from the control

room. 

01:40 At about 2:00pm, the fire chief from Athens

Fire Department recommended use of water to

extinguish the fire. This was rejected by plant

personnel on the scene.

Application of water was delayed due to

electrical concerns. It remains unclear to this

day whether or not this was a correct decision

given the circumstances. Water application was

delayed for several hours, but once applied the

fire was quickly suppressed (see further notes

below). As noted above, some fire PRAs

commonly assume that manual fire fighting will

be initiated promptly and once begun will be

effective in a very short time.

01:40 At about 2:00pm, the “C” 4kV bus was lost. 

Restoration attempts were not successful. 

Problems were also noticed in transformer TS1B which serves 480 volt Shutdown Board 1B.

01:40 At about 2:00pm, Unit 2 lost preferred power

because Unit1 and 2 preferred power boards

were tied together. The buses were separated

and Unit 2 regained its preferred power.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-10

01:40 From 2:00pm until the fire was extinguished,

several attempts were made to restore torus

cooling. However, despite several attempts and

some success in opening valves locally, reactor

shutdown cooling and torus cooling could not be

established because of dense smoke in the RB.

Fire conditions at the location of valves in the

RB prevented operators from completing

attempted valve alignment actions. In a fire

PRA, manual actions in a smoke filled room

would not be credited. This event does illustrate

that fire effects can prevent manual actions

under sufficiently harsh conditions.

01:50 At 2:10pm, a Unit 2 relief valve stuck open,

which caused the reactor to start depressurizing. 

01:55 At 2:15, Unit 2 relief valve manual control was

restored. A decision was made to continue

depressurizing Unit 2 reactor. 

02:10 At 2:30, all but one of the Unit 2 level

indicators were lost.

Transient electrical failure is difficult to

explain. In fire PRA, credit is typically given to

spurious electrical signals to clear after about 30

minutes because of additional failures and short

to ground. 

02:10 At 2:30pm, the Unit 2 RHR pump D was paced

in torus cooling mode.

02:25 At 2:45pm, the following equipment was

inoperable: All ECCS, MSIVs, seven of the

manually controlled eleven Relief Valves,

Reactor Closed Cooling Water System, and

Diesel “C”. Also, some instrumentation was

unavailable: torus temperature and level,

drywell temperature, jet pump flow, reactor

flange temperature, all neutron instruments,

computer, CRD instrument panel, etc.

02:40 At 3:00pm, Unit 2 RHR drain pump was

initiated to control torus water level.

02:40 At 3:00pm, Unit 2 reactor pressure was at

200psig, which allowed the use of condensate

booster pump.

02:50 At 3:10pm, TVA’s Central Emergency Control

Center in Chattanooga was activated.

02:55 Between 2:00 and 3:15pm the water level was

above the measurable range. At about 3:15 it

dropped below the upper setpoint of +60 inches.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-11

03:10 Between 2:30pm and 3:30pm several

unsuccessful attempts were made to manually

open a suction valve on an RHR pump.

03:40 By 4:00pm, the automatic CO2 system was

setoff three times in the CSR. At this time, fire

in the CSR seemed to be contained

03:40 About 4:00pm the MOV board 1A was restored.

03:40 At 4:00pm, a Unit 2 main steam drain line was

opened into the condenser that caused difficulty

in maintaining vacuum in the condenser.

04:00 About 4:20pm, the fire in the CSR was declared

as extinguished.

This scenario demonstrates that use of hand

held fire extinguishers and automatic fire

suppression systems may not to be immediately

effective and may take several hours to control

and extinguish the fire. The possibility of

ineffective fire fighting efforts is considered in

some fire PRA methods probabilistically while

other methods assume prompt and effective

suppression. Current probability curves for time

to control a fire gives a very low probability to

the possibility of several hours of delay. 

04:10 Between 2:00pm and 4:30pm, the RHR valves

74-73 and 74-71 were opened manually in the

RB.

04:10 At about 4:30pm, an RHR service water valve

was partially opened to the RHR heat

exchanger, to provide RHR cooling. At this

time power was restored to the valve.

04:10 At about 4:30 p.m., fire fighting at RB side of

the fire was resumed. The fire continued to

burn.

~05:10 Between 5:30 and 6:00 p.m., from TVA

headquarters in Chattanooga, permission was

given to use water to fight the fire.

 
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-12

05:10 About 6:00pm, the four operating relief valves

were lost. It was later found that a solenoid

valve that controls the air to the valves had

failed closed because of fire damage.

Such late failure demonstrates that fire damage

can continue to occur for a long time after the

fire growth and burning rate has reached a

steady state, and the zone of influence of the fire

may have reached its maximum. In a fire PRA,

the fire duration is practically never modeled to

last more than two hours. However, since it is

assumed that all the cables within the zone of

influence are damaged, effectively late failures

are modeled conservatively. 

06:10 At about 6:30pm, the RHR drain line was

opened manually to direct torus water into the

condenser hotwell.

06:10 At 6:30pm, Unit 2 conditions were considered

as stabilized. 

06:20 At about 6:40, Plant Superintendant gave the

permission to use water on the fire.

A large delay in fighting a fire is not generally

modeled in a fire PRA. Current probability

curves for time to control a fire gives a very low

probability to the possibility of several hours of

delay. 

06:20 From 6:40pm untill 9:30pm, reactor pressure

increased from 300 psig to 600 psig. 

Condensate pumps became ineffective. The

operators reverted back to using the CRD pump.

~06:40 At about 7:00 p.m. two men entered the fire

areas and directed water on the fire using a fire

hose located outside the fire area. These men

had to wedge the hose in position because of

poor breathing apparatus condition had to leave

the area.

06:40 At 7:00pm, Unit 2 vacuum pumps were restored

to establish vacuum in the condenser.

06:55 At 7:15 p.m., two men entered the fire area and

found no evidence of burning.

Spraying continued.

07:25 At 7:45, the fire was declared as completely

extinguished.
Time

(rel. to

ignition)

(hr:min)

Event Description

(Note 1)

Fire PRA Implications

A3-13

-- As the smoke cleared and reliance on breathing

apparatus lessened, various valves were

approached in the RB, the position of the valves

were checked, control power to motor operators,

pump controls, etc. was established using

temporary jumpers. 

07:40 At 8:00pm control of Reactor Water Cleanup

valves were restored.

09:30 At 9:50pm, control over the four previously

operable relief valves were restored by field

operators by rearranging the air supply to the

flow control valve that supplied air to the

valves.

09:30 From 9:50pm reactor depressurization was

resumed and from 600 psig, by 10:20, it reached

350 psig allowing the condensate booster pumps

to pump water into the reactor.

10:10 At 10:30, Unit 2 diesel generator D was

restored.

10:25 At 10:45pm, Unit 2 RHR shutdown cooling was

established using RHR pump B.

13:10 At 1:30am on March 23, torus cooling was

established.

15:50 At 4:10am on March 23, shutdown cooling was

established.

Note 1: All failures and reactor related information refers to Unit 1 unless noted otherwise. All Unit 2 entries are

specifically noted.

Equipment Damaged

A total of 1600 cables were damaged. Of these, a large number were safety related. The

number of damaged safety related cables can be categorized by Unit as: 482 from Unit 1, 

22 from Unit 2, and 114 common to both units.

Damaged Areas

A small area in the CSR and a large area within one compartment in the Unit 1 RB. Dense

smoke propagated throughout the RB.
A3-14

Impact on Core Cooling

While the fire did present severe operational challenges, adequate core cooling was

maintained at all times. At no time during the fire did all core cooling function stopped. 

Fuel cladding, the containment and the torus were not adversely affected by the fire.

Radiological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

There were only minor injuries to plant or external personnel because of smoke inhalation

and other minor injuries.

Public Impact

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A3.3 Comparison of Fire PRA Elements and the Incident

In this section, the chain of events in the fire event is compared against a typical fire scenario as

developed in a fire PRA expressed in terms of a list of scenario elements. Entries are made only if

specific and relevant information was available. No attempt was made to postulate a possible

progression of events beyond the available reports unless it was deemed to be essential in reaching

a specific insight. Such cases are specifically noted.

Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

Presence of

combustible /

flammable materials

A readily combustible material

(polyurethane foam) was used as a

penetration seal. The design

required that a fire resistant coating

be applied to the penetrations, but

the coating was not in place at the

time of the incident. Also, there

were a significant amount of control

and instrumentation cables in

intimate contact with the seal.

With few exceptions (e.g., hydrogen), it is

unusual to find a highly combustible material

in safety areas of a nuclear power plant. In a

fire PRA it is typically assumed that highly

combustible materials (in this case

polyurethane) are either absent or protected. 

Silicone is currently the preferred fire seal

material, and silicone in not nearly as

combustible. Hence, the use of polyurethane

would be considered very unusual today.
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-15

Presence of an ignition

source

A candle flame was used by the

construction crew as part of an

accepted procedure to check for

penetration seal leaks. 

The presence of an open flame in a safetyrelated plant area is not considered in current

PRAs. Such practices are widely prohibited

by plant procedure. This, and the two small

fires that preceded this fire, are the only

known fires in a power plant to have been

ignited in this way. PRA practice is not

contradicted by these related incidents.

Ignition of the fire and

generation of heat

(radiant and

convective), smoke,

and other gases

Electricians using open flame candle

to check for leaks in penetration

seals caused the open polyurethane

foam in one of the penetrations to

ignite. Because of the negative

pressure in the RB, the fire was

drawn into the penetration and

spread to the RB. 

Several ignitions had occurred

previous to this event. On March

20, 1975 two fires had occurred in

the CSR because of candle flame

usage.

The precise fire scenario that occurred at

Browns Ferry (a candle igniting a fire inside

a penetration seal) is not explicitly modeled

in fire PRAs. However, the typical cable fire

scenarios that are modeled do consider the

possibility of self-ignited cable fires, in

particular, for plants with older cables that

are not certified as low-flame-spread. This is

nominally consistent with the conditions

observed at Browns Ferry. Hence, the

potential for, and impact of, fires at this

location would likely have been identified in

a fire PRA.

Fire growth within the

combustible or

component of original

ignition

Because of the readily combustible

nature of polyurethane foam and air

flow from the CSR into the RB, the

fire spread through the penetration

seal rapidly. 

In fire PRA, the initial fire ignition source is

modeled by an established “pilot fire.” In

this incident, the rapid propagation of the fire

through the polyurethane can be considered

as the pilot fire. Again, while this particular

pilot fire would not be considered, a properly

modeled self-ignited cable fire would lead to

the same consequences and would be

considered.

Fire propagates to

adjacent combustibles

The polyurethane fire ignited cables

inside, and adjacent to, the

penetration. The fire then

propagated horizontally and

upwards through all the cable trays

that passing through the affected

penetration. Cables were damaged

over a distance of several 10's of

feet. The fire also propagated

downward a few feet along vertical

cable trays next to the wall.

The cables used in Browns Ferry were rated

as fire retardant based on the standards of the

time. Nonetheless, they did support a selfsustained and propagating fire that burned

for several hours despite repeated attempts at

manual suppression with hand-held fire

extinguishers. In fire PRAs, the comparable

ignition source would be a self-ignited fire as

noted above. Most assessments of such fires

assume only limited potential fire growth. 

This experience my belie those assumptions

at least for older style cables.
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-16

A hot gas layer forms

within the

compartment of origin

(if conditions may

allow)

Although, the available source used

in this analysis do not indicate the

presence of hot gas layer, since the

fire occurred near the ceiling of a

RB compartment, there should have

been a hot gas layer that perhaps

facilitated the horizontal fire

propagation. 

Effects of fire (i.e., hot

gas and smoke)

propagate to an

adjacent compartment

(if pathways exist)

In effect, two compartments were 

simultaneously affected by this fire. 

Because of negative pressure in the

RB side of the wall, the flames were

drawn through the partly open

penetration seal. 

Dense smoke propagated through

the entire RB, making it very

difficult to take manual actions to

overcome valve operability

problems.

Fire propagation to adjacent compartments is

considered in fire PRAs using mainly

qualitative methods. This would typically

include some probability that penetration

seals might fail allowing for passage of fire

from one compartment to another. The

possibility of flames being drawn through

negative pressure path to other compartments

is not typically modeled explicitly. While

current fire PRA methodologies can identify

and treat room-to-room fire scenarios, the

specific mechanism of spread noted in this

case in not explicitly considered.

Local automatic fire

detectors (if present)

sense the presence of

the fire

None of the sources indicate

presence or activation of automatic

fire detectors. Since personnel were

present when the fire occurred, fire

detection was instantaneous,

although the fire in the RB was not

immediately recognized.

Manual detection is commonly credited in

fire PRA. However, there is a continuing

weakness in these methods in that the actual

time between initiation and detection is

typically not known unless personnel happen

to be present when the fire starts. 

Alarm is sounded

automatically in the

control room, locally

and / or other places

 See above. In this case the alarm

was announced manually by an

operator over the plant PA system.

Automatic suppression

system is activated (if

present)

At the CSR side, the operators

eventually activated the fixed CO2

system. This certainly affected the

progression of the fire at the CSR

side. Fire did not propagate past a

short distance from the penetration

and there were little or no smoke in

that room. There was no fixed

suppression for the RB

 In this case operators had to perform some

(apparently minor) recovery actions to

activate the CO2 (removal of a blocking plate

inside the actuation mechanism left over

from construction). Manual recovery of a

fixed suppression system may be credited

under some recent PRA methods (e.g., the

EPRI Fire PRA Implementation Guide)
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-17

Personnel are present

in the area where fire

occurs

Personnel and construction crew

were present in the CSR. In fact

they were the cause of the fire.

 PRAs don’t explicitly consider personnel as

a source of fire, although such events are

inherently included in the fire events data

base. Personnel are commonly credited for

detection if an area is commonly or

continuously manned.

Control room is

contacted or fire alarm

is sounded

 The control room was contacted

about 15 minutes after the fire was

ignited. The delay is attributed to

lack of proper knowledge of the

crew involved with initial stages of

the fire about the requirement in the

emergency response plan to sound

the fire alarm immediately upon

discovery.

 This event echos other similar events (e.g.

Waterford 1995) where there was some delay

in declaring that a fire was present even

given that some plant personnel were aware

of the fire. It is commonly assumed that a

fire alarm will be sounded immediately upon

any personnel detecting any fire anywhere in

the plant. These assumptions may be

optimistic.

Fire brigade is

activated

There was no designated plant fire

brigade at that time. Plant

personnel tried unsuccessfully to put

the fire out and ultimately called the

local fire department.

 Regulatory requirements for plant fire

brigades have changed substantially, in large

part as a result of this fire. This event is not

considered relevant to current fire PRAs.

Fire suppressant

medium is properly

applied

Overall, fire suppression activities

were not especially successful. 

Initial discharges of hand-held

extinguishers at both sides of the

wall were unsuccessful. In the CSR,

the fire was controlled by a

combination of manual

extinguishers and activation of the

fixed CO2 system. On the RB side,

repeated manual suppression

attempts proved to be futile and at

best prevented the fire from

spreading unchecked. Plant

management resisted suggestions of

the off-site fire department to use of

water due to concerns that water

might lead to additional equipment

losses. This decision was reversed

about 7 hours after ignition and the

fire was put out quickly using water.

Two fire suppression scenarios unfolded in

this incident, one in the CSR and one in the

RB. The CSR fire fighting efforts were

ultimately effective based largely on the fixed

CO2 system. In a fire PRA, the CO2 system

would likely have been credited because the

penetration seals would have been assumed to

be intact. For the RB fire, given the location

of the fire close to the ceiling and lack of a

fixed fire suppression system, the time to

control the fire would likely have been

assumed to be relatively long in a full-scope

fire PRA; probably on the order of 30-45

minutes. However, it would also have been

assumed that once on the scene, effective fire

fighting (i.e., water) would have commenced

immediately. The probability versus fire

duration curves recommended by current fire

PRA methods give a very low probability to

fire durations of 7 hours. The delay in

activating effective fire fighting strategy for

the RB would likely not be captured in a

typical fire PRA. 
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-18

Automatic fire

suppression system is

activated

There were no automatic suppresion

systems available. As noted above,

there was a fixed manual CO2

system in the CSR that was

activated. 

Fire suppressant

medium is properly

applied to where the

fire is.

As discussed above, several attempts

by hand-held extinguishers were

unsuccessful. However, no

additional failures were noted after

water was applied to the fire and the

fire fighting efforts did not cause

any additional failures because of

mishandling of equipment or hoses.

See notes above.

Fire is affected by the

suppression medium

As discussed above, on the CSR

side, the fixed CO2 system was

effective. However, on the RB side,

only water was effective at

suppressing the fire. 

 See notes above.

Fire growth is checked

and no additional

failures occur

The fire growth on the CSR side was

checked to a few feet from the

penetration. On the RB Side, the

fire propagated was partly controlled

by repeated application of fire

extinguishers, but continuing

damage was noted for at least six

hours.

The RB fire cannot be considered to have

been brought under control until water was

finally applied to the fire. Fire PRAs

commonly assume that fire control will

prevent further damage. This incident does

not contradict this assumption, but the failure

to initiate effective fire suppression in a

timely manner would not be captured in a

typical PRA.

Fire is fully

extinguished and fire

brigade declares it as

out

 See the discussions above. Some

difficulty was encountered in using

hose fittings between the plant and

local fire department.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

Primarily cables were damaged in

this fire incident. There was also

some damage to aluminum conduits

and to some aluminum coated pipe

insulation, but this was not risk

significant. No structural failures

were noted. Numerous cables were

damaged in both open cable trays

and inside conduits.

 The cable damage that was observed would

likely be captured in a fire PRA. Cables are

the most commonly considered fire damage

target in fire PRAs. There were no particular

events at Browns Ferry that would contradict

current PRA practice in this regard.
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-19

Cable failure impacts

equipment outside the

fire location

Several systems were affected on

both the Unit 1 and Unit 2 sides of

the plant. Many electrical circuits

were affected, including loss of

various electrical busses. There is

debate over the precise way the

control circuits and associated

equipment were affected (i.e.,

whether or not spurious actuations

actually occurred). Although plant

design had incorporated separation

of redundant trains, in several cases

redundant trains were affected

because of routing error, use of

conduits to meet the separation

criteria and common circuit

elements. In the case of the latter,

indicating lights of control circuits

were not considered as safety-related

and their cables were therefore not

subject to separation criteria. 

The following systems and

equipment affected: Unit 1 - RCIC,

ADS, CS, RHR, HPCI, electrical

distribution and Standby liquid

control. A more limited set of

equipment and systems was affected

on Unit 2.

Many systems were rendered unavailable by

the fire. Such losses are commonly identified

in fire PRAs. The construction errors that

contributed to some of the redundant train

equipment losses would not typically be

captured in a fire PRA unless “hand-overhand” cable tracing were undertaken, and

this is rare. Rather, the plant would be

assumed to have been constructed per design.

The potential for, and impact of, spurious

equipment operations due to cable failures is

a topic of current debate. In some fire PRAs,

it is assumed that spurious actuation of

equipment is possible while others neglect

this possibility. The current debate focuses

on the likelihood of various cable fault

modes, the likelihood of both single and

multiple spurious actuations, and the

duration of postulated cable hot shorts that

might lead to spurious operations.

There is evidence that some spurious

actuations did occur during the fire. It

appears quite clear that at least one, and

probably more, spurious alarms were received

in the main control room, likely due to faults

in instrument cables. However, the available

information does not provide conclusive

evidence supporting or disproving typical fire

PRA practice regarding spurious equipment

operations. (Refer to Reference A3-3 (the

Task 1 Letter report for this program) for

more discussion of these aspects of the fire.)

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

Unit 1 was impacted by a number of

sequential equipment losses as

described in Section A3.2 above.

Unit 2 also experienced several

failures. However, the failures were

much less significant than those

impacting Unit 1, and core cooling

conditions were stabilized in about 6

hours after fire ignition. 

 The equipment failure experienced for Unit

1 would likely have been captured in a fire

PRA. The operator’s use of non-procedure

based recovery actions would likely not be

credited in a fire PRA.

With regard to unit 2, it is typical in a fire

PRA to assess the impact of a given fire on

one unit only. In this case, both units were

impacted, and this would not likely be

captured in a typical fire PRA.
Fire Scenario

Element/Issue

Incident - Browns Ferry, March

22, 1975

Fire PRA Insights

A3-20

Operators in the

control room receive

messages and respond

to the information

displayed on the

control board or

received verbally from

the plant

Numerous alarms and seemingly

erroneous indications were received

on the control board. It seems that

the operators were well aware of the

potential impact of a fire on the

control circuits. Overall the control

room operators made several correct

decisions regarding core cooling

strategies and use of available

resources to ensure that the core

remained covered, and do not appear

to have been mis-led by the

erroneous signals and alarms. 

Given the extensive impact of the fire on the

indications and control on the control board,

the operator performance in this incident was

laudable. In a fire PRA it would be assumed

that the probability of operator error would

have been increased by the fact that smoke

and CO2 did get into the control room, and

by the numerous erroneous indications. No

credit is generally given to operators using

methods that are outside set procedures to

ensure core cooling. These assumptions,

given the chain of events at Browns Ferry,

are certainly conservative.

Operators attempt to

control the plant

properly and bring the

plant to a safe

shutdown

See the discussions above. See the discussions above.

Structural failures (if

occurred) may

jeopardize availability

of equipment

 No structural failures other than

melting of the polyurethane inside

the penetration and some damage to

pipe insulation was reported.

Water when sprayed

over electrical

equipment may fail the

exposed equipment

There is no evidence of such an

event. Once water was applied to

the RB fire, there was no reported

additional failures.

The cooling effect of

CO2 may adversely

impact equipment

There is no evidence of any such

damage despite use of the CO2

system to fight the CSR fire.

It is not clear whether or not any nominally

vulnerable components were located in the

CSR so the implications remain unclear.

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

The incomplete nature of the

penetration seal clearly impacted the

fire development. Had the

penetration seal been complete and

intact, the fire would likely not have

been so easily ignited.

Some separation requirements had

not been met during construction.

The CO2 manual actuation device

had been rendered inoperable during

construction.

The aggravating factor in this case (i.e.,

exposed polyurethane) is not generally

modeled in fire PRAs. It is assumed that the

plant is under normal operating condition

and all initial construction related tasks are

completed. Of course, some probability is

assigned to the possibility of a poor

penetration seal. However, the presence of a

highly combustible material because of an

exposed seal is generally not questioned.
A3-21

A3.5 Incident Analysis

The Browns Ferry fire was actually a relatively modest fire in classical fire protection terms. The

fire remained confined to a relatively small part of two adjacent rooms and did not present a

significant challenge to plant structures. However, the fire led to loss of numerous and redundant

plant safety systems. While core cooling functions were never totally lost, the fire did present a

significant challenge to plant operators in their attempts to stabilize Unit 1 in particular.

In many ways, the Browns Ferry fire is quite typical of the “classical” fire PRA risk scenario. 

That is, a relatively modest fire that occurred at a cable “pinch-point” and compromised a

substantial set of plant equipment and systems. In general terms it is expected that a full-scope

PRA of the as-built Browns Ferry Plant would have identified the potential vulnerability

associated with fires in the impacted area, and would have identified these areas as significant fire

risk contributors. Specific aspects of this fire incident that would be captured in a typical fire

PRA include the following:

S the potential for a fire at this location, albeit most likely in the form of a postulated

self-ignited cable fire rather than as a result of personnel actions,

S the lack of fire detection leading to a potential delay in detection of, in particular,

the RB fire,

S the potential for spread of fire from room-to-room, albeit the mechanism for failure

would be assumed to be random failure of the penetration seal rather than the fact

that the seal was incomplete at the time of the fire,

S the lack of fixed suppression in the RB meaning that manual fire fighting would be

required,

S the complications associated with manually fighting the fire in the RB given its

inaccessible location,

S the potential for initial failure, and subsequent recovery, of the fixed CO2 system in

the CSR

S the potential for substantial fire spread in older style cables,

S the potential safety system equipment losses due to a fire involving the cables

located in the area of the fire,

S the potential for loss of multiple instrument trains and the potential for spurious

alarms and erroneous control signals in the MCR, and
A3-22

S the fact that operators would attempt various manual recovery actions, and that

some of these actions would be successful while others would fail due to fire

effects.

Other aspects of the fire would not however be captured in a typical fire PRA. In some cases,

these aspects of the fire are not considered relevant to a current fire PRA due to the sweeping

changes that have been implemented since, and in response to, the Browns Ferry fire. These

would include the following:

S The possibility that an open flame would be introduced into a safety-related area is

widely precluded by current plant procedures. This would not be considered a

credible ignition scenario in a typical fire PRA.

Other aspects of the fire incident that also would not be captured in a typical fire PRA, but that

are considered relevant to current PRA practice are the following.

S The failure of the person who initiated (and hence first detected) the fire to

promptly alert control room personnel would not typically be captured in a fire

PRA. It is commonly assumed that plant personnel will immediately report any

fires that occur. See further discussion below.

S The failure of manual fire suppression efforts using hand-held extinguishers despite

prolonged and repeated attempts would not be captured in a typical fire PRA

under some methods of analysis. See further discussion below.

S The seven-hour delay in the application of water to the RB fire would not be

captured in a typical fire PRA under some methods of analysis. See further

discussion below.

S The fact that construction had not fully complied with the design leading to

redundant cables being co-located in the same raceway would not be detected in

most PRAs. This might be found but only if hand-over-hand cable tracing was

performed as a part of plant walkdowns. Cable tracing is a very intensive effort

and is only performed for critical cases or where there is virtually no available

cable routing information. In cases where routing is unknown, but cable tracing is

not performed, a conservative assumption would typically be made. This was not

the case here because cable routing information was available and would have been

assumed to be correct. There is little prospect that future PRAs would be able to

capture such construction errors. This illustrates one area of PRA analysis

uncertainty that is not easily resolved.

S The potential for a single fire to impact equipment for, and force a simultaneous

shutdown of, two sister units is not captured in typical fire PRAs. This has been

raised as a potential area of concern for some of the IPEEE fire analyses. 

However, common practice is to analyze fires as impacting a single unit only. Fire
A3-23

PRA methods could be extended to explicitly cover multi-unit issues. This is not

an especially difficult prospect, but does imply development of appropriate analysis

guidance and may involve development of some specific analysis tools.

Note that three of the last five points highlight issues of detection and suppression effectiveness

that are not reflected in current fire PRAs. In this case, there was a delay in initial reporting of the

fire, ineffective efforts to fight the CSR fire, a delayed recognition of fire in the RB, repeated and

prolonged but ineffective efforts to suppress the RB side fire. These events are echoed by other

events included in this review. The implications are dependent on the method of analysis being

applied, and there are currently two commonly applied methods. The topic of fire duration

analysis is covered in detail in the body of this report.

References

A3-1 Regulatory Investigation Report, Office of Inspection and Enforcement, Region II;

Subject: “Tennessee Valley Authority, Browns Ferry Unit 1 and 2, 50-259 / 75-1 and 50-

260 / 75-1, Fire in Cable Spreading Room and Reactor Building on March 22, 1975;

prepared by Charles E. Murphy, signed July 25, 1975.

A3-2 “Recommendations Related to Browns Ferry Fire”, report by Special Review Group, U.S.

NRC, NUREG-0050, February 1976.

A3-3 J. LaChance, S.P. Nowlen, F. Wyant and V. Dandini“Circuit Failure Mode And

Likelihood Analysis,” A Letter Report to the USNRC, Sandia National Laboratories,

USNRC JCN Y6037, Final Report, March, 2000 (this report, while unpublished, is

available through the USNRC public document room).

A3-4 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A4-1

Appendix 4 - Analysis of Greifswald, Unit 1 Fire on December 7, 1975

A4.1 Plant Characteristics

Greifswald is a Soviet design plant located on the Baltic coast in the former East Germany (GDR)

[Ref. A4-3]. The plant site included five VVER-440 reactors of which four, units 1 through 4,

are “of the first generation V-230 type.” All five units are now permanently shut down and

undergoing decommissioning. Unit 1 began power operations in December, 1973. This

discussion is based on two relatively limited references [Ref A4-1, A4-2].

A4.2 Chain of Events Summary

On December 7, 1975 at 11:08 a cable fire broke out in or near a 6kV Unit 1 switchgear. The

cause of the fire was cited in one report [Ref. A4-1] as “(a) high short-circuit current (that)

flowed for several minutes following an electrician’s switching error, and the subsequent failure of

the automatic breaker.” The fire apparently burned for approximately 92 minutes destroying “a

large number of electrical cables.”

One report [Ref. A4-2] cites that “the fire caused virtually a station black out.” The fire damage

apparently caused a loss of power to all six of the unit’s main coolant pumps, and there was no

steam-driven pump available. Hence, the plant was reliant on natural circulation and “steam relief

through safety valves on the steam generator secondary side” for reactor core cooling. After

several hours (at least five hours) in this cooling mode, the secondary side water inventory was

depleted, and reactor temperature and pressure began to rise. This led to automatic opening of

the pressurizer safety valves. The valves did not re-seat properly and reactor coolant continued to

escape (effectively a loss of coolant accident situation). As a result reactor pressure decreased

and ultimately reached the low pressure pump head pressure. This allowed the operators to

supply water to the reactor by activating low pressure emergency cooling pumps. 

Secondary side cooling was apparently restored by routing a spare power cable from an alternate

source (apparently from Unit 2) directly to one auxiliary feedwater pump.

The available reports state that the core did not sustain any damage, and that while some

“increased discharge of radioactive material into the atmosphere” resulted, “it was below

proscribed limits.”

A4.3 Incident Analysis

There is insufficient information available about the Greifswald fire to provide a meaningful

analysis of the incident. However, from little information that is available, it is clear that in this

incident plant safety was affected significantly. It does appear clear that for some period of time

all active means of cooling the reactor core were lost, and that non-proceduralized manual

recovery actions were needed to recover the plant. 
A4-2

The loss of plant safety functions that resulted from this fire incident is typically modeled in a fire

PRA. All high pressure core cooling capabilities were lost in this incident. This led to a demand

for the pressurizer safety valves to open to relieve primary pressure. However, since the valves

failed to reseat a small LOCA occurred. This is the only known fire incident where a LOCA

occurred as an indirect result of the fire. The failure of pressurizer safety valves to re-close

should be considered as an independent failure event. In fire PRAs it is common to include

independent failures and the possibility of pressurizer safety valves failing to close is included in

the event trees. Hence, this aspect of the event should also have been captured in a fire PRA.

Based on the available sources, there is no information available on the severity of the fire itself,

how the fire was attacked, the actual extent of fire damage realized, how operators responded to

the incident, nor why the fire burned for as long as it did (about 92 minutes). It would appear

from the reports that a lack of redundant train cable separation was the primary factor

contributing to the severity of fire impact on plant operations. The available reports cite that

many plant improvements were being made in part in response to this incident. As noted above,

the plant is now permanently shut down.

A4.4 References

A4-1 “ASSET team to visit Greifswald” and “German DR releases details of 1975 Greifswald

fire,” Nuclear Engineering International, April, 1990, pg. 6.

A4-2 Frigyes Reisch, “Lessons from Greifswald incidents,” Nuclear Engineering International,

June 1990, pp. 42-43.

A4-3 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A5-1

Appendix 5 - Analysis of Beloyarsk, Unit 2 Fire on December 31, 1978

A5.1 Plant Characteristics

Beloyarsk is nominally a four unit nuclear power plant site located near Ekaterinburg, Russia,

which was part of the former Soviet Union at the time of the fire described here. Beloyarsk

Unit 2 was a 146 MWe LWGR-1000 type nuclear power plant[A5-5] that began operations either in

1967[A5-4] or in December 1969[A5-5]. It shared its turbine building (TB) with Unit 1, which was a

102 MWe LWGR-1000 type[A5-5] nuclear power plant. Both units have been permanently shut

down, Unit 1 in 1983 and Unit 2 in 1990.[A5-4,5] A third unit on site continues to operate,[A5!4,5]

and a fourth unit was under construction but has been suspended[A5-5]. (Units 3 and 4 are of the

BN-600 design type.)

A5.2 Incident Summary

At 01:50 on December 31, 1978, Unit 2 was operating at 100% power when plant personnel

noticed a fire in the Unit 2 side of the TB. The fire was caused by a break in a lubricating oil

piping system. The oil apparently had spilled onto hot surfaces (the turbine itself or steam pipes)

and caught fire. It is not known how long the fire had been burning when detected. The off-site

fire brigade was immediately notified, and three fire-fighting teams arrived at the plant within

about 6 minutes. The oil fire was already quite severe and had already caused the roof of the

building immediately above the fire to collapse. About 960 m2 of the TB was severely damaged. 

 

From the TB, fire propagated into the adjacent control building via open cable penetrations and

other openings. In the control building, the fire propagated upwards inside cable shafts and

caused fires on several different elevations. It propagated through open cable penetrations and

leaking or open doors and hatches into various adjacent areas. Reference [A5-1] states that the

flames propagated vertically at about 0.7 m/s in the cable shafts between cable floors. From the

available information it is not clear what factors led to such rapid propagation of the fire. A large

number of control and power cables were damaged. The fire also propagated into the control

panels of the Main Control Room (MCR) and caused damage there. At one point an oil-filled

transformer also ruptured and the oil caught fire igniting additional cables in the area. The cause

of this secondary fire is not known (possibilities would include direct fire exposure or electrical

faulting).

Fire fighting continued, without a break, for approximately 22 hours. Fire fighters worked in

harsh environments that included heavy smoke and a !47EC outside temperature. Ultimately, the

attack on the fire involved 35 fire brigades and a total of 270 fire fighters including 150 fire

fighters trained in using Self-Contained Breathing Apparatus (SCBA). 

Seventeen hours after discovery of the fire, it was declared to be under control. The fire was

considered completely extinguished about 22 hours after detection.
A5-2

A5.3 Detailed Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in detail and in chronological order as best as

can be inferred from the available sources [Ref A5-1 through A5-3]. If the precise timing and the

order of an event is not known, the time of occurrence is not specified (i.e., all cited times derive

from the available reports). However, the chain of events is presented in a logical chronological

order based on the available information and the judgement of the authors of this report. 

Whether or not an event from the chain of events is typically included in a fire PRA is discussed

where deemed appropriate. Lessons that may be gleaned from a specific event in the context of

fire PRA are also provided. Note that the times reported in the first column are relative to the

time that the fire was first detected. The time of fire ignition is not known precisely.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

The unit was operating at 100% power

level.

During

the

incident

The outside temperature was -47oC. While the available sources have provided little

information, the extremely low outside temperature

must have impacted the effectiveness of the fire

fighters. It would likely impact fire fighters’ trip from

their remote stations to the plant. The impact of

weather conditions on the effectiveness of fire brigade

activities is not considered in fire PRAs. 

00:00 A fire was noticed at 01:50 on the Unit 2

side of the TB. The exact time when

ignition had occurred is not reported. 

The fire was caused by a break in the

lubricating oil piping system. The oil

apparently spilled on hot surfaces (the

turbine itself or steam pipes) and caught

fire. 

This event starts as a typical TB fire scenario that

involves the turbine lubrication oil system. The fire

initiation portion of this event is routinely considered

in fire PRAs.

00:00 The fire brigade was immediately

notified by the plant manager. Three

off-site fire fighting teams were sent to

the station under the direction of the

chief of security. At the same time, the

dispatcher of the fire brigade called other

fire stations near the Beloyarsk area and

informed the local managers of the

situation at the plant.

Most fire PRAs, at least in the U.S., assume that fires

will be handled by on-site fire brigades. Practices in

Russia are, however, quite different from the U.S. in

that primary fire fighting is provided by the off-site

militarized fire brigade. The potential need to call on

an off-site fire brigade, a backup plan at all U.S. plants,

is not considered in fire PRAs.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A5-3

-- Because of the rapid growth of fire, the

plant personnel were unable to take any

actions to fight the fire before the arrival

of the fire brigade. 

From this statement one can infer that there was a

delay in initiating the fire fighting activities. The

causes of the delay are not clear, but one can presume

that a lack of personnel fire fighting training and/or

plant procedures were involved. In any case, it seems

that this delay had a significant impact on the outcome

of the fire. 

00:06 At 01:56, when the first teams of fire

brigades, under the command of RTP-1

(rank of the person in command),

arrived on the scene, the TB roof near #2

turbine-generator had already collapsed

and the flames were visible from outside

through the windows. 

The time from ignition to collapse is no clear, but is

certainly very short (probably on the order of 10

minutes). This implies a very rapid fire growth and

very severe fire. The causes of rapid fire growth and

such severe impact on the roof is not addressed in the

available sources. Fire PRA methodologies do not

typically consider the possibility of roof collapse.

-- The fire propagated from the TB into the

Control Building via open cable

penetrations and other openings. 

In the Control Building, the fire

propagated through open cable

penetrations and leaking or open doors

and hatches into cable tunnels, electrical

rooms and cable shafts. 

The fire in cable shafts spread rapidly

upwards. It is estimated that the flame

propagated vertically at the speed of

0.7m/s. 

A large number of control and power

cables at elevations 12.35m and 16.40m

were damaged.

The fire propagated into the control

panels of the Main Control Room and

caused damage there.

The potential for room-to-room fire spread is

considered in a typical fire PRA, but for US plants this

is rarely found to be a dominant contributor to fire risk. 

While analyzed, such propagation is considered

unlikely in US plants.

This scenario is similar to other fire events at Soviet

plants where a fire propagates through the cable trays

and open penetrations. There was apparently less

attention paid to sealing openings in plant barriers

during the construction of soviet plants than would be

typical of U.S. plants. Many such openings are

apparently left open. Hence, the apparently unchecked

fire spread from room to room seen in this incident

cannot be considered as directly applicable to US

plants.

However, it is also possible that the TB roof collapse

might also breach otherwise intact fire barriers so,

while arguably not directly applicable, this combination

of collapse and potential room-to-room fire spread has

some relevance to U.S. plants as well.

-- The installed foam system at the fire

location could not be activated because

the cables for the system were damaged.

A portable foam system was not used

because the fire area was filled with

smoke and the personnel could not reach

the fire location.

In a typical fire PRA, the routing of the cables for fixed

fire suppression systems is not addressed. This event

demonstrates that there can be a dependency between

the fire and the availability of the fire suppression

systems. Also this statement is an indication that

smoke can adversely impact fire fighting activities.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A5-4

00:15 At 02:05 the assistant chief of the fire

brigade (RTP-2) arrived and took

command of the fire fighting activities. 

After examining the situation at -3.6m,

0.0m, 8.0m and 12.35 m elevations, he

determined that cable shafts #3 and #5

were affected and that the fire was

spreading upwards. The upper

elevations (above 12.35m) of the Control

Building were filled with smoke. This

included the Unit 2 Control Room and

Cable Spreading Room.

The commander gathered those plant

personnel who were available to help in

the use of a portable foam suppression

system. Two portable foam systems

(GVB-600 type) were brought to

elevation 12.35m and a third was

installed at elevation 16.40m. 

It should be noted that at this point the fire has

progressed in scope well beyond those fires that are

commonly modeled in a fire PRA. A typical fire PRA

for US plants would assume that possibility of a fire

propagating to so many areas and being this severe

would be vanishingly small. Again, there is no

evidence from this event to suggest that this

assumption is flawed given the close attention paid to

fire barrier elements in the US.

-- Severe disturbances of the plant systems

were caused by the fire and control of the

plant was made extremely difficult. 

There was apparently some fire damage

some control room panels. Lack of

separation of cables from redundant

trains led to the common mode failure of

a large number of system trains.

Multiple safety systems and a large set of reactor

instrumentation must have been lost. This is one of

few fire incidents where multiple safety trains were

damaged. It is stated in one of the sources that “reactor

was saved mainly by good luck”.

00:38 At 02:28 RTP-3 arrived and took over

the command of the activities. He

divided the fire fighting effort into three

fronts. The first front was to fight the

fire in the TB and try to prevent the

spread of the fire into the cable tunnels. 

The second front was to fight the fire in

the Control Building and extinguish the

fire at and above elevation 12.35m. The

third front worked at 16.40 m elevation

of the Control Building was instructed to

extinguish the fire at this elevation.

00:50 The fire commander at the local

headquarters was informed of the fire at

02:40. A busy inter-city telephone

system was caused delays in informing

various fire stations and headquarters.

Problems with local communications would not be

considered in a typical PRA. However, since fires are

also commonly assumed to be handled by on-site

personnel (see note above), this would not be a

significant factor in any case.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A5-5

-- Transformer oil had spilled and had

ignited with fire spreading to nearby

cables.

 The fire was burning at elevations 0.0 m

and 8.0 m. Additional fire fighter teams

were called in. The positioning of the

fire engines and method for fire fighting

was determined per established fire

fighting procedures.

From this statement it may be inferred that a

transformer failed causing a secondary fire. The failure

cause is not clear and may have been due to direct

exposure to flames or excessive heat, or due to

electrical faults impacting the transformer. In fire

PRAs, the possibility secondary fires is not postulated.

-- The operators had to work in heavy

smoke conditions. One report states that

at one point the operators were halfunconscious because of smoke

inhalation. Operators, despite all the

difficulties, managed to start one train of

reactor emergency cooling system.

In fire PRA, no credit is given to the possibility of

operators functioning in a compartment filled with

smoke. With substantial smoke in the control room,

abandonment would be assumed. This incident

demonstrates that this PRA assumption is conservative.

02:07 At 03:57 RTP-4 arrived with a team of

senior officers from the general territory

of the plant. At this time, the fire had

propagated to elevation 20.0 m of the

Control Building and the foam systems

at lower elevation could not control the

fire properly. It was decided to create a

command center for fire fighting. Plant

Administration considered activating the

automatic foam system to reduce the

intensity of the fire. For this they issued

electrically safe gloves to the fire fighters

and engaged the electric power to the

automatic foam system. 

-- A newly arrived fire engine provides

three additional foam dispensing points

at elevation 12.35m (GVB-600 type

foam system).

02:30 At 04:20 RTP-5 arrived on the scene,

took over the command and made some

changes to the fire fighting activities. 

He specifically instructed the third team

to fight fire at elevation 20.0m from #2

stairwell. He put together two additional

teams. The fifth team was instructed to

inspect, with plant administration, the

cable tunnels. 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A5-6

-- Per the instruction of fire commander,

RTP-5, an additional 100 fire fighters

were called in from Sverdlovsk. This

included fire fighters who were trained

in using self contained breathing

apparatus (SCBA). They also brought

40 tons of foam capacity with them. 

17:05 At 18:55, the fire was declared as under

control. 

21:40 At 23:30, fire was declared as

completely extinguished. The fire

fighting was conducted without break at

areas where the room temperature was as

low as -47oC. The fire fighting involved

35 brigades and a total of 270 fire

fighters including 150 who were trained

in using SCBA.

This is one of the longest duration fires in the history of

the nuclear power industry world-wide. Fire duration

considered in fire PRAs is typically under one hour and

the probability of such a long duration fire is

considered to be very small.

Equipment Damaged

- One of the turbine generators of Unit 2

- At least one oil-filled transformer

- A large amount of electrical cables in the TB and control building

- Control panels apparently including some panels in the main control room

Damaged Areas

About 960 m2 of the TB roof area above one of the turbine generators for Unit No. 2 was

damaged and collapsed. Cables and control panels were damage in the Control Building

at elevations 12.35 m, 16.40 m and 20.0 m. The cable spreading room, the control room

and cable shafts were affected by this fire. 

Impact on Core Cooling 

A large number of safety related equipment were affected by this fire, but some core

cooling functions remained available at all times. 

Radiological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

25 people were exposed to smoke or extreme cold weather conditions and apparently

suffered minor injuries.

Public Impact
A5-7

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A5.4 Comparison of Fire PRA Elements and the Incident

In this section, the chain of events in the fire incident is compared against the elements of a typical

fire scenario. Entries are made only if specific information was available relevant to each element. 

No attempt was made to postulate a possible progression of the event no matter how plausible it

could be based on the physics of the fire process, unless it was deemed to be essential in reaching

a specific insight.

Fire Scenario Element/Issue Incident - Beloyarsk,

December 31, 1978

Fire PRA Insights

Presence of combustible /

flammable materials

Turbine lubrication oil, cables

and other insulating materials

were the combustibles

consumed in this fire.

Turbine halls are widely recognized as

containing unique and potential severe

fire hazards.

Presence of an ignition source Hot surfaces on the turbine

and/or steam pipes served as

then ignition source for the oil

Ignition of the fire and

generation of heat (radiant and

convective), smoke, and other

gases

Turbine Lube oil pipes broke

and spilled oil. The turbine

and/or steam pipe hot surfaces

caused the oil to catch fire. 

Oil leaks and spills are common sources

assumed in the analysis of a TB.

Fire growth within the

combustible or component of

original ignition

The fire grew rapidly into a

large fire. 

The rapid fire growth is somewhat

unique to turbine building fires, but

would be assumed in most fire PRAs.

Fire propagates to adjacent

combustibles.

The fire propagated to electrical

cables and via the cables, it

propagated to other

compartments, including cable

shafts in the Control Building. 

From the cable shafts it

propagated upwards to several

floors of the Control Building. 

At one point in time, a

transformer failed and spilled

its combustible oil that also

caught fire.

While room-to-room fire spread is

considered, the extensive propagation

seen in this incident is not typically

modeled in a fire PRA. The

characteristics of the cables and openings

among compartments were certainly a

key contributor in this event. The same

factors in the U.S. plants are quite

different from those in Soviet plants. 

This experience may not be directly

relevant to US plants.
Fire Scenario Element/Issue Incident - Beloyarsk,

December 31, 1978

Fire PRA Insights

A5-8

A hot gas layer forms within the

compartment of origin (if

conditions may allow)

The TB roof above the fire

collapsed within a few minutes. 

From this one can infer that hot

gases accumulated underneath

the roof and caused the failure

of structural elements of the

roof. 

Collapse of structural elements is not

modeled in fire PRA. (Collapse within

such a short time is unusual in any case.) 

In most areas combustible loading is low,

and this assumption should be valid. A

TB typically houses large quantities of

oil and other combustibles; therefore, the

same assumptions may not be applicable.

Effects of fire (i.e., hot gas and

smoke) propagate to an adjacent

compartment (if pathways exist)

The fire propagated to adjacent

compartments by burning along

cable trays. Open penetrations

and doors allowed the fire to

spread to the cable shafts in the

Control Building. The fire

burned in the shafts for several

hours and ignited fires at

elevations 0.0 m, 8.0 m, 

12.35m, 16.40m and 20.0m. It

severely affected the control

room.

This is one of few fire events where a

large portion of an important area of the

plant (in this case the Control Building)

is affected by the fire. In a typical fire

PRA, the extent of damage caused by a

fire is confined to at most a few adjacent

compartments. However, it must be

noted that particular attention is paid to

fire barriers in the US, and a typical PRA

would confirm the integrity of fire

barriers as part of a plant walkdown. 

Hence, it is likely that a PRA would have

identified the lack of penetration seals as

a significant contributor to plant fire

risk.

Local automatic fire detectors

(if present) sense the presence

of the fire

The fire was detected manually

by plant personnel.

Alarm is sounded automatically

in the control room, locally and

/ or other places

The alarm was promptly

sounded upon detection and the

fire brigades called out.

Automatic suppression system is

activated (if present)

The available information

sources mention that automatic

suppression systems activated as

designed. However, given the

extent of manual fire fighting

that had to be done, the

automatic systems must have

only partially helped the

situation. 

It would appear that a fixed manual fire

suppression system near the fire origin

could not be manually activated because

the fire had already damaged system

cables. Fire protection system cables are

not typically traced as a part of a fire

PRA.

Personnel are present in the

area where fire occurs

The fire was detected by plant

personnel. It is not clear how

long before that the fire had

ignited.

Manual fire detection is commonly

credited in fire PRA.

Control room is contacted or

fire alarm is sounded

See note above.
Fire Scenario Element/Issue Incident - Beloyarsk,

December 31, 1978

Fire PRA Insights

A5-9

Fire brigade is activated The fire brigade was called

immediately after the discovery

of the fire and it took them

about 6 minutes to arrive on the

scene. In the course of the fire,

several other units were called

in from a wide area around the

plant. A number of senior

officers of the fire service got

involved in commanding the

fire.

In Russia, fire brigades are not located

on-site. In this event, plant personnel

chose not to attack the fire until arrival

of the first fire brigade although the

reasons for this decision are not given.

In most fire PRAs, fire are assumed to be

handled by on-site personnel. Fires

growing sufficiently large to require offsite support are not commonly modeled.

Fire suppressant medium is

properly applied

Fire suppressant used in this

event were water and foam. 

Large quantities of water and

foam were applied to different

levels of the Control Building

and the cable shafts.

There are no records of erroneous

application or misapplication of the

suppressant.

Fire is affected by the

suppression medium

It took a long time for the fire to

be brought under control. The

factors influencing the long fire

duration are deemed to be, the

fact that multiple plant areas

were impacted, the

inaccessibility of some fire

areas, propagation of smoke and

the intensity of the fire.

Fire growth is checked and no

additional failures occur

The fire was declared under

control after about 17 hours

from ignition..

This fire was of very long duration and

well exceeds the fire durations typically

considered in a fire PRA.

Fire is fully extinguished and

fire brigade declares it as out

The fire was declared as

completely extinguished about

22 hours after ignition.

As heat and smoke are

generated, equipment, cables

and structural elements near the

fire are affected by the fire.

The roof immediately the fire

collapsed. About 960m2 of TB

roof was severely damaged.

A large number of cables, at

least one transformer, and some

electrical panels were damaged

by the fire. 

Much of the plant systems damage would

have likely been identified in a fire PRA

analysis of the control building in

particular.

Cable failure impacts equipment

outside the fire location

This fire involved extensive loss

of cables and their associated

systems.

The equipment losses appear typical of

what might be assumed in a fire PRA.
Fire Scenario Element/Issue Incident - Beloyarsk,

December 31, 1978

Fire PRA Insights

A5-10

Equipment failure perturbs the

balance of plant operation and

causes automatic systems to

respond

The safety of the plant was

severely affected. The available

sources do not provide much

information about this issue. 

However, clearly the operators

had difficulty in controlling the

reactor. Reference [A5-1],

states that it was “pure luck”

that there was no core damage

resulting from this event.

Certainly, multiple safety trains were

affected in this fire event. It is not clear

whether the control room experienced a

complete loss of vital instrumentation. It

would appear that some core cooling

capability remained available throughout

the event. 

Operators in the control room

receive messages and respond to

the information displayed on the

control boar d or received

verbally from the plant

No information on operator

actions is available.

Operators attempt to control the

plant properly and bring the

plant to a safe shutdown

Clearly the operators had to

work under extremely difficult

conditions. No further details

could be gleaned from the

available sources.

The operators appear to have remained

in the main control room despite

conditions that would almost certainly be

assumed to force abandonment in a fire

PRA.

Structural failures (if occurred)

may jeopardize availability of

equipment

The available information does

not clarify whether the

collapsed TB roof caused any

damage to equipment that may

had been needed for safety of

the reactor.

Water when sprayed over

electrical equipment may fail

the exposed equipment

No information.

The cooling effect of CO2 may

adversely impact equipment

There were no CO2 systems

cited.

Conditions may exist at the time

of the fire that may aggravate

the impact of the fire on plant

systems

No information.

A5.5 Incident Analysis

This event is illustrative of a very severe turbine hall fire. The lack of separation between

redundant cables and extensive fire spread led to numerous common mode failures making the

control of the plant extremely difficult. The conditions for the control room operators were

further aggravated by direct control panel damage (fire spread from below into the control room

panels) and smoke in the control room. At one point the operators were severely affected by

smoke inhalation. Operators, despite all these difficulties, remained in the control room and
A5-11

managed to start one train of a reactor emergency cooling system. The required operator actions

and the locations where those actions took place (e.g., it is inferred that some local actions were

required) are not described in the available documents. Reference A5-1 states that it was only

fortuitous that core damage did not take place.

There was apparently a fixed foam extinguishment system at the original fire location (in the TB),

but the system could not be activated because the cables for the system were damaged by the fire. 

It is not common practice to trace fire protection system cables, so this potential might have been

missed in a fire PRA. It would appear that US standards are largely mute on the protection of fire

protection systems from fire damage.

A large number of fire fighters gathered from a wide area around the plant and fought the fire

from several fronts. Several senior officers from the region joined the force at various times

through the incident, and each arriving official of higher rank took over the command of the fire

fighting operation. At least four changes of command took place. This apparently added some

confusion and uncertainty to the fire fighting efforts, but reports are not clear in this regard. In

the US, the overall lead would likely remain with plant personnel, rather than being transferred to

off-site personnel.

This incident started as a typical TB fire scenario involving the turbine lubrication oil system. 

Hence, the fire initiation portion of this incident is routinely considered in fire PRAs. However,

the fire grew out of control for some time and ultimately spread to much of the control building. 

In some, but certainly not all, fire PRAs, total loss of equipment in the TB is considered. 

However, the complications that followed after the fire propagated to other parts of the plant can

be attributed to plant specific conditions (lack of seals for fire barrier penetrations) not typically

found in US plants, and therefore, not typically addressed in US plant fire PRAs. The lack of fully

sealed fire barriers had a profound impact on the propagation of the fire into different

compartments. In fire PRAs, the status of fire barriers is routinely examined as part of a plant

walkdown.

An important aspect of this incident is the collapse of TB roof; especially the short time it took for

the fire to lead to such catastrophic failure. The roof collapse is attributed in part to the delay in

initiating fire fighting efforts as well as to the apparent rapid fire growth. The plant personnel did

not attempt to fight the fire, but rather, waited for the fire brigade to arrive (this is consistent with

their training, fire brigades in Russia are an off-site function and the fire service is actually a

branch of the Russian military). Other potential factors, for example structural design

characteristics of the roof, fire protection (or the lack thereof) for the structural elements, and/or

extremely cold outside temperature, are discussed in any of the available reports. In fire PRA, the

possibility of structural failure is typically not modeled. This assumption may be appropriate for

areas where the combustible loading is low. However, for TB fire scenarios, where combustible

loading is generally high, the possibility of structural failure may exist but is not typically

considered. The impact of such failure on safety related functions is a plant specific issue. 

Although in a typical PRA structural failure of the TB is not modeled explicitly, only under special

conditions such a collapse may impact safety functions. 
A5-12

This incident has some similarities to other fire incidents at Soviet-design plants where a TB fire

propagated into other parts of the plant through open or leaking doors and penetrations. This

incident demonstrates the importance of quality fire barriers and the sealing of barrier openings. 

In fire PRA, it is typically assumed that fire barriers are properly designed and installed. Some

nominal failure probability (such as 0.01 per demand) is commonly assumed in order to assess the

potential risk contribution of room-to-room fire spread. In the U.S. there has also been

considerable regulatory interest in recent years associated with fire barriers. This has likely

contributed to a high reliability for primary fire barriers in U.S. plants. This incident demonstrates

that it is important to verify the integrity of critical fire barriers as part of the fire PRA effort to

ensure that realistic information is employed in the analysis. As it is noted above, barrier status is

routinely examined in a typical fire PRA as part of plant walkdown.

This is one of the few fire incidents identified where fire fighting proved to be extremely difficult. 

While the available discussions of fire fighting are not extensive, it is clear that the efforts were

influenced by a number of complicating factors. The fixed foam suppression system in the TB

was disabled before it could be activated because of fire damage to cables. The routing of the

cables for a fixed fire suppression system is generally not addressed in fire PRAs. This incident

demonstrates a potential dependency between the fire and the availability of fixed suppression

systems. Such dependency will be minimized in most US plants by the use of diesel (or gas)

driven fire pumps, and the widespread use of wet-pipe sprinkler systems that are not dependent on

electrical actuation or control. It would appear that the US fire suppression system standards are

largely mute on this subject. Hence, there appears to be no basis for a general assumption that US

systems would be immune from similar failures.

Fire fighting was done in heavy smoke conditions and with an extremely low outside temperature.

Because of the extensive spread of the fire, it was fought from at least three separate fronts. Such

complications are not typically considered in fire PRAs. Indeed, fire PRAs rarely postulate fires

of this magnitude or duration. Often, for TBs it is assumed that the entire building is engulfed in

fire. If this fire scenario cannot be screened out as risk insignificant, a detailed analysis of

potential fire scenarios may be conducted. For those detailed analyses, in fire PRAs the time to

extinguish a fire is typically assumed to be on the order of few tens of minutes. This incident

demonstrates that it can take extended times, in this case over 17 hours, to control the fire.

Multiple safety systems and a large set of reactor instrumentation appear to have been lost in this

incident. The details of what was lost and how the operators managed to provide core cooling

and reactor control is not provided in any of the available reports. This is one of few fire incidents

where multiple safety trains have been damaged. The operators clearly worked under very harsh

conditions due to the presence of smoke and fire in the Main Control Room. In addition to cable

failures, there was also direct control panel damage in the Main Control Room. Despite these

adverse conditions the operators managed avoid core damage. In a typical fire PRA, if the

control room is filled with smoke, it is assumed that the operators will become ineffective and, if

an alternate (reserve) shutdown panel is not used, core damage will certainly occur. This incident

illustrates that operators can be effective even under harsh conditions.

A5.6 References
A5-13

A5-1 Heikki Aulamo, Jouko Martilla and Heikki Reponen, “The Full Stories on Aremenia and

Beloyarsk”, Nuclear Engineering International, July 1995.

A5-2 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A5-3 Soloviev.P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A5-4 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A5-5 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.

A6-1

Appendix 6 - Analysis of North Anna, Unit 2 Fire on July 3, 1981

A6.1 Plant Description

North Anna is a two unit nuclear power station located near Mineral, Virginia. Both units are

893 MWe Westinghouse design, pressurized water reactors. Unit 2, where this fire incident

occurred, started commercial operation in December 1980 [Ref. A6-3]. 

A6.2 Chain of Events Summary

On July 3rd, 1981, at 07:23, Unit 2 was at 17.9% power level when an internal fault in one phase

of the “B” main transformer led to catastrophic failure of the transformer and fire (Reference [A6-

1]). A ceramic insulation shifted and the side of the transformer ruptured. Transformer oil

sprayed from the opening over the transformer and the outside wall of the turbine building. 

The fire caused the feeder breakers from a Reserve Station Service Transformer to two station

service buses to trip open. The voltage transient caused by this event led to several bi-stables in

the Solid State Protection System to drop out, resulting in a high steam line flow signal. Since the

reactor coolant temperature was low, this led to a safety injection signal. 

The fire brigade was activated immediately. The local fire departments were also contacted for

assistance (at 07:25). The deluge systems on the B and C transformers activated. However, the

fire was too severe for the capability of the system and the fire continued to burn. It took the fire

brigades about one hour to bring the fire under control.

A6.3 Incident Analysis

Although this incident is considered a severe fire in classical fire protection terms, it affected only

non-safety components. Hence, in a fire PRA it would be considered as risk insignificant. Fire

scenarios impacting only non-safety components are commonly screened out in the early stages of

a fire PRA. The occurrence of the spurious safety injection signal, although in this case initiated

by failures caused by the fire, would also be possible due to other types of equipment failure. In

other words, such a fire is considered as one of many possible causes for the actuation of safety

injection signal. Hence, in a more general context this fire incident should be captured within the

bounds of an internal events PRA rather than in the fire PRA.

Despite the low potential risk impact, the incident provides an interesting insight about fixed fire

suppression system capabilities. It demonstrated that a fixed fire suppression system can be

overwhelmed even when the fire initiates in those components that the system is intended to

protect. In other words, it shows that effectiveness of the suppression system may be an

important factor. In fire PRAs it is assumed that the fire protection systems are designed and

installed properly and if actuated they can control the fire caused by the protected components.

However, this insight is mitigated for many PRA applications because large oil-filled transformers

are commonly located in outdoor switch-yard areas rather than within the plant structures. The
A6-2

main concern of a fire PRA is focused on safety related cables and equipment and the areas where

such components are present. The are typically internal plant areas, and quite commonly, the

characteristics and quantity of combustible materials make the possibility of overwhelming the

fixed suppression system very unlikely. Therefore, the assumption regarding adequacy of

suppression systems is not called into general question by this incident. However, the issue of

effectiveness of the suppression system, as discussed in Reference [A6-2], must be taken into

account for all scenarios. This incident makes it clear that it is not sufficient to consider the

reliability of the suppression system alone. Reference [A6-2] provides methods for incorporating

effectiveness of these systems.

A6.4 References

A6-1 Licensee Event Report (LER) - 339-81-055, Virginia Electric and Power Company, North

Anna Power Station, Unit 2, Docket No. 50-339, July 15, 1981.

A6-2 N. Siu and G. Apostolakis, "A Methodology for Analyzing the Detection and Suppression

of Fires in Nuclear Power Plants," Nuclear Science and Engineering, 94, 213-226(1986).

A6-3 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A7-1

Appendix 7 - Analysis of Armenia NPP fire on October 15, 1982

A7.1 Plant Characteristics

The Armenia Nuclear Power Plant (ANPP) is a two unit VVER 440/230 power plant located

outside Yerevan, the capital of Armenia.[A7-5,6] At the time of the fire, Armenia was part of the

former Soviet Union. Unit 1 began operation in 1976 and was shut down permanently in 1989. 

Unit 2 began operations in 1979 and continues to operate.[A7-6] The two units shared turbine

building where four turbine-generators (two generators per unit) are located. Each reactor has a

separate reactor compartment with six steam generators per unit. The capacity of the steam

generators is such that, after a reactor trip, no makeup water or core injection is necessary for

over 5 hours. This feature played an important role in the fire incident under review. The two

units do not share any systems. The ultimate heat sink is provided by natural draft cooling

towers. The diesel generators are located in a separate building away from the main reactor and

turbine buildings. There were three diesel generators for each unit at the time of the incident.

Each unit has a separate main control room – Control Room 1 and Control Room 2 ! responsible

for reactor control. The connections to the power grid are controlled from a separate Central

Control Room located on the site. The power and control cables are run through several cable

galleries (cable tunnels and cable shafts). At the time of the fire incident, the cables from both

units and from redundant trains of the same system could be found in the same cable galleries. 

(Since the fire incident, routing of the cables has been modified to minimize the co-location

problems of the original design and fire retardant coating have been applied to the cables). The

cables were laid in horizontal cable trays with no fire retardant materials protecting them. Cable

insulation, per Soviet test standards, was rated as 0.5 hour fire resistant. It is not clear if this

rating has any direct correspondence to U.S. fire rating standards.

A7.2 Incident Summary

On October 15, 1982, at 09:55, fires ignited along a power cable at seven different points in two

separate compartments (cable galleries). The fire primarily impacted Unit 1. The impact on Unit

2 was much less severe than Unit 1. The fire rapidly established itself and spread to other cables

and cable trays in both compartments. Ignition occurred because of a short circuit in the terminal

block of a 6 kV power cable to a service water pump. This short was manifested as an overload

current when an operator attempted to start a pump.

Local automatic fire detectors sensed the presence of the fire within 1 minute of ignition. (The

ignition time is assumed to be the moment that pump switch was manipulated by the operator.) 

The detectors sounded an alarm in Control Room 1 and in the Central Control Room. The cable

galleries were equipped with an automatic foam fire suppression system. However, the system

initially did not activate because the controls for the system were set to the manual mode. The

system control cables were damaged by the fire before this could be corrected and therefore the

system could not be activated for the entire course of the fire.
A7-2

The fire brigade was called within 5 minutes of fire ignition. The procedures for fighting electrical

fires stipulated that no fire fighting activity can be initiated inside a compartment that contains

electrical equipment or cables and is darkened by smoke until the power is turned off. The

brigade, therefore waited and did not start fire fighting activities until about 10:15, 20 minutes

after fire ignition. The initial brigade attack was made using fire hoses and water streams.

As noted, the initial fire was ignited in two separate compartments. Fire also propagated to an

adjacent cable shaft. Smoke rapidly filled the compartments of fire origin and propagated to other

rooms, including the Unit 1 main control room, because of open cable penetrations, doors and

hatchways.

About 10:05, 10 minutes into the fire, the main circulating pumps of the primary loop for Unit 1 

were lost. This initiated emergency protection signals. Indications were received on the control

board that the neutron flux (reactor) period was less than 20 seconds. The 0.4kV and 220VDC

safety buses were then lost. The turbine stop valves closed and within 2 minutes the generators

were disconnected from the grid. Eventually, a large number of components were lost due to the

fire.

At about 12:10, 2 hours and 15 minutes into the fire, short circuits were experienced that led to

secondary fires and a complete station blackout. The investigation team later concluded that the

mechanical impact of the water stream caused short circuits in the control cables related to the

main unit turbine generators. As a result, the main breakers of the two generators for Unit 1 (i.e.,

G-1 and G-2) closed spuriously and connected these two turbine-generators to the grid. This

caused several short circuits. The turbine-generators failed due to electrical and mechanical

overload. Turbine Generator 2 experienced a short at its power outlet. As a result of the

generator failure and the shorting, hydrogen escaped and exploded and an oil fire was ignited near

Turbine 2 that engulfed the oil storage tank. Close to 300 m2 of the turbine building was

eventually affected by this secondary fire. In addition to the turbine generators, the startup

transformer was also affected (overloaded) by the inadvertent connection of the turbine

generators to the grid. This transformer exploded and caught fire as a result of the overload.

At 12:30, ANPP personnel started laying temporary cables for connecting a diesel generator to

the “house” loads. At 12:45, the Unit 1 control room lost all instrumentation and control over the

reactor. By 15:13, the power to two high pressure injection pumps (emergency core cooling

pumps) was restored using spare cable runs outside the buildings from a diesel generator to the

motor windings of the pump. This re-established the core cooling capability. 

At 16:00 the fire brigade considered the fire under control and at 16:58 fire was declared to have

been extinguished. The total fire duration was just over seven hours.

A7.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in detail and in a chronological order as best

as can be inferred from the available sources (References [A7-1] through [A7-4]). If the precise
A7-3

timing and the order of an event is not known, the time of occurrence is not specified. However,

it is included within the chronological order of events based on the available information and the

judgement of the authors of this report. If a specific time is cited, this is based on one of the

available reports.

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

The automatic, fixed foam system in the cable

galleries were switched from automatic to the

manual mode.

This condition should be detected during a PRA

plant walkdown.

Prior to

the

incident

Diesel Generator #1 was under maintenance at

the time of the incident.

Prior to

the

incident

Both Units were operating at 100% power

level.

00:00 On October 15, 1982, at 9:55 a.m., fire ignited

at seven points along a 6kV power cable. The

cause of the fire was attributed to a short circuit

in the terminal block of a 6kV electric motor of

the 2NTV-4 service water pump (Note 1). It is

estimated that the current reached in excess of

10kA for an extended duration. The excessive

current led to ignitions in seven places in two

cable galleries (N59a and 60a) along the cable

route.

The cause of the short circuit was traced to an

error committed by electrical shop personnel. 

They had failed to ensure that the terminal

block and 6kV cable attachment were properly

sealed. This was in violation of the specific

written instructions on operation and

maintenance of electric motors.

Electrical fires, including self-ignited cable fires

for older style cables, are considered in fire

PRAs. However, the simultaneous occurrence

of fire ignition at several points is not

postulated. Moreover, in this incident the fire

started in at least two compartments.

In fire PRAs done for plants in the U.S., the

frequency of ignition of fires for a compartment

is based on statistical analysis of fire events that

have occurred in U.S. plants. Often, very small

frequency is assigned to self-ignited cable fires. 

At ANPP, the ignition occurred in a 6kV power

cable because of high current caused by a short

in the power circuit. Certainly there are

significant differences in the electrical circuit

design between U.S. and Soviet power plants

and in the fire performance rating of the power

cables. Therefore, extrapolation of the insights

gained from this incident to fire PRA for U.S.

plants must be done with caution.

-- Both units were manually tripped from the

control room.

The decision to trip both units was made quite

early. PRAs often assume a plant trip will be

initiated given any significant fire in the plant.

00:01 Local automatic fire detectors sensed the

presence of fire within 1 minute of ignition. 

This is consistent with typical assumptions used

in a fire PRA.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-4

The detectors sounded an alarm in Control

Room 1 and Central Control Room. 

-- The fire rapidly established itself and spread to

other cables and cable trays, including control

cables. Some of the control cables laid inside

metal boxes (possibly either junction boxed or

enclosed raceways) were also affected by the

fire.

In fire PRAs, the growth of cable or any other

fire is established through modeling of the

propagation process. Typically, the growth time

is in several minutes. In this incident, the fire

propagated rather rapidly. It is possible that the

large amount of energy discharged by the short

circuit into the cable caused the rapid initial

growth of the fire. It should be noted that the

fire resistance requirements of the cables used in

the plant at that time may not have been as

stringent as those currently applied in a U.S.

power plant. Therefore, the rapid growth of fire

may be partly relevant to U.S., plants, and in

particular, older US plants. 

— Because of lacking or open fire doors and

hatches and loose filling of cable penetrations,

the fire propagated to adjacent areas. This

included cable shaft N (at elevation +3.60m)

and to four parallel cable galleries (elevation -

3.60m).

In a typical fire PRA it is assumed that hatches,

cable penetrations and fire doors are properly

designed and installed. Therefore, the

possibility of fire spread through hatches, cable

penetrations and fire doors is assumed to be a

low probability event. This incident

demonstrates that if these devices are not

properly installed, fire propagation to an

adjacent compartment may be imminent.

-- Smoke rapidly filled the compartments of origin

and propagated to adjacent rooms because the

cable penetrations between rooms were not

sealed. Smoke also got into Control Room 1. 

Propagation of smoke and its impact on plant

personnel is typically addressed in fire PRAs

using conservative and simplified models. The

possibility of smoke ingress into the control

room from fires outside the control room is

often not considered, unless there are clear

indications that this could be possible. 

-- The cable tunnels were equipped with a foam

system. However, the system did not activate

because the controls for the system were set to

the manual mode. The system was never

activated throughout the entire course of the

event. The control circuit (cables) of the system

became damaged by the fire.

The routing of power and control cables for the

fire protection system is generally not

established when conducting a fire PRA. Loss of

a fire protection system because of the fire itself

is seldom considered. In a typical fire PRA it is

inherently assumed that the power and control 

cables associated with the fire suppression

system are not in the compartment where the

fire is postulated. U.S. standards appear to be

largely mute on this subject.

00:05 The fire brigade was called within 5 minutes of

fire ignition. (It may be noted that Soviet plants

commonly rely on a fire brigade that is

associated with the plant but resides off-site.)

 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-5

00:05 At 10:00 a.m., smoke in feedwater area was

noticed

00:07 At 10:02 a.m., all main coolant pumps

disconnected without an apparent reason. This

initiated a level 3 scram (Note 3), which was

immediately followed by a level 1 scram

because of loss of power to reactor protection

system.

-- Tried to check status of condenser vacuum, but

none of the related valves could be operated

from the main control room.

00:10 Lack of cable separation in the cables for the

two units and between redundant trains caused

numerous common cause failures. About 10:05,

in Unit 1, a Type III Emergency Protection

signal activated because of the loss of main

circulating pump 1GCN-3. In a few seconds, a

Type I Emergency Protection signal was

received with indication that the following

conditions are present:

- Neutron capacity exceeded 20%

- Neutron flux period less than 20 sec.

- Loss of 380VAC control and 220VDC

protective power systems

The available reports cite that the control room

indications were not accurate, probably due to

degradation and/or failure in the instrument

cables. The reports imply that the Type I

emergency protection signal was spuriously

generated as a result of these instrument

problems.

00:10 At 10:05 the turbine stop valves were closed

00:11 At 10:06, the reserve transformer 1 was

switched off. Lights went out. Telephone links

to outside the plant were cut off. A large

portion of instrumentation readouts and alarms

in the Central Control Room and main control

room 1 were lost. All Unit 1 6kV and 0.4kV

buses except for the uninterrupted power

coming from the AC/DC motor generator set 

were lost. From the accident investigation

report, it is not clear how exactly these losses

took place.

00:12 At 10:08, diesel generators 2 and 3 started but

would not connect to their respective buses. 

The two main generators were disconnected

from the grid.

It must be noted that these actions would take

place in the central control room. The central

control room was not directly affected by smoke. 

Actions from multiple control points are seldom

explicitly modeled in fire PRAs. Current

human action methodologies however, can

address such scenarios. 

-- Diesel generator 2 disconnected because of local
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-6

interlocks prevented it from connecting to the

bus.

-- Diesel generator 3 disconnected because of a hot

short in its associated cable.

Note that the presence of hot short is

specifically mentioned in incident description. 

This is one of few incident descriptions that the

possibility of existence of a hot short is

specifically mentioned. In fire PRA, such

failure modes play an important role.

-- Plant personnel, for a short time, succeeded in

activating one plant reserve transformer and

bring power in for one emergency makeup

pump and one service water pump.

-- Thick smoke was spreading from the cable

tunnels, switchgear rooms, and other areas of

the control building. The control room was

affected by the smoke and by the fire.

In a typical fire PRA, it is assumed that if the

control room is filled with smoke the operators

cannot continue to function.

00:15 At 10:10, plant fire brigade arrived at the scene.

00:17 Ar 10:12, the local grid was disconnected from

the electrical system.

-- A large set of equipment was lost because of the

fire. This included 400m2 of cable areas and

some switchgear rooms.

-- The fire brigade started the foam pump, that

started rotating but no foam was formed because

of air trapped inside the pump. Personnel

removed the air but could not restart the pump

because fire damage took out the power to the

pump. 

Fire-induced loss of a fire protection system is

not typically considered in a fire PRA.

-- Because the plant lost normal and emergency

makeup, the operators closed all blowdown lines

from the steam generator and reactor.

00:20 At 10:17 a.m., large quantity of smoke was

observed in the turbine building.

00:20 Between 10:17 and 10:25, operators tried to

remove hydrogen from the main generators but

failed to complete the task. One report surmises

that because of their excessive anxiety, the

responsible operators erroneously closed a 

nitrogen feed valve (a manual valve) during the

hydrogen transfer operation. As a result about

20% of the hydrogen was left in the generators.

This is an apparent example where a fire did

lead to increased operator anxiety leading to an

operator failure. In this case, the failure

aggravated the fire situation because the

hydrogen was not properly purged from the

main generator.

00:20 The procedures for fighting electrical fires Delay in initiating fire fighting activities
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-7

stipulated that no fire fighting activity can be

initiated inside a compartment that contains

electrical equipment or cables and is darkened

by smoke until the power is turned off. The

brigade, therefore waited and started fire

fighting activities at about 10:15, 20 minutes

after fire ignition using water streams. A part

of the fire fighting activities were conducted

from Control Room 1. The hatch to cable shaft

was opened from the control room and water

was applied from there.

because of procedural requirements is not

generally considered in a fire PRA.

In this case there is also the added complication

of fire fighting activities (laying of hoses,

personnel movement, opening of access hatches,

etc.) in the control room itself. This particular

configuration is unlikely to be encountered in a

U.S. plant.

00:25 External fire brigades were alerted. The delay

in summoning the external fire brigades was

due to loss of telephone connections caused by

the fire. 

In a typical fire PRA, such circumstances as the

need to call external fire brigades and

difficulties in reaching them is not modeled

explicitly. Such conditions are assumed to be

included in an overall model that is based on

statistical analysis of fire event data.

-- In total, 21 fire brigades arrived at the plant

from Yerevan and other surrounding areas.

The transit time for the off-site brigades cannot

be established. See the preceding note.

-- The plant experienced a station blackout

because power cables were lost that affected the

connections to both the diesel generators and to

the offsite grid.

A fire-induced station blackout is a somewhat

uncommon fire risk scenario for U.S. plants. 

However, fire PRA methodologies that do

address possible spurious actuations and the

resulting potential for loss of equipment, should

include scenarios that would effectively lead to

station blackout conditions..

-- Primary and secondary side pressures were

controlled by the operators in the main control

room by opening the valves at steam dump

stations 1 and 2.

00:35 At 10:30, a spurious signal started feedwater

pump #1. This was considered as a spurious

connection because the normal pump startup

signal should have first initiated the lubricating

oil pump. The pump rotated without

lubrication. The control operators were unable

to disconnect the pump. Electrical technicians

achieved this from the bus powering the pump.

This is clearly an anecdotal account of a

spurious actuation caused by an apparent

control cable hot-short failure leading to a start

signal generated between the control room and

the MCCs. It is also interesting that the fault

bypassed starting of the lube oil system and, had

the pump not been secured, an unrecoverable

failure of the pump would have followed. The

fault also blocked or bypassed the normal stop

command functions in the control room. 

Although such a scenario would be considered

in a fire PRA that includes spurious operation,

the fire incident reports seldom provide

sufficient information to allow an in depth

understanding of the chain of events leading to

the spurious actuation. 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-8

01:10 By 11:05, substantial smoke had entered the

main control room. Additional difficulties with

plant control arose because of the smoke inside

the control room and lack of alternate control

provisions.

There is relatively little information on this

aspect of the event, but it is clear that operations

in the main control room were hampered

significantly.

01:33 At 11:28, steam generator #3 safety valve

opened.

01:35 At 11:30, a total loss of instrumentation

occurred in the main control room.

The electrical connections to the turbine hall

and central control room instruments and

equipment were also lost.

This incident is one of few fire events where

total loss of instrumentation took place (the so

called “flying blind” scenario). In a typical fire

PRA this scenario would be assumed to lead to

core damage. Clearly, based on this and other

fire incidents the PRA practice of assuming core

damage under such circumstances is

conservative.

-- A courier system was established between the

main control room and other locations of the

plant to send and receive information and

instructions.

Operator actions outside of normal procedures

would not typically be credited in a PRA.

01:47 At 11:42, plant personnel succeeded in

establishing a temporary cable between the

main and central control room. (It is inferred

here that this refers to a voice communication

cable was strung between the control rooms to

facilitate the interaction between the two control

rooms.)

In fire PRAs, loss of communication between

different centers of the plant is typically not

considered as an important element of a fire

scenario. However, it must be noted that often,

it is conservatively assumed that in case of a

severe fire damage to main control room

controls and instrumentation, the operators will

abandon the control room and take control over

the plant from other locations. The probability

of success of this mode of operation is genrally

modeled conservatively.

01:50 At 11:45, the power supply if neutron flux

monitoring system was lost.

-- The 0.4 kV uninterruptible power bus was lost

because of a short in the DC power system.

02:05 By 12:00, for both units, the electric power for

the primary side of the units was gone. There

was no indications in Unit 1 main control room. 

Unit 2 main control room had lost its lighting. 

Temporary telephones had to be used for

communication and the operators in Unit 1

main control room were working in darkness

and smoke filled room.

The only instrumentation that was available to
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-9

Unit 1 plant personnel was the primary pressure

readings from 3 manometers at local stations.

02:10 At 12:05, it was discovered that turbine

generator 1 was rotating at 1000 rpm. The

generator was vibrating and smoke was coming

out of its bearings.

02:15 At about 12:10, short circuits were experienced

that led to secondary fires. The investigation

team later concluded that the mechanical impact

of the water stream caused short circuits in the

control cables related to the generators. As a

result, the main breakers of the two generators

for Unit 1 (i.e., G-1 and G-2) closed spuriously

and connected these two turbine-generators to

the grid. The turbine-generators failed due to

electrical and mechanical overload. Turbine

Generator 2 experienced a short at its outlet. As

a result of these failures hydrogen escaped from

generator #2 and exploded (as noted above 20%

of the hydrogen was left behind during the

failed purge operation). An oil fire occurred at

Turbine 2 that engulfed the oil storage tank. 

Close to 300m2 area of the turbine building was

eventually affected by this fire.

The impact of water, and especially mechanical

impact of water on cables and shorts caused by

that is not considered in a typical fire PRA.

It is interesting to note that these shorts

occurred more than 2 hours after the ignition. 

Fire PRAs do not commonly consider damage

beyond at most a few 10s of minutes. 

Secondary fires are not modeled in a fire PRA. 

In this incident, the secondary fires were very

large (two substantial oil fires) and caused

significant damage to the turbine building and

may have aggravated the loss of offsite power. 

-- Because of inadvertent connections to the grid,

the Caucauses region power voltage dropped

and several high voltage lines disconnected.

02:21 At 12:16, in addition to the turbine generators,

the startup transformer (Note 2) was affected by

the connection to the grid. Because of overload,

it exploded and caught fire.

This incident points out that secondary fires

may occur at more than one location and can

have catastrophic impact on equipment.

02:25 Starting about 12:20, personnel tried to

establish nitrogen flow into generators #2, but

failed because of low nitrogen pressure.

The fire brigade started fighting the fires in the

turbine building and at the transformer.

02:35 At 12:30, ANPP personnel started laying the

temporary cables for connecting a diesel

generator to the “house” loads.

In a typical PRA, the possibility of recovery

actions that are beyond the established and

written procedures is assumed to be very

unlikely. In this case, after over 2 hours these

efforts ultimately led to success as noted below.

02:50 At 12:45, control of Unit 1 from the main

control room panels was completely lost. The

Under current designs this would lead to

abandonment of the control room and use of
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-10

smoke in the control room was reportedly

“unbearable”, forcing all remaining operators to

don masks.

alternate shutdown. At this time there was no

specific remote shutdown capability available. 

For such a condition, the fire PRA analysts

would assume that core damage would occur.

03:05 At about 13:00, plant personnel succeeded in

connecting a temporary power cable from diesel

generator #4 to Unit 1's emergency makeup

pump #1 and start the pump (a high pressure

emergency core cooling pump). This allowed

water injection into the primary loop of Unit 1. 

The pressure of the reactor was monitored from

a local manometer. The coolant apparently

discharged through the relief valves into tank

B8/1. 

-- During the next four hours, operators wearing

breathing masks went to the upper levels of the

turbine building to manually open the steam

dump valves of the steam generators. (It must

be noted that it is not clear if this action was

commenced before or after the temporary power

to the emergency makeup pump was connected.)

Operator actions in a fire impacted area would

not typically be credited in a fire PRA.

03:25 At about 13:20, the turbine building and

transformer fires were brought under control in

about two hours after they started.

04:05 At about 14:00, one of cable spreading room

walls was broken open to provide access for fire

brigade to fight the fire at elevation 5.4m under

the main control room.

05:18 At 15:13, per Reference A7-2, the power to

makeup pump #4(1APN-4), was restored using

a spare cable run outside the buildings from a

diesel generator to the motor windings of the

pump. 

This was a non-proceduralized action that

would not have been credited in a typical fire

PRA.

06:05 At 16:00 the fire brigade considered the fire

under control.

07:03 At 16:58 fire was considered as extinguished. 

07:05 At about 17:00,a feedwater pump was also

powered using a temporary cable setup that

established makeup to the steam generators. 

This was possible only after the fire in the

turbine building was extinguished.

This event illustrates operator actions in a fire

impacted area shortly after extinguishment of

the fire. This would not typically be credited in

a fire PRA.

07:05 At about 17:00, the main control room power

was re-established using Unit 2 sources and

Recovery of lost control room functions would

not typically be considered in a fire PRA.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A7-11

instrumentation was restored.

The instrumentation had to be re-calibrated and

repaired to provide correct readings in the main

control room.

10:45 At about 20:40, neutron flux instrumentation

was restored.

NOTES:

Note 1 - Reference [A7-1] identifies the pump as “Boron Make-up Pump” and the cause

of the fire as “Failure of electrical protection occurred and caused overheating of cable and

motor”. 

Note 2 - Reference [A7-2] identifies the transformer in plural as “Service Transformers”. 

It is assumed that it refers to the transformers that bring offsite power to the unit and if there were

more than one such transformer, all were apparently affected by the fire.

Note 3 - In Soviet designed reactors, apparently there are three levels of scram. In a level

3 scram a portion of the control rods start moving in. A level 2 scram normally occurs based on a

timer 10 minutes after level 3 scram is initiated and initiates the insertion of the rest of the rods. A

level 1 scram is full rod drop that would normally occur 10 minutes after initiation of level 2

scram. Note that each of these time delays can be bypassed to speed the process of reactor

shutdown in an emergency.

Equipment Damaged

- Numerous Power cables 

- Numerous Control cables

- Turbine generator number 2

- Start-up transformer

- Off-site communications

- Off-site power

- Diesel generator power supply cables

Damaged Areas

The control building and the turbine building experienced severe damage. An area of

about 300m2 in the turbine building was affected by the fire there, mainly damaging

Turbine Generator 2. Inside the control building, about 400m2 of cable routing areas were

affected by the fire. Smoke entered practically all parts of the control building, including

the control room. At the time, the plant was not equipped with a reserve control room or

an explicit alternate shutdown capability.

Impact on Core Cooling 

Although the plant experienced a station blackout for a long time, core cooling was

maintained via natural circulation in the primary loop and the water remaining in the steam

generators. While all active means of core cooling were lost for some time, at no time
A7-12

during the fire did core cooling stop. This is due to the large secondary side capacity for

passive reactor cooling. Fuel cladding, the primary envelope and the containment were

not adversely affected by the fire. At about 5 hours after the fire, water was injected

directly into the steam generators by installing a spare cable from a diesel generator to a

feedwater pump directly.

Rediological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

There was smoke inside the control room. However, there were no reported injuries to

plant or external fire brigade personnel caused by the fire.

Public Impact

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A7.4 Comparison of Fire PRA Elements and the Incident

In this section, the chain of events in the fire event is compared against a the elements of a typical

PRA fire scenario. Entries are made only if specific information was available in the available

documents. No attempt was made to postulate a possible progression of the event no matter how

plausible it could be based on the physics of the fire process, unless it was deemed to be essential

in reaching a specific insight.

Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

Presence of

combustible /

flammable materials

The primary fuel was cables in at least

two cable galleries. The fuel loading

was high due to the presence of stacks

of cable trays along the walls.

Secondary fires involved both turbine

and transformer oil. 

Presence of an ignition

source

There were no open ignition sources. 

This was a self-ignited cable fire.

Ignition occurred because of a short in

a 6kV power circuit and excessive

(more than 10kA) current in the

cables.

This verifies that a propagating self-ignited

cable fire is possible, although clearly the

fire rating of the cables impacts this

potential. The fire rating of the cables was

cited as 0.5 hour per Soviet standards. No

correspondence to U.S. standards has been

established.
Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

A7-13

Ignition of the fire and

generation of heat

(radiant and

convective), smoke,

and other gases

The fire was caused by a current

overload due to an error committed by

electrical shop personnel. Ignitions

were noted in seven places and in two

compartments (N59a and 60a).

The root cause of the self-ignited cable fire

is operator and maintenance crew error.

Self-ignited cable fires are commonly

considered for older US plants that contain

cables not certified as low flame spread per

current standards.

Simultaneous, multiple ignitions in more

than one compartment is not considered in

current fire PRAs.

Fire growth within the

combustible or

component of original

ignition

The fire presumably propagated to

adjacent cables within the ignition tray

and established itself very rapidly. 

The high overload current and the

implied electrical energy release at the

points of shorting likely contributed to

this rapid growth behavior.

This points out that even a self-ignited

cable fire can establish itself and propagate

rather rapidly. Of course, it depends on the

characteristics of the combustible materials

(in this case cables) present in the

compartment. In a typical fire PRA fire

growth is estimated using a computer

model of fire propagation process. These

models typically predict fire growth in

terms of several 10s of minutes. In this

incident the fire propagation took place

rapidly. Current models do not consider

the potential for electrical heating effects to

enhance fire growth behavior.

Fire propagates to

adjacent combustibles

Fire was ignited in two separate

compartments. The fire clearly

propagated, apparently rather quickly,

to adjacent cable trays and along those

trays to the enclosure boundaries.

The propagation of fire took place rather

rapidly.

A hot gas layer forms

within the

compartment of origin

(if conditions may

allow)

No information avaiable

Effects of fire (i.e., hot

gas and smoke)

propagate to an

adjacent compartment

(if pathways exist)

Smoke filled the compartments rapidly

and propagated to adjacent rooms

including the main control room for

Unit 1. Fire also spread to these

adjacent compartments, most likely

through poorly sealed cable

penetrations.

This room-to-room spread can be largely

attributed to missing or poor cable

penetration seals, and open doors and

hatchways. This condition would not be

typical of a U.S. plant as significant

regulatory attention is paid to the quality

and integrity of fire barriers. In a typical

fire PRA the possibility of fire propagation

through fire doors and penetration is

assumed to be very unlikely. The quality of

penetrations is commonly verified during

walkdowns conducted as part of fire PRA

preparation. 
Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

A7-14

Local automatic fire

detector (if present)

senses the presence of

the fire

Local automatic fire detectors sensed

the presence of fire within 1 minute.

These systems operated quickly and as

designed and would be credited in a fire

PRA.

Alarm is sounded

automatically in the

control room, locally

and / or other places

Fire detector alarms sound in both the

Control Room of Unit 1 and Central

Control Room

Automatic suppression

system is activated (if

present)

An automatic fixed foam suppression

system was installed in the areas of

fire. The system did not activate

because the control setting was on

manual and the control circuit became

damaged by the fire.

The mis-positioned control switch would

perhaps be detected during plant

walkdowns as a part of the PRA. However,

the control and power cables for automatic

suppression systems are usually not traced. 

This event points that those systems that

require control and power circuits may

become unavailable from the fire itself. 

This also impacts methods that credit

manual recovery of a failed suppression

system (e.g., the EPRI Fire PRA

Implementation Guide).

Personnel are present

in the area where fire

occurs

There were no personnel in the areas

where fire ignited.

Control room is

contacted or fire alarm

is sounded

The control room became aware of the

fire within one minute of ignition

through fire detectors.

Fire brigade is

activated

The plant fire brigade was called

within 5 minutes of ignition. The

external fire brigade was not

immediately called because telephone

connection to the off-site .

Most fire PRAs for US plants assume fires

will be handled by the on-site fire brigade. 

The potential problems with notification of

an off-site brigade would likely not be

considered.

Fire suppressant

medium is properly

applied

The procedures for fighting electrical

fires stipulated that no fire fighting

activity can be initiated inside a

compartment that contains electrical

equipment or cables and is darkened

by smoke until the power is turned off

from those cables and equipment. The

brigade, therefore, delayed initiation of

fire fighting activities until about

10:15, or 20 minutes after fire

ignition. Water hoses were used to

fight the fire. 

In a fire PRA it is generally assumed that

fire fighting activities begin as soon as the

fire brigade is assembled. This event points

out that other circumstances may delay the

fire fighting actions.
Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

A7-15

Fire suppressant

medium is properly

applied to where the

fire is.

The fire brigades applied water

streams from various angles, including

through a hatch inside the control

room.

The fire brigade did apply the water

stream properly. However, because the

electrical circuits remained energized,

some of the circuits, at about

12:10p.m., experienced short circuits. 

Some of the short circuits led to

secondary fires in other parts of the

plant. The mechanical impact of the

water stream is cited as causing short

circuits in the control cables related to

the turbine-generators. As a result,

generator G-2 was re-connected to the

off-site grid and leading to a severe

secondary fire. There was also a

secondary fire and explosion at a

transformer.

This event is evidence of the spurious

actuation of equipment (re-connection of

the generator to the grid). However, the

details of exactly how the actuations took

place is not known.

The use of water was also cited as a

contributing factor in some of the short

circuits, but how this was determined is not

clear. Given the severity of the fire, many

short circuits would be anticipated in any

case.

Fire is affected by the

suppression medium

The fire was ultimately brought under

control, but only after an extended

time.

There is no indication that ineffective fire

fighting methods were attempted.

Fire growth is checked

and no additional

failures occur

The fire was eventually brought under

control at about 16:00, nearly eight

hours after ignition.

The fire burned longer than fires typically

postulated in a fire PRA. However, the

ready spread of fire from room-to-room

certainly contributed to the extended fire

duration and complicated fire fighting

activities.

Fire is fully

extinguished and fire

brigade declares it as

out

The fire started at 09:55 and it took

the fire brigade until 16:00 to control

the fire and 16:58 to declare the fire as

completely extinguished for a total

duration of about nine hours. 

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

Extensive damage occurred to cables

in the compartments where fire was

initiated.

Cable failure impacts

equipment outside the

fire compartment

A large set of equipment was lost

because of the fire. By 12:45 the

control over Unit 1 was completely

lost. The Unit experienced a station

blackout. For some time all active

core cooling functions were lost

though natural circulation remained

available throughout the incident.

Given the lack of redundant train

separation, and lack of quality fire barriers,

the potential extent of systems loss would

have likely been identified in a fire PRA.
Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

A7-16

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

Both units shut down because of the

fire. Emergency core cooling systems

were activated. This may have

occurred because of a short. Unit 1 did

loose all active cooling functions, but

core cooling remained available via

natural circulation provided by the

large capacity of the steam generators.

Several spurious actuations are

specifically noted in this incident. 

Both generators connected to the grid,

on diesel generator disconnected from

its emergency loads, and one main

feedwater pump was activated without

initiating the lubricating oil system. 

This is attributed in the available reports to

inaccurate reading of the reactor core

conditions. Neutron flux and other reactor

related instrumentation indicated

conditions that may not have been the

actual conditions of the reactor). This was

likely because many of the instrument

cables were degraded and/or failed by the

fire. Instrumentation faults leading to

automatic actuations are not typically

considered in fire PRAs.

This illustrates that inadvertent actuation

of a system is possible from a fire

impacting control cables. However, there

are no indication about the specific nature

of circuit failures. 

Operators in the

control room receive

messages and respond

to the information

displayed on the

control boar d or

received verbally from

the plant

Control room operators attempted to

control the core cooling and reactivity

control systems. They remained inside

the control room the entire length of

the fire event. Smoke and fire effects

in the control apparently did hamper

operator performance. 

This event points out that the operators

may remain active under extremely adverse

conditions. In this case the control room

was directly affected by the fire through the

cable shaft and by the presence of smoke.

In a typical PRA it is assumed that if the

control room is filled with smoke, the

operators become incapable of acting

properly from the control room.

Operators attempt to

control the plant

properly and bring the

plant to a safe

shutdown

Control of the reactor from the control

room was lost. Recovery was achieved

when a temporary cable was pulled

from the diesel generator building to

an emergency core cooling pump 

Power to the pump was restored and

core cooling was resumed at about

15:13 hour, just over seven hours after

the fire started.

Recovery actions in a fire PRA do not

generally include actions outside those

cited in written procedures. This incident,

similar to the Browns Ferry and several

other incidents, points out that the

operators can be very innovative in

devising methods to provide power and

core cooling and reactor control functions.

Structural failures (if

occurred) may

jeopardize availability

of equipment.

No information

Water when sprayed

over electrical

equipment may fail the

exposed equipment

The reports do attribute some cable

shorts and one spurious actuation to

the water spray from hoses and the

resulting movement of the cables.

The basis for this assertion must be

questioned. Given the fire severity, many

short circuits would be expected, and there

is no clear way to assure that the water

hose streams were actually responsible for

the observed faults.
Fire Scenario

Element/Issue

Incident - ANPP, Oct. 15, 1982 Fire PRA Insights

A7-17

The cooling effect of

CO2 may adversely

impact equipment

Not applicable.

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

The automatic foam system was

switched to manual at the time of the

fire preventing it from actuating

automatically.

See discussions above.

A7.5 Incident Analysis

The ANPP incident is considered one of the most severe fire accidents of the nuclear power

industry both in classical fire protection terms and in the context of nuclear safety. The fire itself

was severe and spread to several plant areas. All of the safety related systems for Unit 1 were

disabled for several hours. Core damage on Unit 1 was prevented because the steam generators

had the capacity to absorb reactor heat for several hours through natural circulation. This allowed

plant personnel sufficient time to run temporary power cables from the diesel generator building

to a high pressure injection pump motor in order to recover active cooling functions.

The root cause of the event is attributed in the available reports in part to human error in that the

operator apparently failed to follow proper procedures in his attempts to start a pump. However,

from the information available at this time the exact set of errors cannot be specifically identified. 

The reports also state that the ignition was caused by a short circuit in a 6 kV power system and

failure of the protective devices to function properly. In addition, the apparently poor fire

resistance characteristics of the cables and lack of separation between redundant trains allowed

the fire to propagate rapidly and disable a number of important plant systems. Finally, the lack of

quality fire barriers allowed the fire to propagate from room-to-room complicating fire fighting

efforts and causing further damage.

The event also demonstrates that self-ignited cable fires are possible. In fact, in this case, the

main cause for cable ignition was not attributed to cable damage or degradation (as is seen in

other events in Soviet-designed reactor sites), but simple overloading of the cable. Reports

estimate that the cable were subjected to more than 10 kA fault current. Presumably, due to the

high energy potential (voltage and current) of the cables, and the flammability characteristics of

the cables, the fire established itself rapidly in two separate compartments and propagated to other

cables and cables trays, including cables inside metal boxes (probably either junction boxes or

enclosed raceways).

In a fire PRA, fire propagation timing is estimated using mathematical models of the burning

process. These models typically predict tray-to-tray fire propagation times for multiple tray

configurations on the order of several tens of minutes. In this incident, however, propagation

took place much more rapidly than what is typically predicted. Factors that contributed to the

rapid fire spread likely include a relatively poor fire performance of the cables themselves and the
A7-18

fact that a high energy electrical discharge along the length of the cable was probably occurring. 

The characteristics of the cables at ANPP are presumed to be significantly different from those

typically found in a nuclear power plant in the U.S. In particular, since 1974 the U.S. industry has

applied the flammability standards of IEEE-383. Therefore, a direct comparison to U.S. plants

may not be appropriate.

This event also demonstrates that multiple fires in different compartments may occur

simultaneously. In this case the initial fire started in two different compartments and at several

points within each compartment. In fire PRAs, simultaneous occurrence of fire ignition at several

points is not postulated.

Severe secondary fires involving turbine generator lube oil and one transformer in the turbine

building were also experienced. The turbine fire was apparently caused when a cable fault

spuriously re-connected the generator to the off-site power grid leading to failure and an oil spill. 

The transformer fire was also apparently caused by cable faults leading to an explosion of the

transformer and release of the transformer oil. Fire PRAs universally assume that only one fire

occurs at a time.

In a typical fire PRA it is assumed that hatches, cable penetrations and fire doors are properly

designed and installed. This is verified in most PRAs as a part of the plant walkdowns. At most,

a random failure probability (on the order of 0.01 per demand) is assumed to reflect the possibility

of a barrier being degraded at the time of a fire. Therefore, the possibility of fire spread through

hatches, cable penetrations and fire doors is assumed to be of very low probability and is typically

found to be risk insignificant. This incident demonstrates that if these devices are not properly

installed and maintained, in case of a fire, smoke ingress, and perhaps fire propagation to an

adjacent compartment should be expected. The experience at ANPP is not considered typical of

U.S. plants because significant regulatory attention has been paid to ensuring the presence, quality

and integrity of fire barriers in the U.S.

The propagation of smoke and its impact on plant personnel is typically addressed in PRA using

conservative and simplified models. If it is concluded that smoke may enter a certain

compartment, no operator actions in that compartment would be credited. In this incident, smoke

did enter the control room and did have some impact on the operators. Nonetheless, the

operators, despite the smoke and ongoing fire fighting activities, remained inside the control room

and remained functional.

Furthermore, in a typical PRA, recovery actions that are beyond the established and written

procedures are generally assumed to be very unlikely and of low reliability. In this incident, core

damage was averted because operators acted outside of their procedures and routed a temporary

cable between a diesel generator and the motor of a high pressure injection pump. At the point

where significant smoke had entered the control room, a typical fire PRA would have assumed

control room abandonment. Subsequent to abandonment only procedure-based actions that were

possible outside the fire effected areas would have been credited. In this case that would have

almost certainly imply a very high conditional core damage probability.
A7-19

The routing of power and control cables for the fire protection systems is generally not

established when conducting a fire PRA. Loss of a fire protection system because of the fire itself

is seldom considered. This incident demonstrates that the fire suppression system may be lost due

to the fire itself. Also, in a typical PRA, the unavailability of automatic suppression system is

taken to range from 0.02 to 0.05 per demand (2-5% failure rate). It is not clear whether this

unavailability includes the possibility of the system being left in the manual actuation mode by the

operators or maintenance crew, as was the case in this incident.

Fire fighting activities were delayed by about 10 minutes because of procedural requirements to

de-energize electrical equipment before entering a fire area containing electrical cables and

equipment. In a fire PRA, the timing of fire brigade actions is typically based on the time that it

takes for the brigade to arrive on the scene, ready with equipment. Delays in initiating fire

fighting activities because of procedural requirements are not generally considered in a fire PRA. 

This incident also reiterates that it is possible to have a fire duration on the order of several hours.

The impact of water, and especially mechanical impact of water, on cables and the potential that

this might lead to electrical shorts is not considered in a typical fire PRA. In this incident, shorts

attributed to the hose streams occurred more than 2 hours after the ignition of fire. The basis for

the assertion that the hose streams caused the problems must, however, be questioned. Given the

severity and duration of the fire many short circuits would be expected in any case. Regardless of

the cause, these shorts caused secondary fires. Such fires are not modeled in a fire PRA as noted

above. In this incident, the secondary fire was also very severe and caused significant damage to

the turbine building and contributed to the loss of offsite power. Furthermore, with the loss of the

start-up transformer in addition to the generator oil fire, this incident demonstrates that secondary

fires may occur at more than one location and can have catastrophic impact on equipment.

During this incident four apparent spurious actuation events were noted. In one, breakers

spuriously actuated (closed) connecting both of the turbine generators to the power grid. The

generators subsequently operated as motors causing further damage and secondary fires involving

one of the generators. In the second, a main feedwater pump spuriously actuated apparently due

to faults in the associated control cables. The fault bypassed the normal start logic, and allowed

the pump to run without the associated lube oil pumps also running. The fault also bypassed or

defeated the control room start/stop controls and attempts to stop the pump from the control

room failed. The pump was shut down by electrical technicians who de-energized power from a

local power bus. In the third case, a cable fault caused breakers for one of the diesel generators

to open disconnecting the generator from its emergency loads. Attempts to recover the loads

failed. The fourth case is associated with faults in the control room instrumentation circuits. 

Reports cite that instrumentation readings received in the control room were suspect (neutron

capacity, neutron flux period and status of certain power busses). These false readings are cited

as the cause for initiation of a Type I Emergency Protection Signal, apparently earlier in the

shutdown sequence than would normally be expected (see note 3 at the end of the table in Section

A7.3).

In each of the above cited spurious actuation events, there are no indications in the accident

investigation reports about the specific nature of the cable failures that might have led to the
A7-20

observed system behaviors. The problems appear to be primarily associated with control and

instrument cables, rather than power cables. In particular, a spurious pump start might result

from cable-to-cable hot shorts in the power cables. However, in the case of the spurious

feedwater pump start, the electrical technicians stopped the pump by isolating it from its power

source. Because the pump did stop when its power source was cut, this implies no other power

source was involved, and one can thereby infer that it was a control circuit fault that led to the

actuation. In fire PRAs the treatment of spurious actuations due to cable faults is a current area

of methodological debate. In particular, the likelihood that multiple spurious operations might be

observed in a single incident remains a point of debate. This event and the Browns Ferry (1975)

fire are the only two incidents identified in this review (or known to the authors) where there are

clear indications that multiple spurious actuations did occur as a result of cable failures. For

further discussion of spurious actuations in fire PRA, see the body of the report (Section 4.4.1).

A7.6 References

A7-1 Heikki Aulamo, Jouko Martilla and Heikki Reponen, “The Full Stories on Aremenia and

Beloyarsk”, Nuclear Engineering International, July 1995.

A7-2 Correspondence between Mardy Kazarians and Ms. Marika Sarkisova of Armenian

Nuclear Regulatory Agency, 1999.

A7-3 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A7-4 Soloviev.P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A7-5 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A7-6 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.
A8-1

Appendix 8 - Analysis of Rancho Seco Fire on March 19, 1984

A8.1 Plant Description

Rancho Seco was a 913 MWe Babcock and Wilcox design, pressurized water reactor located

near Clay Station, California. The plant started commercial operation in April, 1975 and was

permanently shut down in 1989. [Ref. A8-2].

A8.2 Chain of Events Summary

The plant was operating at 85% power on March 19, 1984 and had been experiencing problems

with the automatic level control of the de-foaming tank and hydrogen side drain regulator tank of

the main generator. The drain regulator tank level control was switched to manual mode,

requiring direct operator level control. Operators apparently failed to provide adequate attention

to level control and this allowed the main generator seal oil pressure to decrease. This in turn

allowed hydrogen to escape from the generator. At 21:50 hydrogen gas exploded and started a

fire (Reference [A8-1]). 

The fire was detected immediately by plant personnel in the area. It was extinguished by the fixed

automatic carbon dioxide system within 14 minutes. Nonetheless, significant damage was

observed due to the fire. The fire damage happened in a relatively short time frame and is

attributed primarily to the initial explosion and early burning.

A8.3 Incident Analysis

This fire is one of few turbine building fire incidents in the U.S. that has caused significant

damage. The incident demonstrates the unique nature of the turbine building fire hazards, in this

case a hydrogen gas leak and explosion, and the potential for fast developing fires that may cause

damage despite effective operation of fire suppression systems. Fire PRAs do consider the risk

contribution of turbine building fires. However, this incident illustrates that some special attention

to more severe fires than might be reasonably postulated in other plant areas may be warranted for

turbine building analyses. In this particular incident, the impact on plant operations and safety

systems was apparently minimal, but the operation impact potential is a plant specific factor. That

is, the presence (or absence) of safety significant equipment in the turbine building is plant

specific.

In several of the other incidents reviewed here gaseous suppression agents have proven ineffective

at extinguishing fires effectively. In particular, hand-held gaseous (CO2) fire extinguishers have

been used unsuccessfully to fight a number of fires (e.g., Waterford 1995, Browns Ferry 1975). 

In this case, the system was a fixed gaseous discharge system that functioned as designed and

suppressed the fire rather quickly. It would appear that the system intervened before the fire

could spread to any other fuels (such as cables). More extensive damage would likely have

occurred without the quick response of this system.
A8-2

A8.4 References

A8-1 W. Wheelis, , "User's Guide for a Personnel Computer Based Nuclear Power Plant Fire

Data Base," NUREG/CR-4586, SNL/USNRC, August 1986. 

A8-2 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A9-1

Appendix 9 - Analysis of South Ukraine, Unit 2 Fire on December 15, 1984

A9.1 Plant Characteristics

The South Ukraine Nuclear Power Plant (SUNPP) is located near Nikolaiev, Ukraine.[A9-4] The

site has three operating units and a fourth unit “under construction.”

[A9-5] Each unit is a VVER

1000 type reactor. At the time of the fire, Ukraine was a part of the former Soviet Union. Unit 2

was in the last stages of construction when a fire inside the containment destroyed a large quantity

of cables. Fresh fuel was loaded and the main vessel was closed off, but the reactor had not been

activated at the time of the incident.

A9.2 Chain of Events Summary

On December 14, 1984, at 07:55 the operators for Unit 2 started to pressurize the containment in

order to test its integrity and leak-tightness.[A9-1,2] On December 15, at 04:30, the containment

was at an over-pressure of about 0.36 mPa. 

At 09:00, operators noticed that one train of temperature instrumentation was not working. The

temperature instrumentation trains were inspected outside the containment and no damage was

noticed. At 10:47, the status of the pressurizer heaters was investigated. It was discovered that

there was no resistance on power feed to 17 out of 28 heaters. 

At about 11:40, plant personnel were checking electrical panels and noticed that several relay

coils had caught fire. At the same time, plant personnel noticed that the pressure in the

containment had increased from 0.36 to 0.38 mPa and no external causes could be identified for

this phenomenon. The plant manager ordered the pressure in the containment to be dropped, and

called out the fire brigade, surmising that the pressure rise may have been due to a fire inside the

containment. 

At 12:00, operators started to reduce the containment pressure using a 300 mm (approximately

12") diameter pipe specifically designed for this purpose. Operators noticed a burning smell and

observed smoke in the air coming from the containment. However, the fire detector panel did not

indicate the presence of fire inside the containment. Regardless of this observation, the plant

personnel started setting up hoses to fight a fire.

At 12:10, the fire brigade arrived on the scene. On the control panels of 1st and 2nd safety trains

operators noticed that containment pressure was not indicated properly. This was attributed to a 

short in the associated instrumentation circuit. The indicators on the panel for the 3rd safety train

were not operating because of a “burned out” fuse (possibly another fire-induced fault but not

clearly established in the reports). 

At 13:20, the pressure in the containment reached atmospheric level. Plant personnel and fire

brigade members entered the containment and discovered a fire in compartment A305/I,2. They

attacked and suppressed the fire almost immediately.
A9-2

At 13:45, the fire annunciator panel was realigned to properly indicate fire conditions. About this

time, operators also noticed that the temperature in containment compartments A-503/I and A505/I had reached 150oC. An automatic suppression system apparently providing coverage for

these areas was not functional at that time (it was switched to “manual” mode). Hence, the two

compartments were approached by fire fighters with fire hoses.

At 17:00, all of the compartments where fires had occurred were inspected and the fire was

declared as extinguished. The actual fire initiation time is not known. Most likely it started

between 04:30 and 09:00 on December 15th. It was determined that the fire started inside

containment in the cable tunnel for the second safety train. At 09:00, the first indications of

abnormalities were noted. Assuming ignition at or shortly before 09:00, the fire duration was

then approximately 10 hours. 

The factors that influenced the occurrence and propagation of the fire were determined to be as

follows (as cited in the available reports):

S The power cables passing through the containment penetrations were energized and

powering the pressurizer heaters.

S Pressurization of the containment caused the wires inside the penetration to move and

touch off a short circuit.

S Penetrations included un-isolated (un-insulated) wires or electrical feeds-throughs,

S At the time of the incident, the penetration area was wet; thus, causing a short between

open wires.

S Pressurization increased the oxygen concentration (partial pressure) in the containment

S Arcing from cable to cable ignited a fire in compartment A305/2.

S Hot gases escaped into A305/1 from A305/2 through an opening between the two

compartments and started the fire there.

S Long exposure to hot gases and flames damaged the seal in the ceiling at 22.8m elevation

and allowed propagation of the fire to 2nd safety train cables in the upper elevation. This

caused the fire to propagate into the cable shafts of the reactor building and the annulus at

32m elevation.

A9.3 Incident Analysis

The precise causes for fire ignition and extensive spread is not known. It is postulated that the

fire started in an electrical penetration. In particular, it is suspected that pressurization of the

containment caused the wires inside the penetration to move causing a short circuit and,

presumably, an overload. Moisture in the area of the penetration may also have been a factor. 

Available reports state that the fire apparently started because of poor cable conditions and the

mechanical damage that the cables had sustained inside the penetrations.

This conclusion is supported by observations made by plant personnel prior to the actual fire. 

That is, before this fire incident, a series of events and conditions were observed that can be

regarded as pre-cursors to fire ignition. For example, arcing was noticed among cables in a cable

tray. In another case evidence of severe heating was noticed in the cables. Therefore, it can be
A9-3

concluded that pressurization of the containment was merely the “trigger action” that caused preexisting cable damage to be manifested as a fire. In any case, it would appear that short circuits in

or near the penetration assembly led to cable current overloads and a self-ignited cable fire. In a

typical fire PRA, such specific conditions leading to fire ignition are not modeled explicitly. 

Rather, the likelihood of fire ignition is established from statistical analysis of similar incidents in

nuclear power plants across the industry. The specific conditions of a plant, at least at this level

of detail, are seldom taken into account in estimating fire ignition frequencies. In a fundamental

sense, the current PRA practice would capture the potential for self-ignited cable fires, albeit, the

specific mechanism leading to onset of the fire would not be modeled.

With regard to detection, the detection mode in this fire incident is interesting. The fire detection

system apparently had apparently been disabled in some manner or had an inherent deficiency. 

Operators correctly suspected a fire inside the containment based on the rising pressure and other

observations. This can be cited as a rather astute observation on the part of the plant operators. 

Had the containment not been under pressure, manual fire brigade response would not have been

delayed as long, and it is likely that the fire would not have progressed as far as it ultimately did.

The existence of the fire was verified only after depressurization started (based on the presence of

smoke and odors in the exhaust stream). In fire PRA, the fire detection system is generally

analyzed using industry-wide generic unreliability numbers. Special conditions that may lead to

failure of the detectors to properly recognize the presence of fire may get addressed during a plant

walkdown. However, current fire PRA methodology documents do not provide well defined

guidance on how to determine conditions under which detectors may fail.

This is one of few major fire incidents that occurred inside containment. In fire PRAs it is

generally assumed that containment fires are not risk significant. Containment structures are

commonly screened with minimal detail in the early stages of a fire analysis. This incident neither

negates nor supports that assumption from an operational perspective. It does, however,

demonstrate that it is possible to experience a severe fire inside containment. Hence, some

additional attention to screening bases for the containment may be appropriate.

The fire propagated via cables into cable shafts and the annulus. Hot gases had escaped from the

compartment where the fire is presumed to have started through an opening into an adjacent room

and started a fire there as well. Long exposure to hot gases and flames had also damaged a seal in

the ceiling allowing the propagation of fire to a compartment at an upper elevation. An important

insight from this incident is that the spread of fire to certain of the adjacent compartments was

apparently caused by the spread of hot gases alone. Apparently, no direct paths for fire (flame)

spread were identified that could have allowed fire spread into certain of the fire compartments. 

It is postulated in this review that fire-induced failure of energized cables due to the hot gas

exposure may have provided the ignition source. This is conjecture, but is consistent with

observations made during small-scale fire testing by Sandia National Laboratories.[A9-3] In fire

PRAs, the possibility of propagation to other compartments is deemed to be unlikely unless large

quantity of combustibles are present in direct proximity to a propagation path (such as a cable tray

penetrating a fire barrier). This incident appears to show that cable fires can generate sufficient

heat to propagate fire to adjacent spaces without a direct path for flame spread along a continuous
A9-4

fuel element. It must be noted that the combustion characteristics and qualification testing

standards of the cables in Soviet-designed plants are not known to the authors of this report. It is

possible that they are quite different from the U.S. cables and therefore, extrapolation of the

conclusions from this incident to U.S. plants should be done with caution.

In this incident the fire suppressions system was switched to the manual mode and did not actuate. 

Had the system actuated early in the fire it is quite likely that the fire damage would have been

much more limited. The system was never actuated during the incident, but the available

information does not indicate the reasons for the operators not activating the systems manually. 

This either indicates the system was totally inoperable at the time of the fire, was rendered

inoperable by the fire, or an error of omission on the part of the operators and fire fighters. It is

reasonable to assume that while waiting for the containment to de-pressurize, fire fighters would

have checked the status of the containment fire suppression systems. However, no clear

discussion of this is provided in any of the available reports. Even late actuation of the

suppression system would have likely reduced fire damage.

The observation of burning relays in panels outside containment indicates that shorts occurred in

the power and/or control cables and caused the relay coils to overheat and catch fire. This can be

regarded as simultaneous and/or secondary fires, albeit, in this case these secondary fires did not

propagate. Fire PRAs do not consider multiple concurrent fires. This incident demonstrates the

possibility of such incidents.

This incident is considered a severe fire because a large area of the plant was affected. More than

16 km of cables were burned in this fire. Ultimately, multiple safety trains were affected. If the

plant had been in operation at the time of the fire, such a fire could have caused a severe safety

concern.

It should also be noted that since the time of this fire, a number of plant improvements have been

made. In particular, in cooperation with the U.S. Department of Energy (DOE), efforts are

underway to improve “the safety of day-to-day operations at the plant. DOE projects are

supporting the development of full-scope simulators to enhance operator training (1995-ongoing),

performing in-depth safety assessments (1995-ongoing), and providing safety parameter display

systems (1996-ongoing).”

[A9-5]

A9.4 References

A9-1 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A9-2 Soloviev.P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A9-3 Nowlen, S.P., An Investigation of the Effects of Thermal Aging on the Fire

Damageability of Electric Cables, NUREG/CR-5546, USNRC, May 1991.

A9-4 1999 World Nuclear Industry Handbook, Nucl. Eng. Int., 1999.
A9-5

A9-5 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.

A10-1

Appendix 10 - Analysis of Zaporizhzhya, Unit 1 Fire on January 27, 1984

A10.1 Plant Characteristics

Zaporizhzhya is a six unit nuclear power plant site located near Energodar, Ukraine.[A10-4,5] All six

units are of the VVER-1000 design. At the time of the fire described here, Ukraine was a part of

the former Soviet Union. Plant construction on Unit 1, begun in 1980, was in its last stages when

a severe cable fire occurred on January 27, 1984. As a result, the plant’s initial operations were

delayed until late 1984 (November[A10-4] or December[A10-5]). The plant began commercial

operations in April 1985.[A10-4] At the time of the fire, some of the cable penetration seals were

not installed yet, and there were other penetration seals that had been reopened for inspection. 

The other units at the site began operations between 1985 and 1995.

A10.2 Chain of Events Summary

On January 27, 1984, Unit 1 was in the last stages of construction and apparently the reactor was

not activated yet. At 17:15, a fire was reported at elevation 13.2m of the Control Building. It

was later postulated that a failure in the terminal box No. 114 had caused the fire. The features of

the box and the nature of the initiating fault are not clear from the available information. The

reports postulate that a loose item had fallen into the box.

The fire propagated via cables coming out of the terminal box and into a cable shaft where it

started to burn its way up the cable risers. The fire eventually spread through practically all

elevations of the control building. In response to the fire, the operators tripped the electrical

system, including the DC power system.

All attempts to put the fire out in the initial stages failed. Two operators even tried to crawl

under the smoke and approach the fire with hand held extinguishers, but they had to pull back

because of the heavy smoke. Plant personnel and off-site fire brigades were summoned to

support fire suppression efforts. Using a stairwell for positioning themselves, the fire brigade

sprayed water at different points of the Control Building. However, since the fire brigade

personnel were not familiar with the building layout, and because of the heavy smoke in the

building, they were ineffective at fighting the fire in some locations, and the fire continued to

propagate. In the end, over 115 fire fighters participated in the fire fighting effort.

Until 19:25, about 2 hours after ignition, the fire had remained confined to the cable shaft. At this

point fire barriers failed and the fire propagated into areas adjacent to the cable shaft on four

separate elevations (16.0, 19.0, 21.0 and 24.0 m). At elevation 16.0 the deluge system was

activated (it is not clear whether this was done manually or automatically) and that controlled the

fire on that level. The fire on elevation 20.0 m was stopped by the sprinkler system on that level. 

Although by 21:00 the fire at elevation 16.0 was declared extinguished, the fire continued to

propagate to elevations 19.0 m and 24.0 m. On elevation 19.0 m, the fire was stopped by a

sprinkler system. Despite the impact of fixed suppression systems at different elevations, the fire

continued to propagate and by 21:40 it reached elevations 28.3 m and 41.0 m.
A10-2

At 24:00 the fire was declared as out and the fire pump was stopped. However, at 01:15 on

January 18, plant personnel noticed a cable fire at the 20.4 m elevation. This was apparently a reignition of the previously suppressed fire on this level. The fire pump was restarted and fire water

was sprayed inside the impacted cable shafts and in cable chase areas. The fire fighting continued

for another 11 hours and finally after more than 17 hours from the discovery of the fire, the fire

was declared as completely extinguished.

A10.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (References [A10-1] and [A10-2]). If the precise timing and

the order of an event is not known, the time of occurrence is not specified. However, it is

included at an order of presentation based on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

On January 27 1984, Unit 1 was in the last

stages of construction. Some of the cable

penetration seals were not installed yet and

there were other penetration seals that were

reopened for inspection. At this stage of

construction, the automatic fire suppression

system and fire detectors inside cable trays

and cable shafts were not yet activated. The

dry-pipes of the deluge system for cable

trays and cable shafts were temporarily

connected to a fire water system that

required manual activation.

Construction often presents unique fire hazards and

construction phase fires are often discounted in fire

PRAs. In this case, the fire appears to offer

valuable lessons despite the fact that the plant was

still under construction. It does not appear that the

fact that construction was ongoing had a significant

impact on the fire’s progression. In particular, it

would appear that despite reports of incomplete fire

barrier penetration seals, the fire did remain

confined to the initially impacted cable shaft for two

hours or more before spreading to adjacent areas.

00:00 At 17:15, a fire was observed at elevation

13.2 m of the control building. It had

started in or near terminal boxes No. 112

and 114. As a result of incident

investigation, it was concluded that the fire

may have been caused by a short in 112-114

terminal box at elevation 13.2m. The short

circuit may have started in a cable (it was

suspected that something had dropped

inside the terminal box). 

This event can be classified as a self ignited cable

fire. In fire PRAs for U.S. plants, the possibility of

occurrence of self ignited cable fire is considered to

be very unlikely. It is also interesting that the

reports cite that the fault likely started inside the

box and that the fire propagated to the cables

outside the box. However, the condition of the cable

penetrations into the terminal box are not known.

-- The fire propagated into a cable shaft Vertical cable risers are recognized as a potential

fire hazard in fire PRAs.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A10-3

-- As soon as the shift supervisor received

news about the fire, he ordered the control

room operators to initiate isolation of

electrical devices.

Plants in the former Soviet Union typically require

by procedure that power be isolated before fire

fighters attack fires in electrical equipment. Since

the plant was not in operation this likely had little

or no real impact.

00:20 At about 17:35, a supervisor and his

assistant crawled under the smoke towards

the fire on elevation 13.2m and tried to

extinguish the fire with hand held

extinguishers. Their attempts were futile. 

Because of the heavy smoke, they had to

retreat to safety. 

In this case, the fire brigade had already been

notified of the fire and called out. Hence, the

attempts by operators to extinguish the fire would

not have delayed the later response by trained fire

fighters. However, the event illustrates that early

intervention by un-trained or ill-equipped personnel

may not be successful.

00:23 At 17:38 fire brigade arrived at the plant. In a U.S. plant the primary fire brigade is on site,

and a more rapid response would typically be

assumed.

-- A fire pump was started manually.

00:45 By 18:00, using the stairwell for positioning

themselves, the fire brigade sprayed water at

different points of the control building. 

However, since the fire brigade personnel

were not familiar with building layout and

because of the heavy smoke in the building,

they failed to be effective and fire continued

to propagate. 

At this time fire fighting was taking place

from the cable spreading room for the 3rd

train, half of the 2nd train cable shafts and

the 2nd train cable spreading room. 

01:45 Until about 19:00, the fire fighting activities

were neither systematic nor effective. It is

stated in one report that the fire fighters

often did not know whether the water they

were spraying was directed at the fire or

not. 

The potential for fire fighters to spray water

indiscriminately is recognized, but typically

discounted in fire PRAs. Such behavior could lead

to collateral damage to electrical equipment. In this

case, a lack of adequate pre-fire planning and lack

of fire brigade coordination were clearly

contributing factors. The fact that primary fire

brigades in US plants are made up of plant

personnel would reduce the likelihood of similar

behavior in the event of a fire.

02:10 Starting 19:25, plant personnel started from

the lower elevations systematically looking

for actual fires, so that fire fighting

activities would be focused on actual fires.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A10-4

02:10 Until 19:25, the fire remained confined to

the cable shaft and affected the cables there

up to elevation 16.3 m. However, at this

point propagation to adjacent areas

apparently began. 

Fire resistant construction of the cable shaft

boundaries was the main reason for the fire to

remain confined up to this point. Despite reports of

incomplete barrier seals, the fire did apparently

remained confined for up to two hours.

-- At elevation 13.2, the fire brigade fought

the fire manually. At elevation 16.0 the

deluge system was activated and that

controlled the fire.

02:15 By 19:30, the fire resistant barriers of the

cable shaft failed and the fire propagated

into new areas. It was discovered that the

fire had propagated to elevation 20.0 m

where it was stopped by the sprinkler

system. 

This is a case where a fire barrier may have been

overwhelmed by the fire. In fire PRAs for U.S.

plants it is common to assume that fire barriers will

last for their full fire duration rating (typically three

hours) and that fire of a duration that would exceed

the rating are very low likelihood.

02:25 At 19:40, the chief engineer ordered the

operators to trip 6kV boards BA, BB and

BD (associated with safety trains 1 and 2)

from the control room. 

02:45 At 20:00 plant personnel tripped the

electrical system, including the DC power

system at elevation 41:00m.

03:45 By 21:00, the fire at elevation 16.0 was

declared extinguished. 

03:45 By 21:00 (approximately), the fire

propagated to elevations 19.0m and 24.0m

of the Control Building. On elevation

19.0m, the fire was stopped by the sprinkler

system on that floor.

04:25 By 21:40 the fire propagated to elevations

28.3m and 41.0m of the Control Building. 

06:45 At 24:00 the fires were declared out and the

fire pump was stopped. 

08:00 At 01:15 on January 18, 1st and 2nd safety

trains were lost.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A10-5

08:00 At 01:15, plant personnel noticed cable fire

at 20.4 m elevation. The fire pump was

restarted. Water was sprayed inside the

cable shafts and in cable chase areas. The

power system was tripped.

This is one of the few incidents where fire re-flash

well after initial extinguishment has been reported

(some cases of re-flash immediately following

suppression attempts have been reported). The

main cause of the re-flash is postulated to be deep

seated fire in the cable bundles that got exposed to

fresh air. The possibility of re-flash is not

considered in a fire PRA, however, given the

apparent rarity of such events this may not be a

significant oversight.

17:50 The fire was finally declared as completely

out by 11:10 on January 18, 1999. More

than 115 fire fighters were involved in this

effort.

Equipment Damaged:

S An electrical junction box (source of the fire)

S Large quantity of electrical cables

Damaged Areas

S Cable shafts and a large area of the control building were affected by this fire.

Impact on Core Cooling 

S Safety related equipment was affected by this fire. The plant was in the last stages

of construction. From the available information, it is not clear whether or not core

cooling function was necessary. Had the fire occurred during plant operations, the

impact on plant operations would have been severe.

Radiological Release

S No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

S There were no reported injuries to plant or external fire brigade personnel caused

by the fire.

Public Impact

S The health and safety of the public was not affected by the fire or its impact on the

plant.

Environmental Impact

S There were no radiological releases, contamination or any other environmental

impact other than the smoke release into the atmosphere.
A10-6

A10.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events of the fire incident is compared to the elements that make up a

typical PRA fire scenario. Entries are made only if specific information was provided by the

available sources. No attempt was made to postulate a possible progression of the chain of events

no matter how plausible it could be based on the physics of the fire process, unless it was deemed

to be essential in concluding a specific insight.

Fire Scenario

Element/Issue

Incident - Zaporizhzhya,

January 27, 1984

Fire PRA Insights

Presence of combustible /

flammable materials

Cables were the primary sources

of combustible for this fire

incident. Materials in the

initiating junction box also

played a role in very early fire

behavior.

It is claimed that the construction companies

had used non-fire resistant cables and plastic

materials inside the electrical junction boxes

that contributed to the fire. In fire PRA it is

assumed that a plant is constructed per set

specifications. The possibility of

manufacturers’ error in using the wrong

materials is assumed to be very unlikely.

Presence of an ignition

source

A failure or foreign object in the

electrical panel is suspected to

be the main cause for fire

ignition.

This is, in effect, a self ignited cable fire

since there was no external fire exposure

source.

Ignition of the fire and

generation of heat (radiant

and convective), smoke,

and other gases

See above.

Fire growth within the

combustible or component

of original ignition

Fire apparently established itself

quite readily within the junction

box. 

The fire grew outside the initial junction box

and spread via cable entering the top of the

box.

Fire propagates to adjacent

combustibles.

Fire propagated to other cables

and continued to propagate for a

long time..

Fire spread was apparently slow but steady

during the initial growth period though no

specific estimates are available. There is

conflicting information however regarding

how quickly the fire actually spread, in

particular, in the time between 2 and 4 hours

after ignition.

A hot gas layer forms

within the compartment of

origin (if conditions may

allow)

No information is provided

regarding hot gases. However,

given that the fire occurred in

various compartments and cable

shafts, hot gases should have

played an important role in the

propagation of the fire from one

compartment to the other. 

Clearly, a very dense smoke layer did form in

the compartment of fire origin that prevented

initial attempts to attack the fire. Smoke

formation is commonly recognized a

potentially delaying effective fire fighting

activities.
Fire Scenario

Element/Issue

Incident - Zaporizhzhya,

January 27, 1984

Fire PRA Insights

A10-7

Effects of fire (i.e., hot gas

and smoke) propagate to an

adjacent compartment (if

pathways exist)

In part because of incomplete

penetration seals, the fire had

the opportunity to propagate

into other compartments.

Smoke had a major impact on

the fire fighting activities. 

Attempts were made by the

operators to crawl under the

smoke and extinguish the fire. 

But their efforts proved to be

futile. 

Outside fire brigade members,

because they were not familiar

with the plant, had difficulties

in fighting the fire in smokey

condition. 

From the information provided,

it can be inferred that the entire

control building was affected by

smoke.

The actual role of the incomplete

penetrations may be overstated in the

available reports since the fire apparently

remained confined to the initial area for up to

two hours. Some penetrations may have been

overwhelmed by the fire. Fire PRAs

generally consider fires of sufficient intensity

so as to overwhelm a fire barrier as highly

unlikely.

In a fire PRA, smoke movement is not

explicitly modeled. These events

demonstrates it is important to include some

consideration of smoke spread as part of the

fire PRA analysis and include the

propagation paths and their impact on

recovery actions and fire fighting.

Local automatic fire

detectors (if present) sense

the presence of the fire

From available information it is

inferred that fire detectors were

already installed but were not

activated yet.

The fact that the plant was still under

construction was a factor in this event that

would not be typical of an operating plant.

Alarm is sounded

automatically in the control

room, locally and / or other

places

n/a

Automatic suppression

system is activated (if

present)

From the information provided,

it is inferred that fixed

automatic water systems were

present and functional at least

in certain parts of the Control

Building. The sprinkler and

deluge systems controlled the

fire in at least one and possibly

two locations.

Personnel are present in the

area where fire occurs

Personnel were present at all

parts of the plant where fire had

propagated.

This fire was manually detected.
Fire Scenario

Element/Issue

Incident - Zaporizhzhya,

January 27, 1984

Fire PRA Insights

A10-8

Control room is contacted

or fire alarm is sounded

The fire was reported to the

control room promptly upon

discovery, but time of initiation

is uncertain.

Fire brigade is activated Plant and outside fire brigades

were activated to fight this fire. 

A total of 115 fire fighters

participated in this incident.

There was no apparent delays in calling out

the fire brigade.

Fire suppressant medium is

properly applied

Water streams were applied at

several different locations. 

From the available information

it is inferred that the automatic

sprinkler and deluge system at

certain locations were successful

to control the fire for that area.

From one report it appears that fire fighters

were initially spraying water somewhat

indiscriminately and were not certain where

the fire actually was. Such behavior is

commonly considered and dismissed as

unlikely in fire PRAs.

Automatic fire suppression

system is activated

See above

Fire is affected by the

suppression medium

The fires were ultimately

affected by the water systems. It

was brought under control at

several locations and was

declared extinguished by

midnight. However, the fire reflashed and the fire fighters had

to start the fire pump again and

continued to fight the fire until

11:00 the next day, when it was

finally announced as completely

out.

Fire fighting was not very effective

apparently due to uncertainty as to where the

fire actually was (see comments above).

Fire growth is checked and

no additional failures occur

The fire growth could not be

checked for a long time. It was

thought that the fire had been

brought under control at several

points in the path of its growth. 

While fire fighting efforts

seemed to be at least partially

effective, fire growth continued

for several hours. Contributing

factors include combustibility of

the cables, configuration of the

cables (vertical risers) and the

shape and inaccessibility of the

compartments.

This is an incident where despite all the

efforts of the fire fighters, the fire remained

unchecked for a long time. In fire PRAs, the

possibility of a fire lasting for several hours, 

while fire fighting efforts are seemingly

effective, is deemed to be very unlikely. 

That is, it is commonly assumed that once

fire fighting activities begin, the fire will be

quickly brought under control.

 
Fire Scenario

Element/Issue

Incident - Zaporizhzhya,

January 27, 1984

Fire PRA Insights

A10-9

Fire is fully extinguished

and fire brigade declares it

as out

The fire was declared as out at

midnight. However, it reflashed inside a cable shaft. It

took the fire fighters another 11

hours to completely extinguish

the fire.

The possibility of re-flash is not explicitly

modeled in fire PRAs. However, it can be

argued that since the models used are based

on actual fire occurrence data, it empirically

includes the possibility of re-flash. This

event points out that if one were to model fire

suppression in great detail should include the

possibility of re-flash in that model.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire are

affected by the fire.

A large number of cables were

lost. The available information

does not provide sufficient

information about the type of

electrical circuits, equipment

and systems that were affected. 

Cable failure impacts

equipment outside the fire

location

Several kilometers of cables

were replaced, electrical panels

were replaced. Cable failure

had certainly impacted

equipment outside the fire areas. 

However, the available

information does not specify

which cables and equipment

were affected.

Because of the extensive

damage, the fire delayed plant

startup.

In this case because the plant was still under

construction the operation impact was

apparently minimal. However, from the

severity of the fire as described in the

available sources and given that the fire

damaged a large set of cables, it is inferred

that if the fire had occurred during power

operation, core cooling capability would have

been affected severely. 

Equipment failure perturbs

the balance of plant

operation and causes

automatic systems to

respond

All three safety trains were

affected either directly or

indirectly because of operators’

decision to switch off 6kV bus

to minimize the hazards during

fire fighting.

From the information provided, it can be

inferred that all three safety trains were lost

in this fire incident. Thus, if the fire had

occurred after reactor activation, core cooling

would have been severely jeopardized. 

Operators in the control

room receive messages and

respond to the information

displayed on the control

boar d or received verbally

from the plant

No clear information available.

Operators attempt to

control the plant properly

and bring the plant to a safe

shutdown

n/a

Structural failures (if

occurred) may jeopardize

availability of equipment

n/a
Fire Scenario

Element/Issue

Incident - Zaporizhzhya,

January 27, 1984

Fire PRA Insights

A10-10

Water when sprayed over

electrical equipment may

fail the exposed equipment

No information on this

phenomenon.

As noted above, the fire fighters did spray

water somewhat indiscriminantly. However,

there are no reports of any damage. Given

that the areas contained primarily cables, this

is not unexpected (i.e., cables should not be

vulnerable damage as a result of wetting).

The cooling effect of CO2

may adversely impact

equipment

n/a

Conditions may exist at the

time of the fire that may

aggravate the impact of the

fire on plant systems

The plant was under

construction.

As noted above, construction is widely

recognized as presenting unique fire hazards

and construction fires are routinely dismissed

in fire PRA analyses. In this case, in the

judgement of the authors, the fire behaved

much as it likely would have had the plant

been in operation. The one possible

exception is with regard to fire spread

through incomplete penetration seals as noted

above.

A10.5 Incident Analysis

The root cause of this fire incident can be attributed to an electrical fault leading to a self-ignited

cable fire. While the actual nature of the fault remains unclear, the available reports cite that the

most likely explanation is that a fire started inside a terminal box due to either an external object

shorting across bare terminals or a self ignited cable fire. The fire then propagated from the

terminal box to associated cables entering the top of the box and from there into a cable shaft.

Self ignited cable fires can be regarded as rare occurrences. It is common to assume that the

potential for such fires is tied to the specific characteristics of the cables, cable manufacturing

practices and cable installation practices. In fire PRAs for the plants in the U.S. it is assumed that

self ignited cable fires are implausible if IEEE-383 qualified low-flame-spread cables are used. In

the case of Zaporizhzhya, the qualification standards of the cables and terminal boxes is not clear. 

Hence, this incident neither refutes nor confirms these assumptions.

It appears that the fire propagated rather slowly at first, but steadily. Some of the information

reported for the time period between 2 and 4 hours after detection indicates that the fire may have

spread more quickly during this period, but the information is somewhat contradictory. The cable

risers in the cable shaft where the fire began were the main path for fire propagation. In many

regards, this fire followed a “classical” initiation and spread behavior as commonly assumed in a

PRA fire scenario. That is, the fire started quite small, propagated to adjacent cables, propagated

to nearby cable trays and cable risers, and then spread unchecked until suppression efforts were

begun. Hence, in this regard, a fire PRA would have likely postulated the potential development
A10-11

of a fire in the impacted compartment, at least up to the point that other fire areas became

involved.

Initial attempts by operators to fight the fire were unsuccessful because they did not have proper

gear to deal with the smoke. Subsequent efforts by the fire brigade were also hampered by smoke

because fire fighters could not clearly identify areas of active burning. The fire fighters were

initially somewhat ineffective in their attacks due in large part to the heavy smoke buildup. Other

contributing factors include a lack of adequate pre-fire planning and unfamiliarity of fire fighters

with the plant. Ultimately the fire managed to propagate upward to practically all Control

Building elevations. This incident demonstrates the potential impact of smoke on fire fighting

activities. In fire PRA, the impact of smoke on the fire fighters is not generally modeled

explicitly. It is commonly assumed that once fire fighters arrive on-scene, they will quickly and

effectively control and suppress the fire. It is quite common to base manual fire suppression times

on the response time of the fire brigade without explicit consideration of the conditions they might

encounter upon arrival.

Lack of fire brigade training and pre-fire planning is another interesting insight of this incident. 

From the available sources, the importance of this factor is not clear. In fire PRAs conducted in

the recent years in the U.S., the training of the fire brigade is often reviewed in some level of

detail (see for example Reference 10-3). In this case, there are also reports that fire fighters were

spraying water despite the fact that they had no clear idea of where the fire actually was burning. 

The potential for misdirected suppression is considered, but commonly dismissed, in fire PRAs. 

This incident illustrates that the potential for such actions does exist and provides some indication

of the circumstances under which this might be anticipated. That is, for fire PRAs careful

consideration of the training of on-site fire brigades is confirmed to be both appropriate and

important. Furthermore, it would also be appropriate to consider the level of cooperation,

coordination and pre-fire planning that goes into interactions with off-site fire brigades that might

be called upon to support fire fighting efforts at the plant.

The available reports cite that incomplete and unsealed penetrations were a factor in the fire

spread. However, from the available information, it can be inferred that at least some nominally

intact fire barriers were overwhelmed by the fire. This is inferred from the fact that the fire

remained confined to the cable shaft for over two hours before propagating to various adjacent

spaces. Hence, it is likely that many of fire barriers were intact and confined the fire, but that

continued burning eventually overwhelmed some elements of the barriers and allowed the fire to

propagate to adjacent areas. In fire PRAs for U.S. plants it is common to assume that all fire

barriers are properly designed and installed to withstand the fire threats likely to be experienced in

most areas. Furthermore, cables are not generally considered a high-hazard fuel source, so the

likelihood that a cable fire would overwhelm a rated fire barrier would be assumed very small. It

would be common in such cases to assign a small random failure probability to the barrier,

typically on the order of 0.01 per demand. The applicability of the experience here to U.S. plants

is unclear because of likely differences in Soviet versus U.S. barrier qualification and monitoring

practices.
A10-12

This is one of the few incidents where a long-term fire re-flash has been reported. There are other

cases where initial attempts to suppress a fire have been unsuccessful and a fire has re-flashed

immediately upon removal of the suppressant. This is particularly true in cases where hand-held

gaseous extinguishers are used to fire electrical fires. However, this case is unique because of the

time involved. In this case, over one hour after the fire was initially declared out reports were

received that the fire in one area had re-ignited. It is likely that the main cause of the re-flash was

deep seated burning in the cable bundles and exposure to fresh air. The possibility of re-flash is

not considered in a typical fire PRA. However, it can be argued that since the models used in fire

PRAs are based on actual fire occurrences, it empirically includes the possibility of re-flash. This

event points out that if one were to model fire suppression in great detail should include the

possibility of re-flash in that model.

This event offers little insight into the impact of a fire on plant operations and operator actions

because the plant was still under construction and was not in operation. However, it can be

inferred from the available reports that had the plant been in operation, the impact on plant

operations would have been severe. All three safety divisions were lost during the fire. Hence, it

is likely that core cooling functions would have been severely challenged.

A10.6 References

A10-1 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A10-2 Soloviev, P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A10-3 Lambright, J., S. Nowlen, V.F.Nicolette, and M.P.Bohn, Fire Risk Scoping Study:

Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed

Issues, SNL/USNRC, NUREG/CR-5088, January 1989.

A10-4 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A10-5 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.
A11-1

Appendix 11 - Analysis of Kalinin, Unit 1 Fire on December 18, 1984

A11.1 Plant Characteristics

Kalinin is nominally a four unit nuclear power plant site located in Tver Volga, Russia.[A11!3,4] All

four planned units are VVER-1000 type nuclear power plants. Units 1 and 2 have been in

operation since the mid-1980's, Unit 3 is under construction, and construction has been suspended

on Unit 4.[A11-4] At the time of the fire, Russia was a part of the former Soviet Union. Plant

construction on Unit 1 began in 1977, and the first criticality was achieved in April 1984. First

power operations began in May of 1984, but commercial operations did not commence until June

of 1985. The fire described here occurred in December 1984, approximately seven months after

initial power operations but before commercial operations had commenced. Construction on the

sister unit, Kalinin 2, had been underway for approximately two years but had not been completed

at the time of the fire. 

Typical of Soviet-designed reactors, the unit has two turbine generators and two control rooms. 

A main control is responsible for reactor operations while the second “central control room” is

responsible for the power generation side of the plant. Also note that the Kalinin design includes

three safety trains. 

A11.2 Chain of Events Summary

On December 18, 1984, at 18:28, while Kalinin Unit 1 was producing power, a service water

pump was being restarted after a major repair. Sparks became visible on the cover of the pump

and “unknown sounds” came from the direction of the pump (as reported by workers in the area

who had apparently been working on the pump). Later it was determined that on startup, the

service water pump started to turn in the wrong direction (likely due to a phase reversal on the

power supply connections). This caused the electrical control system to fail. An additional

breaker failure caused a breaker cubicle fire and a 6 kV cable fire in the turbine building. 

A machinist and electrician working in the service water pump area tried to trip the pump using

the emergency switch, but the pump would not trip. They called the control room and asked

operators to trip the pump from there. The control room operators were not able to trip the

pump either. After this the workers observed arcing in the motor and the cable connection to the

motor started burning near the wall. Since the associated power feed breaker did not open, the

electrician called the Central Control Room that controls the electrical distribution system and

asked operators there to de-energize the safety power train. The 6 kV power train was tripped

and the service water pump stopped. However, by this point a fire had started inside the breaker

cubicle for the service water pump. The workers tripped the associated transformer, opened the

cubicle door and applied CO2 onto the fire. They were apparently successful at suppressing the

fire in this cubicle.

However, at 18:28 the turbine building personnel noticed a fire burning in a cable tray at -4.0 m

elevation under Turbine B. A fire had ignited on a 6 kV cable at several locations along the cable. 

The available reports state that it is suspected that the 6 kV cable had manufacturing defects and
A11-2

was damaged because of improper cable pulling practices. Thus, its insulation had weakened or

was damaged and was susceptible to failure. From this one can surmise that the combination of

the damaged insulation and the overload condition resulting from the pump and breaker problems

combined to cause a self-ignited cable fire in the subject cable.

Plant personnel started the fire fighting process immediately and called for the off-site fire brigade. 

At 18:37 the fire brigade arrived on the scene and a full scale fire fighting effort started. By 20:12

(1 hour 46 minutes after the first alarm in the control room) the fire was considered under control

and by 21:20 the fire was declared to be completely extinguished.

The automatic fire suppression systems functioned as designed although it was apparently

ineffective. The fire fighting was done in severe smoke conditions using SCBAs. To vent the

heavy smoke from the turbine building, several windows were broken. The hydrogen was drained

from the generator and the 6 kV buses were de-energized.

A11.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (References [A11-1] and [A11-2]). If the precise timing and

the order of an event is not known, the time of occurrence is not specified. However, it is

included at an order of presentation based purely on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

On December 18, 1984, the unit was

operating at power.

00:00 At 18:28:36 the control room received an

alarm. 

-- Service water pump NTN-3 was being put

back on line after a major repair. Sparks

became visible on the cover of the pump

and unknown sounds came from the

direction of the pump.

Electrical fires are typical of the fire sources

postulated in a fire PRA. The exact mechanism of

initiation is not considered, but rather, fires are

postulated based on statistical analysis of past fire

experiences.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A11-3

-- The machinist and electrician who were

on the scene tried to trip the pump using

the emergency switch, but the pump did

not trip. They called the control room to

trip the pump from there. The control

room operators were not able to trip the

pump either. After this they observed

several arching in the motor and the cable

connection to the motor started burning

near the wall. 

The breaker for the service water pump was later

found to be in the test mode. This reduced the

opportunity for mitigating the ignition processes

before the fire could occur. Such details are not

generally modeled in a typical fire PRA. The fire

occurrence frequency is based on all recorded fire

events and therefore, in theory includes human errors

leading to fires.

-- The electrician called the Central Control

Room asked them to isolate the safety

power train. The 6kV power train tripped

on protective breaker opening. It is not

clear whether the operators tripped the

breaker or it tripped on over-current.

-- Fire was noticed inside the breaker

cubicle for the service water pump. The

technicians tripped the transformer and

opened the breaker cubicle and applied

CO2 into the cubicle.

00:00 At 18:28 fires were discovered in the

cable trays at -4.0m elevation of the

Turbine Building under turbine B. Fire

had ignited at several places on a 6kV

cable. It was later determined that the

motor of Service Water Pump NTN-3 had

rotated backwards. This had caused the

electrical control system to fail, and lead

to a demand for breaker trip. The breaker

failed to open and this led to overcurrent

condition in the 6kV cable. It was also

suspected also that the 6kV cable had

manufacturing defect and was damaged

because of improper cable pulling

practices.

In this incident, effectively there were three ignitions -

- the service water pump, switchgear cubicle and 6kV

cable. On the cable itself there were several ignition

points. Thus, multiple simultaneous fire took place in

this incident. Fire PRAs do not generally address

multiple fires. It is assumed that all fires occur

independent of each other and therefore their

simultaneous occurrence is very unlikely.

00:02 The generator tripped offline.

-- Plant personnel started the fire fighting

process. 

-- The security personnel were notified.

-- The automatic fire suppression systems in

the turbine building functioned as

designed. 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A11-4

00:09 At 18:37 the fire brigade arrived at the

scene. 

-- The fire fighting was done in severe

smoke conditions using SCBAs. To

remove smoke windows had to be broken.

Smoke hampering of fire fighting activities is often

considered, but typically discounted, in fire PRAs. In

this case, fire fighting may was hampered by the

smoke.

-- The hydrogen was drained from the

generator and 6kV bus bars were tripped.

This successful action potentially prevented a much

more severe fire.

01:46 By 20:12 the fire was brought under

control.

This is a relatively long fire in comparison to fires

commonly postulated in fire PRAs. The possibility

that a fire might burn for more than about 30 minutes

02:52 By 21:20 the fire was declared as is considered remote.

completely extinguished

Equipment Damaged

S 6 kV switchgear

S Service water pump motor 

S Electrical cables below turbine B

Damaged Areas

S The switchgear and pump fires were localized to equipment of origin. The cable fire

inside the Turbine Building affected a large number of cables.

Impact on Core Cooling 

S Available sources do not specify the impact on core cooling functions. 

Radiological Release

S No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

S There were no reported injuries to plant or external fire brigade personnel caused by the

fire.

Public Impact

S The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

S There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A11.3 Comparison of Fire Scenario Elements and the Incident
A11-5

In this section, the chain of events of the fire incident is compared to the elements of a typical

PRA fire scenario. Entries are made only if specific information was provided by the available

sources. No attempt was made to postulate a possible progression of the chain of events no

matter how plausible it could be based on the physics of the fire process, unless it was deemed to

be essential in concluding a specific insight.

Fire Scenario

Element

Incident - Kalinin 1, December 18,

1984

Fire PRA Insights

Presence of

combustible /

flammable materials

The combustibles that were affected

in this incident included the motor

winding of service water pump

NTN-3, the breaker cubicle serving

the service water pump, the 6kV

cables under Turbine B. 

These are common combustibles that are

considered in fire PRAs

Presence of an ignition

source

The ignition source for was

electrical overload aggravated by a

breaker that failed to open.

Self-ignited cable fires are considered in fire

PRAs but are judged to be unlikely events.

Ignition of the fire and

generation of heat

(radiant and

convective), smoke,

and other gases

The following three fires occurred:

- The service water pump motor

threw some sparks (minor)

- Switchgear cubicle serving the

pump caught fire

- 6kV power cable under Turbine B

caught fire at several locations.

Simultaneous occurrence of several ignitions

at different parts of the plant is not modeled

by current fire PRA methodologies.

Fire growth within the

combustible or

component of original

ignition

The service water pump stopped

sparking as soon as the power was

cut off from it. The switchgear fire

was quickly suppressed by

technicians at the scene and did not

propagate. However, the cable

associated with the pump caught fire

did spread to other nearby cables.

The fire under the turbine was the only fire

that saw significant propagation. Hence,

while multiple fires did occur due to a

common cause, only one really had any

substantial impact on the plant.

Fire propagates to

adjacent combustibles.

The cable fire in Turbine Building

propagated to adjacent combustibles

and grew to a considerable

magnitude.

A hot gas layer forms

within the

compartment of origin

(if conditions may

allow)

Effects of fire (i.e., hot

gas and smoke)

propagate to an

adjacent compartment

(if pathways exist)

Large quantities of dense smoke

were emanating from the cable fire

in the Turbine Building.

There are no reports of any adverse fire

effects in areas other than the turbine

building.
Fire Scenario

Element

Incident - Kalinin 1, December 18,

1984

Fire PRA Insights

A11-6

Local automatic fire

detectors (if present)

sense the presence of

the fire

Alarm is sounded

automatically in the

control room, locally

and / or other places

Operators did promptly activate the

fire brigade upon initial reports of a

fire.

Automatic suppression

system is activated (if

present)

The automatic fire suppression

systems activate as designed, but did

not extinguish the cable fire. 

In this case, a gaseous suppression system

failed to either control or extinguish the fire. 

The design characteristics or the system are

not, however, known so this failure cannot be

clearly extrapolated to other cases.

Personnel are present

in the area where fire

occurs

Plant personnel were present in the

service water pump and switchgear

area and in the Turbine Building

Personnel did detect the fires and reported

promptly to proper authorities (the main

control room). In one case (the switchgear)

these personnel apparently suppressed the

fire as well.

Control room is

contacted or fire alarm

is sounded

Control room was contacted by the

mechanical and electrical

technicians who were at the service

water pump area and were trying to

startup a pump for the first time

after a major repair. The contacted

the control room to open the breaker

for the pump but control room

efforts failed. They later contacted

the electrical control room and asked

for the associated switchgear to be

tripped, which was done

successfully. 

Fire brigade is

activated

The plant personnel and the plant

fire brigade fought the fires.

The fire brigade was activated quite early in

the incident and apparently responded within

a short time period (several minutes). This is

consistent with typical PRA assumptions

regarding fire brigade response times.

Fire suppressant

medium is properly

applied

The fire brigade applied the fire

suppressant properly.

There are no reports of collateral suppression

damage.

Automatic fire

suppression system is

activated

Automatic fire suppression system is

activated as designed.

While the system activated it was apparently

ineffective.
Fire Scenario

Element

Incident - Kalinin 1, December 18,

1984

Fire PRA Insights

A11-7

Fire suppressant

medium is properly

applied to where the

fire is.

The brigade had to work in dense

smoke conditions. However, no fire

brigade errors are noted. 

The impact of heavy smoke on fire fighting

effectiveness is not explicitly modeled in

most fire PRAs. 

Fire is affected by the

suppression medium

With the help of the fire brigade the

fire was brought under control in

one hour and 46 minutes after the

initial alarm in the control room and

it was declared as completely out at

2 hours and 52 minutes after initial

alarm. 

Typical assumptions assume that fires will be

very quickly suppressed once fire fighting

begins. In this case the fire continued to burn

despite active fire fighting efforts.

Fire growth is checked

and no additional

failures occur

The fire was brought under control

in one hour and 46 minutes after the

initial alarm in the control room 

Fire is fully

extinguished and fire

brigade declares it as

out

Fire was declared as completely out

at 2 hours and 52 minutes after

initial alarm. 

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

There was apparently substantial fire

damage, but the damage was

confined to non-safety systems and

equipment. Windows were broken

intentionally to help in ventilating

the Turbine Building to minimize

the amount of smoke.

Actions outside the established procedures

are not credited in a fire PRA. For example,

in case of heavy smoke in a compartment,

credit would not be given to the possibility of

breaking windows to ease the density of the

smoke.

Cable failure impacts

equipment outside the

fire location

The available sources do not provide

information regarding this matter. 

There was apparently little damage

to safety systems or components.

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

no information

Operators in the

control room receive

messages and respond

to the information

displayed on the

control boar d or

received verbally from

the plant

no information
Fire Scenario

Element

Incident - Kalinin 1, December 18,

1984

Fire PRA Insights

A11-8

Operators attempt to

control the plant

properly and bring the

plant to a safe

shutdown

no information

Structural failures (if

occurred) may

jeopardize availability

of equipment

None reported

Water when sprayed

over electrical

equipment may fail the

exposed equipment

no information

The cooling effect of

CO2 may adversely

impact equipment

n/a

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

None reported

A11.5 Incident Analysis

This particular event was included in the current review largely because, from a classical fire

protection engineering standpoint, the fire was rather severe. The fire burned for nearly two

hours, produced copious amounts of smoke, required several fire fighters working in somewhat

harsh conditions to suppress, and apparently caused some substantial physical damage to the

plant. However, the operational impact of this fire was apparently modest, and plant operators

appear to have responded appropriately to the fire incident. This again illustrates that not all large

or prolonged fires will lead to significant nuclear safety challenges.

This observation is fully consistent with current PRA methods. Many fire areas are routinely

screened from a fire PRA on the basis of minimal potential for operational impact. This

commonly includes the screening of, in particular, turbine halls which are widely known to present

severe fire hazards from a classical fire protection standpoint. This event provides confirmation of

the general validity of this approach. In this case, there was apparently no safety significant

equipment threatened by the fire, and a fire PRA would have likely concluded that even a

prolonged fire would represent a very small risk contributor, provided of course that the fire

remained confined to the turbine hall as it did in this case.

It is also interesting that in this incident there were, effectively, three fires at three different

locations of the plant caused by the same root failure. The three locations are as follows: the
A11-9

service water pump itself, a switchgear cubicle, and a 6 kV cable. The common link was

association with the same electrical circuit. Of the three fires, the most serious was the selfignited cable fire in the turbine building. For the cable, there were actually several ignitions along

the length of the cable, although all were in the turbine building. Thus, multiple, simultaneous

fires took place in this incident. Fire PRAs do not address multiple fires. It is assumed that fires

occur independent of each other and therefore simultaneous occurrence is very unlikely.

This case also involves a self-ignited cable fire. Such fires are commonly considered in fire PRAs,

but are typically dismissed for newer plants and in cases where cables are certified as low flame

spread per the IEEE 383 testing standard. This particular event confirms the potential for selfignited cable fires in a very general context, but neither confirms nor refutes the assumptions

regarding low flame spread cables.

A11.6 References

A11-1 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A11-2 Soloviev, P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A11-3 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A11-4 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.

A12-1

Appendix 12 - Analysis of Maanshan, Unit 1 Fire on July 1, 1985

A12.1 Plant Description

Maanshan is a two unit nuclear power station located near Herng Chuen, Taiwan. Both units are

890 MWe Westinghouse design, pressurized water reactors. Unit 1, where this fire incident

occurred, started commercial operation in July 1984. The sister Unit 2 began commercial

operation in May of 1985, just two months before the subject fire in Unit 1.

A12.2 Chain of Events Summary

While operating at power, a turbine blade failure occurred on July 1, 1985 at Unit 1 [ref. A12-1]. 

As a result of the imbalance, the turbine shaft came to a halt within a few seconds. The vibration

caused by the loss of turbine balance, broke the generator seal allowing hydrogen to escape and

seal oil to spill inside the turbine building. Both the hydrogen and the seal oil ignited starting fire

inside the turbine building. The fires caused significant damage and the plant remained shutdown

for repairs close to 11 months.

The heat detectors in the turbine building responded to the fire and the automatic carbon dioxide

fire suppression system activated. The system was apparently ineffective. The local fire brigade

was summoned and arrived about 1 hour after the turbine failure. The fire fighters experienced

some difficulties and additional delays due to a failed fire protection system valve. Water was

sprayed on the fire starting about 1 hour after turbine failure. The fire was apparently so intense

that the fire fighters had to keep some distance. The fire was declared as completely extinguished

about 10 hours after turbine failure.

The turbine failure also led to reactor trip. Although some electrical cables and motor control

centers were affected, no safety related equipment were affected and there was apparently no

adverse interference with reactor shutdown and core cooling capabilities. 

A12.3 Incident Analysis

In this incident a relatively severe turbine building fire occurred because of turbine blade failure. 

However, despite a severe and prolonged fire causing extensive physical damage, the incident did

not have an adverse effect on plant safety. The plant was shut down reportedly with little or no

real challenge to nuclear safety. This incident confirms the conclusion that is often reached in fire

PRAs; namely, that the turbine building can often be screened out as risk insignificant. This is a

case where this conclusion would have been valid, although the actual risk significance of the

turbine hall is plant specific depending on what equipment (including cables) is housed within or

passes through that area.

The incident is included in this study because it does represent a major turbine building fire

incident of a similar nature to others considered in this review (e.g., Narora and Vandellos). That

is, a turbine blade failure leading to release of both hydrogen and oil and a resulting fire. As in
A12-2

other cases the fire was apparently severe and lasted for several hours. This incident does serve

to illustrate that there are two quite distinct criteria for judging the severity of a fire incident. In

the classical fire protection engineering sense, this fire was quite severe. However, from a nuclear

safety standpoint, the fire had a very minimal impact.

A second aspect of this fire that is of interest is the apparent ineffectiveness of the carbon dioxide

fire suppression system. While the system did actuate as designed, it was ineffective at either

suppressing or controlling the fire. It is not, however, known how the system was designed. For

example, CO2 systems are commonly designed as total room-flooding systems, but may also be

used to protect locally against fires involving fixed sources. Given a space with the volume of a

typical turbine hall, it would be quite unusual to provide a total flooding system. Hence, it is

likely that the system was either provided as “point” protection, or was designed to protect

specific zones within the larger turbine hall. Given these uncertainties it appears inappropriate to

draw conclusions from this aspect of the incident.

A12.4 References

A12-1 W. Wheelis, , "User's Guide for a Personnel Computer Based Nuclear Power Plant Fire

Data Base," NUREG/CR-4586, SNL/USNRC, August 1986. 
A13-1

Appendix 13 - Analysis of Waterford, Unit 3 Fire on June 26, 1985

A13.1 Plant Description

Waterford 3 is a single unit pressurized water reactor (PWR) located near Taft, Louisiana. Unit 3

is the only nuclear power unit on the site (Units 1 and 2 being separate conventional units). The

unit is rated at 1104 MWe and started commercial operation in September 1985. The fire being

reviewed here occurred on June 26, 1985, after initial power operations had begun but prior to

the commercial operation date [Ref. A13-2].

A13.2 Chain of Events Summary

On June 26,1985 the plant was operating at power, when a fire occurred in one of the main

feedwater pumps. An electrician notified the control room that smoke was emanating from main

feedwater pump A. An operator was dispatched to the scene and reported back to the control

room that the pump was on fire. Control room operators tripped the cited pump, started reducing

reactor power and declared an unusual event was underway.

Five minutes after the initial report of a fire, the control room was notified that the fire was

actually in main feedwater B, rather than pump A as previously reported. As a result the control

room operators immediately tripped the turbine, which in turn caused the reactor to trip. Since

both main feedwater pumps were secured, the steam generator level dropped below the

emergency feedwater system setpoint.

The fire brigade was activated upon confirmation of the fire. They used a local hose station and

water streams to fight the fire and managed to extinguish it in about 10 minutes. The fire was

limited to a small portion of the outer wrapping of insulation on the feedwater piping and was

attributed to design and fabrication error.

A13.3 Incident Analysis

In most senses this fire was relatively small and, overall, the challenge to nuclear safety during the

incident was relatively minor (a reactor trip with all safety systems available). The interesting

aspect of this incident is that operator/personnel error led to an initial report identifying the wrong

pump as the one on fire. As a result, the unaffected pump was first tripped, and eventually both

main feedwater pumps were tripped. Although only non-safety related trains were involved in this

incident, it provides an interesting insight into the possibility of indirect impact of fire on multiple

train availability. That is, a fire for various reasons, may lead to unaffected trains being taken out

of service. In this case the cause was operator error.

In this incident, the operator actions would be classified as an error of commission. That is, rather

than failing to take a desirable action, the operator in this case took an action that was

undesirable. Fire PRA methodologies are capable of identifying conditions where an operator

action may exacerbate the situation (i.e., errors of commission). However, currently such
A13-2

scenarios are seldom considered in either general or fire PRAs. More likely is that a fire analysis

of this scenario would have assumed a random failure probability for the unaffected pump,

commonly a very low value. Human reliability methods currently applied are widely recognized

as providing poor treatment of errors of commission.

A13.4 References

A13-1 W. Wheelis, "User's Guide for a Personnel Computer Based Nuclear Power Plant Fire

Data Base," NUREG/CR-4586, SNL/USNRC, August 1986. 

A13-2 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.
A14-1

Appendix A14 - Analysis of Fort St. Vrain Fire on October 3, 1987

A14.1 Plant Characteristics

Fort St. Vrain is a single unit High Temperature Gas-cooled Reactor (HTGR). The power rating

of the plant is 1,250 Mwe provided by one turbine generator. Plant construction began in 1968,

commercial operation began in 1979, and the plant was permanently shutdown in 1989. 

[Ref. A14!3].

A HTGR reactor uses graphite as a moderator and helium gas for heat removal from the core.

Fort St. Vrain had two main cooling (helium) loops. The helium, after passing through the core,

flowed through the two steam generators (one per cooling loop). Motive power for the helium

was provided by two steam driven circulators for each loop. The steam for the circulators comes

from the discharge of the high pressure turbine of the turbine-generator. The steam is passed

through the steam generators once more for superheating before it is taken to the intermediate

and low pressure turbines.

The control room is located at the north end of the Turbine Building (see Figure A14-1). It is

isolated from the open part of the Turbine Building by doors. The control room has four doors:

1) the west door on the south wall opens directly into the turbine area, 2) a double door, also on

the south wall, is labeled in Reference [A14-1] as “non-opening”, 3) an east facing door next to

the south wall that opens into a corridor type area that includes a door into the turbine area, and

4) a door on the east wall that opens into the locker room in Building 10.

A14.4 Incident Summary

On October 2nd, 1987 the plant was coming out of a long outage and was in the midst of its

initial power ascension. As part of this process, the operators closed a hydraulic valve in the

turbine building, when they noticed a drop in hydraulic oil pressure. An inquiry into the causes of

this drop discovered that a filter bowl (canister) had failed and high pressure oil (about 3,000

psig) was spraying (close to 15 feet distance) onto hot exposed steel. The petroleum based

hydraulic oil ignited starting the fire. The temperature of hot surfaces were above the autoignition point of the oil. The equipment operator who discovered the fire initially succeeded in

extinguishing the fire using a portable dry-chemical extinguisher. However, since he did not close

the valve feeding the failed filter, the oil continued to spray and re-flashed (re-ignited). By this

time the size of the fire was relatively large (estimated as 8' x 3'). 

Plant fire brigade was called on immediately. An outside fire department was also asked to

respond. A reactor operator was dispatched to the Reactor Building to close the two control

valves for the hydraulic system to cut off the supply of oil to the failed filter. This operator

managed to close one of the two valves immediately. The handle for the other valve was missing

and therefore, some delay occurred in cutting off the oil from the fire. As soon as the oil was cutoff, the fire was extinguished and the operators managed to close off and isolate the failed filter

and activate the available hydraulic system train. 
A14-2

Figure A14-1: Plan view of the reactor building and turbine building including fire area on Level

6 and control room on level 7 (from Reference A14-1).
A14-3

The damage caused by this fire was limited to the immediate area of the fire at the north end of

the turbine building. Several cables were damaged that had some effect on the control room. 

Valves, instruments and structural elements were affected by the fire. However, there was minor 

impact on plant shutdown and reactor cooling capability. 

The fire had some impact on control room habitability. Apparently large quantities of smoke were

generated from burning oil and cables, that affected the initial fire fighting efforts. The cables

damaged by the fire caused the control room ventilation system to shift to radiation emergency

mode. Also, cable damage caused loss of electric power at the fire location rendering electric

motor driven smoke ejectors useless. In this mode, the system shifts to suction from the turbine

building. It therefore, drew some smoke from the turbine building into the control room. The

operators, within two minutes of ventilation system shift, turned the ventilation system into the

purge mode. However, smoke continued to enter the control room because positive pressure in

the room could not be maintained due to frequent use of the door between the control room and

the turbine building. The operators had to prop open the door separating the control room and

Building 10 to allow fresh air to be drawn into the control room.

The control room was equipped with a piped-in Breathable Air System that provided fresh air via

a common air supply header and individual masks for operators. Although the system was

designed for 6 masks, only three were available during the incident and there were six operators in

the control room. Scott Air Pacs were also available to the operators to make up for the shortage

of masks.

A14.3 Detailed Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (Reference [14-1] and [14-2]). If the precise timing and the

order of an event is not known, the time of occurrence is not specified. However, it is included

at an order of presentation based purely on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

On October 2, 1987, the plant was coming out

of a long outage and was in the process of power

ascension.
A14-4

Prior to

the

incident

The audible alarm of the fire detectors located

in the control room were turned off because of

too many nuisance alarms.

In fire PRA such plant specific conditions are

expected to be discovered during the plant

walkdown. Typically an overall fire detection

and suppression model is used to encompass all

possible ways that detection and suppression is

delayed or failed.

Prior to

the

incident

At 23:50, control room operators noticed that

after activation of a major hydraulic valve

hydraulic oil system pressure did not recover

back to its normal 3,000 psi pressure.

In fire PRA, credit is seldom given to operators

using indirect methods for discovering an

adverse condition. This type of behavior is

difficult to quantify. 

Prior to

the

incident

At 23:51, a turbine equipment operator was

dispatched to identify the causes for oil pressure

drop. 

Prior to

the

incident

At 23:55, the turbine equipment operator

reported that there was oil flowing into the

catch basin under the turbine. This is located at

level 5 of the turbine building. The oil was

coming from a failed filter bowl of the hydraulic

oil system at level 6. The oil was spraying out of

the bowl for a distance of about 15 feet onto 20"

diameter hot reheat piping and 2 associated

reheat check valves..

-- The equipment operator noticed a fire 

00:00 At 23:59, the equipment operator reported a fire

at level 6 involving the sprayed oil. 

The ignition source was later found to be

exposed hot steel parts of relief valves that could

not be insulated. The auto ignition temperature

of the oil was 620F. The hot surfaces of

exposed reheat piping were between 680 and

690 F.

The fire source/cause is relatively common for a

turbine hall fire, leaking lube oil, but PRA fire

modeling rarely considers high pressure spray

fires and would generally treat such fires as pool

fires only.
A14-5

-- The turbine equipment operator, who happened

to be a member of plant fire brigade, discharged

one bottle of dry chemical fire extinguisher at

the fire, which extinguished the flames. 

He could not however reach an isolation valve

to stop the flow of oil to the filter. The fire reignited. This time it was larger than the

previous fire. The dimensions of the fire are

estimated in one report as 8 feet by 3 feet.

The equipment operator had to retreat from the

area because of heavy smoke. 

As mentioned above, in fire PRA under some

methods an overall statistical probability model

is used to account for all possible ways that fire

detection and suppression may be delayed or

failed. The possibility of failing to put a fire out

in the initial stages of a fire fighting scenario is

included in the overall suppression time. 

However, other methods might have given

substantial credit to initial suppression efforts

that may not be appropriate for this situation (a

rapidly developing oil fire).

Also note that the fire itself prevented the

operator from shutting down the oil flow

locally. As a result, oil continued to feed the

fire. A typical fire PRA would not have

credited this action because it required actions

near the fire source.

00:01 At 00:00 (October 3rd) a reactor equipment

operator was dispatched to level 1of the reactor

building to manually close two control valves on

the hydraulic oil supply to the entire system to

stop the flow from the ruptured filter bowl. He

managed to close one valve immediately and

since the handle was not attached on the other

valve, had to leave the area, find a wrench and

then close that valve as well. He completed this

task at 00:13.

A quality fire PRA, as part of the human actions

analysis, would conduct a walkdown of the

actions and potentially discover a missing valve

handle. This incident demonstrates the

importance of conducting such walkdowns. 

Consideration of the possible need to shut down

the oil flow system from this remote location is,

however, a subtle point that might easily be

missed in a fire PRA.

00:02 At 00:01, the operators decided to start lowering

the speed of recirculator D in anticipation of its

shutdown because of hydraulic oil valve closure.

00:04 At 00:03, outside fire department was contacted

for assistance.

-- Smoke leaked into the control room under the

door opening into the turbine building.

-- The equipment operator who had discovered the

fire, went back to the fire area after donning fire

brigade protective clothing and SCBA. He

attacked the fire with a hose using a fog nozzle.

00:05 Fire brigade arrived on the scene and attacked

the fire using hoses from a different angle than

the equipment operator who had discovered the

fire. 

-- The smoke hampered the initial fire fighting

efforts. Also, loss of electric power caused by

the fire rendered the use of electric motor driven

smoke ejectors useless.
A14-6

00:07 At 00:06, the “C” circulator tripped because of

internal causes. Given the circulator “D” was

coasting down, effectively the second reactor

cooling loop was completely tripped.

00:09 At 00:08, loop 1 circulators shut down because

of loss of power to instruments caused by the

fire.

It is interesting to note that a loss of instrument

power is cited as the cause for loss of the loop 1

circulators. In a fire PRA, systems may be

credited with continued operation even if the

associated instrument circuits are lost.

00:09 Cable faults caused by the fire, shifted the

control room ventilation system to minimum

makeup mode from the Turbine Building. This

allowed smoke from the Turbine Building to

enter the control room.

In a quality fire PRA, the failure modes of a

ventilation system should be studied. If such a

study is undertaken, the possibility of

ventilation system drawing smoke into the

control room would be discovered. This is,

however, a rather subtle aspect of the fire that

might easily be missed in a PRA.

00:10 At 00:09, the operators initiated a manual scram

because of indicated loss of primary and

secondary cooling flow.

00:11 At 00:10, the control room ventilation was

manually shifted to purge mode to clear the

light smoke entering the room.

Air masks from a central Breathable Air System

were distributed among the operators. However,

an insufficient number of masks were available

and operators had to share the available masks.

In fire PRA, in case of smoke in the control

room it is conservatively assumed that the room

is inhabitable. Therefore, lack of availability of

sufficient number of working breathing masks

would not be explicitly addressed, but the

analysis may have assumed evacuation instead. 

Only a detailed fire risk analysis of the control

room would identify such problem areas.

-- The door between the control room and building

10 was propped open to allow fresh air to enter

the room and clear the smoke.

In a typical fire PRA no credit is given

(conservatively) to the possibility of taking

actions outside the normal procedures. As

mentioned above, in the case of smoke in the

control room., it is assumed that the operators

will leave the room.

00:13 At 00:12, the operators placed the “B” (motordriven) feed pump into operation.The actions require to accomplish this recovery

are not discussed.

00:14 At 00:13, the reactor equipment operator in the

Reactor Building succeeded in closing the

second hydraulic oil valve shutting off the

source of oil to the fire.

00:16 At 00:15, the fire was extinguished, but heavy

smoke remained in the turbine building.

00:26 At 00:25, Platteville Fire Department arrived on

site

In this case, the fire was out before the off-site

fire brigade arrived. The estimated response

time is 23 minutes.

-- Smoke cleared from the control room.
A14-7

00:31 An ALERT was declared.

00:41 At 00:40, certain phone lines to the plant were

found to be lost because of fire damage to the

cables. 

In fire PRA, the availability of communication

system is not explicitly modeled. Loss of the

phone system would impact the possibility of

contacting personnel who are not on-site. In a

typical human action analysis in a fire PRA the

possibility of calling in off-duty operators is not

taken into account. Since most accident

scenarios are modeled assuming an average

number of operators in the plant, this omission

is conservative.

01:31 At 01:30, the hydraulic oil isolation valve that

had been engulfed in the fire was closed.

01:36 At 01:35, the reactor equipment operator was

dispatched to open one of the two hydraulic oil

control valves from the Reactor Building.

01:46 At 01:45, the Loop 2, Group 1 hydraulic header

was returned to service. No leaks were

discovered.

01:59 At 01:58, the Technical Support Center was

declared operational.

03:51 At 03:50, the Forward Command Post was

declared operational.

06:03 At 06:02, it was verified that two independent

safe shutdown paths were available and normal

cooldown mode was being used.

08:16 At 08:15 downgraded from ALERT.

Equipment Damaged

- Electrical cables

- Instruments

- Valves

- Snubbers

- Fire detectors

- Offsite phone lines

Damaged Area

As shown in Figure A14-1, the fire occurred at the north part of the turbine building close

to the control room. The fire itself was approximately 9 feet by 12 feet at its maximum. 

The area where the temperature was above 3000F was estimated as 19 feet square at the

base of the fire and covered and area of 53 feet by 35 at an elevation 17 feet above the

base of the fire.
A14-8

Impact on Core Cooling 

Although normal cooling capability was affected and apparently lost for a short time

during the fire, it was soon restored when the fire was extinguished. At no time during

the fire was the core in any danger of overheating.

Radiological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

There were no reported injuries to plant or external fire brigade personnel caused by the

fire.

Public Impact

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A14.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire event is compared against the elements of a typical

PRA fire scenario. Entries are made only if specific information was available in the available

documents. No attempt was made to postulate a possible progression of the event no matter how

plausible it could be based on the physics of the fire process, unless it was deemed to be essential

in reaching a specific insight.

Fire Scenario Element Incident - Fort St. Vrain, October 3,

1987

Fire PRA Insights

Presence of combustible

/ flammable materials

Petroleum based hydraulic oil of the

hydraulic system was the main source

of combustible material.

A common source for turbine buildings

that would be considered in a PRA.

Presence of an ignition

source

Hot exposed steel parts of relief valves

that could not be insulated are deemed

to be the ignition source. The

temperature of the exposed steel was

between 680 and 690F and autoignition temperature of the oil 620F.

These would be captured in a PRA

Ignition of the fire and

generation of heat

(radiant and

convective), smoke, and

other gases

The hydraulic oil, under close to 2800

psi pressure, was sprayed out of a failed

filter bowl (canister). The oil spray

arced 15' and came into contact with

exposed hot steel and caught fire. 

PRA fire modeling would typically

consider a pool fire rather than a high

pressure spray fire due to limitations of

the commonly applied models.
A14-9

Fire growth within the

combustible or

component of original

ignition

The fire spread rapidly over the sprayed

oil and created an 8'x3' fire. It

propagated to nearby cables and started

a fire in IEEE 383 qualified and nonqualified cables.

As with other turbine hall oil fires, the

fire grew quickly. This should be

captured in a PRA given the fuel source.

IEEE 383 qualified cables were burning. 

This confirms the general assumption

used in fire PRAs that qualified cables

can sustain fire.

Fire propagates to

adjacent combustibles.

 Fire spread to adjacent cables was

progressing towards Train B safety

related cables. Cables were certainly

damaged in this fire that had some

impact on the control board in the

control room. 

A hot gas layer forms

within the compartment

of origin (if conditions

may allow)

Although, given the large open areas of

the Turbine Building perhaps only a

relatively cool hot gas layer formed

under the ceiling. Reference A14-4

indicates that hot gases were trapped

between large structural beams of the

Turbine Building and caused some

deformation and damage to structural

elements. However, per Appendix B of 

Reference A14-2 the high temperature

region (300F) above the fire and below

Floor 7 is approximately 53x35 feet. 

Modeling of hot layer development in a

very large open space is problematic for

existing fire models.

Effects of fire (i.e., hot

gas and smoke)

propagate to an adjacent

compartment (if

pathways exist)

Smoke entered the control room

because a cable failure caused by the

fire put control room ventilation system

into radiation release emergency mode. 

In this mode the control room HVAC

draws air from the Turbine Building. 

This caused smoke to be drawn into the

HVAC system and into the control

room.

Also, the west door was used

extensively during the course of the fire. 

Frequent opening of that door caused

loss of positive pressure in the control

room and allowed the smoke enter the

room through that door. 

Loss of electric power at the fire area

rendered the use of electric motor

driven smoke ejectors useless.

Turbine building fires are modeled in

fire PRAs. In the case of Fort St. Vrain,

a quality fire PRA would identify the

potential for a turbine building fire

affecting the control room. The west

door would certainly be identified as the

potential pathway for propagation of

smoke into the control room. 

Although current methodologies are

clearly capable of handling the scenario,

given the level of detail employed in a

typical fire PRA, it is doubtful that the

analysts would identify the possibility of

control room HVAC switching to

radiation emergency mode and drawing

from the turbine building.

It is also not clear what the nature of the

cable fault was leading to this switch in

modes. This may be evidence of a cable

failure induced spurious operation, but

this cannot be established.
A14-10

Local automatic fire

detectors (if present)

sense the presence of the

fire

There were local fire detectors in the

fire area that activate as designed. 

However, the operators would not have

learned about the fire from the detectors

because the main fire protection panels

are located in a room separate from the

control room with a closed door. 

Furthermore, the audible alarm in the

control room was turned off because of

nuisance alarms that had occurred prior

to the fire.

The fire was detected because of low

pressure noticed by the operators in the

hydraulic oil system.

If the operators were not alert to

hydraulic oil pressure level, given that

the audible fire detector alarm was

silenced, it is possible that the fire would

have remained unnoticed for an extended

period of time.

Plant specific conditions, such as those

mentioned here (alarm in a separate

room, annunciator turned off), would

likely be identified during the plant

walkdown and a degraded credit allowed

for automatic detection.

Alarm is sounded

automatically in the

control room, locally

and / or other places

See above

Automatic suppression

system is activated (if

present)

There were no automatic suppression

systems in the area.

Personnel are present in

the area where fire

occurs

An equipment operator was dispatched

to check the situation as soon as low

hydraulic pressure was noticed.

Control room is

contacted or fire alarm

is sounded

The equipment operator immediately

contacted the control room about the oil

spill and fire, and then returned to

initiate an attack on the fire.

The operator in this case acted properly

in reporting the fire. This, no doubt,

helped to mitigate the extent of the fire

and contributed to the final prompt

suppression.

Fire brigade is activated Fire brigade was activated practically

immediately and they were on the scene

within a few minutes. Local volunteer

fire department was notified and they

arrived at the plant withing a few

minutes.

Fire brigade response is considered in

PRA and this brigade responded as

quickly or more quickly than is typically

assumed.

Fire suppressant

medium is properly

applied

The equipment operator who discovered

the fire managed to extinguish the fire

initially by a dry-chemical portable

extinguisher. However, since he was

not able to close the valve to isolate the

failed filter bowl, the fire flared up

again and this time it was too strong to

be handled by a portable extinguisher. 

The manual fire brigade was able to

quickly extinguish the fire.

The actions of the fire operator on the

scene undoubtably helped to control the

fire and limit fire damage. However, in

a fire PRA it is commonly assumed that

once initiated fire fighting efforts will be

successful.
A14-11

Fire suppressant

medium is properly

applied to where the fire

is.

Using fogging nozzles, the fire brigade

attacked the fire from two sides and put

out the fire as soon as a reactor operator

closed the control valves to the two oil

headers.

The was no report of collateral damage

due to fire suppression activities.

Fire is affected by the

suppression medium

Fire was affected by the water but was

not brought under control until the oil

supply was cut from the Reactor

Building.

See note above regarding suppression

effectiveness

Fire growth is checked

and no additional

failures occur

Fire growth was checked by the fire

brigade attacking the fire from two

sides.

Fire is fully

extinguished and fire

brigade declares it as

out

The fire was fully extinguished as soon

as the supply of the oil from the two oil

headers were cut off by manually

closing two control valves in the

Reactor Building.

The fire duration in this case is typical of

the fires postulated in a PRA.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

Hydraulic valves, cables,

instrumentation and some structural

related items sustained damage from

the fire.

The damage would likely have been

captured in a fire PRA, in particular, the

damage to cables. Valves are commonly

assumed invulnerable to direct fire

damage.

Cable failure impacts

equipment outside the

fire location

Several cables failed from direct impact

of the fire. Control room ventilation

system shifted to radiation emergency

mode because of this. One primary

circulation loop train was apparently

lost due to loss of associated

instrumentation.

The ventilation mode switch may be

evidence of a spurious operation, but this

cannot be verified. The loss of a

circulation train due to instrumentation

failures would not typically be

postulated, but a plant specific review of

circuit design may have revealed this

vulnerability.

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

There are no indications of direct fire

damage to equipment needed for safe

plant shutdown. The operators had to

trip the hydraulic oil system and close

off the headers to stop release of oil into

the fire. This in turn disabled several

components needed for shutdown.

This is a case where safe shutdown

equipment was rendered inoperable, in

effect, through manual actions taken to

fight the fire (shutting of the oil supply

valves). This type of action could be

easily missed in a fire PRA.

Operators in the control

room receive messages

and respond to the

information displayed

on the control boar d or

received verbally from

the plant

The first message that led to the

discovery of the fire was loss of oil

pressure. After that several failures

occurred that did not cause much

limitation for the operators to maintain

safe reactor shutdown condition.

The operators appear to have performed

well in this incident despite the fact that

some smoke got into the control room,

and there was some difficulty with the

breathing air supply system (not enough

masks).
A14-12

Operators attempt to

control the plant

properly and bring the

plant to a safe shutdown

See above

Structural failures (if

occurred) may

jeopardize availability of

equipment

Although some structural elements were

affected by the fire, there were no

failures of structures.

Water when sprayed

over electrical

equipment may fail the

exposed equipment

no information

The cooling effect of

CO2 may adversely

impact equipment

no CO2 systems were involved

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

The audible fire detector alarm was

turned off in the control room.

This condition would likely have been

detected during PRA plant walkdowns.

A14.5 Incident Analysis

In this fire incident a relatively severe turbine building fire took place (approximate damage $2.5

millon per Reference A14-4) that impacted control room habitability. In many regards, the fire

was quite typical of those considered in a typical fire PRA. The fuel source (oil), the reason for

its exposure (a piping failure), and its ignition mode (hot surfaces) are quite typical of turbine hall

fires. The fire propagated to adjacent cable tray containing IEEE 383 qualified and non-qualified

cables. The fire severity and duration are also quite typical of the scenarios postulated in a fire

PRA analysis.

One significant insight that may be gleaned from this incident is that under special circumstances,

a turbine building fire may be important to plant safety via its effect on other parts of the plant. In

this case it affected the habitability of the control room. This ultimately was not a serious

challenge to the nuclear safety of the plant in this case, but illustrates the potential for such

challenges to arise. Smoke entered the control room via two pathways. The fire failed cables that

caused the ventilation system for the control room to shift to a mode where the system takes air

from the turbine building. There was a door between the control room and the turbine building

that was used frequently causing the ventilation system fail to establish a positive pressure in the

control room. Using current fire PRA methods it is possible for both pathways to be discovered. 

Of course, it will require a detailed analysis of the ventilation system to discover the situations as

it occurred at Fort St. Vrain. 

It must be added that it is common in fire PRAs, in case of smoke in the control room, to

conservatively assume that the room is un-inhabitable. In this incident, there were an insufficient
A14-13

number of breathing masks connected to a piped fresh air system to service the six operators

present (3 masks). This initially caused the operators to share the available masks implying that

they were working in an uncomfortable environment. At some point portable air packs were

made available to alleviate this situation. In a fire PRA the lack of sufficient breathing masks

would not be explicitly addressed. Only a detailed fire risk analysis of the control room would

identify such problem areas.

Other events of note during this incident include the silencing of the audible fire detector alarm in

the control room, and a missing valve handle causing a delay in shutting off a key valve. In a

quality fire PRA, during the walkdown, the analyst is expected to look for such plant conditions. 

This incident demonstrates the importance of conducting detailed walkdowns.

In the case of the valve handle, it is quite likely that the analyst would miss this problem since it

was associated with a secondary shutdown valve (the primary valves being local near the fire

source) and because in terms of the manipulation of plant equipment and systems, the analysis will

commonly focus on plant control and recovery actions rather than actions that might be needed to

mitigate a fire. Hence, this particular item would be easily missed in a fire PRA. It is also

interesting to note that shutdown of the oil system also led to loss of some additional plant

equipment. Again, this would be an easily missed action, although the consequence would be

anticipated given the action.

The telephone system was partially failed during this incident. Although, the impact on the

outcome of this incident was minimal, it brings out an interesting point. In fire PRA, the

availability of communication system is not explicitly modeled. Loss of phone system would

impact the possibility of contacting personnel who are not on-site. In a typical human action

analysis in a fire PRA the possibility of calling in off-duty operators is not taken into account. 

Since most accident scenarios are modeled assuming an average number of operators in the plant,

this omission is conservative.

Finally, the fact that the ventilation system for the control room switched operating modes due to

cable damage may be evidence of a spurious operation due to cable failure. This cannot,

however, be verified based on the available information. Verification would require access to, and

analysis of, the plant HVAC control circuit diagrams and cable routing details. Given that the

plant has been shut down for over a decade, this is considered unlikely, and in any case, such an

analysis is beyond the scope of this review. The likelihood and impact of spurious operations is a

current area of debate for fire PRA.

A14.6 References

A14-1 Attachment to the letter addressed to Mr. Robert O. Williams, Jr., Vice President of

Nuclear Operations, Public Service Company of Colorado, from L.J.Callan, Director of

Division of Reactor Projects, U.S. Nuclear Regulatory Commission, October 30, 1987.

A14-2 “Preliminary Report on the Impact of the FSV October 2nd Fire”, Fort St. Vrain Nuclear

Generating Station, Public Service Company of Colorado, October 30, 1987.
A14-14

A14-3 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A14-4 Schmalz, Gregory D. “Lessons Learned from the Fort St. Vrain Turbine Building Fire”,

Fire & Safety ‘94, Barcelona, Spain, December 5-7, 1994.
A15-1

Appendix 15 - Analysis of Ignalina, Unit 2 Fire on September 5, 1988

A15.1 Plant Characteristics

Ignalina is a two unit nuclear power plant located near Visaginas, Lithuania, which at the time of

the fire discussed here was a part of the former Soviet Union. The two units are both RBMK1500 type reactors. The power rating of each unit is 3,950 MWt and about 1,250 MWe provided

by two turbine generators one at 550 and the other at 700 MWE. Construction of both units

began in 1974. Unit 1 began initial power operations in either October[A15-5] or December[A15-4]

1983. Unit 2, where this fire incident occurred, began initial startup in December 1986.[A15-5] The

units started commercial operation in May 1985 and December 1987 respectively.[A15-4] A planned

third unit on the site was canceled.[A15-4]

RBMK reactors use graphite as a moderator and boiling water for cooling the core. The

generated steam is dried in the steam drum or steam separator before it is directed towards the

turbine generators. Core cooling is composed of two parts, a Left Hand Side (LHS) and a Right

Hand Side (RHS). These two sections of the core are not fully independent from one another. 

There is some interaction between them, and this includes the cooling functions as well. Each

side of the core is serviced by separate core cooling loops, each with its own steam drum and

main coolant pumps (four per side). The feedwater from the condenser is pumped into the steam

drum, which serves as the source of water for the main coolant pumps as well. 

The core for an RBMK reactor includes special reactor protection rods that travel inside

dedicated cross shaped channels and are isolated from the rest of the systems entering the core. 

In the case of Ignalina Unit 2 there were 12 such rods. The channels are cooled by a separate

water cooling system. Pumps CP-21 and CP-22, mentioned in the discussions below, belong to

the cooling system for these channels.

Room 209, where the fire occurred, is a cable spreading room in Unit 2, located under the Main

Control Room and computer room at elevation 5.9m (measured from the local grade). Ionization

type smoke detectors and a water based fixed suppression system were provided for that room. 

At the time of the fire, fire resistant coating was not applied to the cables at Ignalina but such

coatings have been applied since.

A15.2 Chain of Events Summary

On September 5, 1988, Ignalina Unit 2 was at 100% power when, at 00:52:39, the Main Control

Room received a fire alarm from room 209. The exact cause of the fire was never conclusively

determined. However, it is suspected that the fire started in one of the 220VAC cables in the

lowest of a stack of cable trays. There were apparently no external fire sources identified. The

lowest tray housed 31 cables including at least one 220 VDC cable. It is suspected that the fire

started due to overheating caused by a short circuit in one of the cables. The postulated root

cause for the short circuit is damage inflicted to the cable during plant construction and a slow

deterioration of the cable after that. It is possible that the cable had deteriorated because of

thermal cycling, thermal overload, undue mechanical tension or vibration. Inadequate circuit
A15-2

protection devices are also thought to have facilitated the overheating of the cables and thus the

possibility of an ignition.

The automatic fire suppression system in room 209 activated within a short time of the alarm

(either a sprinkler or deluge system). The fire brigade was called and plant personnel made an

attempt to check the room but could not enter because of dense smoke. Within three minutes of

notification, the fire brigade arrived at the plant with five fire engines and smoke removal

apparatus. 

Over the course of the fire incident several pumps related to core cooling and various plant

instrumentation systems were lost affecting the core’s LHS. Despite the losses, however, the

operators managed to establish feedwater flow to the affected steam drum and facilitated the

natural circulation of the coolant through the core. All systems associated with the core’s RHS

remained functional throughout the fire. Operators took some precautionary measures to ensure

that the two sides of the reactor would not adversely interact given the losses to the LHS related

systems. 

Cable faults caused numerous electrical power system failures. Instrumentation and control cable

faults caused supply breakers for normal and essential (non-safety) 6kV buses to open. Cable

damage also prevented proper alignment of two of the six diesel generators to these buses. This

led to the unavailability of the LHS reactor protection coolant pumps. Later, one of the diesel

generators started and properly connected to one of these buses, and one of the reactor protection

coolant pumps started. The power to the affected buses was restored within about 40 minutes

from the first fire alarm and the operators managed to regain normal control of the reactor and its

cooling functions at that time.

The fire also caused a partial loss of reactor core monitoring instrumentation systems. The

indications for 4 out of the 12 reactor protection channels were lost. At about 10 minutes after

the fire alarm, the operators de-energized control rod drive mechanisms to prevent any spurious

movement of the rods.

The fire brigade attempted to enter room 209 to fight the fire directly but they were forced to

retreat because of the dense smoke. At about 22 minutes into the incident, the smoke removal

apparatus was activated. The fire brigade managed to enter room 209 about 16 minutes later, or

38 minutes after the fire alarm. They found the fire completely extinguished by the automatic fire

suppression system. The fire had damaged 646 cables for a length of about 5 meters. Of these,

506 cables were associated with control and instrumentation circuits and 106 with power

distribution systems. Cables in the upper-most cable trays were also found damaged by the fire.

Apparently the cable faults caused by the fire in room 209 led to failures in the Reserve Control

Room as well. The Reserve Control Room is the back-up for the Main Control Room and it

contains a control panel that can duplicate a large number of safety related controls and

instrumentation available in the Main Control Room. For example, the level control signal for the

LHS steam drum was restored from the Reserve Control Room about 40 minutes after the first
A15-3

fire alarm. Since by this time the feedwater flow had been established, but level control was

apparently not functioning, the level was found to be above the measurable scale. 

After the fire was extinguished, diesel generator #8 developed an oil leak and had to be tripped. 

Power to one of the buses was lost again which led to loss of one reactor protection cooling

pump. These failures occurred from causes independent of the fire.

A15.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (Reference [A15-1] through [A15-3]). If the precise timing

and the order of an event is not known, the time of occurrence is not specified. However, such

events are included within the sequence of events based purely on the judgement of the authors of

this report.

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

On September 5, 1988, Unit 2 was at 100%

power (i.e., the turbine generators were

producing 550 MWE and 700 MWe).

The fire detectors and fire suppression

system for room 209 were in the automatic

mode. The ventilation system of room 209

was operational

Main coolant pump 12 was on stand-by.

00:00 At 00:52:39 on September 5, 1988, the Main

Control Room received a fire alarm from

room 209.

The exact cause of the fire could not

precisely be determined during the accident

investigation although a self-ignited cable

fire is suspected. 

Given the conclusions of the fire investigation, this

incident demonstrates that self ignited cable fires

can occur, even in a relatively low voltage circuit

(220VAC in this case). The fire experience in US

nuclear power plants contains only a few minor

self-ignited fire events. In fire PRAs, such fires

are commonly considered, but only for cables that

are not qualified as low flame spread per standards

implemented for the nuclear industry beginning in

1975 (IEEE-383). Given the differences that likely

exist in cable characteristics and electrical circuit

design features between US and Soviet-designed

plants, the Ignalina experience may not be directly

relevant to U.S. plants.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A15-4

00:00 At 00:52:49, a second fire alarm was

received from room 209 in the Main Control

Room. This alarm was also automatically

transmitted to the plant fire brigade.

At the same time, the automatic fire

suppression system in room209 was activated

automatically.

The fixed fire detection and suppression systems

did activate as designed.

00:01 At 00:53:00, the fire brigade was called. 

-- A senior engineer and another member of the

plant staff checked the situation from the

corridor next to room 209, but could not

enter the small entrance area to room 209

because of dense smoke.

00:03 The fire brigade arrived at the plant with five

fire engines and apparatus for removing

smoke from a compartment. Upon arrival,

they called for additional help and

equipment.

As is typical of plants in the former Soviet Union,

fire fighting is primarily provided by an associated

fire brigade located near the plant but off-site.

00:03 At 00:55:55, the Control Room received oil

level alarms for main coolant pump 14

(serving LHS) and the pump tripped

automatically. This caused the power level

to reduce to 2,830 MWt (60%). Cable faults

in the circuits for oil level indicators and

alarm are suspected to be the cause of the

trip. 

This is apparently a spurious trip signal caused by

fire damage to instrumentation circuits. Some fire

PRAs would not assume loss of a system given fire

damage only to associated instrumentation circuits,

although practice does vary from analyst to

analyst.

00:04 At 00:56:25, main coolant pump 13 tripped

because of cable faults related to the oil

system and reduction in oil flow to the

bearings. Loss of this second main coolant

pumps led to automatic reactor trip. The

automatic reactor trip led in turn to the

startup of all six diesel generators associated

with this unit.

This is the second system to be failed by the fire.

00:04 At 00:57:00, turbine generator #3 tripped on

low steam drum level. Reactor coolant

pressure was at 55kgf/cm2 ( 780psi)

00:04 At 00:57:15, turbine generator #4 tripped on

high level in low pressure heater #4.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A15-5

00:06 At 00:58:31, main coolant pump 11 tripped

because of cable faults. With loss of all main

coolant pumps, natural convection became

the motive force of coolant flow through left

hand side of the core. 

This is the third system failed by the fire.

00:06 At 00:59, level control of steam drum,

feedwater control valves and main coolant

pump valves, all associated with the LHS,

were lost. 

Plant personnel established feedwater flow to

the affected steam drum.

00:06 At 00:59:14, cable faults caused numerous

electrical power system failures. 

Instrumentation and control cable faults led

to the opening of supply breakers of normal

6kV buses BA and BB and essential (nonsafety) buses BV and BU. 

Cable damage also tripped Transformer 5

and prevented it from taking up the loads for

these buses.

Diesel generator #7, because of bus failures,

did not connect to bus BU. Because of this,

reactor protection system pump CP-21 failed

to operate.

Diesel generator #8 started and supplied

power to BV to 2MW load. Since BV was

powered, the reactor protection system

cooling pump CP-22 began operation.

These are cases where instrumentation and control

faults apparently led to spurious trip signals being

sent to various supply power systems and breakers. 

See note above.

00:07 At 01:00, there was a partial loss of reactor

neutron monitoring instrumentation. The

indications for 4 out of the 12 reactor

protection channels were lost.

00:10 At 01:03:20, operators de-energized the

control rod drive mechanisms to prevent any

spurious signals from causing a control rod

to move.

Main coolant pump 24 (serving the RHS)

was tripped by the operators to minimize the

possibility of adverse interaction between the

two sides of the reactor. Main coolant pump

22 was left in service.

De-energizing of the CRD system is an interesting

precautionary measure taken by plant operators. 

Whether or not this was a procedure-based action

is not clear. It does illustrate that operators were

cognizant of the spurious actuation possibility and

took actions to mitigate their potential impact.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A15-6

00:12 About 01:05, the fire brigade tried to enter

room 209 to fight the fire but was unable

because of the dense smoke.

This indicates a transit time from the plant

entrance to the location of the fire of about 9

minutes (see 00:03). This is relatively fast in

comparison to typically assumed response time

from fire PRAs.

Smoke hampering fire fighting efforts is

commonly recognized as a potential issue but is

also commonly considered unlikely based on fire

brigade training.

00:18 At 01:11, the monitor for LHS feedwater

flow was lost.

The operators energized buses BA and BU

from a working auxiliary transformer. This

initiated the operation of one reactor

protection system pump. 

00:22 At 01:15, smoke removal equipment was

activated in Unit 2 corridors.

It is not clear if this was portable or fixed

equipment. One must infer from the 10 minute

time period from initial attempts to access the fire

area to the time smoke removal was initiated that

this involved the placement of portable smoke

removal blowers.

00:27 At 01:20, an attempt was made to start main

coolant pump 12, but it did not start.

00:38 At 01:30, the fire brigade entered room 209. 

The brigade could not find a fire in the room. 

The water supply to the fire suppression

system for the room was therefore stopped. It

was concluded that the fire was extinguished

by the automatic fire suppression system.

646 cables for a length of about 5 meters was

found damaged by the fire. 506 cables were

associated with control and instrumentation

circuits and 106 were associated with power

distribution systems.

The ceiling of the room was found partially

damaged.

In this case, the fire suppression system actuated

and performed as designed. The time of detection

and fire suppression system activation imply a very

prompt system response, typical of what would be

assumed in a fire PRA.

It is interesting, however, that despite proper and

successful operation of the fire suppression system,

substantial damage was observed. It is commonly

assumed that once a fire suppression system

activates, further damage will be mitigated. In this

case, the event clearly shows that fire damage

continued to cause system losses well after the

suppression system activated.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A15-7

00:40 The level control signal for LHS steam drum

was restored from the Reserve(1) Control

Room. The level was found to be above the

measurable scale.

Note that this event indicates that a “partial

abandonment” of the MCR was exercised. 

Operators were working from both the main and

reserve control rooms to control the plant.

From the information provided in the available

sources, it can be inferred that the Main Control

Room and Reserve Control Room were not

completely independent and some of the failures

caused by the fire in room 209 rendered some

indicators and control functions on both control

panels unavailable. For U.S. plants, potential

interactions or dependencies between the control

room and remote shutdown capability are explicitly

addressed through the Appendix R analysis. It is

common for current PRAs to rely on these

deterministic assessments to assure remote

shutdown independence, but confirmation of these

assumptions was raised as a potential unaddressed

risk issue in the Fire Risk Scoping Study (SNL)

and was a common point of technical concern

raised in the USNRC-sponsored IPEEE reviews.

00:45 At 01:38, in order to prevent spurious

withdrawal of the rods, the drivers of the

rods were mechanically blocked and the

blocks were de-energized.

Recall that earlier in the event the CRD system had

been electrically de-energized. Apparently

operators did not fully trust this action and took

additional measures to prevent rod withdrawl.

00:47 At 01:40, diesel generator #8 was manually

tripped because of an oil leak from a flange. 

Power to bus BV was lost which led to pump

CP-22 of the reactor protection system to

trip. 

This represents an independent event (failure) in

that the loss of the diesel generator cannot be

attributed to causes related to the fire. Diesel

generator #8's oil system developed a leak and the

operators had to shut it down. In this case, the

impact of this event may not have been detrimental

to the capability to provide core cooling. In fire

PRAs, the possibility of occurrence of independent

events is modeled explicitly through the use of

internal events model.

-- Per Reference A15-2 “Shutdown key” on

Reserve Control Room panel was lost.

Notes: (1) The Reserve Control Room is a back-up of the Main Control Room. For Sovietdesigned plants, the Reserve Control Room generally contains a control panel that can duplicate a

large number of the safety related control and instrumentation functions in the Main Control

Room.

Equipment Damaged
A15-8

S Electrical cables (646 cables for a length of about 5 meters was found to be damaged by

the fire. 506 cables were associated with control and instrumentation circuits and 106

were associated with power distribution systems.)

Damaged Areas

S Cable Spreading Room under the Main Control Room and Computer Room.

Impact on Core Cooling 

S Safety related equipment were affected by this fire. Cooling capability for one half of the

core was affected. 

Radiological Release

S No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

S There were no reported injuries to plant or external fire brigade personnel caused by the

fire.

Public Impact

S The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

S There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A15.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire event is compared against a typical fire scenario

which is expressed in terms of a list of elements. Entries are made only if specific information was

available in the available documents. No attempt was made to postulate a possible progression of

the event no matter how plausible it could be based on the physics of the fire process, unless it

was deemed to be essential in concluding a specific insight.

Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

Presence of combustible /

flammable materials

Electrical cables were the main 

source of combustibles for this fire

incident.

Cable fires are commonly considered in

fire PRAs
Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

A15-9

Presence of an ignition

source

An electrical fault was apparently the

source of ignition in this incident. 

The fire was concluded to have been

ignited in a 220VAC cable servicing

a valve motor. It was suspected that

some of the cables were damaged

during construction and they further

deteriorated due to overheating,

vibration or mechanical tension. 

Also, the inadequate response of

circuit protection systems were

suspected to be a contributor to the

ignition of the cable.

The ignition was apparently

exacerbated by physical damage to the

cables and inadequate circuit protection. 

In fire PRA, fire initiation is handled as

a statistical process and the exact

mechanism of ignition is rarely

considered.

Ignition of the fire and

generation of heat (radiant

and convective), smoke,

and other gases

Fire investigators concluded that this

was a self-ignited cable fire. The

exact cause of cable failure and

ignition of the cables could not be

conclusively determined.

Self-ignited cable fires are considered,

in particular, for older plants that still

contain significant quantities of cable

that has not be certified as low-flamespread per IEEE-383

Fire growth within the

combustible or component

of original ignition

From the information provided, it can

be inferred that fire established itself

quite rapidly. 

It is commonly assumed in fire PRA

that cable tray fires will develop slowly

over the period of several minutes at the

least. This fire appears to have grown

more quickly than this, although

differences in U.S. versus Soviet cable

materials may have played a role so

extrapolation to US plants may be

inappropriate.

Fire propagates to adjacent

combustibles.

From the timing of the events, it can

be concluded that the fire propagated

to other combustibles (trays above the

ignition tray) nearby in a short time.

A hot gas layer forms

within the compartment of

origin (if conditions may

allow)

Clearly, a hot gas layer did form in

the fire room, but it is not clear if any

damage was cause by the gas layer

rather than direct fire involvement.

A common finding in fire PRAs (based

on fire modeling) is that hot gas layers

are not sufficiently hot so as to cause

fire damage. Rather, fire damage is

typically predicted to be limited to trays

directly in the fire or fire plume. This

incident appear to nominally support

the validity of these findings.

Effects of fire (i.e., hot gas

and smoke) propagate to an

adjacent compartment (if

pathways exist)

The fire remained in the

compartment of origin and no

damage outside the compartment was

reported.

Local automatic fire

detectors (if present) sense

the presence of the fire

The ionization type smoke detectors

did actuation, apparently within a

short time of fire initiation. 

Fire detectors performed as designed
Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

A15-10

Alarm is sounded

automatically in the

Control Room, locally and /

or other places

Alarms were sounded automatically

in the Control Room and at the

associated but fire brigade station. In

fact two alarms were received at the

initial stages of the fire, one from the

smoke detectors and a second flow

alarm on the fire suppression system.

Automatic suppression

system is activated (if

present)

The fixed automatic water system of

room 209 activated as designed. 

The suppression system apparently

actuated nearly simultaneous with the

initial fire detection by smoke detectors. 

This is an indication of very prompt

suppression system response.

Personnel are present in the

area where fire occurs

Personnel could not enter the room

because of dense smoke and low

visibility.

Given these conditions a PRA would

not typically credit any fire intervention

actions by anyone other than the fire

brigade. This event confirms the

validity of this practice.

Control Room is contacted

or fire alarm is sounded

The fire initiation time for this

incident is measured from the

moment that the Control Room

received a fire alarm from room 209.

Fire brigade is activated Plant fire brigade was activated

within a short time of the initial

alarm in the Control Room. In

addition to the Control Room, the fire

alarm sounded in the fire station as

well. Five fire engines arrived at the

plant within 3 minutes of the alarm. 

Additional equipment and personnel

were requested as well. 

The fire brigade arrived on-scene very

promptly. Typical PRAs would assume

a somewhat longer brigade response

time, particularly for brigades not

physically located on-site.

Fire suppressant medium is

properly applied

Water from the automatic fire

suppression system sprayed on the

fire. Fire fighters did not apply any

suppressants but after clearing smoke,

found the fire extinguished when they

entered the room.

Fire suppression systems are typically

designed to provide fire control rather

than extinguishment. It is interesting to

note that in this incident the fire

suppression system worked as designed

and apparently suppressed the fire

completely.

However, despite the successful

operation, extensive damage was

sustained. Even cables in the

uppermost cable trays were damaged by

the fire that apparently started in the

lowest tray.
Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

A15-11

Automatic fire suppression

system is activated

The automatic fire suppression

system activated as designed.

See note above.

Fire suppressant medium is

properly applied to where

the fire is.

The fire brigade did not conduct any

manual fire fighting.

Fire is affected by the

suppression medium

The fire was affected by the automatic

suppression system. The fire was

fully extinguished in less than 38

minutes after it was initiated.

Fire growth is checked and

no additional failures occur

The fire growth was checked by the

automatic fire suppression system. 

However, a large number of cables

(646 cables) were damage for a

length of about 5 meters.

In fire PRA it is common to assume that

if the fixed suppression system

activates, any subsequent damage will

be mitigated (prevented). In this case

damage continued well after the

suppression system activated. 

Fire is fully extinguished

and fire brigade declares it

as out

The fire was extinguished by the

automatic fire suppression system and

declared as out about 38 minutes after

the first fire detector alarmed in the

Control Room. No manual fire

fighting was necessary.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire are

affected by the fire.

A large number of cables were lost. 

No other equipment were affected

directly by the fire or smoke. There

was some structural damage to the

ceiling.

See note above regarding damage

timing versus suppression activation.

Cable failure impacts

equipment outside the fire

location

Cable failure certainly impacted

equipment outside the fire area. The

impact was mainly on the systems

serving the LHS: part of the neutron

monitoring instrumentation was lost, 

the main coolant pumps were lost,

and feedwater flow control was lost.

The reported failures apparently include

cases where control or instrument cable

failures did lead to the generation of

spurious trip signals for various

electrical supply systems. (See note in

previous table above.)
Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

A15-12

Equipment failure perturbs

the balance of plant

operation and causes

automatic systems to

respond

Three of the four main coolant pumps

for the left hand side of the core were

tripped. As a consequence the reactor

tripped. Feedwater flow control and

steam drum level were lost. The

power to several buses were lost. The

reactor protection system cooling

pumps were also affected. Overall a

large number of equipment serving

the left hand side of the core were

affected. However, the core was not

in any imminent danger of severe

overheating.

This fire did present the operators with

the loss of a number of important safety

systems. However, the operators

responded appropriately to recover the

plant to a safe shutdown state.

Operators in the Control

Room receive messages and

respond to the information

displayed on the control

board or received verbally

from the plant

The operators used the Main Control

Room and the Reserve Control Room

to monitor the condition of the

reactor and core cooling systems. 

There was partial loss of neutronics

related instrumentation. No specific

information is provided regarding the

adequacy of the information on the

control board in the Main Control

Room, reliance on Reserve Control

Room readings and interaction with

field operators.

This is one of the few fire incidents

where an attempt was made to use the

alternate shutdown panel. However,

some interaction was experienced

between the main panel and the

alternate shutdown panels (i.e., the

Reserve Control Room). In fire PRAs

for US plants it is typically assumed

that the analysis conducted as part of

Appendix R compliance has resolved

the potential interaction issues. Some

attention is given to this issue in fire

PRAs as part the response to the issues

raised in Sandia Fire Risk Scoping

Study. However, no probabilistic

analysis of the potential interactions is

conducted.

Operators attempt to

control the plant properly

and bring the plant to a safe

shutdown

Operators were able to control the

plant properly. The systems serving

the right hand side remained

available throughout the fire. The

left hand side cooling was achieved

by natural circulation and feedwater

flow into the steam drum.

There were not significant operator

errors noted.

Structural failures (if

occurred) may jeopardize

availability of equipment

The ceiling of the cable spreading

room was found partially damaged.

Water when sprayed over

electrical equipment may

fail the exposed equipment

No information

The cooling effect of CO2

may adversely impact

equipment

Not applicable
Fire Scenario Element Incident - Ignalina 2, September 5,

1988

Fire PRA Insights

A15-13

Conditions may exist at the

time of the fire that may

aggravate the impact of the

fire on plant systems

Main coolant pump 12 was on standby at the time of the event and could

not be started.

A15.5 Incident Analysis

The fire incident at Ignalina 2 can be considered as a classic case of relatively modest cable

spreading room fire that ignited on its own, propagated to adjacent cables, was detected in a short

time, and was extinguished by the automatic suppression system that functioned as designed. 

The fire remained confined to its compartment of origin, and damage was apparently limited to

one stack of cable trays. The cables affected by the fire belonged only to a limited number of

systems and components, and core cooling and reactor monitoring was never completely lost in

this incident. Despite the available components and systems, the set of cable faults experienced in

this incident made it difficult for proper control of the reactor core parameters and core cooling

for the LHS. This is a scenario that is commonly postulated in fire PRAs.

One interesting aspect of this fire is that while the suppression system functioned as designed, and

even extinguished the fire (the design basis for a typical automatic suppression system is to

control the fire and not necessarily extinguish it completely), extensive damage was sustained. 

Furthermore, additional equipment losses were recorded well after the fire suppression system had

actuated. This incident demonstrates that it may not be proper in a fire PRA to assume that

activation of a fixed suppression system would stop any further damage from occurring. 

However, it must be added that a direct extrapolation of this incident for refuting the above

mentioned assumption may be premature. The characteristics of the cables used at Ignalina would

have influenced the propagation of the fire, apparently despite fire suppression system activation. 

It is not clear what correspondence (or lack thereof) there might be between cables used in the

U.S. and those used in the Soviet designed plants.

This incident also demonstrates that self-ignited cable fires can occur. Furthermore, such fires can

happen in relatively low voltage circuits (220VAC in this case). Fire PRAs treat fire ignition

possibility through a statistical analysis of relevant fire incidents. For self-ignited cable fires, the

fire experience in the nuclear power plants in the U.S. contains only a few minor incidents. For

cases where the cables are certified as low-flame-spread (per IEEE 383) it is common to dismiss

self-ignited cable fires as of extremely low probability. This incident neither supports nor refutes

this aspect of fire PRAs given the differences that likely exist in cable characteristics and electrical

circuit design features between US and USSR plants.

It is also interesting that in this event, operators acted from both the main and reserve control

rooms. From the information provided in the available sources, it can be inferred that at the time

of the fire the Main Control Room and Reserve Control Room at Ignalina were not completely

independent. This is because some of the failures caused by the fire in room 209 rendered some

indicators and control functions on both control panels unavailable. In fire PRAs for US plants,
A15-14

the Appendix R compliance analyses are commonly cited as ensuring the independence of the

alternate shutdown capability. Verification of independence, rather than assuming independence,

has been raised as a potential risk issue in both the SNL Fire Risk Scoping Study and in the

USNRC-sponsored reviews of the IPEEE submittal. Again, given that the electrical design

practices of the Soviet plants is likely substantially different from that of the US, the Ignalina

experience may not be directly applicable to US plants.

A15.6 References

A15-1 Section IV, “Analysis of the Event: Partial Loss of the Control Room Unit 2 Due to Fire

in Cable Room, 1988”, in English

A15-2 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A15-3 Soloviev.P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A15-4 1999 World Nuclear Industry Handbook, Nuc. Eng. Int., 1999.

A15-5 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.
A16-1

Appendix 16 - Analysis of Oconee 1 Fire on January 3, 1989

A16.1 Plant Characteristics

Oconee is a three unit nuclear power plant located near Seneca, South Carolina. All three units

are nearly identical 860 MWE Babcock and Wilcox design, pressurized water reactors. Unit 1

started commercial operation in July 1973. Each reactor has four reactor coolant pumps (RCPs). 

At Unit1, two of the pumps are powered by an Auxiliary Power System 6.9kV switchgear

designated as 1TA and the other two by another Auxiliary Power System switchgear designated

as 1TB. The following design/control features played a role in the fire incident being reviewed.

Per the technical specifications, reactor cooldown should be less than 50oF per 30 minutes. Main

coolant loop pressure is maintained by controlling the sprays and heaters of the pressurizer. The

normal pressurizer spray is fed from one of the cold legs of the main coolant loops. If control of

the pressure via the pressurizer is not possible, the operators can use one of the following three

methods:

S The Power Operated Relief Valve (PORV) of the pressurizer can be used to

relieve main coolant into the Quench Tank.

S An auxiliary spray is available for the pressurizer using the high pressure injection

system. 

S By throttling open the Turbine Bypass Valve, steam from the steam generators can

be dumped into the main condensers.

The plant, for normal operation, is controlled by the Integrated Control System (ICS). One of the

features of the ICS is to automatically, upon loss of all reactor coolant pumps and availability of

main feedwater function, swap the feedwater flow from the main feedwater nozzles to the

auxiliary nozzles and to increase steam generator level to 50%. These actions facilitate

establishing of natural convection cycle in the main coolant loop. 

A16.2 Chain of Events Summary

On January 3, 1989, Unit 1 was being brought up to power after a trip that had occurred a few

days earlier. It had reached 26% power at 19:16 when the 6.9kV Switchgear (1TA) failed

explosively and caught fire. The precise cause of this incident could not be established in later

investigations. As a result of the switchgear failure, the main turbine and two reactor coolant

pumps tripped initiating a reactor transient.

The operators immediately started reactor power reduction. Average reactor temperature was

575EF at the beginning of the incident. Initially core cooling was maintained by the two operating

reactor coolant pumps and main feedwater flow through the steam generators. Two high pressure

injection pumps were started by the operators to compensate for contraction of the water in the

main coolant loop as it was cooling down due to the power reduction. When the power dropped

to 4%, the operators tripped the reactor.
A16-2

Meanwhile, fire alarms were received in the control room. The fire brigade was activated to

respond to the fire. Later, off-duty shift personnel were called in to assist in the fire fighting

effort. Two initial attempts by the fire brigade to suppress the fire using carbon dioxide and dry

chemical fire extinguishers failed to put the fire out. Control room operators de-energized the DC

power bus in order to isolate the impacted 1TA switchgear from all electrical sources. It was then

decided to apply water to the fire using a fog nozzle. To further protect the fire fighters, the other

train of non-safety 6.9kV switchgear (i.e., 1TB), located near 1TA, was also de-energized. The

water fog was used on the fire and at 20:15, about one hour after the switchgear failure, the fire

was declared as completely extinguished. 

Tripping of 1TB (to protect the fire fighters) caused the remaining reactor coolant pumps to trip. 

The Integrated Control System (ICS) is designed, under these conditions, to raise the water level

in the steam generators to 50% and swap the feedwater nozzles from main to auxiliary. Due to

fire damage to signal cables, the ICS failed and the operators had to execute these two actions

manually. However, in doing so the operators forgot to close the main feedwater valve. This

further accelerated the rapid cooldown process that was already underway. Furthermore, since

the operators focused on in-core thermocouple readings to monitor reactor temperature, they did

not properly monitor the rate of cooldown at different points of the main coolant loop.

Cold leg temperature dropped to about 426EF in about one hour. The shift engineer and shift

supervisor determined that the temperature in parts of the reactor may have dropped faster than

100EF in one hour, which means that they may have entered the Thermal Shock Operation Region

(overcooling).

Because operators had started the high pressure injection system, reactor pressure reached 2355

psig for a short time. Later, the pressure reached 2385, also for a short time. Operators then

stopped the high pressure pumps to control the high pressure condition. These two pressure

spikes, combined with the possibility of operating in thermal shock region, could have endangered

the integrity of the main vessel if the conditions had persisted for an extended time.

At some point in the incident smoke did find its way into the main control room. The extent of

the smoke and the path by which the smoke found its way into the control room are not described

in the available sources. It is not clear if the smoke had any impact on operator performance,

although one report cites this (rather in passing) as a contributing factor to the errors that led to

the overcooling transient.

A16.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available source [Ref. A16-1]. If the precise timing and the order of an event is

not known, the time of occurrence is not specified. However, it is included at an order of

presentation based purely on the judgement of the authors of this report. 
A16-3

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Relative

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

Unit 1 had in the days before the fire tripped

and was being brought back to power. The

reactor had reached 26% power level at the time

of the fire. Units 2 and 3 were operating at

100% power.

00:00 At 19:16, 6.9kV auxiliaries were manually

transferred from the startup transformer to the

main transformer (1T). Differential alarms

were received in the control room on two of the

three phases on 1T.

00:00 Switchgear 1TA failed explosively and caught

fire. The causes of this event could not be

established in later investigations. Two

scenarios were suspected -- arcing at “plug-in”

connections or a fire in the DC control circuits

inside the switchgear that caused high voltage

parts to arc and fail explosively. 

Main turbine and two reactor coolant pumps

tripped as a result. 

This incident involved and explosive fault in a

switchgear panel. Typical fires modeled in a

fire PRA involve an initial ignition that grows

over time. In this case, the fault was energetic

and ignited a substantial fire.

00:01 Fire alarms were received in the Control Room,

which was followed by telephone calls reporting

of a fire and an explosion at 6.9kV switchgear

1TA. The switchgear was de-energized.

Detection of the fire was very prompt as would

be consistent with a typical PRA. Fire PRA will

typically assume prompt detection given fixed

detection systems.

-- The fire brigade was activated to respond to the

fire.

There were no delays in declaring the fire and

initiating a response.

-- Reactor ran back to 14% power.

00:13 At 19:29, the DC control power was removed at

1DIA and 1DIB buses to completely isolate 1TA

switchgear from power sources.

-- Smoke entered the Control Room. The

available information [Ref. A16-1] does not

elaborate on how smoke entered the control

room nor how dense it was. If the operators had

to don breathing apparatus, this would likely

have been mentioned in reports. Since it isn’t

mentioned, this is taken to indicate that the

smoke density was low.

Smoke propagation is not explicitly addressed

in fire PRAs. This incident demonstrates that a

fire outside the Control Room can lead to smoke

inside the Control Room. In Reference [A16-1],

it is stated that the smoke may have had some

impact on operators’ performance. However, no

details are provided.
Relative

Time

(hr:min)

Event or Step Description Fire PRA Implications

A16-4

00:17 At 19:33, carbon dioxide was applied to the

burning switchgear. It did not put the fire out.

PRAs typically assume that once initiated, fire

fighting efforts will be successful. The two

failed fire suppression attempts demonstrate that

the availability and application of a fire

suppressant does not necessarily lead to fire

extinguishment. Rather, the effectiveness of the

fire suppression system or method is important. 

Fire fighting is a decision-making process

involving the selection and application of fire

suppressants, and this decision making process

is not explicitly modeled in current PRAs

00:25 At 19:41, dry chemical extinguisher was

applied. This also failed to extinguish the fire.

00:29 At 19:45, the shift supervisor declared an

Unusual Event.

00:39 At 19:55, operators started reactor power

reduction. Average reactor temperature 575F.

00:40 At 19:56, two high pressure injection pumps

were started by the operators to compensate for

the shrinkage of the water in the main coolant

loop as it was cooling down because of power

reduction.

00:41 At 19:57, Technical Support Center and

Operational Support Center were activated.

-- Shift supervisor asked for off-duty shift

personnel to be called in to assist in the fire

fighting effort.

00:42 At 19:58, a suction valve on the High Pressure

Injection system from the Borated Water

Storage Tank opened automatically and a

reactor coolant loop injection valve throttled

open.

00:43 At 19:59, decision was made by fire brigade

leaders and shift supervisors to use water to

fight the fire. 

Here again fire fighting is seen as a progressive

exercise in decision making. See note above.
Relative

Time

(hr:min)

Event or Step Description Fire PRA Implications

A16-5

00:44 At 20:00, reactor power had decreased to 4% of

full power and the reactor was tripped

manually. The two remaining reactor coolant

pumps were also tripped manually in

preparation to de-energize 1TB switchgear. 

At 20:00, the operators de-energized 1TB

switchgear to allow for the fire fighters use

water on the fire.

With the de-energizing of 1TB, effectively two

opposite trains of a system, albeit a non-safety

system, were temporarily out of service. This

demonstrates that it is not necessary for the fire

itself to cause all system trains to fail. In the

course of fire fighting, equipment may be deenergized possibly leading to the unavailability

of redundant trains. Current fire PRA

methodologies include provisions for analyzing

the actions that should be taken by fire brigade. 

In that analysis, such special condition as that

discussed here may be discovered and modeled

properly.

00:44 The Integrated Control System (ICS) that

controls the normal plant operation was affected

by the fire because of signal cable failure. Upon

loss of reactor coolant pumps and main

feedwater available, the ICS is designed to raise

steam generator levels to 50% and swap

feedwater nozzles from main feedwater to

auxiliary feedwater to facilitate natural

circulation in the main coolant loop. It failed

to implement these two actions.

Failure of the ICS was a direct result of fire

damage to the associated signal cables. This

would have likely been predicted in a fire PRA.

00:48 At 20:04, reactor pressure reached 2,355 psig,

the set point for Reactor Protective System.

The Turbine Bypass Valve was throttled to 10%

open by the operators.

00:49 At 20:05, the operators manually increased

steam generator levels to 50% and swapped

feedwater from main feedwater nozzles to the

auxiliary nozzles. However, the main feedwater

block valves were left open (in error), which

further enhanced the rapid cooldown process.

 

Turbine bypass valves closed automatically.

An error of omission occurred at this point in

the chain of events. In fire PRA such errors are

modeled as an integral part of the event tree and

fault tree models developed for the internal

events analysis. The human error probability

assigned to these events is generally includes

consideration of the conditions that fire imposes

on the operators. However, it is common to

assume that actions in the main control room

are not impacted by fires in other plant areas. 

The fire in this case created the need for a

manual operator response, but it is not clear

whether or not the fire directly increased the

likelihood that failures might then result.

-- The high pressure injection system caused the

main coolant loop pressure to reach 2395 psig.
Relative

Time

(hr:min)

Event or Step Description Fire PRA Implications

A16-6

00:50 At 20:06, apparently due to internal system

control features the high pressure injection

valve first opened fully, then closed completely. 

Operators stopped the high pressure pump 1A

because of the increasing pressure and placed

the pump in the automatic mode.

00:54 At 20:10, plant personnel determined that the

requirements for “Thermal Shock Operating

Region” has been met. 

A control room operator tried to establish high

pressure injection auxiliary pressurizer spray to

depressurize the reactor, but his efforts were not

successful. Later, a containment entry was

made and the isolation valve for this spray path

was found closed.

Failure of the auxiliary spray capability was

caused by an independent failure (i.e., not

related to the fire). This failure had an impact

on the chain of events, and demonstrates the

importance of such events. In fire PRA,

independent failures are modeled explicitly

using the event trees and fault tree of the

internal events model. 

00:54 The high pressure injection pump 1A was

started.

-- A second rapid pressure increase of the main

coolant loop took place. The pressure reached

approximately 2300 psig.

00:59 At 20:15, water fog was used and the fire was

declared as completely extinguished.

This fire was of relatively long duration in

comparison to typically modeled PRA fire

scenarios. In this case, there was a substantial

delay in the application of effective suppression

methods.

00:59 Cold leg temperature reached 426F. 

Given a drop of more than 100EF per hour from

the average temperature of 575EF in the main

coolant loop augmented by two pressure spikes,

there was a threat of thermal shock.

Thermal shock is generally considered in

internal events PRAs. However, it is often

eliminated from the sequence models because

multiple random equipment failures reduce the

likelihood of such an event. Fire PRAs

commonly rely on these same internal events

models. Fire can act as a common threat to

several items whose simultaneous random

failure probability may be very low. 

Elimination of low-frequency sequences in the

internal events analysis may have implications

for the fire analysis.

01:47 At 21:03, 1TB switchgear was re-energized

02:03 At 21:19, the Technical Support Center was

established.

02:04 Cold leg temperature reached 398F
Relative

Time

(hr:min)

Event or Step Description Fire PRA Implications

A16-7

02:34 At 21:50, members of the Technical Support

Center determined that Thermal Shock

Operating Region (TSOR) was not reached. 

However, recommended, after reactor coolant

pump restart, to maintain the reactor in a three

hour soak period to allow vessel and other

reactor parts to reach a steady state condition.

Equipment Damaged

S 6.9kV switchgear.

S Electrical cables (including ICS cables)

Damaged Areas

S The damage was limited to a switchgear and electrical cables nearby.

Impact on Core Cooling

S Core cooling was maintained at all times during the incident. The reactor was

subjected to rapid cooldown and may have entered thermal shock operating

region. 

Rediological Release

S No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

S There were no reported injuries to plant or external fire brigade personnel caused

by the fire.

Public Impact

S The health and safety of the public was not affected by the fire or its impact on the

plant.

Environmental Impact

S There were no radiological releases, contamination or any other environmental

impact other than the smoke release into the atmosphere.

A16.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire incident is compared against the elements that make

up a typical fire PRA fire scenario. Entries are made only if specific information was available in

the available documents. No attempt was made to postulate a possible progression of the event

no matter how plausible it could be based on the physics of the fire process, unless it was deemed

to be essential in concluding a specific insight.
A16-8

Fire Scenario Element Incident - Oconee 1, January 3, 1989 Fire PRA Insights

Presence of combustible /

flammable materials

Switchgear cabinet contents and

electrical cables around the switchgear

were the available combustibles.

Presence of an ignition source Electrical equipment were the source of

ignition.

Ignition of the fire and

generation of heat (radiant and

convective), smoke, and other

gases

The exact cause of ignition could not

be determined. Arcing at the

connectors or a DC circuit related

component fire may have led to the

energetic failure of the switchgear.

In this case, the initial fault was

energetic in nature and the fire,

in effect, bypassed the typical

fire initiation and growth stages

assumed in a PRA. It would

appear that the entire switchgear

panel was engulfed in fire almost

instantaneously.

Fire growth within the

combustible or component of

original ignition

1TA switchgear failed explosively and

its internal components caught fire. 

Fire propagates to adjacent

combustibles

Cables near the switchgear caught fire. This is a case where a fire

starting inside an electrical panel

did propagate out of the panel. 

Some PRA methods discount this

possibility, and this was a topic

of debate with regard to

application of the EPRI Fire

PRA Implementation Guide to

the IPEEE analyses (see report

body for further discussion).

A hot gas layer forms within the

compartment of origin (if

conditions may allow)

No information provided

Effects of fire (i.e., hot gas and

smoke) propagate to an adjacent

compartment (if pathways exist)

From Reference [A16-1] it can be

inferred that some smoke found its way

into the control room.

This event demonstrates that

smoke can propagate to other

locations. In fire PRA smoke

propagation is generally not

modeled in detail. 

Local automatic fire detectors (if

present) sense the presence of the

fire

The fire detectors activated within a

short time of switchgear failure.

Alarm is sounded automatically

in the control room, locally and /

or other places

Fire alarm did sound in the control

room.

Automatic suppression system is

activated (if present)

No information provided. It is inferred

that the switchgear area was not

protected by a fixed automatic

suppression system.
Fire Scenario Element Incident - Oconee 1, January 3, 1989 Fire PRA Insights

A16-9

Personnel are present in the area

where fire occurs

No information is provided although

personnel did report an explosion in

the switchgear room to the MCR.

Control room is contacted or fire

alarm is sounded

The control room was contacted by

telephone, about the fire in a short time

after switchgear failure.

Fire brigade is activated Fire brigade was activated immediately

upon receiving news about the fire.

Fire suppressant medium is

properly applied

Two attempts to suppress the fire were

made with portable CO2 and dry

chemical extinguishers, but it was not

successful. The fire re-flashed in both

cases. The power to 1TA was

completely de-energized (including the

DC power). The power to the adjacent

switchgear 1TB was also de-energized

by the operators to allow for the use of

water with fogging nozzles.

The failure of initial fire

suppression efforts is not

typically considered in a fire

PRA. A PRA would have

assumed a very high probability

of suppression and no further

damage based on the initial fire

brigade response time.

Automatic fire suppression

system is activated

It is inferred that there was no fixed

fire suppression system.

Fire suppressant medium is

properly applied to where the fire

is.

No collateral damage due to fire

suppression was reported.

Fire is affected by the

suppression medium

The fire was finally extinguished by the

use of water in about one hour.

Fire growth is checked and no

additional failures occur

No information is provided regarding

fire growth and extent of fire damage. 

It is inferred that the fire remained

limited to the switchgear of origin and

cables adjacent to the switchgear itself.

Fire is fully extinguished and fire

brigade declares it as out

Using water, the fire was completely

extinguished in about one hour.

This fire was relatively long

(about one hour) compared to

fires typically modeled in a fire

PRA (10-30 minutes).

As heat and smoke are

generated, equipment, cables and

structural elements near the fire

are affected by the fire.

Switchgear 1TA was lost, as it was the

source of the fire. Fire damaged cables

near the switchgear.

The impact of fire damage would

likely have been predicted in a

fire PRA.
Fire Scenario Element Incident - Oconee 1, January 3, 1989 Fire PRA Insights

A16-10

Cable failure impacts equipment

outside the fire location

Switchgear failure and de-energization

led to the unavailability of several

components needed for normal reactor

cooling and power operation. Cable

failure led to failures of certain

functions of ICS.

Equipment failure perturbs the

balance of plant operation and

causes automatic systems to

respond

Loss of 1TA switchgear led to tripping

of two reactor coolant pumps. The

reactor power level started decreasing. 

At a certain point ICS had to adjust

steam generator level to 50% and swap

feedwater nozzles from main to

auxiliary. It failed to do so because of

cable damage. 

Operators in the control room

receive messages and respond to

the information displayed on the

control boar d or received

verbally from the plant

The instrumentation was not affected

in this incident. In-core thermocouple

readings were the focus of the

operators. Adequate attention was not

given to cold leg temperature. Because

of this the operators did not realize that

rapid cooldown is underway and there

is a potential for the reactor entering

the thermal shock operating region.

It is not clear how much the

operators were influenced by the

fire and its effects (i.e., failures

and smoke in the control room). 

In fire PRA, operator errors are

modeled explicitly. 

Methodologies exist that attempt

to model the influence of

complex set of events on human

error probability. However, it is

interesting to note that this

incident, since it occurred in non

safety related switchgear with no

safety related cables and

equipment affected, would be

considered as an insignificant

risk contributor and would be

screened out in the initial stages

of the analysis.

Operators attempt to control the

plant properly and bring the

plant to a safe shutdown

Operators took the steam generator

levels to 50% and swapped the

feedwater nozzles, but forgot to close a

main feedwater valve. This omission

added to the overcooling scenario. The

operators started high pressure

injection system to makeup the water

in the main coolant loop that had

shrunk. HPI activation led to pressure

spikes (twice) over the course of the

incident.

Operator errors are modeled in

fire PRAs. The available report

attributes the error, at least in

part, to the presence of smoke in

the control room, although the

actual role of the smoke remains

unclear. Most PRAs assume that

in-control room actions are not

impacted by fires outside the

control room.

Structural failures (if occurred)

may jeopardize availability of

equipment

No structural damage was reported.
Fire Scenario Element Incident - Oconee 1, January 3, 1989 Fire PRA Insights

A16-11

Water when sprayed over

electrical equipment may fail the

exposed equipment

Switchgear 1TB was de-energized to

allow for the use of water on the

burning switchgear.

PRAs would not typically

consider that nearby equipment

will be de-energized to facilitate

fire fighting.

The cooling effect of CO2 may

adversely impact equipment

Reference [16-1] does not indicate

occurrence of such a phenomenon.

Conditions may exist at the time

of the fire that may aggravate the

impact of the fire on plant

systems

Several independent failures occurred

in the course of this fire. An isolation

valve inside the containment had been

left closed that prevented the use of

auxiliary pressurizer spray. A push

button was stuck on the control board

that caused a device to cycle several

times. The yoke bearing of a feedwater

valve experienced a mechanical failure. 

The feedwater control valves

experienced calibration drifts.

In this incident several

independent failure occurred. In

fire PRA, an important element

of calculating the core damage

frequency for a fire scenario is

the proper accounting of

independent failures that may

occur in tandem with the fire. 

This incident demonstrates that

such failures can occur and may

influence the chain of events.

A16.5 Incident Analysis

The most important insight from this incident is that a fire in non-safety-related area led to a

potential challenge to reactor safety. The fire occurred in a non-safety switchgear that is not colocated with any safety related cables or equipment. In a fire PRA this fire scenario would

generally be considered as risk insignificant, and would likely have been screened out from

detailed analysis because of the lack of any threats to safe shutdown equipment.

The significance of this incident also lies in the actions that the operators took in the control room

in that they caused an overcooling transient that had the potential to cause a thermal shock. It is

not clear whether or not the mistake made by the operators (i.e., failure to close the main

feedwater valve) was influenced by the fire itself. However, by failing the ICS, the fire did put the

operators in a position where they had to take additional manual control actions, and it was while

they were taking these actions that the mistake occurred. Reference [16-1] also states that some

smoke did enter the control room and implies that this was, at least in part, the reason that

mistakes were made. The smoke ingress aspect of the incident is not well described in the

available information; hence, it can not be determined whether or not there was any actual

discernible impact on control room habitability.

In fire PRA, operator errors are modeled explicitly. Methodologies exist that attempt to model

the influence of complex set of events on human error probability. In fire PRAs it is widely

assumed that fires outside the control room will not impact operator actions that take place within

the control room. In this case there may have been such an influence, although the evidence for

this is inconclusive. The chain of events experienced during this fire incident (i.e., a fire in a nonsafety area of the plant leading to a complex chain of events with operator interactions and

mistakes) would not typically be identified as a risk significant scenario in a typical fire PRA.
A16-12

In this incident the most significant operational impact was the overcooling transient coupled with

high reactor pressures. The possibility of thermal shock of the main vessel has been addressed in

some internal event PRAs. Fire PRAs commonly use the same event sequences as those used in

the internal events analysis. However, often in the internal events analysis, the analysts make

simplifying assumptions based on the likelihood of a given chain of events. In fire conditions, the

likelihood of a given chain of events may be significantly greater than that calculated in internal

events analysis. However, if the chain of events is eliminated during the internal events process,

the fire analysis may not recognize that chain of events as a potential risk scenario. The fire

versus internal events difference lies in the fact that fires can simultaneously impact several items

including, in particular, cables. In the internal events analysis, the same equipment would be failed

as a result of random factors that are not correlated. Sequences involving multiple random

failures quickly become probabilistically insignificant. In this incident, the fire damage caused two

of the four reactor coolant pumps to trip, failed parts of the Integrated Control System (ICS), and

affected the control room operators to an undetermined extent.

This incident also demonstrates that even with rapid detection, fire fighting can be a prolonged

process and that the application of a fire suppressant does not necessarily lead immediately to

either fire control or fire extinguishment. In this case two initial suppression attempts were

ineffective, and the fire ultimately burned for over an hour. In many current fire PRAs fire

duration is based primarily on the manual fire brigade response time. This approach may not be a

proper representation of the potential chain of events that may occur. Earlier PRA methods had

commonly utilized generic fire duration probability curves based on historical experience. These

curves would inherently capture this type of behavior, but are not amenable to plant-specific

adjustments. This issue is discussed further in the body of this report.

It is also interesting to note that the neighboring switchgear (1TB) was purposely de-energized in

order to facilitate fire fighting and protect fire fighters from electrical hazards. With the fireinduced loss of 1TA and de-energizing of 1TB, two opposite trains, albeit non-safety trains, of a

system were taken out of service. This demonstrates that equipment may be lost from causes

other than direct fire damage in a fire incident. That is, actions taken to support fire fighting may

also lead to the intentional isolation of redundant trains and this may have unanticipated

consequences. A parallel example of such a condition lies in the so called self-induced station

blackout (SISBO) that has been incorporated in the procedures of a few power plants. The

SISBO procedure instructs the operators to intentionally isolate as-yet unfailed equipment. This is

done to isolate the adverse effects of a cable fire. Current fire PRA methodologies include

provisions for analyzing the actions that should be taken by the fire brigade and are nominally

capable of dealing with these kinds of actions. However, other than SISBO type scenarios,

actions such as manual isolation of an unaffected train are rarely identified or considered. This is

discussed further in the body of the report.

A final aspect of this incident that is of interest is the explosive nature of the initial electrical fault. 

It has been observed that certain electrical faults will be manifested as an energetic release of

electrical/thermal energy. In this case, a 6.9kV switchgear faulted with an explosive release of

energy substantial enough to have been heard in other areas of the plant. This is not the typical

fire modeled in a fire PRA. Typical fire PRAs will assume a fire that ignites, grows within the
A16-13

initial fuel package, and then exposes and potentially spreads to adjacent combustibles. In this

case, the initial fire initiation and growth behavior was essentially by-passed, and a rather

substantial fire was apparently ignited as a result of the fault. There are no clear indications as to

how extensive the initial fire actually was. However, the fire did clearly propagate and caused

damage to cables outside of the originally involved panel. This has been an area of

methodological debate, in particular, associated with the IPEEE process. See the body of the

report for further discussion.

A16.6 References

A16-1 Licensee Event Report # 26989002, “Fire in 1TA Swtichgear Due to Unknown Cause”,

Oconee Nuclear Station, Unit 1, Event Date 01/03/89.

A17-1

Appendix 17 - Analysis of H. B. Robinson, Unit 2 Fire on January 7, 1989

A17.1 Plant Description

H. B. Robinson, Unit 2 is a 665 MWE Westinghouse design, pressurized water reactor located

near Hartsville, Southern Carolina. Unit 2 is the only nuclear unit on the site. The plant started

commercial operation in March 1971.

A17.2 Chain of Events Summary

At the time of this incident the plant was in a refueling outage. At 22:30, on January 6, 1989, as

part of an air test of the main generator, a maintenance crew erroneously connected the

instrument air header to the main generator hydrogen manifold using a rubber hose. This allowed

the bulk hydrogen supply, which is at 120 psig, to be directly connected to the 95 psig station

compressed air system. The configuration was such that hydrogen flow to the generator was

blocked, but flow into the Station Air System was not. Hence, hydrogen spread into the plant’s

general purpose compressed air system.

At the time this hose connection was established the Station Air compressor was out of service

and the Station Air System was connected to the Instrument Air System. The Station Air System

was in greater demand because air-driven tools were being used throughout the plant. This

caused the majority of the hydrogen to migrate into the Station Air System. 

Approximately one hour after the connection had been made, it was noticed that generator

pressure had not increased. At approximately the same time a small fire was discovered in an air

junction box inside the turbine building, on the turbine deck. The fire was extinguished quickly

and no damage was noticed. Approximately three hours after the connection was made, a

contract worker reported that flames were coming out of his air operated grinder. Upon this

discovery, all work that could cause a spark was stopped and the use of the air system was

prohibited.

Samples of the air were taken at several locations. The hydrogen concentration was discovered to

range from 50% to 150% of lower explosive limit. The hydrogen had migrated into the entire

system at practically all plant locations, including the auxiliary building and the containment. No

further fires apparently occurred, and the system was eventually purged of hydrogen.

A17.3 Incident Analysis

This incident is of interest to the current review because it illustrates a somewhat unique point,

namely, that unexpected fire sources can arise during a refueling outage. In this case, at least two

minor fires occurred, and there was clearly an inherent potential for more, and perhaps more

serious, fires. Only a few shutdown fire PRAs have been conducted. The typical methodology

follows the same process as that used in an at-power fire PRA. It is unlikely that a typical fire

PRA of any type would have identified an error of this type as a possible contributor to fire risk. 

In this event flammable gas was introduced into a system and areas of the plant that are normally
A17-2

void of such gases. Also, it created a condition where several, potentially severe fires could have

occurred at the same time at different locations of the plant. The possibility of multiple fires is not

addressed in fire PRAs.

A17-4 References

A17-1 Licensee Event Report # 26189001, “Hydrogen Introduced Into the Instrument Air

System”, H. B. Steam Electric Plant, Unit 2, Event Date 01/07/89.
A18-1

Appendix A18 - Analysis of Calvert Cliffs, Unit 2 Fire on March 1, 1989

A18.1 Plant Description

Calvert Cliffs is a two unit nuclear power station located near Lusby, Maryland. Both units are

850 MWe Combustion Engineering PWRs. Unit 2 started commercial operation in April 1977. 

A18.2 Chain of Events Summary

On March 1, 1989, Unit 2 was operating at 100% power. At 16:45 a fire was discovered in a

control panel in the Main Control Room. An operator was in the process of verifying a repair on

the over-speed trip mechanism of the Auxiliary Feedwater Pump trip/throttle valve actuator. As

part of this procedure, the operator put the hand switch for the valve in the “shut” position. The

shut position indicating light flickered and a buzzing noise was heard on the control panel. The

operator repeated the action with the same result. The operators opened the panel cover and

discovered a fire at the hand switch. Using a hand-held Halon extinguisher, the operators put out

the fire in 1-2 minutes. In the meantime, a 10amp fuse in the associated circuit blew. Since the

fire was extinguished quickly, the control room supervisor did not call out the fire brigade.

When the fire was discovered, a turbine building operator was called to reset the throttle valve. 

In the attempt to reset the valve, that operator discovered that a solenoid associated with the

valve was smoking. There were no visible flames. The solenoid stopped smoking apparently

when the 10amp fuse blew. The fire in the main control room panel caused some damage to wires

nearby. No other damage was noted from this incident. This incident did not cause a significant

safety hazard and its impact was limited to an isolated part of a safety related system. The lack of

damage can be at least in part attributed to the immediate response of the operator whose actions

had led to the fire being initiated.

A18.3 Incident Analysis

This incident caused very limited damage and had no real impact on plant safety. Hence, the fire

was not severe from either a classical or nuclear safety perspective. It is included in this review

because this is one of only a very few incidents in the U.S. lending insight into multiple fire

ignitions in a single incident. In this case there was a small fire in the main control room, and an

incipient fire (the smoking solenoid) in the auxiliary feedwater pump room. Once again, the

common link in the fire is a common electrical circuit. In fire PRAs, the possibility of

simultaneous fires in two different compartments is not generally addressed. See further

discussion in the body of this report.

A18.4 References

18-1 Licensee Event Report # 31889004, “Auxiliary Feedwater Pump Trip Circuitry Fire in

Control Room Due to Maintenance Error”, Calvert Cliffs, Unit 2, Event Date 03/01/89.

A19-1

Appendix 19 - Analysis of Shearon Harris Fire on October 9, 1989

A19.1 Plant Description

Shearon Harris is a 900 MWE, Westinghouse design PWR located in New Hill, North Carolina. 

The plant started commercial operation in May, 1987.

A19.2 Chain of Events Summary

On October 9, 1989, the plant was operating at full power. At 23:05, a turbine generator and

main power transformer differential relay tripped and started a chain of events that led to fires at

three locations involving one main transformer and the main generator. As a result of the relay

trip, the main generator output breaker also tripped. This in turn caused a turbine trip and a

reactor trip. The auxiliary feedwater system actuated as designed. However, the turbine driven

pump failed to operate properly. Motor driven auxiliary feedwater pumps were used. The

operators closed the main steam isolation valves to limit the cool-down rate.

The initial cause of the event was multiple ground faults in a bus duct near the “B” main power

transformer. Reference [A19-1] states that the cause of the ground faults is thought to be

aluminum debris carried into the duct by the forced air ventilation system used for cooling the bus

duct. The debris is suspected to have entered the ventilation system as a result of two damper

failures, one that occurred on February 27, 1988 and a second during the summer of 1989. The

ground fault caused arcing over a fifty foot length of the bus. The arcing reduced the dielectric

strength of the air. The air, per the design of the system, entered the bushing box of the

transformer. This caused ground faults in the bushing box, which led to a crack in the low

voltage bushings. The bushing crack, in turn, led to a spill of oil and ignition of a fire at the

transformer (the first fire).

The faults in the main transformer bushing box and the “A” bus duct, caused the voltage of the

generator neutral to become elevated. A current transformer was mounted around the neutral

conductor, and was isolated from the neutral conductor by insulating tape. The insulation

resistance of the insulating tape was apparently insufficient to withstand the elevated neutral

voltage, and an electrical breakdown occurred causing the neutral conductor to short to ground. 

The arcing caused by this short burned holes in generator related piping, which in turn allowed

generator hydrogen to escape and catch fire (the second fire). The oil in the main generator

housing above the hydrogen fire was subsequently ignited (the third fire).

At 23:09, the Control Room was notified of a fire at the "B" main power transformer, and an oil

fire on the second level of the turbine deck underneath the main generator. The site fire brigade

was activated immediately. The fire fighters also noted a hydrogen fire on the second level of the

turbine deck underneath the main generator. The deluge system at the main transformer activated

as designed.

Off-site fire departments were also contacted shortly after the initiation of the incident to assist in

the fire fighting efforts. Later, the prompt notification of outside fire departments was credited as
A19-2

having limited the damage caused by the fires.

As noted above, the auxiliary feedwater system actuated automatically in response to the incident. 

However, the turbine driven auxiliary feedwater pump tripped shortly after it started. The cause

of the trip was later determined to be a spurious over-speed trip signal from the tachometer. No

link between the failure of the auxiliary feedwater pump and the fire has been established, and this

appears to have been an independent (random) failure event.

At 23:35, an alert was declared and the Technical Support Center (TSC) was activated. By 00:13

October 10 (a little over 1 hour after initiation of the event), the oil fire at the generator housing

was extinguished. Also, the fire at the main power transformer was believed to be under control

by the deluge system. The hydrogen fire underneath the generator was also considered under

control.

By 01:45, a small residual oil fire at the main transformer was extinguished using portable dry

chemical extinguisher. By this time, all three fires were considered extinguished. By 02:45 (2

hours and 40 minutes after incident initiation) walk-downs were completed to verify that all three

fires were extinguished. Fire watches were posted at the fire locations and the main generator

was purged with carbon dioxide.

A19.3 Incident Analysis

The fires in this incident were of relatively long duration, about 1 hour 45 minutes total, and were

relatively severe from a classical fire protection perspective. However, from a nuclear safety

perspective, the overall impact of the fires was relatively modest. The plant did trip automatically,

and an auxiliary feedwater pump did fail, apparently a random failure. However, the operators

responded appropriately to the situation and properly controlled the plant shutdown including

proper control of the cool-down rate. This incident again demonstrates that not all fires that are

severe from a classical fire protection standpoint are severe from the nuclear safety perspective. 

As noted elsewhere in this report, this is fully consistent with the findings of current fire PRA

studies.

The incident is of interest to the current review primarily because it is one of the few incidents in

the U.S. that involves multiple fires occurring concurrently. The incident demonstrates that

multiple fires may occur simultaneously at different areas of a plant. As seen in other such

incidents, one of the common links was a common electrical system. However, the secondary

hydrogen fire was apparently the result of damage caused by the failure of the current sensor on

the generator neutral cable so there are multiple contributing factors, rather than simply a

common electrical system that becomes overloaded. Concurrent multiple fires are not addressed

in current fire PRAs. As discussed in detail in the body of this report, current fire PRA methods

could, at least in theory, predict the potential impact of multiple fires if the locations and

characteristics of the individual concurrent fires could be established. However, there is currently

no basis for identifying the frequency or characteristics of multiple fire incidents.

A19.4 References
A19-3

A19-1 Licensee Event Report # 40089017, “Electrical Fault on Main Generator output bus

Causing Plant Trip and Fire Damage in Turbine Building”, Shearon Harris Nuclear Power

Plant, Event Date 10/09/89.

A20-1

Appendix 20 - Analysis of Vandellos, Unit 1 Fire on October 19, 1989

A20.1 Plant Characteristics

Vandellos Nuclear Power Plant Unit 1, which is currently decommissioned, was a gas cooled,

natural uranium fueled, graphite moderated reactor located 140 km South of Barcelona, Spain. It

shared the site with Vandellos, Unit 2, a pressurized water reactor. Vandellos, Unit 1 started

commercial operation in May 1972 and has not been operated since the October 19, 1989 fire

incident described in this appendix. The rated thermal power of Unit 1 was 1750 MWt. It used a

concrete pressure vessel and CO2 as the primary coolant. Each unit had two turbine generators,

rated at 250 MWe each. There were four steam driver turbo-blowers for primary circuit coolant

(i.e., CO2) recirculation. After shutdown, one blower could provide sufficient cooling. 

A20.2 Chain of Events Summary

At 21:39 on October 19, 1989, while the plant was operating at partial power level (about 80%),

the high pressure section of turbine No. 2 ejected 36 blades. The turbine blade failure was later

attributed to stress corrosion phenomenon. The blade ejection altered the balance of the turbine

leading to high vibration and excessive friction around the turbine shaft. This in turn caused the

shaft to come to a full stop within a few seconds. Vibration also caused the seals around the

generator to fail allowing hydrogen gas to escape. According to available reports, the escaped

hydrogen is thought to have ignited on the hot surfaces of the shaft. Available reports also state

that a hydrogen deflagration did occur, but apparently caused no significant damage.

The ejected blades also cut through turbine lube oil lines. All oil pipes feeding the bearings of the

high pressure side of the turbine and one pipe for the bearing located between the two low

pressure turbines were broken spilling the lube oil. Hot surfaces caused by the excessive shaft

friction are thought to have served as the ignition sources for the oil as well. The oil supply

system, upon loss of oil pressure in the bearings, started all four oil pumps and transferred, in 55

seconds, close to 4,500 liters (more than 1,100 gallons) of oil to the broken pipes. A total of

about 12,000 liters (more than 3,000 gallons) of oil spilled into the turbine building from the

severed pipes during the course of this incident.

The control room became aware of the incident almost immediately because of the loud noise

caused by blade failure, the reported hydrogen deflagration and observations made through a

window from the control room that overlooked the turbine hall. At 21:40, a minute after blade

ejection, the external fire brigade was called. At 21:54, 14 minutes after being notified, the offsite fire brigade arrived. It took them until 04:00 on October 20 (more than 6 hours from

ignition) to extinguish the fire using hose streams.

Of the four coolant loops of the reactor, two (numbers 3 and 4) failed because of fire-induced

cable failures. In addition to the turbo-blowers, the fire caused the shutdown heat exchanger (a

defense in depth feature) to fail as well. Core cooling capability remained available through steam

generators No. 1 and 2, their associated feedwater pumps and turbo-blowers. However, the

control of feedwater flow proved to be difficult. The control air supply was lost because hot
A20-2

gases under the ceiling of the turbine building damaged the copper piping of the air system (this

was presumably due to failure of solder joints in the piping). Operators, using SCBAs and hand

held lighting, entered darkened and smoke filled valve rooms to manually adjust the flow control

valves.

The turbine lube oil, as it was burning, cascaded down to the lower floors of the turbine building

and created a pool of burning oil underneath the turbine. A part of the oil flowed down along a

wall and behind a large (2m diameter) pipe from the circulating water system. A rubber expansion

joint was located on the pipe near the location where burning oil was flowing down along the

wall. The joint was directly exposed to the flames and softened. It eventually ruptured at the

point that was closest to the wall. The rupture allowed seawater to spill into the basement of the

turbine building. The joint itself, because of water flow, did not burn. 

Water from the broken pipe joint collected in the basement of the turbine building. A sufficient

amount of water escaped to cause a large pool to form. The building sump pumps did not

activate because the cables feeding the pumps were damaged by the fire. The water also entered

the reactor building’s lowest elevation through an open door and through piping and cable

penetrations. The water in the reactor building and turbine building basements eventually reached

a depth of 81cm (about 32 inches).

The sprinkler system in the turbine building activated as designed. However, it did not control the

fire because there were no sprinkler heads near where the fire occurred. It is interesting to note

that, despite the proper operation of the sprinkler system protecting the hydraulic oil tank, the fire

overwhelmed the sprinkler system and the tank was completely destroyed.

Smoke entered other areas of the plant and activated the suppression systems in areas where there

were no actual fires burning. Smoke also entered the control room. Self contained breathing

apparatus (SCBA) were issued to control room operators. However, the SCBAs were not used

(apparently the smoke level never reached a point where operators felt the SCBA was needed). 

Portable fans were brought in to clear the smoke and provide fresh air into the control room. 

The fire ultimately damaged 90% of Turbine Generator No. 2 and 10% of Turbine Generator No.

1 as well as numerous cables and the one pipe joint.

A20.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (Reference [A20-1] through [A20-4]). If the precise timing

and the order of an event is not known, the time of occurrence is not specified. However, it is

included at an order of presentation based purely on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.
A20-3

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

Stress corrosion eroded the strength of turbine

blades. The blades were not inspected specifically

for this phenomenon.

Prior to

the

incident

The door between basement of Turbine and

Reactor Buildings was left open. This was

apparently in violation of administrative control

requirements. 

Often a small probability is assigned to the

likelihood of a door being open that is

administratively required to be kept closed. 

This event points to the importance of

inspecting the plant in a detailed walkdown,

as part of fire PRA, where the existing

conditions are observed and recorded

carefully. However, the possiblity of the door

being left open might still be judged small if

the door happened to be closed at the time of

the walkdown.

Prior to

the

incident

The plant was operating at 400 MWE output. 

Turbine Generator Number 1 at 190 MWe and

Number 2 at 210 MWe.

00:00 At 21:39 on October 19, 1989, Turbine No. 2

ejected 36 blades from wheel number 8 because of

stress corrosion phenomenon. This led to high

vibration of the turbine (located on elevation

+16.0m), and friction around the shaft, which

caused the shaft to come to full stop within a few

seconds of blade failure. The friction energy

caused the shaft to reach red hot temperature

range.

A vibration alarm (>180micron) and Turbine

Generator No. 2 trip annunciation was received in

the control room. 

The control room had a window overseeing the

turbine generators. A flash was seen in the control

room and the shift operator manually tripped the

reactor. Fire was observed in the high pressure

turbine housing and in the generator vent at the

excitor side. Fire alarms (audible and luminous)

were received in the control (the exact time of the

alarm is not known)

In a typical fire PRA, ignition of oil fire in

turbine building is assumed to occur from an

arbitrary cause. The specific causes are

generally not addressed explicitly. However,

it is commonly assumed that oil is released,

ignited and a large fire ensues. 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-4

-- The vibration (actually a jump) caused the

generator’s terminals and the seals to fail and

allowed 5m3 of hydrogen to escape. The escaped

hydrogen ignited on the hot surfaces of the shaft

and deflagrated. An eyewitness described

hydrogen burning as a fire ball leaving the bottom

of the generator, traveling horizontally towards the

bottom of the turbine. The eyewitness noted that

the fireball took a spiraling (scrolling) movement

as it went from the generator towards the turbine. 

The deflagration was very short and it only

charred (not burnt) the areas where it touched. The

instrumentation within the area were tested after

the fire and were found in working condition. 

However, the deflagration did damage a movable

ceiling at elevation +16.0 meters.

Two types of fires occurred - a deflagration of

hydrogen gas and a large oil fire. In a typical

fire PRA, only one type of fire is postulated. 

Since, extensive damage is often postulated

for turbine building fire scenarios, lack of

consideration of simultaneous occurrence of a

deflagration and a fire is of minimal

consequence.

In this particular case the hydrogen fire

apparently caused no significant damage.

The oil fire was ultimately the fire of most

significance. In a typical fire PRA the

specific details of oil fire is generally not

considered. This event points out that the

analysts cannot assume that the quantity of

oil involved in the fire is limited to the oil

within the turbine. Under special conditions,

the entire contents of the oil storage tank may

have to be postulated at a location away from

the oil storage tank itself.

-- The ejected blades cut through turbine oil lines.

All oil pipes feeding the bearings on the high

pressure side of the turbine and one pipe for the

bearing located between the two low pressure

sections were broken. Hot surfaces caused by shaft

stoppage served as the ignition sources for the oil

as well. The oil supply system, upon loss of oil

pressure in the bearings, started all four oil pumps

that sent the oil from the storage tank to the

broken pipes. Per the design feature of the oil

system, it was impossible for the control room to

manually stop the oil pumps when they started on

low oil pressure. This eventually led to 11,000

liters (about 3,000 gallons) of oil being pumped

out through the open pipes.

-- A cascade of burning oil poured to the lower

elevations of the turbine building. Oil also poured

on cable trays, causing part of the flow to be

diverted horizontally. In all cases the oil was

burning as it was flowing about. Eventually the

bulk of the oil dropped down to the lowest

elevation floor, formed a burning pool and flowed

towards the floor drain. The pool fire damaged all

of the equipment in its pathway to the drain. 

In this case the fuel (oil) was quite mobile

and spread readily. In a typical fire PRA,

fires are assumed to occur in a particular

location. Hence, this aspect of the fire may

not have been captured in a typical fire PRA. 

Severe oil fires occurring in various areas of

the turbine building would likely have been

postulated as noted above, but each scenario

would likely have considered a relatively

confined fire.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-5

00:01 Within 55 seconds of blade failure, close to 4,500

liters (more than 1,100 gallons) of oil were spilled

from the broken pipes that fueled the fire (see note

1). (See 00:06 below - eventually 12,000 liters

(more than 3,000 gallons) of oil was ejected from

the broken pipes.)

Even by the standards of a typical fire PRA

turbine hall fire scenario, this is a very large

quantity of burning oil. Some fire PRAs do

consider catastrophic loss of the turbine hall. 

However, other fire scenarios would typically

involved more limited fires.

00:01 At 21:40, the external fire department was called

by radiotelephone to respond to the fire and the

plant management and reserve personnel were

notified (per procedures).

The plant maintained a fire brigade of plant

personnel who were trained and certified in fire

fighting techniques. A 5-member team was on

site for every shift. If the fire brigade had to be

activated, the reserve personnel would be called in

to look after the plant while the brigade is focused

on the fire.

-- The oil fire propagated to other combustibles --

some of the cables in the lower elevation of the

turbine hall and the hydraulic oil in its storage

tank. The insulating material of cables were PVC.

-- A part of the oil went down against a wall, behind

a 2 meter diameter pipe from the circulating water

system. A rubber (reinforced by a metallic mesh)

expansion joint was located at this same location. 

The expansion joint was 2m in diameter (as was

the pipe), 40cm long and 1.5cm thick. The joint

became directly exposed to the flames and

softened. It eventually broke from water pressure

at the part that was closest to the wall opening a

vertical gash in the joint of about 2 meters long

(this is about 1/3 of the circumference of the joint). 

The area of the break is estimated to be about

2,000 cm2 ( 310 in2) The opening allowed

seawater to spill into the basement of the turbine

building. Burning oil collected on top of the pool

created by the spilled water. The expansion joint,

because of water flow, did not burn. The normal

flow rate through the circulating water pipe is

12m3/s ( about 190,000 gpm) at about 18oC

temperature. 

This event, failure of the expansion joint,

would not typically be captured in a fire PRA. 

The location of the joint with respect to the

oil pipes and the turbines led to the

possibility of direct flame impact. In a

typical PRA, the chain of events leading to a

breach in the integrity of a water carrying

system is not considered. As mentioned

above, in a typical turbine building fire

analysis, it is postulated that the fire is large

and damages all those items that are

susceptible to fire. However, large waterfilled pipes and associated equipment are not

generally considered vulnerable to fire

damage because of the large heat capacity of

the water inside the pipe. This event directly

contradicts this common assumption, at least

in the case of flexible rubber expansion

joints.

Failure of the pipe joint did lead to

significant flooding of two buildings. PRAs

would not typically consider a large flood

concurrent with a fire.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-6

-- The sprinkler system in the turbine building

activated as designed. However, it could not 

control the fire because there were no sprinkler

heads near where the fire had started. The

sprinkler system inside the turbine building only

covered the oil storage tanks (lubricating and

hydraulic oils) and big motors. The rest of the

Turbine Building had fire detectors only. 

At the hydraulic oil tank, the fire suppression

system was an open head (deluge type) system.

This system was activated by heat detectors with

one alarm level. The detector did activate, the fire

water pump did start and valves to feed the

sprinklers did open.

At the lubricating oil tank, the sprinklers heads

were also of open (deluge) type. The system

activated on heat, optical and smoke detectors that

were arranged in two alarm levels. At the first

alarm level, the fire water pump was started and a

permissive signal was given for opening the

isolation valve of the concerned area from the

control room. At the second alarm level, pump

operation would be confirmed and the valve would

open automatically, thus allowing fire water to

spray from the open heads.

The fixed fire suppression systems did

actuate as designed but covered only select

areas of the building. They were apparently

ineffective at either controlling or

extinguishing the fires.

In conducting a fire PRA, as part of the

detailed analysis, the characteristics of the

fire protection system for each fire area is

studied. Such systems are commonly

credited with suppressing fires quickly and

effectively (on the order of 95% reliability or

higher). This incident illustrates the need to

consider both the system design and the fire

threats that it may face in assessing system

effectiveness.

Note that if only manual fire brigade actions

are postulated, the likelihood of a large fire in

the turbine hall would be postulated to be

significant.

-- As noted above, water from the ruptured expansion

joint and the fire suppression systems collected in

the basement of the turbine building. Although,

there is no eyewitness confirmation, it is inferred

in the available reports that the burning oil floated

on top of this water spreading the fire further.

Occurrence of major flooding as a result of

fire is not postulated in a typical fire PRA. 

Although, theoretically speaking, current

methodologies can accommodate the proper

identification of such events, in a typical fire

PRA the progression of the event scenarios is

not carried through to such level of detail to

allow for the identification of additional

external event phenomena.

-- The sump pumps in the turbine building did not

activate because the cables feeding the pumps were

damaged by the fire. 

Cables for a system such as sump pumps

would not typically be identified in a fire

PRA. Hence, the potential for loss of these

pumps would not typically be captured by a

fire PRA analysis.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-7

-- The water also entered the reactor building lowest

elevation because of an open non-water tight door. 

There were also cable and pipe penetrations in the

wall separating the two buildings that would have

allowed the water through. The flood depth

reached 81cm at elevation +3.50m of the turbine

and reactor buildings.

See note on fire and flooding above.

-- Smoke entered the control room through the

ventilation system. The control room is located at

+28.20m elevation of the electrical/control

building, next to the Turbine Building The control

room was about 50m from the fire itself. SCBAs

were provided for the operators, but they did not

use them.

Propagation of smoke and its impact on plant

personnel is typically addressed using

conservative and simplified models. The

possibility of smoke egress into the control

room is often not considered, unless there are

clear indications that this could be possible. 

If a fire PRA were to be conducted of

Vandellos 1 prior to the incident, given that

the control room ventilation communicates

with the turbine building, the analysts would

likely have postulated the possibility of

smoke inside the control room. Actually, it

would have conservatively been assumed that

the control room would become inhabitable.

00:06 In a few minutes, the three oil transfer pumps,

transferred all the oil in the storage tank into the

severed oil piping. A total of about 12,000 liters

(3,000 gallons) of oil spilled into the turbine

building from the severed pipes and caught fire

(note 1).

-- The cables for non safety 5.5kV switchgear DG2A

that provided power to condenser, feedwater and

vacuum pump loads was lost.

00:07 At 21:46 Turbo-Blower No. 4 (provides primary

coolant flow) failed because of cable failure. The

cables to safety related 5.5 kV switchgear DS4A,

that powers Turbo-Blower No.4 was lost. A 10m

length of cable tray, located in the lowest level of

the turbine building, was damaged from direct

exposure to fire. 

It is suspected that cable fire contributed heavily to

smoke generation during the fire.

The cable trays were doused with burning oil. 

In a typical PRA cables are assumed to be

exposed to external fires. In this case a PRA

would have likely postulated a pool fire on

the floor below the cables. The observed

damage would likely have been covered in

fire PRAs as part of a postulated large fire. 

However, this incident points out that the

typical fire propagation calculation methods

may not be valid for such a scenario.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-8

00:10 At 21:49 Turbo-Blower No. 3 and the feedwater

pumps for heat exchangers no. 3 and 4 failed

because of cable failure. The cables to safety

related 5.5 kV switchgear DS3A, that powers

Turbo-Blower No. 3 was lost. As for DS4A, 10m

length of cable tray was damaged at the lowest

level of the turbine building.

00:10 Electric cables of the power supply for the

shutdown heat exchanger was lost.

-- Power to the safety and normal lighting was lost. 

Battery powered emergency lighting remained

functional. 

Loss of lighting is not typically explicitly

postulated in a fire PRA. This incident

points out that for human action analysis and

human error probabilities, severe

performance shaping factors may have to be

postulated.

-- Per Reference [A20-3], none of the cable failures

led to spurious actuations or instrumentation drift

on the control board.

It is not known whether or not the potential

for spurious actuations did, in fact, exist. In

particular, since the damaged cables were all

in the Turbine Building, it is not clear what

portions of the impacted instrument and

control circuits were threatened. Hence the

implications of this “negative” finding

regarding spurious operations are not clear.

00:15 At 21:54, outside fire brigade arrived. Up to 30 fire

fighters came to the site to help in putting out the

fire. Outside fire fighters were not familiar with

the plant and feared radiological exposure. To

alleviate these problems, a member from the

available plant personnel was assigned to each fire

fighting team.

In typical fire PRAs, the impact of external

fire brigade on the progression of the fire is

combined with the plant brigade in an overall

manual fire fighting model. In this incident,

the external fire brigade did not have any

adverse effects on the fire. However, the

training and familiarity of external fire

brigades with plant layout and special

conditions may need to be taken into account

when it is assumed that a large turbine

building fire will eventually be brought under

control.

-- Fire fighters used hose streams to attack the fire.

They attacked the fire from elevation +9.00m and

+16.00m. The fire fighters had to work in total

darkness using hand-held flashlights. There were

no additional failures attributed to the fire fighting

activities.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-9

-- Smoke was pumped into other areas of the plant by

the ventilation system. In the reactor building this

activated the suppression system at certain

locations. The air intake of the reactor building

ventilation was in the turbo-generator area of the

Turbine Building, above elevation +16.0m. Also,

the doors between the turbine and reactor

buildings at elevation +3.50m and +9.00m were

not tightly closed.

The spread of smoke to areas remote from the

fire points out that some special attention is

warranted in the human error probability

evaluation. Plant conditions may be

degraded by movement of smoke, and

therefore, human error probabilities taken

directly from the corresponding internal

events PRA may not be applicable.

It is also interesting that this incident

involved spurious actuation of a fire

suppression systems in areas remote from the

fire. In the U.S. reliance on smoke detectors

for fire suppression actuation is no longer

common (due largely to adverse spurious

actuation experience). No damage due to

suppression activation was reported.

-- Hot gases accumulated under the floors and the

ceilings. Some equipment damage occurred near

+9.00m ceiling at areas not reached by the flames. 

No damage were noted at elevations below the

ceiling level. Copper pipes of the control air

system melted under the ceiling and caused failure

of automatic control of feedwater control valves.

The loss of the control air system piping

integrity would not be captured in a typical

fire PRA. Fire PRAs typically focus on

cables, and may not consider the loss of other

equipment. Some special attention to solderjoint air control supply piping in fire PRAs

may be warranted if, for example, the

operation or failure of air-operated valves is

risk important.

-- Although the main part of the fire was only 10

meters from the lubricating oil tank at elevation

9.00m, the combined effect of sprinkler system and

fire brigade hose streams managed to protect the

tank from catching fire.

-- The hydraulic oil tank was entirely destroyed by

the fire, despite the presence of and successful

operation of the sprinkler systems. This tank was

located at elevation +3.50m, under the high

pressure side of the turbine. It was doused by the

burning oil raining down from the elevations

above this point. The access to the area became

impossible for the fire fighters during the first

hour. Therefore, the tank did not benefit from the

fire fighting activities.

This incident points out that a fixed

suppression system may be overwhelmed by

the fire. An important basic assumption

underlying fire PRA methodology is that all

fire protection systems are properly designed

and will be effective against postulated fire

threats. This incident points out that, at least

in such areas as the Turbine Building where

large concentration of combustible materials

exist, this underlying assumption may not be

valid in all cases.

-- From live broadcasts of the fire on TV and radio,

many plant personnel heard about the event and

came to the plant to help.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-10

00:30 The ventilation system for the control room was

stopped to prevent further smoke ingress. Portable

fans were brought to the control room to clear the

smoke and bring in fresh air from non-smokey

areas of the plant. Operators remained in the

control room at all times from the beginning of the

fire and did not have to wear breathing apparatus. 

No equipment failures occurred because of the

smoke in the control room.

Smoke in the MCR was apparently not severe

given that operators never felt the need to

don their SCBAs. In a fire PRA conservative

assumptions are made if smoke is assumed to

enter the control room. This would typically

lead to MCR abandonment. However, it is

also rare for a fire PRA to postulate that

smoke from fires outside the control room

would actually enter the control room.

-- Operators did not need to take any actions within

the areas impacted directly by the fire. However,

the operators had to take actions at other parts of

the plant that were either without a functioning

lighting and/or engulfed in smoke. Also, the

public address system was not functioning as a

result of the fire.

Fire PRAs will typically make conservative

assumptions with regard to operator actions. 

Actions that require entry into a smoke-filled

room would not typically be credited. By the

same token, most fire PRAs do not explicitly

consider potential smoke spread, and would

commonly assume that areas not directly

involved in the fire could be safely entered

for manual actions. Hence, it is likely that a

fire PRA would have given credit to many of

the cited manual actions that were taken.

01:54 Beyond 23:33 no additional electrical faults

appeared. 

It can be concluded that the effective fire

duration was about 2 hours. This brings up

an interesting issue about the duration of a

fire. From PRA standpoint, when the fire

stops to propagate such that no additional

failures of safety related equipment would

occur, the severity of the fire, given the

typical compartmentilization of the plant,

becomes of secondary importance to the risk

model. Attention to such detail, of course, is

non-conservative and may not be warranted

for most fire scenarios of a PRA.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A20-11

02:00 In the first two hours of the incident, the feedwater

and condenser pumps were used in an on/off mode

of operation (i.e., the pumps were run at full flow

or stopped). Operators were able to regain

controlled auxiliary feedwater flow to main heat

exchangers No. 1and 2 by manually adjusting the

flow control valves at the valve location at

elevation +9.00 of the reactor building which was

filled with smoke. The operator had to use an

SCBA to be able to approach the valve. Although

there were no specific written procedures for the

actions taken by the operators at those valves, the

operators’ experience (over 15 years) in plant

operation and periodic training were considered as

key contributors to the success of valve

manipulation operations. The operators knew the

proper position of the valves to stabilize water

levels in the turbo-blower’s condensers and in the

heat exchanger. During the periodic training

(administered for one week once per six weeks),

manual adjustments to the automatic control of the

system was always covered.

See note above about operator actions and

smoke spread.

In a typical fire PRA, no credit is given to

operator actions beyond established

procedures. Clearly, this event demonstrates

that the assumptions regarding nonproceduralized actions as used in fire PRAs

are conservative.

03:51 At 01:30, the fire was declared under control. The

damage was later estimated to be 90% of Turbine

Generator No. 2. The other turbine generator did

not sustain any damage.

04:21 At 02:00, the intense spraying on the fire stopped.

06:21 At 04:00, fire was declared as completely

extinguished

Note 1 - There is some inconsistency between two sources regarding the total quantity of oil

spilled and spill rate. A second source reports that 6000 liters spilled in the first 6 minutes

and a total of 15,000 liters burned during the fire. 

Equipment Damaged

S Turbine Generator No. 2

S Turbine auxiliary equipment

S Electrical cables, that led to failure of:

S Turbo-Blowers No. 3 and 4

S Feedwater pumps to heat exchangers No. 3 and 4

S Turbine building sump pumps

S Control air to valves

S Shutdown heat exchanger

S Area lighting in many parts of the plant

S The public address system

S Condenser control valves
A20-12

Damaged Areas

S About 90% of Turbine Generator 2 was damaged. Smoke propagated into the

control building and the control room. Flooding occurred at the lowest elevation

of the Turbine Building and Reactor Building.

Impact on Core Cooling 

Core cooling was maintained at all times. At no time during the fire, did core cooling

functions stop. Fuel cladding, the primary envelope and the containment were not

adversely affected by the fire. Core cooling capability remained available through steam

generators No. 1 and 2 and associated feedwater pumps and turbo-blowers. Two turboblowers remained fully functional (i.e., blower speed control remained available). Only

one blower is needed to provide sufficient core cooling. However, the control of

feedwater flow proved to be difficult. Control air supply was lost. In the first two hours,

the feedwater flow control was achieved using the system in an on/off mode of operation

(i.e., full flow or stopped). This caused the pressure and temperature of CO2 in the

primary circuit to oscillate around a large range. The range, although outside the normal

operating values, remained within the authorized limits. The flow control valves for the

steam generators were locally (manually) adjusted after the second hour. A previous

computer simulation of the event found that if the remaining two turbo-blowers had been

lost and complete shutdown of the feedwater pumps had occurred, core damage was

estimated to ensue at about 70 hours after the initiation of these additional failures. The

long time period is mainly due to the thermal inertia provided by the gas-graphite reactor

design. Given this time period, some substantial recovery actions could have likely been

accomplished to prevent core damage (as demonstrated by other events covered by this

review).

Rediological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

There were no injuries to plant or external fire brigade personnel caused by the fire.

Public Impact

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A20.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire event is compared to the elements that make up a

typical fire PRA fire scenario. Entries are made only if specific information was available in the

available documents. No attempt was made to postulate a possible progression of the event no
A20-13

matter how plausible it could be based on the physics of the fire process, unless it was deemed to

be essential in concluding a specific insight.

Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

Presence of combustible

/ flammable materials

Turbine lubricating oil and hydrogen were

the primary combustibles in this event. 

Cable insulation was a partial contributor

to the combustible load. Hydraulic oil

also caught fire. 

Presence of an ignition

source

A turbine blade ejection event was the

root cause of the fire, but ignition was

attributed to hot surfaces created by the

severe vibration of the shaft that led to

shaft stoppage from friction.

Ignition of the fire and

generation of heat

(radiant and

convective), smoke, and

other gases

Blade ejection led to double ended break

of several oil pipes and generator seal

failure. Oil and hydrogen ignited on hot

shaft surface.

In a typical PRA, only those sources of

ignition that are present at all times

are considered. The possibility of an

accident creating an ignition source is

not generally modeled. However,

since the frequency of fire initiation is

based on a statistical analysis of the

fire events, the impact of unusual

conditions leading to fire ignition is

covered by those frequencies to the

extent experienced by the fire events. 

Given this understanding, a current

fire PRA would consider oil/hydrogen

fires as a result of turbine failure.

Fire growth within the

combustible or

component of original

ignition

Hydrogen deflagrated through its vapor

cloud and dissipated rapidly.

Oil started burning and flowing

downwards. It created a burning pool of

fire under the turbine and along various

cable trays.

The mobile nature of the oil would not

be explicitly modeled in a typical fire

PRA. For example, the oil cascading

onto cable trays directly would not

typically be captured. Rather the fires

wold likely be postulated to be an oil

pool on the floor. Several such fire

locations would be postulated

individually.

Fire propagates to

adjacent combustibles

The fire propagated to cables inside cable

trays where the oil had fallen. Cascading

oil also caused the hydraulic oil storage

tank to catch fire.

See note above regarding the mobility

of the initial fuel. Fire PRAs typically

considered fire source that remain

where they initiate.

A hot gas layer forms

within the compartment

of origin (if conditions

may allow)

Hot gas layer formed under the ceilings

and caused damage at elevation +9.00m.
Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

A20-14

Effects of fire (i.e., hot

gas and smoke)

propagate to an adjacent

compartment (if

pathways exist)

Smoke propagated to other parts of the

plant and caused initiation of automatic

suppression system. Smoke entered the

control room. Mitigative steps were taken

to minimize the impact of smoke on the

operators. The operators did not have to

leave the control room.

This event verifies that suppression

systems outside the fire area may

become activated from smoke ingress

into other parts of the plant depending

on the system design (in this case

actuation by smoke detectors). Such

scenarios are typically considered in

fire PRAs conducted for U.S. plants as

part of a deterministic survey of

various fire related issues. 

Local automatic fire

detectors (if present)

sense the presence of the

fire

Automatic fire detectors sounded an alarm

inside the control room in a very short

time after fire ignition. 

Alarm is sounded

automatically in the

control room, locally

and / or other places

The control room became aware of the

fire almost immediately because of the

noise caused by blade ejection and by

visual observation through a window

overlooking the turbine hall.

Automatic suppression

system is activated (if

present)

Sprinkler and deluge systems inside the

Turbine Building were activated as

designed. However, there were no

coverage in some of the areas where fire

occurred and therefore, it could not

control the fire.

Personnel are present in

the area where fire

occurs

Personnel were present in the turbine

building when the event started. There

were eyewitness accounts of how

hydrogen gas deflagrated and how oil

cascaded down to a lower floor.

Control room is

contacted or fire alarm

is sounded

Control room personnel became aware of

the fire almost immediately because of the

window between the control room and the

turbine building and the loud noise caused

by blade ejection.

Fire brigade is activated Outside fire brigade was called within one

minute of fire ignition. A 30 person team

responded and applied water hose streams

to the fire.

Fire suppressant

medium is properly

applied

Hose stream was used to fight the fire. 

The sprinkler system had only partial

coverage of the building
Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

A20-15

Automatic fire

suppression system is

activated

Automatic sprinkler and deluge systems

were activated but, because of lack of

coverage in the area of fire proved to be

ineffective in controlling the fire.

In the case of the hydraulic oil system,

since the fire fighters did not train their

hose streams on them, despite the

sprinkler system, the tank was destroyed

by the fire.

This event demonstrates the

importance of special conditions

influencing the effectiveness of fire

suppression system. One of the

objectives of walkdowns conducted as

part of fire PRA is to identify special

conditions under which the

suppression system may fail to be

effective.

In a fire PRA it is assumed that the

fire protection system is properly

designed to handle all possible fire

scenarios of the area. The possibility

of the suppression system being

overwhelmed is not considered.

Fire suppressant

medium is properly

applied to where the fire

is

There is no evidence in the available

sources that the fire fighting efforts led to

additional damage or complications,

including areas where spurious actuations

were observed.

Fire is affected by the

suppression medium

It took about 4 hours for the fire brigade

to control the fire, and another two hours

to extinguish the fire

This is a rather long fire in

comparison to fire typically postulated

in a fire PRA.

Fire growth is checked

and no additional

failures occur

At about 2 hours after the start of the fire

no additional failures were observed.
Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

A20-16

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire

The burning oil cascaded down to the

lower elevations of the turbine building. 

It caused the failure of cables in cable

trays underneath the turbine and it caused

the failure of a rubber expansion joint on

a 2m diameter circulating water pipe. 

The rubber failed from softening under

high temperature conditions and led to

water spilling into the basement of the

turbine building.

Heat damage breached the control air

piping and led to loss of control air

pressure.

Smoke from fire initiated automatic

suppression systems outside the

immediate fire area.

Smoke propagated to other parts of the

plant including the control room through

the ventilation system that interacted with

the turbine building.

Some minor structural damage was later

noticed that was attributed to hydrogen

explosion.

In fire PRA the possibility of

secondary effects, such as flooding

caused by expansion joint failure, is

not typically considered. Large waterfilled pipes are commonly assumed to

be invulnerable to fire damage. This

event demonstrates that in fire PRA

the analysts should focus attention on

the specific chain of events that may

ensue given a fire’s propagation. 

The loss of the control air piping also

would not typically be considered in a

fire PRA.

Smoke propagation is modeled in fire

PRAs using simplified assumptions.

At Vandellos, if a fire PRA was

conducted prior to this incident, the

possibility of smoke entering the

control room and other buildings

would have been predicted from the

information obtained during plant

walkdown.

Cable failure impacts

equipment outside the

fire location

Cable failures caused the failure of No. 3

and 4 heat exchangers (led to turboblower failure) and failure of control air

system that led to the failure of remote

control capability of the flow control

valves to No. 1 and 2 heat exchangers.

Cable failure caused the failure of the

sump pumps and therefore the water from

the suppression system and circulating

water system water flooded the basement

of the turbine building.

Per Reference [20-3], no spurious

activation of equipment was observed.

The control and power cables of such

non-safety related components as drain

pumps are not traced in a fire PRA.

Although, in this case flooding had

minimal effect on the core cooling

functions and recovery actions, this

incident points out that lack of

knowledge about non-safety related

components has the potential for

indirectly affecting the analysis.
Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

A20-17

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

Operators initiated a reactor shutdown

almost immediately after the fire. Some

defense in depth equipment were lost to

the fire. Core cooling was achieved

through the use of two remaining turboblowers and feedwater flow to the steam

generators.

More than one safety train was

affected by the fire. See further notes

above.

Operators in the control

room receive messages

and respond to the

information displayed

on the control boar d or

received verbally from

the plant

Operators apparently responded properly

to the incident. Some smoke did enter the

control room. However, the control

boards were not adversely affected by this

fire. The operators remained inside the

control room at all times. They had

SCBA units available to them, but did not

use them.

In a fire PRA, if the control room is

postulated to be filled with smoke, no

credit would be given to further

operator actions from the control

room. In this incident, the operators

remained in the room and continued to

take proper actions to maintain core

cooling despite some smoke ingress. 

By the same token, it is rarely assumed

that smoke from fires outside the

control room would actually enter the

control room, let alone in quantities

sufficient to cause abandonment. Most

abandonment scenarios derive from

fires that start in the control room

itself. Hence, a fire PRA would likely

not have postulated abandonment for

this particular fire scenario.

Operators attempt to

control the plant

properly and bring the

plant to a safe shutdown

The operators manually adjusted the flow

control valves of the functioning heat

exchanger, by donning SCBA and

walking through darkened and smoke

filled compartments. 

The operators took actions under

environmental conditions that in a

typical fire PRA would not be given

any credit for. In particular, actions in

smoke-filled rooms would not typically

be credited. By the same token, smoke

spread is rarely considered explicitly,

and a typical fire PRA would assume

that areas not involved in the actual

fire would be accessible. Hence, it is

likely that a fire PRA would have

credited many of the actions taken by

operators.

Structural failures (if

occurred) may

jeopardize availability of

equipment

Hydrogen deflagration had some impact

on the movable ceiling at elevation

+9:00m. 

Water when sprayed

over electrical

equipment may fail the

exposed equipment

No evidence of water damage to electrical

equipment is provided.
Fire Scenario Element Incident - Vandellos 1, Oct. 19, 1989 Fire PRA Insights

A20-18

The cooling effect of

CO2 may adversely

impact equipment

Only water was used or was activated for

fire fighting.

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

The only pre-existing condition was the

fact that the door between the turbine and

reactor buildings that was left open. The

door was not water tight and there were

piping and cable penetration that would

have allowed water through into the

reactor building regardless of the position

of the door. Hence, this had minimal

impact on the development of the

incident.

Fire PRAs would have assigned a very

low probability to this door being left

open based on the existence of

administrative controls requiring that

the door be kept closed.

A20.5 Incident Analysis

The Vandellos, Unit 1 fire incident is considered a major fire from the classical fire protection

perspective. The fire also presented a modest challenge to nuclear safety. The fire caused

extensive damage, failed several key safe shutdown related components, created an adverse

environment for the operators in the control room and in other areas of the plant, and ultimately

led to the permanent shutdown of the plant.

The root cause of the fire is failure of a turbine wheel and blade ejection caused by stress

corrosion of the blades. The configuration of turbine oil pipe routing with respect to the turbine

blade trajectories influenced the severity of the incident in that the ejected blades severed the oil

piping at several points. Also, the design of the lube oil pumps, which auto-started on loss of oil

pressure, contributed to the very large quantity of oil released into the turbine building in a very

short time period. Operators were unable to stop these pumps from the main control room, and

presumably, manual local shutdown was not possible due to the fire and/or short time period

involved with the oil discharge (the total inventory was apparently discharged within about six

minutes). In a typical PRA, fire initiation is modeled using statistical analysis of actual incidents. 

The actual configuration of the systems that may or may not influence the occurrence rate or

initial severity of a fire is not explicitly taken into consideration.

Two ignitions took place in this fire incident – an oil fire and a hydrogen deflagration. Since the

hydrogen fire did not cause much damage, outside of superficial charring of cables and equipment,

it did not have any serious contribution to the overall incident. In a typical fire PRA, the

possibility of multiple, simultaneous of concurrent fires is not modeled. A hydrogen deflagration

event, and the associated pressure effects, are also not typically considered. However, it must

also be noted for areas such as a turbine building where large quantities of flammable materials are

present, in fire PRAs it is often conservatively assumed that the fire would affect the entire

building. This would inherently encompass this scenario. 
A20-19

In a typical fire PRA, fire-induced damage is limited to failure to function or spurious actuation of

active components. Other types of potential failure are not typically considered in fire PRAs. For

example, in this incident, the rupture of an expansion joint of a water-filled pipe from direct

exposure to flaming oil led to the flooding of the basement of the reactor and turbine buildings. In

this case flooding of the basements had little impact on the progression of the events and core

cooling function. However, a typical fire PRA would consider the likelihood of failure of a waterfilled component (e.g., expansion joint) to be invulnerable to fire damage; hence, the potential

problems associated with flooding concurrent with a fire would not be captured in a typical PRA

(with the possible exception of flooding due to fire water discharge). A second example is the

heat-induced loss of the control air piping and loss of control air pressure. A typical PRA would

not currently consider this potential. This could be an important aspect of some scenarios, if for

example, air operated valves are involved in the scenario (either their failure on loss of air or

reliance on their operation for plant shutdown). In this case, it is presumed here that the piping

was probably of a soldered copper type, and the heat caused failure of the solder joints. Other

types of piping would not likely be vulnerable to similar fire damage. A third example is the loss

of plant lighting systems. The fire apparently caused loss of lighting in several areas of the plant. 

This is cited as a specific complicating factor in the fire fighting response and in operator actions

taken locally. A typical fire PRA would not trace lighting cables nor consider the potential impact

of their loss. In this case, emergency lighting was available. Fire fighting efforts in the turbine

hall were apparently impacted significantly, but a number of local operator actions were

successfully taken, including in some darkened areas.

In a typical fire PRA, the control and power cables for sump or drain pumps are usually not traced

because these pumps have no direct reactor safety function. This incident points out that even

those non-safety grade systems that require control and power circuits may become unavailable

from the fire itself, and that their loss may complicate a fire incident. This could have implications

for events involving the release of significant quantities of fire fighting water, or situations where

a water-filled pipe may be vulnerable to failure (e.g., direct flame impingement on an expansion

joint as in this case). The loss of sump pumps may lead to flooding problems that would not be

captured in a typical fire PRA.

The need to consider the effectiveness of a fixed fire suppression system is mentioned in most fire

PRA methodology documents. However, specific guidance on how to accomplish an

effectiveness assessment is lacking, hence, effectiveness assessments are often not incorporated

into actual analyses. Certainly, the phenomena that would lead to degradation of the effectiveness

of a suppression system are difficult to identify, analyze and quantify in terms of suppression

reliability. Typical PRAs will assume that if the suppression system actuates, then the fire will be

controlled and/or suppressed and that any subsequent damage would be prevented. While

exceptions exist, this is commonly given a high reliability - on the order of 95% success rates or

higher. In this incident, the suppression systems did not cover those areas where the fire occurred

(i.e., the general turbine building sprinklers) and/or were inadequate to deal with the fire that

occurred (i.e., in the case of the deluge system for the hydraulic oil tank). Fire-induced damage

continued well after actuation of the suppression systems. This possibility is not covered in

typical fire PRA methodologies and applications. This incident also reiterates that a fire duration

on the order of several hours is possible.
A20-20

Smoke entered several important areas of the plant, including the control room. Operators

managed to function properly and maintain core cooling functions with available equipment. 

While SCBA equipment was available in the control room, it was never used indicating that only a

modest amount of smoke must have made its way to the control room. Control room ventilation

was shut down to prevent further smoke ingress and portable fans were brought in to provide

ventilation. Other actions were successfully undertaken that required operators in SCBA to enter

smoke-filled compartments in order to manipulate certain valves manually. The situation with

regard to current PRA practice is somewhat dichotomous. On one hand, a typical fire PRA

would assume that the presence of smoke in an area would prevent operator actions in that area. 

This incident illustrates that this fire PRA assumption may be conservative since operators did

take actions successfully in smoke-filled areas using SCBA equipment. On the other hand, fire

PRAs rarely give explicit consideration to the potential for smoke spread to areas not directly

impacted by the fire. In particular, operator actions in areas that are not actually involved in the

fire are widely credited without explicit consideration of potential smoke spread paths. 

Performance shaping factors are often applied in these cases, although not universally, to reflect

an increased likelihood of failure for actions taking place outside the main control room. Hence,

current PRA practice contains elements with the potential to introduce both conservative and

optimistic assumptions. Overall, the “trick” would appear to be to achieve a proper balance

between the two.

Smoke also caused the activation of fire protection systems in other parts of the plant where fire

had no direct impact. The suppression system actuations in these areas had no known impact on

plant equipment. However, this points out that the spurious activation of fire suppression systems

due to smoke migration, an issue included in the scope of Generic Issue 57, is possible. Spurious

suppressant discharge has a potential to cause secondary equipment damage, may divert

suppressants from areas where they are actually needed to fight the fire and may also create

hindrances or distraction for the operators. In this case the systems were apparently actuated on

smoke detection alone. This is now a rarely encountered configuration for plants in the U.S.,

largely due to adverse spurious operation experiences of the 1980's.

A20.6 References

A20-1 E. Pla, “Fire at Vandellos 1: Causes, Consequences and Problems Identified”

A20-2 “Fires in Turbine Halls and Nuclear Power Plant Safety”, ASSET/IRS Activity,

International Atomic Energy Agency, Vienna, Austria, December 11-13, 1991.

A20-3 Personal communication between Mr. E. Pla of International Atomic Energy Agency and

Dr. M. Kazarians, 1999.

A20-4 “Fires in Turbine Halls and Nuclear Power Plant Safety - ASSET/IRS Activity”,

International Atomic Energy Agency, Vienna, December 11-13, 1991.
A21-1

Appendix 21 - Analysis of Chornobyl, Unit 2 Fire on October 11, 1991

A21.1 Plant Characteristics

The Chornobyl plant site is located near Pripyat Ukraine. At the time of the fire incident

addressed in this Appendix, Ukraine was a part of the former Soviet Union. The plant site

originally had four units. Unit 4 was destroyed in an April 1986 reactor accident.[A21-7] The three

remaining units were brought back online after the Unit 4 accident, and after implementation of

several improvements including upgraded fire protection systems and cable protection. This

appendix discusses a fire that occurred in Unit 2 about five years after the Unit 4 accident.

All four units are RBMK-1000 type reactors. This type of reactor has a vertical channel, boiling

water, graphite moderated, light water cooled core with two turbine-generators per unit. 

Turbine-Generators No.3 and No.4 serve the Unit 2 reactor. The thermal power rating of Unit 2

is 3,200 MWt and each turbine-generator is rated at about 500 MWE power. Unit 2 started

commercial operation in 1979 and was apparently was shut down permanently following the fire

described here.[A21-7] The only currently operating unit is Unit 3. 

Each reactor unit is cooled by two independent loops; each cooling half of the reactor and

providing steam to a separate turbine-generator. Each loop includes four coolant pumps and one

separator drum for drying the steam before it enters the turbine. The condensate from the turbine

condensers flows back via five main feedwater pumps (for use during power operation) or three

emergency feedwater pumps (for use during an emergency) to the separator. The main circulating

pumps of the main coolant loop take suction from the separators. 

A21.2 Chain of Events Summary

On October 11, 1991, Unit 2 was in the process of start-up after a two-month shutdown when a

steam leak was discovered on Turbine-Generator No. 4. The reactor was at about 50% power

(1,570MWt) and Turbine-Generator No. 3 output was at 425 MWE. The operators tripped

Turbine-Generator No. 4 and attempted to take the generator off the gird by closing the valves to

the turbine which caused the automatic opening of the 330kV air-operated breaker between the

generator and the grid. However, before the field operators could open the isolator that deenergizes the air breaker, a short circuit in the control cable for the 330kV air breaker caused the

breaker to close spuriously and re-connect the grid to generator No. 4.

It was later determined that the short was caused by mechanical damage to a section of cable

insulation about 120 mm long in an underground duct. Cable pulling practices during

construction in 1977 were thought to be the cause of insulation failure. Cable tests were carried

out periodically during operation, but the defect was not discovered in any of those tests. The

short occurred between the conductor that carried the control signal for breaker control and the

conductor that carried the indication signal that the breaker is closed. Both conductors were

located inside the same cable.

The closure of the breaker, in effect, turned the generator into a motor. However, the breaker
A21-2

closure was such that the generator started to turn in an asynchronous mode. Its speed reached

3,000 rpm in about 30 seconds. Due to the asynchronous operation, the alternator rotor

overheated causing damage to the alternator rotor windings. Displacement of the rotor windings

produced out of balance forces during the acceleration of the rotor and damage to the bearings

and seals. This led to the release of hydrogen from the generator cooling system and release of oil

from the turbine lube system. Both materials ignited on hot surfaces and started a large fire in the

Turbine Building near Turbine-Generator No. 4.

Upon the initiation of the fire, operators tripped the reactor manually and started cool-down

procedures. The shift supervisor ordered rapid cool-down of the reactor (30EC/hr) using the

steam dump valve discharging into the steam suppression tank. The makeup for the Steam Drum

Separator was provided by a main feedwater pump.

The fire brigade was called almost immediately. They arrived at the plant within 5 minutes. A

total of 63 people including both plant personnel and off-site fire fighters were ultimately engaged

in fighting the fire.

There was one error of omission made by the operators in response to the fire. The circuit

breakers for Turbine-Generator No.3 were left closed even after the reactor had been tripped. 

Therefore, after the reactor trip this generator also received power from the grid and rotated, in

this case in synchronous mode, like a motor. The generator remained in this condition for close

to 20 minutes but did not suffer any observable damage. Ultimately this error had no impact on

the progression of the event.

The steel roof supports located above Turbine-Generator No. 4 deformed from high temperature

and collapsed. This is attributed to the build-up of hot gases under the ceiling, the lack of smoke

discharge capability and insufficient cooling of the steel structure. The fire brigade’s hose streams

did not have enough pressure to reach the ceiling. This led to the collapse of the roof over

Turbine-Generator No. 4 within about 20 minutes. The generator was completely destroyed by

the collapse of the roof. Main feedwater and emergency feedwater pumps and their electrical

boards were also affected. As a result, three out of five main feedwater pumps and one out of

three emergency feedwater pumps were damaged. Thus, multiple safety trains were rendered

unavailable in this incident.

The failure of the roof structural elements and the impact of fire on these elements caused release

of radioactive aerosols into the atmosphere from contamination that was deposited during the

April 1986 accident at Unit 4. The total radioactive material released from this event was about

1.4x10!3 Ci, which is less than daily admissible level. No other radiological release or undue

contamination occurred as a result of the fire.

Initially, the makeup water was provided by a main feedwater pump. A flow control valve failed

to adjust the flow and caused a high level condition in the steam drum. This in turn caused the

main feedwater pump to trip. Later, the steam dump valve failed partially open because of a

mechanical failure causing depressurization of the reactor coolant loop. All high pressure

feedwater capability was eventually lost. Some of the pumps and their associated control valves
A21-3

were damaged by the debris from falling roof elements and the rest were de-energized to allow for

fire fighting activities in the vicinity of their associated electrical panels.

At about 1 hour into the incident, the water level in the Steam Dump Separator dropped to the

emergency set point. However, none of the main and emergency feedwater pumps were available

to provide water to the separator. Although the operators were successful in starting one main

feedwater pump, the electrical supply to all main and emergency feedwater pumps were removed,

at about 1.5 hours, to allow the fire fighters continue their efforts in the vicinity of the associated

electrical equipment. At about 2 hours, the operators started the seal water supply system to the

main circulating pumps to provide makeup to the reactor. This can be regarded as a change in the

core cooling and coolant makeup strategy.

About 3 hours after the incident started, the water level in both Steam Drum Separators dropped

below the measurable range. Due to the decrease in reactor pressure and low temperature of the

feedwater, the water had contracted and the level in Steam Drum Separator had dropped. The

reactor pressure eventually decreased to the level where the low pressure feedwater injection from

the clean condensate storage tank could be activated. Water level was regained when the low

pressure pump was started. Thus, the operators lost control over the coolant flow rate through

the core. For a time they relied on the seal water to provide the core cooling, but had no clear

idea of the rate of coolant entering the reactor. The water level in the Steam Drum Separator was

restored only after a feedwater pump was re-activated. 

About 3.5 hours after the fire started, it was declared under control. At about 6 hours, the fire

was completely extinguished. Reference A21-7 cites that Unit 2 was shutdown (permanently) in

October of 1991. While not stated explicitly, one can infer that the unit was permanently

shutdown due to the extensive damage realized during the fire.

A21.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (Reference [A21-1] through [A21-5]). If the precise timing

and the order of an event is not known, the time of occurrence is not specified. However, it is

included at an order of presentation based purely on the judgement of the authors of this report. 

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.
A21-4

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

The unit was in the process of start-up after a

two-month shutdown. The reactor was at about

1,570MWt, with Turbine-Generator No. 3 at

425 MWe. Turbine-Generator No. 4 had to be

tripped because of a steam leak and it was

coasting down. Its rotational speed was 50 rpm

when the incident started. Two main feedwater

pumps and 6 main circulating pumps were

operating. 

Prior to

the

incident

At 19:46, on October 11, 1991, the operator

switched off the Turbine-Generator No. 4 from

the grid. This was achieved by closing the

valves to the turbine and automatic opening of

the 330kV air-operated breakers 1, 2 and 3

between the generator and the grid. The

operator in the Central Control Room (the

control room that controls plant connection to

the grid) instructed a field operator to open the

isolator TP-4GT to de-energize the air breaker. 

He had to walk 150m to verify the position of

the breaker before he could de-energize the

breaker.

00:00 At 20:10, Turbine-Generator No. 4 had coasted

down in the range of 50 to 200rpm, before the

field operator could reach his destination and

open the isolator, a short circuit in the control

cable for the 330kV air breaker caused the

breaker 2 to close spuriously and re-connect the

grid to generator No. 4. 

The short was caused by a mechanical damage

to about 120 mm of cable insulation thought to

have been caused during the cable pulling

operation through an underground duct during

construction in 1977. Cable tests were carried

out periodically and the defect was not

discovered. Because of poor or damaged

insulation, a short occurred between the wire

that carries control signal for breaker control

and the wire that carries the signal that the

breaker is closed. Both wires were located

inside the same cable.

The operator in the Central Control Room

noticed that the 330kV breaker was switched

on.

This event demonstrates that spurious actuation

of a device can occur from a short between two

wires inside a cable. This type of event is often

postulated in fire PRAs as a consequence of fire

damage to control cables. This case is

somewhat unique because the failure led to the

fire rather than resulting from the fire.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A21-5

-- The operators in the Unit Control Room and

Central Control Room felt vibration of the

building and noticed severe vibration of

Turbine-Generator No.4. Almost at the same

time, both operators discovered the fire in

Turbine-Generator No. 4. 

The closure of the breaker, in effect, turned the

generator into a motor (sometimes referred to as

“motorizing” of the generator). It started

turning in an asynchronous motor regime. Its

speed reached 3,000 rpm in about 30 seconds. 

The alternator rotor overheated and resulting in

damage to the alternator rotor windings. 

Displacement of rotor windings produced out of

balance forces during the acceleration of the

rotor.

Severe vibration took place that led to rotor

displacement. The forces of this event led to

damage in rotor components, bearings (numbrs

10 to 14) and generator seals. Hydrogen and

oil were released that caught fire.

00:00:40 At 20:10:40, the oil fire affected generator bus

bar and caused a 120,000 amp short circuit of

all 3-phases. The generator protection system

activated and opened the generator circuit

breaker 2. However, because of the short in the

control cable, breaker 2 closed again in 0.25

sec. The breaker cycled once more at a period

of about 0.2 second. At this point the air

pressure became insufficient to allow further

action of the air-operated breaker. The grid

circuit breaker, located 200km away, opened by

actions of the grid protection system, which

disconnected the generator from the grid. The

duration of these actions was estimated as about

1.18 second.

00:01 At 20:10:52, the reactor was tripped manually. 

According to the procedures, the operators

immediately initiated emergency oil removal

process from the turbine and purging of the

generator hydrogen with nitrogen.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A21-6

-- The generator circuit breakers on TurbineGenerator No.3 were left closed. This generator

also received power from the grid and rotated,

in this case synchronous, motor mode. 

Although, the generator remained in this

condition for close to 20 minutes, it did not

suffer any observable damages.

This is an error of omission in that an erroneous

configuration of plant equipment went

unnoticed for a long time. One possible cause

for this may be operators’ pre-occupation with

dealing with the fire damage, reactor shutdown

and core cooling. Although this element of the

event was not important to plant safety, it

demonstrates that it is possible for operators to

fail to monitor a condition that could potentially

cause adverse consequences because other

events are in progress. The possibility of

occurrence of overlapping scenarios is not

explicitly addressed in typical fire PRAs.

00:01 Loss of vacuum occurred on both main

condensers. 

00:01 Manual fire fighting activities using portable

and fixed equipment were initiated and fire

suppression systems activated as designed. 

Turbine oil sprinkler and area sprinkler systems

were activated manually.

None of the references indicate the effectiveness

of the suppression systems. Since it took a long

time and the efforts of a large number of fire

fighters to put the fire out, it is inferred that the

fire overwhelmed the suppression systems and

manual actions were necessary.

00:01 The fire brigade was called in.

00:03 At 20:13, the control room shift supervisor

ordered rapid cooldown of the reactor (30oC/hr)

using steam dump valves discharging into the

steam suppression tank.

00:04 Two main feedwater pumps were operating. At

20:14, operators tripped one of the two pumps.

00:06 At 20:16, the fire brigade arrived on the scene

of the fire. A total of 63 people from the fire

brigades and plant personnel were ultimately

assigned to fight the fire.

00:08 At 20:18, the operators tripped the turbinegenerator oil pumps and started manually

draining the oil in the lubricating oil tanks

which are located outside the turbine building. 

An oil spill occurred as a result of this activity,

but not in the vicinity of the fire.

Plant personnel were perhaps lucky that the oil

spill did not contribute to the fire. This part of

the event demonstrates that it is possible for

personnel actions to influence the spread and

severity of the fire. In fire PRA, actions taken

by plant personnel that may aggravate the

severity of the fire is not addressed. 
Time

(hr:min)

Event or Step Description Fire PRA Implications

A21-7

00:10 At 20:20, high level in the Steam Drum

Separator tripped the operating main feedwater

pump. The high level was caused by a failure in

the main feedwater discharge valve to modulate

properly. 

This is a case where an event (failure) has

occurred independent of the fire. In fire PRA,

such independent failures or events are routinely

included in the core damage frequency

evaluation of fire scenarios using event trees

and fault trees.

00:13 Fire brigade begins the fire fighting activities. The response time of the fire brigade is quite

typical of the times assumed in fire PRAs. 

Given that the brigade is largely an off-site unit,

this is, in fact, a relatively prompt response.

-- The fire brigade aims water streams towards the

ceiling. However, it later becomes evident that

because a large number of equipment (including

two sprinkler systems) drew water from the fire

water system, its pressure had dropped and the

hose streams did not reach the ceiling. Because

of dense smoke in the turbine building, the fire

fighters could not tell whether their water

streams were reaching the ceiling.

Specific causes for the failure of manual fire

fighting is generally not modeled in a fire PRA. 

This specific scenario (i.e., insufficient pressure

in the system because of water over use) is

typically not addressed in a fire PRA. 

Simplistic, perhaps conservative, models are

used that is intended to cover a wide range of

failure scenarios.

00:20 At 20:30, the steel roof supports located above

Turbine-Generator No. 4 deformed from high

temperature and collapsed. This is attributed to

lack of smoke discharge capability and

insufficient cooling of the steel structure. 

Attempts to cool the ceiling and structural

elements failed because of lack sufficient

pressure in the fire hoses for the water to reach

the full height of the building. It must be noted

that roof collapse occurred despite the upgrades

in 1986, when combustible components of the

roof were replaced with fire resistant elements,

and the fixed fire fighting systems were

improved.

This event demonstrates that a severe turbine

building fire may cause catastrophic structural

damage, even with proper fire protection

measures. The relatively short time from fire

initiation to collapse of the roof (20 minutes) is

somewhat unexpected. In this case, the fire

grew very quickly and must have been quite

severe. However, in fire PRA it is relatively

common to consider catastrophic loss of the

turbine building without explicit consideration

of the timing of that loss. Hence, most modern

full-scope fire PRAs would nominally capture

this potential.

00:20 Debris from the ceiling fell over TurbineGenerator No. 4. The generator was completely

destroyed from the collapse of the roof. Main

feedwater and emergency feedwater pumps and

their electrical boards were affected. As a result

3 out of 5 main feedwater pumps and one out of

three emergency feedwater pumps were

damaged. 

Multiple safety trains were rendered unavailable

in this event. Such failures are the focus of all

fire PRAs.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A21-8

-- The roof materials caught fire and released

radioactive materials from contamination 

deposited during the April 1986 accident. From

this part of the event, one can infer that a

portion of the roof structure was combustible

(Reference [A21-3]) and that excessive heat

caused them to ignite. This may have

contributed to the structural collapse.

00:28 At 20:38, the Steam Dump Valve failed

partially open because of a mechanical failure. 

This caused the level in the Steam Dump

Separator to drop.

This is another case of an independent failure

that occurred during the course of the fire. (See

note above).

00:30 At 20:40, because of debris falling from roof

and impact of fire, control of main feedwater

pumps 2, 3 and 4 and their associated control

valves were lost. Hot metal debris and

electrically active wires prevented operators

from reaching control cabinets to restore a

feedwater pump.

00:50 The level in the Steam Dump Separator reached

emergency set point. However, none of the

main and emergency feedwater pumps were

available to provide water to the separator.

01:05 At 21:15, operators were successful in starting

one main feedwater pump (No.1). 

01:10 At 21:20, the operating main feedwater pump

had to be stopped based on high water level in

Steam Drum Separator.

01:30 At 21:40, the electrical supply to all main and

emergency feedwater pumps were removed to

allow fire fighters to continue their efforts in the

vicinity of pump motors and control cabinets. 

This left the reactor cooling system without

make-up water.

This incident demonstrates that direct fire

damage may not be necessary for a set of

equipment to become unavailable. One cause

for equipment unavailability is intentional

tripping of the equipment as part of fire fighting

activities. This type of scenario is not generally

considered in a fire PRA.

-- Operators initiated reactor coolant system

pressure decrease by opening steam relief valves

into the pressure suppression tank. 

02:00 At 22:10 the operators, initiated reactor cooling

through an auxiliary system that is normally

used to supply main circulating pump seals

cooling.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A21-9

02:51 At 23:03, water level in both Steam Drum

Separators dropped below the measurable range. 

Because of decrease in reactor pressure and low

temperature of the feedwater, the water had

shrunk and the level in Steam Drum Separator

had dropped. 

The reactor pressure decreased to the level

where the low pressure feedwater injection from

the clean condensate storage tank could be

activated. The operators, per Reference A21-6,

had no previous experience with this type of

operation. 

Similar to a few other fire events, operators in

this case have gone beyond the well established

written and practiced procedures. In fire PRA,

no credit is given to such actions and it is

conservatively assumed that operators would not

deviate far from set procedures.

03:03 At 23:15, the water level in the right Steam

Drum Separator increased to above the

measurable level.

-- The operators maintained the makeup and core

cooling using the seal water system and

regained control of the Steam Drum Separator

level by 23:45.

03:31 At 23:41, the fire is declared under control.

03:35 At 23:45, water level in the left Steam Drum

Separator increased to above the measurable

range.

03:48 At 23:58, the level in both steam drums reached

normal range.

06:10 At 02:20 on October 12, the fire was completely

extinguished.

Equipment Damaged

S Generator

S Five main feedwater pumps

S Three emergency feedwater pumps

Damaged Areas

S The turbine building sustained severe damage. The roof above the TurbineGenerator No. 4 collapsed. No effects outside the turbine building were noted.

S The plant apparently was permanently shutdown following the fire.[A21-7]

Impact on Core Cooling 

S Some safety related equipment was affected by this fire. However, core cooling

functions remained available at all times. 
A21-10

Radiological Release

S The disruption of roof structural elements and impact of fire on these elements

caused release of radioactive aerosols into the atmosphere from contamination that

was deposited during the April 1986 accident at Unit 4 (Reference [21-3]). The

total radioactive material release from this event was about 1.4x10-3 Ci, which is

less than daily admissible level. No other radiological release or undue

contamination occurred as a result of the fire.

Personnel Injury

S There were no reported injuries to plant or external fire brigade personnel caused

by the fire. The fire fighters and plant personnel involved in fire fighting activities

received radiation exposure that ranged from 0.02 to 0.17 rem, which did not

exceed the two-week dose.

Public Impact

S The health and safety of the public was not affected by the fire or its impact on the

plant.

Environmental Impact

S Available sources do not indicate any radiological releases beyond the re-lofting of

previously deposited contaminants as noted above. There was no significant,

contamination or any other adverse environmental impact.

A21.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire event is compared against the elements of a typical

PRA fire scenario. Entries are made only if specific information was available in the available

documents. No attempt was made to postulate a possible progression of the event no matter how

plausible it could be based on the physics of the fire process, unless it was deemed to be essential

in concluding a specific insight.

Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

Presence of

combustible /

flammable materials

Turbine lubricating oil and generator

hydrogen were the combustible

materials that contributed to this fire.

Presence of an ignition

source

Hot surfaces of the turbine-generator

and steam pipes or the heat generated

by asynchronous operation of the

generator may have served as ignition

sources. 
Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

A21-11

Ignition of the fire and

generation of heat

(radiant and

convective), smoke,

and other gases

The fire ignited because of oil and

hydrogen release from TurbineGenerator No. 4. The release occurred

because the generator was inadvertently

connected to the grid and rotated up to

3,000 rpm as an asynchronous motor. 

The generator breaker had closed

because of a short between two wires

from the breaker control circuit and

breaker closure status signal. The short

occurred because of mechanical damage

to the cables inside a duct.

Fire growth within the

combustible or

component of original

ignition

The fire became large, apparently in a

short time. Per Reference A21-6, the

hydrogen flame was 6 to 8 meters high.

Turbine building are widely recognized in

fire PRAs as presenting unique fire

hazards. This incident confirms these

assumptions and the potential for a very

rapidly growing and severe fire to occur.

Fire propagates to

adjacent combustibles.

The fire apparently caused parts of the

roof to ignite although reports imply

that ignition occurred only after the roof

had collapsed. It is not clear whether or

not any other aspects of fire spread were

significant.

A hot gas layer forms

within the

compartment of origin

(if conditions may

allow)

The hot gas layer under the ceiling

caused the roof to collapse over the

turbines. Combustible elements of the

ceiling and the roof may have caught

fire contributing to the early collapse.

This is well beyond the typical hot layer

effects characteristic of fires postulated by

a PRA in most plant areas. However, for

turbine buildings many PRAs will

postulated total loss of the turbine

building without specific consideration of

the mechanisms of loss beyond

postulating a severe fire.

Effects of fire (i.e., hot

gas and smoke)

propagate to an

adjacent compartment

(if pathways exist)

From the available information it is

inferred that the fire remained confined

to the turbine building close to TurbineGenerator No. 4

Local automatic fire

detectors (if present)

sense the presence of

the fire

No information is provided regarding

the presence of any fire detectors in the

area.
Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

A21-12

Alarm is sounded

automatically in the

control room, locally

and / or other places

No information is provided regarding

alarms. However, the control room

became aware of the fire in a very short

time. The operators felt the vibration

caused by generator rotor rotating as an

asynchronous motor.

Automatic suppression

system is activated (if

present)

From the available information it can be

inferred that there were manually

activated sprinkler systems at the

turbine oil and the general area that

were activated by plant personnel upon

discovering the fire. However, no

further information is given regarding

the effectiveness of the systems. It can

be inferred that they were overwhelmed,

since it required a large number of

people and a long time to put the fire

out. Also, their combined activation

with manual fire fighting activities

caused the pressure in the fire water

system to drop and starve the fire

fighter from the capability to properly

spray the ceiling to prevent its collapse.

The possibility of a suppression system

being ineffective or being overwhelmed by

the fire is not explicitly modeled in a fire

PRA. PRAs commonly assume that if the

system actuates it will be effective.

Personnel are present

in the area where fire

occurs

Personnel discovered the fire and were

present in the turbine building at the

time of the fire.

Control room is

contacted or fire alarm

is sounded

Control room became aware of the fire

in a very short time after ignition The

vibration caused by generator No. 4 was

felt in the control room.. The exact

mechanism of informing the control

room of the presence of a fire is not

provided in the available sources.

Fire brigade is

activated

The fire brigade was called immediately

upon discovery of the fire. They arrived

at the plant in five minutes and began

suppression efforts in about 13 minutes.

The fire brigade response is typical of the

response times assumed in a fire PRA for

an on-site fire brigade. Given that the

brigade was made up of off-site personnel,

the response time can be cited as quite fast

compared to typical PRA assumptions.
Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

A21-13

Fire suppressant

medium is properly

applied

Although not specifically mentioned in

the available sources, in addition to the

sprinkler systems that were activated

manually, it is apparent that water and

hose streams were used to fight the fire. 

 Because there was excessive demand

on the fire water system the hose

streams did not have enough pressure

to spray water on the structural

elements of the ceiling. 

Automatic fire

suppression system is

activated

See the discussions above.

Fire suppressant

medium is properly

applied to where the

fire is.

There is no evidence that the hose

streams were misapplied. The power to

all main and emergency feedwater

pumps had to be turned off to allow the

fire fighting to continue around the

pumps and control cabinets.

Fire is affected by the

suppression medium

The fire was brought under control in

about 3.5 hours. 

Fire growth is checked

and no additional

failures occur

No additional failures caused by the fire

were reported beyond the first half hour

of the event.

In this case, the structural collapse of the

roof apparently did the most serious

damage. After this, there were few

additional damage reports noted. (See

related notes above).

Fire is fully

extinguished and fire

brigade declares it as

out

The fire was declared as completely out

about 6 hours after the event started.

This is a relatively long fire in

comparison to fires considered in a typical

PRA. However, as noted elsewhere,

catastrophic loss of the turbine building is

often postulated.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

The roof above generator No. 4

collapsed because of the failure of

structural elements. The roof debris

caused the failure of 3 out of 5 main

feedwater pumps and one out of 3

emergency feedwater pumps. All

feedwater capability was eventually lost

because the power to the system had to

be turned off to allow for fire fighting in

the vicinity of the electrical cabinets.
Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

A21-14

Cable failure impacts

equipment outside the

fire location

No information is provided regarding

this issue. However, the entire

sequence of events started with a short

in a cable caused by mechanical

damage.

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

The plant was scrammed immediately

after the fire was discovered. Core

cooling was established opening a

Steam Dump Valve and makeup of

water by one main feedwater pump. 

The feedwater capability was lost

completely during this event, in part

due to intentional shutdown of

associated power busses. The operators

had to use condensate seal water system

for the main circulating pumps to add

water to the core. To be able to

accomplish this, reactor coolant system

pressure had to be reduced by opening

steam relief valves. The operators had

no previous experience in providing

makeup water in this manner.

The control of the water level in the

Steam Drum Separators was lost during

the course of the event and was later

regained when the seal water system

was initiated.

Operator recovery actions were a key

element of this incident. The operators

took at least two different approaches for

maintaining core cooling (use of

feedwater and use of the seal water

system). They also decided to implement

the rapid cooldown (i.e., 30oC/hr)

procedure. This last decision had

implications in terms of loss of water level

in the steam drums. Overall, the

operators were successful in maintaining

core cooling. At one point, for a duration

of about 45 minutes, the water level in the

Steam Drums was below its measurable

level, thus the exact status of core cooling

capability was not known to the operators. 

The operators relied on pump seal flow to

provide coolant to the core. In PRA,

small probability of success is typically

assigned to the possibility of changing

course in recovery strategy. Also, in fire

PRA, core damage is assumed to occur if

the water drops below a measurable level.

Operators in the

control room receive

messages and respond

to the information

displayed on the

control boar d or

received verbally from

the plant

No information is provided regarding

this issue. Since the fire was in the

Turbine Building, the affected cables

likely had little impact on safety related

instrumentation.

Operators attempt to

control the plant

properly and bring the

plant to a safe

shutdown

The operators attempted several

methods for rapid cooldown of the

plant. Despite many difficulties in

controlling the water from the

feedwater systems and the water level in

the Steam Drums, the operators

managed to maintain core cooling at all

times with the help of one main

feedwater pump and seal water system

for the main coolant loop recirculating

pumps.
Fire Scenario

Element

Incident - Chornobyl 2, October 11,

1991

Fire PRA Insights

A21-15

Structural failures (if

occurred) may

jeopardize availability

of equipment

Structural failure occurred in this event

and the debris caused the failure of

main and emergency feedwater pumps.

Water when sprayed

over electrical

equipment may fail the

exposed equipment

The electrical equipment were deenergized to allow for the spray of water

in the vicinity of the electrical

equipment.

This is an aspect of the fire incident that

would not be captured in a typical fire

PRA. The possibility that redundant

equipment might be taken out of service

to facilitate fire fighting is not considered. 

This may be an artifact of Soviet fire

fighting procedures that call for deenergizing equipment before fighting fires

so the applicability to US plants is

uncertain..

The cooling effect of

CO2 may adversely

impact equipment

No information.

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

At least two independent failures did

occur during the event. The feed valve

of operating main feedwater pump

failed to modulate flow properly and the

Steam Dump Valve stuck half open. 

This demonstrates that independent

failures can adversely impact the

progression of a fire incident. In PRAs,

independent events are an integral part of

the event tree/fault tree models. In

general the occurrence of more than one 

such failure in a single incident would be

judged highly unlikely.

A21.5 Incident Analysis

The fire in the Chornobyl Unit 2 turbine building was clearly a severe fire from a classical fire

protection standpoint because significant damage was inflicted on the turbine building structure,

one generator, and several safety related pumps and equipment. Damage from the fire apparently

led to a permanent shutdown of Unit 2.[inferred based on A21-7] The incident is also judged to have led to

a significant nuclear safety challenge because the strategies employed by the operators for core

cooling, were not according to an established procedure and perhaps could have led to adverse

conditions for the core.

Operator recovery actions were a key element of this incident. The operators took at least two

different approaches to maintaining core cooling (use of feedwater and use of seal water system)

and decided to implement the rapid cool-down (i.e., 30EC/hr) procedure. This decision had

adverse implications in that it led to a drop in water level in the steam drums and a depletion of

the coolant inventory. Overall the operators successfully maintained core cooling. This was

initially accomplished using the main feedwater pumps. After that option was lost (due to manual

isolation of the operating pumps to facilitate fire fighting efforts) operators used reactor coolant

pump seal flow. Thus, two different strategies were employed in maintaining coolant flow. At
A21-16

one point, for a duration of about 45 minutes, the water level in the Steam Drums was below its

measurable level, thus the exact status of core cooling capability was not known to the operators. 

In PRA, a small probability of success is typically assigned to the possibility that operators will

change course in their recovery strategy in the midst of an unfolding accident. Also, core damage

would conservatively be assumed to occur if the water level drops below the measurable level. 

At least two independent failures occurred that adversely impacted operator recovery efforts;

failure of the feedwater flow control valve and failure of the steam dump valve in a partial open

condition. The occurrence of independent failure events is an integral part of fire PRAs since

such failure are included in the plant fault trees and event trees. However, the occurrence of two

such failures during a single incident would generally be considered highly unlikely. This incident

does illustrate that even unlikely events can occasionally occur, again, a concept consistent with

the core basis of PRA which inherently deals with unlikely events.

The root cause of this incident was a short circuit between two wires inside a cable that resulted

in spurious operation (closing) of a breaker circuit. The incident therefore demonstrates that

spurious actuation of a device can occur from a short between two wires inside a cable. This case

is somewhat unique in that the fire was a result of the short rather than a short resulting from fire

damage to cables. Spurious equipment actuation is often postulated in fire PRAs as a

consequence of fire damage to control cables. Current methods of analysis for this are, however,

subject to considerable debate. See the body of this report for further discussion.

Another interesting factor in this incident is the fact that an erroneous alignment of plant

equipment went unnoticed for a long time due to an operator error. Following the reactor trip,

operators failed to isolate the second turbine generator from the grid. As a result Turbine

Generator No.3 rotated in synchronous motor mode for close to 20 minutes. Ultimately this had

little significance in this particular event. However, it must be noted that it was a spurious

connection of generator 4 to the grid that led to the fire. Had this second generator also operated

in an asynchronous mode, a second fire may have ensued.

The actual cause for the operators failing to notice the condition of this generator has not been

established in any of the available documents. The most plausible apparent explanation is that the

operators were pre-occupied with assessing and responding to the fire, implementing a reactor

shutdown and maintaining core cooling (certainly these would appropriately be their top

priorities). Although this element of the incident was ultimately not important to plant safety, it

does demonstrate that fires can lead to adverse impacts on operator responses, even if those

actions take place from the main control room. In this case operators failed to monitor a

condition that could potentially cause adverse consequences beyond the original chain of events. 

In fire PRA methodology, it is commonly assumed that fires occurring outside the control room

will not impact the reliability of operator actions that take place within the main control room. 

Also, the possibility of occurrence of overlapping scenarios or operator demands resulting from

the fire is not explicitly addressed. In a fundamental sense, current methods do allow for the

possibility of addressing such events in a fire PRA, this is simply not typical practice. 

The available information sources indicate that the manually activated sprinkler systems activated
A21-17

as designed. Although, no information is provided about the effectiveness of those systems, it is

noted that the pressure of the fire water system had dropped because of excessive demand on the

system. Since the fire did cause extensive damage, and because it took a long time and the efforts

of a large number of fire fighters to put the fire out, it may be inferred that the fire overwhelmed

the suppression systems. The possibility of suppression system failing to control the fire because

of the intensity of the fire is not generally modeled in a fire PRA. It is commonly assumed that if

the systems actuate, they will control the fire. It is also commonly assumed that the activation of

a fire suppression system will prevent any further damage from occurring. In this case, damage

clearly continued to occur well after the suppression systems actuated. Again, the turbine

building presents unique fire hazards as compared to other plant areas.

Roof collapse in the turbine building occurred despite upgrades made in 1986. The upgrades

included replacement of combustible components of the roof with fire resistant elements, and the

fixed fire fighting systems were improved. It would appear, however, that at least some

combustible elements were left in place as the reports do cite that, at least after collapse and

perhaps before the collapse, some elements of the roof did burn. (One might suspect, for

example, that the roofs exterior sheathing was combustible.) The major structural supports were

apparently steel, and the fire was sufficiently severe so as to cause failure of these steel structures. 

This incident demonstrates that a severe turbine building fire may cause catastrophic structural

damage, even with fire protection measures in place. However, the specifics of the upgrades are

needed to fully understand the reasons for the failure of the protective measures. It is also

interesting to note that in this case the failure occurred in a rather short time, about 20 minutes. 

This is a further indication of that the fire was quite intense and grew rapidly following ignition.

Another human action that was noted in this event was that the electrical supply to all main and

emergency feedwater pumps was intentionally removed to allow for the fire fighters continue their

efforts in the vicinity of the associated electrical equipment. This incident demonstrates that direct

fire damage may not be necessary for a set of equipment to be taken offline during a fire. Fire

fighters are commonly reluctant to apply water to electrical fires due to personal safety concerns. 

In this case, the systems were taken off-line to alleviate such concerns and to facilitate fire fighting

activities. Various incidents in the U.S. also demonstrate a reluctance on the part of fire fighters

to apply water to energized electrical equipment (beginning with the Browns Ferry fire in 1975

and continuing through current events). This may have particular relevance in scenarios where

redundant equipment is separated only by spatial separation within a single room. If the room fills

with smoke, fire fighters may seek isolation of the redundant train power sources before applying

water to the fire. This could delay fire fighting efforts and/or result in the isolation of the

redundant train. This would not be considered in a typical fire PRA given current methods of

analysis.

A21.6 References

A21-1 “Fires in Turbine Halls and Nuclear Power Plant Safety; ASSET/IRS Activity” Working

Material, Report of a Consultants Meeting Organized by the International Atomic Energy

Agency, Vienna, 11-13, December 1991.
A21-18

A21-2 “Report of the ASSET Mission to the Chornobyl Nuclear Power Plant, Ukraine, 22-26

June 1992 - Review of the Root Causes of a Safety Significant Incident that occurred 11

October 1991 at Unit 2 - Loss of the Emergency Feedwater Supply due to a Fire in the

Turbine Hall", IAEA-NENS/ASSET/92/A/03.

A21-3 Vasil’chenko, V.N., A.Ya. Kramerov, D.A. Mikhailov, and A.P. Nikolaeva, Analysis of

the Accident in the Second Power-Generating Unit of the Chornobyl Nuclear Power Plant

Caused by Inadequate Makeup of the Reactor Cooling Loop”, Translated from Atomnaya

Energiya, Vol 78, No.4, pp. 249-255, April, 1995, Plenum Press Corporation, 1995. 

A21-4 Ovchinnikov, "Fire Protection of Nuclear Power Plants", A.E.Mikeev, Energoatomizdat,

Moscow, 1990.

A21-5 Soloviev.P.S. “Accidents and incidents in nuclear power plants”, Obninsk,1992.

A21-6 Shteinberg, Nicolai, J. Joosten and S. Routchkine, “Fire at Chornobyl 2", Fire & Safety

‘94, Barcelona, Spain, December 5-7, 1994.

A21-7 Soviet-Designed Nuclear Power Plant Profiles, USDOE, Office of Int. Nucl. Safety and

Coop., Washington, DC, January 1999.
A22-1

Appendix 22 - Analysis of Salem, Unit 2 Fire on November 9, 1991

A22.1 Plant Description

Salem is a two unit nuclear power plant site located near Salem, New Jersey. Unit 1 is a boiling

water reactor and Unit 2, which is completely separate from Unit 1, is a pressurized water reactor. 

Unit 2 is rated at 3411 MWt and 1106 MWE. Unit 2, where the fire being reviewed occurred,

started commercial operation in October 1981.

A22.2 Chain of Events Summary

On November 9, 1991, Unit 2 was operating at full power when a reactor trip occurred

(References [A22-1] and [A22-2]). As a result of the trip, the main generator breaker opened. 

The Auto Stop Oil System was in test mode and as a result the turbine valves cycled open while

the generator was disconnected from the grid (i.e., the turbine “re-started” without an appropriate

generator load on the system). An over-speed condition took place, but the over-speed

protection system failed to function properly and allowed the turbine’s rotational speed to exceed

2500 rpm compared to the normal operating speed of 1800 rpm. The forces associated with this

level of over-speed caused the blades to break apart and fragments were ejected from the turbine

casing. Hydrogen gas escaped and caught fire because of seal failure caused by excessive

vibration. The lube oil pipes were also severed causing release of the oil that also caught fire.

The following automatic fire suppression systems actuated promptly as designed. 

- Deluge system protecting inboard generator bearing housing

- Deluge system protecting low pressure bearing housing

- Low pressure carbon dioxide system protecting the main generator excitor

- Wet pipe sprinkler system below the main generator pedestal

Per Reference A22-3, the entire sequence of events leading to turbine failure lasted 74 seconds. 

Fires had occurred by then and some of the automatic suppression systems had activated within

that time frame. The automatic suppression systems managed to extinguish some of the fires.

The fire brigade happened to be outside the protected area at the time of fire. Withe the

assistance of plant security, the brigade re-entered the plant proper promptly and managed to be

on the scene within 5 minutes of fire ignition in full gear. With the help of plant fire brigade

personnel, the fire was contained rapidly and was extinguished within 15 minutes. The damage

caused by the fire in this incident was small compared to the damage done by the ejected blades. 

The turbine and exciter end of the main generator were found to be impacted by the fire.

Since the main turbine generator of Salem 2 is not enclosed, the hydrogen and smoke from the

fire escaped directly into the atmosphere. The fire brigade did not need to be concerned with

pocketing of hydrogen under ceiling structural elements.
A22-2

A22.3 Incident Analysis

This incident is considered important because despite the potential for a very severe fire, only very

limited fire damage was observed. In this case, catastrophic failure of a turbine occurred leading

to a fire. In this sense, the event is similar to other turbine hall fires including some incidents

covered by this same review (i.e., Narora, Maanshan and Vandellos). However, this event is

somewhat unique in that the fire suppression system was adequate to control the ensuing fire, and

coupled with brigade response, the fire was put out very quickly. There was some localized fire

damage, and the costs for replacement of the failed turbine were extensive, but there was no

impact on the safety related elements of the plant. The fire had no specific impact on the control

room functionality nor the operators. This event illustrates the importance of rapid response to

fires.

In this incident a main turbine-generator related system failure led to turbine disintegration. Fire

was a consequence of that failure. In PRA, categories of external events are defined that include

internal fires and turbine blade failures as two separate categories. In this incident both categories

took place This incident demonstrates that when analyzing turbine failure (especially turbine

blade ejection) in a general PRA, special attention should be given to the possibility of fire

occurrence in the turbine building.

Finally, it is interesting to note that two independent events contributed directly to the initiation of

the fires. First, the Auto Stop Oil System was in test mode and this created a condition where the

turbine was, in effect, re-started without an appropriate load and this in turn led directly to the

potential for an over-speed condition to occur. Second, the over-speed protection system failed

to function allowing the over-speed condition to progress unchecked. PRAs rarely model the

actual process of fire initiation, instead relying on statistical estimates of fire initiation based on

past experience. Nominally, concurrent random failures tend to be considered low likelihood

events. Nonetheless, current PRA practice would have captured the potential for such fires.

A22.4 References

A22-1 “Fires in Turbine Halls and Nuclear Power Plant Safety - ASSET/IRS Activity”,

International Atomic Energy Agency, Vienna, December 11-13, 1991.

A22-2 Licensee Event Report # 31191017, “Reactor/Turbine Trip on Low Auto Stop Oil

Pressure Followed by Turbine/Gen. Failure”, Salem Generating Station - Unit 2, Event

Date 11/09/91.

A22-3 Braddick, Rita E., “The Role of Fire Protection - Salem Generating Station Turbine

Failure”, Fire & Safety ‘94, Barcelona, Spain, December 5-7, 1994.
A23-1

Appendix 23 - Analysis of Narora, Unit 1 Fire on March 31, 1993

A23.1 Plant Characteristics

Narora Atomic Power Station (NAPS) is a twin unit pressurized heavy water reactor (PHWR)

located in Utal Pradesh, India. Each unit is rated at 220 Mwe. Unit 1 started power operation in

July 1989 and was declared as commercial in 1991. Unit 2 started power production in 1992. 

There are two turbine-generators, one per unit, housed in the same turbine building. The two

units share the same control room, but separate control panels.

A23.4 Chain of Events Summary

On March 31, 1993, Unit 1 (NAPS-1) was operating at 185 MWe. Unit 2 (NAPS 2) was in cold

shutdown but containment was pressurized. At 03:32, a turbine blade failure took place on the

Unit 1 turbine-generator set that led to severe vibrations, rupture of oil lines and the release of

hydrogen. These fuels ignited causing an explosion and fire in the Turbine Building. The reactor

was tripped manually. A plant emergency was announced within a few moments of the accident

and was not lifted until 22:45 of the same day, about 19 hours after the initiation of the accident.

Cool-down of the primary reactor cooling loop was initiated by manually opening small

Atmospheric Steam Discharge Valves (ASDVs). The operators, observing the gravity of the

situation, later opened the large ASDV valves to start a “crash” cool-down. In less than ten

minutes all primary coolant recirculation pumps tripped and all safety related power sources were

lost. This effectively placed the plant in a station blackout condition for Unit 1, and this condition

persisted for 17 hours.

The oil-initiated fire propagated along cable trays inside the turbine building toward the Control

Equipment Room. Apparently, the lack of proper fire barrier penetration seals allowed the fire to

propagate to other areas as well. A large number of cable trays were damaged.

Within about 10 minutes, the operators manually started two diesel-driven fire water pumps. 

These pumps provided fire water and were later used to pump water into the steam generators. 

They operated for about 3.5 hours, when they both tripped simultaneously. Based on the

information available, no clear cause for the pump trips can be established. There appears to be

no direct link to any observed fire damage; hence, the trips were likely caused by an independent

(random) common cause failure. One of the pumps was restored about 1.75 hours later (after the

pumps tripped), although no details on how the pump was recovered are available.

A large quantity of smoke entered the Main Control Room from the Control Equipment Room

and air supply diffusers. The operators for both units were forced to leave the Main Control

Room at about 10 minutes after the blade failure and could not re-enter it for close to 13 hours. 

An attempt was made to take control of the plant from the emergency control room. Unit 2

efforts were apparently successful, but there was no power available to the Unit 1 side and

therefore the Unit 1 control panel of the emergency control room had no functioning indications. 
A23-2

Thus, the operators had no indications of the condition of the reactor and were, in effect, “flying blind”.

Fire fighting started about 20 minutes after blade failure in the area below the generator using

water from fire hydrants and a fire tanker. Within about 1.5 hours the major part of the fire was

extinguished. The rest of the fire was put out within another 7.5 hours, or about 9 hours after

blade failure.

Members of Advisory Committee for Accident Management reached the site in about 30 minutes.

and took charge of the situation. The guard house at the entrance of the turbine building was

used as the command center for guiding the operations. The plant design had included an

emergency back-up connection between the fire water system and the steam generators. A group

of plant personnel were sent to the boiler room to check on the status of the valves to the fire

water back-up circuit. The valves were opened manually to their 50% point. This established fire

water flow into the steam generators that served as a heat sink for decay heat removal by

maintaining natural-circulation cooling of the core. 

Borated heavy water was added to the core to ensure sub-criticality. The Gravity Addition of

Boron (GRAB) system was used for this purpose per established emergency operating

procedures. GRAB was specifically designed to remain functional during a station blackout

condition. Later, fire water hoses were also connected to the End-Shield Cooling System.

Some portion of the neutral bus ducts of the main generator and the vertical portion of the phase

bus ducts below the generator melted because of the oil fire in the area. The turbine generator

support structure and portions of the slab around the turbine generator set also suffered damage

from intense heat. A number of glass window panes in the turbine building shattered.

At about 4.5 hours into the incident, the operators entered the primary containment of Unit 1

where they could read the primary loop instrumentation readouts directly. This lifted the “flyingblind” condition and restored the operators’ ability to monitor reactor conditions.

A third diesel generator that serves both units was started and loaded about 5.5 hours into the

incident. This allowed essential equipment to be energized. However, the shutdown cooling

pump was not energized until about 17 hours into the accident. This point in the chain of events

was used by Narora management to define the end of the station blackout condition. 

A23.3 Incident Progression and Implication for Fire PRA

In this section, the conditions prior to the incident, the chain of events leading to ignition and the

chain of events following the ignition are described in a chronological order as best as can be

inferred from the available sources (References [A23-1] and [A23-2]). If the precise timing and

the order of an event is not known, the time of occurrence is not specified. However, it is

included at an order of presentation based purely on the judgement of the authors of this report. 
A23-3

Whether an event from the chain of events is typically included in a fire PRA is discussed where

deemed appropriate. Lessons that may be gleaned from a specific event in the context of fire PRA

are also provided.

Time

(hr:min)

Event or Step Description Fire PRA Implications

Prior to

the

incident

Unit 1 (NAPS-1) was operating at 185MWe full

power level. Unit 2 (NAPS 2) was in cold

shutdown but pressurized. 

Prior to

the

incident

One of three diesel engine driven fire water

pumps was under maintenance and was

inoperable.

00:00 On March 31, 1993, at 03:31:40 a turbine trip

signal was initiated, caused by fatigue failure of

two turbine blades on the 5th stage of flow path 2

of the low pressure turbine. The initial failures

resulted in breakage of 14 additional blades.

The control room registered several alarms at

the same time on the control panel for turbine

and related auxiliaries. The specific parameters

that initiated the turbine trip could not be

identified.

In a typical fire PRA, ignition of a large fire in

the turbine building is assumed to occur from an

arbitrary cause. The specific causes are

generally not addressed explicitly. However, it

is assumed that oil is released, ignited and a

large fire ensues. 

-- Turbine blade failure led to turbine-generator

imbalance, that led to the failure of bearing # 4

and later failure of bearings #5 and 6. Turbine

imbalance led to frictional forces in the shaft.

-- The vibration of turbine-generator caused the

hydrogen seals of the generator to be “thrown

out.” A large quantity of hydrogen gas escaped

from the generator and caught fire. A hydrogen

explosion and fire took place. The hydrogen

escaped into the bus ducts past the terminal and

seal-off bushings. A hydrogen explosion caused

damage to the bus ducts and excitation panels.

The vibration also caused the oil pipes

connected to the turbine to snap and spill the

oil, which ignited and started a large fire in the

turbine building.

Two types of fires had occurred -- an explosion

of hydrogen gas and a large oil fire. In a typical

fire PRA, only one type of fire is postulated. 

Since, extensive damage is often postulated for

turbine building fire scenarios, lack of

consideration of simultaneous occurrence of an

explosion and a fire is of minimal consequence.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-4

-- The control room personnel and other staff

inside and outside the turbine building heard the

sound of an explosion. The control room

personnel felt vibration in the floor and a gush

of hot and dusty air.

A “huge” fire was observed at elevations

+111.0m and +104.0m of the turbine building

near the generator.

The crane operator of turbine building crane

was inside the crane cabin parked near the Unit

2 turbine and noticed a fire near the Unit 1

turbine-generator set with a bluish flame.

-- The turbine trip initiated the opening of the unit

transformer breaker, main generator breaker

and field breaker and closure of start-up

transformer breaker, as designed.

00:00:38 A reactor trip was immediately, manually

initiated upon turbine failure.

00:00:40 Turbine-generator shaft stopped under friction

caused by turbine imbalance (normal turbine

coast down is 45 minutes).

-- The control room received several reactor trip

signals.

-- The motor-generator set tripped.

-- Cooldown of Primary Heat Transport (i.e.,

primary reactor cooling loop, the PHT) was

initiated by manually opening small

Atmospheric Steam Discharge Valves (ASDVs). 

-- The fire spread to control and power cables. 

Because of lack of separation between

redundant trains, cable damage caused a station

blackout (see Note 1). Control power supply

cable trays on the mezzanine floor (+106.0m

elevation) were severely damaged.

Multiple safety trains were affected by this fire. 

Impact on multiple trains in a fire incident is

relatively rare. Current PRA methodologies

would properly identify the possibility of

occurrence of station blackout from a turbine

building fire.

-- The diesel generators (2 for Unit 1) started

automatically, but tripped because of loss of

control power supply.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-5

00:05:45 Operators, upon observing the gravity of the

situation, initiated a “crash” cool down of the

primary coolant loop (the PHT) by opening the

large Atmospheric Steam Discharge Valves.

The Secondary Shutdown System (SSS) was

initiated automatically because of crash

cooldown.

Operators took the proper actions throughout

the course of the event. Current PRA

methodologies would properly identify the

operator actions that had to take place. 

However, PRA methodologies put considerable

emphasis on written, available emergency

procedures. Little or no credit is given to

actions outside written procedures.

00:06:47 All PHT pumps tripped. A complete loss of

class IV supply was experienced.

-- Control room staff noticed that PHT pressure is

at 50kg/cm2(g) (about 700 psi) and that the

fueling machine pump is running.

00:07:04 Isolation of primary containment was noted.

00:07:40 Complete loss of power supply systems (station

blackout) on Unit 1 side of the plant was

experienced. All Class I and II power supplies

were lost.

00:07:59 The breaker for motor-generator set MG-3 (of

the control circuits) tripped leding to a complete

loss of control power supply.

00:08 Senior plant management were informed of the

fire. Using the Unit 2 public address system,

plant emergency was announced.

-- Fire propagated along the cable trays towards

the Control Equipment Room next to the

Turbine Building. Lack of complete fire

barriers allowed the propagation of the fire to

other areas. A large number of cable trays,

Emergency Transfer Relay (EMTR) panels and

Line, Transformer and Generator (LTG) panels

were damaged.

-- Large quantity of smoke entered the Main

Control Room from the Control Equipment

Room and air supply diffusers. The operators

for both units 1 an 2 had to leave the Main

Control Room.

This is one of the few fire events where

operators had to evacuate the Main Control

Room. In fire PRAs, upon presence of smoke or

other adverse conditions in the control room, it

is assumed that the operators will not be able to

function properly and will have to leave the

control room.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-6

00:10 Two diesel engine driven fire water pumps were

started by the operating crew. 

Recall that the third pump was out of service for

maintenance. A PRA will not typically consider

specific unavailability times for fire protection

equipment as a part of the fire suppression

assessment. Rather, suppression system

reliability is based on generic overall system

reliability estimates.

-- An attempt was made to take control of the

plant from the emergency control room. 

However, there was no power supply to the Unit

1 side of the emergency control room and

therefore Unit 1 control panels had no

functioning indications.

This is one of the few fire incidents where the

operators had to go to the emergency (reserve)

control room. However, this event demonstrates

that common causes can lead to failures for both

control rooms. Because of complete loss of vital

buses, the emergency control room was

rendered useless. In PRA studies for U.S. plants

independence of the remote shutdown station is

commonly assumed by virtue of the

deterministic Appendix R compliance analyses. 

However, confirmation of remote shutdown

independence has commonly been cited as a

point of potential technical concern during the

IPEEE review process.

-- The operators had no indications of the

conditions of the reactor and therefore were in

“flying blind” operating mode.

This is perhaps the only fire incident where the

operators have faced “flying blind” conditions. 

In a PRA it is generally assumed that core

damage will ensue given a total loss of

instrumentation.

00:20 Fire fighting started in the area below the

generator using water from fire hydrants and a

fire tanker. 

By the time that fire fighting efforts had begun,

severe damage had already been experienced. 

This is actually quite consistent with

assumptions commonly made in fire PRA, that

is, there is a competition between fire growth

and damage and fire suppression. In this case,

the fire was simply too severe and too fast

growing for fire fighters to intervene before

critical damage had been done.

00:30 Members of Advisory Committee for Accident

Management reached the site and took charge of

the situation. The guard house at the entrance

of the Turbine Building was designated as the

control center for guiding the operations.

00:30 A quick radiation survey of the outside areas of

the reactor building was conducted and no signs

of abnormal radiation levels were noted.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-7

-- A group of staff members was sent to a boiler

room to check the status of, and open, valves on

a fire water back-up connection to the main

coolant system. The valves were opened

manually to the 50% point. This established

fire water flow into the steam generators that

served as a heat sink for decay heat removal by

maintaining natural convective circulation

cooling of the core. 

The manual connection of the fire water system

to the steam generators and use of diesel engine

driven fire water pumps were the main method

for providing core cooling in this incident. In a

fire PRA, credit to the use of such core cooling

method would be given only if a written

procedure is available and the operators are

trained in the implementation of the procedure. 

In this case, the connection did apparently preexist as a part of the plant design so one must

presume that procedures for its use were

available. 

-- Borated heavy water was added to the core to

ensure sub-criticality. Gravity Addition of

Boron System (GRAB) was used for this

purpose per established emergency operating

procedure. GRAB is designed to be used during

a station blackout condition.

-- Some portion of the neutral bus ducts of the

main generator and the vertical portion of the

phase bus ducts below the generator melted

because of the oil fire in the area.

-- The turbine-generator support structure and a

portion of the slab around the turbine-generator

set suffered damage from intense heat. A

number of glass window panes in the turbine

building shattered.

-- Fire brigades from nearby stations were

summoned for additional help.

-- More than 50 staff members from different

sections of plant organization came to the site to

help the Advisory Committee. Remaining staff

members were asked to be on stand-by at a

nearby community center.

01:30 Major fires on the ground and mezzanine floors

of the turbine building were extinguished.

This is interpreted as the time of fire being

brought under control.

02:00 A radiation survey of the inside of the secondary

containment was conducted and no signs of

abnormal radiation levels were noted.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-8

03:50 The two operating diesel driven fire water

pumps tripped. The cause for this failure is not

known.

It seems that the cause for the failure of the

diesel engine driven fire pump were linked (a

common cause failure) and it was not related to

the fire itself. In a fire PRA, the independent

failure of equipment is postulated and the

probability of occurrence of such events is

included in core damage frequency calculations. 

04:00 A radiation survey of the Reactor Building

(primary containment) showed normal radiation

levels.

04:25 First entry into the Reactor Building (primary

containment) was made by operating staff

04:25 PHT pressure noted at the master gauge at

Elevatoin +103.0m inside secondary

containment.

04:35 Fire water hose is connected to the End-Shield

System.

05:30 Inside the primary containment, fire water was

connected to the suction side of the End-Shield

Cooling System Pumps to provide cooling of the

end-shields. Although the End-Shield Cooling

System Pumps could not be used, the pressure in

the fire water system was sufficient to push

through past the pumps and provide cooling to

the End-Shields (see Note 2)

Entry into containment is not typically credited

in a fire PRA.

05:35 About 1:45 after they tripped, one of the two

diesel driven fire water pumps was restarted. 

Cooling to end-shields provided in addition to

putting fire water into the steam generators.

The steam generators remained without makeup water for about 1 hour 45 minutes. This

demonstrates that the steam generators had

sufficient capacity to allow for a lack of water

make-up for an extended time. None of the

incident reports indicate the capacity of the

steam generator. The time to core damage after

all make-up (primary and secondary) capability

is lost is an important measure that is used in a

PRA to establish the likelihoods of success or

failure of operator recovery actions. 

05:35 Diesel Generator #3 that serves both units was

started using electrical power from Unit 2. 

06:00 Start up of Diesel Generator #3 allowed for

Class Bus Q to be energized. From this point

on, essential systems were started one after

another.
Time

(hr:min)

Event or Step Description Fire PRA Implications

A23-9

07:00 Non-active high pressure process water pump

(feedwater pump # 2) started.

09:00 The fire was completely extinguished There is a long time difference between the fire

being brought under control and complete

extinguishing of the fire. This is not modeled in

a typical fire PRA and is not generally

considered as an important contributor to the

chain of events. In this case, the most critical

damage occurred within the first 20 minutes of

the fire.

13:10 Operators went back to the Main Control Room.

17:00 One of the shutdown cooling pumps was started

after 17 hours. This is considered by the plant

operators to represent termination of the station

blackout condition.

17:05 Shutdown cooling pump # 2 was started.

19:15 Plant emergency was lifted at 22:45.

32:00 One End-Shield Cooling System Pump is

activated to operate on its own power (see Note

2).

Note 1: The original design basis accidents of the plant did not include station blackout. Hence,

this event is considered as “Beyond Design Basis Accident”.

Note 2: The use of fire water pressure to pass through the End-shield Cooling Pumps is inferred

from the information provided in Reference [A23-1]. There may be some conflict in the exact

timing of these actions given that other reports state that the first fire pump was not recovered

until five minutes after this action was reported.

Equipment Damaged

S Turbine generator of Unit 1 and its accessories, bus ducts and excitation panels.

S Electrical cables, that led to the following:

S Electrical power buses Class I and II (station blackout)

S Automatic Liquid Poison Addition System (ALPAS)

S Emergency D2O injection

S Circulation and cooling of moderator and end-shields

S PHT circulation including shutdown cooling

S Auxiliary feed to boilers

S Loss of all indication on the emergency control panel outside the Main

Control Room

Damaged Areas
A23-10

The turbine building experienced severe fire damage. The turbine-generator, its support

structure and portion of the slab around the turbine-generator set suffered damage from

intense heat. A number of window glass panes of the turbine building were shattered. 

The fire propagated to the Control Equipment Room. Smoke entered the Main Control

Room and rendered the room inhabitable.

Impact on Core Cooling 

Core cooling was maintained at all times. At no time during the fire, core cooling function

stopped. Fuel cladding, the primary envelope and the containment were not adversely

affected by the fire. Core cooling capability remained available through secondary side

cooling and natural convective recirculation in the primary side. The steam generators

were supplied with fire water using diesel driven pumps. 

Rediological Release

No radiological release or undue contamination occurred as a result of the fire.

Personnel Injury

There were no reported injuries to plant or external fire brigade personnel caused by the

fire.

Public Impact

The health and safety of the public was not affected by the fire or its impact on the plant.

Environmental Impact

There were no radiological releases, contamination or any other environmental impact

other than the smoke release into the atmosphere.

A23.4 Comparison of Fire Scenario Elements and the Incident

In this section, the chain of events in the fire event is compared against the elements of a typical

PRA fire scenario. Entries are made only if specific information was available in the available

documents. No attempt was made to postulate a possible progression of the event no matter how

plausible it could be based on the physics of the fire process, unless it was deemed to be essential

in concluding a specific insight.

Fire Scenario Element Incident - Narora 1, March 31, 1993 Fire PRA Insights

Presence of combustible

/ flammable materials

Turbine lubricating oil and hydrogen were

the primary combustibles in this event. 

Cable insulation was a partial contributor

to the combustible load. 

Hydraulic oil also caught fire. 
Fire Scenario Element Incident - Narora 1, March 31, 1993 Fire PRA Insights

A23-11

Presence of an ignition

source

The event, that is turbine blade ejection

and severe vibration of the shaft, led to

shaft stoppage from friction. It is assumed

that this led to high temperature surfaces

and served as the ignition source.

In a typical PRA, only those sources

of ignition are considered that are

present at all times. The possibility

of an accident creating an ignition

source is not generally modeled. 

Ignition is commonly treated

probabilistically based on past

experience. 

Ignition of the fire and

generation of heat

(radiant and

convective), smoke, and

other gases

Blade ejection lead to imbalance of the

turbine, that led to severe vibration. This

led to breaks in several oil pipes and

generator seal failure. Oil and hydrogen

ignited on hot shaft surface.

Fire growth within the

combustible or

component of original

ignition

Hydrogen exploded inside bus ducts and

caused damage to the ducts. Oil started

burning and created a large fire inside the

turbine building.

Fire propagates to

adjacent combustibles

The fire damaged cables inside cable trays

that propagated to areas away from the

turbine-generator.

A hot gas layer forms

within the compartment

of origin (if conditions

may allow)

No information provided

Effects of fire (i.e., hot

gas and smoke)

propagate to an adjacent

compartment (if

pathways exist)

Smoke propagated into the Main Control

Room and caused the operators to leave the

room. 

This is one of several events in this

review that led to smoke in the main

control room due to a fire elsewhere. 

This is the only event identified

where this actually led to control

room abandonment.

Local automatic fire

detectors (if present)

sense the presence of the

fire

No information provided.

Alarm is sounded

automatically in the

control room, locally

and / or other places

The control room operators became aware

of the fire in a short time because of the

noise, a draft of hot air and many different

system alarms.

Automatic suppression

system is activated (if

present)

No information provided.

Personnel are present in

the area where fire

occurs

Personnel were present in the turbine

building who observed the occurrence of

the explosion and the fire.
Fire Scenario Element Incident - Narora 1, March 31, 1993 Fire PRA Insights

A23-12

Control room is

contacted or fire alarm

is sounded

Control room operators became aware of

the fire almost immediately because of the

noise, vibration of the building, draft of hot

air into the room and many system alarms.

Fire brigade is activated Internal and outside fire brigades were

called. Fire fighting started about 20

minutes after ignition. Outside fire

brigades arrived about 30 minutes after

ignition.

Note that most of the significant fire

damage had already been done before

fire fighting activities began. 

Scenarios such as this tend to

dominate fire risk estimates.

Fire suppressant

medium is properly

applied

Hose streams were used to fight the fire. It

took about 1.5 hours for the fire brigade to

control the fire, and another 7.5 hours

(total of 9 hours) to extinguish the fire

Automatic fire

suppression system is

activated

No information.

Fire suppressant

medium is properly

applied to where the fire

is.

There are no indications of any collateral

damage due to fire suppression activities.

Fire is affected by the

suppression medium

See above.

Fire growth is checked

and no additional

failures occur

From Reference [23-1] it is inferred that all

cable and equipment failures caused by the

fire occurred in the first 30 minutes of the

fire. 

Although the major fire was

announced as extinguished in 1.5

hours after ignition, it can be claimed

that from fire PRA standpoint, the

fire was checked in about 30 minutes

after ignition.

Fire is fully

extinguished and fire

brigade declares it as

out

Fire was declared as fully extinguished 9

hours after ignition.

The duration of fire can be considered

as several hours. In fire PRA,

typically the fire duration is in the

order of several 10 minutes. This fire

incident demonstrates and it is

possible for the fire to last for several

hours.

As heat and smoke are

generated, equipment,

cables and structural

elements near the fire

are affected by the fire.

The turbine-generator support structure

and portion of the slab around the turbinegenerator set suffered damage from intense

heat. A number of window glass panes of

the turbine building were shattered.

A large number of cables were damaged.

Smoke entered several areas including the

control room.
Fire Scenario Element Incident - Narora 1, March 31, 1993 Fire PRA Insights

A23-13

Cable failure impacts

equipment outside the

fire location

The following systems and equipment were

failed:

. Electrical power buses Class I and II

(station blackout)

. Automatic Liquid Poison Addition

System (ALPAS)

. Emergency D2O injection

. Circulation and cooling of moderator and

end-shields

. PHT circulation including shutdown

cooling

. Auxiliary feed to boilers

. Loss of all indication on the emergency

control panel outside the Main Control

Room

A fire PRA would have likely

identified the potential for loss of

multiple and redundant equipment

trains given the apparent lack of train

separation.

Equipment failure

perturbs the balance of

plant operation and

causes automatic

systems to respond

Operators initiated a reactor shutdown

almost immediately after the fire. All

active components normally used for

shutdown cooling were lost because of

station blackout. Core cooling was

achieved through the use of two diesel

engine driven fire water pumps that

injected water into the steam generators. 

Core cooling was then achieved through

natural convective recirculation.

Multiple trains were affected by the

fire. Impact on redundant trains is a

rare occurrence. In fire PRA, proper

methodologies are available to

identify impact of fire on redundant

trains and loss of vital systems. 

Operators in the control

room receive messages

and respond to the

information displayed

on the control boar d or

received verbally from

the plant

The operators initiated atmospheric release

of steam generators, monitored reactor

parameters until they had to abandon the

control room because of smoke. 

In a fire PRA, if the control room is

postulated to be filled with smoke, no

credit would be given to proper

operator actions from the control

room. This incident, demonstrates

the validity of this assumption.

Operators attempt to

control the plant

properly and bring the

plant to a safe shutdown

The operators manually adjusted the flow

control valves of the fire water pumps into

the steam generators. The Gravity

Addition of Boron (GRAB) system was

activated manually. The system does not

require electric power to function. 

The operators took actions under time

constraints that were in the order of

half hour to one hour. In a fire PRA,

the human error probability for

actions that require such time

windows is often close to those used

in the internal events PRA.

Structural failures (if

occurred) may

jeopardize availability of

equipment

In the turbine-generator area some

structural damage took place and bus ducts

melted from the heat. However, none of

the structural failure impacted safety

components or cables. The cables in the

area caught fire and caused all safety

related failures.
Fire Scenario Element Incident - Narora 1, March 31, 1993 Fire PRA Insights

A23-14

Water when sprayed

over electrical

equipment may fail the

exposed equipment

No evidence of water damage to electrical

equipment were reported.

The cooling effect of

CO2 may adversely

impact equipment

Only water was used for fire fighting.

Conditions may exist at

the time of the fire that

may aggravate the

impact of the fire on

plant systems

The only existing condition was the

unavailability of the third diesel engine

driven fire pump.

A23.5 Incident Analysis

The turbine building fire at Narora Unit 1 caused an extended station blackout and extensive

damage; hence, it is considered one of the major fire incidents in the nuclear power industry both

from a classical fire protection standpoint and from a nuclear safety standpoint. The root cause of

the fire is failure of a major equipment item (i.e. the turbine-generator) because of metal fatigue. 

Since the turbine generators are equipped with lubricating and hydraulic oil systems and the

generators are filled with hydrogen, as is the case at several other sites, a catastrophic failure of

the turbine generator set often leads to a severe fire. The impact of this fire on plant safety was

aggravated by the lack of separation between redundant trains of cables.

In a fire PRA, the possibility of a large turbine building fire is often considered. It is common to

model such fires by postulating that an oil spill occurs and is ignited. This, of course, is intended

to cover a large spectrum of possible incidents, including blade ejection and turbine generator

catastrophic failure. It is also interesting to note that in fire PRA the mechanism of ignition is

rarely explicitly treated; however, in those cases where it is treated, only those sources of ignition

that are present at all times are typically considered. In this incident, the imbalance in the turbine

generator shaft caused the shaft to overheat presenting an ignition source that is not normally

present in the plant. This was also seen at Vandellos, for example. The possibility of an accident

creating an ignition source is not generally modeled. As mentioned above, in fire PRA an overall

fire initiation frequency is used to represent a large spectrum of possible fire scenarios.

Two types of fires occurred at Narora Unit 1 during this incident; namely, an explosion of

hydrogen gas and a large oil fire. In a fire PRA, only one type of fire is postulated in a given

scenario. Since, extensive damage is often postulated for turbine building fire scenarios, the lack

of consideration of simultaneous occurrence of an explosion and a fire would be expected to be of

minimal consequence, provided that no ignitions or damage is observed outside the turbine

building.
1The nearest similar incident is perhaps the 1975 Browns Ferry fire where operators and

electricians tapped into instrument feeds through containment electrical penetrations in order to

by-pass fire damaged cables.

A23-15

Multiple safety trains were affected at Narora, Unit 1. In particular, all primary and backup trains

of safety related power were lost resulting in a station blackout. Current PRA methodologies

properly identify the possibility of a fire impacting multiple trains by a thorough analysis of the

location of cables important to plant safety. Therefore, in the case of Narora, a fire PRA should

have correctly identified the possibility of occurrence of the station blackout from a turbine

building fire, as was experienced.

Operators took the proper actions throughout the course of the incident. There were no

significant operator errors identified. The alignment (done manually) of the fire water system to

the steam generators and use of diesel driven fire water pumps were the main methods for

providing core cooling in this incident. Current PRA methodologies do allow for properly

identifying the appropriate operator actions. However, PRA methodologies put considerable

emphasis on written, available emergency procedures. Little or no credit is given to the possibility

of successful completion of actions that are outside written procedures. In this case since the fire

water system connection apparently was pre-existing as a part of plant design, one can presume

that there was a procedure in place for its use. However, this cannot be clearly established based

on the available information.

This is perhaps the only fire incident where the operators have faced a “flying blind” condition

(i.e., the operators had lost access to reactor and primary coolant loop instrumentation)1. The

closest analogue is perhaps the 1975 Browns Ferry fire where plant personnel tapped into

containment penetrations (on the outside of containment) to bypass damaged or suspect

instrument cables and fed critical data on the reactor conditions to the main control room (see

Appendix 3). Somewhat similarly in this case, operators overcame the problem by entering

containment and tapping directly into instrument feeds or reading from master gauges. In a PRA

it is generally assumed that the result of a complete loss of instrumentation is core damage,

operator actions outside of the established procedures are not typically credited, and containment

entry would not typically be credited. This incident demonstrates that typical PRA assumptions

with regard to operator actions may be conservative.

This is the only fire incident identified in this review where operators had to evacuate the Main

Control Room. In fire PRAs, upon the presence of smoke or other adverse conditions in the

control room, it is assumed that the operators will not be able to function properly and will have

to leave the control room. This incident demonstrates that smoke alone (i.e., there is no fire in the

main control room and no direct fire damage to main control room circuits) can lead to main

control room abandonment. It is also of interest to note that upon arrival at the emergency

(reserve) control room, operators for Unit 1 were still unable to control the reactor because the

station blackout had rendered the emergency control panels inoperable as well. This incident

demonstrates the possibility of a common cause failure for the two control rooms. It should be

noted, however, that regulatory requirements in the U.S. should preclude a similar occurrence. 
A23-16

Indeed, in fire PRAs it is somewhat common to assume remote shutdown independence based on

the Appendix R analyses. However, verification of remote shutdown independence and potential

control system interactions continues to be a point of methodological debate. For example,

related technical concerns were commonly identified in the USNRC-sponsored reviews of the

licensee IPEEE fire analyses.

In the course of the incident, the two diesel driven fire water pumps failed simultaneously well

into the incident. No clear cause for this is established in the available reports, but it is inferred

that the cause for the failure of both of the available diesel engine driven fire pumps were linked (a

common cause failure) and that the failures were not related to the fire itself (i.e., not the result of

fire damage). In a fire PRA, the independent failure of equipment is postulated and the probability

of occurrence of such events are included in core damage frequency calculations. However, in

the case of fire suppression systems, it is common practice to apply a generic system-wide

reliability estimate rather than to consider specific mechanisms that might lead to system failure. 

This was somewhat aggravated by the maintenance outage of the third fire pump, although it is

not clear if this pump would have survived while the other two failed. This incident demonstrates

the potential importance of independent failure events and equipment outages to core damage

frequency evaluation.

In this incident, there is a long time between the fire being brought under control and complete

extinguishing of the fire. This is not modeled in a typical fire PRA and is not generally considered

as an important contributor to the chain of events. Furthermore, from the available information

about this incident, all key failures appear to have occurred within the first half hour of the

incident. No additional failures were reported beyond this time. From a core damage modeling

point of view, this demonstrates that extinguishing the fire quickly is an important factor. Beyond

the first half hour in this case, the impact of fire fighting efforts had little or no apparent effect on

the likelihood of core damage, perhaps other than the continued evolution of smoke that may

have extended the abandonment time for the main control room. This is consistent with typical

results of fire PRAs. PRAs commonly predict that fire damage that might occur very early in the

incident is of the greatest risk significance.

The operators successfully took actions under time constraints that were on the order of a half

hour to one hour. In a fire PRA, the human error probability for actions that require such time

windows is often close to those used in the internal events PRA. That is, it is commonly assumed

that the fire will not impact the longer term operator actions, provided those actions take place

away from the fire itself. This event appears to be consistent with that assumption, despite the

fact that the fire continued to burn for several hours.

A23.6 References

A23-1 International Atomic Energy Agency, Incident Reporting System, “Completed Station

Blackout Due to Fire in Turbine Building at NAPS-1".
A23-17

A23-2 J. S. Rao, “Role of Electrical Problems in the Failure of Narora Power Plant”, Proceedings

of the 1996 International Conference on Power Electronics, Drives and Energy Systems

for Industrial Growth, Volume I, ISBN 0-7803-2795-0.

A24-1

Appendix 24 - Analysis of Waterford, Unit 3 Fire on June 10, 1995

A24.1 Plant Description

Waterford 3 is a single unit pressurized water reactor (PWR) located near Taft, Louisiana. Unit 3

is the only nuclear power unit on the site. The unit is rated at 1,104 MWE and started

commercial operation in September 1985. The fire being reviewed here occurred in one of the

non-vital switchgear cabinets. There are two non-vital switchgear trains, A and B, and both are

located in one room on the +15 feet elevation of the turbine building. The two buses are

separated by a 10 foot high heat shield (a 1-foot thick, partial height, concrete block wall). The

ceiling of the turbine building switchgear room is 25 feet above the floor, and the switchgear

cabinets are 7 feet tall. There were 36 fire detectors in the room that annunciated on a fire

protection board inside the control room, and there was no fixed fire suppression system in the

switchgear room. 

A24.2 Chain of Events Summary

On June 10, 1995, the unit was operating at 100% power. At 08:58 failure of a lightning arrester

on a substation transformer (230kV/34.5kV) caused a severe electrical transient that, in

combination with failure of a breaker, led to non-vital switchgear 2A failure and fire in the breaker

cubicle for the startup transformer. This led to a reactor trip and a series of other non-safety

related equipment trips, signal actuations and equipment activations. [Ref. A24-1].

All 36 fire detectors for the turbine building switchgear room alarmed to the control room

indicating panel. However, the control room operators did not become aware of the fire detector

alarms because there were other plant alarms sounding at the same time, the fire protection alarm

board was in an area not readily visible to the operators and the fire detector alarm panel buzzer

had been covered with tape. Hence, control room operators remained unaware of the fact that a

fire had started in the switchgear room.

At 09:06 a.m., the control room received a report from an auxiliary operator, who happened to

be a trained fire brigade member, that heavy smoke was coming out of the switchgear room. The

shift supervisor asked if the auxiliary operator could observe flames or an orange glow. The

response was that no flames could be seen but a large amount of smoke was coming out of the

switchgear room. The auxiliary operator was instructed to confirm the presence of an actual fire

and report back.

Two auxiliary operators donned self contained breathing apparatus (SCBA) and entered the

switchgear room to verify the presence of a fire. The control room was notified that a fire was

indeed in progress. This exchange of information took place about half hour after the arrival of

the first fire alarms in the control room (i.e., approximately 09:30). The shift supervisor, at this

point, announced the presence of fire and activated the fire brigade. 

The fire brigade arrived on the scene and initially attempted to put the fire out using hand held

extinguishers charged with carbon dioxide, Halon and dry chemical. All their attempts proved
A24-2

ineffective. The shift supervisor, according to plant procedures, assumed the leadership of the fire

brigade and left the control room for the fire location. 

The local off-site fire department was summoned at 09:41and they arrived at about 09:58 (17

minutes later). Upon arrival they recommended the use of water. However, the shift supervisor

in consultation with other members of plant operations team decided to continue using non-water

suppression media. Permission to use water was eventually given about 90 minutes after fire

initiation (i.e., about 10:30). The fire was brought under control within four minutes after initial

application of water and was declared extinguished about two and a half hours after initiation.

As noted, the fire was initiated inside of a switchgear panel. The fire propagated out of the top of

the panel and ignited vertical cable tray risers above the panel. It can be inferred that the

switchgear cubicle fire broke through the steel top of the panel and propagated to those cables. 

However, whether this was due to heat damage to the top panel or whether the top panel may

have been damaged in the initial electrical fault cannot be established. In its progression, the fire

jumped over a fire stop installed in the vertical section of the cable tray and continued its

propagation. Cables in a 5-foot diameter column up to a height of about 10 feet above the panel

top were damaged by the fire. The fire detectors immediately above the fire zone were also

damaged by the heat.

The fire eventually reached a horizontal cable tray about 17 feet above the floor (10 feet above

the top of the panel). The fire then propagated horizontally until it came to a fire stop installed in

the horizontal cable tray about 8 feet from the junction with the vertical trays. From the available

information it can be inferred that, for the horizontal segment of the cable trays, the flames were

of limited height and/or limited duration. This is because the 6.9 kV power cables that were

located a few inches above the burning 4.16 kV cables were not ignited and after the fire were

found with only minor surface damage.

Two adjacent switchgear cubicles were also severely damaged by the fire. Four other nearby

cubicles experienced exterior damage only. The investigators postulated that the radiative heat

reflected from the shield wall separating the two switchgear trains caused the exterior damage to

those four cubicles. None of the redundant train cubicles (on the opposite side of the shield wall)

were damaged.

It is also interesting to note that, log records indicate erratic behavior of the A2 unit auxiliary

transformer breaker that was involved in the fire. A few other erratic indications were also noted

on the control board through the course of the incident. The records indicate that the transformer

breaker first showed closed and then open. It can be inferred from this that breaker control circuit

faults led to inaccurate indications on the sequence of events log.

A24.3 Incident Analysis

The non-vital switchgear fire at Waterford 3 had little impact on safety related functions. It does,

however, provide important PRA lessons. Switchgear fires are considered one of the most likely

fire scenarios in a nuclear power plant, and many fire PRAs have concluded that safety related
1Based on discussions with cognizant USNRC/NRR staff.

A24-3

switchgear are significant fire risk contributors. Non-safety related switchgear however, are not

generally found to be risk significant.

This incident provides an interesting account of what can happen to the switchgear cubicles and

the cables above it in the event of a switchgear fault and fire. In this case, three cubicles suffered

extensive damage, and four experienced minor damage. Further, the fire propagated through the

steel panel top into a vertical cable tray, about 10 feet up the vertical tray to a crossing horizontal

tray and about 8 feet along the horizontal tray before being stopped by a raceway fire barrier. The

potential for fires inside closed electrical panels to propagate outside of the panel has been a point

of significant recent debate. This incident illustrates that under some conditions this potential

clearly exists.

A second factor of interest is the fact that fire fighting was delayed considerably in this incident. 

The delay was caused by three nominally unrelated factors, two relating to decisions made by

plant personnel during the incident.

One of these three factors was the decision made by the shift supervisor who insisted on direct

observation of flames prior to declaring a fire and activating the fire brigade. It took close to half

an hour (from the time of ignition) for two operators to don protective breathing apparatus, enter

the room, seek out the source of the fire, verify the presence of flames, retreat from the room and

report back to the main control room. This would not be captured in a typical fire PRA. Fire

PRAs will almost universally assume that once there are clear indications of a fire underway (e.g.,

alarms, smoke), the fire brigade will be activated immediately. Indeed in most cases this is what

happens observed. In this particular case the plant procedures apparently did call for plant

personnel to verify the existence of flames before declaring a fire1. This illustrates the importance

of a careful review of plant fire emergency response procedures to fire PRA. 

The second factor related to the strategy used to fight the fire. Once the fire was declared and the

fire brigade arrived on-scene, the fire brigade resisted using water on an electrical fire until

multiple attempts to extinguish the fire using portable extinguishers proved ineffective. As a

result, the fire was allowed to burn far longer than would typically be assumed in a fire PRA, and

the observed damage was perhaps made worse than if prompt and effective fire suppression had

been undertaken. Typical PRA practice assume that once the fire brigade arrives on scene,

effective fire fighting will begin immediately. Delays caused by the decision to use ineffective fire

suppressing agents are not modeled. This incident illustrates that this assumption may be

optimistic. It must be noted that current fire PRA methodologies are fundamentally capable of

incorporating the possibility of ineffectiveness of the fire suppression attempts and delays caused

by management decision. For example, current methods already include the ability to assess fire

brigade response based on time - likelihood of suppression distributions which could account for

some chance that initial fire fighting attempts will be ineffective. However, there is currently no

basis for quantifying such behaviors.
A24-4

The reasons for the failure of carbon dioxide, Halon and dry chemical in controlling the fire in this

incident has not been reported. However, other incidents have illustrated similar unsatisfactory

results for such efforts, in particular, when the fires involve energized electrical panels. In hindsight, it also appears likely that the fire had already propagated to the overhead vertical cable trays

before fire fighting was initiated (recall the fire had been burning for at least 40 minutes). This

would place the fire well above the heads of the fire fighters. Under these conditions it is not

surprising that the hand-held extinguishers were ineffective. These devices are designed to fight

fires that can be readily approached. The very limited capacity and range of a hand-held gaseous

or dry powder fire extinguisher made them poor choices in this particular case, and this was likely

a contributing factor in their ineffectiveness in this particular incident.

The final factor contributing to the delay in declaring a fire emergency is the position of the fire

protection annunciator panel and the suppressed sound of the alarm. The panel was not readily

visible to the operators in the control room and the fire alarm buzzer had been covered with tape. 

Also, there were many other alarms in the control room that must have diverted the attention

from the fire panel. It is important to note that the operators, even after receiving a verbal report

of smoke in the switchgear room, did not approach the fire protection panel to verify fire detector

conditions.

Such conditions may be addressed in a fire PRA but may well be overlooked. Current

methodologies would likely have led to discovery of some of these conditions if exercised fully. 

In particular, a fire PRA walkdown would have considered the position of the fire annunciator

with respect to the location of the operators and would have likely detected the condition of the

buzzer. Of course, in such situations as tape over the buzzer, it is quite likely that the tape would

be removed as a result of the discovery during the walkdown and the PRA analysts would assume

lack of tape as the normal condition. However, this may be an optimistic assumption and a

thorough analyst would likely attempt to discern the original reasons for the presence of the tape. 

Had, for example, plant operators been interviewed as a part of the PRA process, and had they

stated that multiple false fire alarms had been a problem at the plant, then the PRA analyst would

likely apply a judgmental factor to “degrade” the response time for fire detection and verification. 

This would, however, be highly dependent on the approach and knowledge state of the analyst. 

No clear or consistent guidance in this regard is currently available.

Another point of interest in this incident is the fact that a few erratic indications were noted on the

control board through the course of the incident. This indicates that control circuits can fail

erratically under fire conditions. The exact reasons for the observed behavior was not reported

for this incident.

This incident also demonstrates two points related to cable fires and fire stops in cable trays. In

this case the fire propagated out of the panel top, up a cable riser for about 10 feet, and along the

intersecting horizontal tray for about 8 feet. Second, a fire stop in a horizontal cable tray can be

effective in stopping the progression of the fire. In this case, the fire propagation in the horizontal

tray ended at a raceway fire stop. Third, fire stops in a vertical cable tray may be ineffective. In

this case the fire in the riser jumped past a fire stop and continued to propagate. It is not clear if
A24-5

propagation was delayed by the stop. Fire PRAs will often assume some credit for fire stops in

cable trays limiting the extent of fire damage, although practices vary widely.

PRA practices with regard to panel fires vary widely. For example, the EPRI Fire PRA

Implementation Guide (see report body for associated references) recommended that fires

initiated in a closed and unventilated panel could not propagate out of the panel, and such sources

could be screened. This was a point of considerable debate in the USNRC IPEEE review

process. Indeed, the Waterford fire was one of the incidents cited as the basis for technical

concerns regarding this practice. In this case, the fire did propagate out of a nominally closed

electrical panel, along a vertical riser and into a horizontal cable tray. Ultimately, EPRI developed

revised guidance and licensees were asked to reconsider the potential for fire spread outside of a

closed panel for a range of panel types. While this resolved the concerns in the context of the

IPEEE process, the more general methodological debate has not been fully resolved.

From the observations provided in the investigation report, it can be inferred that the flames on

the horizontal segment of the cables were of limited height and/or limited duration. This is

because damage to a tray immediately above was very limited and no propagation of the fire to

the next higher tray was observed. The cable combustibility properties would clearly impact this

behavior, and it must be noted that these aspects of the incident are not known. Given the age of

the plant (construction began in 1974) it is quite likely that the cables used at Waterford are

qualified as low flame spread per the 1975 IEEE-383 test standard. In fire PRAs, a large

variation of fire propagation patterns are predicted depending on the severity of the exposure fire,

cable material characteristics and the approach to estimating fire growth behavior. In some cases

fire models are used to predict fire growth, and these models explicitly consider cable material

flammability parameters. In other cases, fire spread is based on the results of past fire experiments

applied to a given case. This practice has been criticized as a part of the IPEEE review process,

and not considered to be well founded. This case does confirm behaviors that have been noted

experimentally. In particular, fires propagate much more readily in vertical cable trays than in

horizontal trays.

The fire damage to adjacent switchgear cubicles is also interesting to note. Only two adjacent

cubicles were damaged severely. Four other cubicles, next to the first two, experienced minor

surface damage. It is suspected by investigators that the radiative heat reflecting off of the wall

that runs parallel to the switchgear caused the damage to these four cubicles. This demonstrates

that despite a severe fire in one cubicle, the fire may not propagate internally in the horizontal

direction. In a fire PRA, practices in this regard vary widely. Some PRA’s would credit a solid

steel barrier with preventing fire propagation. In other analyses, if the cubicles are separated by a

single metal sheet, the likelihood of propagation across cubicles is considered to be high. Testing

(References [A24-2,3]) illustrates that fire propagation given a solid single wall panel is unlikely

unless there is direct contact between the wall panel and a secondary fuel source. It is not clear

what the exact configurations involved in this case were. Radiative heat reflecting off of other

objects is modeled in some of the existing fire propagation models. Re-radiation and reflection is

considered in such models as COMPBRN IIIe (Reference [A24-4]). Another observation of

some interest is that the heat shield (partial wall) separating the two trains functioned properly and

protected the Train B switchgear from the fire.
A24-6

This incident also demonstrates that given an energetic failure of a switchgear and ensuing fire,

large quantities of smoke may be generated and the smoke will likely not be confined to the

compartment of origin. In a fire PRA, the impact of smoke outside the compartment of origin is

seldom modeled explicitly. In this particular case, smoke did escape from the room of fire origin,

but no direct effects of the smoke propagation were noted.

A final point of interest is that in fire PRAs, if the fire does not impact safety related equipment, it

is commonly assumed that the operators would take the proper actions to provide core cooling

and reactor shutdown, and such scenarios are screened. This incident demonstrates that the plant

may experience a large number of inter-related deviations from the expected chain of events. 

Such deviations may impact operators’ judgement regarding the best course of actions and proper

shutdown of the plant. In this incident, the fire was limited to non-vital switchgear but the overall

incident did cause considerable operational upset. Nonetheless, the operators took the proper

actions for the plant conditions that existed and ultimately there was only a minor challenge to

nuclear safety (a plant trip with redundant plant safety systems available).

A24.4 References

A24-1 Inspection Report 50-382/95-15, by U.S. Nuclear Regulatory Commission, of Waterford

Steam Electric Station, Unit 3, June 13-16, 1995.

A24-2 J. Chavez, An Experimental Investigation of Internally Ignited Fires in Nuclear Power

Plant Control Cabinets, Part I - Cabinet Effects Tests, SAND86-0336V1, NUREG/CR4527/V1, SNL/USNRC, April 1987.

A24-3 J. Chavez and S. P. Nowlen, An Experimental Investigation of Internally Ignited Fires in

Nuclear Power Plant Cabinets, Part II - Room Effects Tests, SAND86-0336V2, 

NUREG/CR-4527/V2, SNL/USNRC, October 1988.

A24-4 V. Ho, et al., "COMPRN IIIe: An Interactive Computer Code for Fire Risk Analysis,"

University of California at Los Angeles, EPRI NP-7282, May 1991.
A25-1

Appendix 25 - Analysis of Palo Verde, Unit 2 Fire on April 4, 1996

A25.1 Plant Description

Palo Verde Nuclear Generating Station is located outside Phoenix, Arizona. The site has 3

pressurized water reactor (PWR) units rated at 1,270 MWE each. The units each started

commercial operation between 1986 and 1988. 

A25.2 Chain of Events Summary

On April 4, 1996, Unit 2 was in a refueling outage. At 17:00 a fire watch detected smoke in the

back panel area of the control room. Smoke was emanating from the Train B emergency lighting

un-interruptible power supply panel. At about the same time, an auxiliary operator discovered

smoke and fire in the Train B DC equipment room at the 100 foot elevation of the Auxiliary

Building. This second fire was found on the 480/120 volt essential lighting isolation transformer. 

Multiple trouble alarms on the fire detectors had masked the actual fire alarm coming from this

equipment room such that the valid fire alarm signal that had come in was not noticed by the

operators.

The fires led to the loss of power to Train B control room emergency lighting circuits, to some of

general plant essential lighting, and to plant fire detection and alarm system panels. The circuit

breaker supplying power to the un-interruptible power supply panel tripped open when cables in

the conduit supplying the power supply panel overheated causing various conductors to short

circuit. The circuit breaker trip also de-energized power to the fire detection and alarm panels in

the auxiliary building. The fire alarm annunciator monitor (a computer screen) indicated a large

number of fire detector trouble alarms and these multiple alarms were scrolling on the monitor. 

This was attributed to the de-energized fire detection and alarm panels.

The fire in the equipment room was reported to the control room and the onsite fire brigade was

activated. They attacked the fire immediately and put it out in a short time. It is not entirely clear

if the fire brigade also reported to the main control room or not. The fire in the main control

room was apparently handled by the operators. In either case, the control room fire was also

quickly extinguished. The direct damage caused by these two fires was limited to the components

of origin. That is, neither fire propagated beyond the point of ignition.

A25.3 Incident Analysis

In this incident, the fires were neither severe from a classical fire protection standpoint nor from a

nuclear safety standpoint. The most interesting aspect of this incident is the occurrence of

multiple simultaneous fires, one of which occurred in the plant’s main control room. Incidents

involving multiple initial fires have been observed in several other plants (as discussed elsewhere

in this report). In some cases, particularly incidents at non-U.S. reactors, the fires have led to

extensive damage. PRAs currently do not treat concurrent fires. Rather, only a single fire is

postulated in a single location at a given time. This is discussed in detail in the body of this

report.
A25-2

The cause of simultaneous fires at Palo Verde was traced to a fault in the isolation transformer

located in Train B DC equipment room. This failure caused a short circuit fault to the station

ground through the transformer’s panel ground. The neutral leg of the transformer was not

connected to ground. Also, an inverter that served as the alternate essential lighting uninterruptible power supply was grounded improperly. The ground connection of the inverter

served as the return path for the isolation transformer’s ground fault that passed through the

essential lighting power supply panel. The conductors that carried the fault current were not

designed to handle the high currents caused by the fault. As a result they overheated and ignited

the combustible materials around them. Clearly, the common factor leading to the multiple

ignitions was a common overloaded electrical conductor.

It is also interesting to note that the fires in this case were, in effect, self-ignited cable fires. An

electrical fault led to an ampacity overload on a particular cable, and the cable was ignited in two

locations as a result. The units at Palo Verde are relatively new (construction began on Unit 2 in

1976 and the current U.S. cable flammability standard, IEEE 383, was adopted in 1975); hence, it

can be assumed that the cables installed in the plant are of a low-flame-spread type. This incident

is one of the very few incidents, if not the only incident, where a self-ignited cable fire in lowflame-spread cables has not self-extinguished. In typical fire PRAs, the potential for a sustained

self-ignited cable fires is typically considered vanishingly small provided the cables are certified as

low-flame-spread. This incident appears to illustrate that the possibility of such fires does exist at

some level, though the actual frequency of such fires remains uncertain. If this is, indeed, the only

such event in the experience base, then the assumption of low frequency would still be justified.

A25.4 References

A25-1 NRC Information Notice - IN 97-01, “Improper Electrical Grounding Results in

Simultaneous Fires in the Control Room and the Safe-Shutdown Equipment Room”, U.S.

Nuclear Regulatory Commission, January 8, 1997.
NRC FORM 336 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER

2-89)

NRCM 1102,

(Assigned by NRC, Add Vol., Supp., Rev.,

3201,3202 BIBLIOGRAPHIC DATA SHEET and Addendum Numbers, if any.)

(SeeInstructions OR the reverse) NUREG/CR-6738

2. TITLE AND SUBTITLE SAND2001-1676P

Risk Methods Insights Gained From Fire Incidents 3. DATE REPORT PUBLISHED

MONTH YEAR

September 2001

4. FIN OR GRANT NUMBER

Y6037

5. AUTHOR(S) 6. TYPE OF REPORT

S.P. Nowlen, Sandia National Laboratories

Dr. M. Kazarians, Kazarians and Associates Technical

F. Wyant, Sandia National Laboratories 7. PERIOD COVERED (Inclusive Dates)

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (if NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; if contractor,

provide name and mailing address.)

Sandia National Laboratories

Albuquerque, NM 871850748

Kazarians and Associates

Glendale, CA 91205

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (if NRC, type "Same as above"; if contractor provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission,

and mailing address.)

Division of Risk Analysis and Applications

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

IO. SUPPLEMENTARY NOTES

H.W. Woods, NRC Project Manager

11. ABSTRACT (200 words or less)

This report presents the findings of an effort to gain new fire probabilistic risk assessment (PRA) methodology insights from fire

incidents in nuclear power plants . The study is based on the review of a specific set of 25 tire incidents including fires at both

U.S. and foreign reactors. The sequence of actions and event s observed in each fire incident is reconstructed based on the

available information. This chain of events is then examined and compared to typical assumptions and practices of fire PRA.

The review focuses on two types of actions and events . First are events that illustrate interesting insights regarding factors that

fall within the scope of current fire PRA methods. Second are events observed in actual fire incident s that fall outside the scope

of current fire PRA methods. Fire PRA insights are then drawn based on these observations. The review concludes that the

overall structure of a typical fire PRA cant appropriately capture the dominant factors involved in a fire incident. However,

several areas of potential methodological improvement are identified. A few factors are also identified that fall outside the scope

of current fire PRAs including the occurrence of multiple initial fires or secondary fires, multiple simultaneous initiating events,

and some aspects of the smoke control and human response assessment.

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.)

Fire, Probabilistic Risk Assessment, PRA, Fire Events, Fire Incidents, Event Analysis

13. AVAILABILITY STATEMENT

unlimited

14. SECURITY CLASSlFlCATlON

(This Page)

unclassified

(This Report)

unclassified

15. NUMBER OF PAGES

16. PRICE

This formwas electronically produced by Elite Federal Forms. Inc.
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300