NUREG/CR-4229

Evaluation of Current Methodology

Employed in Probabilistic Risk

Assessment (PRA) of Fire Events

at Nuclear Power Plants

Prepared by C. Ruger, J. L. Boccio, M. A. Azarm

Brookhaven National Laboratory

Prepared for

U.S. Nuclear Regulatory

Commission
NOTICE

This report was prepared as an account of work sponsored by an agency of the United States

Government. Neither the United States Government nor any agency thereof, or any of their

employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus,

product or process disclosed in this report, or represents that its use by such third party would

not infringe privately owned rights.

NOTICE

Availability of Reference Materials Cited In NRC Publications

Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082,

Washington, DC 20013-7982

3. The National Technical Information Service, Springfield, VA 22181

Although the listing that follows represents the majority of documents cited in NRC publications,

it is not intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection

and Enforcement bulletins, circulars, information notices, inspection and investigation notices;

Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and

licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales

Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and

NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations In the Code of

Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series

reports and technical reports prepared by other federal agencies and reports prepared by the Atomic

Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items,

such as books, journal and periodical articles, and transactions. Federal Register notices, federal and

state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference

proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request

to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process

are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available

there for reference use by the public. Codes and standards are usually copyrighted and may be

purchased from the originating organization or, if they are American National Standards, from the

American National Standards Institute, 1430 Broadway, New York, NY 10018.
I

-NUREG/CR-4229

BNL-NUREG-51877

RP

Evaluation of Current Methodology

Employed in Probabilistic Risk

Assessment (PRA) of Fire Events

at Nuclear Power Plants

Manuscript Completed: February 1985

Date Published: May 1985

Prepared by

C. Ruger, J. L. Boccio, M. A. Azarm

Brookhaven National Laboratory

Department of Nuclear Energy

Upton, NY 11973

Prepared for

Division of Engineering Office of Nuclear Reactor Regulation

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

NRC FIN A3710

L
IIF
I

-iiiABSTRACT

This report presents a general evaluation of the current methodology used

by industry for the probabilistic assessment of fire events in nuclear power

plants. The basis for this evaluation, in which the strengths and weaknesses

of the methods are identified, stem from reviews of several, industrysponsored, full-scope Probabilistic Risk Assessments (PRAs) and various

deterministic/probabilistic approaches used by industry to judge their compliance with or used to seek exemptions from the fire-protection requirements

enumerated in Appendix R to 10 CFR 50.

In performing this evaluation of the current methodologies, state-of-the- F

art literature on the modeling of fire propagation/detection/suppression, input parameters, and modeling uncertainties are utilized. Areas are identified

where recently-developed, more accurate and complete techniques can be implemented to reduce the state-of-knowledge uncertainties that presently exist.

Recommendations are also made which could be the basis for a more suitable and

complete fire-risk methodology.
-ivCONTENTS

Page[

ABSTRACT ..................................... .......................... iii

EXECUTIVE SUMMARY ..................................................... ii

1. INTRODUCTION ..................................................... 1

2. LOGICAL STRUCTURE OF A PRA MODEL - A BRIEF OVERVIEW .......... .... 2

3. OUTLINE OF FIRE RISK METHODOLOGY - SALIENT LIMITING FACTORS ...... 4

4. FIRE HAZARD ANALYSIS 7...........................*...

7

4.1 Screening Analysis ...... ...................... 7.........• 7

4.1.1 Engineering Judgement *...... ......................... 7

4.1.2 Plant Model .......................................... 7

4.1.3 Fire Induced Sequence Frequencies .................... 7

4.1.4 Multiple Fire Locations - Spatial Interactions ....... 9

4.1.5 Uncertainties in Current Screening Methodology ....... 10

4.2 Fire Occurrence Frequency .......... .. ........... . ........ 11

4.2.1 Specialization of Fire Scenario Frequency ............ 11

4.2.2 Uncertainties in Frequency Data ...................... 12

4.2.3 Fire Zones ........................................... 12

4.2.4 Fire Size ............................................ 13

5. FIRE PROPAGATION ANALYSIS ............... ......................... 14

5.1 Fire Growth Modeling ............. ........................... 14

5.1.1 Deterministic Fire GrowthModeling.................., 15

5.1.2 Summary Evaluation of Deterministic Fire Growth

Modeling ..... .. .. •...•..... ....... ••...... •.....• 17

5.1.3 Detailed Evaluation of Deterministic Fire Growth

Modeling *...*..........•••........•........•......... 19

5.1.3.1 Fuel Burning Rate & Flame Spread ............ 19

5.1.3.2 Fuel Element Ignition ....................... 21

5.1.3.3 Fires Near Enclosure Walls or Corners ... ,... 24

5.1.3.4 Stratified Ceiling Layer .................... 25

5.1.4 Recommendations for Improving Fire Growth Modeling ... 25

5.1.5 Uncertainties Associated with Fire Risk Analysis ..... 26

5.1.6 Fire Growth and Suppression Interaction .............. 27

5.2 Fire Suppression Model ..................... ................ 28
I

CONTENTS (Cont'd.)

Page

6. PLANT SYSTEMS ANALYSIS .............. . .......... 30

6.1 Operator Actions .................................... ...... 30

6.2 Dependent Failures .. , .... ......................... ......... 30

6.3 Categorization & Methods of Analysis of Dependent Failures.. 31

7. CONCLUSIONS ............... g...................... ........... 33

REFERENCES ..... ........ .... ............ 35

L

r.
-viEXECUTIVE SUMMARY

In general, Probabilistic Risk Assessment (PEA) models and techniques are

tools which can be used to investigate a variety of aspects of nuclear power

plant safety. Like any tool (or a set of tools) PRA has certain inherent

strengths and limitations which make it very useful for some applications

while perhaps being poorly suited for others. Thus, although a PEA is inherently incomplete it does provide an investigative tool that is logical and

systematic. Also, although it lacks extensive experimental data, it does provide the means for developing an integrated plant model.

For example, PEAs which evaluate fire and fire-fighting activities have F

the potential to provide valuable insight into several aspects of plant fire

vulnerability and the relative merits of alternative fire protection configurations. PRAs can be structured to assess and quantify the reliability and

independence of various alternate shutdown capability schemes; it can be employed to rank fire vulnerable areas within a plant so as to identify critical

areas requiring greater fire protection emphasis or to assess the relative

merits of various fire protection strategies.

Thus, although current PEA state-of-the-art is not sufficiently developed

to be a basis for licensing decisions, future refinements may permit PRAs to

be used as Justification for or against the implementation of certain aspects

of fire protection requirements and guidelines put forth by the NRC.

However, a number of significant problems exist with fire-related PEA

methodology which limit its utility in this regard. These include: the poor

quality of the data base related to the comprehensiveness in fire incident reports; the lack of sufficient knowledge of fire/accident sequences and operator recovery actions; the validity of fire modeling techniques for nuclear

plant environments; and the limited knowledge of the reliability of certain

fire protection systems.

This report documents a study which has evaluated the current industry

methodology used for the probabilistic assessment of fits events. This study

makes no attempt to evaluate a "risk curve" in which the probability (or expected frequency) of exceeding a certain consequence level is plotted against

that consequence but rather it attempts to identify the strengths and weaknesses of the approach and methods employed therein for eventual "engineering

application" use. That is those applications which would emphasize the logical, systematic and investigative strong points of the methodology.

In performing this evaluation, state-of-the-art literature on the modeling of fire propagation, suppression and detection, input parameter and modeling uncertainties are addressed. In those areas where recently-developed,

more accurate and complete techniques can be utilized to reduce the uncertainties in the current methodology, recommendations are made which, if implemented, would put the probabilistic assessment of fire events on a firmer analytical foundation.
I

-viiThis study has shown that with the current state-of-the-art some of these

problem areas still prevail while others can be reduced. The physical modeling of fire propagation has advanced somewhat to provide greater assurance of

the validity of these latest techniques in nuclear plant environments. The

latest treatment of dependent failures or fire-induced spatial interactions

has enhanced our knowledge of fire-induced accident sequences.

Additional information, as the report indicates, is required before the

aforenoted shortcomings can be alleviated. These include, but are not limited

to, the following:

" The frequency/magnitude of fires in power plants.

" Exceedance frequency distribution of fires by combustible

classification.

* The distribution of time-to-fire detection as it relates to the location and magnitude of fires.

" Component responses and their damageability to fires of differing

magnitudes.

" Failure rate data on fire protection systems.

* Interzone propagation of fire stressors.

" Instrumentation response and recovery actions.
I

1
--1--

1.0 INTRODUCTION

Not until recently has there been much attention devoted by the nuclear

industry in investigating the occurrence of fires and their effects on nuclear

plant safety. Indeed the issues associated with the assessment of fire risk

are highly complex. The methodologies developed are fraught with uncertainties; approximations and engineering judgment are often required to arrive at

the needed results. Essentially, the approaches that have been employed in

so-called, full-scope Probabilistic Risk Assessments (PRAs) employ a hybrid of

models: physical models, point probability models and probabilistic models.

These models exhibit uncertainties as a result of schematization (model uncertainties). The influence variables accounted for in the models for investiga- [

ting the many aspects of fire (e.g., fire ignition, propagation, detection and

suppression the characteristics of materials under fire conditions, etc.) also

exhibit uncertainties with respect to their numerical values (stochastic variables). This situation is compounded since the performance of the plant-safety functions under fire-induced accident and upset conditions is the primary

objective of such studies. Thus, uncertainties can arise from different

sources, viz., (1) intrinsic randomness, (2) uncertainties with respect to the

mathematical/physical models and (3) uncertainties with respect to the stochastic models. The first source refers to the real scatter of the natural L

phenomena, i.e., fire; the other two refer to our lack of knowledge when attempting to translate the various phenomenological aspects of a fire incident

into physical and statistical models.

Model uncertainties are as equally if not more important as the intrinsic

randomness. Actual data are very limited, incomplete or not available at all.

Plant models and systems performance assignments, given a fire, that have been

utilized in these fire-risk studies have been questioned with regard to completeness in the sense that dependent failures due to system interactions resulting from a spatially connected intersystem dependency (spatial interactions) have not been fully addressed.

Complex issues notwithstanding, probabilistic approaches produce a logic

and rational framework for dealing with problems of safety. In our judgment

however, numerical values should not be regarded as true representation of

reality, but as operational values, supported by engineering judgment.

The purpose of this study is to review the current industry methodology

used for the probabilistic assessment of fire events to identify their

strengths and weaknesses. In this context, state-of-the-art literature on the

modeling of fire propagation, input parameter and modeling uncertainties, and

the modeling of detection/suppression are used to evaluate the current methodology. For those areas where recently-developed, more accurate techniques can

be utilized recommendations are proffered.

L
-2-

2.0 LOGICAL STRUCTURE OF PRA MODEL - A BRIEF OVERVIEW

To set the stage for subsequent discussion, this section is provided to

present a brief overview of the basic elements currently employed in a fullscope risk analysis. Its intent is only informative and is largely taken from

existing safety studies.

The complete, logical structure of a PEA model is shown in Figure 1. The

first step in the model is to identify "initiating events" which may lead to

core damage. An initiating event is defined as any event that initiates a

plant transient or otherwise perturbs the operation of the plant in such a way

that, depending on the response of systems and human operators, a sequence of

events involving undesirable consequences (core-melt) could result. In this

study of the impact of fire on plant performance, investigation of common

cause initiating events produced by physical interactions is crucial. Fire

can therefore cause a plant to trip and can cause failure or degradation of

one or more systems needed to respond to the plant trip. Fire-manifested

dependent failures arise as a result of the initiating fire, the subsequent

propagation and advection of the energy released and other fire-induced stressors such as smoke and toxic gases, and other spatial interactions brought

about by fire-suppression activities.

These initiating events are identified using several independent approaches including a fault tree analysis of the plant energy balance, failure

modes and effects analysis of plant systems, and cross-checks against reactor

operating experience.

Scenarios or accident sequences that could result are then identified

using "plant event trees." The top events of the tree represents the functioning of various systems so that each path through the tree represents an

accident sequence. At the end of each sequence, the plant is either in a

stable recovered condition, or has suffered some core damage. To analyze

fire-induced spatial interactions an adjunct study should be used to establish

a cross-reference between critical components and physical spaces so that system failure cutsets in the trees can be replaced with critical component location cutsets.

Given that the plant is in some core-damage upset state, the subsequent

events are represented by the "containment event tree." The methodology normally used is analogous to the plant model. The entry states to the containment event tree are the plant event trees, and the top events of the tree represent the occurrences of various containment phenomena. At the end of each

sequence, the core damage has either been contained or resulted in some release categorized by type, quantity and timing.

The consequences of these various radioactive releases are then analyzed

using site-specific atmospheric dispersion models. In the figure where supporting analysis is indicated, those that specifically deal with external

events, dependent failures, human actions, and spatial interactions, implicitly relate, in part, the need for fire analysis.
RISK

CUAVE FAMILY

DAMAGE

PINOI POINT

IV

FISE ASSEMOLY AND

DEI9AOM ITIO9 1211

DAMAGE

UPPA&AAY0

fRIsmnS

903~

INITIATING

WVENT

SELECTION

Is.2`1

OUAWIWICATION

flI. 1. 0`

CONTAINMENT

EVENT TREE CONTAINMENT

DEFINITION EVENT TREE

111.61 OUANTIFICATION

IIsE

SITE MODEL

OUANTWIICATIO

I12.4

q•I

I

EXTERNAL EVENTS/It DIENODENT YSTfMS

FAILURE ANALYSIS Ill

ANALYSIS M3 DATA

HUMAN ANALYSIS Iff

ACTIONS IfM

NOTE; THE STRUCTURE OF THE PLANT EVENT TrEiS VAPIS WITIl EVENT TYPE (INCULU•ES AUXILIARY SYSTEMS EVENT TREE1s)

CONIAINMENT CONTAINMENT RADIOACTIVITV

FEATURES FAILURE RELEASE

II1.2) ANALYSISIII.41 ,PALYSISIIII

PHIYSICAL

PROCESSES 111.21

NOTE: TilE STRUCTURE Of THE CONTAINMENT

EVEliT TREE DOES NOT

VARY WITH PLANT STATE

01 METIEROLOGY ANDI SUPPORTING

DEMOGRAPHY 112.31 ANALYSIS

FLUME D"ISPEsSION

AkO EVACUATION 112.31

FIGURE 1 SSPSA RISK MODEL ELEMENTS

F--- I P ý.-j
-4-

3.0 OUTLINE OF FIRE-RISK METHODOLOGY - SALIENT LIMITING FACTORS

In this section the basic steps employed within full-scope PRAs for evaluating plant risk from fire are summarized. Basically, the methodology employed in most of the PRAs documented thus far are largely based upon the efforts of Apostolakis and his associates at UCLA. The methods devised through

these efforts and used for the analysis of potential accident sequences involving fires consists of the following steps:

1. Identification of critical locations where fires can cause an initiating event and, at the same time, fail redundant engineered safety

functions, or disable several redundant and diverse safety related

equipment.

2. Calculation of the frequency of fires in these identified areas.

3. Calculation of fire propagation and the effects of detection and

suppression activities.

4. Assessment of the effects of initiating fires and subsequent growing

fires on the initiating events, i.e., various categories of Loss-OfCoolant Accidents (LOCA) and transients (see Figure 1).

5. Assessment of the effects of these fire scenarios on accident seqences as defined by the event trees (Figure 1) corresponding to the

identified, fire-induced initiating events.

6. Estimation of the frequencies of the various fire-initiated plant

damage states (e.g., core-melt frequency).

Indicative in the execution of these six major steps, required to quantify fire-induced plant damage state frequencies, are considerations related to

a) the occurrence of fires, b) the physical effects of fires, and c) the response of the plant. Crucial is the fact that the plant response is affected

not only by components damaged by the fire, but also by comonents being unavailabile due to other causes (e.g., random failures, maintenance and firefighting activities). Further section shall expand on this approach.

In most studies employing this methodological framework limitations on

its implementation have been noted by both the PRA practitioner and the PEA

reviewer. The following lists some of these limiting factors which are indications that (i) the fire analysis was carried out under resource limitations

that limited the scope of the analysis activities, and (ii) that fire and its

effects on plant safety have not received as much attention as other parts of

risk assessment. Thus, major assumptions had to be made in order to perform

the analysis. These salient limiting factors are noted below:
a

-5-

LIMITING FACTOR COMMENT

Probability of Specific

Location of Fire

Cable Routings

Failure Models

Fire Growth

The frequency of fires were derived from the experience of all U.S. nuclear power plants. The extent to which these data reflect plant specific

data is not entirely certain. Possibly the use of

non-nuclear data as a surrogate to nuclear data

would alleviate this concern.

The analyses are usually based on the location of

important cables and equipment that is usually provided in Fire Hazards Analyses Reports (FHAR) and

Appendix R submittals. In some cases the information extracted is adequate, in others a great deal

of uncertainty exists since detailed information is

not available.

Hot-short calculations used to identify probability

of spurious actuation are heavily influenced by

analysts' judgment. Detailed data do not exist.

Recent, more in-depth fire risk studies have investigated the possibility of hot shorts in control

cables. However, their impact on the plant are explicitly considered only for a limited number of

components and fire zones.

Fire propagation is based upon physical fire growth

models with detection/suppression activities decoupled from the analyses. Large uncertainties exist

in the data employed in these physical fire-growth

models and their mathematical representations.

Fire suppression is based upon industry-wide data

and is not necessarily directly representative of

actual characteristics of the fire areas of concern. Suppression activities do not address the

potential for damage by suppression agents to other

equipment not directly involved in the fire.

Errors of commission by control-room operators as

instigated by failures in the instrumentation circuit are usually not analyzed explicitly. Recently

concluded PRAs have investigated to some extent the

impact of fires on instrumentation, notably cable

spreading room and control room fires. These later

studies note that whenever a fire is postulated in

an area where it can affect instrumentation, the

question of completeness becomes very important.

Understandably, it is very difficult to know what

information reaches the operators, how they respond, and how they should coordinate their activities with manual fire-fighting activities.

[

[

f

I-I

Fire Suppression

Operations Staff Effects
I

-6-

LIMITING FACTOR COMMENT

Smoke Propagation

Fire-Initiated Accident

Sequences

Flooding From Fire

Suppression Activities

The effects of smoke on the operations staff is not

analyzed explicitly. The effectsof smoke and toxic gases on electronic components is usually not

appraised. However, recent studies that included

spatial interactions on a more formal basis have

investigated the impact of smoke on a limited

basis.

The analysis of fire-initiated accident sequences

is usually not detailed. A more detailed analysis

should explicitly include the timing of events, the

onset of other initiating events, the possibility

of restoring lost functions, the possibility of errors of commission, and a detailed analysis of

local actions outside the control room.

The effects of flooding from fire-fighting activities have not been analyzed explicitly.

The above discussion tends to emphasize that the ability to estimate the

fire risk of potential reactor accidents should largely be determined by plant

models having the capability to analyze statistically dependent multiple failures. Granted, the importance of dependent failures, for all aspects of nuclear risk, has been indicated in recent PRA studies as well as in documented

reactor experience.

Other assumptions and limitations are usually noted throughout fire-risk

analyses. These additional assumptions pertain to the analysis of specific

fire areas, enclosure geometry, and equipment contained therein and phenomenological model uncertainties. The following details further these and other

items of concern and where appropriate recommendations are provided. It also

provides an in-depth review of fire-risk analysis methods and approaches.
I

-7-

4.0 FIRE-HAZARD ANALYSIS

4.1 SCREENING ANALYSIS

Theoretically, a fire-risk analysis should include the potential contributions to risk of fires anywhere in the nuclear power plant. By screening

out unimportant locations, however, the amount of work required can be greatly

reduced without sacrificing significant confidence in the results. The purpose of the screening analysis is to identify the locations that are important

to the fire-risk analysis.

To protect against the effects of a single fire, redundant components and F

systems in a nuclear power plant are typically separated from each other by a

combination of empty space and barriers. For the purpose of initial fire-risk

analysis, fire locations are usually considered to be coincident with the fire

zones defined by the utility in its fire hazard analysis and Appendix R review.

The "importance" of a fire location is measured by its potential contribution to the frequency and the nature of a release of radioactive material

resulting from damage to equipment located therein. Since this cannot be determined until at least the first iteration of the fire-risk analysis has been

completed, more approximate measures are employed. The primary measures are

the type and the quantity of fire-vulnerable safety equipment at the location

of interest. Several levels of screening analysis are usually employed.

4.1.1 Engineering Judgment

The simplest type of screening analysis employs only engineering judgment. The analyst surveys the entire plant and decides in which areas a fire

may have safety significance; usually if it contains enough safety equipment

so that a severe fire could fail one or more safety systems. Although this

method usually identifies the critical areas, it is clearly not guaranteed to

identify all since dependent failures and spatial interactions, and the possibility of zone-to-zone propagation are not fully addressed.

The fire protection reviews and a study by Gallucci 1 employs such a

screening approach. Because there are many rooms that contain some safety

equipment, that study considered fire occurrences in many locations. However,

only a small number of locations contribute significantly to the fire risk in

most power plants; the rooms that contains many divisions of safety equipment.

The less critical locations can be screened out by performing a failure modes

and effects analysis.

4.1.2 Plant Model

A somewhat more systematic method for screening combines the use of engineering judgment with an explicit plant model. Use is made of a simplified

representation of a power plant's behavior using either event tree or fault

tree logic. Using either form with knowledge of the locations of important

equipment within the plant, the analyst may then directly observe how a fire
-8-

in a given area can initiate or contribute to important accident scenarios.

The reduced role of judgment in this type of analysis is an incentive for

using this approach. However, increased complexity is indicated.

This form of screening was employed in the-fire-risk portions of the

Zion 2 and Indian Point 3 studies. At each location considered, the loss of all

the equipment in the zone is postulated regardless of the size or position of

the fire in the zone. If by use of a plant model it is found that an initiating event (LOCA or transient) will not occur, the location is eliminated from

consideration. Given the potential for a fire-induced LOCA or a transient

(including a reactor trip), a number of safety functions are required for safe

shutdown. If the loss of all equipment in the zone of interest prohibits the

performance of any or all required functions, the zone is further considered

using more detailed fire growth and fire suppression analyses.

4.1.3 Fire Induced Sequence Frequencies

One disadvantage for terminating the screening process at this stage is

the potential for omitting fire sequences leading part-way to core meltdown

but requiring additional component failures to result in the top event. For

example, a sequence initiated by a fire in one location, plus a dependent

failure of components in other locations, would be screened out by this

method.

This weakness can be removed and additional screening of the critical

areas accomplished by roughly estimating the frequency of the scenarios in

which they are involved. For example, the fire-risk analysis for the Limerick

Generating Station4 included such a systematic ranking of each fire zone by

its contribution to the fire-induced core-melt frequency. After establishing

which zones could contain a significant fire that both causes an initiating

event and adversely affects the performance of mitigating systems, the frequency of such fires was quantified.

Data 5 - 8 for fire incidents were used to estimate the frequency of fires

in general plant locations such as the reactor enclosure and the control

structure. Then the frequencies of fires for the individual fire zones were

calculated by partitioning the frequency of fires for the appropriate general

location based on the ratio of the weight of combustible material contained

within a zone to the total weight of combustible material in the general location. Although there is no justification for using this combustible weight

ratio for estimating specific zone fire frequency, the procedure should provide a rough estimate for screening analysis.

The frequencies of fire-induced accident sequences due to a combination

of fire damage and random equipment faults was determined by first selecting

the appropriate initiating event for each fire zone and evaluating the conditional sequence probabilities, given a fire, taking credit only for the availability of systems not affected by a fire in that zone. The various system

fault trees were requantified, with the failure probability of all the equipment in the fire zone set at 1.0. Next these conditional sequence probabilities were multiplied by the significant-fire frequencies of the appropriate

fire zones and the results for all sequences in each zone screened to obtain
I

-9-

the overall fire-induced core-melt frequencies for each zone. The screening

analysis was concluded by selecting, for a detailed fire growth analysis, all

fire zones for which the screening analysis predicted effects of fire in the

zone resulting in a contribution to accident-class or core-melt frequencies

exceeding 1 percent of the corresponding value for internal initiating events.

However, this screening analysis only addressed the impact of fire in the area

it had originated.

4.1.4 Multiple Fire Locations - Spatial Interactions

One weakness of this type of screening methodology is that sets of fire

locations are not considered for evaluation. For instance, if in two adjacent

fire areas each containing one train of safety equipment, fires that poten- V

tially can spread from one room to the other and disable both trains are not

studied. In the past it was felt that a very large and long-burning fire is

needed to penetrate most power-plant compartment walls. Since these scenarios

are usually considered as low-frequency events, their contributions to risk

were insignificant when compared with fire scenarios in areas that contain

both trains. However, newer plants 9 and updated plant designs which comply

with current fire-safety standards and which are, perceptibly, more fire safe

(on a relative basis) when compared with older plant designs, may not have the

more "obvious" fire hazards and potential fire propagation scenarios that have

been identified in previous fire risk studies. Therefore, for one to assure a

reasonable degree of completeness as to how fires contribute to risk-based

measures, other aspects such zone-to-zone fire propagation have to be included

in the screening analysis.

A means for studying intra-zone communication in full scope PRAs exists

in the form of a spatial interaction analysis. 1 0 This methodology provides a

cross-reference between critical plant components and spaces. This reference

is achieved by the listing of key equipment, piping, and power and control

cable runs by safety and support systems and identifying the rooms and spaces

in which they are located or pass through. This location information is codified and input along with a plant model into a location-dependent common cause

computer code. The code identifies which locations or combination of locations must be involved in an accident scenario for serious consequences to

occur. In this way an assessment is accomplished of the ranked importance of

these locations as a function of the potential initiation of accident scenarios, damage to safety equipment located there, the possible system interactions, and the probability of these events in that space. Use of this procedure in the screening analysis will help assure a reasonable degree of completeness in identifying important spatial interactions, i.e., those that are

significant risk contributions.

RECOMMENDATION: IN OUR JUDGMENT THE SPATIAL INTERACTION

ANALYSIS DESCRIBED BY KAZARIANS1 0 AND IMPLEMENTED IN THE

SEABROOK PEA11 REPRESENTS A SIGNIFICANT ADVANCE IN THE

FORMAT AND STRUCTURE NEEDED IN OVERALL FIRE-RISK ANALYSIS.

THE DEPENDENT FAILURE ANALYSIS, MODELED THEREIN, AND METHODOLOGY REDUCES SOMEWHAT THE ISSUE ON COMPLETENESS THAT

ARISES FROM QUESTIONS WHICH DEAL WITH FIRE-INDUCED PHYSICAL AND SPATIAL INTERACTIONS.
-10-

4.1.5 Uncertainties in Current Screening Methodology

One assumption in the current screening analysis methodology reviewed to

date that leads to overconservativism is that all cables and components in the

area containing the fire are assumed damaged. Because many fire areas within

a nuclear power plant are large and contain few combustibles, a single, small

fire in an area often cannot damage all safety equipment in that area. The

process of critical area identification can therefore be extended to define

those "critical locations" within the selected area where a fire may cause

significant damage. In addition to including the fraction of fires in a critical area which occur in critical locations in the screening analysis, the

screening process can be further narrowed by determining the fraction of fires

occurring in the critical locations which are large enough to damage the

equipment present.

The distributions for internal area fire locations and fire size must be

developed from judgment. Factors entering into this judgment include fuel

loading, fuel type, equipment location, area usage by plant personnel, and administrative procedures. Clearly, these further screening procedures require

more information and analysis than presently employed. However, it is worthwhile to consider the merits of these additional complexities. The selection

of a method and its implementation should be based on the objective of minimizing the chances that important fire-source locations will be overlooked in

balance with the objective of minimizing the expenditure of effort on detailed

analysis of unimportant locations.

A weakness inherent in some screening procedures which leads to overconservativism is the lack of detailed knowledge of control-cable and power-cable

routings. Fires that engulf control cables or electric power cables are of

great potential concern because the cables from a variety of components can be

routed very close to one another. As a result, a single fire can cause malfunctions in all of the associated components. When cable routings are not

known explicitly, it is necessary to assume that cabling for all critical components pass through all possible cable routing areas. This may lead to the

conclusion that a system is damaged by a fire in the cable routing area, when

in fact the cables for that system may not pass through the area. This may

lead to the inclusion of unnecessary fire areas in the detailed fire-risk

analysis.

A criticism of most screening methodologies, which may become important

in nuclear power plants of advanced fire-safety design, is that they do not

account for the possibility that fire-caused simultaneous failures of many instruments and/or non-safety systems that may further initiate other accident

sequences. This may not be important for power plants having single rooms

containing redundant safety trains where fires would dominate the risk. But

for plants where the more obvious fire-risk sequences are designed out, initiating events due to non-safety system failure due to fire may become significant risk contributors.

Another subject concerning the completeness of screening analysis is the

effect of a fire on the integrity of the containment building. Even if the

core-melt frequency determined by a screening analysis is small relative to
the total from other external or internal events, it might dominate a plant

damage state. Therefore, a screening analysis should also estimate the frequency of selected plant damage states and include scenarios which have the

potential to threaten the integrity of the containment in the more detailed

fire-risk analysis.

RECOM4MENDATION: THE EFFORT SHOULD BE TAKEN TO ADEQUATELY

IDENTIFY ELECTRICAL CABLE ROUTINGS REMOVING UNCERTAINTIES

OVER WHICH SYSTEMS ARE DISABLED BY FIRES IN SPECIFIC LOCATIONS. CONSIDERATION SHOULD BE GIVEN TO FIRE-CAUSED SIMULTANEOUS FAILURES OF MULTIPLE INSTRUMENTS AND/OR NONSAFETY SYSTEMS THAT MAY FURTHER INITIATE OTHER ACCIDENT

SEQUENCES. THE FREQUENCY OF SELECTED PLANT DAMAGE STATESF

SHOULD BE INCLUDED IN THE EVALUATION OF WHICH SCENARIOS

HAVE THE POTENTIAL TO THREATEN CONTAINMENT INTEGRITY.

402 FIRE OCCURRENCE FREQUENCY

Once the screening analysis has identified the critical locations, likely

fire scenarios, and their potential impact on the plant, these are then subject to a more detailed fire-risk analysis to quantify the core-melt frequency

and plant damage states. The first step in this more in-depth analysis is the

quantification of the frequency of initiating fires associated with each likely scenario.

4.2.1 Specialization of Fire Scenario Frequency

The quantification of the initiating fire frequency can be considered as

a stepwise process.12 At each step the estimate of frequency becomes less

conservative; however, the level of effort required also increases in a stepwise manner. Additionally, it is important to note that as the fire scenario

frequency is further specialized (as discussed below), less data are available

for the specific fire class of interest, and the uncertainty in the frequencies increases. For example, while the occurrence frequency of fires in a

plant building may be established from actuarial data, the frequency of fires

in a particular room in that building is known to a lesser degree. This uncertainty is reflected in a wider spread of the distribution as the fire incident frequency is further specialized from general area to particular

location.

The steps in quantifying the fire occurrence frequency can be listed in

increasing levels of detail as: 12

"annual frequency of fire in the plant,

* fraction of plant fires that occur in a specific building,

* fraction of fires in a building that occur in a specific fire zone or

room,

" fraction of fire zone fires that occur in a specific location,

" fraction of fires at a location that are large enough to damage the

equipment required in the scenario, and

"fraction of those large fires in the specific location that are not

suppressed before equipment damage.
-12-

4.2.2 Uncertainties in Frequency Data

The current industry methodology evaluates the frequency of fires in generic plant buildings either by direct use of documented historical operating

experience at U.S. light water reactor plants 1 3 or by estimating frequencies

related to different mechanisms of fire initiation. These mechanisms are

based on the type of combustibles present in the building type and consist of:

self-ignited cable, transient combustible, and distribution panel.

Large uncertainties occur in the interpretation of historical data due to

discrepancies ?etween the actual number of fire occurrences and the number of

reported fires and the validity of applying industry-wide fire data to a particular power plant. Related to this second point is the use of weighting

factors to reduce fire frequencies due to increased awareness of the danger of

fires in a particular plant. For example in the Limerick study,I a five-fold

reduction of self-ignited cable raceway fire frequencies was assumed based on

Limerick protection measures and the use of flame retardant cables. This was

based on a claim that all historical self-ignited cable raceway fires were attributable to bad cable splices and underrated cables. However, it is unclear

that all such fires were caused by these factors, leading instead to a suggested three-fold reduction factor based upon use of newer cable/jacket firedamage indices.

Thus, because of the rarity of fire occurrence, there is need for models

that utilize to the maximum degree possible the available evidence from the

plants and, at the same time, provide results that can be used directly in

PEAs. Models used to account for plant-to-plant variability have been developed. 3 The use of these models, and the very nature of fire-incident data

analysis is however highly subjective. Important information that is usually

needed, but not adequately provided by actuarial data or data-analyses modeling is the precise location of the fire and its initiating stage and final

stage magnitude, exemplified possibly by data on energy release rate and fire

size. Until these particular data needs are fully addressed, viz., distributions of particular classes of fuels in a fire area, distributions of particular quantities of transient combustibles, distributions on spill sizes, and

distributions on initiating frequency, the use of actuarial data and accompanying data analysis remain highly suspect.

RECOMMENDATION: TO ALLEVIATE, SOMEWHAT, THE DATA NEEDS

CONCERN, EFFORTS SHOULD BE MADE IN THE POTENTIAL USE OF

NON-NUCLEAR FIRE-INCIDENT DATA AS A SURROGATE OR ADJUNCT

TO NUCLEAR DATA.

4.2.3 Fire Zones

In order to estimate the fraction of building fires that occur in an individual zone, factors including the number of zones in the building, the relative weight of combustibles in the rooms, and the relative projected area of

the combustibles in the room have been used. The logic behind these fractional weight factors is understandable but the rationale is unclear. In fact

other factors such as the types of equipment, number of cable conductors and

splices, voltage/power-ratings, geometric factors, etc., may be more suitable
I

-13-

for weighting the frequency of each fire zone. This matter of concern indicates that large uncertainties are present in the fire frequency estimates of

various zones.

RECOMMENDATION: AS INDICATED ABOVE, ZONE SPECIFIC, NON- [

NUCLEAR ACTUARIAL DATA MAY PROVIDE THE ADDED INFORMATION REQUIRED TO PLACE FIRE-INCIDENT DATA ON A FIRMER FOUNDATION.

SIMILAR CRITICAL LOCATIONS, SUCH AS CONTROL ROOMS, CABLE

SPREADING ROOMS, DIESEL GENERATOR BUILDINGS, ETC., IN NONNUCLEAR FACILITIES SHOULD BE QUERIED AS TO THE NUMBER OF REPORTABLE FIRE INCIDENTS, PARTICULAR LOCATIONS AND FIRE SIZE.

4.2.4 Fire Size [

In fire scenarios where the initiating fire source is a transient combustible, the current methodology usually considers fixed fuel quantities and

fire areas. However, with the present state of the art in fire risk analysis

further consideration on the various quantities of transient combustibles or

various spill areas, each with an assigned probability distribution should be

made. Hence, the effective damageability area and the critical propagation

time for transient combustible fires are expected to be in the form of distribution functions. The core-melt frequencies for transient combustible fire

scenarios can be mrde more realistic by the consideration of various size

fires and their corresponding frequencies much in the same fashion as probability of exceedance distribution functions are utilized in seismic risk

analysis.

RECOMMENDATION: FOR EACH CLASS OF TRANSIENT COMBUSTIBLE

NORMALLY FOUND IN NUCLEAR POWER PLANTS, METHODS SHOULD BE

INVESTIGATED FOR GENERATING EXCEEDANCE FREQUENCY DISTRIBUTIONS, E.G., PROBABILITY OF EXCEEDING A LIQUID POOL AND

SPILL OF A GIVEN SIZE.

L

L
-14-

5. FIRE PROPAGATION ANALYSIS

The preceding section discussed the steps taken in various screening

analyses for identifying specific equipment items that are critical from

either or both of two standpoints.:

1. Fire-induced failures or malfunctions that can cause LOCAs or transients to occur.

2. Fire-induced failures or malfunctions that can severely hinder the

plant's ability to properly respond to these upset conditions.

Having identified critical equipment, the next logical step, as indicated in

the previous section, is to continue the screening analysis to identify fire

locations in the plant that could be critical from the standpoint of adversely

affecting most of that critical equipment. It is these critical locations

upon which detailed quantitative analysis of frequencies of fire initiation,

propagation, suppression are focused, together with the attendant effects on

equipment functionability.

Continuing analysis emphasizes fires that can engulf control cables or

electric power cables. These types of fires are deemed more important than

those which can individually engulf mechanical equipment because the cables

from a variety of components can be routed very close to one another. As a

result, a single fire can cause malfunctions in all of the associated components. Fires in critical cable areas therefore form the focal point for more

detailed analysis that requires use of physical fire growth models and suppression models. A crucial limitation of the physical analysis presently employed however, is the fact that fire propagation models are explicitly decoupled from physical modeling which can account for suppression effectiveness.

The following provides a broad overview of these models employed for further

analysis of the identified critical locations.

5.1 FIRE GROWTH MODELING

Essentially, three different approaches to fire propagation have been

used to date. The first employs a statistical model based on past experience, 5 the second uses a multistan event-tree model,' and the'third employs deterministic physical models. 4- Because the behavior and effects of fire

propagation are dependent on the geometry of the fuel and the surroundings,

the physical modeling approach has been most used for modeling fire propagation in recent fire-risk analyses. The deterministic model contains the methodology which explicitly incorporates the physics of enclosure fire development. Most current fire risk analyses employ the computer code COMPBRN 16 as

the deterministic fire growth model.

Three primary assumptions underlie the methodology employed to develop

these models:
I

-15-

* The large size of nuclear power plant enclosures and the relatively

small amounts of readily ignitable fuel in those enclosures make rapid

flashover unlikely; the fire analysis therefore concentrates on the

fire growth phase. [

" The growth of fires in realistic scenarios is treated with simple

models.

" Fire growth and suppression are considered to be independent processes

and are treated separately.

The simple physical models in the COMPBRN code are essentially used to

calculate the heat transferred from a fire to its surroundings, the time to [

ignition or damage for affected materials, and the subsequent rate of fire

growth. Its predictions are subject to uncertainties, due to statistical uncertainties in the behavior of fires, uncertainties caused by basic modeling,

and uncertainties in the numerical values of the input parameters. The latter

source of uncertainty is propagated through the model by response-surface

techniques, and the statistical uncertainties are often left unquantified,

since they are generally dominated by the state-of-knowledge uncertainties.

To treat the basic modeling uncertainties, which are large and conservative,

the output of the model is treated as an expert's opinion, and a probability

distribution for the accuracy of the model is constructed based on available

data and the judgement of the analyst. Since the deterministic physical

models are known to be overconservative, this accuracy distribution is usually

used to remove some of the conservatism, i.e., for example, to lengthen the

fire growth times.

5.1.1 Deterministic Fire Growth Modeling

Briefly, the deterministic modeling in the COHPBERN code is a synthesis of

simplified, quasi-steady unit models resulting in what is commonly called a

zone approach model. There are many other computer codes 1 7-21 to analyze

fires in enclosures which use the unit-model approach. Of particular interest

is the DACFIR Code22 developed at the University of Dayton Research Institute,

which models the fire growth in an aircraft cabin as it progresses from seat

to seat. This may then be analogous to the problem of fire spreading from

cable tray to cable tray as analyzed in COMPBRN.

Generally speaking, these codes/models are limited by the modeler's ability to incorporate other features of the fire phenomena while still maintaining a simplified physical "picture" of how enclosure fires develop. What

therefore drives the modeler is the tractability of the mathematical analysis

at the expense of incorporating these additional features hopefully providing

a requisite compromise between reality and practicality of implementation.

Basic limitations of zone-model approaches are that (1) complex enclosure

geometries cannot be addressed, (2) forced ventilation cannot be realistically L

modeled using simple unit models, (3) subsequent burning of excess pyrolozates

remote from its initiating source are not modeled, and finally (4) to account
-16-

for suppression activities in a concomitant fashion would breakdown the entire

philosophy of the utility of zone approaches.

Indeed, state-of-the-art numerical/physical techniques can handle these

additional aspects but at the expense of tractability. However, in suggesting

further modeling improvements one must not lose sight of the overall methodology employed in safety analysis including both internal- and external-event

analysis. One must not be tempted to overly improve one aspect of a complex

analyses without attempting equivalent improvements in other areas of the

overall study. Thus, further modeling effort must be appropriate and consistent both in terms of their accuracy and their economy of effort as seen in

the context of the safety analysis as a whole. It is particularly important

to avoid unnecessary use of very complicated and time consuming methods when

the basic data used is of low accuracy.

Thus, in lieu of large-scale computer codes to assess the fire hazard in

an enclosure, the unit-problem approach (as used in COMPBRN) is about the best

that can be taken at the present time. The issue is essentially one of weighing practicality, with regard to complexity, vs an acceptable degree of

accuracy.

However, because fire modeling is still in a developmental stage, many

judgmental assumptions must be made in both modeling and physical data in order to model fire development in the complex enclosures existing in nuclear

power plants. Additional complexity is introduced when one considers electrical cable insulation as the fuel rather than the more commonly considered

fuels such as plastic slabs, which may have a more uniform composition than

cable insulation.

In fact, as discussed later, some of the sub-models used in COMPBRN are

highly suspect. That is, although these models usually lead to highly conservative results, they do not adequately reflect the dependence on the physical

parameters which are evidenced in experimental data. Other models, assumptions, and omissions in the application of COHPBRN generate results that can

be either conservative or nonconservative. Steps have been underway however

to improve this basic modeling approach.

This combination of nonphysical models and conservative as well as nonconservative assumptions leads to very large uncertainties in the deterministic modeling process. It is therefore also difficult to quantify the effects

of these uncertainties on the probabilistic analysis, since the latter uses

the results of the deterministic analysis as input. In any case, an evaluation of the modeling and assumptions of the COMPBRN code and its application

is summarized below. A more detailed discussion of each item of concern follows in Section 5.1.3 along with some suggestions in Section 5.1.4 for possibly reducing the uncertainties.
I

-17-

5.1.2 Summary Evaluation of Deterministic Fire Growth Modeling*

The deterministic methodology contained in the computer code COMPBRN has

been used to evaluate the thermal hazards of postulated fires in terms of heat [

flux, temperature, and fire growth. This code employs a unit-model approach

which is relatively acceptable given the current state of the art in enclosure

fire modeling as discussed above. However, some of the submodels contained in

the code can be improved without undo complexity and some assumptions are

overconservative, while other assumptions and applications can yield nonconservative results. The uncertainties arising from the combination of these

counterbalancing models and assumptions are difficult to quantify, but judgmentally, the deterministic analysis is generally biased on the conservative

side. However, to reiterate, the state-of-the-art in fire modeling is such

that less uncertain results can be attained with improvements in the existing

model.

The burning rate model is probably the most important source of uncertainty in the COMPBRN code. The methodology employed is oversimplistic since

it implies that the burning rate should be constant for a specific cable sample with a constant externally imposed heat flux. Instead, the fuel burning

rate should be dependent on the instantaneous size of the fire. Data show

variations of a factor of three or more in burning rate during one test.

Also, use has not been made of existing cable flammability data.23-24 It is a

difficult to determine if the cable insulation burning rates obtained by the

COMPBRN methodology are conservative or nonconservative.

It is important to distinguish between the burning rate of already ignited cable and flame spread over virgin cable. The COMPBRN discretization of

fuel elements (cables) leads to problems and potential error in the determination of flame spread. The flame spread velocity in COMPBRN is dependent on

the second power of the time-averaged external heat flux, which is inconsis- F

tent with the first power dependence of the fundamental equation of

Williams. 2 5 Also, for very small fuel element size, the flame spread rate approaches zero.

RECM1MENDATION: EMPLOY MORE REALISTIC FLAME SPREAD MODELS 25 -26

DESCRIBED IN THE OPEN LITERATURE WITH RECENT CABLE FLAMMABILITY

DATA.

Another example of inappropriate modeling is the fuel element ignition

time relationship. This model yields a finite value for fuel ignition time

even if the incident heat flux is considerably below that critical value (jo

kW/m ) found necessary to initiate cable insulation damage in experiments.

The model assumes a constant input heat flux even when cables in a convective

plume are considered. Convective heat flux must be a function of the difference between the plume and target temperatures, and must therefore decrease as

* During the preparation of this report, the authors became aware of a revised

and improved COHPBRN code which was not available during the course of this

study. This improved version eliminates some of the fire-modeling concerns

specifically addressed herein.
-18-

the target fuel heats up. Cable damageability criteria based on a critical

heat flux and an accumulated energy, as discussed later and in Ref. 27, would

be more appropriate. The model used in COMPBRN leads to rather small cable

ignition times. Considering this factor above, keeping in mind the dynamics

of fire growth and plant operational times, this could lead to overly conservative estimates on fire risk.

The model also neglects the partial reflection of the impinging radiative

heat flux to a target fuel element, as well as reradiation, convection, and

other losses. Therefore, COMPBRN may erroneously predict damage when it is

physically impossible or where damage is possible, damage times much smaller

than actual values may be predicted. This results from not accounting for

these losses causing the fuel elements to continuously gain sensible heat until its temperature surpasses a specified level, usually classified as the

ignition temperature.

The application of the model used to calculate the radiative heat transfer from the flame to a target object is also overly conservative. The radiative heat flux obtained from this application is much greater than that obtained from a classical Stefan-Boltzmann model, wherein the heat flux is a

function of the flame gas temperature to the fourth power. The COMPBRN model

also neglects the attenuation of the heat flux with distance due to intervening hot gas or smoke.

Another area of uncertainty concerns the quantity and size of the assumed

transient-combustible fires. As mentioned in the discussion of fire occurrence frequencies, the quantity and area of transient combustibles are usually

considered to be fixed. No rationale is given for the selection of these fixed values. It is certainly possible for larger quantities or combinations of

these fuels to exist in nuclear power plants. For example, given 1 gallon of

oil, it is not clear whether a pool spill 1-foot in diameter pool represents

a relatively more severe hazard than the same fuel quantity occupying a larger diameter pool. A larger diameter pool will give a larger heat release,

although for a shorter duration. Damage sustained by the target cable is

implicitly related to this combination of heat flux level and burn duration.

A distribution of varying quantities would therefore be more appropriate.

Other factors not considered in the application of the model would tend to

make the analysis nonconservative. These include the effects that enclosure

walls and corners (in close proximity to the initiating fire) have on the convected heat flux and the possibility of cable damage due to convection in a

stratified ceiling layer.

RECOMMENDATION: EMPLOY DISTRIBUTION FUNCTIONS OF FUEL QUANTITY AND SPILL AREA IN THE ANALYSIS. ENHANCE MODELING CAPABILITY TO ACCOUNT FOR WALL/CORNER EFFECTS. STATE-OF-THE-ART

CORRELATIONS EXIST FOR THIS ENHANCEMENT WITHOUT ADDING UNDO

COMPLEXITY.
I

-19-

5.1.3 Detailed Evaluation of Deterministic Fire Growth Modeling

5.1.3.1 Fuel Burning Rate and Flame Spread [

The COMPBRN code 16 models the specific burning rate, , of the fuel,

which, for complete combustion, is equivalent to the mass loss rate, for fuel

surface controlled fires as

" 0' + Cs "ext (5.1)

The term mo is defined as a specific burning rate constant, and the

second term represents the effects of external radiation on that burning rate.

The specific burning rate constant is assumed to represent the effects of

flame radiative heat flux to the surface, q"fl,r, and surface re-radiation,

q"loss, i.e.,

;" ("fl,r - ;"los)/Ls (5.2)

where L is the heat energy required to generate a unit mass of vapor.

Note that if the externally applied heat flux, ;text, is zero, the object will burn at a constant rate given by ;"-4. The consideration of

as a constant for an element of fuel burning during the early growth stages of a fire is questionable. For non-charring combustibles, such as PMMA

or Plexiglas, experimental data indicate that mo is indeed a constant. However, for complex solid fuels such as electrical cables, this may not be the

case. Also, the burning rate is a function of the size of the fire through

;"flr and q"loss- The mass loss rates of a small sample of PE/PVC cable,

subjected to a constant external heat flux, are shown in Ref. 24 to be time

dependent even at constant applied external heat fluxes. Thus, interpreting

a" and Cs as characteristic constants for a given material is highly

questionable. Use of large scale cable tray fire tests2 could reduce some of

this uncertainty.

In COMPBRN, Eq. (5.1) is applied to each small square "fuel element" into

which the individual cable trays (super modules) have been discretized. The

fire is assumed to initiate in one element and spread to adjacent elements

when their ignition criteria is reached due to the incident radiation from the

initial fire.

Application of Eq. (5.1) requires an algorithm to determine the ignition

times, tj, of the various discretized cable elements. The COMPERN ignition

time computational algorithm is reviewed later in this report. The ignition

of successive contiguous elements produces a cumulative flame spread rate,

vf, of:
-20-

NiL

vf t t

and an average flame velocity, vf, of:

Ni N

v w I/tI ) . (5.3)

NI i -i j

where I is the length (typically 0.5 - 1 ft) of each element in the direction

of flame spread.

The COMPBRN discretization of cable trays leads to problems and potential

errors in the flame spread calculation. As is evident from Eq. (5.3), the

effective flame spread rate between adjacent cable elements is equal to the

ratio i/t1 , where the ignition time, t*, is given by (Eq. 4.19 of Ref. 14):

t (w/40 [k (T * 0T)/q 12 (5.4)

For a given material, the value of tj is determined by the time-averaged external heat flux, qj, impinging on the jth cable element. Thus, the effective flame spread velocity, vf varies as the product:

*It2 qoj

This relationship is not consistent with Williams' fundamental equation of

fire spread25:

v (5.5) vf pAh

where q" is Lne heat flux to the fuel element at the "surface of fire inception;" p is the fuel density; and Ah is the enthalpy increase required for

ignition. Thus, Eq. (5.5) indicates that vf is much less sensitive to q"

than is given by the second power variation in the COHPBRN formulation.

Another limitation of the COMPBRN flame spread algorithm is that it produces a flame spread rate of zero in the limit of vanishingly small values of

1. This can be shown by ascertaining that the heat flux, 43 becomes a finite value (determined by the radiation view factor) as I goes to zero. Thus,

erroneously small flame spread rates will result if the size of the discrete

cable elements is too small. However, it is not clear how small is "too

small" without comparing calculated flame spread rates with experimental data.
-21-

A comparison of COMPBRN-calculated-versus-measured cable flame spread

rates for nylon/PVC cables is presented in Section 4.4.3 of Ref. 14. The configuration involved upward flame spread for vertical cable tray fire tests

conducted by Underwriters Laboratories. Although COMPBRN provided a reason- J

able simulation of the measured heat flux distribution along the cable, the

vertical flame spread rates were grossly overestimated. Measured flame speeds

were in the range 0.08 to 0.36 cm/s, whereas calculated flame speeds obtained

with various values of m; and Cs were in the range 0.58 to 1.27 cm/s.

Moreover, the experimental flames often stopped short of the cable top, whereas the calculated flame spread encompassed the entire cable. Siu attributed

the overestimated flame spread to the neglect of cable insulation melting and

dripping in the ignition algorithm. Without a more detailed and comprehensive F

ignition/flame spread model, it is uncertain that these factors would lead to

better agreement. In fact, melting and dripping, would increase the burning

rate since fuel surface area increases.

RECOMENDATION: A MORE ACCURATE BURNING RATE MODEL IS REQUIRED TO AVOID USE OF CHARACTERISTIC "CONSTANTS" WHICH ARE

INDEED REPLACEMENTS FOR PARAMETERS WHICH ARE IMPLICITLY RELATED TO GROWTH AND FEEDBACK PROCESSES. THESE BURNING RATE

MODELJS OULD POSSIBLY BE EXTRACTED FROM MODELS DEVELOPED BY

NBS.1 -2

5.1.3.2 Fuel Element Ignition

In the COMPBRN code, a fuel element is considered ignited if its surface

temperature exceeds a critical ignition temperature, T*. Additionally, the

fuel elements are modeled as semi-infinite slabs and the losses from the fuel

to the environment due to reradiation and convection are neglected.t

In reference to the latter point, COMPBRN may erroneously predict damage

when in some cases it is physically impossible to attain ignition for the particular fire scenario under investigation. In those cases where damage is

possible, COMPBRN may predict a damage time much smaller than the actual value. These predictions occur because COMPBRN does not model the mechanisms for

heat losses from the fuel element mentioned above; the fuel element, therefore, continuously gains sensible heat, according to Eq. (5.4), until its temperature surpasses any specified level. Thus, all fuel elements are eventually damaged given that the exposure fire continues to burn.

The primary mechanisms of heat loss from the fuel surface to the environment prior to damage are radiation and convection. Heat losses due to phase

changes and fuel movement are negligible prior to melting or ignition and do

not contribute to the thermal behavior of the fuel element during most of the

period of interest, i.e., the period prior to damage and ignition.

tDuring the preparation of this report, the authors became aware of a

revised and improved COMPERN code which was not available during the course of

this study. This improved version eliminates some of the fire-modeling

concerns specifically addressed herein.
-22-

This expression for the ignition time, t*, Eq. (5.4) is obtained by solving the heat conduction equation, (Ref. 28, page 75) for the condition of a

constant imposed surface heat flux, ;;. Its usage in this context is incorrect since it implies that an ignition time is achievable no matter how small

a value of heat flux is applied. Cable flammability test data27 show that

cables are generally not damaged unless the heat flux is above'a critical value of about 20 kW/m owing to heat losses at the surface.

Also, the assumption of constant imposed heat flux is overly conservative

since the heat flux received by an object is a function of the object surface

temperature, Ts, which increases with time as the object is exposed to the

external flux.

For instance, in the case of an oil fire beneath a cable tray the convective heat flux at the cable surface is described through:

qh" h[Tp- Ts (5.6)

where Tpl is the plume temperature at the cable height, Ts is the cable

surface temperature, and h is the surface heat transfer coefficient. Therefore, the surface heat flux will decrease substantially as the temperature of

the cable surface approaches the plume temperature. The COMPBRN code conservatively assumes that the surface temperature remains at its initial value for

the duration of the fire.

For example, for a 1-ft-diameter oil pool fire the estimated plume temperature at 10 ft above the fire using three methods ranged between 370*K a' 3 0

450*K. These include two correlations of convective heat flux by Alpert,

[one of which is used in COMPBRN11 ] and a more recent plume correlation by

Stavrianidis.31 These low values indicate that cables, within the convective

plume and located 10 ft above this particular fire, would never reach their

designated critical ignition temperature of 840*K which COMPBRN predicts is

reached in 4 min.

Of course, one must also consider the radiative heat transfer from the

flame to the target (the electrical cables) in order to predict the time required for the cables to achieve this critical ignition temperature. In this

regard, audit calculations, using the method described in Ref. 32, yield a

radiative heat flux, ;"r, of 0.42 kW/m 2 . This is based upon use of the following equation:

;r = (Tfl4/4/W) (Ap A2)e (5.7)

where a is the Stefan-Boltzmann constant; Tfl is the flame temperature

(1255oK) 3 1; A is the distance of the target from the radiating body (with a

flame height of 5 ft 3 0 and a cable height of 10 ft: . is equal to 5 ft; and

Apeis the flames projected surface area. The emissivity, e, is assumed to

be 0.3 (the sum of a gaseous value of 0.2 and a luminous soot value of 0.1).
e

-23-

This value of radiative heat flux, when added to the previously calculated

convective heat flux, then yields a value of ignition time, t*, (via Eq. 5.4)

markedly higher than the 4 min obtained with COMPBRN.

Even the radiative heat flux model, as described in COMPBRN, yields a

value of radiative heat flux lower than that required to achieve the critical

ignition temperature of 840*K within 4 min. In COMPBRN, the radiative flux is

given by

q;r= FO-fl k/Afl , (5.8)

where Fo-fl is the shape factor between the object and the flame, Afl is

the flame surface area, and Qr is the heat radiated by the fire which is expressed as

Q - . (5.9)

r

In the above expression, y reflects the radiant output fraction (y-0.4 as assumed in Ref. 14) and Q represents the total heat release rate of the fire. To

reconcile this wide disparity between ignition times reported and those calculated by the methods described above, "back" calculations were made using

Eq. 5.4 which indicated that an imposed surface heat flux, q o, of -12

kW/m 2 is required to achieve an "ignition time" of roughly 4 min. This value

is obtainable using the COMPBRN model, if Afl in Eq. 5.8 represents the projected flame area (or pool area in this case) and not the flame surface area.

This is clearly inconsistent with the methodology used to derive Eq. 5.8.

These audit calculations clearly point out that the results of the

COMPBRN code yield an overconservative estimate of critical times to reach

cable ignition.

Even in the event that the radiative heat flux dominates the convective

heat flux, the target will not absorb the total flux since significant amounts

will be convected away. If a proper model for convective heat transfer, Eq.

(5.6), is used, once the surface temperature increases above the plume temperature, heat will be convected away from the target reducing the effects of

radiation.

Actually, as stated by Siu, 1 4 the concept of a threshold ignition temperature is somewhat imprecise. Experimental data generally exhibit significant

variations with further uncertainties arising if ill-defined cable insulation

compositions are involved. The crucial issue is not whether the fuel surface

reaches a certain temperature level, but whether the heat gains by the pyrolyzing gases are great enough to overcome the losses and trigger the combustion

reactions, and the resulting heat of combustion is sufficient to sustain the

reaction.
I

-24-

Lee 2 7 has developed a set of cable damageability criteria along these

lines. For an applied heat flux, the time for spontaneous ignition is defined

in terms of a critical heat flux, q;cr, at or below which ignition cannot be

initiated and an accumulated energy, E, required for sustaining ignition.

Critical times are defined simply though the following relation:

t wi/(qext - qcr) • (5.10)

RECOMMENDATION: THE CONVECTIVE HEAT FLUX RECEIVED BY A TARGET OBJECT SHOULD NOT BE CONSIDERED CONSTANT, BUT SHOULD ACCOUNT FOR THE INCREASE IN TARGET SURFACE TEMPERATURE WITH

TIME. CABLE DAMAGEABILITY CORRELATIONS AND DATA27 SHOULD BE

EMPLOYED IN THE UNIT MODEL APPROACH TO INSURE IGNITION IS

NOT PREDICTED WHEN THE IMPOSED HEAT FLUX REMAINS BELOW CRITICAL VALUES.

5.1.3.3 Fires Near Enclosure Walls or Corners

The COMPBRN code does not consider the effects that the close proximity of

walls or corners of an enclosure can have on the temperature distribution in

the convective plume of fires. The presence of walls will increase the gas

temperature at an elevation above the fire by a magnitude that can be theoretically estimated by considering initiating fires having "equivalent" heat release rates 2 and 4 times the actual heat release rate for walls and corners,

respectively. The neglect of this effect will have a nonconservative effect

on fire growth calculations if cable trays are located near a wall.

Evidence of the increased gas temperatures at a given elevation above a

fire is available in the literature. In Ref. 30, Eqs. (3) and (4) illustrate

the concept of equivalent heat release rates mentioned above. Figure 6 of the

same reference shows test data of the fire positioning effects on ceiling temperature. On page 119 of Ref. 33, the average plume temperature rise is found

to increase by factors of 1.75 and 2.5 for fires adjacent to walls or corners,

respectively. Finally, Table A-i of Ref. 34 shows the upper-layer gas temperature is likewise affected by burner locations near walls and corners.

The increased gas temperatures in the presence of walls are due to the effects of reduced cool air entrainment, which results in higher flames due to

the additional distance needed for fuel vapor/air mixing. Concerned is therefore the distribution of energy, not just the maximizing of the overall energy. Even though the code considers complete combustion, which maximizes the

heat release rate and the temperatures near the fire, the wall effect causes

local temperature increases which must be considered to yield a more realistic

results.

RECOMMENDATION: EMPLOY THE CORRELATIONS OF WALL AND CORNER

EFFECTS INTO THE PRESENT DETERMINISTIC ANALYSES.
I

-25-

5.1.3.4 Stratified Ceiling Layer

The application of the COMPBRN code in the fire risk analysis have failed

to consider the stratified hot gas layer near the ceiling of enclosures even

though such a model is included in the code. This assumption that enclosure

effects are minimal may be valid since the fires considered are small with respect to the size of the enclosure. However, in small fire zones the hot gas

layer near the ceiling could preheat the nonburning fuel elements and reduce

their time to ignition. Some substantiation of the neglect of this effect

should be included in the analyses.

The ceiling gas layer model in COMPBRN is based on a simplified steady

gross heat balance. A uniform gas temperature is assumed throughout the upper F

hot layer. Alpert29 indicates that the ceiling gas temperature decreases with

distance from the ceiling, as well as with radial distance from the plume

axis. More recently, Newman and Hill 3 5 have developed a transient correlation

for the heat flux below the ceiling of an enclosure containing a pool fire,

which includes the effects of forced ventilation. This correlation shows a

decrease in heat flux with distance below the ceiling, but contrary to Alpert,

it indicates very little dependence on lateral separation. This evidence indicates that the assumption of a uniform upper layer gas temperature is an

oversimplification, which neglects the effects of horizontal separation.

Additionally, audit calculations using COKPBRN have shown that the upper gas

layer model in the code cannot predict the layer temperature or boundary location if the enclosure does not have openings or there is no forced ventilation. This is a severe limitation of the codes usefulness.

5.1.4 Recommendations for Improving Fire Growth Modeling

The previous sections have detailed some of our concerns regarding the

sometimes nonphysical, usually overconservative, deterministic fire growth

modeling in the COMPBRN code. There are five major areas where we feel the

modeling can be made more realistic:* the cable burning rate model, the flame

spread model, the fuel element ignition time algorithm, the flame radiant heat

transfer model, and the surface temperature dependence of the convective heat

transfer model.

Incorporation of recent test data 23 - 2 4 on cable flammability into the

determination of the burning rate of the EPR/Hypalon cables should give a more

realistic representation of fire growth.

One option to improve the flame spread algorithm would be to use an empirical relationship between the flame spread rate and the external heat flux

*During the preparation of this report, the authors became aware of a revised

and improved COMPBRN code which was not available during the course of this

study. This improved version eliminates some of the fire-modeling concerns

specifically addressed herein.
-26-

as utilized in the Harvard1 7 and DACFIR2 2 codes. This option has the difficulty that there are very little quantitative flame spread data available. An

alternative approach would be to use the Williams 2 5 fire spread equation

(5.5), which would require experimental verification.

The use of cable ignition/damageability criteria, 2 7 based on a critical

heat flux and an accumulated energy, would yield cable ignition times more

consistent with test data. Improvement of the model for calculating the

radiated heat flux received by a fuel element, by using an appropriate flame

area and by considering attenuation due to hot gases and soot, will result in

more realistic fire growth scenarios and establish a more accurate proportionality between convective and radiative heating. Finally, the convective heat

transfer model should take into account the instantaneous temperature of the

surface of the object being heated. This will reduce the convective heat absorbed as the object heats up and will allow for convective cooling if its

temperature exceeds that of the local fire plume.

5.1.5 Uncertainties Associated with Fire Risk Analysis

In general, a PRA should be a realistic appraisal of the consequences

that could potentially result from nuclear reactor accidents and should provide a quantitative assessment of the likelihood of such occurrences. It is

particularly in the latter aspect that PRA differs from the traditional licensing approach to safety analysis in which "worst-case" scenarios and assumptions are stressed. Indeed, such an approach has some merit because it

builds in a margin of safety, however, for risk impact assessment it is more

relevant to make a best estimate of what the potential risks are. Where results depend on a chain of calculations, worst-case assumptions for each independent source of uncertainty would yield a final result which will be quite

inappropriately pessimistic.

When performing a PRA, realistic analyses should be applied uniformly.

This, therefore, leads to questions concerning the relative "sophistication"

of the various models employed and uniform validity of the attendant, independent sub-models.

The science of fire protection has progressed more slowly than other aspects of combustion science. This state of affairs is due partially to the

complexity of uncontrolled combustion, i.e., fire and partially to the fact

that relatively large technological payoffs are not anticipated to be obtained

from scientific investigations of fires. The ever-present fire problems have

attracted fluctuating interest with relatively low average level of concern.

In the attempts to perform a fire risk analysis, this prevailing, but in

our opinion improving, condition leads to results that are fraught with large

uncertainties. These uncertainties, in general, arise from those associated

with the physical modeling of fire and in the modeling of the impact of fire

on plant systems.

In our judgment, the analysis of those statistically dependent multiple

failures, i.e., those which can arise due to the physical interaction of fires
I

-27-

on plant systems, must achieve a level of sophistication, structure, and formalism comparable to existing dependent multiple failure models before fireimpact uncertainties and questions on plant model completeness can be fully

addressed.

Methodologies addressing such physical interactions (as well as seismic,

flood, etc.) are being developed. In the more recent risk assessment

studies, 1 location-dependent fault trees have been used in this regard. Accordingly, a more formal structure for dealing with the physical interactions

of plant systems, as a result of fire, has been developed which would allay

some of the concerns and issues dealing with system impact completeness. With

this improvement in plant system analysis, as it pertains to completeness, it

then places increased importance on reducing the uncertainties in the physical I_

fire models that accompany this analysis.

As indicated earlier, these uncertainties are those connected with the

statistical uncertainties due to the random nature of fire and state-ofknowledge uncertainties in the modeling of fire. Basically, these uncertainties encompass both the uncertainty of not knowing and the uncertainty of not

being sure. From the standpoint of not knowing, risk methods and approaches

discussed herein purport to bias the conservative side; from the standpoint of

not being sure, the recommendations proffered for improving these methods and

approaches should provide some added realism. Recommendations notwithstanding, a great deal of further study in fire model research and experimentation

is required before our state-of-knowledge uncertainties can be reduced.

However, this additional study should be structured to further strive for

a compromise between accuracy in real fire simulation and practicality of

implementation. In particular, the fire growth model described herein, which

is basically a synthesis of various independent sub-models that are available

in the open literature, should be improved through proper implementation of

boundary conditions, burning rates, and flame spread rates sub-models as

identified in the previous section.

5.1.6 Fire Growth and Suppression Interaction

Before discussing the modeling of fire suppression, it is appropriate to

discuss further one of the inherent assumptions used in the application of

fire growth modeling as mentioned earlier in this section. More specifically,

we would like to discuss the interacting nature between fire growth and suppression activities. In the application of the fire growth model, it was assumed that a fire can progress regardless of suppression initiation, but will

terminate with some probability after an expected time which is required for

successful suppression. The lack of physical modeling for the suppression

phase of a fire scenario appears to be one of the weakest links in fire-risk

analysis. This deficiency seems to be a conventional practice, usually resulting in very conservative estimates for fire impact on equipment and

cabling.
-28-

5.2 FIRE SUPPRESSION MODEL

As discussed in the previous sections the deterministic fire growth model

is used to obtain the time available for fire suppression before the defined

extent of damage is sustained. The current methodology uses a probabilistic

fire suppression model to predict the probability of failing to extinguish the

fire within the time interval available before damage. The suppresion probability distribution is based on information presented by Fleming.

There are uncertainties arising out of the interpretation of this cumulative suppression/detection data. For instance in some analyses4 self-extinguished cabinet fire incidents were included in the estimate of the suppression success probability for cable raceway fires. In our opinion this credit

should not be taken for self-extinguishment when only cable raceways are considered. In other analyses 2- 3 substantial judgment is utilized in assessing

the dependence of the distribution on the size of the fire.

More basic is the fact mentioned earlier that the lack of physical modeling of detection and suppression is one of the weakest links in the fire-risk

analyses reviewed to date. In the analysis of a fire scenario, initiation

time for detection and suppression is of great importance. Detection and suppression can be achieved either manually or automatically. In a detailed fire

PRA, both detection time and suppression initiation time should be expressed

in the form of probability distribution function (pdf). For the automatic

suppression and detection response, some design charts are available which

graphically, or through some equations, determine the response time vs. the

spacing, ceiling height, and heat release rate. 3 6 - 38 If detailed fire growth

modeling, with the associated uncertainties of various fire parameters, is

available for a specific scenario, the detection and suppression response may

be directly estimated in the form of pdfs. If detailed fire growth modeling

is not available, a generic response can be considered by assuming the two extreme fire growths (slow, fast) as defined in Ref. 36. In this case, the

lower and upper bounds for response time may be .determined assuming fast or

slow fire growth, respectively. These bounds may be used to define a pdf for

response. The response time for the initiation of the manual suppression may

be estimated by means of available data on response time during fire drills

and some engineering judgment. The modeling of fire growth during the suppression phase can be very complicated depending on the governing mechanism of

the process (heat removal, chemical reaction, oxygen removal). However, for

the purpose of fire PRAs, a combination of simplistic models, coupled with empirical correlations, may be used. For example, the effect of sprinkler systems on fire growth may simply be modeled in the form of global energy

balance.39

In conclusion, the time in which fire can reach various stages of growth

is dependent on suppression initiation time. There is a strong belief that

fire cannot grow significantly once the suppression has begun. It has been

conservatively assumed that probabilities of various stages of growth can be

determined using the time period for the completion of successful suppression,

rather than the initiation of suppression. This is a very conservative assumption, and at present the effect of this conservatism on the final results

cannot be evaluated.
-29-

RECOMMENDATION: INVESTIGATE USE OF NONNUCLEAR DETECTION AND

SUPPRESSION TIME DATA AS POTENTIAL SURROGATE DATA FOR PURPOSES OF DISTRIBUTION GENERATION . REEXAMINE NONNUCLEAR

DATA BY COMPARING SPECIFIC AREAS IN THE NONNUCLEAR ENVIRONMENT TO CRITICAL AREAS IN NUCLEAR FACILITIES AND USE ENGINEERING JUDGMENT PERTAINING TO EXPECTED DIFFERENCES AND

SIMILARITIES FOR DETECTION TIMES, SUPPRESSION TIMES AND FIRE

AREAS.

F"
-30-

6.0 PLANT SYSTEM ANALYSIS

The objective of the plant-system analysis is to estimate the frequency [

of fire-initiated accident sequences leading to core damage once the frequency

of fire-induced component losses are assessed. Usually modifications are made

to the front end of existing event trees for other initiating events to specialize them for fires. The conditional branching probabilities are altered to

reflect the dependence on the fire. In cases where fires are treated as a

separate event, care must be exercised that data from which basic componentfailure rates are determined do not double-count these failures from fires.

6.1 OPERATOR ACTIONS F

Inclusion of operator actions is a subject leading to large uncertainties

in fire risk analysis. Operators can substantially influence accident scenarios by extinguishing fires, manually operating equipment, repairing or temporarily replacing equipment and negatively by taking actions which may worsen

the situation based on faulty information or otherwise. Analysis reviewed to

date have included a variety of operator actions. However, extremely crude

models have been used leading to large uncertainties.

RECOMMENDATION: DETERMINE WHAT OPERATOR ACTIONS ARE REQUIRED FOR RESPONSE AND RECOVERY GIVEN LOSS OF INSTRUMENTATION. DETERMINE IF HABITABILITY CONSIDERATIONS ARE IMPORTANT, ESPECIALLY FOR CONTROL ROOM AND ALTERNATE SHUTDOWN

PANEL LOCATIONS.

6.2 DEPENDENT FAILURES

The quantification of accident sequences involving fires follows the general methodology of developing event trees and fault trees based on fire induced initiating events. However special attention must be paid to intersystem dependencies introduced by fire. While early analysis based on simple

system reliability models indicated low values of accident probability, more

recent estimates employing more sophisticated plant and system level models

have yielded much higher numerical values than the earlier estimates. These

more recent estimates tend to be dominated by the effects of physical and

human interactions. These interactions tend to increase the probability of

each successive failure in an accident chain as compared to a chain of independent, random events. These various physical and human interactions result in dependent failures in the accident sequence which must be taken into

account to achieve a realistic perspective of accident probabilities.

Reactor operating experience also indicates that a succession of multiple

failures is more likely to occur in a dependent fashion as a result of some

human or physical interaction, as opposed to the case of an unfortuitous concurrence of independent events. Reliability and risk analysis have also made

it clear that dependent failures are major contributors to accident likelihood. This is a result of accident likelihood being small to start with, and

that multiple independent failures have been made to be exceedingly remote

events through the use of highly reliable equipment.
B

-31-

It is unclear whether previously published fire risk analyses have adequately treated dependent failures or systems interactions in the respective

plant and system models. There are examples of either experienced or postulated system interactions that have been missing in current risk analysis. 1

These include unconnected systems that share common locations and the attendant spatially related physical interactions arising from fire. Incomplete

enumeration of causes of failure at the lowest levels of a fault tree and the

abusive application of the assumption that the component failure modes are independent can lead to underestimation of accident frequencies by many orders

of magnitude.

The objective of the analysis of dependent failures is to be able to distinguish between important dependent failures that make a contribution to risk F

and those that can be postulated but make little or no contribution to risk.

It is also necessary to assure a reasonable degree of completeness in identifying important systems interactions that are significant risk contributors.

6.3 CATEGORIZATION AND METHODS OF ANALYSIS OF DEPENDENT FAILURES

The Seabrook risk model 1 1 from which most of the above discussion was

summarized contains a description of the categorization of dependent failures

and a number of different techniques for analyzing them in PRA studies. The

first level of categorization depends on the level of impact of the dependent

failure. This leads to three basic types of dependent failure: common cause

initiating events, intersystem dependencies, and intercomponent dependencies.

External events such as fire are mostly common cause, but in some cases they

can be intersystem or intercomponent, depending on the degree of damage due to

fire and whether an initiating event occurs as a result.

The second level of categorization depends on the fact that some types of

physical or human interactions that result in dependent failures are intentionally designed into the plant system. These include plant designed functional dependencies and shared equipment dependencies. These two types of dependency, together with physical interactions and human interactions, make up

the four subtypes of dependent failures.

Because of the existence of such diverse classes of dependent failures,

there is no one method of analysis which can be applied to all classes. Basically there are three methods of dependent failure analysis: explicit, parametric, and computer-aided. Explicit methods involve the identification of

specific causes of multiple failures. Among the dependent failures that are

explicitly modeled are external events such as fire. External events comprise

a major segment of the possible causes of physical interactions leading to

multiple failures.

Parametric methods such as the B-factor model are used to estimate the

reliability characteristics of systems subject to common cause failure. In

this method the specific failure causes are not directly identified. Instead,

parameters are used to model the effects of the failure dependence. No single

method of analysis can cover all the important aspects of dependent failures.

Explicit modeling of dependent failure interactions in event tree and fault

tree logic models can only be done to a reasonable degree of completeness for
-32-

those dependent failures that are readily identifiable from plant documentations and inspections. These tend to be the functional and shared equipment

dependencies, and tend not to include many subtle physical and human interactions. When used appropriately, the parametric methods will pick up many

causes of dependent failures that cannot be modeled explicitly in a practical

way.

The systems analysis task of a risk assessment considers all types of dependent failures, principally because this task conceptually disassembles and

reconstructs the plant to facilitate risk quantification. The methodology

suggested by the Seabrook analysis 1 1 includes explicit modeling and an

advanced version of the B-factor, parametric method which provides a means of

incorporating all relevant experience with common cause failures into the

analysis.

The third method of analysis relies on general purpose reliability analysis computer codes. This approach was discussed in the screening analysis

section where spatial interaction analyses were considered. Spatial interactions are a class of dependent failures.

RECOMMENDATION: DEPENDENT FAILURE ANALYSIS SHOULD BE INCORPORATED INTO THE PRA METHODOLOGY TO ADEQUATELY TREAT THE

VARIOUS PHYSICAL AND HUMAN INTERACTIONS MAKING IMPORTANT

CONTRIBUTION TO FIRE RISK. INCLUSION OF DEPENDENT FAILURES

IMPROVES THE DEGREE OF COMPLETENESS IN IDENTIFYING IMPORTANT

SYSTEMS INTERACTIONS THAT ARE SIGNIFICANT RISK CONTRIBUTORS.
I

-33-

7.0 CONCLUSIONS

The objective of probabilistic risk assessment studies of fires in nuclear power plants is to evaluate the performance of plant-safety functions under

fire-induced accident and upset conditions. Probabilistic approaches produce

a logic and rational framework for assessing problems of safety. However,

numerical values should not be regarded as a true representation of reality,

but as comparative values, used to assess relative levels of risk when supported by engineering judgment.

The issues associated with the assessment of fire risk are highly complex F

and the methodologies employed contain many sources of uncertainty due to the

extensive use of approximations and engineering judgment. Although probabilistic risk assessment is an invaluable tool in assessing the effects of fire

on plant safety system performance, the effectiveness of the methodology is

weakened by these uncertainties and a lack of completeness usually resulting

from resource limitations and the lack of attention fire and its effects on

plant safety have received until recently. In some areas recently developed,

more accurate and complete techniques can be used to reduce the uncertainties

and lack of completeness in the current methodology.

Major limitations of the presently employed probabilistic methodological

framework which have the possibility of being improved, include the identification of critical fire areas. AnalySis are usually limited to the most obvious

areas of fire damage. A complete analysis should include many more plant

areas as well as the possibility of fire spread across zone boundaries.

Spatial interaction analysis represents a significant advance in the format

and structure needed in overall fire-risk analysis. Its employment has the

potential of reducing somewhat the issue of completeness that arises from

questions which deal with fire-induced physical and spatial interactions.

The frequency of fires occurring at a specific location are currently derived from the experience of all U.S. nuclear power plants. Until sufficient

data, i.e., distributions, on the precise location of the fire, its initiating

stage and final stage magnitude become available, the use of actuarial data

and accompanying data analysis remain highly suspect. To alleviate this data

concern, efforts should be made in the potential use of nonnuclear fire incident data as a surrogate or adjunct to nuclear data. To enhance the possibilities of nonnuclear data being surrogate to nuclear data, zone specific partitioning of data should be attempted.

In some analysis detailed information on the routing of electrical cables

is lacking. These uncertainties lead to overconservativism in that equipment

must be assumed inoperable if there is any possibility of the cables passing

through an area damaged by fire. In developing a full-scope PRA the effort

should be taken to ascertain the detailed cable routings to preclude the inclusion of unnecessary fire areas in the detailed fire-risk analysis.

Fire propagation is presently based upon physical fire growth models with

detection/suppression activities decoupled. Large uncertainties exist in both

the mathematical models themselves and the data employed. State-of-the-art
-34-

correlations exist for enhancing these models without adding undo complexity.

These include more realistic flame spread models, more accurate burning rate

models, employment of distribution functions of transient fuel quantities and

spill areas, more realistic ignition/damage criteria modeling and inclusion of

wall/corner effect correlations. Additionally, recent cable, flammability data

is available to further enhance the fire growth unit models.

Fire suppression analysis is currently based upon industry wide data and

is not a reflection of the true characteristics of the fire areas of concern.

Nonnuclear detection and suppression time data have the potential to act as

surrogate data for purposes of distribution generation if partitioned by comparing specific areas in both the nuclear and nonnuclear environments.

The importance of operator actions upon loss of instrumentation and the

effects of fire on habitability deserve further consideration. Dependent

failure analysis should be incorporated into fire PRAs to assure a reasonable

degree of completeness.

To conclude, probabilistic approaches to fire risk assessment represent a

powerful methodology for dealing with problems of safety in a logical and rational manner. Major weaknesses are Tresent in the form of large uncertainties due to the many assumptions necessitated by the complexity of the problem

and a lack of completeness due to resource limitations and the lack of attention fire risk has received in the past. However, many of these weaknesses

can be eliminated or improved upon without adding undo complexity to the

analysis.
-35-

REFERENCES

1. Gallucci, R.H., "A Methodology for Evaluating the Probability of Fire

Loss of Nuclear Power Plant Safety Functions," Ph.D. thesis submitted to

the Rensselaer Polytechnic Institute, 1980.

2. Commonwealth Edison Co., "Zion Probabilistic Risk Safety Study," 1980.

3. "Indian Point Probabilistic Safety Study," Power Authority of the State

of NY, Consolidated Edison Co. of NY, Inc., Spring 1982.

4. Philadelphia Electric Co. "Severe Accident Risk Assessment, Limerick Generating Station," Report No. 4161, April 1983.

5. Fleming, K.N., et al, "A Methodology for Risk Assessment of Major Fires

and Its Application to an HTGR Plant," GA-A15402, July 1979.

6. Hockenbury, R.W. and Yater, M.L., "Development and Testing of a Model for

Fire Potential in Nuclear Power Plants," NUREG/CR-1819, 1980.

7. Verna, B.J., "Nuclear Power Experience," (all reported fire events

through October 1981).

8. USNRC, "Licensee Event Reports," (all reported fire events through

October 1981).

9. General Electric Co., "GESSAR II Fire and Flood External Event Analysis,"

October 1983.

10. Kazarians, M. and Lydell, B., "Spatial Interaction Analysis in Probabilistic Risk Assessment," Pickard, Lowe, and Garrick, Inc., private

communication from M. Kazarians, October 1984.

11. "Seabrook Station Probabilistic Safety Assessment," Section 4, Public

Service Co. of New Hampshire and Yankee Atomic Electric Co., PLG-0300,

December 1983.

12. Kazarians, M., Siu, N., and Apostolakis, G., "Fire Risk Analysis for Nuclear Power Plants: Methodological Developments and Applications," to be

published in Risk Analysis.

13. Kazarians, M. and Apostolakis, G., "Modeling of Rare Events: The Frequencies of Fires in Nuclear Power Plants," presented at the Workshop on

Low-Probability/High-Consequence Risk Analysis, Society for Risk Analysis, Arlington, Va., June 15-17, 1982.

14. Siu, N., "Probabilistic Models for the Behavior of Compartment Fires,"

School of Engineering and Applied Science, University of California, Los

Angeles, Ca., NUREG/CR-2269, August 1981.
-36-

15. Siu, N. and Apostolakis, G., "Probabilistic Models for Cable Tray Fires,"

Reliability Engineering, 3, 1982, pp. 213-227.

16. Siu, N., "COMPBRN - A Computer Code for Modeling Compartment Fires," [

School of Engineering and Applied Science, University of California, Los

Angeles, Ca., UCLA-ENG-8257, August 1982.

17. Hitler, H. and Emmons, H., "Documentation for CFCV, the Fifth Harvard

Computer Fire Code," Harvard University, Cambridge, Ma., October 1981.

18. Quintiere, J., "Growth of Fire in Building Compartments," ASTH Special

Technical Pub. 614, 1977.

19. Tatem, P. et al, "Liquid Pool Fires in a Complete Enclosure," 1982 Technical Meeting, the Eastern Section of the Combustion Institute, Atlantic

City, N.J., December 14-16, 1982.

20. Zukowski, E. and Kubota, T., "Two Layer Modeling of Smoke Movement in

Building Fires," Fire and Material, 4, 17, 1980.

21. Delichatsios, M., et al, "Computer Modeling of Aircraft Cabin Fire Phenomena," FMRC J.I. OGONI.BU, Factory Mutual Research Corp., Norwood, Ha.,

December 1982.

22. MacArthur, C., "Dayton Aircraft Cabin Fire Model Version 3," Vols. I and

II, University of Dayton Research Institute, 1981.

23. Sumitra, P., "Categorization of Cable Flammability, Intermediate-Scale

Fire Tests of Cable Tray Installations," EPRI NP-1881, Electric Power Research Institute, Palo Alto, Ca., August 1982.

24. Tewarson, A., Lee, J., and Pion, R., "Categorization of Cable Flammability, Part 1: Laboratory Evaluation of Cable Flammability Parameters,"

EPRI NP-1200, Electric Power Research Institute, Palo Alto, Ca., October

1979.

25. Williams, F., "Mechanisms of Fire Spread," 16th International Symposium

on Combustion, pp. 1281-1294, 1976.

26. Quintiere, J., "A Simplified Theory for Generalizing Results from a

Radiant Panel Rate of Flame Spread Apparatus," Fire and Materials, 8,

pp. 52-60, 1981.

27. Lee, J., "A Study of Damageability of Electrical Cables in Simulated Fire

Environments," EPRI NP-1767, Electric Power Research Institute, Palo

Alto, Ca., March 1981.

28. Carslaw, H. and Jaeger, J., "Conduction of Heat in Solids, 2nd Ed.,"

Oxford Clarendon Press, 1959.
I

-37-

29. Alpert, R., "Calculation of Response Time of Ceiling-Mounted Fire Detectors," Fire Technology, 8, pp. 181-195, 1972.

30. Alpert, R. and Ward, E., "Evaluating Unsprinklered Fire Hazards," FMRC 1

J.I. No. 01836.20, Factory Mutual Research Corp., Norwood, Ma., August

1982.

31. Stavrianidis, P., "The Behavior of Plumes Above Pool Fires," a thesis

presented to the Faculty of the Department of Mechanical Engineering of

Northeastern University, Boston, Ma., August 1980.

32. Orloff, L., "Simplified Radiation Modeling of Pool Fires," FMRC J.I. No. F

OEIEO.BU-1, Factory Mutual Research Corp., Norwood, Ma., April 1980.

33. Zukoski, E., Kubata, T., and Cetegen, B., "Entrainment in Fire Plumes,"

Fire Safety Journal, 3, 1980/81, pp. 107-121.

34. Steckler, K., Quintiere, J., and Rinkinen, W., "Flow Induced by Fire in a

Compartment," National Bureau of Standards, NBSIR 82-2520, September

1982.

35. Newman, J. and Hill, J., "Assessment of Exposure Fire Hazards to Cable

Trays," EPRI-NP-1675, Electric Power Research Institute, Palo Alto, Ca.,

January 1981.

36. Benjamin, I., et al, "An Analysis of the Report on Environments of Fire

Detectors," Ad Hoc Committee of the Fire Detection Institute, 1979.

37. Newman, J., "Fire Tests in Ventilated Rooms - Detection of Cable Tray and

Exposure Fires," EPRI NP-2751, February 1983.

38. Hill, J., "Fire Tests in Ventilated Rooms - Extinguishment of Fire in

Grouped Cable Trays," EPRI NP-2660, December 1982.

39. Levinson, S., "Methods and Criteria for Evaluation of Nuclear Fire Protection Alternatives and Modifications," Ph.D. thesis, Rensselaer Polytechnic Institute, Troy, NY, December 1982.
FF
I

NRC FORM 335 1. REPORT NUMBER (Awsnedwby DDC) 1143) U BIBLOGRAHICDATA .S NUCLEAR REGULATORY COMMISSION SETNUREG/CR- N R G C -4 42292

BIBLIOGRAPHIC SHEET RNI -NIIRFr-s-iA7w7

4. TITLE AND SUBTITLE Add Vokome Na., id aoprcdriaw) 2. (Leave blank)

"Evaluation of Current Methodology Employed in Probabilis- 3. RECIPIENTSACCESSION NO.

tic Risk Assessment (PRA) of Fire Events at Nuclear Power

/A.L -H Ii 1 5. DATE REPORT COMPLETED

C. Ruger, J. L. Boccio, M. A. Azarn "'FNT~ebruary VEAR 1985

9. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) DATE REPORT ISSUED

Department of Nuclear Energy MONT•kM j YEAR 1985

Brookhaven National Laboratory ay

Upton, New York 11973 6. k-eae banki

8. (Le.ma blank)

12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (include Zip Code)

Division of Engineering __.______TT___O. __UNIT __O.

Office of Nuclear Reactor Regulation 1. FIN NO.

U.S. Nuclear Regulatory Commission

Washington, D.C. FIN A-3710

13. TYPE OF REPORT PERIOD COVERED linclusive daws)

Technical

lb. SUPPLEMENTARY NOTES 14. ILea& clank)

F

1b. ABSTRACT2OOwords o lei/ II repurt presents a general evaluation OT the current metnoaology used by industry for the probabilistic assessment of fire events in nuclear power plants.

The basis for this evaluation, in which the strengths and weaknesses of the methods are

identified, stem from reviews of several, industry-sponsored, full-scope Probabilistic

Risk Assessments (PRAs) and various deterministic/probabilistic approaches used by industry

to judge their compliance with or used to seek exemptions from the fire-protection requirements enumerated in Appendix R to 10 CFR 50.

In performing this evaluation of the current methodologies, state-of-the-art literature on the modeling of fire propagation/detection/suppression, input parameters, and

modeling uncertainties are utilized. Areas are identified where recently-developed, more

accurate and complete techniques can be implemented to reduce the state-of-knowledge uncertainties that presently exist. Recommendations are also made which could be the basis for

a more suitable and complete fire-risk methodology.

11. KEY WORDLS AND DOCUMENT ANALYSIS I ho. DESCRIPTORS

Probabilistic Risk Assessment (PEA), External Events, Fire Risk, Fire Modeling

I I/,. IDENTIFIERS:OPEN.ENDED TERMS

18. AVAILABILITY STATEMENT 19. SECURITY CLASS(Ths repor 21. NO OF PAGES

Unclassified

Unlimited 20. SECURITY CLASS IThus paW.) 22 PRICF

NHC FORM 335 II II1
IVF

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20655

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE. 0300

POSTAGE & EES PAID

USNRC

WASH. D.C. PERMIT No. 047

2

Tn

32

F-n mc Z"T

mc

<'C

.n

mc

Zr

IC,

aU -%

0 r