FIRE DYNAMICS TOOLS An Educational Program to Improve the Level of Teaching Risk-Informed, Performance-based Fire Protection Engineering Assessment Methods 1

Plant Fire Hazard Analysis in PRA Probabilistic Risk Assessment (PRA) is increasingly the central tool for plant safety mangement and regulation. The fire risk to the plant was initially not well represented in the internal events PRA. A separate fire safe shutdown path was established to assure safe cold shutdown in 72 hours, for any postulated fire. Arthur E. Ruggles, Professor of Nuclear Engineering, UT 2

Fire PRA (NUREG/CR 6850) 2005 We will review how fire modeling is integrated with the plant PRA. Mostly review the process, with all NPP already operating with an internal events PRA. A much more detailed review is available from EPRI, who did the work for NRC. 3

NUREG/CR 6850 Fire PRA Methodology for Nuclear Power Facilities 4

More NUREG/CR

Task 1: Plant Boundary and Partitioning Global Boundary: Diesel Tanks, Substation, Intake pumps, auxiliary external fuel storage. Plant Partitioning: By safety class, building, function, and impact on safe shut down path. Fire Compartments: Fire modeling based decisions, can this be modeled as a compartment. Some fire zones based on a protection or sensor system may not make good fire compartments. 6

Task 1 Confessions Ignition sources and components will eventually drive analysis, so be careful in selection of divisions. Cables appear to be the biggest driver for uncertainty in consequence predictions. The components selected partially determine the cables for which routing must be known. We do not know where all our cables are. 7

Task 2: Components Selection Plants already have a Fire Safe Shutdown Analysis-path allowing Cold shut-down in 72 hours. Plant Critical Safety Systems Involved: a.Reactivity Control b.Reactor Cooling System (RCS) integrity c.Decay Heat management d.Containment integrity? e.Process/plant status monitoring 8

Task 2: Components Fire PRA will include active components that can contribute to compromise of safe shutdown, and these components are often part of the safe shutdown systems: a.Injection pumps and safety injection pumps b.Motor Operated, Air operated, Manual Control Valves that can be opened to cause loss of coolant to RHR system or containment. c.Instruments that may malfunction to initiate inappropriate valve, pump, or operator actions. 9

Task 2: Components The component list may expand to include supporting components and instrumentation: a.Header tanks and associated level and temperature instruments (pumps) b.Line pressure and flow instrumentation used to ascertain function (pumps) c.Power supplies and switch gear for all above. d.Fire instruments and protection systems for all above. (they have failure probabilities too) 10

Task 2: Components and SA, SI Spurious Activation….fires can cause spurious activations when cable trays are burning. Spurious Indications….fires can cause spurious indications when instruments and cable trays are burning. PRA will include some Human Reliability Analysis in concert with Prescribed Operator Response for defined conditions (normal, fire, emergency, RHR, full power, etc.). Indications from plant induce response of operator. 11

Sometimes we decide to alter our perception of reality to get a good result. We find later that the component list may be expanded to “improve” the PRA outcome. Redundant systems offer multiple paths to safe shutdown. Complementary and/or redundant instruments offer more comprehensive information to operator. Additional components may improve plant probability to shut down safely. Task 2: Confessions Taken From: NUREG Fault Tree Handbook 12

Task 2: Components “Should the resulting fire PRA CDF/LERF or other results be considered inadequate (e.g. too high) and it is desired later to model more of the equipment list and model more of that credited in the internal events PRA, the equipment list from the full internal events PRA is readily available.” pp NUREG 6850, Vol

Task 3: Cable Selection Cables associated with fire PRA equipment and instruments. Determine routing and location of these cables. Identify power supplies for equipment and instruments. Correlate cables to Fire PRA equipment and associated compartments and/or areas from Task 1. 14

Task 3: Cables Circuit Failure Analysis (Task 9) may expand the fire cable list, and some thought toward likely Task 9 outcomes may save time here. Database retrieval of cable routing and location information is required, but generally not available. Fire PRA pre-planning may need to include development of a cable routing database. 15

16

Task 3: Cable ID and Location, per NUREG/CR

Task 4: Qualitative Screening Define plant trip initiators, and relate to compartments. Establish compartments where there are no components or cables relevant to plant protection that would be damaged by fire in that compartment. Screening removes compartments from more detailed fire modeling. 18

Task 5: Fire Induced Risk Model PRA models to predict core damage frequency (CDF) and Large Early Release Frequency (LERF). This is usually leveraged from earlier internal events PRA modes. Several software packages are available, both fault tree (outcome centric) and event tree (initiator centric) approaches are used. 19

Task 5: PRA model observation Fire induced initiating events….commonly used term exposes the challenge in fire PRA. Fires are somewhere between a top event, like an off-site release, and a pure initiator, like a stuck open PORV. Each fire has an initiator of its own, and a sequence of progression, and can cause several other “initiating events” for the plant PRA. 20

Perhaps there are better ways to define the risk associated with fires at Nuclear Power Plants. 21

Task 5: Fire PRA Cable Room Fire: Plant nervous breakdown of a sort, can lead to several sequential failures/ initiating events: a.Plant Trip b.Loss of off site power c.PORV opening d.Loss of RCP seal cooling e.Loss of steam generator level control/indication f.Inappropriate safety injection… 22

Task 6: Fire Ignition Frequencies One significant fire event per plant per year implies 440 data points per year globally. Unfortunately, all US plants are a little different, so data does not translate perfectly. Important electrical component classes are pretty well characterized. Most potential pool fire sources are diked, and flamable fluid inventories limited. 23

Task 6: Fire Frequency 24

Task 6: More Fire Frequencies: Frequencies apply to ALL equipment items within a unit. Divide by number of components. 25

Ignition Frequency: The rest of the story 26

27

Task 6: Plant Specific Frequencies One can modify generic frequencies using unit specific data. Suggested to use given frequencies, and map total unit based frequency onto a compartment by dividing number of components in compartment by total components in class (e.g. weighting Factor). Components shared between two units may have frequency doubled. 28

Task 6: Ignition Frequencies May further modify compartment frequencies to account for high maintenance areas (frequent cutting, welding,… painting). May modify compartment ignition frequencies to accommodate traffic or storage patterns. One size may not fit all, unit unique attributes should be considered even if generic ignition frequency table 6.1 is employed. 29

Task 7: Quantitative Screening Initial qualitative screening assumed nothing in compartment mattered, or ignition frequency was very near zero. Quantitative Screening still assumes all fails in compartment, but ignition frequencies and the internal events PRA are used to evaluate probability of core damage (CDP) or large early release (LERP). Look for incremental core damage probability (ICDP) due to screened compartment to be less than

Task 8: Scoping Fire Modeling Want to screen ignition sources that cannot threaten other targets in compartment. Establish severity factors to unscreened ignition sources to prioritize detailed modeling. Remember ignition sources (motors, cables, ele. cabinets) may be risk significant on their own. 31

32

Task 8: Use 98 th Percentile HRR’s 33

Task 8: Use Zone of Influence (ZOI) Model to Establish Target Damage NUREG/CR 6850 suggests to use EPRI FIVE models. Flame, flame irradiation, plume, ceiling jet and HGL can cause damage. Walkdown recommended and forms provided to record inputs to FIVE code. 34

Task 8: Severity Factor Screened on 98 th percentile HRR. If ignition source damages target at 97 th percentile HRR, severity factor is If just a small percentage of potential HRR is required to damage other targets, severity factor approaches unity. 35

Task 9: Circuit Failure Analysis Create mapping of specific failure modes for circuits to specific fire induced cable failures. Cables can fail several ways: short to ground, hot shorts, open circuit are the main ones. Probabilities for each failure mode must be postulated in Task 10. An “Equipment failure response Report” lists all outcomes of fire damage to the cable. 36

Task 9: Circuit Failure Analysis 37

Task 9: Cable Failure modes Convert to Circuit Failure modes Spurious operation Loss of Power Erroneous indication Loss of control, due to errors in feedback data from instruments Loss of control due to loss of operator control connection 38

Task 10: Circuit Failure Mode “Likelihood” Must define probability of each failure mode since they may lead to different outcomes. Detailed Cable Data Required: insulation type, raceway type, power source, company in the raceway Go to failure mode probability estimate tables 39

Task 10: Cable failure mode probabilities 40

Task 10: Example Failure Mode Probability Tables. 41

Task 11: Detailed Fire Modeling! Detailed fire growth And spread analysis 42

Task 12: Fire Human Reliability Assessment Fire tenability, and other stress, leads to human failure events (HFEs). Some plant trajectories require significant human intervention, and these may warrant adding this assessment. Fire emergency procedures should be reviewed for possible HFEs that could cause increased risk. HFE assessment aimed to improve instrumentation, MCR layout, or procedures to reduce possibility for errors. 43

Task 13: Seismic Fire Interactions Sounded pretty over-the-top until just a few months ago. Seismically induced fires Degraded fire suppression and fire brigade effectiveness. Spurious activation of suppression and detection systems. Qualitative examination of these issues is suggested. 44

Task 14: Fire Risk Quantification Recall that risk is a combination of probability and outcome: Core Damage (CDF) and Large Early Release (LERF) are main outcomes evaluated. Uncertainty is also presented (Task 15). Also note that PRA is always based on probability of postulated events/initiatiators, and the postulated probabilities are derived mostly from operational experience. 45