United States Nuclear Regulatory Commission - Protecting People and the Environment

Information Notice No. 83-41: Actuation of Fire Suppression System Causing Inoperability of Safety-Related Equipment

                                                            SSINS No.: 6835 
                                                            IN 83-41       

                                UNITED STATES
                        NUCLEAR REGULATORY COMMISSION
                    OFFICE OF INSPECTION AND ENFORCEMENT
                           WASHINGTON, D.C. 20555
                                     
                                June 22, 1983

Information Notice No. 83-41:  ACTUATION OF FIRE SUPPRESSION SYSTEM CAUSING 
                              INOPERABILITY OF SAFETY-RELATED EQUIPMENT 

Addressees: 

All holders of operating licenses (OLs) or construction permits (CPs). 

Purpose: 

This information notice is issued to alert licensees to some recent 
experiences in which actuation of fire suppression systems caused damage to 
or inoperability of systems important to safety. No specific action or 
response is required at this time. 

Description of Circumstances: 

In its continuing review of licensee event reports (LERs) the NRC has 
identified many LERs describing automatic actuation of fire suppression 
systems, where the actuation resulted in degrading or jeopardizing the 
operability of systems important to safety. In some instances the 
suppression system actuated properly, in response to a valid signal. In 
other instances there was no real need for initiation. In these latter 
instances, there does not appear to have been a single common causative 
factor. It appears that errors have been made in design (including selection 
of the most appropriate sensors), in installation, and in plant operating 
and maintenance procedures. 

The NRC is concerned that fire fighting systems and activities, if not 
properly designed and implemented, can contribute to risks to the plant and 
public. General Design Criterion 3, Fire Protection, of Appendix A to 10 CFR
Part 50 states in part: "Fire detection and fighting systems of appropriate 
capacity and capability shall be provided and designed to minimize the 
adverse effects of fires on structures, systems and components important to 
safety. Fire fighting systems shall be designed to ensure that their rupture
or inadvertent operation does not significantly impair the safety capability
of these structures, systems and components." Paragraph II B of Appendix R 
to 10 CFR Part 50 and the related NRR Branch Technical Position requires 
that a fire hazard analysis be performed to assess the probability and 
consequences of fires in each utilization facility. This analysis, in 
considering the consequence of a postulated fire, must include the effect of
fire fighting activities. Such an analysis need not be complex, but should 
not be limited to a "paper study." The events reported indicate that a 
walk-down of plant equipment would have identified instances where minor 
modifications such as shielding equipment and sealing conduit ends would 
have reduced water damage from inadvertent operation of the fire protection 
system, 

8305110477 
.

                                                            IN 83-41 
                                                            June 22, 1983 
                                                            Page 2 of 2 

without significantly reducing its effectiveness. It appears that in many 
instances, the hazards analysis did not adequately address system 
interactions between fire suppression systems and systems important to 
safety, particularly those necessary for safe shutdown. The overall design 
must accommodate both needs; that is, it must provide an effective fire 
protection system but not adversely affect other aspects of plant safety. 

Attachment 1 to this Information Notice tabulates several representative 
examples of events reported, with some attribution of probable cause. Also, 
the Institute of Nuclear Power Operations is planning to issue a document 
providing further information on this subject.  

To date, none of the reported events have resulted in a serious impact on 
the functional capability of the facility to protect the health and safety 
of the public. However, in many instances it would not be difficult to 
extrapolate actual occurrences in a sequence of events that could lead to 
much more serious consequences. Attachment 2 gives some examples. 

Although no written response to this notice is required, it is suggested 
that holders of operating licenses or construction permits review the 
information in this notice for applicability at their facilities. If you 
have any questions regarding this matter, please contact the Regional 
Administrator of the appropriate NRC Regional Office, or this office. 


                                   Edward L. Jordan Director 
                                   Division of Emergency Preparedness 
                                     and Engineering Response 
                                   Office of Inspection and Enforcement 

Technical Contact:  J. B. Henderson, IE
                    (301) 492-9654

Attachments: 
1.   Selected Examples off Licensee Event 
     Reports Related to Fire Suppressions Systems 
2.   Events That May Be Precursors to More Serious
     Similar Events
3.   List of Recently Issued IE Information Notices
.
                                                              Attachment 1 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 1 of 4  

                SELECTED EXAMPLES OF LICENSEE EVENT REPORTS 

                    RELATED TO FIRE SUPPRESSION SYSTEMS 

Oyster Creek, November 9, 1980 

     Personnel were trouble-shooting an electrical fault in an automatic 
     fire suppression system, without de-activating the automatic feature. 
     Sprinkler actuation occurred, causing water damage and inoperability of 
     one train of a redundant safety feature actuation system. 

     This event appears to involve two deficiencies: The hazards analysis 
     had not recognized the potential system interaction between the fire 
     suppression system and the emergency safety feature actuation system; 
     and the plant procedure for trouble-shooting was either inadequate or 
     inadequately implemented (or both). 

Oyster Creek, January 9, 1982 

     A pump drive motor overheated, actuating an automatic fire suppression 
     sprinkler system. The sprinkler system operation was consistent with 
     conceptual and detailed design. 

     Some safety-related equipment suffered water damage. Subsequent 
     licensee evaluation indicated that minor modifications, such as sealing 
     conduit ends and shielding equipment and vents could significantly 
     reduce water damage, without degrading fire suppression capability. A 
     more effective as-built walkdown could have initiated appropriate 
     preventive actions. 

Dresden Unit 3, November 30, 1981 

     Ionization-type smoke detectors in an HPCI room reacted to high 
     temperature and humidity, and actuated an automatic sprinkler system. 
     The HPCI system was rendered inoperable as a result of water damage. 

     Subsequent licensee analysis indicated the heat and humidity signals 
     were valid, but resulted from local steam and vapor leaks, and from 
     inadequate procedures related to local ventilation. Analysis also 
     indicated that water damage could be significantly reduced and perhaps 
     eliminated by judicious sealing and shielding of equipment. The fire 
     suppression system was modified to reduce probability of future events.

Dresden Unit 2, December 24, 1981 

     An event similar to the November 30, 1981 event at Unit 3 occurred at 
     Unit 2. The fundamental cause was the same - inadequate operating and 
     maintenance procedures allowed a high-temperature, high-humidity 
     condition to develop which caused actuation of the sprinkler system in 
     the HPCI room. In this instance, the redundant automatic 
     depressurization system was coincidentally found to be inoperable 
     because of a broken wire. 

     System modifications similar to those on Unit 3 were made on Unit 2. 
.
                                                              Attachment 1 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 2 of 4  

Farley Unit 1, June 10, 1981 and July 21, 1982 

     These two events resulted in unnecessary actuation of the deluge system
     for the main cooling towers. Actuation of this system resulted in 
     drawdown of the two water storage tanks below the technical 
     specification limit. 

     The sprinkler control system is pneumatic and designed so that an 
     actuation signal bleeds off control pressure, allowing a deluge valve 
     to open. In both instances of actuation, the control system had been 
     taken out of service for maintenance. The procedures were inadequate to
     maintain control system pressure above the trip value. 

Trojan, July 26, 1981 

     The automatic fire suppression system was actuated by smoke from 
     welding. Water damage caused inoperability of one train of the 
     redundant containment atmosphere hydrogen recombiner system. 

     Maintenance procedures for the welding activity were either inadequate 
     or inadequately implemented. The maintenance procedure should include 
     steps to establish a local fire watch and to deactivate, and later 
     reactivate the automatic feature of the fire suppression system. 

Surry Unit 2, May 28, 1981 

     The licensee reported that as part of the fire suppression system, a 
     foam distributor system was installed in the main (reserve) diesel fuel 
     oil tank. The system was piped (solid) to the fire suppression water 
     main, without adequate precautions to prevent accidental unwanted water 
     injection to the tank. During an unrelated manipulation of the 
     suppression water supply system, the valve introducing water to the oil 
     tank was inadvertently left slightly open. 

     More than 4000 gallons of water had been introduced and some had been 
     widely distributed in the diesel fuel oil system before a routine 
     periodic test disclosed the presence of the water. The water had not 
     reached the immediate supply (day) tanks for the diesel engines which 
     were promptly and successfully test started. However, extensive cleanup
     operations were required and the diesel generators were technically 
     "inoperable" until the water had been removed. 

     This event is a particularly vivid example of apparent inadequacy in 
     the analysis required by 10 CFR 50 Appendix R. The fundamental safety 
     requirement is that there shall be an onsite, reliable source of power 
     to cover emergency shutdown and cooldown power requirements. The 
     supporting requirement is that there shall be on site a sufficient 
     quantity of clean fuel to sustain operation of the emergency 
     generators. Fire prevention and suppression provisions are, of course, 
     desirable. However, they must not assume such importance that they 
     jeopardize safety concerns. The-subsequent reevaluation resulted in 
     retaining the foam-type fire suppression system but removing the fixed 
     piping internal to the tank. 
.
                                                              Attachment 1 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 3 of 4  

Diablo Canyon, October 1982 

     A grass fire started outside the controlled area. Neither unit was 
     operating. The fire burned extensive acreage and the heat and products 
     of combustion caused temporary loss of all offsite power. 

     The fire did not cause any damage within the plant. The onsite diesel 
     generators were started (in anticipation of loss of offsite power) and 
     operated reliably. However, because of drifting smoke from the fire, 
     the plant staff isolated the control room to assure continued 
     habitability. Drifting smoke from the fire caused many fire alarm 
     actuations, and the plant staff was kept nearly continually busy 
     responding to those alarms. No automatic sprinkler actuation took place 
     since sensors used for sprinkler actuation are of the heat-sensitive 
     type. 

North Anna, Unit 2, July 3, 1981 

     A fire occurred as a result of an internal electrical fault in a single
     phase main transformer. Energy from the fault ruptured the transformer 
     case containing approximately 9300 gallons of insulating oil. The plant
     design provided a drainage pit around the Unit 2 main and station 
     service transformers, with individual fire walls between transformers. 
     The pit was filled with uniformly sized gravel for personnel access, 
     but the void spaces were calculated to be sufficient to contain the 
     inventory of oil in case of transformer rupture. Two 6-inch drains were 
     provided, to conduct liquid from the drainage pit to nearby Lake Anna. 

     Each transformer cubicle is equipped with a water deluge system except 
     the spare main transformer cubicle, which is at one end and adjacent to
     the faulted transformer. Two of the main unit transformer deluge 
     systems actuated automatically, and the third was actuated manually to 
     protect the transformer. These deluge systems, plus manual hose streams 
     were competing with the spilled oil for the limited drainage pit 
     volume. As a result, some of the burning oil escaped from the pit and 
     had to be extinguished on the ground. The NRC inspector estimates that 
     during the course of the fire, approximately 130,000 gallons of water 
     were delivered by the deluge system, and about 90,000 gallons by 
     hand-held hoses. 

Ginna, November 14, 1981 

     Personnel were performing a lamp test on "Satellite Station A (SSA)," 
     which provides power to smoke detector circuits associated with several
     automatic fire suppression water spray/sprinkler systems. System 
     actuation occurred in several plant areas, which resulted in the trip 
     of one RPS motor generator set and a small amount of water entering the
     control rod drive switchgear cabinet. In response to two dropped 
     control rods, caused by the above condition, the control room operators 
     manually tripped the reactor from full power. 
.
                                                              Attachment 1 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 4 of 4  

     Subsequent licensee analyses indicated an apparent design deficiency 
     associated with the power supply to the SSA. Fire suppression system 
     modifications have been made to preclude inadvertent water discharge. 
     It  was also revealed that personnel had not followed plant procedures 
     for  reenergizing the SSA following a loss of power. Had personnel 
     followed procedures, which requires deactivation of the solenoid valve 
     actuator associated with the fire suppression systems, this mishap 
     would not have  occurred. 

Grand Gulf Unit 1, July 14, 1982 

     A ground in the initiation circuit caused the repeated actuation of the
     CO2 system in the ECCS penetration room resulting in sufficient 
     pressure build-up to force open the locked door to the auxiliary 
     building. 

     The design of the ECCS penetration room was inadequate since it did not
     provide proper venting to prevent overpressurization during CO2 
     discharge. 
.
                                                              Attachment 2 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 1 of 2  

        EVENTS THAT MAY BE PRECURSORS TO MORE SERIOUS SIMILAR EVENTS 

Based on reported events, such as those summarized in Attachment 1 with a 
reasonable extrapolation, the NRC is concerned that some fire protection 
systems may be susceptible to events that were not adequately considered in 
detailed designs, and that could cause a significant impact on plant safety.
Examples of these concerns are discussed below. 

     1.   Contamination of diesel fuel oil by fire suppression system water.

          The Surry Unit 2 contamination of the diesel fuel oil tank by fire
          suppression water (described in Attachment 1) was identified by 
          routine sampling before the water had reached the diesel engine 
          day tanks, but a slightly greater rate of inleakage could have 
          contaminated those tanks too before the sampling interval had 
          expired. Under those circumstances the diesels, even if they 
          started, would not have operated long, and could have been damaged 
          to the degree that all of them would be out of service for an 
          extended time. If the diesels started in response to an actual 
          loss of offsite power, the consequences could have been serious. 

     2.   Damage to safety-related equipment by inadvertent actuation of a 
          fire suppression system. 

          Most of the events listed in Attachment 1 fall in this category 
          without extrapolation. 

     3.   Control and disposal of excess fire suppression water. 

          The North Anna fire is an excellent example of this concern. The 
          designer had made provision to control oil leakage in a drainage 
          pit, but had not considered what to do with about 220,000 gallons 
          of water, delivered over a period of about 11/2 hours. As a 
          consequence, the two 6-inch drain lines were overwhelmed, and the 
          burning oil, floating on the water, escaped from the drainage pit.
          Escape of the oil made fire fighting more difficult, and caused 
          some contamination of Lake Anna. If radioactivity had been 
          involved, the consequences could have been far more severe. 

          A number of events have been described in which fire suppression 
          water leaked through a floor and damaged equipment below. Leakage 
          paths include cracks (which are not structurally significant) in 
          concrete floors, unsealed construction joints, and openings for, 
          passage of vertical pipes, cable ways, etc., which do not have 
          water control seals or coamings. 
.
                                                              Attachment 2 
                                                              IN 83-41     
                                                              June 22, 1983 
                                                              Page 2 of 2  

     4.   Common cause for concurrent actuation of many fire suppression 
          systems. 

          The Diablo event could be repeated at other sites, with more 
          serious consequences. Many facilities use smoke detectors to 
          actuate fire suppression systems. These smoke detectors are 
          subject to actuation by smoke from other areas, dust and, in some 
          cases, steam. Further, the remote siting of some of these 
          facilities makes them more susceptible to brush or grass fire 
          effects. 

     5.   Problems that appear to relate to improper or inadequate design. 

          The Surry water contamination of diesel fuel oil is an example 
          where the designer did not perform a sufficient analysis of system
          interactions. 

          The Farley events, the Grand Gulf event, and the Surry event give 
          evidence that the control system design was not tolerant of 
          operational or procedural errors. 

          Control systems for fire detection and suppression can take many 
          forms, such as pneumatic, hydraulic-electro-mechanical and direct 
          electric systems. In some instances initiation is caused by a 
          positive signal, in others, by removal of an inhibit control. In 
          most, if not all instances, electric power is involved. The power 
          supply needs to have high reliability, and the control systems 
          need to be carefully designed to minimize the probability of 
          either failure or inadvertent actuation. 

          In the Farley events the control system contained a pneumatic 
          inhibit device. When the air pressure decayed sufficiently, the 
          deluge system actuated. 

          At Grand Gulf, an intermittent ground in the control system caused
          repeated discharge of C02 to a closed room until a closed and 
          locked door was blown open. 

          Events such as this could lead to the generation of missiles that 
          could damage equipment located in the area or, adjacent areas. 
          This damaged equipment may in turn be required to prevent or 
          mitigate reactor accidents. An event such as this could also allow 
          CO2 to enter the plant ventilation system and adversely affect 
          plant operating personnel. 
.
Page Last Reviewed/Updated Tuesday, November 12, 2013