Home > NRC Library > Document Collections > Generic Communications > Information Notices > 1983 > IN 83-41
Information Notice No. 83-41: Actuation of Fire Suppression System Causing Inoperability of Safety-Related Equipment
SSINS No.: 6835 IN 83-41 UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF INSPECTION AND ENFORCEMENT WASHINGTON, D.C. 20555 June 22, 1983 Information Notice No. 83-41: ACTUATION OF FIRE SUPPRESSION SYSTEM CAUSING INOPERABILITY OF SAFETY-RELATED EQUIPMENT Addressees: All holders of operating licenses (OLs) or construction permits (CPs). Purpose: This information notice is issued to alert licensees to some recent experiences in which actuation of fire suppression systems caused damage to or inoperability of systems important to safety. No specific action or response is required at this time. Description of Circumstances: In its continuing review of licensee event reports (LERs) the NRC has identified many LERs describing automatic actuation of fire suppression systems, where the actuation resulted in degrading or jeopardizing the operability of systems important to safety. In some instances the suppression system actuated properly, in response to a valid signal. In other instances there was no real need for initiation. In these latter instances, there does not appear to have been a single common causative factor. It appears that errors have been made in design (including selection of the most appropriate sensors), in installation, and in plant operating and maintenance procedures. The NRC is concerned that fire fighting systems and activities, if not properly designed and implemented, can contribute to risks to the plant and public. General Design Criterion 3, Fire Protection, of Appendix A to 10 CFR Part 50 states in part: "Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on structures, systems and components important to safety. Fire fighting systems shall be designed to ensure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems and components." Paragraph II B of Appendix R to 10 CFR Part 50 and the related NRR Branch Technical Position requires that a fire hazard analysis be performed to assess the probability and consequences of fires in each utilization facility. This analysis, in considering the consequence of a postulated fire, must include the effect of fire fighting activities. Such an analysis need not be complex, but should not be limited to a "paper study." The events reported indicate that a walk-down of plant equipment would have identified instances where minor modifications such as shielding equipment and sealing conduit ends would have reduced water damage from inadvertent operation of the fire protection system, 8305110477 . IN 83-41 June 22, 1983 Page 2 of 2 without significantly reducing its effectiveness. It appears that in many instances, the hazards analysis did not adequately address system interactions between fire suppression systems and systems important to safety, particularly those necessary for safe shutdown. The overall design must accommodate both needs; that is, it must provide an effective fire protection system but not adversely affect other aspects of plant safety. Attachment 1 to this Information Notice tabulates several representative examples of events reported, with some attribution of probable cause. Also, the Institute of Nuclear Power Operations is planning to issue a document providing further information on this subject. To date, none of the reported events have resulted in a serious impact on the functional capability of the facility to protect the health and safety of the public. However, in many instances it would not be difficult to extrapolate actual occurrences in a sequence of events that could lead to much more serious consequences. Attachment 2 gives some examples. Although no written response to this notice is required, it is suggested that holders of operating licenses or construction permits review the information in this notice for applicability at their facilities. If you have any questions regarding this matter, please contact the Regional Administrator of the appropriate NRC Regional Office, or this office. Edward L. Jordan Director Division of Emergency Preparedness and Engineering Response Office of Inspection and Enforcement Technical Contact: J. B. Henderson, IE (301) 492-9654 Attachments: 1. Selected Examples off Licensee Event Reports Related to Fire Suppressions Systems 2. Events That May Be Precursors to More Serious Similar Events 3. List of Recently Issued IE Information Notices . Attachment 1 IN 83-41 June 22, 1983 Page 1 of 4 SELECTED EXAMPLES OF LICENSEE EVENT REPORTS RELATED TO FIRE SUPPRESSION SYSTEMS Oyster Creek, November 9, 1980 Personnel were trouble-shooting an electrical fault in an automatic fire suppression system, without de-activating the automatic feature. Sprinkler actuation occurred, causing water damage and inoperability of one train of a redundant safety feature actuation system. This event appears to involve two deficiencies: The hazards analysis had not recognized the potential system interaction between the fire suppression system and the emergency safety feature actuation system; and the plant procedure for trouble-shooting was either inadequate or inadequately implemented (or both). Oyster Creek, January 9, 1982 A pump drive motor overheated, actuating an automatic fire suppression sprinkler system. The sprinkler system operation was consistent with conceptual and detailed design. Some safety-related equipment suffered water damage. Subsequent licensee evaluation indicated that minor modifications, such as sealing conduit ends and shielding equipment and vents could significantly reduce water damage, without degrading fire suppression capability. A more effective as-built walkdown could have initiated appropriate preventive actions. Dresden Unit 3, November 30, 1981 Ionization-type smoke detectors in an HPCI room reacted to high temperature and humidity, and actuated an automatic sprinkler system. The HPCI system was rendered inoperable as a result of water damage. Subsequent licensee analysis indicated the heat and humidity signals were valid, but resulted from local steam and vapor leaks, and from inadequate procedures related to local ventilation. Analysis also indicated that water damage could be significantly reduced and perhaps eliminated by judicious sealing and shielding of equipment. The fire suppression system was modified to reduce probability of future events. Dresden Unit 2, December 24, 1981 An event similar to the November 30, 1981 event at Unit 3 occurred at Unit 2. The fundamental cause was the same - inadequate operating and maintenance procedures allowed a high-temperature, high-humidity condition to develop which caused actuation of the sprinkler system in the HPCI room. In this instance, the redundant automatic depressurization system was coincidentally found to be inoperable because of a broken wire. System modifications similar to those on Unit 3 were made on Unit 2. . Attachment 1 IN 83-41 June 22, 1983 Page 2 of 4 Farley Unit 1, June 10, 1981 and July 21, 1982 These two events resulted in unnecessary actuation of the deluge system for the main cooling towers. Actuation of this system resulted in drawdown of the two water storage tanks below the technical specification limit. The sprinkler control system is pneumatic and designed so that an actuation signal bleeds off control pressure, allowing a deluge valve to open. In both instances of actuation, the control system had been taken out of service for maintenance. The procedures were inadequate to maintain control system pressure above the trip value. Trojan, July 26, 1981 The automatic fire suppression system was actuated by smoke from welding. Water damage caused inoperability of one train of the redundant containment atmosphere hydrogen recombiner system. Maintenance procedures for the welding activity were either inadequate or inadequately implemented. The maintenance procedure should include steps to establish a local fire watch and to deactivate, and later reactivate the automatic feature of the fire suppression system. Surry Unit 2, May 28, 1981 The licensee reported that as part of the fire suppression system, a foam distributor system was installed in the main (reserve) diesel fuel oil tank. The system was piped (solid) to the fire suppression water main, without adequate precautions to prevent accidental unwanted water injection to the tank. During an unrelated manipulation of the suppression water supply system, the valve introducing water to the oil tank was inadvertently left slightly open. More than 4000 gallons of water had been introduced and some had been widely distributed in the diesel fuel oil system before a routine periodic test disclosed the presence of the water. The water had not reached the immediate supply (day) tanks for the diesel engines which were promptly and successfully test started. However, extensive cleanup operations were required and the diesel generators were technically "inoperable" until the water had been removed. This event is a particularly vivid example of apparent inadequacy in the analysis required by 10 CFR 50 Appendix R. The fundamental safety requirement is that there shall be an onsite, reliable source of power to cover emergency shutdown and cooldown power requirements. The supporting requirement is that there shall be on site a sufficient quantity of clean fuel to sustain operation of the emergency generators. Fire prevention and suppression provisions are, of course, desirable. However, they must not assume such importance that they jeopardize safety concerns. The-subsequent reevaluation resulted in retaining the foam-type fire suppression system but removing the fixed piping internal to the tank. . Attachment 1 IN 83-41 June 22, 1983 Page 3 of 4 Diablo Canyon, October 1982 A grass fire started outside the controlled area. Neither unit was operating. The fire burned extensive acreage and the heat and products of combustion caused temporary loss of all offsite power. The fire did not cause any damage within the plant. The onsite diesel generators were started (in anticipation of loss of offsite power) and operated reliably. However, because of drifting smoke from the fire, the plant staff isolated the control room to assure continued habitability. Drifting smoke from the fire caused many fire alarm actuations, and the plant staff was kept nearly continually busy responding to those alarms. No automatic sprinkler actuation took place since sensors used for sprinkler actuation are of the heat-sensitive type. North Anna, Unit 2, July 3, 1981 A fire occurred as a result of an internal electrical fault in a single phase main transformer. Energy from the fault ruptured the transformer case containing approximately 9300 gallons of insulating oil. The plant design provided a drainage pit around the Unit 2 main and station service transformers, with individual fire walls between transformers. The pit was filled with uniformly sized gravel for personnel access, but the void spaces were calculated to be sufficient to contain the inventory of oil in case of transformer rupture. Two 6-inch drains were provided, to conduct liquid from the drainage pit to nearby Lake Anna. Each transformer cubicle is equipped with a water deluge system except the spare main transformer cubicle, which is at one end and adjacent to the faulted transformer. Two of the main unit transformer deluge systems actuated automatically, and the third was actuated manually to protect the transformer. These deluge systems, plus manual hose streams were competing with the spilled oil for the limited drainage pit volume. As a result, some of the burning oil escaped from the pit and had to be extinguished on the ground. The NRC inspector estimates that during the course of the fire, approximately 130,000 gallons of water were delivered by the deluge system, and about 90,000 gallons by hand-held hoses. Ginna, November 14, 1981 Personnel were performing a lamp test on "Satellite Station A (SSA)," which provides power to smoke detector circuits associated with several automatic fire suppression water spray/sprinkler systems. System actuation occurred in several plant areas, which resulted in the trip of one RPS motor generator set and a small amount of water entering the control rod drive switchgear cabinet. In response to two dropped control rods, caused by the above condition, the control room operators manually tripped the reactor from full power. . Attachment 1 IN 83-41 June 22, 1983 Page 4 of 4 Subsequent licensee analyses indicated an apparent design deficiency associated with the power supply to the SSA. Fire suppression system modifications have been made to preclude inadvertent water discharge. It was also revealed that personnel had not followed plant procedures for reenergizing the SSA following a loss of power. Had personnel followed procedures, which requires deactivation of the solenoid valve actuator associated with the fire suppression systems, this mishap would not have occurred. Grand Gulf Unit 1, July 14, 1982 A ground in the initiation circuit caused the repeated actuation of the CO2 system in the ECCS penetration room resulting in sufficient pressure build-up to force open the locked door to the auxiliary building. The design of the ECCS penetration room was inadequate since it did not provide proper venting to prevent overpressurization during CO2 discharge. . Attachment 2 IN 83-41 June 22, 1983 Page 1 of 2 EVENTS THAT MAY BE PRECURSORS TO MORE SERIOUS SIMILAR EVENTS Based on reported events, such as those summarized in Attachment 1 with a reasonable extrapolation, the NRC is concerned that some fire protection systems may be susceptible to events that were not adequately considered in detailed designs, and that could cause a significant impact on plant safety. Examples of these concerns are discussed below. 1. Contamination of diesel fuel oil by fire suppression system water. The Surry Unit 2 contamination of the diesel fuel oil tank by fire suppression water (described in Attachment 1) was identified by routine sampling before the water had reached the diesel engine day tanks, but a slightly greater rate of inleakage could have contaminated those tanks too before the sampling interval had expired. Under those circumstances the diesels, even if they started, would not have operated long, and could have been damaged to the degree that all of them would be out of service for an extended time. If the diesels started in response to an actual loss of offsite power, the consequences could have been serious. 2. Damage to safety-related equipment by inadvertent actuation of a fire suppression system. Most of the events listed in Attachment 1 fall in this category without extrapolation. 3. Control and disposal of excess fire suppression water. The North Anna fire is an excellent example of this concern. The designer had made provision to control oil leakage in a drainage pit, but had not considered what to do with about 220,000 gallons of water, delivered over a period of about 11/2 hours. As a consequence, the two 6-inch drain lines were overwhelmed, and the burning oil, floating on the water, escaped from the drainage pit. Escape of the oil made fire fighting more difficult, and caused some contamination of Lake Anna. If radioactivity had been involved, the consequences could have been far more severe. A number of events have been described in which fire suppression water leaked through a floor and damaged equipment below. Leakage paths include cracks (which are not structurally significant) in concrete floors, unsealed construction joints, and openings for, passage of vertical pipes, cable ways, etc., which do not have water control seals or coamings. . Attachment 2 IN 83-41 June 22, 1983 Page 2 of 2 4. Common cause for concurrent actuation of many fire suppression systems. The Diablo event could be repeated at other sites, with more serious consequences. Many facilities use smoke detectors to actuate fire suppression systems. These smoke detectors are subject to actuation by smoke from other areas, dust and, in some cases, steam. Further, the remote siting of some of these facilities makes them more susceptible to brush or grass fire effects. 5. Problems that appear to relate to improper or inadequate design. The Surry water contamination of diesel fuel oil is an example where the designer did not perform a sufficient analysis of system interactions. The Farley events, the Grand Gulf event, and the Surry event give evidence that the control system design was not tolerant of operational or procedural errors. Control systems for fire detection and suppression can take many forms, such as pneumatic, hydraulic-electro-mechanical and direct electric systems. In some instances initiation is caused by a positive signal, in others, by removal of an inhibit control. In most, if not all instances, electric power is involved. The power supply needs to have high reliability, and the control systems need to be carefully designed to minimize the probability of either failure or inadvertent actuation. In the Farley events the control system contained a pneumatic inhibit device. When the air pressure decayed sufficiently, the deluge system actuated. At Grand Gulf, an intermittent ground in the control system caused repeated discharge of C02 to a closed room until a closed and locked door was blown open. Events such as this could lead to the generation of missiles that could damage equipment located in the area or, adjacent areas. This damaged equipment may in turn be required to prevent or mitigate reactor accidents. An event such as this could also allow CO2 to enter the plant ventilation system and adversely affect plant operating personnel. .
Page Last Reviewed/Updated Friday, May 22, 2015