Resolution of Generic Safety Issues: Issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment (Rev. 3) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was identified at an NRC Operating Reactor Events meeting on January 7, 1982,1027 and addressed fire protection system (FPS) actuations that resulted in adverse interactions with safety-related equipment at operating nuclear power plants. Events showed that safety-related equipment subjected to FPS water spray could be rendered inoperable. The events also indicated numerous spurious actuations of the FPS initiated by operator testing errors or by maintenance activities (e.g., welding), steam, or high humidity in the vicinity of FPS detectors. At the Reactor Events meeting, OIE was assigned the responsibility to review previous FPS actuations and consider development of an Information Notice; in addition, DE/NRR was expected to review the events and consider the need for modifications to FPS requirements or licensing review procedures.
An AEOD memorandum1028 issued on January 28, 1982 provided examples of FPS actuation interactions in addition to those identified at the Reactor Events meeting and suggested that all types of FPS suppression systems (e.g., water, halon, CO2, and other chemicals) be considered in the OIE and NRR reviews. An NRR response to the AEOD concerns was provided in August 1982.510
In November 1982, DE/NRR presented a review of FPS regulations and guidelines regarding interactions between FPS features and plant safety systems as well as a review of operating experience involving such interactions. It was concluded that, if existing guidelines were properly implemented, such interactions should be minimized. However, LERs indicated that the guidelines had not been properly implemented at some plants.
On June 22, 1983, IE Information Notice 83-411025 was issued to alert licensees and provided examples of previous experiences in which actuation of fire suppression systems caused damage or inoperability of systems important to safety. The IE Notice indicated that the plant Fire Hazards Analysis required by 10 CFR 50 Appendix R and by the related NRR BTP11 required, not only consideration of the consequences of a postulated fire, but also consideration of the effects of fire-fighting activities. The IE Notice stated that a properly conducted Fire Hazards Analysis in conjunction with a physical walk-down of plant areas would have identified instances where minor modifications such as shielding equipment and sealing conduit ends would have reduced equipment water damage from inadvertent FPS operation. The IE Notice indicated that none of the reported events resulted in a serious impact on the functional capability of a plant to protect public health and safety. However, examples were given where it would not be difficult to extrapolate actual occurrences into a sequence of events that could lead to more serious consequences.
Safety Significance
FPS actuations which result in adverse interaction with plant safety systems reduce the availability of such safety systems needed to achieve safe plant shutdown or to mitigate a postulated accident.
Possible Solution
A possible solution was to follow up IE Information Notice 83-411025 with an IE Bulletin that would require licensees to reevaluate their implementation of the FPS guidelines regarding adverse interactions with safety systems, to ensure that safety-related equipment not damaged by fire can perform its intended function during and following an FPS actuation.
PRIORITY DETERMINATION
Frequency Estimate
In order to estimate the frequency of FPS actuations resulting in adverse interactions with plant safety systems, a review of plant operating events over a four-year period from 1979 through 1982 was conducted. During this period, there were 30 FPS actuations where FPS suppressant (water or gas) was released or the FPS actuation circuitry isolated a safety system. Of these 30 occurrences, 24 were inadvertent and directly related to personnel error during maintenance and/or test work on the FPS or systems adjacent to FPS detectors, 2 resulted from system steam leaks which actuated FPS heat/smoke detectors, and 2 were FPS water valve gradual leaks without actual FPS actuation. One occurrence was a planned FPS suppressant (CO2) release test and the other was due to a fire in the area.
During this same time period, there were some additional inadvertent FPS actuations without release of fire suppressant since there was no heat to melt the sprinkler head fusible links. These cases had no potential interaction effect and were not considered further. Of the 30 FPS actuations summarized above, 18 caused an interaction with a safety system; 16 of these involved only a single train of redundant(2) train system while the other 2 involved redundant trains of a given safety system. All but 2 of the 18 interactions involved open head deluge water sprinkler systems spraying water onto safety system equipment or oil supplies. The remaining 2 interactions involved FPS actuation circuitry interacting with the control circuitry of a single train of a safety system but no release of suppressant. The systems affected by the single train and redundant train interactions are tabulated in Table 3.57-1.
In order to estimate the contribution of these interactions to potential core-melt accidents, Table 3.57-1 was used to identify typical interactions with systems represented in plant dominant accident sequences leading to core-melt. The FPS interaction with redundant trains of a diesel generator system (in the above case, water contamination of the fuel oil common to both diesel generators) represented a potential common mode failure of the onsite emergency AC power function.
The HPCI and RCIC interactions above actually constitute safety system single train interactions since each system is backed by the ADS plus LPCI. However, for conservatism, it was assumed that these data were equivalent to one redundant train interaction representing potential common mode failure of high pressure injection protection against an SBLOCA.
| TABLE 3.57-1 | |||
|---|---|---|---|
| Systems Affected by Interactions | |||
| Redundant Train Interactions | Single Train Interactions | ||
| System | Occurrences | System | Occurrences |
| Diesel-Generator | 1 | Diesel-Generator | 4 |
| Aux Bldg., Fuel Bldg. | 1 | ESF, SGTS Charocal | 4 |
| Ventilation-Charcoal | Filters | ||
| Filters | RCIC | 2 | |
| Core Spray | 2 | ||
| HPCI | 2 | ||
| Hydrogen Recombiner | 1 | ||
| RPS MG Set | 1 | ||
| 2 | 16 | ||
There was one redundant train and several(4) single train interactions causing inoperability of charcoal filters of various safety grade ventilation systems. However, these interactions were not contributors in core-melt accident sequences even though they can adversely affect radiation releases from a plant following an accident. These occurrences were not considered in estimating contribution of these interactions to core-melt accidents.
Consequently, it was assumed the above data represented a potential common mode failure of onsite emergency AC power or high pressure injection function during the operating period reviewed. During this period, an average of 75 reactors were operating. Thus, the frequency of common mode failure for either system was estimated to be once in 300 RY or 0.0033/RY.
To evaluate the frequency of the cut sets and sequences affected by these common mode failures, it was necessary to estimate the resulting additional system unavailability using the above common mode failure frequency of 0.0033/RY per system.
Two sequences were considered in determining the increased system unavailability. The first sequence considered a potential inadvertent FPS actuation resulting in total loss of either HPI or onsite emergency AC power followed by a 36-hour period when either the HPI or diesel generators are out of service. The 36-hour period was selected based on plant TS considerations assuming that plant personnel are aware that the inadvertent FPS actuation has occurred but are unable to restore operability to the affected system. Plant TS require that, in the event of total inoperability of such systems, the operators must restore operability of at least one train within one hour. If operability cannot be restored, then the plant must be in hot standby in the next 6 hours and in cold shutdown in the following 24 hours. It was assumed that the plant would be no longer vulnerable to loss of these systems after cold shutdown was achieved.
The second sequence considered a potential plant transient or SBLOCA followed by a 3-day period during which the plant would be vulnerable to an inadvertent FPS actuation which could cause total loss of the diesel generators or the HPI system. The 3-day vulnerability period was assumed on the basis that 3 days are long enough to restore AC power from offsite, depressurize the RCS, and operate in a recirculation mode. Also, after 3 days, reactor decay heat flux is low enough that various auxiliary system small-capacity, low-head pumps could be aligned to keep up with atmospheric boil-off of decay heat in a feed-and-bleed mode, if necessary.
If it were assumed that Sequence 2 was additive to Sequence 1, the total period of plant vulnerability from outage of either system could be 4.5 days. Using 4.5 days, the additional unavailability of either system was estimated to be:
This additional unavailability was then added to each of the parameters associated with core-melt sequences involving loss of onsite emergency AC power or HPI system function. The resulting increase in core-melt frequency was estimated to be 3.4 x 10-7/RY, of which 55% was associated with diesel generator unavailability and the remaining 45% with HPI system unavailability.
Based on the operating experience used and the derived additional system unavailability, safety system interactions associated with inadvertent FPS actuations represented non-dominant contributors to the overall core-melt risk of a plant.
With regard to spurious FPS actuations interacting with a single train of a safety system, the operating experience in Table 3.57-1 indicated that one train of a given system could have been affected as often as 18 times during the 300 RY operating period reviewed. Thus, a single train interaction frequency as high as 6 x 10-2/RY can be derived. However, even at this frequency, such occurrences were considered insignificant contributors to total system unavailability since the redundant train would still be available. Also, in all of the single train interactions reported, the affected train was restored to operability within the outage time for a single system train allowed by plant TS.
Consequence Estimate
Because the contribution to core-melt was low, the potential reduction in public risk was not calculated.
Cost Estimate
The minimum cost/plant to comply with an IE Bulletin which required all licensees to reevaluate their implementation of FPS guidelines concerning FPS interactions would involve three-quarters of an engineering staff-year (~$75,000) to conduct the review and submit a report to the NRC. Any resulting changes to plant procedures or FPS hardware would be additional cost and would be unique to each plant. Also, NRC effort to review the response from each plant would average 2 to 3 staff-months/plant or approximately $20,000/plant. Thus, the minimum cost to comply with an IE Bulletin was estimated to be $100,000/plant, exclusive of plant-unique FPS modifications.
Value/Impact Assessment
No priority score was calculated since the frequency and consequence estimates were very low.
Uncertainty
As noted above, approximately 80% of the 30 FPS actuations reviewed were a direct result of personnel error during maintenance and/or testing of the FPS or systems adjacent to FPS detectors. Coupled with the consideration that following a plant transient or L0CA it is very unlikely that plant personnel would be engaged in such work, the likelihood of inadvertent FPS actuations as postulated for the second sequence considered in the frequency analysis above would be low. If only the first sequence of events were considered, the core-melt contribution due to unavailability of onsite emergency AC power or the HPI system would reduce to 1.1 x 10-7/RY.
Other Considerations
Surry 2 Feedwater Line Rupture: The data base used in the frequency analysis did not include the feedwater line rupture event at Surry 2 on December 9, 1986. During this event, the Cardox and Halon fire suppression systems were actuated by steam/water intrusion into their control panels. The security repeater (located approximately 5 feet from a Cardox discharge nozzle) failed and was later found to be covered with a thick layer of ice. As a result, security communications were limited to the non-repeater hand-held radios. Therefore, the actuation of the Surry FPS resulted in the loss of a single train of a safety system. This was the first such occurrence at the Surry plant in its 14 years of operation and one could calculate a frequency of occurrence of actuation of the FPS resulting in the loss of a single train of a safety system at Surry of 1/14 or 7.1 x 10-2/RY. The data base used in the analysis of this issue identified 18 events in which actuation of the FPS resulted in the loss of a single train of a safety system. For the 300 RY represented by the data base, the 18 events would result in a frequency of 6 x 10-2/RY for FPS actuation causing loss of one train of a safety system. It was concluded that the operational history at Surry was in sufficient agreement with the data base used for the above analysis and the significance of the Surry event with regard to the interaction of the FPS with plant safety systems was encompassed within this issue.
CO2 Releases: During the operating period reviewed, 3 of the 28 releases of fire suppressant were releases of CO2: 2 were inadvertent and 1 was a planned CO2 system acceptance test. One event caused evacuation of maintenance personnel from a cable spreading room following the FPS pre-release alarm. In most plants, the cable spreading room is an unmanned area. The second event resulted in sufficient pressure buildup to force open a closed door in an ECCS penetration room. The third event was a planned acceptance test which failed to achieve the specified CO2 concentration but also caused rapid temperature reduction in a cable spreading room such that some instrument cabinets approached their operating temperature lower limit. In this latter case, the CO2 system was replaced with a halon gas system. None of these releases resulted in an adverse interaction with safety systems or a plant transient. The staff's FPS guidelines addressed the possibility of each of the conditions described above.
External Events: An additional consideration concerned a potential external event such as a large smoke cloud due to a large offsite fire, or a seismic event which could cause actuation of multiple smoke detectors which could cause inadvertent release of fire suppressant in several plant areas.
During the operating period reviewed, there was one occurrence of a large external smoke cloud due to a large grass fire near a plant that actuated several smoke detectors. In this instance, no suppressant was released since the smoke detectors were used with pre-action water sprinkler systems which require heat in the vicinity of the sprinkler head to melt the fusible link before releasing suppressant. Also, the operators had advance notice of the approaching smoke cloud and had time to start operation and to have personnel available to establish fire watches in an area where smoke detectors were actuated. For a plant with open head deluge sprinklers, the advance warning would permit time to deactivate the deluge system and post a fire watch in an area where safety equipment might be exposed.
A core-melt frequency of 3 x 10-9/RY was estimated for large offsite fires causing an inappropriate or inadvertent actuation of the FPS and further failures resulting in core-melt events. The one precursor event mentioned above translated to a frequency estimate of 1.4 x 10-3/RY for offsite fire-induced FPS actuation. A probability of 0.1 was assumed for failure to post a fire watch and take manual control of the FPS. AFWS failure assumptions were as follows:
| Probability that AFWS is protected by an open head deluge system | = 0.02 |
| Probability of AFWS electrical failure due to deluge | = 0.02 |
| Probability of operator error defeating manual operational of AFWS | = 0.10 |
Failure of feed-and-bleed heat removal was assumed to be 0.5/demand. These estimates and assumptions were used to calculate the 3 x 10-9/RY core-melt frequency estimate for offsite fire-induced FPS actuation. Thus, the offsite fire contribution to core-melt for this issue was found to be negligible.
The frequency of a core-melt event initiated by a seismic event of OBE magnitude or greater causing an inadvertent actuation of the FPS was estimated to be 10-8 /RY. It was believed that there was still some conservativism inherent in this estimate and that a more rigorous development of a best estimate frequency for this sequence of events would result in a lower frequency estimate. The LLNL Report (UCRL-53037), which provided estimates of earthquake frequency at the Zion site and the conditional probabilities of transient or LOCA initiators given an earthquake, was used to develop a frequency of 2 x 10-6/RY for earthquake-induced LOCA and 5.6 x 10-4/RY for earthquake-induced loss of offsite power (T1) transients. Examination of systems and equipment at 109 different major industrial facilities (including power plants) that experienced seismic events (peak ground accelerations from 0.1g to 0.75g) revealed no inadvertent operation of FPS. Therefore, a conditional probability of 10-2 was assumed for FPS actuation, given an earthquake. The 30 inadvertent FPS actuation events yielded only one event in which complete loss of safety function (emergency onsite power diesel generators) resulted. Therefore, a conditional probability of loss of safety function given an earthquake was assumed to be 1/30 or 3.3 x 10-2. This probability was assumed for both a loss of emergency onsite power for T1 transient events and loss of high pressure injection for LOCA events. Solution of the LOCA and T1 transient event trees resulted in the 10-8/RY estimated core-melt frequency due to seismic-induced FPS actuations. When compared to the estimated core-melt frequency of 3.4 x 10-7/RY from other scenarios resulting from inadvertent FPS actuation, the seismic contribution was found to be negligible.
Periodic Fire Protection Program Audits: There already existed a mechanism for mandatory review of the Fire Protection Program and implementing procedures for each plant without requiring an IE Bulletin. The TS for each plant requires under Administrative Controls:
(a) An independent fire protection and loss prevention inspection and audit annually utilizing either qualified offsite licensee personnel or an outside protection firm.
(b) Audit of the Fire Program and implementing procedures at least once every 24 months.
(c) An inspection and audit of the fire protection and loss prevention program by an outside qualified fire consultant at intervals no greater than 3 years.
The issuance of IE Notice 83-411025 and periodic INPO Significant Event Reports provide timely operations feedback to enable licensees to consider applicability of such events in the periodic program reviews indicated above. Several plants have documented instances where their periodic reviews in conjunction with the feedback information identified an area where there was potential for FPS interaction with part of a safety system and corrective action was taken.
CONCLUSION
Based solely on the above quantitative analysis, this issue would have been given a low priority ranking (See Appendix C). However, the external events portions of the analysis, although resulting in a low safety significance, had (by their very nature) large uncertainty error bands inherent in the determination of frequencies of occurrence for rare events (i.e., earthquakes). In addition, the analysis of events resulting in core-melt from inadvertent FPS actuation considered the frequencies of initiating events (particularly transients) to be independent of the FPS actuation. Initially, it must be assumed that, if inadvertent FPS actuations can result in the loss of a safety system train or function, in some instances it can also result in the initiation of a reactor transient. This limited analysis could not incorporate such subtle effects of FPS actuation. Hence, it could be assumed that the true core-melt frequency would be greater than that calculated above.
The ACRS and the nuclear industry showed a higher interest in this concern than that which would be normally warranted of a low priority safety issue. In fact, the nuclear industry, through EPRI, initiated a study of the effect of inadvertent FPS actuation on plant safety. The EPRI study was one of three research initiatives suggested by the EEI Fire Protection Committee as a result of their review of electrical utility experience with the design and operation of FPS at both nuclear and non-nuclear electric generation facilities. In consideration of the above factors, this issue was given a medium priority ranking.
In resolving the issue, the staff evaluated 4 plants and found that the dominant risk contributors fell into the following 2 categories: (1) seismic-induced fire plus seismic-induced suppressant diversion; or (2) seismic-induced actuation of the FPS. Both of these categories were to be addressed in the IPEEE.1222 The staff's technical findings were published in NUREG-14721541 and NRC Information Notice 94-121543 was issued. An evaluation of the issue was documented in NUREG/CR-5580.1588 Thus, the issue was RESOLVED with no new requirements.1542 Consideration of a license renewal period of 20 years would not affect the resolution.
REFERENCES
|
