Nuclear power plants: A unique challenge to fire safety

Fire Safety Journal 19 (1992) 3-18

Nuclear Power Plants: A Unique Challenge to Fire Safetyt

Steven P. Nowlen

Division 6419, Sandia National Laboratories, Albuquerque, Ne.w Mexico 87185, USA

A B S T R A C T

The evaluation o f fire safetyin a nuclear power plant must include the consideration o f the impact o f a fire on the operability o f plant safety equipment and systems. This issue is not typical of the life safety and property protection issues which dominate traditional fire safety concerns. This paper provides a general discussion o f the issue o f nuclear power plant fire safety as it currently exists in the USA. Included is a discussion of the past histroy of nuclear power plant fire events, the development o f nuclear industry specific fire safety guidelines, the adverse experience associated with the inadvertent operation o f fire suppression systems, and the anticipated direction of fire safety requirements for future reactor designs in the USA.

I N T R O D U C T I O N

Nuclear power plants present the fire protect ion communi ty with unique challenges. In addit ion to the traditional concerns of life safety and proper ty loss prevent ion, nuclear safety analysts must also be concerned with the impact of fires on the safe operabil i ty of the nuclear reactor. Safe shutdown capability must be protec ted from fire damage.

~-This work was supported by the US Nuclear Regulatory Commission and was performed at Sandia National Laboratories which is operated for the Department of Energy under contract number of DE-AC04-76DP00789.

3 Fire Safety Journal 0379-7112/92/$05-00 © 1992 Elsevier Science Publishers Ltd, England. Printed in Northern Ireland

4 Steven P. Nowlen

In the USA, when nuclear power plants were first designed and built, fire safety considerations were based primarily on the same criteria applied to general industrial facilities, primarily those concerning life safety and property loss prevention. This practice continued until 1975 when the Brown's Ferry nuclear reactor site experienced a severe cable tray fire. The fire burned for over 7 h, due in part to the reluctance of on-site personnel to use water on the fire for fear of shorting out critical electrical circuits.

As a result of the Brown's Ferry fire, extensive investigations were initiated by the U S Nuclear Regulatory Commission (USNRC). Due largely to this fire, the USNRC developed new standards for fire safety in the commercial nuclear reactors. These criteria identified specific requirements for the continued operability of safety systems in the event of a fire. All existing plants were required to upgrade to the new criteria retroactively.

Shortly before the Brown's Ferry fire, the USNRC Office of Research (RES) had initiated a fire safety program at Sandia National Laboratories. 1 The Brown's Ferry fire significantly altered the direction of those efforts. This fire safety work has continued through to the present. This paper will present an overview of some of the major results and conclusions which have been developed as a result of these investigations and as a result of nuclear plant operational experience.

OVERVIEW OF N U C L E A R P O W E R PLANT FIRE EXPERIENCES

As an industry, US nuclear reactor sites have experienced many fires, both large and small. A data base of these fire events has been developed by Sandia National Laboratories (SNL). 2 This work was performed in support of a broad-based USNRC-sponsored fire research effort. 1 The SNL fire data base identifies 354 fire incidents occurring between February 1965 and May 1985. Each of the fire incidents was identified through one of three general sources, namely, the USNRC Licensee Event Report (LER) system, nuclear industry insurance and operating organizations, and the open literature.

Figure 1 presents a summary of the yearly history of fire incidents as documented in this data base. (Note that 143 of the 354 fires occurred while a plant was still in the construction phase and are not included in this plot.) Interestingly, certain historical events are reflected in this data base. In particular, immediately after the 1975 Brown's Ferry fire, there is an increase in the rate of fire event reporting. The Brown's

Nuclear power plants: a unique challenge to fire safety 5

Number of Fire Incidents 25

20

15

10

5

0

of plant operation. shutdown/pre-op.

o

65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 Calendar Year

History of US nuclear power plant fire incidents by calendar year and by mode B, power operation; J , cold shutdown/refuel; [], hot

Ferry fire resulted in a heightened fire awareness and sensitivity throughout the industry so that many fires which may previously have gone unreported due to a low level of operational significance were now being reported. During 1983 and 1984, the last years for which complete data are available, there is a significant drop in the rate of fire reports. This is attributed to the fact that in 1982 the USNRC issued new reporting guidelines for fire incidents. These guidelines stated that fires need be reported only if they did have, or could have had, an adverse impact on safety equipment or systems. Thus, many of the smaller fires which were previously being reported by utilities are no longer being reported.

A number of general insights can be gained through examination of this data base. First, US commercial nuclear power plants are ex- periencing an average of one significant fire every 7-10 years of actual, at power, operation. In this context, a significant fire is one which does or could threaten the operability of one or more safety systems. Insights regarding the sources of fires in nuclear power plants can also be found through examination of the data base. The most common sources of nuclear power plant fires (other than during plant construction) in the approximate order of fire frequency are as follows:

--oi l line leaks and oil spills (including diesel generator fires, pump fires, and fires caused by oil contacting hot pipes);

- -hydrogen leaks and explosions (hydrogen is present as a component cooling agent and as a part of the reactor chemistry);

--welding and cutting operations;. ---electrical faults in switchgear, breakers, and motor control centers;

6 Steoen P. Nowlen

-- transformer faults; --electrical faults in control and instrumentation circuits; --personnel error; - -cable and cable splice faults.

The fire incident data base also provides interesting insights into the detection and suppression of nuclear plant fires. Manually detected fires outnumber automatically detected fires by approximately 5 to 1. Nearly all of the reported fires have been suppressed by manual actions and in only a relatively few fires have automatic suppression systems played a role. These observations can be attributed to a number of factors.

First, in the USA, fire detection and fixed or automatic fire suppression systems are only required in plant area containing redundant trains of safety equipment. In practice, relatively few plant areas will meet this criteria. A second factor is that many fires are either caused by personnel actions or occur as a result of test and maintance operations during which personnel are present in the immediate area. These fires are typically handled quickly, before any automatic measures might have become involved.

Another factor contributing to this observation is that all nuclear power plant sites in the USA are required to have, on site, manual fire response teams. These teams may be comprised of personnel drawn from plant security, maintenance, and operation staffs, or may be personnel dedicated to fire protection activities. A final factor, which will be discussed in more detail below, is that plants occasionally have been reluctant to implement fixed or automatic fire suppression systems due, in part, to a significant history of adverse spurious fire suppression system actuation incidents. These practices tend to result in a strong reliance on the manual fire response capability at US nuclear power plants.

A D V E R S E EXPERIENCES INVOLVING FIRE SUPPRESSION SYSTEM ACTUATION

In addition to the fire incident experiences described above, the nuclear industry has experienced a number of incidents in which the spurious actuation of a fixed fire suppression system has resulted in the failure of plant safety systems. Two reviews of such incidents have recently been completed. 3'4 The most recent review identified a total of 131 separate incidents in which a fixed fire suppression system had been actuated (based on a review of USNRC Licensee Event Reports submitted

Nuclear power plants: a unique challenge to fire safety

between 1 January 1980 and 31 December 1989). Of these incidents, only 15 were considered advertent actuations, that is, incidents in which a fixed suppression system was actuated as a result of an actual fire in the protected area. The remaining 116 events were inadvertent actuation incidents.

Figure 2 identifies the number of fixed fire suppression system actuation incidents occurring by calendar year. The data are subdivided into three categories, namely, advertent incidents, post-criticality inadvertent incidents, and pre-criticality inadvertent incidents. Of the 116 inadvertent incidents, 99 involved the actuation of a water-based suppression system, 12 incidents were identified involving carbon dioxide systems, and 10 incidents were identified involving Halon systems. In two cases, multiple suppression system actuations occurred, including one incident which involved the actuation of one deluge water sprinkler system, one carbon dioxide system, and one Halon system.

It is interesting to note that the rate of inadvertent fixed suppression system actuation incidents is quite similar to that identified in Fig. 1 for actual fire incidents. For the years in which complete data are available, 1981-7, five to 15 such events are identified each year. When this generic plant-wide frequency of events is refined to the frequency of events occurring in critical safety related plant locations, an interesting result appears.

In a typical fire risk analysis, the analyst must estimate the condi- tional frequency of a fire occurring in a very specific plant location (such as one corner of a cable spreading room). However, the generic data base can, in general, only provide an estimate of the fire frequency

NulT~ber of Evel~ts 25

20

15

10

5

0 80 81 82 83 84 85 86 87 88 89

Calenc~ar Year l~ . 2. History of US nuclear power filant fixed fire suppresion actuation incidents by calendar year indicating advertent and inadvertent actuation events. I , inadvertent events; ~ l I advertent events .

8 Steven P. Nowlen

for relatively large and generalized plant areas (such as the auxiliary building). Thus, a process called 'partitioning' is invoked by which the generic incident base is refined for application to specific plant locations. In effect, partitioning apportions a fraction of the fires occurring in a large generalized plant area to the very specific plant location of concern to the risk analysis. The partitioning factors are typically assessed as being much less than unity, and hence, the fire frequencies for the very specific critical safety impact locations are reduced significantly from those typical of the plant as a whole (typically by one to three orders of magnitude).

In the case of spurious suppression incidents, a similar partitioning process is invoked. However, only those areas with fixed fire suppression systems will factor into this partitioning process. In effect, the generic spurious suppression data base applies only to that subset of the plant which is equipped with fixed fire suppression systems, whereas the generic fire incident data base applies to the entire plant. As stated above, for US reactor sites, relatively few plant areas will be equipped with fixed fire suppression systems, and those areas which are equipped with such systems will generally be associated with safety related equipment and systems. Thus, the partitioning factors which refine the generic spurious suppression data base to critical safety related areas will approach unity, and the generic incident frequencies are reduced only slightly.

Because the generic frequencies for fire and spurious suppression system actuation are quite similar, one would generally conclude that an inadvertent suppression incident is more likely than a fire in areas which are protected by a fixed suppression system. This conclusion is considered generally valid, although it is a rather unexpected result. A second factor which further aggravates this situation is that fire suppression systems will, in general, have a larger area of influence than will a fire. When combined, these observations illustrate the potential importance of considering the impact of spurious suppression system actuations on plant safety.

Figure 3 identifies the causes of the fixed fire suppression system actuations. The most commonly identified cause was personnel error (22-8% of the reported incidents). This includes errors in testing and maintenance (failure to follow proper procedures), bumping actuators, miscommunications, and other mistakes. The second most commonly identified cause was leakage in water-based fire suppression systems (22-1%). These causes were followed by, in order of frequency; unknown causes, advertent actuations (only 11%), test and maintenance procedure inadequacies, steam/dust/humidity causing actua-


F i g . 3 . cause.

Actuation Cause

Advertent

Lightning Wetted Detectors

Electrical Failures Welding

Pressure Surges Steam/Dust

Bad Procedures

Unknown Water Leakage

Personnel Error

~ --111.0% 1.5%

~ 2.2%

~ 2.2% I I 2.9% ~ 5 . 1 % ~ . " I a.1%

I 13.2% ~ 2 ~

0 6 10 15 20 Number of Events

22.1% / , J, 122.8~/,

25 30 35

History of US nuclear power plant fixed fire suppression system actuations by

tion of smoke detectors, pressure surges in water-based systems, smoke from welding and maintenance activities actuating smoke detectors, wetted detectors, electrical failures in fire protection system control panels, and lighting-induced actuation of flame detectors.

Of the 131 actuation incidents identified, 55 incidents occurred in which the fire suppression system actuation resulted in damage to other plant equipment. In 31 of these events, the damaged equipment was considered risk important. This proportion of incidents which actually resulted in damage is much higher than that which occurs for actual fire incidents. This is not entirely surprising since in the US, fixed fire suppression systems are typically employed only in areas which house safety equipment rather than general plant areas. Thus, it can be expected that almost any inadvertent actuation would potentially expose safety components to damage.

The incident review also demonstrated that a wide range of plant equipment and systems were potentially vulnerable to fire suppression- induced damage. The most commonly identified components which were damaged were, in order of frequency; transformers (17 incidents), charcoal filters (15), fire protection equipment and systems (14), control panel circuitry (13), and load centers, switchgear, motor control-centers and electrical busses (11). In addition, less commonly identified equipment damage involved diesel generator actuators and dampers, pumps, valves, miscellaneous instrumentation, the plant computer, a motor generator set, a doorway access card reader, and an internal

10 Steven P. Nowlen

plant radio repeater. Other incidents reported system damage without identifying the specific component damaged.

These component failures have resulted in the failure of a variety of plant safety systems. Perhaps of most significance are reported failures, in different incidents, in the primary control rod drive mechanism, primary and back-up power supply systems, high pressure core injec- tion, core spray systems, reactor protection system, reactor coolant system, emergency equipment cooling, main feedwater, emergency communications, and access control. Because of the built-in redun- dancy, a failure in any one plant safety system may have little or no effect on plant operations. However, in 29 of the 131 events identified, equipment failures led directly to a forced shutdown of the plant (scram or trip). Here again, this is a higher rate of shutdown than that experienced for actual fire incidents.

In general, the vulnerabilities identified in these reviews have been attributed to design and installation inadequencies. In the implementa- tion of fire protection, equipment vulnerabilities to fire suppressant discharge have not been fully considered. Consideration of these factors in the design and installation of fixed fire suppression systems could largely eliminate the significance of inadvertent suppression incidents. For example:

---cable and conduit penetrations into electrical cabinets should be sealed to prevent water intrusion;

---conduits should be examined for the potential to channel water to sensitive components and sealed if necessary;

- -Halon and CO2 discharge nozzles should not be located near components sensitive to freezing such as integrated circuits and relays;

--multiple gaseous storage tanks should be used for multiple suppressant systems rather than a single large storage tank to service many systems (one incident occurred in which a plant's entire suppressant inventory was discharged into a single fire area);

--placement of fire protection control panels must be carefully considered to insure that a multiple safety system vulnerability is not created through the potential for multiple fire suppression system actuation due to a common mode failure such as flooding;

---suppression systems should be selected to be compatible with the protected equipment wherever possible (e.g. don't put automatic deluge sprinklers in a switchgear area; if water is needed, use a wet pipe or preaction system as spurious actuation is less likely);

---suppressant actuation switches should be clearly marked and protected from inadvertent actuation;


--single smoke detectors should not be used as the sole criteria for the initiation of fire suppressant discharge (at the least, multiple detection logic or cross zoning should be employed, or an alternate detector type should be employed, particularly in areas of high humidity, high dust levels, or potential steam leak areas);

--administrative procedures are needed so that maintenance activities do not inadvertently set off suppression systems (e.g. when welding or cutting in an area, be sure that smoke detectors are deactivated, a fire watch is posted, and that the system is properly restored upon completion of work);

--potential water drainage and gaseous suppressant venting paths should be examined so that suppressants can be managed following discharge;

--f loor penetration seals should be water tight for areas in which water is the likely fire suppressant;

~ q u i p m e n t failure analyses and fire risk analyses should consider fire suppressant discharge as a source of failure.

These and other design considerations would generally address the vulnerabilities identified. However, even with such consideration, vulnerabilities are expected to remain as not all equipment can be adequately protected without compromising fire fighting effectiveness, and not all failure modes and circumstances can be foreseen. Analyses should be performed to insure that safe shutdown capability will remain, given conceivable inadvertent suppression actuations and damage.

FIRE RISK ASSESSMENT

Probabilistic risk assessments (PRAs) have been performed for a large number of US nuclear power plants. Many, though not all, of these risk assessments have considered fire as a source of safety system failure which could potentially lead to nuclear core damage. In general, those analyses which have considered fire as a source of core damage risk have concluded that fire is, in fact, an important contributor to overall plant risk. Based on the mean value (or point value) estimates which have been reported in publicly available PRAs, fire typically contrib- utes as much as 6-60% of the overall plant core damage frequency from all sources.

The most important insights which have arisen from fire risk assessments are the identification of potential plant systems fire vulnerability. In many cases, it has been observed that fire risk can be

12 Steven P. Nowlen

significantly reduced through the installation of relatively simple plant modifications. However, it is often only through the performance of a risk assessment that such vulnerabilities are identified. For example, at the Indian Point Unit 2 site, the dominant fire risk scenario and overall plant fire risk was reduced by approximately an order of magnitude through the installation of alternate power cabling for a critical safety system. This alternate cabling was routed so that one particular fire area which represented a multiple system "pinch point" vulnerability was avoided. 3

In other cases, the vulnerabilities identified are not so easily resolved and may require more extensive measures. For example, reactor containment cable penetration areas are often identified as fire risk significant. This results from the fact that these areas often represent cable convergence, or pinch points for multiple safety systems. Due to other design and operational constraints, it is not usually possible to relocate these cables to other areas. In such cases, other measures may be employed to reduce fire risk. For example, the cables associated with one or more of the safety trains may be protected by passive fire barrier systems. These will also be areas in which automatic, fast-acting fire detection and suppression systems may be employed. As will be discussed further below, when a reactor is still in the design stage, many of these types of vulnerabilities can be eliminated through design considerations.

Another example of a very important fire area is the main control room. This is the one area in the plant where virtually every plant safety system converges. While alternate safe shutdown areas are required at all US reactor sites, the control room remains a critical location. In this area, fire risk is assumed to be significantly reduced because the area is continuously manned. There have been four control room fires in commercial reactors in the U S A . 2'3 Each of these four fires resulted from control circuit component failures, and the fires were quickly extinguished by plant personnel. In all cases, damage was contained to a single control panel. Control room fire safety is a difficult issue to address. Design constraints prevent the segregation of safety systems in the control room to the extent possible in other plant areas. The use of automatic or fixed manually actuated fire suppression systems is avoided due to their potential for causing equipment damage if spuriously actuated. Even for new reactors, control room fire safety provisions will be largely limited to the use of low flammability materials, segregation of control panels with solid non-flammable barriers, careful routing of control and instrumentation cables, training of operating personnel in fire safety, and smoke control provisions.

Nuclear power plants: a unique challenge to fire safety

FIRE SAFETY PLANT AGING

13

In the USA, no new commercial nuclear power plants have been commissioned for several years. The last plants commissioned are now generally either in operation, approaching operational status, tied up in legal battles, or have been canceled. Many of the first generation nuclear power plants are approaching their initial licensing lifetimes of 40 years. Current projections estimate that 18% of domestic electrical generation in the USA by 1995 will be from nuclear power plants. 5 If no changes are made in the current licensing situation, by 2009, eight nuclear reactors will have been shut down. By the year 2015, an additional 41 units will be shut down, and by 2023 85% of the operating reactor sites will have been shut down. 6 It is estimated that without changes, nuclear power's share of the US domestic electric production by 2025 will be down to 2%. 5 This would place a considerable burden on the electric power industry to provide alternate sources of power generation .6

The USNRC and nuclear industry groups have launched extensive investigations of plant aging and plant life extension. These investigations are aimed at identifying and resolving plant aging safety issues so that plants might be allowed to safely operate beyond their original design life. The energy security of the US will be closely tied to the viability of the nuclear industry, both in terms of plant life extension, and in the longer term, the construction of new power generating capacity. 6

One question which must be addressed as a part of plant life extension efforts is the possibility that plant aging could result in an increase in fire risk. A number of potential fire safety plant aging issues have been identified. 7 These include the impact of aging on:

- - the flammability of cable insulation materials; - - the vulnerability of plant equipment, including cables, to fire

induced damage; - - the likelihood of self induced electrical equipment fires; - - the reliability of fire detection and suppression systems; - - the integrity of passive fire protective features such as barrier

penetration seals, cable tray fire retardant coatings, cable tray fire barrier systems, and cable tray protective wraps.

Very little is known about these effects. Under USNRC sponsorship, an effort has been initiated to investigate fire safety issues which might be affected by plant aging. Current investigations are focussing on

14 Steven P. Nowlen

450Expos~r_e Temperatme (C) ~ EPR/HypalonCabte

425 •

400

375

35011

325

300 0 10 20 30 40 50 60 70 80 90

Time to Electrical Failure (min)

450F.xposure Ten~er~,ture (C) XPE/Neol~rene C~ble

425 ~

400 '~

375 '~.

350 ~- ' ~ . . v _ ~ . . : . . : : . - _ :_ . . . - ~ - ~ ,

325

3OO 0 10 20 30 40 50 60 70 80 90

Time to Electrical Failure (mln)

Fig. 4. Cable thermal damage data showing the impact of thermal aging on (a) a 16 AWG, 2-conductor, EPR/Hypalon cable and (b) a 12 AWE, 3-conductor, XPE/Neoprene cable. A, aged cable failures; V, new cable failures; -~-, aged data bounds; ..~t_ , new data bounds.

three areas, namely; the impact of aging on cable fire damageability, cable flammability and control circuitry fire damageability.

Initial results of the cable damageability studies are available. These results have shown that aging can affect the thermal damageability of cables. Figures 4(a) and (b) illustrate the results for two types of cables. The plots show the time to electrical failure versus convective exposure temperature for each of two cable types in both an unaged, and artificially aged condition. As can be seen, the aging process had a different effect on each of the two cables tested. In one case the cable's thermal damage threshold was lowered by aging, whereas in the second case the thermal damage threshold increased with aging. In neither case are the differences considered large enough to result in a significant change in fire risk estimates.

F IRE SAFETY AND NEW R E A C T O R DESIGNS

As nuclear plants in the US age beyond the point where safe, economical operation is practical, they will be phased out and an alternative source of power must be supplied. It is expected that a new generation of nuclear power plants will be developed in the US to help fill this need. It is also expected that, in terms of fire safety, significant changes in the regulatory approach will also take place.

The first plants in this new generation of US nuclear reactors are quite likely to be built by the US Depar tment of Energy (DOE) to serve the needs of the defense nuclear industry. DOE is currently in the process of soliciting and evaluating New Production Reactor (NPR)


design proposals from nuclear vendors. These reactor designs will be required to meet all existing safety standards, including those associated with fire safety. Even beyond this, the reactor design is expected to anticipate future changes in the regulatory environment, and thus, remain in compliance with evolving regulations.

In the area of fire safety, this last condition is of particular importance. Current commercial nuclear reactors are required to meet USNRC standards. However, the current USNRC fire safety standards were written in the aftermath of the Brown's Ferry fire, described previously, and were intended as retrofit rules to apply to all then existing plants. For a new reactor design, a different set of requirements will almost certainly be developed by the USNRC. It is this anticipated set of rules which the DOE NPR designs are expected to meet.

In particular, the principal provisions of the current USNRC fire safety guidelines require that redundant trains of safety equipment in general plant areas be protected by one of three general features:

---separation by a fire barrier with a 3-hour fire rating, or ---separation by 20 feet of horizontal space with no intervening

combustibles or fire hazards, and area protection with automatic fire suppression and detection systems, or

--enclosure of equipment in a 1-hour rated fire barrier, and area protection with automatic fire suppression and detection systems.

The second of these criteria is the so-called '20-ft separation criterion'. This criterion specifically allows redundant trains of safety equipment to be housed within the same fire area if certain protective measures are employed. Fire areas in which this criterion has been applied will often represent the dominant contributors to estimates of plant fire risk.

The most significant change in fire safety regulations for the advanced reactor designs, including NPR, is expected to be that, with only a very few exceptions, spatial separation of safety equipment within a single fire area will not be acceptable. It is expected that the new designs will be required to separate redundant trains of safety systems and components into independent fire areas.

Other changes in the regulatory environment are also anticipated. These changes will, in large part, be based on the experiences obtained in the operation of commercial nuclear reactors and in the implementa- tion of fire safety for the commercial nuclear industry. In particular, it is anticipated that:

--requirements for the staffing and training of on-site fire response teams will be increased;

16 Steven P. Nowlen

---design requirements will place more emphasis on compartmen- talization and segregation of equipment types into separate fire areas (e.g. do not place switchgear in areas of high cable concentration);

--the plant design will be expected to minimize the use of fire barrier penetrations, particularly through barriers which separate redundant trains of safety systems and components;

--all barrier penetrations will be required to fire rated to the same rating as the barrier itself, and international penetration seal testing standards which include a pressure testing condition may be endorsed (current US barrier testing standards do not address the question of fire induced pressures);

--plant ventilation systems will be designed such that smoke control and/or removal is supported (e.g. realignment capability to manage smoke movement);

--fire detection systems will be required in virtually all plant areas; -- the use of Halon-based fire suppression systems will be severely

limited, and will likely not be allowed at all (due to environmental concerns about the impact of Halon on atmospheric ozone);

Qplant designs will be required to consider the potential impact of inadvertent fixed fire suppression system actuation on equipment operability;

---control room design will be required to compartmentalize control panels and segregate safety systems through the use of solid fire barriers between cabinet sections;

---control room design will consider the routing of cables within the control room to (1) minimize the concentration of cables, (2) minimize the presence of power cables in the control room, (and (3) minimize the likelihood that a fire in a given area might damage redundant cables overhead;

--material selection, particularly for cable insulations, will be based on stringent fire safety evaluations including flame spread, toxico- logy, corrosivity, and aging properties;

--fire protection features, including system control and actuation panels, will be designed to withstand seismic loadings;

wan extensive, independent redundant safe shutdown area will be required, and the requirements for this area are expected to be more explicit than current regulations;

- -a risk assessment, including fire risk, will be performed and dominant vulnerabilities will be addressed during the design stage.

It is expected that these measures, if implemented during the design stages, could reduce residual fire risk to vanishingly small values. Fire


will always represent a risk to personnel safety, property protection, and safe operation. However, by considering fire safety as a design criteria, the level of fire risk can be effectively minimized without compromising other aspects of plant safety.

SUMMARY

In summary, nuclear power plants have, and will continue to, present the fire protection community with unique challenges. Considerations must extend beyond the traditional concerns of life safety and property protection, and must include consideration of the operational safety of the reactor and the protection of safe shutdown functions from fire damage.

One must also consider that one of the most commonly employed approaches to fire safety, the installation of fixed and automatic fire suppression systems, can introduce a new source of safety system damage. Experience in the US indicates that the spurious actuation of a fixed fire suppression system is as likely to occur as is an actual fire. This does not imply that fixed fire suppression systems should not be used in a nuclear power plant. Such systems have been credited with significantly reducing fire risk. However, when such systems are employed, special consideration must be given to the potential impact of system actuation on plant safe shutdown capability. Fire suppression agents must also be carefully managed following release.

For the future, the US nuclear power industry must face two issues. First, for existing plants, it will be important to ensure that plant aging does not result in a significant increase in fire risk. The USNRC has initiated efforts to identify and investigate issues of plant aging which might impact fire risk. Second, future reactor designs will face an entirely different regulatory environment than that applied to current reactor sites. It is anticipated that fire safety requirements in the US will be made significantly more stringent for the next generation of power reactors. These changes should be anticipated in the design of new reactors.

REFERENCES

1. A Summary of Nuclear Power Plant Fire Safety Research at Sandia National Laboratories, 1975-1987, NUREG/CR-5384. Sandia National Labora- tories, Albuquerque, NM, December 1989.

18 Steven P. Nowlen

2. Users Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base, NUREG/CR-4586. Sandia National Laboratories, Albuquerque, NM, August 1986.

3. Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues, NUREG/CR-5088. Sandia Na- tional Laboratories, Albuquerque, NM, January 1989.

4. Evaluation of Generic Issue 57, Effects of Fire Protection System Actuation on Safety-Related Equipment, NUREG/CR-5580. Sandia National Labora- tories, Albuquerque, NM, draft issued for comment and review June 1990.

5. Estimated cost savings from nuclear-plant improvement and life extension. LWR Plant Life Extension, EPRI NP-5002, US Department of Energy and the Electric Power Research Institute, Palo Alto, CA, January 1987.

6. EPRI/DOE 1987 PLEX research plan. LWR Plant Life Extension, EPRI NP-5002, US Department of Energy and the Electric Power Research Institute, Palo Alto, CA, January 1987.

7. The effects of aging on the fire vulnerability of nuclear power plant components. In Sixteenth Water Reactor Safety Meeting, NUREG/CP-0097, USNRC, Washington, DC, October 1988.

Documents

Nuclear power plants: A unique challenge to fire safety