INTERNATIONAL PEER REVIEW SERVICE For Probabilistic Fire Safety Assessment of Mühleberg Nuclear Power Plant

Transcription

1 January Distr.: Restricted INTERNATIONAL PEER REVIEW SERVICE For Probabilistic Fire Safety Assessment of Mühleberg Nuclear Power Plant Final Report January 1992 Wiirenlingen, Switzerland Paul Guymer (USA) Steve P. Harrison (UK) Stefan Hirschberg (IAEA) ),;Lia VW*-' 1

2 January 1992 Distr.: Restricted INTERNATIONAL PEER REVIEW SERVICE For Probabilistic Fire Safety Assessment of Mühleberg Nuclear Power Plant Final Report January 1992 Wiirenlingen, Switzerland Paul Guymer (USA) Steve P. Harrison (UK) Stefan Hirschberg (IAEA) <3

3 - 2 - PREAMBLE This report presents the results of the IAEA International Pear Review Services (IPERS) mission that reviewed the fire analysis part of the Mühleberg Safety Assessment (MUSA). The final set of PSA documentation was available during the review. In addition to the information supplied in the documentation, the IPERS views are based on communications with MUSA Project Managers, with plant personnel, and on the plant walk down which covered areas of primary interest in the context of fire analysis. The results presented herein reflect the views of the international experts carrying out the review. This document is provided to the responsible Swiss authorities for their consideration. Distribution of the IPERS report is left to the discretion of the Government of Switzerland; this includes the removal of any initial restrictions. The IAEA makes the report available only with the express permission of the Government of Switzerland. Any use of, or reference to, the views expressed in this report that may be made by the competent Swiss organizations is solely their responsibility.

4 - 3 - TABLE OF CONTENTS 1. INTRODUCTION Background The Plant...: The PSA The Review Report Structure SUMMARY, CONCLUSIONS AND RECOMMENDATIONS MUSA METHODOLOGY AND APPLICATION REVIEW Screening Methodology Description of Screening Methodology Screening Methodology Review Screening Application Review Recommendations Detailed Analysis of Fire Scenarios Review of the Methodology and Input Data Analysis of Specific Fire Scenarios APPENDIX A: The MUSA fire analysis: A step by step description of the methodology and procedure (Report by A. Torri) APPENDIX B: Composition of the review team APPENDIX C: Agenda for the IPERS meeting

5 INTRODUCTION 1.1 Background At the request of the Government of Switzerland, the International Atomic Energy Agency (IAEA) has agreed to conduct an International Peer Review Service (IPERS) mission for'the fire analysis part of the Mühleberg Nuclear Power Station (KKM) Safety Assessment (MUSA). The requested IPERS has been conducted during a one week mission to Switzerland. A valid plant-specific Probabilistic Safety Assessment (PSA) is a valuable tool useful for guiding safety decisions related to design, operation and regulatory activities. Independent peer review of a PSA constitutes an integral part of any PSA programme. Since 1989 the IAEA has provided such review services at the request of Member States. The general objectives of the IPERS programme are: - To use available international experience for improving PSA studies and hence nuclear safety: - To give guidance on what improvements should be made on the analytical approaches used. Thus, an IPERS examines a PSA to identify specific areas either planned or performed which are not accurate or not in accordance with accepted practices, and to give guidance on recommended revisions. Depending upon the objectives of the PSA, an IPERS can focus on one or more of the following technical areas: - The completness of the tasks and validity of the technical approaches of the PSA; - The general validity of assumptions, models, data and analyses used in the PSA; - The validity of the results obtained; - The validity and applicability of the PSA models as useful tools, in achieving the stated goals of the PSA. An IPERS can be carried out basically at any stage of a PSA, but typically it takes place at the beginning of the project, half-way through the project and/or when the project is about 90 % complete. During the early phases, the focus might be more on guidance for improvements rather than evaluating the PSA itself. The advantage of an intermediate review is that any identified deficiencies can be corrected in a timely manner with minimum impact on the available resources. The present review was carried out for a fully completed PSA. It was limited in scope in accordance with the request presented to the IAEA. Only one particular type of initiator, namely internal fires, was

6 - 5 - addressed. The main reasons for focusing the IPERS on fire analysis were some concerns raised in the MUSA review previously carried out by the Swiss Federal Nuclear Safety Inspectorate (HSK) and its consultants (Energy Research, Inc., (ERI)), and general awareness about substantial uncertainties involved in fire PSAs. 1.2 The Plant The Mühleberg Nuclear Power Plant (KKM) is a Boiling Water Reactor (BWR), owned and operated by Bernische Kraftwerke AG (BKW). The present net electrical power is 327 MWe (997 MWt), but BKW recently submitted a request for an uprating to 364 MWe (1097 MWt). The MUSA study is based on the uprated power of 1097 MWt. The plant is located near the village of Mühleberg on the Aare River, approximately 14 kilometers west of Bern. The nuclear steam supply and the Mark I primary containment were supplied by the General Electric Company (GE). The balance of the plant, including the two turbine generator sets, was designed and supplied by Brown Bovery Company (BBC). KKM has been in commercial operation since The availability factors over the years have been high (typically about 85 %). The plant has been extensively backfitted to meet current, more stringent safety standards. Thus, in 1990 a special independent and seismically qualified safety system called SUSAN was installed and taken into operation. This feature of KKM together with a highly redundant electrical power supply system are of particular importance in the context of mitigation of fire related accident scenarios. 1.3 The PSA The PSA was performed by PLG Inc. for the plant owner. Some other organizations (e.g. Impelí Corporation) were subcontractors for specific tasks such as development of seismic fragility information. BKW provided relevant plant information and participated in the review of project documentation. MUSA represents a detailed Level I PSA, including external events analysis. The study was extended to cover Level II analysis. The Level I report was published in July 1990, the Level II report in November SUSAN systems were fully incorporated into the PSA models and its benefical impact on the plant safety level was reflected in the results.

7 - 6 - The specific objectives of MUSA can be summarized as follows: "1. Perform an independent, plant-specific assessment of the risk of experiencing severe core damage based on unique and specific factors associated with the site, plant design, plant operation, maintenance, and operator response of KKM. 2. Document the results and methods in a form that is suitable for detailed technical review." 1.4 The Review The present IPERS of the fire analysis in MUSA is based on the PSA documentation (Report PLG-0751, Volumes 1-6). Parts of this documentation, specifically addressing the fire analysis, were delivered to the IPERS team in good time before the mission. In addition, the IPERS team received a step by step description of the methodology, written by the MUSA Project Manager (Dr. A. Torri, Risk and Safety Engineering, formerly with PLG Inc.); this report complemented the MUSA documentation and is attached (Appendix A) to the IPERS report as a background to the present review. The MUSA fire analysis IPERS is based on the international PSA experience of the IPERS team members and on the IPERS Guidelines (IAEA-TECDOC-543). The three IPERS team members were from the IAEA, UK and USA. Appendix В contains the curriculum vitae of the IPERS experts. The agenda for the IPERS meeting is attached in Appendix C. Following presentations of plant features and of the MUSA fire analysis the IPERS team discussed a number of issues related to fire analysis. Answers to the questions were provided by Drs. D. Haschke (BKW MUSA Project Manager), U. Schmocker (HSK, Head Section for Reactor Technology) and A. Torri (PLG MUSA Project Manager). These interactions as well as the plant visit and discussions with the plant personnel helped the IPERS team to understand the details of the analysis as well as the design and operation of the KKM plant, and consequently were essential for a successful performance of the review. The support and openess experienced in this context are gratefully acknowledged. It is important to point out the following limitations of the present review: 1. The procedure followed is different from the standard IPERS approach. The PSA analysts who actually performed the fire hazard analysis were not available for interactions with the IPERS team. Thus, the normal IPERS procedure based on generating issue lists and on resolving the issues upon receiving detailed written responses from PSA analysts could not be adapted.

8 The IPERS reviewed only those parts of MUSA which specifically address fire analysis. This analysis in turn uses to a large extent the plant model and data for internal events, when carrying out the propagation of fire scenarios through the plant model. The internal event plant model has been separatelly reviewed by HSK and its correctness has not been questioned by the IPERS team. 1.5 Report Structure A summary of the main conclusions and recommendations is given in Chapter 2 of this report. More extensive review comments on MUSA approach to the screening of fire scenarios, to detailed fire analysis for critical areas and to results analysis, are provided in Chapter 3.

9 SUMMARY, CONCLUSIONS AND RECOMMENDATIONS The main conclusions and recommendations of the review are summarized in this chapter. The conclusions are as follows: 1. The basic steps in the methodology used in MUSA fire analysis are consistent with those typically used in state of the art published PSAs. 2. Sound engineering approach has been applied in the context of screening analysis. The location analysis and the associated source analysis are of high quality, and more detailed than in most PSAs. However, the screening criteria used (sequences with frequences below 10-6 per year screened out) are questionable in view of the results obtained ( the most dominant fire scenarios identified by MUSA are of the order of 2 x 10-7 per year). Some of the scenarios screened out are just below 10-6 level and no evidence is explicitly provided that these estimates actually involve substantial conservatisms and would be significantly reduced given credit for available mitigating systems. In addition, some scenarios were not screened out, but were still not considered for detailed analysis. 3. The implemented methodology for detailed fire analysis for selected scenarios is inconsistent with the proposed one. Thus, when carrying out this analysis the findings from the screening phase, which included area specific fire sources, were disregarded. 4. The basis for fire propagation and damage impact is unclear. A simple, generic model was used; this means that plant/area specific characteristics (i.e. configuration, exposure fire type/size, properties of combustible, fragilities of components and cables, specific characteristics of detection and suppression), can only be reflected to a limited extent or not at all. Without access to data supporting the model used it is not possible to evaluate the impact of this considerable simplification. 5. The review confirmed that the dominant fire scenarios have been identified (given that the recommended check of the scenarios screened out will not lead to identification of additional significant contributors). Consequently, the most important objective of the PSA has been met. 6. Cases with potential significant under-estimation and with potential excessive conservatism have been identified by this review among the MUSA fire scenarios. This is due to the methodology used and can lead to incorrect ranking of the scenarios. Assurance of correct ranking is considered as one of the specific PSA objectives.

10 In spite of the IPERS concerns the expected overall impact of fire scenarios can be considered as reasonably low due to the mitigating impact of SUSAN (in scenarios with fire induced loss of non-susan equipment) and due to availability of feedwater (in scenarios with fire induced loss of both SUSAN and non-susan equipment). The relative fire contribution is, however, significant as already assessed by MUSA. 8. MUSA lacks sensitivity analysis for fire-related scenarios, the documentation of fire analysis is incomplete and no results analysis (i.e. clear outline of engineering insights from fire analysis), is available. 9. The deficiencies identified in the above points are not in the spirit of a "Living" PSA. It must, however, be remembered that realization of a "Living PSA concept was not the original objective of MUSA. This remark is made in view of the long-term goals for the Mühleberg PSA. Based on the conclusions above the IPERS recommendations of highest priority are as follows: 1. Fire scenarios screened out on the basis of 10- frequency criterion should be checked to assure that no contributors comparable with the dominant ones have been neglected. The reasons for some scenarios not being screened out and not being considered for detailed analysis should be established. 2. PLG internal data supporting the detailed scenario analysis (more specifically providing the background to the fire severity factor curves) should be scrutinized. 3. COMPBRN (or equivalent code) calculations are of interest for say two areas (380 V Switchgear Room and Reactor Building First Level). 4. Upgrade of the fire analysis PSA documentation should be considered.

11 MUSA METHODOLOGY AND APPLICATION REVIEW The results of the review of the fire PSA methodology and its application are described in this chapter. For convenience the methodology has been considered in two phases. The first phase is the screening methodology and is described in Section 3.1. The second phase is the detailed analysis which is described in Section Screening Methodology Firstly the screening methodology is described. This is followed by a review of the methodology and then a review of the way in which it has been applied to MUSA. Recommendations are then given Description of Screening Methodology The first phase of the fire PSA methodology involves the screening of the various plant areas to identify those areas which might contribute significantly to the core melt frequency. The screening methodology used in MUSA consists of the following steps: 1. Establish MUSA Equipment List: The list is derived from the hardware modelled in the system analysis. 2. Establish Plant Areas: Plant areas which contain PSA equipment are identified and given an area designator. 3. Assign Components to Areas: Each component in the MUSA equipment list is assigned to its areas. The areas identified by these components constitute the end points of cables routed between components. 4. Develop Area Strings: For each component the power and control cables connecting it, are traced back to their source component, which is listed in the equipment list. The string of areas through which the cable is routed are identified. 5. List Components and Cables in an Area: The cables identified in Step 4 are then combined with the components identified in Step Compile Plant Specific Fire Experience: Fire occurances at the plant are noted during the operating data collection.

12 Update Generic Building Fire Frequencies: A Bayesian update of the generic fire frequency for each building category is performed. 8. Assign areas to Building Type: Each area is assigned to a building category. 9. Allocate Building Fire Frequencies to Area: The fire frequency for each area is developed based upon equipment inventory, transient fuel inventory, and traffic in the area. 10. Estimate SUSAN Function and Non-SUSAN-Function Unavailability: From the system analysis results the unavailability of the core cooling function by SUSAN equipment alone and by non- SUSAN equipment alone is estimated for use in screening risk significant fire locations. 11. Screen on Frequency: Areas are classified as containing Non-SUSAN, SUSAN or both Non- SUSAN and SUSAN equipment. For areas containng non-susan equipment the area fire frequency is multiplied by the independant unavailability of the SUSAN function. For areas containg SUSAN equipment the area fire frequency is multiplied by the independent unavailability of the non-susan function. Areas containing both SUSAN and non-susan equipment retain the area fire frequency. All scenarios with a frequency greater than 10-6 per year are retained for further analysis. 12. Screen on Inventory: The PSA significance of the area inventory is screened to determine areas which have only limited PSA equipment, such that failure of all the equipment in the area would not cause more than one train of one multi-redundant system to fail. The areas not screened out at this stage are retained for more detailed analysis Screening Methodology Review The description of the methodology given in the PSA documentation is difficult to follow, but is for the most part complete. The additional information which was provided, and is reproduced here in Appendix A gives a much clearer description of the methodology. Some of the PSA documentation is misleading in terms of the methodology actually used. An example is provided by Section of the MUSA report, which describes the method used to evaluate the fire propagation frequency between areas. This method is not used in the screening analysis, which more conservatively estimates the frequency of fires propagating to another area as the sum of the fire frequencies for the areas being considered. No account of the probability of the failure of the barrier is used in the screening analysis; this is included in the detailed analysis. The steps used in the screening analysis and described in Appendix A are generally consistent with current practices used in fire PSAs. One good feature of the method is the way in which the building fire frequency is partitioned based on equipment type, transient combustibles and traffic level.

13 Screening Application Review The issues arising from the way in which the screening methodology has been applied in the MUSA study are now described. The generic data for fire frequency in nuclear power plant on which the assessment of building fire frequency in the MUSA study is based (NUREG/CR-4586,1986) is derived from reports of fires in- American LWR's. As such the fire frequencies obtained from this data should be considered as "average" for an American LWR. The SUSAN system could however be considered to be additional plant equipment relative to the "average" American LWR. An increase in the total fire frequency for the plant may therefore result. This increase is unlikely to be significant. The Bayesian update reported in Table of the PSA was performed for a period of 11.5 years. This is conservative since the operating period is 14.5 years. In addition, the 1 fire that has occured in the turbine building happened during the pre-operational phase and need not have been included in the Bayesian update. Both of these points are conservative but whould not have a significant effect on the posterior fire frequencies used in the analysis. The location of major equipment is often relatively easy to identify from plant layout drawings and plant walk-through. However, power and control cable routing can be difficult to trace without detailed documentation, as in the case for non-susan plant. In the MUSA study, for non-susan plant it was often necessary to make assumptions about the potential routing of many PSA component power and control cables. When possible these assumptions were made using guidance from KKM electrical engineering staff. This has its limitations, but in the circumstances is the only realistic approach available. The identification of cable routes appears to have been performed well in the circumstances but there can be no guarantee that the correct routes have been established. The propagation paths for fire between different areas were established using the decision trees presented in Figures to of the MUSA report. The propagation of fires is considered through open doors, equipment hatches, HVAC ducts, and walls. No decision tree is given for the propagation of fire through cable penetrations, which do not appear to be considered in the PSA. However on the plant walk-down by the IAEA review team no cable penetrations in poor condition were observed. The propagation of fire through cable penetrations should have been considered in the PSA. It is not clear from the PSA documentation whether fire propagation to more than one adjacent area has been considered. An example of this is provided by the different propagation scenarios considered for the 380 V switchgear room (B161). Whilst several scenarios involving the propagation of fire to single adjacent areas are considered, no scenarios are described in which the fire might propagate to two or more adjacent areas. This is not usually a significant issue if fire area boundaries coincide with 3 hr rated walls floors and ceilings, including appropriately rated barrier elements (doors, dampers etc.). However in the MUSA study it is understood that, in some cases, non rated structures

14 are credited as fire area boundaries. Some fire area boundaries also include openings. In these circumstances fire propagation to more than one area should be considered. The results of screening on frequency for single areas is presented in the MUSA report in Tables and Table A total of 44 areas exceed the screening criteria of 1 x These areas are then screened on equipment inventory, which results in a reduction to 19 for the single areas requiring detailed analysis. However, some of the areas retained after the frequency screening and identified in Appendix F of the MUSA report as requiring detailed analysis are not carried over into the detailed analysis. An example of this is given by area P1 (Pump House) which has a frequency greater than 1x10-6 (Table 9.4-1) and according to Appendix F requires additional analysis, yet is not carried over into the detailed analysis (Table ). This is also found for the following areas: G1 M23 M6 M7 M35 Waste Gas Treatment Plant Diesel Generator Room Turbine Generator Room В Turbine Generator Room A Feed Pump Level In addition to this several of the areas are not included in Appendix F, and it is not clear that they would not be required for detailed analysis. Among the areas not covered by Appendix F are B229, R11, B151 and M11. The reasons for areas G1, M23, Мб, M7 and M35 not being included in the detailed analysis should be determined. In addition the reason for areas B229, R11, B151 and M11 not being included in Appendix F should be found and if necessary any additional analysis performed. The results of screening on frequency the scenarios for propagating fires are not documented in the MUSA report (i.e. there is no equivalent to Table 9.4-1), hence it is not possible consider these in detail. They should however be checked to ensure that all the relevant scenarios are carried over into the detailed analysis. The value of 1 x 10-6 used as the cut-off in the screening on frequency may not be low enough to ensure that significant scenarios are not missed in terms of the core damage frequency due to fire (7.2 x 10-7). Once the CDF had been established it would have been good practice to go back and demonstrate that those scenarios which are close to 1 x 10-6 do not contribute significantly to the core damage frequency Recommendations The reasons for some scenarios not being screened out and not being considered for detailed analysis should be established.

15 Analysis should consider the potential for fire propagation to more than one adjacent area, given that fire area boundaries in the MUSA study are not necessarily fire rated and contain openings. It should be demonstrated that scenarios which are close to the cut-off screening frequency are not significant contributors to the core damage frequency. 3.2 Detailed Analysis of Fire Scenarios The purpose of the detailed analysis is to reduce the conservative assumptions made in the screening analysis in order to develop a more realistic estimate of the risk. The review of the detailed fire analysis is considered in two parts; first the appropriateness of general methodology and input data used, and second the application of the methodology to various fire scenarios. The latter was aided by a limited plant walkdown Review of the Methodology and Input Data The detailed analysis methodology is described briefly in Section 10.3 of the MUSA PSA and more explicitly in a supplementary document prepared by Dr. A. Torri (see Appendix A). In summary, the steps involved in the approach are as follows: 1. Identify important fire scenarios that may be initiated within a given fire area. In principle this step may consider individual fire locations and subsequent propagation to different levels of plant damage. However in practice representative fire scenarios were modelled and only the worst case impact addressed, based on general separation of redundant trains. This approach is acceptable providing the basis (i.e. equipment, cable configuration) is documented, which is not done consistantly in the MUSA. 2. Determine the frequency of the fire scenario leading to particular plant damage state based on the following relationship: 0x = (*z)x(fg)x(fs)x(fns)x(qx) where Xz = is the frequency of fire in the fire area Fg = fraction of those fires that are initiated in a specific location of the area (i.e. that are capable of causing the specific scenario being analyzed).

16 Fs = fraction of those fires initiated in the location that have an initial severity sufficiently great to potentially damage the critical components (severity factor). Fns = fraction of scenario fires that are not suppressed before component damage (non suppression factor). Qx = conditional frequency of reaching plant damage state x due to failure of equipment exposed to the fire scenario. It should be noted that while the MUSA study, Section , defines (Fs) and (FNS) as separate factors, the non suppression factor (Fns) is excluded from actual analysis reported in Appendix G and from the supplementary methodology write-up referred to earlier. In discussion with project personnel it was suggested that the suppression factor may be in fact already included within the fire severity factor (Fs) as derived from Figure of the MUSA study and thus no explicit consideration is necessary. However this could not be confirmed. For scenarios which include the propagation of fire from one area to another the likelihood of fire barrier element failures (e.g. open door, HVAC fire damper fails to close) are also factored in. 3. The final steps involve; selection of fire scenarios for propogation through the plant model based on frequency / impact considerations, assignment of uncertainty distributions, etc to fire frequencies, geometric and severity factors and final quantification of the contribution of each fire scenario to the plant damage state frequencies. The basic steps outlined in the methodology proposed for the study are consistent with those typically used in state of the art published fire PSA's to date (e.g. Seabrook, Limerick, South Texas, NUREG- 1150). However, there are several aspects associated with the proposed method of implementing those steps which appear to be deficient in that they are incapable of providing a realistic measure of the fire risk in specific fire areas at Mühleberg NPP. There are also several fire safety issues, previously unaddressed in published fire PRA's, which have been shown to be potentially significant to risk (NUREG/CR-5088, Jan. 1988). (a) Seismic fire interactions - potential for seismically induced fires and fire suppression system actuations and failures. (b) Manual fire fighting effectiveness - large plant to plant variability regarding training of personnel and area to area variability regarding manual response times for fire suppression. Also potential for damage due to manual suppression.

17 (c) Total environment equipment survival - concerns are related to combustion products (smoke, high humidity), spurious actuation of suppression, and ability of operators to perform remote shutdown actions. (d) Adequacy of fire barriers - concern is primarily proper installation, testing and inspection of fire barrier elements (dampers, seals and doors). (e) Adequacy of analytical tools - concern is problems with earlier versions of COMPBRN fire code (I, II and III). NRC will accept COMPBRN HIE. (f) Control systems interaction - concern is for physical dependence between control room and remote shutdown panels. In some cases it is unclear to what extent these issues have been addressed, for example, smoke damage and adequacy of analytical tools. In other cases it is clear that the issue has not been addressed, for example, damage due to suppression activities and plant/area specific mannual fire fighting effectiveness. Each aspect of the analysis performed and its associated input data is discussed below. Fire frequency (Xz) The total fire frequency for each fire area is taken from the analysis performed in the screening analysis in which the buidling fire frequency is distributed according to the type and quantity of hardware located in the area or the relative size and traffic flow of the fire area. While the intended methodology for the detailed analysis (described in Appendix A) indicates that fires associated with individual types of fire (e.g. cable, equipment, transient combustible) are considered separately, this approach has not been implemented in practice. Rather only the total fire frequency has been considered regardless of the specific fire source and distributed over the fire area according to a geometric factor (Fq) discussed below. This approach is clearly inappropriate and may be either very conservative or very non conservative, depending upon the actual location of specific fire source in relationship to the target equipment or cables being considered. Clearly the method intended in the methodology is preferred and would lead to the most realistic results. Furthermore the information already developed in the spread sheet (Table 9.3.3) would easily facilitate this approach. With regard to self ignited cable tray fires, the frequency of ignition is dependent upon the type of insulation, the degree of overating, the reliability of over current protection provided, the inclusion and type of splices permittet in the raceways. In previous studies (Limerick NUREG/CR-4230) a factor of

18 reduction has been applied for IEEE qualified cables with overcurrent protection and exclusion of splices. In the FIVE methodology and NUREG-1150 self ignited cable fires are not included. Geometry Factor (FG) The general intent of the geometry factor is clear, in that it represents the fraction of fires in fire area. which are located in the vicinity of critical equipment (as defined by the fire scenario) and are thus capable of causing the specific equipment damage state being evaluated. There is, however, a strong coupling between the geometry factor and the severity factor. That is the more severe a fire becomes, the greater the range over which it will impact equipment and the less specific the required location of the fire becomes (i.e. the geometry factor is a function of the severity factor). It was clear that project personnel were well aware of this issue but it is not evident from the documentation of the methodology how the fire analyses have in any way taken this into account. Furthermore in some cases the analysts appear to have chosen an optimistic approach in defining the area of concern in asssuming that it is limited to the area occupied by the critical equipment (see later). The intended definition of the geometric factor given in the methodology supplement (Appendix A) is unclear. Initially the geometric factor is referred so as the ratio of the area of interest for the fire, to the total area within which fires can originate, and that the latter is usually the entire room area (although it could be a subarea). An example is provided for cable fires in which (FG) is the ratio of a cable tray junction of interest to the total area of the cable trays within the room. However, in the implementation of the fire analysis, as discussed in Appendix G of MUSA, the geometric factor for a cable tray junction in area B139 is defined as the ratio of the subarea comprising the junction (0.86 m2), to the entire floor area of the room (227 m2). This yields on FG of (note that if the cable tray area rather than the entire floor area was used as the denominator the value of FG could easily be5-10x higher). Furthermore in selecting the area of the junction as the numerator for evaluating (FG) it is implied that only fires which originate in cables at the junction can result in the damage state, whereas in fact fires which originate in surrounding cable trays or cabinets or transient combustibles may also result in critical equipment damage. This again can lead to an underestimation of the geometry factor. In conclusion, while the principle behind the incorporation of some geometric factor into the detailed modeling is sound, the definition of the term as applied in the MUSA study is lacking a physical basis and may lead to optimistic results (or very conservative). The more appropriate means of developing geometric factors would be to: 1. Consider individual types of fire source separately (as presumably intended in the methodology document).

19 Develop geometric factors for each type of combustible which determine the fraction of fires that may impact a given target (i.e. occur in the zone of influence). This can be done conservatively by assuming fire sources in a wide area around the critical location are included. The maximum zone of influence of a fire may be determined from COMPBRN. Alternatively a less conservative approach can be adopted by evaluating a geometry factor for different fire severities. It is reasonable to assume that the fraction of cable fires which occur in a given cable tray Section or electrical panel is the ratio of the area of the cable tray Section or panel to the overal area of that type of equipment located in the area. Transient combustible fires may be distributed uniformily over the unoccupied floor area. Unless there is some reason to suspect they may be stored in some particular location. Severity factor (Fs) The severity factor (Fs) represents the fraction of fires which exceed a size required to impact the critical equipment designated the fire scenario, given that the fire initiates within a specific location used earlier to determine the geometry factor. In the MUSA study the fire analysts have relied heavily on a set of generic curves (Figure ) which according to Appendix A define the probability of a fire growing to a particular size before being extinguished. A separate curve is provided for high voltage, low voltage and mechanical equipment fires. These curves are based on COMPBRN runs performed during the course of previous PLG studies as well as actual fire incident observations. It is also stated that the analyst may have to use other methods including judgment to determine the severity of the fire. No documentation which provides a basis for the generic curves or the analysis judgement is given. Rather the user or reviewer of the study is asked to accept the results on the basis of trust. On the basis of the information provided it is impossible to determine the validity of the curves and their applicability to the specific situations being modelled at Mühleberg. Furthermore, it is uncertain whether the analyst selected a particular severity curve to use on the basis of the type of combustible in which fire ignites, as inferred by the methodology in Appendix A, or on the basis of the nature of the target being exposed. The latter may be more consistent with the PLG approach in other published studies. However, regardless of the precise meaning of the curves, what can be said is that it is highly doubtful that this one set of curves can be representative (or necessarily conservative) for all possible situations for the following reasons: 1. The rate at which a fire develops is highly dependent upon the properties and configuration of the combustible material. For example the rate of growth of a transient oil, solvent or trash fire are obviously much greater than for cable insulation fires. There are also significant differences in the heat of combustion, auto ignition temperatures and mass loss rates and damage

20 temperatures/energies associated with different cable insulation types. That is cable insulation which has an IEEE 383 or equivalent qualification is generally burns slower and can absorb more energy before damage occurs than non qualified cable. A comparison is provided in NUREG/CR At Mühleberg it is understood that the original plant cable was not qualified whereas all SUSAN and replacement cables are qualified. It should also be noted that fires in vertical trays grow faster than those in horizontal trays. 2. The effects of the enclosure also have a significant effect ori the rate of fire growth. COMPBRN runs show that fires ignited in the proximity of wall and especially corners of rooms develop faster. The smaller enclosures may also result in damage to cable or equipment which are widely separated due to the formation of hot gas layers of sufficient temperature and thickness. 3. Fire detection and suppression prior to critical equipment damage depends on the specific type of detection installed, whether suppression systems are automatic or manual, and the ease of access to the particular fire location. 4. The range over which a fire may cause damage is dependent upon the specific fragility of the target component. For example the typical threshold temperature for cable damage is 350 C whereas the corresponding temperature for electrical components may be C. It is recommended that HSK first of all attempt to obtain from PLG and review the basis for the generic fire severity curves. If this is unsuccessful or the basis cannot be verified, fire propagation and suppression models should be developed for specific fire scenarios in a similar manner to that performed in other state of the art fire PSAs, such as those mentioned earlier. In such cases the effects of smoke damage on susceptible equipment should also be considered (note also that the possible adverse effects of suppression activities on working equipment in the vicinity of the fires as well as other issues discussed earlier will have to be addressed in future fire PSAs performed in the US according to the IPEEE guidelines) Analysis of Specific Fire Scenarios A limited plant walk down of the areas in which there are important fire scenarios was performed. These areas included: 1) the 380 V switchgear area (B161) 2) the reactor building (RB6, RB7, RB8) 3) the control cabinet area (B139) 4) the control cabinet area (B140) 5) the 24 V switchgear room (B194)

21 The most important fire scenarios associated with the first three areas, developed in MUSA, are evaluated with insights gained from the walk down. 380 V switchgear area (B161) This area contains the most significant fire scenario with respect to core damage frequency (2.1 x 10*7 per year). The worst case fire scenario postulated (see Appendix G of MUSA report) is a fire which would destroy both trains of non-susan switchgear leaving only the SUSAN system undamaged for accident mitigation. In order to do this it is stated that the fire must propagate along the length of one train of switchgear (a distance of 16 m) and then across the floor area of approximately 1.2 m to reach the alternate train at which point it would propagate down along that train for another 16 m. A geometric factor of 0.35 (А^г/Ав^) and a severity factor of 0.05 (from generic curve) are assigned. An inspection of the room revealed the following: 1. There are currently no fire detectors installed in the area. 2. All critical equipment associated with the scenario may be impacted by a fire located in the switchgear itself or in isle between the switchgear having a fire damage radius of perhaps 3 m. 3. Significant amounts of transients fuel, including a wooden bench, numerous plastic boxes containing plastic sheets and paper material. 4. The room is relatively small (6.5 m x 24 m) and forced ventilation only operates if needed during hot weather. The first comment is that it is difficult to conclude that the fire scenario described in the study is representative of the fire risk in this area, given the arrangement of equipment. A fire which originates in the central portion of the switchgear (train A or B) and grows to damage other switchgear within about a 3 m radius would be much more appropriate. For fires which only have a 3 m severity approximately one third of the switchgear related fires may cause the postulated damage and therefore, on this basis, the geometry factor (.35) used is reasonable. (Note, however, that this is a coincidence since a totally different method was used to derive the value). Of course this does not account for those fires which have a significantly greater severity.

22 - 2Í - Second, the current lack of fire detectors in the area substantially reduces the liklihood of an early response to extinguish the fire. The first indication of fire may in fact be when operators in the control room begin to see equipment failures. The severity factor may therefore be severly underestimated. Third, the presence of a significant amount of readily ignitable transient material may indicate that the assessment of the human initiated fire frequency for this area is underestimated. Two things should be mentioned here; (1) at least some of the materials found in the switchgear room appeared to be permanently stored in this location, and (2) transient combustible materials were not found in any other of the plant areas visited. Finally, the relatively small size of the room, the lack of forced ventilation, the presence of transient fuels and the sensitivity of the installed hardware to temperature and combustion products, make fire damage due to hot gases and smoke a possibility which must be addressed explicitly. Furthermore, since the redundant switchgear is in close proximity, damage caused by suppression activities should also be considered. Each of these factors is made even more important when the lack of a means of early detection is considered. In conclusion, the current analysis seems to lack a physical basis in terms of the fire scenario which has been evaluated and does not address all of the fire damage mechanisms which are appropriate for this type of area. The current arrangement in the switchgear room may render the actual risk a factor of say 10 higher than the present estimate. However, some fairly simple fixes (completion of fire detector installations and removal of transient materials) are possible which would reduce the risk. Reactor Building (RB6, RB7 etc.) RB6 is the first level in the Reactor Building and contains equipment and cable associated with all SUSAN and non-susan equipment with exception of feedwater. In the event all equipment is lost in this area (scenario RB6FS1) accident mitigation would rely on high pressure feedwater makeup to the vessel with blowdown to the suppression pool via the SRVs. Ultimately the wetwell would be vented to relieve pressure and heat, although this would not be required for many hours. RB7 is the second level in the Reactor Building. The most important fire scneario postulated (RB7FS2) is the propogation of the fire from RB7 to RB6. The fire scenarios are not well defined in the MUSA, in terms of the ignition sources or the target equipment or cables. Neither is the general separation and layout of redundant cable and equipment. No precise basis for the geometry or severity factors is provided.

23 For RB6FS1, Fg =.25 and Fs =.05 For RB7FS2, FG = 1 and Fs =.1 An inspection of this area revealed the following: 1. The most significant fire source in RB6 appears to be the lube oil associated with the RCIC system turbine driven pumps. However automatic fire suppression coverage of these sources is provided. Spread of oil pools is limited by drainage channels in the floor. 2. The only other combustibles observed in the areas (RB6 or RB7) were cable insulations although the loading is minimal and there is no obvious fire propagation pathway from one location in the fire area to another. 3. Each of the reactor building fire areas cover the entire annulus around the drywell (at different elevation) and there are open connections between these areas. 4. Cables associated with SUSAN and non-susan equipment enter the reactor building on opposite sides and are mutually separated both horizontally and vertically. Train A and train В are routed in opposite directions around the perimeter. Even in cases where redundant trains come within relatively close proximity (several meters) not all equipment would be effected by a fire in such location. In conclusion, based on the lack of combustible continuity, the massive size of the area and the high degree of separation of redundant trains, the fire risk predicted for these areas in the study is probably overestimated. While this may be the case, this conclusion cannot be drawn from the documentation provided in the study. Again it is recommended that a model be developed (or documented) which has some physical basis in terms of the ignition source and target equipment and cable. B139 Control Cabinet Area The most important scenario is B139FS1, which appears to be subdivided as follows: The first scenario in this area is a fire scenario which damages train A and В cable trays which support all non-susan equipment. In this case values of FG =.004 and Fs =.71 are assigned.

24 The issues relating to the evaluation of the geometry factor for this scenario have been discussed earlier. In evaluating the severity factor the presence of a fire barrier at the crossover between train A and В is mentioned. In fact this did not appear to be a fire rated barrier as such, but rather a coating to prevent flame spread. Since a value for FS of.71 is applied this does not have any serious numerical implication although it should be checked and corrected as necessary. A second scenario involving loss of (at least) one train of cableway or cabinets is also described in Appendix G. In this case the propogation distance being considered is 3m, but exactly which fire is propgating, and where to, is not disclosed. In conclusion, the method for evaluating the geometry factor for the train A to В crossover appears to be suspect and may be highly optimistic. The second fire scenario needs much clearer definition and appropriate modelling. Finally, given that control cabinets are located in this area the possibility of smoke and suppression damage should be addressed explicitly.

25 APPENDIX A THE MUSA FIRE ANALYSIS: A STEP BY STEP DESCRIPTION OF THE METHODOLOGY AND PROCEDURE A. TORRI RISK AND SAFETY ENGINEERING OCTOBER 1991 I. INTRODUCTION The review of the MUSA fire analysis by the HSK and their consultants has lead to the conclusion that the fire analysis procedure employed in MUSA can not be followed through all the steps, and that a step by step description of the methodology employed would be useful. This is provided in this document, with the expectation that it would complement the MUSA documentation and allow the HSK to perform a more complete review. A fire PSA proceeds in three basic phases. In the first phase, fire zones are defined as locations, within which fires can occur that affect safety related equipment, and where provisions are made to limit the propagation of fires into the room from the outside as well as propagation from inside the room to the outside. Thus, the fire zones for a PSA normally coincide with physical rooms bounded by fire rated walls. For each of these four zones or locations the inventory of PSA significant equipment must be established. In the second phase the many potential fire zones are screened both with respect to the potential frequency of fires and with respect to the impact on safety from the loss of all equipment in the location. This phase results in a reduced set of significant fire locations. In the third phase, these potentially significant fire locations are analyzed in more detail and with less conservatism, to obtain as realistic an assessment of the risk significant fires as is necessary. Each of these three phases is discussed in the following sections by providing a step by step description of the progression of a fire analysis according to the methodology used in MUSA. 1

26 II. DEVELOP LOCATION INVENTORY LISTS 1. Establish MUSA Equipment List: The first step in the fire analysis involves the definition of the equipment list. Every piece of hardware modelled in the system analyses in Sections 6 and 7 of the MUSA report is listed. Every hardware item and the power and control cables to and from the item must be tracked by the fire analysis, since its availability can be affected by a fire. This task is performed by the system analysis task leader. The MUSA equipment list is given in Table Establish Plant Locations and Location Designator Plan: In the second step, all plant locations and rooms in buildings containing PSA equipment are identified and a fire location designator plan is developed. Subsequently, fires are identified by their location designator. The MUSA fire location designator plan is given in Figure It is based, whenever possible, on the existing room designators at the plant. 3. Assign Components to Locations: Each component in thè MUSA equipment list is assigned to its location. The locations identified by these components constitute the end points of cables routed between components. Appendix E lists for each location all the equipment contained in it. (Note that the cables in a given location are also listed in these tables. These are discussed in Item II.5) 4. Develop Location Strings: For each component the power and control cables connecting to it are traced back to their source component, which is listed in the equipment list. The string of locations through which the cable is routed is called the cable location string or the cable routing. These are given in Table Depending on the details contained in the plant drawings and documentation, these cable routing location strings are sometimes difficult to establish precisely, and the exact routing by cable tray is even more difficult to establish. Therefore, this task relies on information from the plant staff and sometimes on estimates based on the shortest routing between the source location and the terminal location that is consistent with the design principles for cable separation during construction. 5. List Components and Cables in a Location: From the cable routing location strings (Tables 9.2-2) the power and control cables contained in each location are added to the location inventory tables in Appendix E. This 2