ITER Fire Safety Approach

Transcription

1 IDM UID 25SDBD VERSION CREATED ON / VERSION / STATUS 28 Jul 2010 / 3.1/ APPROVED EXTERNAL REFERENCE Guideline/ Handbook (non-baseline document) ITER Fire Safety Approach This document provides a summary of the ITER safety approach for fire. Fire protection has the following objectives: to prevent fire and fire damage that could lead to the release of radioactive or dangerous material to the environment, to limit releases within acceptable limits, to ensure personnel safety, to limit damage to the machine and property (investment protection). This document focuses on the first three of these objectives. PDF generated on 13-Sep-2010

2 ITER Fire Safety Approach Contents 1. Introduction: Objectives and Scope General Fire Protection Requirements Fire Prevention Fire Detection Fire Suppression Mitigation to Prevent Spread and Limit Consequences of Fire Fire Hazard Assessment...10 Annex A - Definitions...14 Annex B - Fire sectors...15 Annex C - Integrated approach to confinement and fire protection...17 Annex D - Guidance on control of combustibles during design...18 Annex E - Guidance on fire detection and alarms...21 Annex F - Guidance on fire suppression Annex G - Guidance on fire mitigation in design...26 G.1 Layout...26 G.2 Ventilation systems...26 G.3 Fire venting...27 G.4 Electrical systems...27 G.5 Special location requirements...28 G.6 Fires of external origin...29 G.7 Secondary effects of fires and extinguishing systems...30 G.8 Safety Important Systems, Structures and Components...31 Annex H - Bibliography...32 Preface This abstract documents the concept of fire protection being applied in the design of ITER as of July 2010 to be consistent with the approach developed in the preliminary safety report (Rapport Préliminaire de Sûreté RPrS), mainly chapters on fire protection, on fire zoning and on internal risks. Future updates may be considered if the ITER fire protection approach changes significantly. This abstract is based on a previous draft document titled, ITER Design Guide for Fire Safety, dated June 2004 and updated in May ITER Fire Safety Approach Page 1 of 35

3 Revision Record Changes and revisions Major Changes # When What Why 1 October 2007 Initial Issue. Abstract of G 81 MD W0.1 to provide summary of current approach to fire safety. Provide an abbreviated summary document. 2 May 2008 Updated sectoring and zoning information. Edited for clarity. Clearly reflect current sectoring and zoning approach and provide information consistent with the Rapport Préliminaire de Sûreté (RPrS). 3 July 2010 Major changes to incorporate RPrS strategy Consistency with RPrS as submitted in March ITER Fire Safety Approach Page 2 of 35

4 1. Introduction: Objectives and Scope A fire is a chemical reaction, started by an ignition source, that consumes fuel and oxygen and produces heat and light; if this chemical reaction is stopped the fire tetrahedron (presence of fuel, oxidant, ignition source and exothermal chemical chain reaction) is broken. A fire can cause the degradation of systems contributing to safety functions, including the degradation of confinement systems, resulting in the release and spreading of toxic products, and the risk of internal and external exposure. This abstract describes the concept of fire protection applied in the design of ITER. These measures are compliant with applicable French legislation, namely the enactment of 31 December 1999 amended by the enactment of 31 January 2006 [Order 1999], as well as DGSNR guideline 7/01 concerning the prevention, detection and propagation of fire [DGSNR guidelines]. Definitions are provided in Annex A. 2. General Fire Protection Requirements Fire protection for the ITER site has the following objectives: To prevent fire and fire damage that could lead to the release of radioactive or other hazardous material to the environment, To limit releases in the case of postulated fires to within acceptable limits, To ensure personnel safety, To limit damage to the machine and property (investment protection). It must be possible to maintain ITER in a safe condition during and following a fire, based on the following principles: For each radioactive inventory, at least one confinement system will remain intact, An adequate degree of fire protection is provided by a "defence in depth" concept in the design: Preventive measures which aim to avoid or limit the occurrence of the four prerequisite conditions (fire tetrahedron) for a fire to occur, Fire detection measures suited for the type of fire considered, Reduction measures, intended to: Limit or prevent fire propagation, particularly through adequate zoning of buildings and appropriate routing of ventilation and detritiation systems, Ensure the integrity of SIC systems and components, and their associated safety functions (e.g. confinement, radiation protection), particularly through design, e.g. separation of redundant equipment into different fire sectors, fire-fighting and personnel protection measures, Ensure personnel evacuation by means of emergency exit routes throughout the facility, accessible from every room within a time and distance in accordance with the applicable regulations. The evacuation routes include fire protected corridors and staircases. ITER Fire Safety Approach Page 3 of 35

5 Moreover: To the extent practicable, Fire Sectors shall be established in order to limit the risks associated with fires (See Annex B). The sectors shall be established taking into account: Fire loading (as low as practicable), Fire resistance (twice the related fire loading and at least 2 hours), Ignition sources, Equipment, Inventory at risk. Fire sector inventories at risk shall be as low as practicable. In a fire sector where the impact of a potential release represents a significant fraction of the project safety objective, additional controls shall be established to limit fire risk. These additional controls may include: precluding ignition sources, and/or further restricting fire loading and/or increasing fire resistance. For a specified time period, fire sectorization prevents the propagation of a fire or the effects of a fire from one sector to another. This is achieved by maintaining the fire resistance of the boundary of the sector during postulated fires which could occur on either side of the boundary. The fire load is controlled in order to ensure that the duration of the fire will not exceed the duration specified for the fire sector walls or boundaries. These functions are accomplished through a combination of design features, procedural controls, and automatic or manual response actions. Fire hazard analysis consists of the identification of fire hazards in the different rooms of the building. For each room, the fire hazards are analyzed and measures are implemented as necessary to reduce the likelihood, duration and consequence of a fire. A postulated fire in the building will not lead to the loss of safety function or radiological consequences exceeding acceptable limits. Detritiation and depression function will remain operational in case of fire to ensure confinement of tritium. Releases could most significantly occur upon breach of confinement barriers; hence, protection of confinement is needed, and the following functions need to be evaluated considering the safety characteristics of ITER: Control coolant enthalpy to prevent damage to barriers from overpressure or underpressure. Control chemical energy to avoid energy release and pressurization threats to confinement barriers. Heat removal to protect against mobilization (e.g. by evaporation or melting) of hazardous materials and damage to confinement barriers. Control magnetic energy to avoid damage to confinement barriers from electric arcs, pressurization by cryogens, or mechanical impact in the event of failures. Provide required auxiliary services to achieve the above. Provide reliable information on all operational events and accidents, and for monitoring the performance of the confinement, and its protection during accidents. ITER Fire Safety Approach Page 4 of 35

6 Safety requirements and Safety Importance Class (SIC) systems to achieve this for ITER are elaborated in the Project Requirements document [PR] and the criteria and methodology is described in [SIC guidelines] and in RPrS chapter 1-10 [RPrS 1-10]. The following key assumptions have been made for the design and will be confirmed by the outcome of the ITER fire hazard assessment (Section 7): The secondary confinement system is the final barrier to environmental release, therefore to provide defence in depth, the primary confinement system shall be designed such that at least one primary confinement barrier provides its confinement function in all conditions within the design basis. Exceptions may be considered individually. Fire barriers, including ventilation system valves and dampers are designed to ensure functioning for isolation, smoke control, detritiation, etc. Design should provide a confinement efficiency greater than or equal to 90% during and after a fire. A fire does not occur simultaneously with another independent initiating event (consequential damage and consequential fires are to be addressed). These key assumptions are consistent with the project integrated confinement and fire protection approach described in Annex C. 3. Fire Prevention The design and operation of ITER shall limit the likelihood of a fire. The main preventive measures taken with regard to the risk of internal fire are described in Annex D. Some of them are given in this section: The quantity of combustible materials and loads in each room or area is limited to minimum process requirements by using non-combustible or non-flammable materials whenever possible (M0 or M1 materials, C1 cables, etc) in buildings with radioactive inventories, Halogen-containing products are prohibited as they reduce the efficiency of the detritiation systems, The use and installation of combustible materials in rooms containing SIC components (or adjacent rooms) are optimized, particularly by: Separating or increasing the distance between potential fire sources and SIC components or systems, Protecting SIC components (diesel generators, cables, electrical panels, etc.) against the effects of a fire, by separation, minimizing fire loads, etc., Basing the design and construction of the facilities as far as possible on rules that prevent fires caused by the use or malfunction of equipment, Operations with a risk of fire (e.g. cutting, welding, etc.) require specific permits and associated protection measures, particularly in rooms with confinement systems, The on-site use and storage of combustible materials in areas adjacent to or containing SIC items will be controlled and accounted for and kept to a practicable minimum; combustible materials not required to be immediately available for operational purposes will not be stored close to SIC items, ITER Fire Safety Approach Page 5 of 35

7 Gloveboxes will be inerted in tritium facilities or when the process includes flammable materials, Areas with a hot spot (such as cutting for example) are inerted with a non-reacting (e.g. nitrogen) gas. 4. Fire Detection The design and operation of the ITER Project shall ensure early detection. Each fire and/or confinement sector is equipped with a fire detection and alarm system specifically engineered and selected for fire risks in that area. The fire detection and suppression systems operate during all modes of operation of ITER. In the event of a fire, the following actions are initiated by the fire protection system and the detritiation system: All personnel are evacuated as soon as the fire detection is activated - this detection and alarm function will be provided by smoke/heat detectors; in areas of the facility where there is inert gas purging provided, (e.g. gloveboxes within the Tritium Building, certain hot cells), evacuation will be initiated by elevated oxygen levels in the enclosures or loss of inertization, The HVAC supply to the fire sector is isolated, The isolation of HVAC and the switch over to the detritiation system is automatic if the contamination is higher than the action level and the detritiation system takes over the function of maintaining the area concerned in depression. The isolation of HVAC and the switch over to the detritiation system to keep the area concerned in depression can also be done manually on the decision of the operator if the action level is not reached (and thus the isolation of HVAC and the start up of the detritiation system are not done automatically) The detection system annunciates by audible and visual alarms in the control room. Local audible and visual alarms, as appropriate, are also provided in areas normally manned at other specific locations. Fire, loss of the inert gas system and elevated oxygen level alarms are distinctive and cannot be confused with any other plant alarms. For the purpose of providing a warning to personnel who may enter or who may be working in an area equipped with potentially hazardous materials, automatic fire extinguishing systems and suitable audible and visual alarms are provided within, and at each entrance, to each area normally occupied by personnel. In addition, adequate written procedures are provided to ensure the safety of personnel entering such areas. The detection and alarm system is energized at all times. It is capable of being energized by the non-interruptible emergency power supplies, so that in the event of loss of normal power, it will still provide early warning of a fire or, for areas of the facility where there is inert gas purging provided, (e.g. gloveboxes within the Tritium Building, certain hot cells), elevated oxygen levels within the enclosures. The fire protection system is comprised of normal detection systems and detection systems classified as SIC equipment in the zones with a significant tritium inventory as well as in the ITER Fire Safety Approach Page 6 of 35

8 zones containing components or systems classified as important for safety. If necessary certain fire fighting equipment is controlled and activated by the detection systems. Where spurious operation is detrimental to the plant, operation is activated by two lines of redundant detection (2 out of 3 logic). The fire detection systems initiate the transition to a safe state of the ventilation system through the Central Safety System (CSS): for example from smoke detectors which through the CSS close the entry ducts of HVAC or from a high temperature sensor which closes the isolation valves of the HVAC through the CSS. Further guidance on fire detection systems is provided in Annex E. 5. Fire Suppression The design and operation of the ITER Project shall ensure early suppression of fires by automatic and/or manual fire fighting and containment techniques. Fire suppression systems shall be designed and located to ensure that their operation, rupture, or spurious or inadvertent actuation does not impair the capability of SIC items. Potential for errors in operating extinguishing systems should be considered in the design. Consideration should also be given to the effects of operation of suppression systems in adjacent areas. In the design of fire suppression systems, events which could credibly occur simultaneously and independently of a fire shall be considered. For example, consideration should be given to the effects of SIC system maintenance outages, and the single failure criterion. The type of extinguishing system is adapted to the type of fire identified in the particular room considered. Consideration is given to speed of operation, the type of combustible material present, the possibility of thermal shock, the impact on room pressure, the potential for spread of contamination, the potential for developing and managing waste and the consequences on human beings (e.g. asphyxiation) and on items important to safety. Fixed and mobile extinguishing systems are installed according to room accessibility. In addition, fixed systems are installed near to potentially vulnerable items of plant and equipment (e.g. inerted gloveboxes in the Tritium Building) to provide an additional line of defence against the spread of fire to systems containing tritium. A fire extinguishing system is installed in all zones which have a significant fire risk as well as zones containing SIC systems or components. The system is automatic for rooms with a large radioactive inventory. Access for fire fighting personnel is available in case of fire whenever possible or remote fire extinguishing devices will be operable from outside the room. Egress routes and emergency exits allow safe personnel evacuation. Ventilation ensures smoke free evacuation routes providing pressurization in emergency exits, when appropriate. Auxiliary equipment for fire extinguishing is provided in the form of: ITER Fire Safety Approach Page 7 of 35

9 Suitable fixed emergency lighting at appropriate locations and portable lighting, as appropriate, is provided for all fire sectors, A fixed wired emergency communication system with a reliable power supply is installed at pre-selected stations, Alternative communication equipment such as two-way radios is provided in the control room and at selected locations throughout the plant, Self-contained breathing apparatus is available for the immediate action fire fighting team and is positioned at appropriate locations. The Fire Protection Water System (FPWS) supplies and distributes water for the purpose of fire fighting. It is configured as two independent feeds, so that water can be delivered at any point by at least two independent means. Routing is such that leaks will not affect systems important to safety. Liquid effluents generated by fire extinguishing media are collected to prevent dispersion of radioactive and toxic material. Gas extinguisher systems are used in locations containing control cabinets and other electrical equipment where water may cause electrical short circuits and impair functionality. The use of fixed total-flooding gas extinguishing systems is generally confined to unmanned spaces. Where an automatic extinguishing system is selected, provisions are made for manual initiation and shutoff. Automatic fire extinguishing systems are employed where necessary in order to prevent the propagation of a fire. Examples of zones in which these systems are installed include: Zones containing redundant safety systems which cannot be physically separated, Zones with a high potential for the liberation of radioactive materials. Fire detection and suppression systems have been designed to comply with recognized international standards such as for example, IAEA 50-SG-D2 Fire protection in nuclear power plants and they conform to specific French regulations as mentioned in the following table: Description Insulated cables and flexible cords for installations. Halogen-free 0,6/1 kv cables with improved characteristics in the case of fire, type C1, with cross-linked synthetic insulation and with extruded synthetic protective sheath. French Standard NF C European Standard International Standard ITER Fire Safety Approach Page 8 of 35

10 Description Rubber insulated cables of rated voltages up to and including 450/750 V - Part 13 : single and multicore flexible cables, insulated and sheathed with cross linked polymer and having low emission of smoke and corrosive gases French Standard NF C European Standard HD22-13 International Standard Halogen free NF C EN50267 IEC Fire behaviour bunched cables NF C EN50266 IEC Further guidance on fire suppression systems are presented in Annex F. 6. Mitigation to Prevent Spread and Limit Consequences of Fire The mitigation measures associated with the risk of internal fire and intended to protect safety important components and prevent or limit fire propagation include: Measures taken in terms of layout and sectorization [RPrS 1-9.6] are intended to prevent the spread of fire or fire effects from one fire sector to another and causing the simultaneous loss of the redundant components of SIC systems and components providing a safety function. Redundant equipment of SIC systems and components are segregated and installed in different fire sectors, This is achieved by maintaining the fire resistance of the sector boundary against postulated fires that may occur on either side of the boundary. The main characteristics are as follows: Fire sectors prevent fire propagation to adjacent zones for a value of twice the fire loading and generally 2 hours in areas where radioactivity is present, The fire resistance of wall penetrations in fire sectors is equivalent to that of the corresponding walls, Specific measures (fire detection and suppression systems, sufficient distance with respect to SIC components) are implemented in fire sectors where the risk of fire propagation within the sector needs to be reduced, Fire sectors requiring fire suppression systems are equipped as far as possible with their own fire detection and suppression systems, and support systems such as smoke extractors, ventilation and drainage, Rooms containing electrical cut-off systems or significant quantities of electrical cables are separated from other equipment or are confined within fire sectors, Specific measures are implemented to prevent fire propagation via the vertical shafts, Electrical connections are segregated and independent. If necessary (due to space or functional constraints, e.g. in a control room, etc.), connections can be grouped together with appropriate measures. Potential sources of fire initiation and fire load should be located in separate fire sectors segregated where practical from SIC components and systems, ITER Fire Safety Approach Page 9 of 35

11 Electrical rooms allow access to fire suppression systems, In case of fire in the control room, the operators will place the plant in a safe state before evacuating the control room, and monitoring will be available at back-up control room located in Personnel Access Control Building, The measures taken to reduce the secondary effects of a fire in a fire sector (e.g. smoke, heat, overpressure, contamination transfer) are as follows: Fire sectors are isolated by fire dampers upon detection of a fire, Detritiation systems are implemented upon detection of unacceptable radioactivity levels, Ventilation and detritiation systems (depending upon location) remain operational during and after a fire to ensure smoke extraction and overpressure suppression, and confinement of radioactive materials (filters, etc.), with the efficiency of the detritiation system reduced to 90%. Ventilation and detritiation system filters are protected against fire by detection systems located in ventilation ducts, and by fire damper systems, Measures are taken to enable manual isolation of valves or fire dampers whenever necessary. Personnel protection measures include: Providing safe escape routes for personnel with permanent emergency lighting systems installed in emergency exits used for personnel evacuation, Staircases are free of combustible materials and provisions are taken to avoid smoke ingress and facilitate evacuation. Further guidance on fire sectorization is provided in Annex B and on fire mitigation in Annex G. A preliminary scheme for fire sectors is provided in the Rapport Préliminaire de Sûreté (RPrS) chapter on fire zoning [RPrS 1-9.6]. 7. Fire Hazard Assessment The fire risk analysis proceeds according to the following steps: Identification of rooms containing safety targets, defined as radioactive materials or SIC systems and components; Identification of rooms for further investigation, based on the coincidence of the above in the same or adjacent rooms; Characterization of the fire with the fire tetraedron approach: Combustible sources (fuel) ; Oxygen concentration (oxidant); Ignition sources (activation energy) ; Exothermic chemical chain reaction (activation energy); Identification of the potential consequences in case of fire growth inside the room and propagation outside; Analysis of fire development inside the room considering active and passive fire protection measures; Assessment of fire propagation outside the room; Assessment of fire consequences in terms of radiological or toxicological impact or unavailability of SIC components in order: To check the General Safety Principles [General Safety Principles]; ITER Fire Safety Approach Page 10 of 35

12 To demonstrate that safe conditions are ensured in the nuclear facility. At each step of the fire analysis, the lines of defence are identified and required measures identified. The majority of the most sensitive rooms are those where a safety target is located where fire cannot be ruled out due to the presence of substantial quantities of combustible materials together with the potential for ignition sources. Situations where a safety target and a significant fire load are located in adjacent rooms are also considered to be potentially sensitive if they could communicate via a door or similar penetration in the fire barrier. The critical rooms have been selected according to the following criteria: The room contains combustible materials and minima high fire loads, potential ignition sources and potential sources of oxygen, And one or more of: The room contains a SIC system, a SIC component or a component necessary for a system to fulfil a safety function that could be potentially a target in a fire, The room contains a large/significant radioactive material inventory that could be potentially mobilized in a fire, An adjacent room, to which a fire could propagate, contains SIC or radioactive material as above. The analysis of the critical rooms in the tokamak building, the tritium building, the hot cell facility, the radwaste facility and the diagnostic building is given in the RPrS on internal risks [RPrS 2-3.1]. For the same buildings the fire analysis with the ignition sources, the heat loads and the safety targets are also described. As buildings and their contents and operational plans evolve, systematic fire hazard assessments shall be undertaken, including: Fire hazard assessment of the ITER site. On the basis of this analysis, fire sectors can be confirmed, the magnitude and characteristics of their fire load determined, and choices made for the types of detectors and mitigation systems. Identification of potential fire situations. Study of potential fire impacts on SIC equipment. Changes in equipment layout or fire protection may be required to ensure releases are prevented. Study of emergency exit of personnel in case of fire. Study of access of incident response personnel in case of fire. Study of active fire-mitigation measures to check that they result in no significant adverse effect to personnel safety and environmental protection (and the protection of investment and the experimental program). Fault analysis of systems (e.g. fire detection and alarm, fire water, instrumentation and cabling). (1) Fire Scenario - Possible fire sources include batteries, motors, relay cabinets, and electrical switchboards or cubicles. For screening purposes, fire frequency for a scenario is neglected, and a representative fire scenario is postulated. ITER Fire Safety Approach Page 11 of 35

13 (2) Damage to Critical Equipment - The assessment of equipment damage typically involves: i. A prediction of the fire-induced environmental conditions based on fire loading; ii. iii. An assessment of the equipment response to these conditions; and An assessment of the likelihood that the fire will not be detected and suppressed (or self extinguish) before equipment damage occurs. Characterization of the fire-induced thermal environment requires the estimation of the timedependent temperature, pressure and heat fluxes in the neighbourhood of the SIC equipment of interest (i.e., the targets ). This requires the treatment of a variety of phenomena as the fire grows in size and severity, including the spread of fire over the initiating component (or fuel bed), the characteristics of the fire plume and ceiling jet, the spread of the fire to noncontiguous components, the development of a hot gas layer, and the propagation of the hot gas layer or fire to neighbouring sectors. This requires details of the amount, distribution and nature of combustibles in the area, the room geometry and location of targets, and ventilation design and operation. For a screening analyses for a given target, the worst case is adopted, in other words, the analysis focuses on the representative scenario for which damage of the target is the most probable. A representative fire scenario should be developed for each fire sector. Simplified screening criteria are used to determine if equipment fails for the representative fire scenario. Specific failure criteria for equipment should be developed. When component temperature criteria are used, conservative approaches (e.g., assuming the component is at the local environment air temperature) or simple heat transfer models (e.g., lumped capacitance models or one-dimensional transient heat radiation/conduction models) could be employed. Regarding the treatment of failure modes, fire-induced circuit failures that lead to loss of function and spurious actuation of plant equipment or to an alarm should be considered. Digital components may be more sensitive to environmental conditions than older relatively robust analogue electromechanical components used in the conventional plant instrumentation, which are considered less vulnerable to short-term smoke damage. Digital systems are considered vulnerable due to their closer spacing of electrical traces and contacts, the more precise performance demands of the devices, and the generally less robust nature of the individual components. In case of fire, one principal damage mechanism is exposure to smoke. Equipment (including cables) present in the fire sector should be assessed against these screening criteria assuming simultaneous exposure to temperature, smoke, etc. In screening analyses, it is assumed that for a fire barrier which has a resistance rating greater than twice the calculated fire duration for the room of fire origin, fire spread through the barrier to an adjacent zone will not occur. Also in screening analyses, fire suppression is not taken into account to determine the possibility of component damage. If fire models show that component damage can be caused by the worst-case fire for the area, the possibility of suppression before damage should be considered. Manual intervention to mitigate consequences should be neglected for the screening assessment. (3) Release of radioactivity Three mechanisms for release due to fire are identified: i. damage to barriers that limit radioactive effluents during normal operation leads to unacceptable release; ii. damage to confinement barriers leads to unacceptable release during postulated events; ITER Fire Safety Approach Page 12 of 35

14 iii. damage to equipment results in some other postulated initiation event that leads to unacceptable release. Equipment in each fire sector should be assessed to identify safety importance class components and identify design provisions to avoid release of radioactivity. Annex A ITER Fire Safety Approach Page 13 of 35

15 - Definitions Fire Barrier Walls, floor, ceiling or devices for closing passages such as doors, hatches, penetrations and ventilation systems, etc., used to limit the consequences of a fire. A fire barrier is characterized by a Fire Resistance rating. Fire Sector A building or part of a building comprising one or more rooms or spaces, constructed to prevent the spreading of fire to or from the remainder of the building for a given period of time. A fire sector is completely surrounded by a Fire Barrier. Fire Damper A device which is designed to prevent the passage of Fire through a duct, under given conditions. Fire Load The sum of the calorific energies which could be released by the complete Combustion of all the combustible materials in a space, including the facings of the walls, partitions, floors and ceiling. Fire Resistance The ability of an element of building construction, component or structure to fulfil, for a stated period of time, the required load bearing function, integrity and/or thermal insulation and/or other expected duty specified in a standard fire resistance test. Fire Retardant The quality of a substance of suppressing, reducing or delaying markedly the Combustion of certain materials. Fire Stop Physical barrier designed to restrict the spread of Fire in cavities within and between building construction elements. Non-combustible Material A material that, in the form in which it is used and under the conditions anticipated, will not ignite, support Combustion, burn or release flammable vapour when subject to Fire or heat. Single Failure A single fault of a system, structure, or component. A single failure shall include any consequential failures that result from it but shall not include any independent failures. Single Failure Criterion No single failure, including consequential failures, shall prevent a system or component from performing its intended (credited) safety function. ITER Fire Safety Approach Page 14 of 35

16 Annex B - Fire sectors The fire/confinement sectors are presented in the Rapport Préliminaire de Sûreté [RPrS 1-9.6]. Fire sector boundaries ensure: There is no spread of radioactive or hazardous substances to a room or zone in which these substances cannot be confined and kept from spreading to the environment, There is no loss of safety function through failure of SIC equipment. The following measures are implemented in the fire sectors of the buildings: Radioactive inventory is controlled by physical means, administrative means, or both in order to limit the radioactive inventory potentially vulnerable to a fire, Fire loading and fire resistance are controlled to avoid damage such that at least one confinement barrier remains intact, Fire sectors are surrounded by physical, fire-resistant barriers, fire resistance rating is at least twice the fire loading, Doors through fire barriers are designed to offer the same degree of fire resistance as the rest of the fire barrier, Openings through fire barriers are filled in using a material guaranteeing the same degree of fire resistance as the rest of the fire barrier, using a process verified by an approved organization, Electric cables and other materials running through a fire sector do not contribute to the spread of fire (C1 cables or cables protected by a flame-retardant material for radiologically controlled building), Electric cables and other materials running through a fire sector and which are required to operate in the event of fire are fire resistant (CR1 cables or cables protected by a fire-resistant material for radiologically controlled buildings), Ventilation ducts and pipes running through a fire sector are protected by a fireresistant material, Ventilation ducts opening into a fire sector are equipped with fire valves or dampers. These dampers or valves are installed as near as possible to the fire sector walls. The piping between the damper or valve and the fire sector is protected by a fire-resistant material, Halogenated materials are not used in sectors served by detritiation systems. Moreover, within a fire sector, requirements can be established to limit radioactive inventories potentially vulnerable to a fire. These requirements are such as fires initiating in a zone will not propagate outside the zone, and fires initiating outside the zone will not propagate into the zone. Confinement sectors are associated with fire sectors when there is an identified risk of radioactive substances being released. These sectors are designed to prevent the uncontrolled release of such substances to the environment. In the analysis performed in [RPrS 1-9.6], Confinement Sectors are congruent with Fire Sectors since there is no scenario leading to a significant release of radioactive materials outside the fire sectors. In fact, measures are taken to: Limit the fire loading in the sectors; ITER Fire Safety Approach Page 15 of 35

17 Reduce the likelihood of fire (locating ignition sources away from radioactive materials, inerting the vessels with the largest inventories mobilizable in a fire, installing fire detection); Reduce the fire extent and propagation (inerting already mentioned will inhibit fire development and limit pressurization so as not to threatening the fire sector); And reduce the consequences (rooms tightness, room detritiation, aerosol filtration). The analysis procedure is the following: Generally, rooms sensitive to fire risks are those where a safety target is located, and where fire cannot be excluded because of the combined presence of ignition sources and substantial amounts of combustible materials. Cases where a safety target and a significant fire load are present in adjacent rooms are also considered if there is a communication between these rooms through doors or penetrations within the fire barrier. Content and function of each room is analyzed and fire sectors are established according to the following criteria: Criterion 1: the room contains combustible materials, potential ignition sources and potential sources of oxygen, Criterion 2: the room contains one or more pieces of SIC equipment necessary to fulfil a safety function and which could potentially be damaged during a fire. Criterion 3: the room contains a significant amount of radioactive material mobilizable in case of a fire, Criterion 4: the adjacent room where the fire could propagate contains SIC equipment or a significant amount of radioactive material mobilizable in case of a fire. Fire development, its propagation, and the lines of defence necessary to limit the fire effects are considered depending on the analysis of these risks. Fire safety zoning is then established in order to segment the radioactive materials and to separate redundant SIC equipment to the extent practicable so as to reduce the potential impact of fires. Fire zoning is presented in [RPrS 1-9.6]. ITER Fire Safety Approach Page 16 of 35

18 Annex C- Integrated approach to confinement and fire protection Fire is considered a credible event and can cause equipment failure. Therefore, the confinement and fire protection systems are designed to limit the likelihood and consequences of a fire. An integrated approach to confinement and fire protection has been developed. This approach has four major purposes: Protect workers, Preserve the primary confinement system function, Preserve the secondary confinement system function, and Limit consequences. Design Provisions and Controls shall be sufficient to meet the needs of project objectives. Protect workers: The workers are evacuated from the affected space when a detector senses and an audible alarm sounds to annunciate a fire, elevated temperature, smoke, radioactivity and/or tritium condition. Preserve primary confinement function: The primary confinement system shall be designed to preserve the primary confinement barrier in the event of a fire. Protection is accomplished utilizing appropriate controls on the primary system, limiting the combustible loading in the fire sectors and, if necessary, through fire suppression. Preserve secondary confinement function: In the event that fire compromises a primary confinement barrier, the secondary confinement system must limit releases. The secondary system is protected through fire rated barriers, ventilation protection and, if necessary, fire suppression. The design should provide confinement efficiency greater than or equal to 90% in the event of a fire. Limited consequence: If the performance of the secondary confinement system is compromised, strategic division of radioactive material inventories into sectors limits the consequence. These inventories are controlled to values as low as practicable. In any case, the inventory shall not exceed a value which has been shown by analysis to limit potential offsite impact in a postulated fire scenario to within the project general safety objectives (see [General Safety Principles]). In fire sectors where the impact of a potential release represents a significant fraction of the project general safety objectives, additional controls shall be established to limit fire risk. These additional controls may include: precluding ignition sources, further restricting fire loading, and/or increasing fire resistance. ITER Fire Safety Approach Page 17 of 35

19 Annex D- Guidance on control of combustibles during design. This Annex provides guidance on the design needed to fulfil the requirements of Section 3 (Fire Prevention). The main preventive measures taken with regard to the risk of internal fire are as follows: The personnel are informed of fire hazards in the buildings and measures to prevent a fire The quantity of combustible materials and loads in each room or area is limited to minimum process requirements by using non-combustible or non-flammable materials whenever possible (M0 or M1 materials, C1 cables, etc) in buildings with radioactive inventories, The quantity of combustible materials stored internally and normally exposed to risks of fire (e.g. oils) is reduced by supplying only the minimum necessary for ongoing operations and by providing an external storage area, The quantity of combustible materials in rooms or areas is monitored and measures are taken to limit quantities: Paints and coatings are avoided in most cases, since they contribute to the fire loading and can absorb the tritium; in cases where wall or floor lining is required, low-flammability products are used, Halogen-containing products are prohibited as they reduce the efficiency of the detritiation systems. This includes but is not limited to: Electrical insulating materials such as terminal blocks, moulded circuit breakers cable terminations, etc., Teflon sealants, Teflon lubricants, Teflon based seals and other fluorinated materials, PVC based caps, tubing connectors etc., SF6 piping is specifically studied to take into account this hazard, The use of combustible materials in air filters and their frames is minimised, As far as is practicable lubricating oil is only used in a fire protected design, Preference is given to a low flammable hydraulic fluid, Inside buildings, dry indoor transformers are used where appropriate, The use of plastics that produce corrosive combustion products is kept as low as reasonably practicable, Precautions are taken to prevent insulating materials that have the capability of absorbing oil or other combustible fluids from accumulating flammable or explosive mixtures, The use and installation of combustible materials in rooms containing SIC components (or adjacent rooms) are optimized, particularly by: Separating or increasing the distance between potential fire sources and SIC components or systems, Protecting SIC components (diesel generators, cables, electrical panels, etc.) against the effects of a fire, by minimizing fire loads, separation, etc., SIC components are protected from the consequences of fire so that their safety function is maintained. The principle of separation of redundant SIC systems fulfilling a safety function (or parts of non-redundant SIC systems) is adopted. Ignition sources are controlled (metallic equipment grounded, electrical equipment in conformity with legislation, non spark-creating electrical equipment, physical separation between electrical components, protection against external aggressions (lightning, external fire etc)), ITER Fire Safety Approach Page 18 of 35

20 Electrical equipment is turned off after use, Basing the design and construction of the facilities as far as possible on rules that prevent fires caused by the use or malfunction of equipment (e.g. restriction of fluid pipes in electrical rooms, routing fluid lines below cables, power supply shutdown, arc protection, protection against external hazards, etc.), Operations with a risk of fire (e.g. cutting, welding, etc.) require specific permits and associated protection measures, particularly in rooms with confinement systems, Specific measures are taken for rooms containing flammable liquids or gases (hydrogen, deuterium, tritium, etc.) that can be potentially released into the rooms during a fire or other abnormal events, for example: Systems should be designed with a high degree of integrity and protected from vibration or other destructive effects to prevent leakage of such materials. Safety devices should be provided for limiting the leakage of combustibles, for example by using flow limiting devices, flow limiting valves and automatically controlled shut-off and isolating valves. Similarly, drainage facilities should be provided for combustible or flammable liquids in case they leak. Supply lines are drained or purged with a non-reacting gas (e.g. nitrogen) when not in use or during maintenance phases, Priority is given to low-flammability hydraulic fluids, oil lubrication is only used in systems designed with suitable fire protection, Tritiated hydrogen is confined in an additional confinement when needed with a non-reacting gas to prevent tritium leakage and air ingress, Processes are operated slightly below atmospheric pressure to prevent release and permit detection of failures, Rooms containing flammable gases are ventilated, Rooms with a risk of tritiated hydrogen leakage are equipped with a tritium detection system. In case of detection of tritium leakage, the process is placed in a safe state and the detritiation system is activated as necessary, Hydrogen supply cylinders (or special containers) and associated distribution manifolds are kept well-ventilated and are stored outside of areas containing SIC components. In the event that additional ventilation is required in these storage areas, the system is designed to maintain the hydrogen concentration below flammable limits in the volume, Batteries potentially producing hydrogen are located in well-ventilated rooms in order to limit the risk of hydrogen accumulation and in the case where 'open' batteries are used, a hydrogen detection system associated with a charge cut-off system is installed inside the room, Process monitoring systems can detect abnormal conditions that could indicate leakage, Tritiated hydrogen systems are designed, as far as possible, in such manner that their operation (or potential failure) do not trigger a fire-initiating mechanism, The on-site use and storage of combustible materials in areas adjacent to or containing SIC items will be controlled and accounted for and kept to a practicable minimum; combustible materials not required to be immediately available for operational purposes will not be stored close to SIC items, Components comprising a significant quantity of combustible materials (transformers, diesel tanks, etc.) are installed away from nuclear buildings to prevent risks of fire propagation, Dry transformers are used whenever possible, ITER Fire Safety Approach Page 19 of 35

21 Inertization of gloveboxes, Removal of electrical cubicles from the rooms with systems containing radioactive materials. Cubicles are closed by instruction, Areas with an ignition source (cutting workstation & Tritium Recovery Station) are inerted with a non-reacting (e.g. nitrogen) gas. ITER Fire Safety Approach Page 20 of 35

22 Annex E - Guidance on fire detection and alarms. This Annex provides guidance on the design needed to fulfil the requirements of Section 4 (Fire Detection). A fixed fire monitoring system is installed in each fire sector so as to rapidly identify fire outbreaks. The measures adopted include: Personnel are evacuated upon activation of the fire detection - this detection and alarm function will be provided by smoke/heat detectors; in areas of the facility where there is inert gas purging provided, (e.g. gloveboxes within the Tritium Building, certain hot cells), evacuation will be initiated by elevated oxygen levels in the enclosures or loss of inertization ITER shall have a sustained capability for early detection and effective extinguishing of a fire in order to protect items important to safety. The fire extinguishing capability consists of fixed fire extinguishing systems and manual fire fighting facilities. In the design of fire detection and extinguishing systems it is important to consider the reliability of the system and of individual components to perform their required function at all times. For fire detection systems, this reliability may be affected by, for example, a reduction in sensitivity of the sensing devices leading to the non-detection or late detection of a fire, or the spurious operation of an alarm system when no smoke or fire hazard exists. Each room with a risk of start of fire is equipped with a fire detection and alarm system specifically engineered and selected for fire risks in that area, Detectors shall be selected based on the nature of products released by the heating up, carbonization or initial bursting into flame of the materials present in the fire sector. 'Fire alarms' may be activated by personnel present inside the buildings (during operating phases where access to the buildings is permitted), independently of the automatic alarms generated by the fire monitoring system, Fire detection system is designed in closed loops, The detection and alarm system shall be energized at all times. It shall be capable of being energized by the non-interruptible emergency power supplies, so that in the event of loss of normal power it will still provide early warning of a fire. Automatic system connected with fire detection system is provided to protect the filtration system and control the closure of fire dampers, Visual and audible alarm signals associated with the fixed fire monitoring system are transmitted to the control room and are distinct from other alarm signals, For the purpose of providing a warning to personnel who may enter or who may be working in an area equipped with potentially hazardous automatic fire extinguishing systems (e.g. carbon dioxide), suitable audible and visual alarms shall be provided within, and at each entrance to, the area and there shall be adequate written procedures to ensure the safety of personnel entering such areas. It may be necessary to provide individual local alarm panels for groups of alarms and provide general alarms in the control room from each of the individual local alarm panels. Fire detection are implemented in cubicles, ventilation air currents, ventilation ducts, etc. to allow early detection of fires and specific identification of fire outbreaks (addressability of detectors), ITER Fire Safety Approach Page 21 of 35