FUNDAMENTAL SAFETY OVERVIEW VOLUME 2: DESIGN AND SAFETY CHAPTER C: DESIGN BASIS AND GENERAL LAYOUT

Transcription

1 PAGE : 1 / FIRE 7.0. SAFETY REQUIREMENTS Safety objectives The general safety objectives for internal hazards are given in Chapter C.4.0. The safety objective for fire protection is to ensure that the safety functions are performed in the event of a fire inside the installation, where the fire has the same characteristics as the reference fire. This objective implies that: - a fire must not cause the loss of more than one set of redundant equipment in an F1 system; - the non-redundant systems and equipment, which perform the safety functions must be protected against the effects of a fire in order to ensure continuous operation; - a fire must not compromise the habitability of the control room. In the event that the control room cannot be accessed the habitability of the remote shutdown station must be assured. In addition, for a given room its accessibility must be ensured for actions to be taken Fire protection requirements Identification of risks A fire acts mainly by greatly increasing the temperature of rooms (ambient temperature), equipment and structures. The risk identified is the unavailability of equipment required to maintain the area in a safe condition Deterministic / Probabilistic approach The main approach for protection against fire is deterministic. This approach will be complemented by a probabilistic safety assessment (fire EPS [PSA]), which aims to determine if the fire risk is of the same order of magnitude as other risks, and to verify the overall frequency of core meltdown Principles of the deterministic approach The principles used for the deterministic approach are as follows: - The fire is assumed to occur in any power station rooms which contain combustible materials.

2 PAGE : 2 / 19 - Coincidental occurrence of two or more fires, from independent causes, affecting rooms in the same or different plant is not taken into consideration. - The ignition of any combustible material present in the Basic Nuclear installation (INB) perimeter must be considered, except for low and very low voltage electrical cables and equipment or materials protected by a housing or box. - A fire is assumed to occur during normal plant conditions (from full power to shutdown condition) or in a post-accident condition once a controlled condition has been achieved Random failure The random failure of an active item of equipment in the fire protection systems must not lead to a common cause failure in the systems which are required to perform the F1 safety functions, even if these functions are not required after such an event. The redundancy requirement resulting from the consideration of this principle, and the additional geographical or physical separation measures including those ensuring the independence of the electrical sources, will be implemented as long as the channel separation principle is not compromised. Verification of resistance to a (single) random failure is applied in a deterministic manner in the following instances: - fire independent of accidents, likely to affect the safety barrier; - fire leading to PCC-2 events; - fire resulting from a PCC3/4 event. A random failure is applied in a deterministic manner to the following: - active materials in the fire protection mechanical systems; - all components in the fire protection electrical systems. An occasional loss of the integrity of the safety barrier may be allowed where the failure of an active item of equipment in the fire protection systems does not lead to a common cause failure in the systems required to perform the F1 safety functions Fire and events Fire and consequences In case of fire, the following is considered: the loss of all the equipment (apart from that protected by fire barrier devices or able to withstand the fire effects) present in the fire compartment where the fire is assumed to exist. A fire could lead to an additional PCC2 event. In this instance, the analysis ensures that adequate systems/redundancies remain available to control the event. Where possible a fire must not lead to an additional PCC3/4 event. A fire must not cause the loss of non-redundant safety equipment. Otherwise, this equipment must be protected or the likelihood of a fire must be eliminated.

3 PAGE : 3 / Postulated event and consequential fire External hazards and consequential fire The fire protection measures must be designed so that if a fire is caused by an external hazard, the requirements of C , shall be ensured. Only those fire hazards which are a consequence of other external hazards are described below. Earthquake In the case of an earthquake, buildings designed to resist external hazards must not contain equipment which is likely to release combustible materials or to create a source of ignition. An exception is made for the BAN and the BTE where only the buildings are earthquake classified. If the equipment is not designed to resist an earthquake, fire protection measures must be taken which are able to resist the effects of these hazards. All the fire protection materials must comply with the criteria of the earthquake event analysis. They also must impair the performance of the safety functions as a result of either their destruction or a fall. Aircraft crash The risk of an aircraft crash causing a fire in a protected building is taken into consideration at the design stage. The combination of an aircraft crash and a fire in a building is not applied when designing the fire protection systems. However, the distribution network protection system (geographical separation and structural protection) will ensure the availability of means of emergency fire fighting. Extreme cold The materials required for fire protection must be protected against conditions of extreme cold. Internal hazards and consequential fire The fire protection measures must be designed so that if a fire is caused by an internal hazard, the requirements of Chapter C , shall be met. This applies in the event of a pipe break (rupture) carrying flammable liquids or gases giving rise to a simultaneous release of fuel and sufficient ignition source. Postulated initiators and consequential fire PCC or RCC conditions that could lead to fire are LOCA and severe accidents. This is due to the fact that during these events there is a potential release of hydrogen in the containment. The necessary measures for designing the containment as well as the equipment necessary to eliminate potential ignition of H 2, to control hydrogen fire or explosion are described in Chapters C and C

4 PAGE : 4 / Postulated event and independent fire Although there is no proven dependency, the following cases of combined events are taken into consideration for in-depth protection. PCC2 to 4 events An independent fire is only assumed to occur during the post-accident phase and after a controlled condition has been reached following a PCC2 to 4 events. Nevertheless, the fire protection measures are available for the full duration of the post-accident phase. N.B.: A fire in the control room is ruled out. This is justified by sufficient fire protection measures and the presence of operating staff that are able to rapidly extinguish the fire. RRC Events RRC type events rarely occur. As a result, such an event combined with an independent fire is assumed only during the post-accident phase and at least two weeks after the event. N.B.: A fire in the control room is ruled out. This is justified by sufficient fire protection measures and the presence of operating staff that are able to rapidly extinguish the fire. Design-basis earthquake An independent fire is only assumed during the post-accident phase and at least two weeks after the design-basis earthquake. The following protection concept must be applied: - The detection and extinguishing systems of the fire compartment, in the buildings where mechanical, electrical or instrumentation and control equipment is installed necessary for F1 functions, must be earthquake category 1 classified. - Repair or replacement measures must be in place, if required, within a two week deadline. External flooding The fire and external flooding combination presents no interaction. However, for in-depth protection, the fire fighting system components must be protected against a 100 year flood event the CMS and its consequences Fire during plant operation; shutdown conditions and maintenance phases The fire protection concept described above must also be applied to the plants shutdown condition and maintenance phases, during plant operation. The maintenance periods present a potential increase in the risk of fire, however the presence of personnel will aid the rapid detection and extinguishing of fires, thus reducing the consequences. Specific administrative procedures (fire permits, increased monitoring etc) must be applied for any situation which deviates from the general fire protection concept.

5 PAGE : 5 / 19 Specific attention will be paid to the addition of combustible materials and ignition sources (welds, paint, solvents, etc) as well as to possible degradations in the fire protection devices (loss of compartment integrity due to an open door, etc), requiring a fire analysis for each shutdown case Principles of the probabilistic approach The methodology relative to the fire EPS [PSA] is described in Chapter R Regulations and applicable codes Regulations In accordance with French regulations Codes The applicable code is ETC-F (see Chapter B.6) DESIGN BASES The design of the fire protection systems is based on three types of measures which are based on the three levels of in-depth protection (prevention, detection and extinguishing). The three types of measures are as follows: - Prevention, - Containment, - Control. For each of these levels, consideration must be given to a random failure which does not bring into question the fire protection safety objective Prevention Prevention comprises a set of measures which aim to prevent a fire from starting or to reduce the likelihood of a fire. The requirements covering prevention are as follows: - The preventive measures must, as a priority, deal with limiting the heat loads, separating or shielding them (enclosure or box) and preventing potential ignition sources from being placed near combustible materials. - Preference must be given to the use of non-combustible materials (A1 or A2s1d0). If not the material must at least be type B or C and must not produce dense or toxic smoke.

6 PAGE : 6 / Containment If a fire starts, despite preventive measures in place, measures must be taken to limit its spread and to prevent: - Impact on the function of the F1 systems. The fire must only be able to damage one redundant train in a given F1 system. - Spreading to other rooms (safety impact and unavailability) and the emergency exits from being engulfed, hence disrupting fire fighting. - Environmental impact contravening French Regulations. Limiting the spread of a fire is achieved by dividing the buildings into fire compartments which use physical or geographical separation principles. The installed fire barriers must contain the fire so that only one of the redundant trains in a given F1 system may be endangered by a fire, providing that different redundant systems are installed in different areas, fire sectors or fire zones. The requirements covering segregation are as follows: - All safety classified buildings must be separated from other buildings using (R) EI 120 classified walls. - Priority must be given to physical separation. In the same way, priority must be given to structural measures (fire resistance of the structures) rather than the use of fire protection devices. - In case of fire the redundant equipment in a F1 system must be protected so that its failure, is limited to a single train. - Random failure is only to be considered for active equipment such as fire stop check valves and any servo-controlled doors. The doors, smoke extraction ducts and floor drains are passive equipment. - The following table summarises the different types of fire compartments: Objective Fire compartment Radioactivity containment Type 1 Safety Type 2 Protected evacuation route Type 3 Limiting the unavailability Type 4

7 PAGE : 7 / 19 - The principles used take into consideration geographical separation (extinguishing screen distance). The containment is justified by taking into account the location of the concentrated heat loads and the combustible material properties. Fire zones must only be used in exceptional circumstances and their effectiveness must be demonstrated on both, fire propagation and radioactive or toxic waste release level. - Physical separation is the best method of reducing the risk of common cause failure, and therefore takes precedence over other solutions. - Where geographical separation is used, it will be justified by a vulnerability analysis as shown in Chapter C Fire sectors There are four fire sector types: Type 1 fire and containment sector (SFC). In this sector type, radioactive particles created during a fire may be released which, in the absence of measures to prevent them from being dispersed outside of the fire sector in question, are likely to contravene French Regulations. In addition to fire containment, it measures are provided to control the release of radioactive particles. The walls of fire and containment divisions must have an (R) El 120 level of fire resistance. They must also be fitted with a fixed automatic fire extinguishing system which can still operate in cases of single failure. Type 2 safety fire sector (SFS). This sector type is created to protect the safety lines from common cause failure. The walls in these safety fire sectors must have an (R) El 120 level of fire resistance and active or passive fire protection devices should be installed, where necessary, to ensure their integrity, in the event that the 120 minutes resistance is exceeded. Type 3 access sector (SFA). This sector type is used to enable the safe evacuation of personnel in the event of a fire and for response team access. This corresponds to a protected evacuation route. The walls in these sectors must have a fire resistance level equal to the MAX [resistant to fire from the adjacent fire compartment - (R)E 60] and the doors must be classified as S 200 WC5 (smoke tightness, limited radiation and durability in accordance with standard NF EN ). These sectors must not contain safety equipment or combustibles. Type 4 limiting unavailability fire sector (SFI). This type of sector is created when the heat load density in the room is greater than 400 MJ/m 2, in order to limit the plants unavailability and to aid the fire fighting teams. The walls in these fire sectors must have a level of fire resistance which is suitable for the consequences of a fire in the compartment but not below (R) EI 30. It can be: - included in a safety fire sector, - independent of any safety fire sector Fire zones In some buildings, and in the reactor building in particular, the division of fire sectors may be limited due to construction measures or the process: - Compact nature of the installation,

8 PAGE : 8 / 19 - Hydrogen concentrations dilution, - Steam release in case of pipe break (rupture). In this instance, some sections of these buildings may be specifically divided into fire zones. Evidence of non-propagation and absence of failures of safety classified equipment must be established by assessing all possible modes of fire propagation and combustion products. This geographical separation implies: - A sufficiently low heat load or specific border conditions or an automatic extinguishing device. The first two principles will be specified during integration of the new thermal programme for fire assessment. - Demonstration that it is not feasible to build a wall. There are two fire zone types: Type 2 fire safety zone. This is created inside a safety fire sector in order to protect the safety functions from common cause failure. The borders of these fire safety zones must ensure the integrity of these safety functions for the time required to extinguish the fire. Active or passive fire protection devices are installed, if necessary. Type 4 limiting unavailability fire zone. This is created inside a fire compartment in order to limit the unavailability of plant and to aid the intervention of the fire fighting teams Physical separation This separation is achieved by creating fire sectors or by using passive fire resistant protection. Passive protection The operational resistance of these protection devices (enclosures or boxes) must at least be equal to the duration of the reference fire, defined by the combustion of materials contained in the room and outside the enclosure, but not less than the duration of the fire in the zone or sector with the longest fire duration. Where it is not possible to shield part of the rooms equipment from a fire (e.g. the consoles in the main control room), fire retardant paints can be used on the condition that all the combustible materials, present, are also coated Geographical separation The separation is achieved by creating fire zones or by using fire resistant geographical protection. Geographical separation is associated with an analysis which concludes that the time required for the hot zone to reach all of the equipment is greater than the time required to extinguish the fire.

9 PAGE : 9 / 19 Distance In the event that separation is associated with a specific analysis, the use of physical distance ensures that a fire in a specific combustible mass cannot propagate towards another combustible mass. This is achieved by installing both masses in such a way that the distance between the combustible masses is free from combustible material. Distance may also be used to prevent a fire in a combustible mass causing failure in two redundant items of equipment. This is achieved by ensuring that distance from the combustible mass is sufficient for at least one of the redundant items. The distance used depends on the direct radiation and the time required for the fires hot zone to reach the second combustible mass or the equipment to be protected. A large number of parameters (type of combustible, location in the room, severity of the heat load, etc) are included in this definition. As it is difficult to define a general rule the measures used are subject to specific assessments. Thermal screen This measure, which may complete the protection by distance, enables a section of the equipment to be shielded from direct radiation. This is achieved by installing a screen whose fire resistance is at least equal to the severity and duration of the reference fire. Fixed automatic protection associated with geographical separation An additional means of protection, when the previous provisions (screen, distances) are not adequate, is provided by installing a fixed and automatic fire fighting device, which ensures that the fire will be extinguished or restricted before it reaches another combustible mass or two redundant items of equipment Controlling Detection and fire fighting devices are installed to detect and fight the fire and to control the fire as quickly as possible. The control requirements are as follows: - The purpose of the detection system is to quickly detect the start of a fire, to locate the fire, to trigger an alarm and in some instances, to initiate automatic actions. - The fire detection system must be operational in all cases where a fire is assumed to occur in accordance with Chapter C Fire fighting devices, which are fixed or portable depending on the nature of the fire and the type of equipment to be protected, must be provided where a heat load is likely to generate a fire which could affect redundant equipment performing the same safety function Vulnerability analysis Where a fire is detected, in a safety fire sector or in a safety fire zone, operational failure of all the equipment is assumed (apart from those which are protected by an approved fire barrier, designed to resist the consequences of a fire).

10 PAGE : 10 / 19 The operational consequences of loss of equipment in terms of safety must be analysed in accordance with the criteria in Chapter C and C For practical reasons, two different approaches must be considered in the analyses of the consequences of a fire: a) Fire in the divisions: In those zones which are separated into divisions (e.g. safeguard buildings, diesel generator buildings) the fire must be limited to the division affected. b) Fire in the zones which are not separated into divisions: This for example applies to the containment function. The fire must be limited to a restricted area (for example safety fire sector and safety fire zone). Stage 1 Identification of the fire compartments containing F1 system equipment in potential common mode or non-redundant mode. A potential common cause failure is identified when the same fire compartment contains equipment which corresponds to at least one of the following cases: a) Safety classified mechanical equipment or electrical connections belonging to two redundant trains of the same system performing a safety function; b) Safety classified mechanical equipment or electrical connections belonging to one train of a system which performs a safety function, on one hand, and to systems which are required to operate the same system in the redundant train, on the other hand, c) Electrical connections which are not included in the previous categories, but which are supplied by redundant electrical switchboards. The number of electrical switchboards is such that the protection devices may not ensure the selectivity. The criterion c) relative to the non-selectivity of the electrical protection devices is only to be considered when a fire is able to simultaneously reach both electrical connections. Therefore, only the electrical connections which are present in the same room are taken into consideration. d) Equipment which, were it to fail in case of fire, is likely to lead to an accidental or additional operating condition, and equipment which is required to ensure the necessary safety function of the system during the event. Stage 2 The second stage consists of the functional analysis of the consequences of losing the equipment identified during the first stage in order to define the need for additional fire protection measures. When the analysis confirms the existence of a common cause or the unacceptable loss of a non-redundant item of equipment, additional fire protection measures must be implemented. In case of fire in a division, specific attention must be made for the protection of: - Interconnections, in order to avoid a breach in the containment with the other division.

11 PAGE : 11 / 19 - IRWST in order to ensure its integrity. In case of fire in a fire compartment of a building which is not separated into divisions, a fire risk analysis must be performed with regard to the equipment, taking into consideration the characteristics of the assumed fire. An analysis of the equipment required to return the area to a safe condition, must be performed taking into account the single failure criterion. Stage 3 Additional fire fighting measures must be implemented, if necessary, dependant on stage Consideration of random failure The following active equipment is to be considered for a (single) random failure: - Containment: fire stop check valves (and possibly servo-controlled doors), - Detection: all of the detection equipment (as the detectors and their circuits are electrical equipment), - Extinguishing: pumps, servo-controlled valves that change position when the systems and sprinklers are activated. When the redundancy of equipment (and its support systems) as well as any additional measures consisting of geographical or physical separation, and redundancy in electrical supply cannot be implemented, a minimum operational redundancy shall be ensured. The operational redundancy can be ensured by a diversified system whose performances will enable compliance with the principle described in Chapter C STRUCTURAL FIRE PROTECTION MEASURES Reactor building The reactor building design, which is based on the double containment technique, comprises two compartments: - Compartment (or inter-space) between containments, - Reactor containment compartment inside the internal containment. These compartments made of concrete walls (pre-stressed or reinforced) are considered to be fire sectors. The potential fire risk in the reactor building is low and generally segregated (pumps, electrical equipment and crane) Containment Outside of shutdown periods the containment building is sealed preventing the external release of contaminated materials in case of fire.

12 PAGE : 12 / 19 Division into fire compartments are limited by construction measures or by the process: - Compact nature of the installations, - Hydrogen concentration dilution, - Steam release in case of pipe break (rupture). The Reactor Building is made of fire zones which can be taken as fire sectors for application of the compartment rules: electrical segregation of the divisions. The demonstration of the non-propagation and the absence of failures in important safety classified equipment will be established by analysing all of the possible modes of fire propagation and combustion products released. A fire zone is generally associated with an electrical train (1 to 4). If, in exceptional circumstances, a fire zone contains redundant electrical components, a vulnerability analysis will be performed at the end of the detailed studies in accordance with the ETC-F, in order to define whether protection against fire is required. The fire zone limits may be actual or virtual (distance) Layout of fire zones Inter-space between the reactor building containments The compartment space between the containments is divided into safety fire zones (ZFS): - Four fire zones, each corresponding to one division. Each fire zone includes all of the cabling and connections to the corresponding safeguard building. - Each fire zone limit is fitted with a physical separation comprising a vertical screen The containment compartment (primary enclosure) The primary containment compartment is divided into safety fire zones (ZFS) as follows: - Three fire zone groups each corresponding to: - one division, and including all of the electrical or instrumentation and control connections, of the corresponding BL, - a reactor coolant system loop, - an installation zone for the redundant shutoff valves serving each BL and diesel generator building. - Four fire zones, for protection of the reactor coolant pumps. - Four fire zones dedicated to the four RIS [SIS] / RRA [RHRS] trains.

13 PAGE : 13 / Layout of the fire sectors The containment comprises two access fire sectors (SFA) located in front of every personnel airlock. Each of these sectors includes an evacuation area in front of the airlocks and a staircase which serves all levels Safeguard buildings (BAS) The electrical and safeguard buildings are divided into four completely distinct divisions (BAS/BL 1 to 4) Containment Each division (BAS/BL 1 to 4) forms a safety fire sector (SFS) which is divided into several fire sectors: Safety fire sectors: - Rooms which are used for the information and safety management systems (SICS) and the computer. - Remote shutdown station. Limiting unavailability fire sectors: - Landings which serve the rooms from the protected staircases including the lift wells. - Un-controlled mechanical zone. - Controlled mechanical zone. - Cable decks or large cable routes. - Rooms containing powerful electrical equipment. - Rooms containing the instrumentation and control cabinets. - Cable tunnels between the control room (and the Emergency Control Centre) and the different divisions (in certain cases these could also be safety fire sectors due to their segregation). - Ventilation rooms including the presence of DCL iodine filters. - Battery rooms. - RRI [CCWS] tank level measuring rooms (in certain cases these could also be safety fire sectors due to their segregation). - Air conditioning rooms for the control room and the Emergency Control Centre (in certain cases these could also be safety fire sectors due to their segregation)

14 PAGE : 14 / 19 For two divisions only, the: - VVP [MSSS] steam shutoff valve rooms (in certain case these could also be safety fire sector due to their segregation). - GV [SG] water supply shutoff valve rooms (in certain case these could also be safety fire sector due to their segregation). And, in addition, for the other two divisions, the: - Control room. - Rooms connected to the control room. Access fire sectors: - Protected staircases. - Main corridors at level 0.00m; (controlled area). - Main corridors at level m; (uncontrolled area). - Corridors between the control room and the Emergency Control Centre Evacuation and emergency access All of the levels in each division are accessible via protected staircases (SFA) Fuel Building (BK) Containment The fuel building is vertically divided into two safety fire sectors (SFS), from the lowest level to the floor level of the fuel pond and dedicated as division 1 and 4 respectively. Each of the safety fire sectors (SFS) comprises several limiting unavailability fire sectors (SFI), the: - RCV pump rooms. - Main cable routes, in particular the vertical risers coming from BAS 1 and 4. - Storage area located in front of the Reactor Building access airlock. - Filtration boxes for the ventilation systems iodine traps (EDE [AVS], DWL [CSBVS], EBA [CSVS]). And, in the access fire sectors (SFA), the: - Protected staircases. - Main corridors at level 0.00 m.

15 PAGE : 15 / 19 - Evacuation area in front of the personnel airlock Evacuation and emergency access All of the levels are accessible via protected staircases (SFA) Nuclear auxiliary building (BAN) Containment The nuclear auxiliary building is divided into limiting unavailability fire sectors (SFI): - Main cableways or some electrical cabinets. - Areas which include the ventilation equipment (DWN). - Area for the RCV [CVCS] system filters. - Area for the TEG [GWPS] gaseous waste decay beds. - Sampling, laboratory and sump area. - Primary waste treatment (TEP) [CSTS] area. - BR cooler and chilled water pump area (DER). - Disassembly areas and workshops in hot areas. Access fire sectors (SFA): - Protected staircases. - Main corridors at level 0.00 m Evacuation and emergency access All of the levels are accessible via protected staircases (SFA) Diesel Generator Buildings (BD) Each building includes two electricity generator sets dedicated to divisions 1/2 or 3/4, plus an emergency unit which serves both divisions Sectors Each diesel generator building is divided into three safety fire sectors (SFS) corresponding to each electricity generator and their respective components. These three safety fire sectors (SFS) are divided into limiting unavailability fire sectors (SFI):

16 PAGE : 16 / 19 For the main diesel generators, the: - Diesel bay. - Cooling towers. - Control room, electrical rooms, ventilation and cable decks. - Room for the daily fuel tank. - Room for the main fuel tank. For the emergency diesel generator, the: - Diesel bay. - Cooling towers. - Control room, electrical rooms, ventilation and cable decks. - Ventilation room. - Battery room. - Electrical cabinet room. - Room for the daily fuel tank. Access fire sectors (SFA), the: - Protected staircases Evacuation and emergency access All the levels of each safety fire sector are accessible via a protected staircase (SFA) The Effluent Treatment Building (BTE) Sectors Part of the BTE is sectored: Limiting unavailability fire sectors (SFI), are: - Electrical rooms. - Cable decks and cable tunnels. - Control room and adjoining rooms. - Technological waste storage and treatment rooms.

17 PAGE : 17 / 19 Access fire sectors (SFA), are: - Main BAN access corridor. - Protected staircases. The remainder of the building is not sectored Evacuation and emergency access Controlled area: All of the levels are accessible via protected staircases (SFA). Uncontrolled area: Access to the uncontrolled area is gained from the outside Pumping station and tunnels (SDP) The design of the pumping station and the SEC tunnel includes consideration of the fire risk through the separation of the 4 divisions which house the 4 trains for the main safety functions (CFI [CWFS] and SEC [ESWS]). Each pumping station division is made up of a safety fire zone (ZFS) whose interface is the corresponding SEC [ESWS] tunnel, which itself consists of a safety fire zone (ZFS). The diesel generator tunnel is linked to the SEC [ESWS] tunnel from the same division and is included in the same fire compartment. The SEC [ESWS] access staircases (one staircase per division) are protected (SFA) Turbine hall (SDM) Containment The turbine hall contains the following three limiting unavailability fire sectors (SFI): - Room for the lubrication oil and jacking oil tank. - Hydrogen leaktight oil tank room. - Control fluid room. In addition, each of the motor driven supply pumps is included in the limiting unavailability fire zone (ZFI) Evacuation and emergency access Access to the turbine hall is gained via protected staircases (SFA).

18 PAGE : 18 / Unclassified Electrical Building (BLNC) This is divided into two separate areas (A for BLNC1 and B for BLNC2), which are connected to divisions 1/3 and 2/4 respectively Containment The BLNC is divided into: - Eight limiting unavailability fire sectors (SFI) corresponding to the four levels and the two zones. - Two access fire sectors (SFA, one per zone) corresponding to the staircases and the access airlocks (zone A). The other rooms (terrace and BLNC2 freight lift) are not sectored Evacuation and emergency access Access to BLNC1 and 2 is gained via protected staircases ACCESS TOWER Containment Access fire sectors (SFA): - Staircases in ZNC. - Staircases in ZC. - Circulation zone in ZNC. - Circulation zone in ZC. - Cloakroom access staircase. The other rooms are not sectored Evacuation and emergency access Access to the controlled area is gained via: - The POE tunnel. - A division. Access to the uncontrolled area is gained via: - The exterior. - A division.

19 PAGE : 19 / 19 Access to the rooms on other levels is gained via two protected staircases (one in the controlled zone and one in the uncontrolled zone) Management of potential heat loads The possibilities of storing combustible materials for operational requirements in industrial buildings are assessed and taken into consideration at the design stage. In particular, measures are taken to ensure fire safety in the storage areas and during work associated with plant maintenance. The fire protection concept is also applied during plant shutdown. Specific attention is paid to the additional combustible materials (e.g. paints, coatings and decontamination products) introduced and temporarily used whilst the plant is shutdown, and these are stored in purpose built areas. Following the same principle, necessary measures need to be considered when performing hot work.