Information Notice No. 83-41:Actuation of Fire Suppression System Causing Inoperability of Safety-Related Equipment
SSINS No.: 6835
IN 83-41
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF INSPECTION AND ENFORCEMENT
WASHINGTON, D.C. 20555
June 22, 1983
Information Notice No. 83-41: ACTUATION OF FIRE SUPPRESSION SYSTEM CAUSING
INOPERABILITY OF SAFETY-RELATED EQUIPMENT
Addressees:
All holders of operating licenses (OLs) or construction permits (CPs).
Purpose:
This information notice is issued to alert licensees to some recent
experiences in which actuation of fire suppression systems caused damage to
or inoperability of systems important to safety. No specific action or
response is required at this time.
Description of Circumstances:
In its continuing review of licensee event reports (LERs) the NRC has
identified many LERs describing automatic actuation of fire suppression
systems, where the actuation resulted in degrading or jeopardizing the
operability of systems important to safety. In some instances the
suppression system actuated properly, in response to a valid signal. In
other instances there was no real need for initiation. In these latter
instances, there does not appear to have been a single common causative
factor. It appears that errors have been made in design (including selection
of the most appropriate sensors), in installation, and in plant operating
and maintenance procedures.
The NRC is concerned that fire fighting systems and activities, if not
properly designed and implemented, can contribute to risks to the plant and
public. General Design Criterion 3, Fire Protection, of Appendix A to 10 CFR
Part 50 states in part: "Fire detection and fighting systems of appropriate
capacity and capability shall be provided and designed to minimize the
adverse effects of fires on structures, systems and components important to
safety. Fire fighting systems shall be designed to ensure that their rupture
or inadvertent operation does not significantly impair the safety capability
of these structures, systems and components." Paragraph II B of Appendix R
to 10 CFR Part 50 and the related NRR Branch Technical Position requires
that a fire hazard analysis be performed to assess the probability and
consequences of fires in each utilization facility. This analysis, in
considering the consequence of a postulated fire, must include the effect of
fire fighting activities. Such an analysis need not be complex, but should
not be limited to a "paper study." The events reported indicate that a
walk-down of plant equipment would have identified instances where minor
modifications such as shielding equipment and sealing conduit ends would
have reduced water damage from inadvertent operation of the fire protection
system,
8305110477
.
IN 83-41
June 22, 1983
Page 2 of 2
without significantly reducing its effectiveness. It appears that in many
instances, the hazards analysis did not adequately address system
interactions between fire suppression systems and systems important to
safety, particularly those necessary for safe shutdown. The overall design
must accommodate both needs; that is, it must provide an effective fire
protection system but not adversely affect other aspects of plant safety.
Attachment 1 to this Information Notice tabulates several representative
examples of events reported, with some attribution of probable cause. Also,
the Institute of Nuclear Power Operations is planning to issue a document
providing further information on this subject.
To date, none of the reported events have resulted in a serious impact on
the functional capability of the facility to protect the health and safety
of the public. However, in many instances it would not be difficult to
extrapolate actual occurrences in a sequence of events that could lead to
much more serious consequences. Attachment 2 gives some examples.
Although no written response to this notice is required, it is suggested
that holders of operating licenses or construction permits review the
information in this notice for applicability at their facilities. If you
have any questions regarding this matter, please contact the Regional
Administrator of the appropriate NRC Regional Office, or this office.
Edward L. Jordan Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact: J. B. Henderson, IE
(301) 492-9654
Attachments:
1. Selected Examples off Licensee Event
Reports Related to Fire Suppressions Systems
2. Events That May Be Precursors to More Serious
Similar Events
3. List of Recently Issued IE Information Notices
.
Attachment 1
IN 83-41
June 22, 1983
Page 1 of 4
SELECTED EXAMPLES OF LICENSEE EVENT REPORTS
RELATED TO FIRE SUPPRESSION SYSTEMS
Oyster Creek, November 9, 1980
Personnel were trouble-shooting an electrical fault in an automatic
fire suppression system, without de-activating the automatic feature.
Sprinkler actuation occurred, causing water damage and inoperability of
one train of a redundant safety feature actuation system.
This event appears to involve two deficiencies: The hazards analysis
had not recognized the potential system interaction between the fire
suppression system and the emergency safety feature actuation system;
and the plant procedure for trouble-shooting was either inadequate or
inadequately implemented (or both).
Oyster Creek, January 9, 1982
A pump drive motor overheated, actuating an automatic fire suppression
sprinkler system. The sprinkler system operation was consistent with
conceptual and detailed design.
Some safety-related equipment suffered water damage. Subsequent
licensee evaluation indicated that minor modifications, such as sealing
conduit ends and shielding equipment and vents could significantly
reduce water damage, without degrading fire suppression capability. A
more effective as-built walkdown could have initiated appropriate
preventive actions.
Dresden Unit 3, November 30, 1981
Ionization-type smoke detectors in an HPCI room reacted to high
temperature and humidity, and actuated an automatic sprinkler system.
The HPCI system was rendered inoperable as a result of water damage.
Subsequent licensee analysis indicated the heat and humidity signals
were valid, but resulted from local steam and vapor leaks, and from
inadequate procedures related to local ventilation. Analysis also
indicated that water damage could be significantly reduced and perhaps
eliminated by judicious sealing and shielding of equipment. The fire
suppression system was modified to reduce probability of future events.
Dresden Unit 2, December 24, 1981
An event similar to the November 30, 1981 event at Unit 3 occurred at
Unit 2. The fundamental cause was the same - inadequate operating and
maintenance procedures allowed a high-temperature, high-humidity
condition to develop which caused actuation of the sprinkler system in
the HPCI room. In this instance, the redundant automatic
depressurization system was coincidentally found to be inoperable
because of a broken wire.
System modifications similar to those on Unit 3 were made on Unit 2.
.
Attachment 1
IN 83-41
June 22, 1983
Page 2 of 4
Farley Unit 1, June 10, 1981 and July 21, 1982
These two events resulted in unnecessary actuation of the deluge system
for the main cooling towers. Actuation of this system resulted in
drawdown of the two water storage tanks below the technical
specification limit.
The sprinkler control system is pneumatic and designed so that an
actuation signal bleeds off control pressure, allowing a deluge valve
to open. In both instances of actuation, the control system had been
taken out of service for maintenance. The procedures were inadequate to
maintain control system pressure above the trip value.
Trojan, July 26, 1981
The automatic fire suppression system was actuated by smoke from
welding. Water damage caused inoperability of one train of the
redundant containment atmosphere hydrogen recombiner system.
Maintenance procedures for the welding activity were either inadequate
or inadequately implemented. The maintenance procedure should include
steps to establish a local fire watch and to deactivate, and later
reactivate the automatic feature of the fire suppression system.
Surry Unit 2, May 28, 1981
The licensee reported that as part of the fire suppression system, a
foam distributor system was installed in the main (reserve) diesel fuel
oil tank. The system was piped (solid) to the fire suppression water
main, without adequate precautions to prevent accidental unwanted water
injection to the tank. During an unrelated manipulation of the
suppression water supply system, the valve introducing water to the oil
tank was inadvertently left slightly open.
More than 4000 gallons of water had been introduced and some had been
widely distributed in the diesel fuel oil system before a routine
periodic test disclosed the presence of the water. The water had not
reached the immediate supply (day) tanks for the diesel engines which
were promptly and successfully test started. However, extensive cleanup
operations were required and the diesel generators were technically
"inoperable" until the water had been removed.
This event is a particularly vivid example of apparent inadequacy in
the analysis required by 10 CFR 50 Appendix R. The fundamental safety
requirement is that there shall be an onsite, reliable source of power
to cover emergency shutdown and cooldown power requirements. The
supporting requirement is that there shall be on site a sufficient
quantity of clean fuel to sustain operation of the emergency
generators. Fire prevention and suppression provisions are, of course,
desirable. However, they must not assume such importance that they
jeopardize safety concerns. The-subsequent reevaluation resulted in
retaining the foam-type fire suppression system but removing the fixed
piping internal to the tank.
.
Attachment 1
IN 83-41
June 22, 1983
Page 3 of 4
Diablo Canyon, October 1982
A grass fire started outside the controlled area. Neither unit was
operating. The fire burned extensive acreage and the heat and products
of combustion caused temporary loss of all offsite power.
The fire did not cause any damage within the plant. The onsite diesel
generators were started (in anticipation of loss of offsite power) and
operated reliably. However, because of drifting smoke from the fire,
the plant staff isolated the control room to assure continued
habitability. Drifting smoke from the fire caused many fire alarm
actuations, and the plant staff was kept nearly continually busy
responding to those alarms. No automatic sprinkler actuation took place
since sensors used for sprinkler actuation are of the heat-sensitive
type.
North Anna, Unit 2, July 3, 1981
A fire occurred as a result of an internal electrical fault in a single
phase main transformer. Energy from the fault ruptured the transformer
case containing approximately 9300 gallons of insulating oil. The plant
design provided a drainage pit around the Unit 2 main and station
service transformers, with individual fire walls between transformers.
The pit was filled with uniformly sized gravel for personnel access,
but the void spaces were calculated to be sufficient to contain the
inventory of oil in case of transformer rupture. Two 6-inch drains were
provided, to conduct liquid from the drainage pit to nearby Lake Anna.
Each transformer cubicle is equipped with a water deluge system except
the spare main transformer cubicle, which is at one end and adjacent to
the faulted transformer. Two of the main unit transformer deluge
systems actuated automatically, and the third was actuated manually to
protect the transformer. These deluge systems, plus manual hose streams
were competing with the spilled oil for the limited drainage pit
volume. As a result, some of the burning oil escaped from the pit and
had to be extinguished on the ground. The NRC inspector estimates that
during the course of the fire, approximately 130,000 gallons of water
were delivered by the deluge system, and about 90,000 gallons by
hand-held hoses.
Ginna, November 14, 1981
Personnel were performing a lamp test on "Satellite Station A (SSA),"
which provides power to smoke detector circuits associated with several
automatic fire suppression water spray/sprinkler systems. System
actuation occurred in several plant areas, which resulted in the trip
of one RPS motor generator set and a small amount of water entering the
control rod drive switchgear cabinet. In response to two dropped
control rods, caused by the above condition, the control room operators
manually tripped the reactor from full power.
.
Attachment 1
IN 83-41
June 22, 1983
Page 4 of 4
Subsequent licensee analyses indicated an apparent design deficiency
associated with the power supply to the SSA. Fire suppression system
modifications have been made to preclude inadvertent water discharge.
It was also revealed that personnel had not followed plant procedures
for reenergizing the SSA following a loss of power. Had personnel
followed procedures, which requires deactivation of the solenoid valve
actuator associated with the fire suppression systems, this mishap
would not have occurred.
Grand Gulf Unit 1, July 14, 1982
A ground in the initiation circuit caused the repeated actuation of the
CO2 system in the ECCS penetration room resulting in sufficient
pressure build-up to force open the locked door to the auxiliary
building.
The design of the ECCS penetration room was inadequate since it did not
provide proper venting to prevent overpressurization during CO2
discharge.
.
Attachment 2
IN 83-41
June 22, 1983
Page 1 of 2
EVENTS THAT MAY BE PRECURSORS TO MORE SERIOUS SIMILAR EVENTS
Based on reported events, such as those summarized in Attachment 1 with a
reasonable extrapolation, the NRC is concerned that some fire protection
systems may be susceptible to events that were not adequately considered in
detailed designs, and that could cause a significant impact on plant safety.
Examples of these concerns are discussed below.
1. Contamination of diesel fuel oil by fire suppression system water.
The Surry Unit 2 contamination of the diesel fuel oil tank by fire
suppression water (described in Attachment 1) was identified by
routine sampling before the water had reached the diesel engine
day tanks, but a slightly greater rate of inleakage could have
contaminated those tanks too before the sampling interval had
expired. Under those circumstances the diesels, even if they
started, would not have operated long, and could have been damaged
to the degree that all of them would be out of service for an
extended time. If the diesels started in response to an actual
loss of offsite power, the consequences could have been serious.
2. Damage to safety-related equipment by inadvertent actuation of a
fire suppression system.
Most of the events listed in Attachment 1 fall in this category
without extrapolation.
3. Control and disposal of excess fire suppression water.
The North Anna fire is an excellent example of this concern. The
designer had made provision to control oil leakage in a drainage
pit, but had not considered what to do with about 220,000 gallons
of water, delivered over a period of about 11/2 hours. As a
consequence, the two 6-inch drain lines were overwhelmed, and the
burning oil, floating on the water, escaped from the drainage pit.
Escape of the oil made fire fighting more difficult, and caused
some contamination of Lake Anna. If radioactivity had been
involved, the consequences could have been far more severe.
A number of events have been described in which fire suppression
water leaked through a floor and damaged equipment below. Leakage
paths include cracks (which are not structurally significant) in
concrete floors, unsealed construction joints, and openings for,
passage of vertical pipes, cable ways, etc., which do not have
water control seals or coamings.
.
Attachment 2
IN 83-41
June 22, 1983
Page 2 of 2
4. Common cause for concurrent actuation of many fire suppression
systems.
The Diablo event could be repeated at other sites, with more
serious consequences. Many facilities use smoke detectors to
actuate fire suppression systems. These smoke detectors are
subject to actuation by smoke from other areas, dust and, in some
cases, steam. Further, the remote siting of some of these
facilities makes them more susceptible to brush or grass fire
effects.
5. Problems that appear to relate to improper or inadequate design.
The Surry water contamination of diesel fuel oil is an example
where the designer did not perform a sufficient analysis of system
interactions.
The Farley events, the Grand Gulf event, and the Surry event give
evidence that the control system design was not tolerant of
operational or procedural errors.
Control systems for fire detection and suppression can take many
forms, such as pneumatic, hydraulic-electro-mechanical and direct
electric systems. In some instances initiation is caused by a
positive signal, in others, by removal of an inhibit control. In
most, if not all instances, electric power is involved. The power
supply needs to have high reliability, and the control systems
need to be carefully designed to minimize the probability of
either failure or inadvertent actuation.
In the Farley events the control system contained a pneumatic
inhibit device. When the air pressure decayed sufficiently, the
deluge system actuated.
At Grand Gulf, an intermittent ground in the control system caused
repeated discharge of C02 to a closed room until a closed and
locked door was blown open.
Events such as this could lead to the generation of missiles that
could damage equipment located in the area or, adjacent areas.
This damaged equipment may in turn be required to prevent or
mitigate reactor accidents. An event such as this could also allow
CO2 to enter the plant ventilation system and adversely affect
plant operating personnel.
.
Page Last Reviewed/Updated Tuesday, March 09, 2021