Improving fire safety at Kozloduy30 May 2001
A programme to improve fire protection measures forms a significant part of the upgrade of Kozloduy's two VVER-1000 units. By wolfgang hensel, wilfried neugebauer & tsvyatko tsvetkov
Soviet-designed VVER-type nuclear power plants are currently undergoing modernisation, upgrading and completion with support from the European Commission and other western European organisations. This support is being provided under the condition that the level of safety thus achieved will be comparable to that of modern western European PWR power plants.
Activities related to fire protection usually make up a large and very important part of such programmes. Typical weak points as regards fire protection have been identified at both VVER-440 (Models 230 and 213) and VVER-1000 plants. A lack of comprehensive safety target oriented fire hazard analyses and the inadequacy of individual fire protection measures can be seen as representing the main safety deficiencies.
The prime objective of any fire hazard analysis is to ensure that the following nuclear safety targets will be met in the event of a fire:
•Safe shutdown of the reactor.
•Maintenance of subcriticality after reactor shutdown.
•Removal of residual heat from the reactor core.
•Limitation of radioactive releases.
The performance of a deterministic fire hazard analysis is therefore a fundamental necessity because the results of such an analysis will determine the scope and priorities of any fire protection measures needed. In addition to being vital to plant safety, fire protection also serves to increase personnel safety, enhance plant availability and protect capital assets.
The Kozloduy programme
The general procedure involved in a fire hazard analysis is exemplified in the current project at the Bulgarian nuclear power plant units of Kozloduy 5 and 6.
Within the modernisation program initiated for Kozloduy, fire protection tasks accounted for an essential portion of the overall project scope.
Siemens and Framatome (now merged as Framatome ANP), and Bulgarian partners worked closely together on performing an extensive fire hazard analysis for all main buildings of the plant.
The analysis comprised the following two main steps:
•A deterministic fire hazard analysis was performed according to the internationally accepted IAEA safety guide (No. 50-SG-D2, Rev. 1) to determine the adequacy of passive and active fire protection measures in terms of nuclear safety.
•A fire-induced vulnerability evaluation was carried out according to the IAEA document “fire hazard analysis for VVER nuclear power plants” (IAEA-TECDOC-778, Vienna 1994) to quantify the fire hazards related to nuclear safety, and to rank the fire protection conditions in relevant areas.
Although complete documentation is usually not available for VVER-1000 plants regarding the fire protection concept originally implemented when the plants were built, the design of individual plant systems, components and buildings does provide an indication of the general fire protection methodology applied at the time.
The concept for fire protection applied at Kozloduy and other VVER-1000 plants is mainly oriented towards the following basic requirements:
•To ensure consistent physical separation of the systems needed for fulfillment of the plant’s safety targets.
•To reduce the risk of fire.
•To provide for automatic fire detection and fire suppression by active measures.
The existing fire protection concept is therefore based on the following features.
Building layout and system configuration
The mechanical components of the triply redundant safety systems, including their related systems, are consistently physically separated either by distance or by structures.
The rooms housing the electrical systems and instrumentation and control (I&C) equipment of each safety system’s three redundant trains are consistently located in three different parts of the reactor building outside the containment (hermetic zone). This general segregation is mainly implemented at the middle elevations of the building.
Cable routing inside the reactor building is also consistently based on separation of redundant trains by using different vertical cable shaft runs and horizontal main cable runs at different building elevations.
Reduction of general fire risk
To reduce the general fire risk, the most significant fire loads are either encapsulated (such as in the case of cables coated with a fire-retardant material) or structurally isolated (compartments containing oil storage and distribution equipment are physically separated from other compartments and are provided with active fire protection equipment).
Furthermore, administrative procedures are applied for controlling the use of combustible materials and for ensuring fire safety during maintenance and repair work.
Detection of fires
Several types of fire alarm systems are installed in specific rooms and areas of the main buildings of units 5 and 6 to detect a fire in its earliest possible stage. Smoke detectors are mainly provided in cable rooms, cable shafts, electrical and I&C equipment rooms. Temperature detectors are installed in the oil rooms. In addition, the area surrounding the main coolant pump motors is monitored using special devices.
The fire detection system automatically controls a number of ventilation components (fans and fire dampers) and fire suppression systems (water spray deluge systems for cable areas and oil tanks areas).
Mitigation of the effects of fires
To mitigate the effects of a fire, specific areas such as cable rooms, cable shafts and oil compartments are equipped with automatic water spray deluge systems. Several safety-related and non-safety-related I&C equipment cabinets are protected by gas extinguishing systems.
Hydrants are also installed in the anterooms of the staircases to support manual fire fighting actions by the fire brigade. Mobile equipment such as carbon dioxide and powder extinguishers is available as well.
Performance of analysis
The deterministic fire hazard analysis is intended to advise designers, safety assessors and regulators on recommended ways of implementing the concept of fire protection in practice. The analysis mainly comprised the following steps.
An essential prerequisite for a successful
fire hazard analysis is to have detailed knowledge and information concerning as-built conditions at the plant. Therefore, to properly prepare for the analysis, all necessary and relevant data must first be collected. This is usually done by carrying out extensive plant walkdowns and studying all available documents.
Room inventory data
Room inventory data was compiled to obtain information about the general situation in the rooms (such as room dimensions and fire loads), about existing structural fire protection measures (boundaries, ventilation components, penetrations and other openings) and about equipment-specific fire protection measures (fire detection, fire fighting, smoke extraction and heat removal).
In view of the fundamental aims of the fire protection concept, the study paid special attention to those systems which are needed for fulfilment of the plant safety targets. For this reason a systems analysis was carried out. This served to identify those systems whose operation would still be needed in the event a fire, the individual components belonging to these systems and their locations, and the main cable runs of the various redundant system trains.
Analysis of fire risks
The main fire loads were identified for each room in terms of their nature and quantity. Cables, oil, and electrical and I&C equipment cabinets represented the most frequently encountered types of fire loads.
Fire loads serve as a major criterion for defining fire compartments.
Definition of fire compartments and fire cells
On the basis of the information thus obtained, the necessary fire compartments and fire cells were defined according to the principles of the “fire containment approach” and the “fire influence approach” referred to in the IAEA safety guide.
The main criteria for defining fire compartments are:
•Arrangement of redundant safety equipment.
•Shape and architectural layout of building.
•Rooms of special importance.
Assessment of adequacy
Considering the as-built conditions and the specific requirements, the adequacy of the different parts of the fire protection system was assessed and, where necessary, recommendations were made for eliminating any identified deficiencies.
Ventilation systems and concept for fire dampers
The ventilation systems of the reactor building are arranged in a distributed configuration. This means that specific groups and types of rooms have their own air supply and exhaust systems. There are very few fire dampers, these being installed only in oil tank compartments and some of the cable rooms. The requirements to be met by the ventilation systems from a safety viewpoint are as follows:
•Fire and smoke must be confined to a small area within the plant to minimise their spread to and consequential effects on adjacent compartments and areas.
•The spread of smoke, heat and flames through ventilation ducts crossing fire compartment boundaries must be prevented.
•Safe access and escape routes must be provided for manual fire fighting and other manual actions. These must therefore be kept free of smoke and fire.
To fulfil these basic requirements, a number of new fire dampers are necessary at points where ventilation ducts cross and penetrate fire compartment boundaries. The figure below illustrates this, based on the example of a typical room.
Passive fire protection measures
All existing structural elements were identified and assessed. The actual fire protection quality (obtained from existing documentation or evaluated by engineering judgement) was compared with the required quality for fire compartments and fire cells. In cases of deficiencies, replacement or backfitting was recommended. Assessments were specifically carried out for:
•Walls and ceilings (including gaps and joints).
The fire detection system should detect the fire as soon as possible, initiate the necessary fire alarms and generate signals for triggering automatic fire extinguishing systems.
Based on the fact that a number of automatically controlled fixed fire extinguishing systems – in particular in the reactor building – are classified as “safety systems”, the corresponding fire detection system is also classified as such. Hence the design requirements resulted in a fire detection concept for “safety class” buildings that features:
•2-out-of-2 signalling for automatic triggering.
•Assignment of separate fire detection lines/loops and central units to redundant system trains.
•Design of components – particularly the central units – to withstand specific seismic loads (accelerations).
The adequacy of the existing types and locations of fire detectors and their technical features was also assessed. Selective seismic screening, especially for the central units, was implemented to provide a basis for decisions on necessary retrofitting measures.
The fire extinguishing systems and equipment were analysed and assessed. These included the fire water system, fixed fire extinguishing systems such as water spray deluge, fire hydrant and gas extinguishing systems, and mobile fire extinguishing equipment. Depending on the safety classification of the systems being protected, the water extinguishing systems are generally divided into “safety-related” and “non-safety-related”. This classification governs the design of the extinguishing system, including its actuation concept. The fire hazard analysis assessed the design and adequacy of all fire suppression systems.
Common cause failures due to fire
The failure of more than one redundant safety train due to a fire must not occur. In view of this requirement, the physical separation of redundant cable runs and redundant components was analysed taking local conditions and the potential local fire risk into account. The analysis was carried out in two steps. Firstly, an analysis of common cabling points to identify the existence of redundant cable runs at the same location and within close proximity of each other. And secondly, an analysis of “common mechanical points” to identify the existence of redundant safety-related components at the same location and within close proximity of each other. The analyses identified such locations and, where necessary, also recommended measures for ensuring adequate physical separation.
The following areas of the power plant were analysed and assessed separately due to their special importance:
•The main control room and the emergency control room in terms of their separation from one another from a fire protection viewpoint.
•The entire containment as regards the risk of an oil fire.
•The compartment containing the atmospheric steam dump stations and the steam generator safety valves due to its close proximity to the turbine building.
Performance of the fire hazard analysis resulted in comprehensive documentation being generated regarding the as-built fire protection conditions at the plant. This as-built documentation comprises:
•Detailed room data lists for all investigated buildings containing all room-specific information gathered during the data collection stage.
•Fire protection drawings with fire compartments and fire cells for all elevations of all investigated buildings.
For areas in which deficiencies were identified with respect to internationally accepted requirements, recommendations were formulated which, when implemented, will ensure an internationally acceptable level of fire safety.
The fire hazard analysis provides a basis for designing necessary fire protection upgrades. The main topics focused on by the fire hazard analysis were as follows.
Consolidation of fire compartments
To ensure consistent physical separation of redundant equipment and isolation of fire risks, first of all the existing fire doors and fire dampers will have to be qualified and additional fire doors and dampers installed at certain locations. Furthermore, requalification of the corresponding passive fire protection measures such as cable coatings and pipe and cable penetration seals will be necessary in order to achieve a documented level of fire resistance quality.
Comprehensive modernisation of detection system
Taking into account the existing fire risks and the requirements related to fire protection and seismic design, the new fire detection concept must be in line with the current standards of technology. Therefore improvements will focus on:
•Replacement of existing inadequate central units with new ones designed to retain their structural stability and functional capability under seismic loading.
•Provisions for modern monitoring and control features and for possible extensions in the future.
•Partial replacement of existing fire detectors/detection lines with new ones and installation of additional fire detection lines/loops in specific fire risk areas in order to ensure quick detection and addressability of individual detectors.
•Seismic requalification of remaining central units according to available documentation or by performing additional seismic tests.
•Seismic retrofitting of remaining central units, e.g. installation of additional stiffeners.
Control of oil fire risk in containment
The lubricating oil for the main coolant pumps represents the greatest potential fire risk inside the containment. To control this situation, adequate measures for suppressing an oil fire inside the containment are needed. Under some reactor operating conditions the containment airlock must not be breached. Even when this is allowed a significant delay has to be taken into account before manual fire fighting actions can start. Therefore manual fire fighting capabilities as well as fixed fire suppression systems must be provided as well.
The fire-induced vulnerability evaluation (FIVE) methodology is oriented towards uncovering plant fire vulnerabilities. It provides a combination of deterministic and probabilistic techniques for examining a power plant’s fire propagation and protection characteristics.
The FIVE methodology is a screening analysis and a useful tool for ranking the various plant fires according to their significance, as well as a technical basis for prioritising the implementation of plant improvements.
The screening analysis performed for Kozloduy comprised:
•Identification of those fire compartments or plant cells in which a fire would create a demand for safe shutdown.
•Calculation of the fire damage probability for each identified fire compartment or plant cell, which is the product of fire initiating frequency and unavailability of fire suppression. Rooms with a fire damage probability below a defined value (screening criterion) are screened out without further analysis.
•Evaluation of the probability that an attempted safe shutdown will be unsuccessful because of a fire event in the cell. Therefore the fire damage probability has to be multiplied by the alternative shutdown unavailability. The alternative shutdown unavailability is usually obtained from a plant probabilistic safety analysis (PSA). Rooms with a fire damage probability below a defined value are screened out without further analysis.
•For the remaining rooms, more detailed studies are needed. It is no longer assumed that a fire will disable all of the shutdown equipment. Instead, a detailed but conservative analysis of the fire growth and heat transmission is made. This analysis yields more detailed results regarding fire damage to equipment required for safe shutdown.
In general, the screening analysis verified certain basic results of the deterministic fire hazard analysis such as, for example, the necessity for:
•Provision of additional means of fire detection and fire fighting inside the containment area.
•Installation of fire detectors in cable corridors.
•Replacement of older parts of the fire detection system (such as fire detectors of insufficient sensitivity).
•Establishment of fire compartments for the main control room and the emergency control room.
A good foundation
In conclusion, it can be said that the fire protection conditions at the analysed VVER-1000 plant represent a good basis for ensuring fulfilment of the specified nuclear plant safety targets, provided that the recommended measures for replacement and backfitting are implemented.