- Email: [email protected]
Assessing the adequacy and reliability of fire barriers in nuclear power plants
Nuclear Engineering and Design 125 (1991) 367-376 North-Holland
367
Assessing the adequacy and reliability of fire barriers in nuclear power plants A.N. Beard a, G. Burke b and M.T. F i n u c a n e b a Unit of Fire Safety Engineering, University of Edinburgh, United Kingdom b UKAEA Safety & Reliability Directorate, Culcheth, Warrington, United Kingdom
Received February 1990
Fire barriers on nuclear power plants are essential for proper segregation of redundant trains of safety equipment. The contribution they make to nuclear safety is obviously significant, but difficult to quantify. As a result, the analysis of fire barriers for nuclear safety justification purposes tends to concentrate on demonstrating that they are adequate instead. The paper discusses various methods of analysing fire barriers and introduces work being completed on a method for quantifying the l'eliability of a fire barrier.
1. Introduction The concept of sub-dividing buildings into fire-resisting cells to contain fire and smoke spread is fundamental to good fire safety engineering design. The practice benefits life safety and property protection in normal buildings, while on nuclear power plants it also provides the segregation of safetyrelated systems which is necessary for nuclear safety. Fire segregation has been practiced for a number of years, nevertheless it is true to .say that there is very little historical data available on the actual performance of fire barriers in real fires. In the United Kingdom, national fire statistics are compiled from the longestablished fire report forms completed by Public Fire Brigades for every fire attended. The form covers items such as the extent of fi~'e damage and the presence and performance of fire protection systems. It does not refer to the performance of elements of construction which prevent fire spread, such as floors, walls, doors and penetration seals. The lack of statistical data obviously makes any quantification of the reliability of fire barriers difficult. This creates a problem with the safety justification for nuclear power plants, irrespective of whether the licencing approach is deterministic or probabilistic. Over the last two years, the subject has been under discussion [1,2]. Th~ general conclusions have been that: (a) fire barriers are a fundamental component of nuclear safety;
(b) fire barriers are not 100~ reliabie; (c) the exact contribution they make to nuclear safety is difficult to quantify, but should be determined. Since there are currently few, if any, methods of analysing the reliability of fire barriers, safety assessors depend to a larse extent on deterministic arguments which attempt to prove that the barrier is adequate to the task. Some of these arguments are discussed below.
2. The compliance argument The standard furnace test for elements of construction has changed little from the early part of this century. The low incidence of structural collapse in fires is taken as evidence that the standard, and the building codes that refer to it, provide an adequate, degree of structural fire safety. There is a great store of information on the performance of elements in furnace tests. Unless a novel or exceptional type of construction is being used, there is no need for a designer to subject elements to a test because many are already 'approved' or 'deemed to satisfy' constructions. The compliance argument is based on the premise that, providing the appropriate fire resistance rating is chosen for a barrier, that barrier is 'safe' and is expected to survive any fire to which it might be exposed in its lifetime. The required fire rating might be calculated using one of the simple methods discussed in the
0 0 2 9 - 5 4 9 3 / 9 1 / $ 0 3 . 5 0 © 1991 - Elsevier Science Publishers B.V. ( N o r t h - H o l l a n d )
A.N. Beard et al. / Assessing the adequacy and reliability
368
next section, or it might be imposed by building code requirements which are themselves often based on the same simple methods. There are a number of weaknesses in the argument. (i) It assumes the barrier is free of defects (e.g. inadequate firestopping around penetrations). (ii) It ignores the possibility of fire protection equipment failure (e.g. fire doors or ventilation dampers). (iii) It neglects all the well-documented difficulties of comparing the performance of barriers in the test with their performance in real fires (e.g. the limits on sample size and loading, variations between test furnaces, etc.). (iv) It assumes the selected fire rating is appropriate to the occupancy under consideration. The standard fire test is primarily a means of establishing a comparable measure of performance in an element of construction under precisely reprodu¢ibJe conditiens. It is most useful when new materials are being considered. The fire resistance ratings obtained in tests do not indicate times to failure in real fires, although this is often how the rating is interpreted. In general, the compliance argument is an over-simplified approach to a complex problem and is favoured by people who are non-experts in fire safety.
3. The fire severily arguments While the compliance argument does not concern itself with the actual performance of a barrier in a fire, these next methods do but only indirectly. The methods are all based around one argument which is that since a L:a:rier is known to survive a certain period in the standard furnace test, it will survive any real fire which is less severe than that furnace test. There are thus two aspects to this argument; predicting the fire severity in a room and then relating this to an equivalent period in the standard test.
4. Simple methods
The first load method (or fuel load or single parameter method) is the most basic version of the fire sever;.~y e:guments. It has been .and still is v~de!y used t~oth inside and outside the nuclear industry. The method derives essentially from experiments early this century. Ingberg [3] established that fire development is dependent on fire load after a series of full-scale fire tests where wooden cribs were burned in large, naturallyventilated compartments, The temperature profiles (' fire curves') obtained are equated to the standard furnace
1000
STANOARO
_ ~
300
. . . . . .
+,.. _~.
60
3O
TIME
(min)
Fig. 1. The equal-area concept.
_ , - , ~ - ~ -
-.
90
A.N. Beard et al. / Assessing the adequacy and reliability
test fire using the equal-area concept i.e. if the areas under different temperature profiles above a certain baseline (usually 150°C or 300°C) are equal, the fires have equal severity. Figure 1 illustrates this concept and table 1 shows the relationship found between fire resistance period and fire load density (given as a mass of wood per unit floor area). Application of the method simply requires a survey of the total mass of combustible materials in a room. These are converted to an equivalent mass of wood (according to the ratio of the heats of combustion) and expressed as a fire load density. This is equated to a period in the standard furnace test using table 1, extrapolating between values where necessary. The period found must not exceed the fire resistance rating of the compartment envelope. The validity of the method hinges on the assumption that fire severity can be defined using only one parameter. In other words, an amount of fuel cmmot cause a more severe fire than is defined in the table. This assumption obviously fails if, under certain condition% an amount of fuel is found to give a more severe fire. Such conditions can be found, particularly in nuclear facilities with relatively restricted ventilation, mostly liquid hydrocarbon or synthetic fuels and lower heat losses from compartments. In the method developed by Law [4], the fire resistance requirement is expressed as a function of the total fire load, the ventilation area and the internal surface area of the room. The relationship is derived from analysis of the response of an insulated steel column to both real fires and the standard test and uses data from the extensive series of full-scale fire tests by the CIB. The relationship found is shown in fig. 2.
Table 1 lngberg's fuel-load-fire-severity relationship Combustible content a (wood equivalent) lb/ft2
kg/m 2
10 15 20 30 40 50 60
49 73 98 146 195 244 293
Equivalent (MJ/m 2 a,b)
Standard fire duration (h)
0.90 1.34 1.80 2.69 3.59 4.49 5.39
1 1.5 2 3 4.5 6 7.5
" Calculated on the basis of floor area. b Heat of combustion of wood taken as 18.4 kJ/g.
369
1200 1000
o
800
6oo m, i,w
o. 4,00 T200
1
2
3 t0 5 TIME - h Fig. 2. Correlation between fire resistance requirements and a 3-parameter characterisation of fire severity.
This simple relationship has obvious advantages in terms of practical engineering application, it uses the three classic parameters to characterise fire severity and it relates to the standard test. However, there is a dependency on insulated steel elements which is limiting, while the u ~ of empirical da!a from naturallyventilated fires prevents application to fires on nuclear plant.
5. Sophisticated methods
Pettersson [5] offers a method for determining the required fire r~sistance rating entirely by calculation using computer models. Fire curves are calculated by solving the equ~tions for heat balance in a room fire. Temperature development in a steel element is then calculated using simple one-dimensional heat transfer theory, the Tailur~ temperature being found from knowledge of materi~ properties at elevated temperatures. Figure 3 shows a typical chart giving families of fire curves characteri=ed by an 'opening factor' (the ventilation and room s~,xface parameters) and fire load. The curves can be ad~pted for walls with different thermal properties. The first li~fitation of this method is that concrete barriers are largely excluded because it is considerably more difficult tc model the thermomechanical response of concrete tha~:: it is for steel. Also, the fire curve predictions are dependent on empirical relationships, particularly th:,~ for buoyancy-induced flow through a vent, so the av, ,fication to nuclear plant fires remains to be proven. Fi~lally, this is a 'best-estimate' method of
370
A.N. Beard et aL / Assessing the adequacy and reliability
/
160
1 &O ..m. C
"~ 120 taJ t.i
z< [ 100
0o
"I
"wn' ac~80t u.
6O
0
°
I--
•
i1
~,,.
• P •
20
[a r
0
f
20
o/ 4,
41,
,~
4,0
i
I
I
I
I
I
60
80
100
120
1/,0
160
LI ( AwATflz -kg/mz
Fig. 3. Theoretical temperature/time curves for different fire load densities and opening factors.
fire prediction. Since the method only gives a 'fail' or 'no fail' prediction for a barrier, the lack of safety factors in the calculations makes it unsatisfactory for nuclear applications. Berry [6] also predicts fire curves using a similar computer model to solve the heat balance equations for a room. However, it is argued that since rooms in nuclear plants are so difierent from domestic rooms, the heat losses from the room should be underestimated and the oxygen supply to the room maximised. The computer fire model thus assumes that heat is only lost from the room gases to the room surfaces. All other soarces of heat loss, e.g. buoyancy-driven hot gas flow out of the vent, are ignored. Since the convective ~heat losses from a domestic room fire can account for up to 60% of the total heat generated in a fire, this assumptions makes for very conservative temperature predictions. Because nuclear plant rooms are all broadly similar., other va:':.ables in the model (such as wall thermal conductivity etc.) can be taken as constants. Thus, the
fire curve for a typical nuclear plant room can be characterised by only three parameters; mass of fuel, ventilation rate and room surface area. The predicted fire curves are compared with the standard test curve. By simple inspection, if the predicted curve exceeds the standard in terms of either temperature of duration, then the predicted fire is more severe. Again, this comparison introduces another conservatism. The method is illustrated in fig. 4. Using the model, the design chart in fig. 5 can be drawn which shows combinations of the three parameters giving a fire which is equivalent to a certain period in the standard test. Using the chart, one can rapidly assess a room to determine whether the likely fire severity exceeds the rating of the room boundaries. The chart relates only to solid combustible fire loads, but has been extended by others to cater for hydrocarbon pool fires, as fig. 6 shows. The presentation of the results is slightly different as the fire severity requires four parameters for characterisation - room surface area, ventilation rate, pool area (which governs temper-
A.N. Beard et al. / Assessing the adequacy and reliability
371
1200
/"qUa-STANDARD FIRE CURVE
1100
1000
800
700
~-
S00
f ,/
Q. E taJ
:.-
TEMPERATURE • STANDARD CURVE "FIRE SEVERITY • STANDARD FIRE
b)
FIRE SEVERITY < STANDARD FIRE
c)
FIRE DURATION > 3 HOURS •".FIRE SEVERITY • STANDARD FIRE
\
c
/
n~
a) ,
I/I
~J
600
b
///
|
""
3 HOUR DURATION
/,/
o
~-
i
/,
900
•
11
/
/ r
I
I
~
f,O0
/
3O0 20O 100
1
'
/
\
\\
\
\ \
0
o
30
60
qo
120
150 180 21o TIME (t) HIN
2t,o
270
300
360
330
Fig. 4. Comparison of fire curves. 45O I
400
350 o
300
I--
<
250,
O
200
,,J "!-
////
/
J
~
~
TEMPERATURE-LIMIT
..
150 O
<
100 50
u.
0
5
10
1
!
15
20
25
AIR RATE ( k g l s - m 2 OF HEAT LOSS AREA)M 10-3
Fig. 5. Acceptable fuel load and ventilation combinations assuming heat loss into wall only.
A.N. Beard et al. / Assessing the adequacy and reliability
372
A
20
KG OF FUEL
. .
.,,i o o
K¢
/ l
/
',
ee'
0 0
S
10
1S
20
AIR RATE WALL AREA
25
30
3S
~0
( gls - mz)
Fig. 6.
ature development) and mass of fuel (which governs duration). A fire severity comparison is also made with a notional hydrocarbon fire standard. This method has a number of advantages, particularly the use of a simple computer code which makes conservative predictions for room gas temperatures. The code is demonstrably 'safe' in its predictions. If some form of room-by-room analysis is available on a database, the whole plant can be assessed very rapidly by applying these simple rules as it' for spreadsheet operations. If the user finds a room where the predicted fire severity is greater than the barrier rating, there is scope to use progressively less conservative assumptions in the
model until best-estimates are reached. If the problem remains, design changes must be made. The thermomechanical behaviour of a barrier can now be modelled reasonably accurately using computer codes based around finite element or field modelling techniques [7]. Given an actual or predicted heating regime, the deformation and failure of elements, composites or complete structures can be estimated including for example crack prediction for concrete elements. These codes combine empirical knowledge, essentially for material properties, with purely theoretical algorithms for structural analysis. Figure 7 shows some predictions for temperature development and deforma-
A.N. Beard et at / Assessing the adequacy and reliability TEMPERATURE
PROFILES
AFTER
373
112 MtNS INFLUENCE
1200
OF LOAD
250 1000 200 MEASURED TEMPERATURE
0... 800
E ~- 150
600
t,lJ r Lk/
A,00
O. L~
II, I O.
z
<_, 100
60
200
0
I
I
I
I
I
I
l
20
/~0
60
80
100
120
lZ, O
DIST. FROM --X-,. MEASURED --A--
ABAQUS ( h i g h
EXPOSED
0 160
0
1
FACE (ram)
- - o - - ABAOUS cond.)
I 2
I 3
I z,
TIME ( I 1000sec$ ) --
MEASURED ( NO LOAD )
--0--ABAOUS
--O-- ABAQUS
LOAD 1500 MPa
Fig. 7. Temperature profiles through slab (a, left) and mid-point deflection of slab (b, fight) (ABAQUS-predictions).
tion of a concrete slab in the standard furnace test. The predictions of such models are sufficiently accurate to be considered as serious alternatives to full-scale fire testing. However, in terms of practica~ engineering application, they are limited by the large amount of computing power and expertise required.
along with stochastic teclmiques to obtain probability distributions for fire consequences. In the case of OSFIC, for example, Monte Carlo techniques are applied to vary the size and location of pool fires in a pump room to determine the likelihood of fire damage to the pump. To date, there is no published work on the application of such methods to the analysis of barriers, but in principle they appear suitable.
6. The prol~bilisfic arguments
6.2. Fully probabilistic methods Some of the previous methods for assessing fire barriers might demonstrate adequacy but cannot quantify barrier reliability because they only predict 'failure' or 'no failure'. The onus is therefore on the safety assessor to show that the maximum fire severity has been correctly predicted for any room. Probabilistic models are more suitable for fire barrier reliability studies because they output event probabilities. They calculate likely fire effects from statistical data and are not concerned with the physical parameters of a fire of the termomechanical response of the barrier.
6.1. Semi-probabifistic methods One way of obtaining event probabilities is to combine deterministic and probabilistic methods. Examples of these would be the COMPBRN [8] and OSFIC [9] computer c~:les which use deterministic fire models
A computer program called ARSSUN [10] has been developed to model fire spread through a building or plant probabilistic~ly. It is similar in principle to other such models, representing the building layout as a network of nodes (the rooms) connected by paths (the barriers) along which the fire spreads. A problem with such programs is that they require as input the probability of barrier failure due to fire. The lack of data on this subject prompted the development of a theoretical framework to find the probability of failure of a barrier. A number of base events emerged in the analysis for which probabilities need to be found. Until these base events and their relationships are investigated, a framework is suggested for estimating the base event probabilities. The Appendix describes the logic diagrams in figs. 8 and 9 which are used to ident;;fy base events for barrier
374
A.N. Beard et ai. / Assessing the adequacy and reliability FIGURE 8, NOTION BEING: F: G: F/G: Gi: !: Fi
FaiLure ParticuLar case F given G Constitutive possibility for G
pl["~
Ignition
:
F and
I o,,-
~: So: ~"~:
Not (Ignition) Suppression activity Not (Suppression activity)
11 '
lgnitien not adjocen.*" to the barrier vhich produces a post-
""
A • jfNJ
j=l
P2
ftashover fire 12:
Ignition not adjacent to the barrier vhich does not produce o post-floshover fire
13:
Ignition
II1:
Constitutive
adjacent to the barrier possibility for 11
Pll
P12
%
~~a125jtgaZ6j /I~ [~al3Gj/SalGjJ P19 Pl? Pie Similar to 11 SimiLar to 11
I FISallGji Gj.,__ ~a|1 /G=.._jj ~a| 1 ~ ~ P16 1-N 1
,,ol,,.,.o,, ii,O,l,O,,,o,,o,j.,, To Figure 9
Fig. 8. Logic diagram for fire barrier failure.
failure. Data is available for some of these events, but values for other have to be estimated. This will be acxomplished using a set of indices to represent a particular barrier component, for example, the continuum part of a barrier (such as a wall) can be represented by
five indices covering continuum type, thickness, fire resistance rating, maintenance state and damage state. A reference continuum can be defined corresponding to an assignment to each index. Deviations from the reference continuum can then be considered. Similar
A.N. Beard et al. / Assessing the adequacy and reliability
arguments can be made for the door and penetration components, adding size and position as indices. Until such time as sufficient data becomes available, it is intended to use Delphi techniques to estimate base event probabilities. (Delphi = expert group opinion.)
7. Conclusions It would be true to say th~-t fire b-~.'~er re~abLUty on nuclear power plants has long been taken for granted. This attitude is changing because, on the one hand,
/ ~IF~/ [Pa | 2l t Goj
J
P21
P29
375
P22
~"l
~'sl
P)O
P31
! ~o" ~°"'°~1 ! ~,'~'" ~°~1
P,6 ]
J
P27
Pko
P28
P&I
I~ ~'~' ~~°*'~,~,~o,'~°'~°JJ
iP34.1 '~,u'~",, °,II~,. '~°',, °, I IP36.1 ~,.'~°', ~°~ I I ~., °'~°',,P37.1 °, I l ~,.'~",, P30.°~I I ~o,-'~",,P39.1°,I P35.1 Figure 9 . notation being: Fy : Failure via a single component ie. continuum, door, perforation Faiture directly involving a combination of components Fyc: Failure via continuum port Fyd: Failure via o door F,/p: Failure via o perforation F?cu: Failure via continuum part. insulation first Fycv: Failure via continuum part. integrity first Fycv: Failure via continuum part. stability first Fydl: Failure via door 1 ( likevise door 2 ) Fydlu: Failure via door 1. insulation first F?dly: Failure via door 1, integrity first Fydlv: Failure via door 1. stebility first Flrpl: Failure via perforation 1 ( iikevise perf. 2 ) Fyplu: Failure vie perforation 1. insulation first Fyplv: Failure via perforation 1. integrity first Fyplw: Fnilure via perforation 1. stability first FiBu. Failure directly involving o combination of components, via insulation Fjv: Failure directly involving a combination of components.via integrity FJv" Failure directly involving a combination of components, via stability ,'llSU(av):Failure directly tnvolving a combination of components . via i.'.sulation and the average temperature criterion FGullO¢)Faiture directly involving a combination of components, via insulation and the local temperature criterion
FB:
Fig. 9. Logic diagram (continued).
376
A.N. Beard et al. / Assessing the adequacy and reliability
some nuclear regulatory authorities are questioning our previous assumptions and, on the other hand, new tools are being developed to assess fire barriers. Suitable methods exist for determining the adequacy of a fire barrier but they can only predict 'failure' or 'no failure'. A combination of deterministic and probabilistic techniques could be a fruitful way of avoiding this problem, but has yet to be explored. At least one fully probabilistic method for determining the reliability of a fire barrier has been developed but requires data for base event probabilities. Until this information is available, a method is suggested to synthesize the required data.
Appendix: Probability of failure of a barrier It is desired to fi.~d *.be probability of fai~.at-e of a barrier in a particular case. The final probability of interest may be denoted by P ( F / G ) where G refers to the characteristics of a particular case which generally cover: (a) material properties; (b) geometrical characteristics; (c) ambient conditions; and (d) directly human characteristics. A particular configuration corres'~onds to an assignment for each of these characteristics and may be denoted by Gj. A particular case will cola'espond to a particular configuration, but which one may not be known. For example, one configuration may correspond to 'door open' and another to 'door closed'. P ( F / G ) may be decomposed as illustrated in the lo~c trees of figs. 8 and 9. The y-arm corresponds to failure occuring through a single component, where component means one of: (a) the continuum part of the barrier; (b) a door; (c) a perforation. This is indicated in the breakdown of P21 into/'23, P24 and P2s. P23 is broken down in to failure via insulation, integrity or stability first (u, v, w)./'24 is broken down with respect to the doors (i.e. dl, d2 etc.). P32a, pertaining to door 1, is broken down into failure via insulation, integrity or stability. Likewise for other doors. The B-arm corresponds to a failure which directly involves a combination of components. For example: (i) a crack which may cross an interface between two components such as a section of a continuum and a perforation; (ii) a stability failure which may only have meaning when considering the entire barrier; (iii) failure via the average temperature criterion which may involve several components. P22 has been decomposed into failure via insulation, integrity and stability and P26 broken down into failure via the average temperature criterion (Pao) and via the local temperature criterion
(P41).
Precisely which constituent probabilities it is desired to estimate depends upon the particular case and the objectives of the user. For example, it may be decided to ignore suppression activity or not, or it may be decided to ignore the branches associated with 12 and 13 or not. In principle, failure from a non-fire cause is also included (e.g. earth tremor). In the longer term, work needs to be conducted in order to be able to estimate all the constituent probabilities. In the immediate term, a procedure has been suggested to assist estimation. There is insufficient space here to go into details but, as an example, P2t will be considered to some degree. In general, below P2t there are three subsets: (a) the continuum subset /'29, P30, P31; (b) the door subset P34.,., P3s.,., P36.,. for door m; (c) the perforation sobset F37.,.. P3s.m, /'39.,. for perforation m. The user has to decide which cut set needs to be estimated. Each of the probabilities of concert,, may be examined from a Bayesian point of view. Such techniques are valuable because they provide a systematic way of combining empirical information and engineerin~ judgement.
References [1] M.T. Finucane, Information and tools required for a fire PSA, Seminar on Int. Approach to Nuclear Reactor Safety, Blackpool, 8-10 June, 1988. [2] M.P. Bohn et al., Fire risk scoping study: investigation of nuclear power plant fire risk, including previously unaddressed issues, NUREG/CR-5088 (SAND88-0177) January, 1989. [3] S.H. Ingberg, Fire loads, Quarterly Journal of the NFPA, No. 22 (1928). [4] M. Law, A relationship between fire grading and building design and contents, Fire research Note No. 877 (1972). [5] O. Pettersson, et al., Fire engineering design of steel st~ructures~ Swedish Institute of Steel Construction, Pubfic~tfion 50 (1976). [6] D.L. Berry Analysis of fire barriers within nuclear power plants, Nuclear Technology 53 (May 1987). [7] R.C.B. Judge, Modelling the failure of reinforced concrete structural members subjected to fire loading, Proc. ABAQUS User's Conf., Stresa, Italy, May 1989. [8] G. Apostolakis et al., COMPBRN II! - a fire hazard model for risk analysis, Fire Safety Journal (1988). [9] B. Karlsson and J. Nirmark, Fire risk analysis in nuclear power plants - use of the computer programs DSLAYV •rod OSFIC, IAEA-SM-305/73, Vienna (March 1989). [101 D.D. Drysdale and M. F~nucane, Probabilistic method to consider fire attack on the segregated safety systems in a nuclear plant, IAEA-CN 48/203, Vienna (October 1987)
367
Assessing the adequacy and reliability of fire barriers in nuclear power plants A.N. Beard a, G. Burke b and M.T. F i n u c a n e b a Unit of Fire Safety Engineering, University of Edinburgh, United Kingdom b UKAEA Safety & Reliability Directorate, Culcheth, Warrington, United Kingdom
Received February 1990
Fire barriers on nuclear power plants are essential for proper segregation of redundant trains of safety equipment. The contribution they make to nuclear safety is obviously significant, but difficult to quantify. As a result, the analysis of fire barriers for nuclear safety justification purposes tends to concentrate on demonstrating that they are adequate instead. The paper discusses various methods of analysing fire barriers and introduces work being completed on a method for quantifying the l'eliability of a fire barrier.
1. Introduction The concept of sub-dividing buildings into fire-resisting cells to contain fire and smoke spread is fundamental to good fire safety engineering design. The practice benefits life safety and property protection in normal buildings, while on nuclear power plants it also provides the segregation of safetyrelated systems which is necessary for nuclear safety. Fire segregation has been practiced for a number of years, nevertheless it is true to .say that there is very little historical data available on the actual performance of fire barriers in real fires. In the United Kingdom, national fire statistics are compiled from the longestablished fire report forms completed by Public Fire Brigades for every fire attended. The form covers items such as the extent of fi~'e damage and the presence and performance of fire protection systems. It does not refer to the performance of elements of construction which prevent fire spread, such as floors, walls, doors and penetration seals. The lack of statistical data obviously makes any quantification of the reliability of fire barriers difficult. This creates a problem with the safety justification for nuclear power plants, irrespective of whether the licencing approach is deterministic or probabilistic. Over the last two years, the subject has been under discussion [1,2]. Th~ general conclusions have been that: (a) fire barriers are a fundamental component of nuclear safety;
(b) fire barriers are not 100~ reliabie; (c) the exact contribution they make to nuclear safety is difficult to quantify, but should be determined. Since there are currently few, if any, methods of analysing the reliability of fire barriers, safety assessors depend to a larse extent on deterministic arguments which attempt to prove that the barrier is adequate to the task. Some of these arguments are discussed below.
2. The compliance argument The standard furnace test for elements of construction has changed little from the early part of this century. The low incidence of structural collapse in fires is taken as evidence that the standard, and the building codes that refer to it, provide an adequate, degree of structural fire safety. There is a great store of information on the performance of elements in furnace tests. Unless a novel or exceptional type of construction is being used, there is no need for a designer to subject elements to a test because many are already 'approved' or 'deemed to satisfy' constructions. The compliance argument is based on the premise that, providing the appropriate fire resistance rating is chosen for a barrier, that barrier is 'safe' and is expected to survive any fire to which it might be exposed in its lifetime. The required fire rating might be calculated using one of the simple methods discussed in the
0 0 2 9 - 5 4 9 3 / 9 1 / $ 0 3 . 5 0 © 1991 - Elsevier Science Publishers B.V. ( N o r t h - H o l l a n d )
A.N. Beard et al. / Assessing the adequacy and reliability
368
next section, or it might be imposed by building code requirements which are themselves often based on the same simple methods. There are a number of weaknesses in the argument. (i) It assumes the barrier is free of defects (e.g. inadequate firestopping around penetrations). (ii) It ignores the possibility of fire protection equipment failure (e.g. fire doors or ventilation dampers). (iii) It neglects all the well-documented difficulties of comparing the performance of barriers in the test with their performance in real fires (e.g. the limits on sample size and loading, variations between test furnaces, etc.). (iv) It assumes the selected fire rating is appropriate to the occupancy under consideration. The standard fire test is primarily a means of establishing a comparable measure of performance in an element of construction under precisely reprodu¢ibJe conditiens. It is most useful when new materials are being considered. The fire resistance ratings obtained in tests do not indicate times to failure in real fires, although this is often how the rating is interpreted. In general, the compliance argument is an over-simplified approach to a complex problem and is favoured by people who are non-experts in fire safety.
3. The fire severily arguments While the compliance argument does not concern itself with the actual performance of a barrier in a fire, these next methods do but only indirectly. The methods are all based around one argument which is that since a L:a:rier is known to survive a certain period in the standard furnace test, it will survive any real fire which is less severe than that furnace test. There are thus two aspects to this argument; predicting the fire severity in a room and then relating this to an equivalent period in the standard test.
4. Simple methods
The first load method (or fuel load or single parameter method) is the most basic version of the fire sever;.~y e:guments. It has been .and still is v~de!y used t~oth inside and outside the nuclear industry. The method derives essentially from experiments early this century. Ingberg [3] established that fire development is dependent on fire load after a series of full-scale fire tests where wooden cribs were burned in large, naturallyventilated compartments, The temperature profiles (' fire curves') obtained are equated to the standard furnace
1000
STANOARO
_ ~
300
. . . . . .
+,.. _~.
60
3O
TIME
(min)
Fig. 1. The equal-area concept.
_ , - , ~ - ~ -
-.
90
A.N. Beard et al. / Assessing the adequacy and reliability
test fire using the equal-area concept i.e. if the areas under different temperature profiles above a certain baseline (usually 150°C or 300°C) are equal, the fires have equal severity. Figure 1 illustrates this concept and table 1 shows the relationship found between fire resistance period and fire load density (given as a mass of wood per unit floor area). Application of the method simply requires a survey of the total mass of combustible materials in a room. These are converted to an equivalent mass of wood (according to the ratio of the heats of combustion) and expressed as a fire load density. This is equated to a period in the standard furnace test using table 1, extrapolating between values where necessary. The period found must not exceed the fire resistance rating of the compartment envelope. The validity of the method hinges on the assumption that fire severity can be defined using only one parameter. In other words, an amount of fuel cmmot cause a more severe fire than is defined in the table. This assumption obviously fails if, under certain condition% an amount of fuel is found to give a more severe fire. Such conditions can be found, particularly in nuclear facilities with relatively restricted ventilation, mostly liquid hydrocarbon or synthetic fuels and lower heat losses from compartments. In the method developed by Law [4], the fire resistance requirement is expressed as a function of the total fire load, the ventilation area and the internal surface area of the room. The relationship is derived from analysis of the response of an insulated steel column to both real fires and the standard test and uses data from the extensive series of full-scale fire tests by the CIB. The relationship found is shown in fig. 2.
Table 1 lngberg's fuel-load-fire-severity relationship Combustible content a (wood equivalent) lb/ft2
kg/m 2
10 15 20 30 40 50 60
49 73 98 146 195 244 293
Equivalent (MJ/m 2 a,b)
Standard fire duration (h)
0.90 1.34 1.80 2.69 3.59 4.49 5.39
1 1.5 2 3 4.5 6 7.5
" Calculated on the basis of floor area. b Heat of combustion of wood taken as 18.4 kJ/g.
369
1200 1000
o
800
6oo m, i,w
o. 4,00 T200
1
2
3 t0 5 TIME - h Fig. 2. Correlation between fire resistance requirements and a 3-parameter characterisation of fire severity.
This simple relationship has obvious advantages in terms of practical engineering application, it uses the three classic parameters to characterise fire severity and it relates to the standard test. However, there is a dependency on insulated steel elements which is limiting, while the u ~ of empirical da!a from naturallyventilated fires prevents application to fires on nuclear plant.
5. Sophisticated methods
Pettersson [5] offers a method for determining the required fire r~sistance rating entirely by calculation using computer models. Fire curves are calculated by solving the equ~tions for heat balance in a room fire. Temperature development in a steel element is then calculated using simple one-dimensional heat transfer theory, the Tailur~ temperature being found from knowledge of materi~ properties at elevated temperatures. Figure 3 shows a typical chart giving families of fire curves characteri=ed by an 'opening factor' (the ventilation and room s~,xface parameters) and fire load. The curves can be ad~pted for walls with different thermal properties. The first li~fitation of this method is that concrete barriers are largely excluded because it is considerably more difficult tc model the thermomechanical response of concrete tha~:: it is for steel. Also, the fire curve predictions are dependent on empirical relationships, particularly th:,~ for buoyancy-induced flow through a vent, so the av, ,fication to nuclear plant fires remains to be proven. Fi~lally, this is a 'best-estimate' method of
370
A.N. Beard et aL / Assessing the adequacy and reliability
/
160
1 &O ..m. C
"~ 120 taJ t.i
z< [ 100
0o
"I
"wn' ac~80t u.
6O
0
°
I--
•
i1
~,,.
• P •
20
[a r
0
f
20
o/ 4,
41,
,~
4,0
i
I
I
I
I
I
60
80
100
120
1/,0
160
LI ( AwATflz -kg/mz
Fig. 3. Theoretical temperature/time curves for different fire load densities and opening factors.
fire prediction. Since the method only gives a 'fail' or 'no fail' prediction for a barrier, the lack of safety factors in the calculations makes it unsatisfactory for nuclear applications. Berry [6] also predicts fire curves using a similar computer model to solve the heat balance equations for a room. However, it is argued that since rooms in nuclear plants are so difierent from domestic rooms, the heat losses from the room should be underestimated and the oxygen supply to the room maximised. The computer fire model thus assumes that heat is only lost from the room gases to the room surfaces. All other soarces of heat loss, e.g. buoyancy-driven hot gas flow out of the vent, are ignored. Since the convective ~heat losses from a domestic room fire can account for up to 60% of the total heat generated in a fire, this assumptions makes for very conservative temperature predictions. Because nuclear plant rooms are all broadly similar., other va:':.ables in the model (such as wall thermal conductivity etc.) can be taken as constants. Thus, the
fire curve for a typical nuclear plant room can be characterised by only three parameters; mass of fuel, ventilation rate and room surface area. The predicted fire curves are compared with the standard test curve. By simple inspection, if the predicted curve exceeds the standard in terms of either temperature of duration, then the predicted fire is more severe. Again, this comparison introduces another conservatism. The method is illustrated in fig. 4. Using the model, the design chart in fig. 5 can be drawn which shows combinations of the three parameters giving a fire which is equivalent to a certain period in the standard test. Using the chart, one can rapidly assess a room to determine whether the likely fire severity exceeds the rating of the room boundaries. The chart relates only to solid combustible fire loads, but has been extended by others to cater for hydrocarbon pool fires, as fig. 6 shows. The presentation of the results is slightly different as the fire severity requires four parameters for characterisation - room surface area, ventilation rate, pool area (which governs temper-
A.N. Beard et al. / Assessing the adequacy and reliability
371
1200
/"qUa-STANDARD FIRE CURVE
1100
1000
800
700
~-
S00
f ,/
Q. E taJ
:.-
TEMPERATURE • STANDARD CURVE "FIRE SEVERITY • STANDARD FIRE
b)
FIRE SEVERITY < STANDARD FIRE
c)
FIRE DURATION > 3 HOURS •".FIRE SEVERITY • STANDARD FIRE
\
c
/
n~
a) ,
I/I
~J
600
b
///
|
""
3 HOUR DURATION
/,/
o
~-
i
/,
900
•
11
/
/ r
I
I
~
f,O0
/
3O0 20O 100
1
'
/
\
\\
\
\ \
0
o
30
60
qo
120
150 180 21o TIME (t) HIN
2t,o
270
300
360
330
Fig. 4. Comparison of fire curves. 45O I
400
350 o
300
I--
<
250,
O
200
,,J "!-
////
/
J
~
~
TEMPERATURE-LIMIT
..
150 O
<
100 50
u.
0
5
10
1
!
15
20
25
AIR RATE ( k g l s - m 2 OF HEAT LOSS AREA)M 10-3
Fig. 5. Acceptable fuel load and ventilation combinations assuming heat loss into wall only.
A.N. Beard et al. / Assessing the adequacy and reliability
372
A
20
KG OF FUEL
. .
.,,i o o
K¢
/ l
/
',
ee'
0 0
S
10
1S
20
AIR RATE WALL AREA
25
30
3S
~0
( gls - mz)
Fig. 6.
ature development) and mass of fuel (which governs duration). A fire severity comparison is also made with a notional hydrocarbon fire standard. This method has a number of advantages, particularly the use of a simple computer code which makes conservative predictions for room gas temperatures. The code is demonstrably 'safe' in its predictions. If some form of room-by-room analysis is available on a database, the whole plant can be assessed very rapidly by applying these simple rules as it' for spreadsheet operations. If the user finds a room where the predicted fire severity is greater than the barrier rating, there is scope to use progressively less conservative assumptions in the
model until best-estimates are reached. If the problem remains, design changes must be made. The thermomechanical behaviour of a barrier can now be modelled reasonably accurately using computer codes based around finite element or field modelling techniques [7]. Given an actual or predicted heating regime, the deformation and failure of elements, composites or complete structures can be estimated including for example crack prediction for concrete elements. These codes combine empirical knowledge, essentially for material properties, with purely theoretical algorithms for structural analysis. Figure 7 shows some predictions for temperature development and deforma-
A.N. Beard et at / Assessing the adequacy and reliability TEMPERATURE
PROFILES
AFTER
373
112 MtNS INFLUENCE
1200
OF LOAD
250 1000 200 MEASURED TEMPERATURE
0... 800
E ~- 150
600
t,lJ r Lk/
A,00
O. L~
II, I O.
z
<_, 100
60
200
0
I
I
I
I
I
I
l
20
/~0
60
80
100
120
lZ, O
DIST. FROM --X-,. MEASURED --A--
ABAQUS ( h i g h
EXPOSED
0 160
0
1
FACE (ram)
- - o - - ABAOUS cond.)
I 2
I 3
I z,
TIME ( I 1000sec$ ) --
MEASURED ( NO LOAD )
--0--ABAOUS
--O-- ABAQUS
LOAD 1500 MPa
Fig. 7. Temperature profiles through slab (a, left) and mid-point deflection of slab (b, fight) (ABAQUS-predictions).
tion of a concrete slab in the standard furnace test. The predictions of such models are sufficiently accurate to be considered as serious alternatives to full-scale fire testing. However, in terms of practica~ engineering application, they are limited by the large amount of computing power and expertise required.
along with stochastic teclmiques to obtain probability distributions for fire consequences. In the case of OSFIC, for example, Monte Carlo techniques are applied to vary the size and location of pool fires in a pump room to determine the likelihood of fire damage to the pump. To date, there is no published work on the application of such methods to the analysis of barriers, but in principle they appear suitable.
6. The prol~bilisfic arguments
6.2. Fully probabilistic methods Some of the previous methods for assessing fire barriers might demonstrate adequacy but cannot quantify barrier reliability because they only predict 'failure' or 'no failure'. The onus is therefore on the safety assessor to show that the maximum fire severity has been correctly predicted for any room. Probabilistic models are more suitable for fire barrier reliability studies because they output event probabilities. They calculate likely fire effects from statistical data and are not concerned with the physical parameters of a fire of the termomechanical response of the barrier.
6.1. Semi-probabifistic methods One way of obtaining event probabilities is to combine deterministic and probabilistic methods. Examples of these would be the COMPBRN [8] and OSFIC [9] computer c~:les which use deterministic fire models
A computer program called ARSSUN [10] has been developed to model fire spread through a building or plant probabilistic~ly. It is similar in principle to other such models, representing the building layout as a network of nodes (the rooms) connected by paths (the barriers) along which the fire spreads. A problem with such programs is that they require as input the probability of barrier failure due to fire. The lack of data on this subject prompted the development of a theoretical framework to find the probability of failure of a barrier. A number of base events emerged in the analysis for which probabilities need to be found. Until these base events and their relationships are investigated, a framework is suggested for estimating the base event probabilities. The Appendix describes the logic diagrams in figs. 8 and 9 which are used to ident;;fy base events for barrier
374
A.N. Beard et ai. / Assessing the adequacy and reliability FIGURE 8, NOTION BEING: F: G: F/G: Gi: !: Fi
FaiLure ParticuLar case F given G Constitutive possibility for G
pl["~
Ignition
:
F and
I o,,-
~: So: ~"~:
Not (Ignition) Suppression activity Not (Suppression activity)
11 '
lgnitien not adjocen.*" to the barrier vhich produces a post-
""
A • jfNJ
j=l
P2
ftashover fire 12:
Ignition not adjacent to the barrier vhich does not produce o post-floshover fire
13:
Ignition
II1:
Constitutive
adjacent to the barrier possibility for 11
Pll
P12
%
~~a125jtgaZ6j /I~ [~al3Gj/SalGjJ P19 Pl? Pie Similar to 11 SimiLar to 11
I FISallGji Gj.,__ ~a|1 /G=.._jj ~a| 1 ~ ~ P16 1-N 1
,,ol,,.,.o,, ii,O,l,O,,,o,,o,j.,, To Figure 9
Fig. 8. Logic diagram for fire barrier failure.
failure. Data is available for some of these events, but values for other have to be estimated. This will be acxomplished using a set of indices to represent a particular barrier component, for example, the continuum part of a barrier (such as a wall) can be represented by
five indices covering continuum type, thickness, fire resistance rating, maintenance state and damage state. A reference continuum can be defined corresponding to an assignment to each index. Deviations from the reference continuum can then be considered. Similar
A.N. Beard et al. / Assessing the adequacy and reliability
arguments can be made for the door and penetration components, adding size and position as indices. Until such time as sufficient data becomes available, it is intended to use Delphi techniques to estimate base event probabilities. (Delphi = expert group opinion.)
7. Conclusions It would be true to say th~-t fire b-~.'~er re~abLUty on nuclear power plants has long been taken for granted. This attitude is changing because, on the one hand,
/ ~IF~/ [Pa | 2l t Goj
J
P21
P29
375
P22
~"l
~'sl
P)O
P31
! ~o" ~°"'°~1 ! ~,'~'" ~°~1
P,6 ]
J
P27
Pko
P28
P&I
I~ ~'~' ~~°*'~,~,~o,'~°'~°JJ
iP34.1 '~,u'~",, °,II~,. '~°',, °, I IP36.1 ~,.'~°', ~°~ I I ~., °'~°',,P37.1 °, I l ~,.'~",, P30.°~I I ~o,-'~",,P39.1°,I P35.1 Figure 9 . notation being: Fy : Failure via a single component ie. continuum, door, perforation Faiture directly involving a combination of components Fyc: Failure via continuum port Fyd: Failure via o door F,/p: Failure via o perforation F?cu: Failure via continuum part. insulation first Fycv: Failure via continuum part. integrity first Fycv: Failure via continuum part. stability first Fydl: Failure via door 1 ( likevise door 2 ) Fydlu: Failure via door 1. insulation first F?dly: Failure via door 1, integrity first Fydlv: Failure via door 1. stebility first Flrpl: Failure via perforation 1 ( iikevise perf. 2 ) Fyplu: Failure vie perforation 1. insulation first Fyplv: Failure via perforation 1. integrity first Fyplw: Fnilure via perforation 1. stability first FiBu. Failure directly involving o combination of components, via insulation Fjv: Failure directly involving a combination of components.via integrity FJv" Failure directly involving a combination of components, via stability ,'llSU(av):Failure directly tnvolving a combination of components . via i.'.sulation and the average temperature criterion FGullO¢)Faiture directly involving a combination of components, via insulation and the local temperature criterion
FB:
Fig. 9. Logic diagram (continued).
376
A.N. Beard et al. / Assessing the adequacy and reliability
some nuclear regulatory authorities are questioning our previous assumptions and, on the other hand, new tools are being developed to assess fire barriers. Suitable methods exist for determining the adequacy of a fire barrier but they can only predict 'failure' or 'no failure'. A combination of deterministic and probabilistic techniques could be a fruitful way of avoiding this problem, but has yet to be explored. At least one fully probabilistic method for determining the reliability of a fire barrier has been developed but requires data for base event probabilities. Until this information is available, a method is suggested to synthesize the required data.
Appendix: Probability of failure of a barrier It is desired to fi.~d *.be probability of fai~.at-e of a barrier in a particular case. The final probability of interest may be denoted by P ( F / G ) where G refers to the characteristics of a particular case which generally cover: (a) material properties; (b) geometrical characteristics; (c) ambient conditions; and (d) directly human characteristics. A particular configuration corres'~onds to an assignment for each of these characteristics and may be denoted by Gj. A particular case will cola'espond to a particular configuration, but which one may not be known. For example, one configuration may correspond to 'door open' and another to 'door closed'. P ( F / G ) may be decomposed as illustrated in the lo~c trees of figs. 8 and 9. The y-arm corresponds to failure occuring through a single component, where component means one of: (a) the continuum part of the barrier; (b) a door; (c) a perforation. This is indicated in the breakdown of P21 into/'23, P24 and P2s. P23 is broken down in to failure via insulation, integrity or stability first (u, v, w)./'24 is broken down with respect to the doors (i.e. dl, d2 etc.). P32a, pertaining to door 1, is broken down into failure via insulation, integrity or stability. Likewise for other doors. The B-arm corresponds to a failure which directly involves a combination of components. For example: (i) a crack which may cross an interface between two components such as a section of a continuum and a perforation; (ii) a stability failure which may only have meaning when considering the entire barrier; (iii) failure via the average temperature criterion which may involve several components. P22 has been decomposed into failure via insulation, integrity and stability and P26 broken down into failure via the average temperature criterion (Pao) and via the local temperature criterion
(P41).
Precisely which constituent probabilities it is desired to estimate depends upon the particular case and the objectives of the user. For example, it may be decided to ignore suppression activity or not, or it may be decided to ignore the branches associated with 12 and 13 or not. In principle, failure from a non-fire cause is also included (e.g. earth tremor). In the longer term, work needs to be conducted in order to be able to estimate all the constituent probabilities. In the immediate term, a procedure has been suggested to assist estimation. There is insufficient space here to go into details but, as an example, P2t will be considered to some degree. In general, below P2t there are three subsets: (a) the continuum subset /'29, P30, P31; (b) the door subset P34.,., P3s.,., P36.,. for door m; (c) the perforation sobset F37.,.. P3s.m, /'39.,. for perforation m. The user has to decide which cut set needs to be estimated. Each of the probabilities of concert,, may be examined from a Bayesian point of view. Such techniques are valuable because they provide a systematic way of combining empirical information and engineerin~ judgement.
References [1] M.T. Finucane, Information and tools required for a fire PSA, Seminar on Int. Approach to Nuclear Reactor Safety, Blackpool, 8-10 June, 1988. [2] M.P. Bohn et al., Fire risk scoping study: investigation of nuclear power plant fire risk, including previously unaddressed issues, NUREG/CR-5088 (SAND88-0177) January, 1989. [3] S.H. Ingberg, Fire loads, Quarterly Journal of the NFPA, No. 22 (1928). [4] M. Law, A relationship between fire grading and building design and contents, Fire research Note No. 877 (1972). [5] O. Pettersson, et al., Fire engineering design of steel st~ructures~ Swedish Institute of Steel Construction, Pubfic~tfion 50 (1976). [6] D.L. Berry Analysis of fire barriers within nuclear power plants, Nuclear Technology 53 (May 1987). [7] R.C.B. Judge, Modelling the failure of reinforced concrete structural members subjected to fire loading, Proc. ABAQUS User's Conf., Stresa, Italy, May 1989. [8] G. Apostolakis et al., COMPBRN II! - a fire hazard model for risk analysis, Fire Safety Journal (1988). [9] B. Karlsson and J. Nirmark, Fire risk analysis in nuclear power plants - use of the computer programs DSLAYV •rod OSFIC, IAEA-SM-305/73, Vienna (March 1989). [101 D.D. Drysdale and M. F~nucane, Probabilistic method to consider fire attack on the segregated safety systems in a nuclear plant, IAEA-CN 48/203, Vienna (October 1987)