Methodology to evaluate the effectiveness of fire protection systems in nuclear power plants

Nuclear Engineering and Design 76 (1983) 161-182 North-Holland, Amsterdam

161

METHODOLOGY TO EVALUATE THE EFFECTIVENESS OF FIRE PROTECTION SYSTEMS IN N U C L E A R P O W E R P L A N T S * S.H, L E V I N S O N ** a n d M.L. Y E A T E R Rensselaer Polytechnic Institute, Troy, New York 12181, USA Received 18 March 1983 A methodology for the evaluation of a fire protection system in a nuclear power plant is described. A system of Monte Carlo simulation modules has been developed, divided into the four phases of a fire scenario: ignition, detection, suppression and propagation. An interactive graphics computer program, FIRES, has been written to support these models. The system has been applied in a test case analysis of several zones of an operating plant. The models appear capable of providing interpretable and useful results.

1. Introduction

The occurrence of a fire in a nuclear power plant represents a substantial danger to continued normal operations and subsequent shutdown, if necessary. Gallucci [1] estimates the probability of impairment of safety and cooling systems required for safe shutdown at 2.1 x 10 -4. More probable smaller fires can disrupt normal operations and be an economic burden for the utility. After the cable insulation fire in the Browns Ferry plant [2,3] in 1975, the Nuclear Regulatory Commission required each utility to completely review the existing fire protection systems. Several standards were developed [4-6]. Much of the subsequent research was directed towards evaluating the effect of the fire on overall plant safety [1,7-12]. The objective of this paper are to develop a methodology to evaluate the effectiveness of a fire protection system, implemented by appropriate computer software, rather than to examine the plant-wide consequences of a fire. The program is used to evaluate how well (or poorly) the risk of a destructive fire has been reduced to an acceptable level. The model includes ignition, detection, suppression and propagation components. The software includes an interactive graphics package called FIRES (Fires: Interactive Reliability Evaluation System). This allows the user great flexibility when establishing the input conditions and provides an easy* Based on the doctoral work of S.H. Levinson. ** Presently with Babcock & Wilcox, P.O. Box 1260, Lynchburg, VA 24505, USA.

to-interpret, graphical output. It forms a pre- and postprocessing interface with the analytical software, which controls the running of the simulation. While this type of analysis is especially important with respect to plant shutdown, it can also be used to evaluate fire zones with non-safety-related equipment, where economic losses are important. As Talbert has emphasized [13]: "... confining the development and use of a pre-fire plan to only safety-related areas will not provide the utility with adequate protection from property loss or from interruption of power production. To provide this protection, the pre-fire plan should be extended to all major portions of the plant." The modeling of human action plays an important role in the detection and suppression models. In some cases, human action is directly responsible for the fire. In a study of the effects of human errors with respect to plant safety [14], the results indicated that the core melt probability was unchanged with decreasing human error probabilities, but increased with increasing human error probabilities. Section 2 presents the details of the four components of the model. After a simulation is performed, the analyst needs a method to combine the results into an easily interpretable form; section 3 discusses the definitions and uses of 'Resource' and 'Adequacy' Indices. Section 4 describes the interactive graphics features of the software used to facilitate the input and output processes. A description of test zones for a PWR and the interpretation of the simulation results are given in section 5.

0 0 2 9 - 5 4 9 3 / 8 3 / $ 0 3 . 0 0 © Elsevier Science Publishers B.V. ( N o r t h - H o l l a n d Physics Publishing Division)

162

S.H. Levinson, M.L. Yeater / Fire protection .~vstems in nuch,ar power phmt.~

2. Model development The methods to evaluate fire hazards can be divided into three categories for the development of ignition, detection, suppression and propagation models: physical models, point probability models and probabilistic models. Physical models suffer from the complexity of the large number of variables and the relationships required to calculate a fire history; point probability models suffers from small and inadequate data bases. Apostolakis [11] notes that "these difficulties immediately suggest the use of a probabilistic a p p r o a c h . . . " This approach also suffers from data base inadequacy and the inability to model certain phases of a fire history. Thus, the most useful model will be a hybrid of all three, as proposed in this work.

It can be considered a conditional PDF, J~,:{x, y. _-]1) where f, ~._~is the PDF, x, y, z are the coordinates of the fire location in the zone and I represents the event of ignition. Since P ( I ) is assumed to be equal to 1. f,~,=(x,y, ell) reduces t o £ , : ( x , y , -). Since the P D F is a function of three variables, the condition: ,,, r ,'o e - ~

L Jo

Jo

,~._.(x,y,z)dxdydz=l

(1)

must hold, where the fire zone has dimensions x 0 x Y0 x %. It is conceptually difficult to deal with a triple integral. To provide a tractable solution in determining the origin of a fire, the z-dependence is ignored. Thus f: is separable from £~,, and integrates to 1, and eq. (1) becomes:

2.1. Ignition model

f[

Ignition obviously requires a heat source and combustible material. Heat sources at a nuclear plant include: electrical circuitry (e.g. resistive heating or arcing), heated equipment (e.g. exhaust pipes of a diesel generator or part of the steam-pipe assembly of a turbine), mechanical energy (e.g. spark or friction) and chemical energy (e.g. decomposition or self-ignition). Another ignition source is man, through carelessness, inexperience or poor procedures, cigarettes, matches, welding and other customary actions. Combustibles present in a nuclear power plant include building insulation, interior finishes, cable insulation, oil supplies (for lubrication), cleaning solvents and rags, and transient loads (paper, wood, packing material). Models describing a fire scenario handle ignition by (1) ignoring the probabilistic aspect or (2) relying on data which identify the ignition probabilities for fires which have occurred in the past. In the first approach there is an a priori assumption that a fire has started in a certain area. The model deals with the subsequent effects of the fire. In other models, when a fire is assumed to occur, no consideration is given to the location of the fire. The origin of a fire (both location and combustible) can influence the response of the fire protection system; for example, a cable insulation fire products smoke, without necessarily raising the zone temperature a substantial amount.

The above integral can he interpreted as the volume contained between the surface function f~y and the floor of the fire zone. The analyst's task is to examine the zone with its one or more combustibles, and determine an appropriate surface for each combustible. A normalization process using Relative Ignition Weights is discussed in the next section. Progammatically, the number of types of PDFs must be limited. Four probability density functions have been selected as the marginal distributions: uniform, ramp, exponential and normal. To form a surface, the PDFs are joined at right-angles and extend over the area of the combustibles. There are a total of ten possible surfaces (combinations of 4 distributions taken 2 at a

~'[~"'f ( x v ) d x d v = l . jl}

xv

-

m

2.1.1. Use of surface PDFs The concern with this model is the determining of a probability density function for the location of the fire.

(2)

.

Fig. 1. Ramp-uniform surface.

S.H. Levinson, M.L. Yeater / Fireprotection systems in nuclearpowerplants

163

value equal to the reciprocal of the edge length. For a ramp distribution, the "length" must be normalized to 1, thus the sampled value can be considered a percentage of the original length. This insures that the ramp function will have positive probability values for any integrated value. After the function is defined, the next consideration is how to sample from a surface function. Integrating the joint probability density function given in eq. (4) results in the joint cumulative density function (CDF). F(x, 5')=

fo" fO~kf,(x )f2 (y )dxd Y

=fo~kyf2(y)dY.fo'~kxfl(x)dx,

where k x, ky are constants whose product is k and are the respective normalization constants for fl(x) and f2(Y). Thus eq. (5) is:

Fig. 2. Exponential-exponential surface. time). With the exception of the normal-normal combination, all the combinations are separable and can be shown to be the joint probability density function by simple integration to their respective x- and y-marginal density functions. Since it is assumed that the selection of an x-coordinate is independent of the selection of a y-coordinate, the joint correlation simplifies to

s(x,

>,) =

exp

-

,

(3) which is the product of the normal distributions of x and y. Figs. 1 and 2 show a graphical representation of two of these combinations. It is clear from figs. 1 and 2 that the domain of definition is important for obtaining a normalizing constant. The region of integration will be the area of the domain.

ffU,(x)f2(y)dxdy

= 1.

(5)

(4)

A

For the cases of the normal and exponential distributions, the area A truncates the usual domain of the distribution. Clearly, k will be greater than 1 in these cases, since the properly expressed normal and exponential PDFs have an integrated value of 1 from minus infinity to plus infinity. In their truncated form, the unnormalized area will be less than one. This fact does not carry over to the uniform and ramp probability density functions. For the uniform distribution, there is no problem in assigning fx (or fv) a

F(x,y)=F(x)F(y). Taking into account this separability, sampling is only necessary for a uni-variant distribution. The method used is to calculate an inverse CDF, that is, solve for the random value in terms of F(x) (the CDF) and distribution parameters. Since F(x) maps with a one-to-one correspondence with x, selecting a value of F(x) at random will produce a distribution value via the inverse function [15], x = F-I[F(x)]. F(x) always varies from 0 to 1 , s o a uniform random number generator can be used to 'pick' the value of F(x).

2.1.2. Relative ignition weights Once each combustible has been "fitted" with a surface PDF, the sum of the volumes under the density functions is renormalized. Each surface PDF is multiplied by a weighting factor such that the sum of the volumes under all the surfaces equals unity. Since the volume under each surface has previously been normalized to 1, the sum of the weighting factors must also be one. Thus, this factor will be considered a measure of the likelihood of a particular combustible igniting relative to the other combustibles in the zone, and is designated as a Relative Ignition Weight (RIW). Because of the comparative nature of the RIW for each component, factors common to each one will cancel out and only factors relating specifically to an individual combustible need be considered. Individual combustibles are characterized by: (a) material properties and (b) geometric configuration. The fire load incorporates both of these factors in its definition:

164

S.H. Levinson, M.L. Yeater / Fire protection ~3"stems in nuclear power pkml~

Fire load ( B T U / f t 2) = combustible volume (ft 3 )

2.2. Detection model

x combustible heat release ( B T U / f t 3) × [floor area (ft2)] -1

(6)

This parameter is given in zone descriptions of plant fire hazards reports. The geometric contribution is not completely included in the fire load. For an area A containing a combustible of volume V with a heat release of R, the fire load would be, according to eq. (6): VR

BTU/m2"

A If a second combustible were placed next to the original with an equal volume of A square feet of the floor, the new fire load would be: (2V)R 2A

VR

BTU/m2"

A

In both situations the "fire load" is identical. Obviously the "fire hazard" is not equivalent, and another geometric parameter must be considered. Since fire is a surface area phenomenon [16], the proper factor should be the exposed surface area, Se. One more material constraint should be considered. Drawing on the A N I fire data base [17,18]. Gallucci has developed 'fire ratios' for his ignition model [1]. These give a crude probability and convey the idea of the relative occurrence of a fire in different materials in a nuclear power plant. The results are summarized in table 1. The Relative Ignition Weights should be directly proportional to the three parameters discussed, namely fire load (FL), exposed surface area (Se) and fire ratio (FR). Thus, R I W = k x F L x So x F R .

(7)

The units of k (or RIW) are unimportant, since RIW is used only in a relative manner. Table 1 Summary of fire ratios Fire class

Combustible type

A

plastic wood

B C

Number of fires

Fire ratio

8 6

0.138 0.103

oil non-oil/gas

23 4

0.397 0.069

cables electrical equipment

6 11

0.103 0.190

Detection is the identification of a critical deviation from ambient conditions in terms of fire-generated symptoms. These include high smoke particle concentration, excessive heat and flicker, which are the basis for the operation of automatic fire detectors. Assuming a fire has started, the detection phase controls the speed at which suppression begins and to what extent propagation occurs. Detectors should be chosen to respond to the most appropriate fire symptom level, at one of the four stages of the fire (incipient. smoldering, flame and heat). For example, an oil fire will proceed very quickly into the f l a m e / h e a t phases without giving off much smoke, hence a heat detector provides the best production. Other variables in the design of a detection system are the number and placement of the detectors. The detectors may be all of the same type or mixed. The model allows many configurations to be tested, but will not compute an optimum configuration; indeed, this is deemed a nearly impossible task, as such decisions rely on human experience and intuition. Berry [19] discusses some of the inadequacies of current detector system designs and makes suggestions concerning the detector types and offers guidelines for arrangements (detector patterns). F I R E S (see section 4) allows the user to test a multitude of designs. Human discovery may be the most important means of detection. While humans can be distracted by personal or work-related problems, they can detect any of the fire symptoms. They are mobile and can be explicitly trained to observe the signs of a fire, determine if it is actually a fire (low false alarm rate) and then take the proper steps towards extinguishment. The failure data available for a probabilistic model consist mainly of response times for detectors. Furthermore, these tests [16,20,21] are normally performed under ideal conditions and do not simulate real situations; tests are likely to be conducted in a room with no air movement, smooth ceilings and no obstructions. However, the model is structured to take advantage of better data when it becomes available. 2.2.1. Automatic detection model

For zones protected by one (or more) automatic detectors, a model is required to ascertain functionality in the event of a fire. The components are: (1) the probability of successful operation on demand and (2) the sufficiency of fire symptoms to cause detection. Detector types to be modeled include heat, rateof-rise, flame and smoke. The possibility of false actuation is not being considered because false alarms do not

165

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

necessarily decrease the effectiveness of a given system, (although causing extra costs and down time). 2.2.1.1. Detector failure probabilities To model the successful operation of a detector (on demand), the detector failure probability, Pr, is c o m p a r e d to a uniform r a n d o m number, x i, such that:

if x~ >__pf, then the detector does not fail. Using a value of 1.0 failures per million hours [22], and a test interval of 3 years, pf can be estimated as 3 × 24 × 365 = 0.0263. 106

Sprinkler system failures were evaluated by Nuclear Power Experience (NPE) [23]. The tabulated data from the tests are given in table 2, taken from ref. [1]. Note that the value of 0.0264 is in close accord with the previous value calculated. The CO z special systems value of 0.142 is most likely indicative of smoke detector failure probabilities. Ref. [24] estimates a failure rate of 2 - 4 failures per million hours; pf equals 0.07884, assuming 3 × 10-6 f a i l u r e s / h o u r , a three year testing interval a n d time-independence. Using the arithmetic mean, Pf

0.142 + 0.07884 2

Protected zones c Unprotected zones ~

Automatic

Human

10 d

7 10

Human-initiated Humans present at ignition f Impossible to specify

if xi < pf, then the detector fails,

pf -

Table 3 Survey a of ANI fire data base to estimate probability of detector b failure

a Data examined for operational phase of BWRs and PWRs only. b Heat and smoke detectors are lumped together in one category in the data base. c Includes: transformers, diesel generators, turbine building, switch yard, reactor building. d Five of these were credited with both human and automatic detection. e Includes: warehouse, radwaste building, auxiliary building, relay room. f Such as during cleaning or testing (diesel generator). tion equipment in each of these fires, then 7 10 + 7 + 3 + 8

Pfl

Pf2

=

Component/ system

Trip failures

Number of tests

Failure probability

Deluge valves CO/special systems

16 28

605 197

0.0264 0.142

7 7 + 10

= 0.41

C o m p r o m i s i n g and taking an average, pf equals 0.33. For flame detectors, a failure rate of 20 failures per million hours is given in ref. [22]. The corresponding failure probability is 0.175; because of the high failure rate, a test interval of 1 year was used, the lowest value of the reasonable testing time interval. W i t h no indication of an ' u p p e r b o u n d , ' twice the value o b t a i n e d for s m o k e / h e a t detectors is used, due to the high failure rate. With intervals for Pr established, a specific value Table 4 Summary of detector failure probability parameters

Heat Smoke Flame

Table 2 NPE failure data for automatic detectors

0.25.

If no credit is given, then

0.1104.

In this work 0.026 and 0.1104 will be used as a 'lower b o u n d ' for the pf value for heat and smoke detectors, respectively. To determine an ' u p p e r b o u n d , ' the A m e r i c a n N u c l e a r Insurers ( A N I ) fire data base [18] was examined. This involved examining fires during the operational phase and d e t e r m i n i n g the n u m b e r of fires discovered by h u m a n means in zones presumably protected by automatic means. Heat a n d smoke detectors were lumped together in this data base. A summary of the results is given in table 3. The ' h u m a n - i n i t i a t e d ' and ' h u m a n present at ignition' are grouped separately since their scenarios imply immediate h u m a n discovery, regardless of whether or not the area was protected by automatic means. If credit is given for automatic detec-

3 8 3

Heat Smoke Flame

pf median

pf (95th percentile)

#

o

0.0260 0.1104 0.1750

0.33 0.33 0.66

- 3.650 - 2.204 - 1.743

1.545 0.666 0.807

mean

variance

0.086 0.130 0.242

0.0726 0.0106 0.0539

166

S.H. Levinson, M.L, Yeater / Fire protection systems in mlch'ar power plantv

must be determined for comparison with x,, a random number from the uniform distribution; a lognormal distribution is assumed for Pf. The lower and upper bounds are taken as the 50% and 95% distributional values of the lognormal distribution. Table 4 summarizes the intervals, p, and o parameter values, and the mean and standard deviation for each detector type. 2.2.1.2. Fire symptom determination When heat, smoke and flame detectors are used, a calculational method must be available to determine numerical values for the appropriate variables in the model, i.e. temperature or smoke concentration. Ideally, these should be computed as a function of time and position, but this has not been achieved [25-29]. The computer code discussed in the next section, while not meeting all the desired requirements, is probably the most useful for this application. This code, Computer Fire Code (CFC, also known as M A R K V) [30-33] is a large, physical-based code used to track various fire symptoms (e.g. temperature and smoke) through time and space subject to certain restrictions. It uses a time-dependent control-volume model, as opposed to a field model [34]. Other available codes [34] appear to offer no advantage over CFC. In CFC, only the ceiling and hot layer temperature are calculated for each time step. Thus, all detectors will appear to reach their threshold temperatures (or temperature rates) at the same time. This, of course, does not account for the time delay required to activate the next closest detector. A method is described in ref. [35] to calculate an approximate time delay; this approach assumes that the temperature set point, ~et, is identical for all heat detectors within the zone and the temperature increase is quadratically related to the distance from the fire. The results is:

t,

=

at° )=( d ,12 { dmax}2•( dmin

+

( dm,~ } 2 - ( 1 + a ) ( d m m ) 2 {dmax)2-(dmin}

(8)

2

where d~ is the distance from the fire to detector i, dmi n is the minimum distance over all d,, din, ~ is the maxim u m distance over all d,, t o is the time the closest detector reached the threshold temperature, a is an upper percentage bound on the maximum time (i.e. time for detector associated with dma x to activate), and t~ is the time of activation of detector d,. It should be stressed, at this point, that the development of eq. (8) is only an approximate, and not in-

tended to be a rigorous solution. When the state-of-art advances sufficiently, the function T ( x , y , :, t ) c a n be used to obtain more exact values for t,. A smoke detector measures the quantity of smoke in a room, but it is difficult to identify the best units to use when determining this quantity. Suggested units [20,21], [36 39] include: mass concentration (mg/m3), number density (number of particles/m3), optical density (per meter), obscuration (percent per meter, photoelectric devices) and voltage (ionization devices). The quantity calculated by CFC is the mass fraction of smoke in the hot layer. The threshold value is determined by ,8.,, a multiplicative factor indicating the increase in the mass fraction from the first iteration:

where p~) is the smoke mass fraction on the first iteration, and pff) is the threshold value, ~8~p~1), which occurs during the kth iterations. Since this is still a relative measure, it will be used as a constraint on the sampling of a time-to-activation distribution. Tests with smoke detectors [20,40] reveal detection times ranging from 18 s to no activation. One set of response times give the uncharacteristically long time of 1762 s. Remaining data show a more reasonable upper limit in the 160 s range. Using a lognormal distribution, for the same reasons given for heat detectors, and 18 seconds as the 5% and 160 seconds as the 50% distributional value, lognormal parameters of ~t = 5.07 and o = 1.112 are obtained. Thus time-to-detection with a smoke detector equals: tl~ for t~ < t[~, t~

for

t s>t/~,

where t~ is the time sampled from a lognormal distribution (/, = 5.07, o = 1.112); t/~ is the time when Off ~=

/~<,,.

Since the value of the smoke mass fraction is constant for the hot layer at a given time, the value of t a must be modified to take into account the time required to bring the smoke level at the next closest detector to the threshold level. This is identical to the temperature calculation previously discussed. It has been suggested [27] that there is a relationship (presumably linear) between the change in temperature from ambient and the amount of smoke produced, so the same formulation will be used, with dmi n and dma x defined appropriately for smoke detectors. The fire symptom that flame detectors use for activation, rapid changes in emitted frequencies of light, is not readily quantifiable. In tests done to measure the response time of flame detectors to fires in various materi-

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

als, it was found that with one exception, response time was less than a second. The exception was PVCs (Polyvinyl Chlorides, cable insulation-like material); response time was approximately 70 seconds [22]. Due to the fast response time, flame detectors are usually fitted with a time delay circuit to insure a flicker of a specified duration. The time-to-detection is (in seconds): tdelay

for non-PVC-like materials,

tdelay + 70

for PVC-like materials,

where tae~ay is the delay built into the detector. Pyr-alarm markets detectors with a tde~ay equal to 3, 10 and 30 s [41]. Such values are provided by the user for specific cases. Unfortunately, the above treatment is overly simplified. Several other factors must be considered; these are: (1) separation distance between the fire and the detector and (2) evaluating the effect of obstructions. Flame detector effectiveness is limited by the distance from the fire. Pyr-a-larm [41] suggests the diameter of the viable protected area is "3 times the detector height from the floor." Thus, a fire ignited outside this radius will not be considered detectable by that flame detector. Because a direct line of sight is required for actuation, an obstruction (e.g. cable tray) in the path will increase the response time. The following is derived in ref. [35]:

t(N) = -t*N2 + ~2t* -U, 25 --

(9)

where N is the number of obstructions, and t* is the maximum time to detection for an 'infinite' number of obstructions. The formula is based on a quadratic fit between the two points (0, 0) and (N*, t*) representing zero detection time with no obstruction and a time of t* with N* obstructions. Assuming no more than a 5% difference in t(N* - 1) and t(N*), N* was found to equal 5 [35]. The time-to-detection is the sum of the two components; in seconds:

course, human detection can also be effective prior to the detection of a fire by functional equipment. The model has been dichotomized; it will deal with either (1) normally occupied zones or (2) normally unoccupied zones. It is recognized that this is one of many possible approaches. This model is discussed in an accompanying paper [42]. The main results are: (1) Given k sets of n people in a room where ignition takes place, the discovery time, T D, in a series of such events are represented by a distribution f(x) with a cumulative distribution function ( C D F ) F(x) for which the distribution of the smallest element, ~ ( x ) is (this is the Gumbel distribution [43,44]):

qb ( x ) = r " ( x ) , tO, ( x ) = 1 - (1 -

(10)

F(x))",

1

f ( x ) = 2x ~ _ ~ e x p can be used in conjunction with eq. (11) as the sampling distribution for T D for a room with n people. The sampling form is derived using eq. (11), repeated here, by using the inverse technique and solving for x : , ~ , ( x ) = 1 - (1 G(x)-l= (1

F(x))",

(12)

-(X-F(x))",

-G(x))'/"=a -r(x),

for non-PVC-like materials,

r(x)=l-(1-G(x)) 1/",

/delay + 70 + t ( N )

for PVC-like materials,

x = r-'{1

t(N) is defined in eq. (9).

(11)

where n is the number of people in the room and F"(x) is [43] " t h e probability that all n independent observations on a continuous variate are less than x." Eq. (10) is the maximum extreme value C D F , while eq. (11) is the minimum counterpart. Unfortunately the usefulness of this approach is extremely limited because a functional form for f ( x ) is not available. (2) In a more intuitive approach, using a lognormal distribution [45], values of 3 and 6 min are selected [35] as the 5% and 95% distributional values; these yield ~t = 1.445 and o = 0.211. Thus

tdelay + t( N )

where

167

- (1 - G(x)) '/" }.

(13)

G(x) is the C D F , with a value between 0 and 1; it can be replaced in eq. (13) with an uniform random number,

2.2.2. Human detection model

R i•

Two cases exist when human detection is necessary: the first is when the automatic equipment has failed, the second, when a zone has no automatic equipment. Of

(3) For the case of a "normally unoccupied zone" (occupied briefly by security guards, maintenance personnel or inspection staff performing routine duties,

168

S.H. Levinson, M.L. Yeater / Fire protection ,sTsterns in nuch, ar power plam~

F tl I

7~

tl 2

t13

t

t

t

I

t21

t22

t23

t24

I

t- ~ -

t31

t32

I t33

t34

t35

i

i

t36

t37

Fig. 3. Inspection intervals.

assuming that the plant is operational and construction workers are absent), a lognormal distribution is assumed for the human failure probability, with a cut-off time, t¢, such that

When the time of the fire, T v, is known, the first inspection time can be determined. T v. (the sampled value), as shown in fig. 3, indicates the next inspection at t22 and t33--these represent two inspections at the same time by two individuals. It is not necessary that t l , l , t 2 , 1 . . . . . ti, I be equal. The only requirement is that all interval patterns are relative to t,.,~ and can be specified by an offset value r,, see fig. 4; ~-,* is, of course, equal to zero. Fig. 4 is the more realistic picture. However, it is not realistic to expect the guards or inspectors to arrive at exactly t,,/; it is assumed that the time of arrival, TA , will be normally distributed about t,,/, and a normal sampling distribution is used to determine the 'exact' time-of-detection by human means. 2.3. Suppression model

P(F)

= Prob(failure) = 0.9 (0.5, 0.99)

t < t~,

(14)

P(F)

= Prob(failure) = 0.0

t > t c.

(15)

For t < t~, the failure probability is for an unsuccessful recognition of a deviation item for one shift with one shift assumed to be equivalent to one inspection tour [45]; the 0.5 and the 0.99 values are the upper and lower bounds [45] and can be used to derive parameters for a lognormal sampling distribution for P ( F ) ; this will implicitly account for some of the human variations. The remaining parameter is the test interval for the inspection personnel. Fig. 3 shows an interval layout for three inspectors, where: t , , j = time of inspection for a specific zone, i = number of the inspector, j = number of the inspection. Let inspector i* have the most widely spaced intervals. Assume the fire occurs during two consective intervals, between ti.,j and t i . , j + 2 . This can be determined by sampling a uniform distribution; fTv --

1 ti. j+2 -- ti. j

tl I

7~

t21

t31

'

ti*,j <- I <--.t i . j + 2 .

tl E

t22

t32

t33

tl 3

t23

t34

t35

Fig. 4. Revised inspection intervals.

t36

The suppression system must respond rapidly after detection, respond as designed and be designed adequately to suppress a design basis fire. The design basis fire is determined by the designer to account for experience with the system and the combustibles present in the zone. These systems include both human and automatic elements, and involve the use of sprinkler systems, standpipe/hose stations and portable extinguishers. In addition to the varied means of applying an extinguishing agent, there are a variety of agents available: water. halogenated compounds, carbon dioxide, dry-chemicals, foam. 2.3.1. A u t o m a t i c suppression model The automatic suppression model is composed of two components, similar to the corresponding detection

Table 5 Summary of success percentages for automatic sprinkler systerns Organization/ source

Success percentage a

Years covered

References

NFPA NFPA U.K. Fire Statistics IRI U.S. Navy Australia Factory Mutual

95.8% 96.2% 91.7% 91.06-99.35% 94.8% 99.76% 76-91%

1897-1924 1925-1970 1965-1969 1973-1977 1966-1970 1886-1968 1970-1972(?)

[53] [521 [50] [16] [53] [46] [53] [52] [54] [51] [52]

The success percentage is assumed to apply only to the actuation of the sprinkler systems, as opposed to actuation and extinguishment of the fire.

S.H. Levinson, M,L. Yeater / Fire protection systems in nuclear power plants model. These determine: (1) the probability of successful operation on demand of equipment and humans, and (2) the adequacy of the amount and type of the delivered suppressant. In the case of latter, a time to suppression (or control of the fire) must be ascertained. The systems currently included in the model are water sprinkler and halon systems. These systems are assumed to activate immediately upon the activation of the automatic detection systems.

values for the lognormal distribution of:

2.3.1.1. Failure probabilities System failure usually implies complete inoperability of the system, as with an interrupted water s u p p l y - - t h e most common failure mode. This may be the result of a value shutoff, for reasons including: valve leakage, system repair or prevention of freezing. Failure determination is made in the same manner as described in section 2.2.1.1. A failure probability, pf, is sampled from a distribution, derived below. Table 5 summarizes success probabilities for automatic water sprinklers. Most values are in the mid-90's; the failure distribution will take the form of a lognormal distribution. Since the N F P A value of 96.2% is about average and based on the largest data base (over 81,000 fires), covers all sprinkler systems and includes modern systems (as opposed to data from the late 1800's and early 1900's), it is taken as the median. The high Australian value is used as the 95% value. Since a failure probability is the desired quantity, the following complements are used to compute the parameters/~ and o :

Qw, = ( ~ , G ) ( l l l 0 , )

50% value 5% value

= 0.038, = 0.0024.

/x = o=

- 2.926, 0.590.

2.3.1.2. Actuation 2.3.1.2.1. Water effectiveness The total absorption power, Qw, from a single sprinkler head can be calculated as [35]: p

BTU/min,

where pt = effective water fraction, percentage of the sprinkler release that strikes the fire, G = flow rate per sprinkler, gallon/minute, 1110 = ideal absorption power of 1 lb of water from 72°F into steam, BTU, c = efficiency of steam conversion, and p is the density of water, 8.34 lb/gal. The total absorption power of the system is: n

Qw=~_,Owi, i=l

where n is the total number of sprinklers that open; this variable is evaluated in the next section. The total fire BTU output rate, Qf, can be obtained from the C F C output. The net BTU output, Q, as a

One Burning Object

The parameters of the lognormal distribution are: /~ o

= - 3.270, = 1.679.

For a halon system, a signal must be transmitted from the detector to the release circuitry. This transmission is assumed to be instantaneous and totally reliable; any failures are absorbed in the system failure probability. Failure data for halon systems are very limited; IRI [46] provides some test results of systems from five manufacturers. Of a total of 63 tests, there were 9 reported failures, yields a Pt = 0.142. However, six of the failures resulted from testing seven systems of the same manufacturer; without these data, the failure probability, pf, is 0.0536. With no other data available, the latter value will be taken as the median value, and the former as the 95% value; this results in parameter

169

Two Burning Objects Fig. 5. Fire area for one and two burning objects.

170

S.H. Levinson, M.L. Yeater / Fire protection .~vstems in nuclear power plamv

function of time is:

Q(t)= fo'(Qf-Qw)d)~.

(16)

When Q(t) is zero or negative, the fire can be considered extinguished. Note that Qf and Qw may be time dependent. Qw will vary in discrete steps, as more sprinklers open or human suppression action is added, until the supply of water is exhausted. Eq. (16) can be expanded into the sum of integrals to represent the change in water flow at different times. If Qf is considered to be decreasing by Qw per unit time, then Qf(t) can be expressed as: Q f ( t ) = Q f - Qwt.

(17)

Substituting into eq. (16) yields:

R~ = 0.533D.

Q ( t ) = f 0 ' ( Q ~ - Q w X - Qw)dX = ( Q f - Qw)X - 0.5QwX21~ = (Of-

O w ) t - o . 5 O w t2.

of heads that will open. For this work, sprinklers whose area of water dispersal intersects with the area of the fire will be considered as opening. For a single ignition source, the area of a fire will be ~rR 2, where R is the fire radius, as calculated by CFC. For propagation to another object, the area will be a circle with a diameter of r 1 + r 2 + Ar, where rl, r~ are the radii of the two objects" fires, and Ar is the distance between the two objects' centers. For three objects, the area will be a circle centered at the center of a circle which passes through the three centers (of the object's fires) with a radius equal to that circle's radius plus the average of the objects' radii. These three cases are shown in figs. 5 and 6. The effective radius of the sprinkler action, R~, will be computed as a linear function of the discharge rate:

(18)

Eq. (18) represents the net BTU rate at time t; integration is required over the different time intervals determined by the change in the suppressant flow. 2.3.1.2.2. Sprinkler openings and coverage Since C F C cannot calculate temperature as a function of time and position, temperature can only be use to ascertain the functioning of the sprinkler system, but not the number

(19)

This is based on an 8 ft radius with a discharge rate of 15 gpm [47]. Eq. (19) is subject to two conditions: (1) R~ does not exceed the ceiling height, (2) R~ does not exceed the distance to the nearest sprinkler. With the two (sprinkler and fire) circles defined, the area of intersection can be computed. Let A ~, A f and A~ be the sprinkler, fire and intersection areas, respectively. The effective water fraction, v, is defined as:

v = An/A s, which represents the fraction of water released striking the fire from a single sprinkler. Define a second ratio, ~, as the percentage of the fire area protected by a sprinkler:

= Aj/Af.

Three Burning Objects

Fig. 6. Fire area for three burning objects.

As a further limitation of the number of sprinklers that will open, only consider those with ~ > 0.5 plus a random number of those with 0 _< ~ _< 0.5. 2.3.].2.3. Halon e/fecfiveness Since a halogenated compound mechanism of extinguishment is chemicallybased, the type of analysis used for water sprinkler systems cannot be used. Further, since halon systems are total-flooding systems, the question of 'number of sprinklers' is moot. Thus, a total-flooding halon system will be assumed to be totally effective i / i t operates. Any partial successes are assumed to be absorbed in the failure probability. Time to suppression (control of the fire) will be 10 seconds, the maximum allowable discharge time. If successful, no human suppression actions will be considered; if failure occurs, only human means will be available for suppression.

171

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclearpower plants 2.3. 2. Human suppression model The human suppression model is divided into three parts. These should be considered sequentially with time and are: (1) equipment failure probabilities, (2) human failure (or performance) probabilities, (3) adequacy of the suppressant agent. The human suppression model is discussed in detail in ref. [42]. The following is a summary of the main results. Note that in this model the human response is evaluated first with respect to an individual who discovers the fire and attempts to extinguish it with a portable extinguisher (when appropriate); second is the response of the individuals comprising a fire brigade, involving the use of both hoses and portable extinguishers.

A probability of failure, pf, is associated with each member of the fire brigade; for simplicity pf is assumed the same for each member. Of the n brigade members, it is assumed that at least r of them must perform successfully to control the fire *. If less than r members perform adequately, the brigade is considered to be totally ineffectual--the competent members are prevented from doing their j o b by the others. If r or more (r*) are successful, then that number (r*) of extinguishers a n d / o r hose streams can be used to combat the fire. The fire brigade should be able to reach any point (within the plant) in 4 to 6 min [48]. The time to arrival will be sampled from a normal distribution with/~ = 5 min and o = 0.608 (where 4 and 6 min are the 5 and 95% distributional values).

2.3.2.3. Adequacy of the suppressant 2.3.2.1. Hose station/portable extinguisher failure probability Unlike sprinkler failure data, failure statistics for hose stations and extinguishers are virtually non-existent. Gallucci [1] used a failure probability of 0.0118 for hose stations. He reasoned that the primary failure mode is having the water shut off; from N F P A data he estimated the probability of this failure as 0.0118. In the absence of better data, this value will be used as the pf value for hose stations, a value of 0.00365 for portable fire extinguishers is also taken from ref. [1].

The probability of failure for suppressants based on the fire class has been estimated from American Nuclear Insurers failure data by Gallucci [1]. The pertinent data are given in table 6. When the agent is water, the value of Qw must be changed over the proper time interval when evaluating

* Determining the number of successful brigade members is similar to performing a Bernoulli or bionomial experiment with n trials and the probability of success equal to 1 - pf.

2.3.2.2. Human/fire brigade response

It is assumed that an individual discovering a fire will only use an available extinguisher, but not attempt to use a hose stream. The ability to use the extinguisher correctly is a function of the level of training, how recent the training, previous experience, ability to react in an emergency and others. A probability of failure will be associated with the human discoverer; this value is supplied by the user when establishing the human suppression model. Only extinguishers within 75 ft of the fire are considered available. The time required to obtain the extinguisher include an assumed one minute as the time necessary to report the fire and locate an extinguisher (if available) and assuming a travel rate of 700 f t / m i n ( > 12 ft/s). The total time from discovery to application is, in minutes: 1 + 2D/700, where D is the distance to the extinguisher, in feet. The same modeling parameters discussed with respect to the individual above also apply to the fire brigade, composed of a group of trained personnel onsite who are able to respond to and initiate action to suppress a fire.

Table 6 Partial table of American Nuclear Insurers failure data for extinguishing agents based on fire class a Fire class

Water

Carbon dioxide

Drychemical

7 27 0.259

***

A

Failures Incidents Probability, pf

,,,

b

B

Failures Incidents Probability, pf

2 20 0.1

***

***

C

Failures Incidents Probability, pf

0 13 0.0714 ~

***

***

a Note that Gallucci separated the data into large and small volume categories. Volume sufficiency is discussed later in this section. b Asterisks indicate that the extinguishing agent is appropriate for the indicated fire class. c With no observed failures, the failure probability is calculated by assuming the next incident would result in a failure. So pf is calculated as 1/14.

172

S.H. Leoinson, M.L. Yeater / Fire protectton .~yxtems in nuclear power plants

Table 7 Coverage and discharge time for portable carbon dioxide extinguisher as a function of capacity

Table 9 Discharge time for portable soda-acid extinguisher as a function of capacity

Capacity (lb)

Capacity (Ib)

2- 3 4- 6 10-12 15-25 50 75 100 750

Normal fire area of gasoline in open tank to be extinguished by nonexpert operator (sq ft)

Discharge time (s)

1 2 3 5 8 10 12 50

15 22 25 30 57 *** ~ 60 150

i'.

1'~

Asterisks indicate that the value is not given in ref. [47].

the integral of eq. (16). If no automatic action has been taken, the same theoretical considerations developed in section 2.3.1.2.1. for sprinkler action applies equally to the water supplied from a portable extinguisher. In the case of a c a r b o n dioxide or dry-chemical extinguisher, a similar method c a n n o t be used. For these extinguishers, the area of coverage will be comp a r e d to the area of the fire. The area of a fire was previously defined in section 2.3.1.2.2. Ref. [47] lists the " n o r m a l fire area (sq. ft) of gasoline in an open tank to

Table 8 Coverage and discharge time for portable dry-chemical extinguisher as a function of capacity Capacity (lb)

Normal fire area of gasoline in open tank to be extinguished by nonexpert operator (sq ft)

Discharge time (s)

2~ 4 5 7~ 10 15 20 25 30 75 150 300-350

2 3 5 7 9 12 14 17 25 33 67

10-16 10-16 10 16 10-16 10-16 10-16 10-16 10-16 35 45-63 105

2'~ 17 33

Discharge time (s)

35 40 60 180 240

be extinguished by a nonexpert operator" as a function of extinguisher capacity. Since this value refers to a " n o n e x p e r t operator," only if the fire area exceeds this tabulated area will the volume be considered ineffective. The coverage for c a r b o n dioxide and dry-chemical extinguisher are given in table 7 and 8. If the volume is sufficient to extinguish the fire, then the time to suppression will be equal to the discharge time of the extinguisher. These data can also be found in ref. [47] a n d are given in tables 7, 8 and 9. In the event that there is too little suppressant to extinguish the fire, then there is no satisfactory suppression for that trial a n d the fire is allowed to burned out, presumably destroying the room with it. 2.4. Propagation m o d e l

W h e n discussing propagation of fires, two types can be considered, interzonal a n d intrazonal propagation. The first requires the breaching of a wall or door in most cases. To treat this analytically, the temperature of the zone boundaries (walls) must be examined with respect to the severity of the fire. The consequences of a wall failure necessitate continued analysis in the breached zone. This greatly increases the c o m p u t a t i o n a l requirements. C F C , for example, is currently set up to perform the calculation in a single enclosed room [32,33]. A study of the A N I data base [17,18] shows that interzonal propagation has occurred only once in nuclear power plant *. It will not be considered further in this paper. The remainder of this section will be devoted to intrazonal propagation. For intrazonal propagation, m a n y fire models use the concept of flashover, which is the simultaneous ignition of the remaining (non-burning) objects in the room after the original ignition; flashover is the most * The one notable exception is the Browns Ferry fire which began at the boundary of two zones.

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

extreme case of intrazonal propagation. Analytically, the occurrence of intrazonal propagation (simply referred to as propagation for the remainder of this paper) is treated by CFC, which uses a time-dependent control-volume model. One of the available output variables is the status of each zone-object; an object can change state from heating to burning. The criteria used by C F C to determine ignition of a nearby object are (1) flame contact and (2) surface temperature. In this way, propagation is established and treated accordingly in the detection and suppression models. Ref. [35] discusses the use of barriers in an analytical context, as well as methods to determine the level of protection provided by the barriers.

173

smoke detectors, the RI must contain a heat, smoke and human entry. The definition for the Resource Index must be divided into two components, for the detection and suppression systems. The detection system is considered operational (available) if at least one detector has not failed, which assumes that detectors of the same type have the same threshold level. This does not imply that the "single" working detector is as effective in discovering the fire as the entire system; this is a function of the detector placement, fire origin and material nature of the combustible. The probability of one or more detectors in working condition is: n

3. R e s o u r c e / A d e q u a c y

indices

Before a measurement index can be developed, a precise definition of the parameters to be used is required. The desired index (or indices) should identify the effectiveness of the total fire protection system. Three possible interpretations of "effectiveness" are considered. The simplest approach is to examine the reliability (or availability) of the equipment. This, however, fails to consider the subsequent action of the fire protection system, which is the second approach; this indicates how well the system performed, if, in fact, it was able to do so. The performance aspect can also be expanded, providing a third interpretation; namely, how well the system is designed. This discussion suggests that a single index (or interpretation) is inadequate and probably without much value. Therefore two indices are used, based on the first and second interpretations of "effectiveness." The first index is the Fire Protection Resource Index (RI). It basically examines the probability of successful operation. The second is designated as the Adequacy Index. It reflects how well the system, as designed, performs with respect to the fire hazard in the zone. 3.1. Resource index 3.1.1. Definition The Fire Protection Resource Index (RI) shows the reliability (or availability) of the components of the fire protection system; this includes the human and automatic aspects of the detection and suppression systems. This index is necessarily multi-faceted, relating a value for each component of the designed system. For example, if a zone is protected by a combination of heat and

where g = success probability for a individual detector, q = 1 - p = failure probability for a individual detector, n = total number of detectors in the system. The summation represents the probability of 1, 2 . . . . . i operational detectors. Note that i = 0 is not included in the sum; eq. (20) can be rewritten as:

-qo

1

Physically, this represents one minus the probability that all the n detectors fail, which by definition is the quantity RI; therefore RI = 1 - (

pf)n,

(22)

where q has been replaced by the familiar pf of section 2. Since there is a different pr value for each detector type, there will also be a RI value corresponding to each type. Eq. (22) is equally valid for human detection. For a normally occupied zone, n can be considered to be the number of people in the room; for a normally unoccupied zone, n can be considered to be the number of inspectors. In each case, only a single individual is required for detection of the fire. The values of pf used in the detection model are sampled from lognormal distributions derived from available data in section 2.2.1.1. For the Resource Index calculation, the median value, e ~' (/~ is a parameter of the lognormal distribution, will be used. For human detection, a lognormal distribution is also derived based on human factors data from Swain and Guttman [45]. For normally occupied zones, no failure probability is

174

S.H. Levinson, M.L. Yeater / Fire protection .~Tstems in m~c/ear power plants

required for the model; the same distributional median from the unoccupied zone model will be used. It is apparent from the above that there can be up to five components of the detection RI; this is rarely the case as usually only one form of automatic detection is used in conjunction with human detection. The suppression phase is also divided by the type of suppression system used. For sprinkler systems, the number of sprinkler heads is not a controlling variable as it is for a detection system. The sprinkler failure probability is based on the overall system, so RI = 1 - Pr, where Pr is the median value of the failure probability distribution. For the human operated suppression equipment, such as hose stations and portable extinguishers, the "atleast-one" criterion is no longer valid. The most conservative approach would be to require that all the available equipment be functional. This seems to be too stringent, as very often a fire will be extinguished without using all the available resources. Therefore, if more than two items (of the same type) are available, any one may fail and still leave a system which may be capable of extinguishing the fire. This does not imply that the suppression system will always be able to control the fire, just that the system components are in operational readiness. In this case: RI =

1 - (pr)"

for n < 2,

#l =

_-

) tl

:

where n is the number of hose stations or extinguishers. Since there is a single Pr value for all extinguisher types, only one RI is computed for all portable extinguishers. For human suppression, RI is computed as:

tion. This information is graphically presented as two bar graphs, one each for the detection and suppression systems. The x-axis indicates the specific system (as indicated in figs. 8-10), while the y-axis is the success probability or RI. The probabilities used in the calculations are based on the currently available data bases. As more information becomes available, better numbers and distributional representations can be implemented in the modeling and RI calculation. While providing the user with useful information about the fire protection system, there are some limitations inherent in the RI calculation. The Resource Index does no take into account a common mode failure: the formulas developed in the preceding section assume independence between the failures of the individual detectors and manually operated suppression equipment. To account for this, a separate analysis must be performed. Another limitation concerns the possible use of a priority matrix detection system. Such a system requires activation of at least two adjacent detectors before any automatic suppression action is initiated; this design feature is commonly used for the actuation of a halon system. The present RI calculation assumes that only one detector is required for functionality. The last item involves the human component of the detection phase. While a failure probability is supplied for humans (which is much lower than the automatic devices), this value is constrained by a time consideration. After a specific time, a fire is assumed to reach such proportions that no human in the vicinity could fail to notice it ( Pr = 0). The RI calculation occurs prior to this threshold time and the analyst should be aware of this when comparing the various elements of the Resource Index matrix.

3.2. Adequa~ y Index 3.2.1. Definition

where n = the number of fire brigade members, r = the number of members required to perform successfully for overall brigade success, p, q = success/failure probability of the individual fire brigade member, p* = success probability for suppression by a human who detects the fire. 3.1.2. Interpretation and limitations

The Resource Index provides two levels of informa-

The Adequacy Index (AI) reflects the ability of the system, as designed, to control a fire. While the RI was scenario-independent, the AI is clearly dependent on the reaction of the system during the course of the fire; therefore an AI value is generated for each trial of the simulation. Thus the AI forms a continuum of values, as opposed to the discrete nature of the R1. For the remainder of this section, the Adequacy Index is considered to be a single factor. While a single numerical value would be a convenient descriptor, it obscures much of the valuable information made availa-

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

ble by the simulation. The AI is formed by multiplication of four factors or sub-indices, which are best represented as distributions. These factors relate to different portions of the fire scenario which are indicative of the response of the overall system. These variables, which represent the detection system, suppression system, propagation likelihood and a combination of all three are: (1) time-to-detection, tD, (2) time-to-suppression, t s, (3) area covered, Av, (4) maximum temperature reached, Tma~. The time-to-detection is defined as the time required after ignition until any form of detection occurs. The time-to-suppression is the time from the moment of detection until the fire is extinguished. The area covered is the same A v defined in section 2.3.1.2.2 used for the suppression model. The maximum temperature refers to the hot layer temperature as calculated by the C F C code. To be able to multiply these variables into a single A1 and to examine them on a comparative basis, each is normalized to a dimensionless quantity. Each factor is normalized against a " m a x i m u m " value: (1) N o = t o / t ~ , (3) NA = A F / A ,

(2) N s = t R / t ~ , (4) N T = Tmax/T*ax ,

where t~, t* and T*ax* are upper limits of times-to-detection and suppression, and maximum temperature; A is the maximum floor area, calculated from the zone dimensions. Examining any individual normalized factor, the worst case, resulting from an observed value close to the upper limit, approaches a value of 1. Systems showing good performance, i.e. fast detection and suppression times, minimum fire spread and minimum increase of room temperature, will have normalized factors approaching, but never reaching, zero; times-to-detection and suppression must be greater than zero, and the fire area, based on the assumption that a fire has occurred, must also be greater than zero. The normalized temperature factor should be redefined as: rmax -

NT

Tamb

Tm*ax-77.mb'

where a "no-fire" condition results for the hypothetical zero value (for NT); Tamb is the ambient temperature of the zone. This definition also approaches a value of 1 for the worst condition, as did the original formula. Taking these together, the Adequacy Index is computed as: AI = NDNsNAN T.

(23)

175

As with the individual sub-indices, AI will vary from something greater than zero to a maximum limit of one.

3.2.2. Interpretation and limitations The Adequacy Index and its components are actually distributions, in which one value is contributed from each trial of the simulation. The information is displayed in the form of a frequency histogram, probability density function or cumulative distribution function. When plotted as a PDF, the F I R E S software allows for goodness-of-fit and statistical comparison tests to be performed. The above discussion refers to the AI distribution as well as the distribution of the normalized parameters (sub-indices). In fact, a study of the individual parameters can indicate to the analyst any relatively strong or weak aspects of the system. For example, if a simulation yields a high value for AI, further analysis might show that the biggest contributor to the high value is N O, indicating inadequacy of the specified detection system. There are several cases which do not clearly fit into the zero-to-one continuum. Consider a fire which is so small that the detection devices never record its occurrence; it burns out without spreading or causing appreciable damage. According to the formulation developed in the preceding section, t~ and t~ are both infinite. This, besides being difficult to handle analytically, distorts the results of the remaining scenarios. To avoid these difficulties, these cases of "non-fires" will be removed from the results and not included in the AI calculations. Since these "non-fires" cannot be scored along the AI continuum, they will be treated as binary e v e n t s - - e i t h e r occurring or not. When they do occur, a tally will be kept, so at the end of the simulation, the percentage of "non-fires" of all the trials can be reported. "Non-fires" are defined as any trial where the fire is undetected due to insufficiently of the fire symptoms only, i.e. not including any detector failures. At the other end of the spectrum are the " u n c o n trolled-fires"; those that remain undetected due to system failures or are unsuppressed due to suppression system failures or inadequacies. This presents the same difficulty with infinite detection and suppression times. As with the "non-fires," these will be treated as binary events and not included in the AI computations; only the total percentage of trials in which "uncontrolledfires" occur will be reported. A high percentage of either type of fire should signal the analyst to re-examine the design under consideration.

176

S.H. Levinson, M.L. }'eater / Fire protectwn *ystems in nuclear power plants

4. The F I R E S code

FIRES (Fires: Interactive Reliability Evaluation System) is a large F O R T R A N computer program written to implement the models discussed in section 2. The program is split between two computer systems: the P R I M E / I M L A C system of the Rensselaer Polytechnic Institute Center for Interactive Computer Graphics (CICG), and the IBM 3033 of the Office of Computer Service (OCS) at RP1. Communications are controlled by a software link described in ref. [49]; details of this system are described in ref. [35]. The purpose of this section is to provide a brief over-view of the program and the interactive graphics features. Appendices A - K of ref. [35] provide documentation of FIRES; Appendices M and N contain the Programmer's Guide and User's Manual, respectively. F I R E S is a menu-driven interactive graphics analysis package; a menu is a list of options that can be selected by one of the available interactive devices. The menu structure is shown diagrammatically in fig. 7. The graphics itself does not make the analytical models more sophisticated or powerful. However, graphics greatly enhances the ability to use the model. It increases the flexibility of runs that can be made and increases the number of trials in a practical series of analytical runs. Its basic function is to provide an i n p u t / o u t p u t interface with the analytical software. F I R E S requires that a fire zone be described with combustibles and fire protection equipment. Without graphics the user would be burdened with establishing a complex input file containing zone dimensions, object dimensions and the position of each object within the zone. With graphics, a few lightpen manipulations define and position an object. The software converts the information displayed on the screen into the data required for the input file. The procedure is the same for the identification and placement of detection equipment, suppression equipment, barriers and openings. The user never has to be concerned with the format or coding of the input file; the input is displayed in the most readable f o r m - - p i c torially on the screen. This highlights an advantage of graphics: once the input file is established, modifications can be made as easily as the original definitions were specified. This permits the user great versatility in performing a series of computer runs. Often the analyst is required to prepare graphs or other visual representations of the output data to draw an inference from the calculation. In the case of FIRES, the output is an index calculated for each trial of the Monte carlo simulation. These data are stored in a form

so that a frequency histogram, probability density Itlnction and cumulative distribution function can be displayed on the CRT. In addition, these plots can be used to perform a variety of goodness-of-fit and statistical comparison tests. All input: the input file, the test distribution type and its parameters, and the significance level, can be established by graphical means.

5: Results of test cases

Examples of three zones and their fire protection systems, based on a representative pressurized water reactor (PWR), are established as test input files for the analytical portion of FIRES. In addition to giving the program an opportunity to run with realistic data, the suitability of the input procedures is examined. In most cases, the necessary data can be entered without ambiguity. Three exceptions are evident: (1) the inability to model more than five zone objects, (2) the inability to model a pre-action water sprinkler system and (3) the inability to establish more than ten heat sensitive sprinkler heads. 5. l. Description o f test eases

This section provides a physical description of the zones and their associated detection and suppression systems, based primarily on a plant inspection tour made by the author. 5.1.1. Diesel generator room

The diesel generator room, 15.5 m × 6 m × 3.7 m, contains, as combustibles, a diesel generator, a control panel and cable tray. The diesel generator occupies most of the room, situated to the left and center. The cable trays run for about half the length of the back wall; the controller sits below the cable tray, in the back right-hand corner. The room is protected by a pre-action water sprinkler with smoke detectors acting as the initial detecting devices, allowing the water to flow into the dry pipes. The water is released by the activation of the 165°F heat-activated upright sprinkler heads. A single 20 lb dry chemical portable extinguisher is located in the room. Since the exact operation of a pre-action system cannot be modeled, the smoke detectors are considered to act only as detection devices and do not trigger the water flow. If the temperature reaches 165°F, the sprinkers will apply water regardless of the smoke detector's action. It is assumed that if the temperature

177

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

reaches 165°F, sufficient smoke is produced to trigger the smoke detectors (at least in the case of an oil fire). The primary modeling concern is that if the smoke detectors alarm, the detection processes ceases, thus not giving the heat-sensitive sprinklers an opportunity to activate and release the water. The portable extinguisher is actually located outside the fire zone in an unmodeled switchgear portion of the zone. Since the extinguisher distance limits are not exceeded, its modeled position does not affect the outcome of the simulation. 5.1.2. Switchgear room

This is relatively large zone, 30.5 m x 18.3 m × 6 m, with much electrical equipment. Arranged as parallel columns, width-wise in the room, the zone contains motor control centers, switchgears, electrical buses, inverters, transformers, batteries, battery recharger and covering about half the ceiling area, cable trays. This zone is modeled with only five objects (the maximum number allowed in the C F C V code), omitting the batteries, their rechargers, transformers and cable trays. The inverter is labeled as 'switchgear' since there is no such equipment designation (as 'inverter'). The room is protected by a total flooding H a l o ° 1301 system. Activation is triggered by 32 smoke detectors in a priority matrix system. The priority matrix feature is not modeled, and activation will occur at the first, not the first two, smoke detector actuated. Since modeling 32 detectors is not currently possible, they were collapsed into groups of four to form an 8 detector matrix. Title Display Menu l[HtU'n~/

I

I(.ap~, I

-~;I LO~ Menu

I

i. . . . . . .

"F.tL*t~)

Mono I

5.1.3. Oil storage room

This zone, 13.7 m × 9.4 m × 4 . 6 m, contains two large storage tanks, located side-by-side to the left of the center of the room. Against the right-hand wall are approximately ten 55-gallon barrels containing used oil. The left-hand side also contains some 55-gallon barrels; these later items are not included in the modeling. The ten barrels are modeled as a single cylindrical tank. The room is protected by a matrix of 24 heat-sensitive sprinklers. The sprinklers are of the fusible link type and are rated at 165°F. Since 24 d e t e c t o r s / sprinklers are more than the input of F I R E S can treat, the system was reduced to a matrix of eight detectors. There are no manually operated suppression devices located within the zone. There is, however, a variety of equipment situated just outside the oil storage room; this includes a hose station, two carbon dioxide extinguishers and a 125 lb wheeled dry chemical unit. Due to their proximity to the zone, they are modeled as being inside the room. 5.2. Results/discussion 5.2.1. Resource Index

Figs. 8-10 show the nine components of the Resource Index for the three zones. A glance at these bar graphs gives an indication of the relative reliability of the detection and suppression system components. The RI for heat detectors includes all the heat detectors with the assumption that only one is required to be opera0"9t~ I

~--~ ZONE Menu i~ . . . . . . "I(eELPZONq

I

The room contains four non-water extinguishers and a hose station. The modeled locations are accurate, which is significant due to the size of the room.

I

.................................

~-~F~rst Level RUN Menu

0.08 fl.B2 0.76 0.70 ]

I

0.58 8,52

Lev.,.0. Menu t

~."...... t (H~N2) i

~

.

~AT

R-OF -R

............................

. ~ F i r s t Level ANALYS Menu ] ~ S e e o n d Level ANAL'(S i(.tLe.'.',,-,) K...........tVen,~ (HELP.',N~)

i::. . . . . . .

,o,r

t.~

I

on ,,co..,

~

FL~

BI_ ~_TLC!L0_N__I~ ! ;LS . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I

0.97 I ~.gq I B.9!

Me°,.,

ZZ. t

g,88 ~:. "

!

i~i............... hMenu

~,~-.~SUPPRession Menu

i::........... "I(H~PP)

]

"Z---')J PROPoGotion Menu

~:!:.....

"l ("~)

I

Fig. 7. 18-element line menu hierarchy.

(~le~P)

I

J

IL73 e,78 ~I~L~

~

9. EXTI~. RI ~ S S I ~ I~ICES

HUKIqN

Fig. 8. Diesel generator zone: resource index.

t 78

S.H. Lemnson, M.L. Yeater / Fire protection mstem.~ in nuclear power plant.~ L2fl ~ !

0-9LI [

N F i l l /tK/~i~ ZZ. L I I I I11

fl.88 0.82 0,76

~.70

r

f,q~l HEAT

R-OF-R

St'I~E

FLRI'E

a

_

_

i

i

E

i

0 F

_R__ Z~ _T.E £LT/ PB__I_ND _I~ _S ............................

............................

097 0.9~

N

U M

0.6~. 0.58 I

6fl,l~ t

Ti

R 40.~

Z7,2 - - - -

0.91 ] 0"88 I ~.85 g.82 I

I

0.76

I

0fl2

0.73 fl.7fl

o,og

flJ0s

0108

fit0

a:t2

oi~4

o.~6

oi~a

TOT~ R; ~¢~RINKLER

HOSE S. EXTIN(3. RI SUPPRESSION INDICES

Fig. 1 l. Diesel generator zone: total adequacy index.

Fig. 9. Switchgear zone: resource index.

tional for the entire detection system to function. Not unexpectedly, the human RI values are consistently less than their machine (automatic) counterparts. The y-axis (probability scale) anchor values willtypically differ between the detection and suppression R1 values in the same zone. The anchor values are a function of the values being plotted, thus care should be taken when comparing (or contrasting) the RI values of the detection and suppression system. The bar graphs also clearly indicate at a glance what methods of detection and suppression are being used in the zone under study.

fl.9~ fl.fl8 0.82

fl.78 0.7fl 0.6t~ fl.58 fl.52

[m_]

fl.'46 HEAT

R-IOF-R

SMOI~

FL,Ot'IE

HUI'RN

............................ B_I__~T_E_C_T~. _I ~~_I~ .S. . . . . . . . . . . . . . .

5.2.2. Adequacy Index To aid in the interpretation of the Adequacy Index a n d its c o m p o n e n t values, the artificial upper limits used in the normalization process must be known. These are given in table 10; the limits are selected based on the k n o w n (raw) o u t p u t data. The AI histograms for the three zones are shown in figs. 11-13. The total AI for the diesel generator zone (ZZ.1, fig. 11) shows a strong peak at the 0.09-0.10 range, which indicates, on the average, c o m p o n e n t values a b o u t 10% of the upper limit values (used for normalization). The cluster of values indicates that the simulation generates similar results for each trial. Note that the fire area and temperature c o m p o n e n t s should be strongly positively correlated with the time-to-detection value. Both of these parameters are limited by a fast time-to-detection. The individual c o m p o n e n t s support this observation. The variability in the results (what little there is) is generated from the time-to-suppression component. The results for the switchgear room (ZZ.2, fig. 12) are very similar to the previous case, a single concentrated peak of values, with scattered points to either side; even the numerical values are approximately the

t.~

fl,97 ]

_ _

o.8~ ~'9"I I

T

ZZ,3

Table 10 Arbitrary upper limits used in the normalization process

0.fl2 ] 0.78 I 0.76

Upper limit values

TTD TTX TMAX (s) (min) (K)

NTRIAL

Zone 1 (Diesel generator) Zone 2 (Switchgear) Zone 3 (Oil storage)

300 300 300

100 50 29

0.73

0.70

~RINI~F.R

HOSE S. EXTINO. RI SUPPRESSIONINDICES

Fig. tO. Oil storage zone: resource index.

300 20 20

1500 600 1500

179

S.H. Leuinson, M.L. Yeater / Fire protection systems in nuclear power plants

same. Also note that more trials appear to the left of the peak (indicating better performance) than to the right. If the reverse had been true, further investigation of the individual components would be warranted to identify the one (or more) factors contributing to the higher values. Despite the similarity in the complete AI, the components of the switchgear zone differ greatly from that of the diesel generator zone. In spite of the satisfactory results indicated by the total AI, the differences in the component values should be a matter of concern. The main reason for the differences is that a halon system is used as the primary suppression means, thus the timeto-suppression has little variability, in distinct contrast to the previous case. The variability of the total AI is mainly a function of the time-to-detection. Nonetheless, the fire area and temperature components have little range due to the large area of the zone (as the normalization factor) and the relatively small increase in the ambient temperature (which is not uncommon for a cable insulation fire). The oil supply zone (ZZ.3, fig. 13) shows the greatest variety in AI values. Note that the numerical values of the AI are again similar (in range) to the previous two cases; this provides support to the selection of the arbitrary limits, as well as demonstrating the well designed zones in terms of the fire protection system's performance. However, the wide variety of the values should be an indication to the analyst that examination of the four AI sub-index values is needed. Fig. 14 shows these parameters. Note the concentrated values of the timeto-detection, fire area and maximum temperature; detection is very fast. This is indicated by the close-to-zero

- -

M

ZZ,2 I.III

N-FIAE / Lle;ITRL :Z.3 e.mm o n

--

N 4.00] U M

B E R

3.20

0

2.q~

F

R ~601

o.[~ L ~.g6

g.~7

j

l

8.00

0.08

0.10 TGTRL A;

0.1t

e.~L~

[6.~

012

~:L3

Fig. 13. Oil storage zone: total adequacy index. values shown in fig. 14. Since this is an oil fire, the zone heats rapidly yielding similar results as the diesel generator zone. The great variability in the total AI is obviously generated from the time-to-suppression component. In addition, these are much higher than any previously observed values. Further investigation of the adequacy of the suppression system is indicated. The variety of the times-to-suppression are presumably due to the various methods of suppression available, see fig. 10. The energy output rate must vary just enough, so that in conjunction with the various suppression equipment failure rates, different combinations of equipment are used to extinguish the fire producing many different times-to-suppression. The interpretation of the AI can only indicate when there is a malfunctioning of the detection and/or sup-

i.mm

- -

.~.ill

RI -D

........

AI -$

N

.....

AI ~A

U

......

A] -T

~ ~.~ E R 0 15.• F T

~2.aem

B

T R 1 A L 8

4.8~

R

ZZ.3

NON-FIRZ- 1111 UNCNTRL- I.m

18,W L.-., i

8.~

5.~

!i....,: e. - - f ~ J

t.~ 11:84

o:e8 TO%qL

.~.

0.

g.10

8.12

AI

Fig. 12. Switchgear zone: total adequacy index.

~.[~+

e

ii.....i

J.O~

OILO

i

........... :

......:

...................

4 AI F R C T ~

Fig. 14. Oil storage zone: four component indices.

!

i

180

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power phmt~

pression system. The Adequacy Index does not suggest the possible causes of failure; some information of this nature could probably be extracted from the simulation with a more complex output interface. This amount of output data would overwhelm the user and most likely be less useful than originally intended. However, some knowledge of the failure mode is vital if the analyst is to examine the system parameters and arrive at some conclusion. The following list supplies some of the failure reasons, but is by no means complete: Detection:

(a) (b) (c) (d) (e)

failure of automatic system, failure of human agent, poor judgement when positioning detectors, insufficient number of detectors, threshold value set too high.

Suppression:

(a) (b) (c) (d) (e)

failure of automatic system, poor performance by human agents, failure of manually operated equipment, unavailability of manually operated equipment, inadequate type of manually operated equipment for the type of fire, (f) no detection. Note that any of the reasons given above can themselves be caused for a variety of reasons. For example, the threshold value of a heat detector could be inadequate due to an error in the manufacturing process, damage caused during transport, damage caused by installation (or improper installation), poor engineering judgement when determining the detector's threshold value, error during the setting of the detector in the plant or an error during testing or maintenance.

6. Conclusions The model and its software analogue perform their intended function. With the Resource Index and the Adequacy Index, certain generalizations can be made concerning the effectiveness of the fire protection system in a fire zone of a nuclear power plant. Modeling and software refinements which would provide additional information are discussed in ref. [35]. The results from the test cases indicate that the fire protection systems in the plant studied are adequately designed, with the possible exception of the suppression system in the oil storage zone. While reasonable, interpretable results are obtained with FIRES, there is no comparative base to substantiate the results. N o other

known calculations of a similar nature have been performed. The user is cautioned against treating the AI components and the total value as only a single number, such as a mean. Because of the general lack of variability, a mean loses most of its value as an overall descriptor variable. Treating the AI as a distribution is the most reasonable option. If a single number were to be used in selected cases, in the light of the current results, the mode would probably be the most useful value. There are a variety of other cases that could be considered. The detector reliability, its type or threshold value could be changed. The reliability and type parameters apply equally to the suppression equipment. The suppression model can be further modified by varying the type. amount and delivery rate of the extinguishing age,it. H u m a n failure (or success) probabilities can be altered, as well as the number of fire brigade members, the number of members required for successful operation. arrival time, etc. Most of the parameters mentioned above can be easily modified by interactive means with the F I R E S graphics. However, some, such as the distributional parameters affecting the detector and suppressor failure probabilities, cannot be interactively varied in the present version. Such a capability would be worthwhile and useful to the analyst.

Acknowledgements The authors wish to thank American Nuclear Insurers and Dr. Leo Mariani for the financial and technical support provided under the auspices of the Michael Bellanti Fellowship. We would also like to thank Dr. Henry Mitler of Harvard University for the C F C code and our many long distance telephone conversations needed to get it running, and the staff of the C I C G for their help in the development of the graphics and interface portion of FIRES. Thanks are also extended to Jonathan K. Witter for aiding in the preparation of the final draft.

References [1] R.H.V. Gallucci, A methodology for evaluating the probability for fire loss of nuclear power plant safety function, Ph.D. Thesis, Rensselaer Polytechnic Institute, Troy, N.Y. (May 1980). [2] Browns Ferry nuclear plant fire; Hearings before the Joint Committee on Atomic Energy, Congress of the United States, 94th Congress, First Session (September 16, 1975).

S.H. Levinson, M.L. Yeater / Fire protection systems in nuclear power plants

[3] Regulatory Investigation Report on fire in cable spreading room and reactor building on 22 March 1975 at Browns Ferry units 1 and 2, US Nuclear Regulatory Commission (July 1975). [4] Guideline for fire protection for nuclear plants, Branch Technical Position 9.5-1, Appendix A. [5] Fire Protection Program for nuclear power plant facilities operating prior to January 1, 1979, Code of Federal Regulations, Energy 10, part 50, Appendix R (revised as of January 1, 1982). [6] Generic requirements for light water nuclear power plant fire protection (Draft), ANSI N18.10/ANS 59.4. [7] R. Gallucci and R. Hockenbury, Fire-induced loss of nuclear power plant safety function, Nucl. Engrg. Des. 64 (1981) 135. [8] D.L. Berry and E.E. Minor, Nuclear power plant fire protection--fire-hazards analysis (Subsystems Study Task 4), Sandia National Laboratory, Albuquerque, New Mexico, SAND79-0324, NUREG/CR-0654 (September 1979). [9] D.L. Berry, Nuclear power plant fire protection--philosophy and analysis, Sandia National Laboratory, Albuquerque, New Mexico, SAND80-0334 (May 1980). [10] K.N. Fleming, W.J. Houghton and F.P. Scaletta, A methodology for risk assessment of major fires and its application to an HTGR plant, General Atomic Company, GAA15402 (July 1979). [11] G. Apostolakis, Probabilistic analysis of the fire risk in nuclear power plants, First Progress Report, UCLA, Contract No. NRC-04-78-198 (June 1978). [12] G. Apostolakis, Probabilistic analysis of the fire risk in nuclear power plants, Second Progress Report, UCLA, Contract No. NRC-04-78-198 (October 1978). [13] J.H. Talbert, Pre-fire planning for nuclear power plants, Proceedings of ANS/ENS Topical Meeting, Thermal Reactor Safety, Vol. 1, CONF-800403/V-1, Knoxville, Tenn. (April 6-9, 1980). [14] R.E. Hall, P.K. Samanta, A.L. Swoboda, Sensitivity of risk parameters to human errors in reactor safety study for a PWR; NUREG/CR-1829, BNL-NUREG-51322 (January 1981). [15] Y.A. Shreider, The Monte Carlo Method (Pergamon Press, New York, 1966). [16] Power plant fire brigade reference text, Professional Loss Control, Inc., Oak Ridge, Tennessee. [17] D. Garlington, Fire incident data analysis system, Masters Project, Rensselaer Polytechnic Institute, Troy, New York (May 1978). [18] A.G. Sideris et al., Nuclear plant fire incident data file, Nuclear Safety 20 (May/June 1979). [19] Nuclear power plant fire protection--fire detection (Subsystems Study Task 2), Sandia National Laboratory, Albuquerque, New Mexico, SAND78-1313, N U R E G / CR-0488 (March 1979). [20] R.W. Bukowski, Large-scale laboratory fire tests of smoke detectors, in: Fire Detection for Life Safety, Proceedings of a Symposium (National Academy of Sciences, Washington, D.C., 1977).

181

[21] E. Wall and J. Reddin, Ionization-photoelectric smoke detection tests, Dictograph Security Systems, Division of Guardian Industries, Inc. (Florham, New Jersey) and Pyrotector, Inc. (Highham, Mass., November 1975). [22] G.J. Grabowski, The application of thermal and flame sensors to fire detection systems, in: Fire Detection for Life Safety, Proceedings of a Symposium (National Academy of Sciences, Washington, D.C., 1977). [23] B. Verna, Nuclear Power Experience, Inc., Encino, California. [24] H.N. Nelson, Jr., The need for full-function test features in smoke detectors, Fire Technology 15 (February 1979). [25] T.Z. Harmathy, A new look at compartment fires, Parts I and II, Fire Technology 8 (August 1972) p. 196, and (November 1972) p. 326. [26] I.I. Pinkel, Estimating fire hazards within enclosed structures as related to nuclear power stations, BNL-NUREG 23892, Brookhaven National Laboratory (January 1978). [27] R.L. Alpert, Response time for ceiling-mounted fire detectors, Factory Mutual Research, Norwood, Mass., FMRC Serial No. 19722-3 (1972)., also Fire Technology 8 (August 1972) p. 181. [28] N.J. Alvares and H.K. Hasegowa, Fire hazard analysis for fusion energy experiments, Fire Safety Journal 2 (1979/1980) 191. [29] C.D. Coulbert, Energy release criteria for fire hazard analysis--Part I, Fire Technology 13 (1977). [30] Why America burns, PBS Channel 17 (WMHT), NOVA presentation, (October 10, 1981). [31] Third Annual Conference on Fire Protection, Final Report, Ed.: Ileana M. Martinez, Center for Fire Research, National Engineering Laboratory, NBS, Washington D.C., NBSIR-79-1916 (October 1979). [32] H.E. Mitler, Physical basis for the Harvard Computer Fire Code, Home Fire Project Technical Report No. 34, Division of Applied Sciences, Harvard University, Cambridge, Massachusetts (October 1978). [33] H.E. Mitler and H.W. Emmons, Documentation for CFC V, the Fifth Harvard Computer Fire Code, Home Fire Project Technical Report No. 45, Division of Applied Sciences, Harvard University, Cambridge, Massachusetts, (October 1981). [34] C.D. MacArthur, Mathematical modeling of enclosed fires - - a review of current US research, in: Fire Research and Safety, National Bureau of Standards, NBS Special Publication 540, Washington DC (Nov. 1979). [35] S.H. Levinson, Methods and criteria for evaluation of nuclear reactor fire protection alternatives and modifications, Ph.D. Thesis, Rensselaer Polytechnic Institute, Troy, New York (December 1982). [36] R.G. Bright, Recent advances in residential smoke protection, Fire Journal (November 1974). [37] Third Annual Conference on Fire Protection, Final Report, Ed.: Ileana M. Martinez, Center for Fire Research, National Engineering Laboratory, NBS, Washington D.C., NBSIR-79-1916 (October 1979), pp. 62-65. [38] R.G. Bright, Status and problem of fire detection for life safety in the United States, in: Fire Detection for Life

182

[39]

[40]

[41]

[42]

[43]

[44] [45]

S.H. Let#nson. M.L. Yeater / Fire protectton systems m nuclear power plants

Safety, Proceedings of a Symposium; National Academy of Sciences, Washington D.C. (1977). R.W. Bukowski and G.W. Mulholland, Smoke detector design and smoke properties, in: Fire Research and Safety; National Bureau of Standards, NBS Special Publication 540, Washington, D.C. 'November 1979). N.J. Alvares and R.J. McKee, The response of smoke detectors to pyrolysis and combustion products from aircraft interior materials, in: Fire Detection for Life Safety, Proceedings of a Symposium; NAS, Wash., D.C. (1977). Application data, flame detectors, B-188, in: Pyr-a-larm Early Warning Fire Detection and Alarm Systems; Pyrotronics, Cedar Knolls, New Jersey (September 1974). S.H. Levinson and M.L. Yeater, Evaluation of the human component of a fire protection system in a nuclear power plant, to be submitted to Nucl. Engrg. Des. E.J. Gumbel, Statistical theory of extreme values and some practical applications--a series of lectures, National Bureau of Standards, Applied Mathematics Series 33 (Febraary 1954).' E.J. Gumbel, Statistics of Extremes (Columbia University Press, New York, 1958). A.D. Swain and H.E. Guttman, Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications, Draft Report for Interim Use and Comment, NUREG/CR-1278; Sandia Laboratories, New Mexico (October 1980).

[46] Results of 1977 tests of dry-pipe valves, quick-opening devices, deluge valves, and special system, NL-51: Industrial Risk Insurers (IRI), Hartford. Connecticut lMarch 1978). [47] Handbook of Industrial Loss Prevention, Second Edition; Factory Mutual System (McGraw-Hill Book Company, New York, 1967). [48] Private communication, plant personnel (May 1980). [491 J. Fisher, S. Levinson and J. Witter, Software-driven IBM/PRIME remote system, Internal document, Rensselaer Polytechnic Institute, Troy, New York (December 1982). [50] Fire Protection Handbook, Thirteenth Edition; NFPA, Boston, Mass. (1969). [51] M.J. Miller, Risk management and reliability, Factory Mutual Research, presented at Third International Safety System Conference (Wash. D.C., October 1971). [52] M.J. Miller, Loss prevention: reliability of fire protection systems, Chemical Engineering Progress, Vol. 70. No. 4 (April 1974). [53] P. Nash and R.A. Young, Automatic sprinkler systems for fire protection (Victor Green Publications Limited, London). [54] H.W. Marryatt, Automatic sprinkler performance in Australia and New Zealand 1886-1968 (Australian Fire Protection Agency, Melbourne, Victoria Australia, April 1971).