Challenges and Open Issues

10.1Mobile equipment and help from outside the plant site

• 
  a list of organizations and institutions involved, their responsibilities and subordination in the emergency conditions;
  
• 
  the types of support that could be expected (e.g., firefighting, repair activities, transportation, mobile equipment and fuel supply, etc.);
  
• 
  the conditions for identification of transfer from normal to an emergency operation and declaration of the emergency;
  
• 
  the notification, communication and reporting lines and procedures;
  
• 
  the emergency teams activation, arrival and response procedures;
  
• 
  the technological risks that may be imposed in case of some actions;
  
• 
  the technologically defined maximal times to take mitigation measures;
  
• 
  the sequence of actions;
  
• 
  the prescribed timeframes.
  

While familiarization with the national and regional ER documents is useful for understanding the overall response structure and organization, it is practical to focus further studies primarily on the on-site, the particular facility, its technological structure and local emergency response actions. On the necessity the analysis may be extended to take into account other off-site response. The data to be collected include⁵:

• 
  the type of the emergency response facilities;
  
• 
  the quantitative resource of the emergency response facilities (quantitative estimation of the emergency response facilities in respect to the respective nuclear facility size: number of units, spent fuel storages, other);
  
• 
  location of emergency response facilities (e.g., fire station, mobile equipment hangars);
  
• 
  transportation routes that will be used;
  
• 
  ER team organization and capabilities (staff number, training, specialized emergency equipment and machinery availability and readiness, etc.);
  
• 
  emergency response procedures;
  
• 
  emergency response staff preparedness to cope with any situation that may occur;
  
• 
  24h availability of the emergency response staff, availability of second shift;
  
• 
  communication organization and means;
  
• 
  notification processing and arrival time;
  
• 
  location and inventory of water, special firefighting means, and fuel sources to be used, location of fire water stand pipes and mobile equipment connecting points.
  

The general guidance on modelling the emergency response to a fire is provided in NUREG/CR6850 [27]. The probability of fire brigade failing to suppress the fire is estimated using the following formulae:

 – fire suppression rate.

• 
  potential spread of smoke and heat through the access doors that may result in a damage of equipment and ignition of fire sources located therein or propagation of fire to adjacent area in the case of suppression failure;
  
• 
  potential damage of equipment caused by spreading of fire suppression substances;
  
• 
  influence of smoke on fire suppression effectiveness⁶.
  

It is recognized that organization and capabilities of fire brigades at NPP under evaluation may vary from those accounted in NUREG/CR6850, and applicability of suppression rate data from NUREG/CR6850 may be questioned.

Earlier analyses which took into account fire brigade response, utilized plant specific fire drill data to estimate the fire suppression probability assuming that the time to detect, respond, and extinguish the fire are equivalent to those observed in the drills. This simplified approach may lead to underestimation of the time to extinguish a fire especially for the plant areas where substantial smoke build-up is possible prior to arrival of the fire brigade (see ch.V2 of IAEATECDOC1134 [26]). Therefore, the application of domestic or applicable international data on fire brigades response to actual NPP fire events to estimate fire suppression probability is more preferable. If existing data are insufficient for obtaining representative estimates, the review of fire brigade practices, interviews of fire department personnel and plant walk-downs may be used (see [54] and ch.V2 of IAEATECDOC1134 [26]). Alternatively, the plant-specific information from actual fire events can be compared with NUREG/CR6850 data, and appropriate adjustment method introduced if deemed necessary. Usage of Boolean/discrete representation of ER success or failure instead of variable probability distribution is also may be found applicable (especially at the initial stages of analysis).
Aircraft crash fires represent a significantly higher threat to the plant SSCs as compared to "conventional" fires because of the larger fuel quantities involved, the very rapid rate of fire development, the combination with structural damages as impact result, and the necessity to use special firefighting equipment (e.g., foam generators), suppression agents and specific firefighting operations. The effects associated with aircraft crash fires include (see ch.4.23 of IAEA NSG1.5 [29], 5.16 of NSG3.1 [41]):

• 
  burning of aircraft fuel outdoors causing damage to exterior plant components important to safety;
  
• 
  explosion of part or the whole aircraft fuel externally to buildings;
  
• 
  entry of combustion products into ventilation or air supply systems, thereby affecting personnel or causing plant malfunctions such as electrical faults or failures in emergency diesel generators;
  
• 
  spreading of aircraft fuel to the compartments through normal openings, through holes/cracks which may have resulted from the crash or as a vapour or aerosol through air intake ducts, leading to subsequent fires or explosions.
  

The spill of aircraft fuel on large area shall be taken into account. Such fire can cause smoke curtain in the area of the accident and obstacle the initial visual estimations of the accident consequences.

Combination of aircraft fuel fire with affected equipment on the ground must be taken in account:

• 
  transformer oil in unit / auxiliary transformers;
  
• 
  compressed air receivers /tanks/ (for example for DG starting system, etc.);
  
• 
  diesel fuel tanks;
  
• 
  compressed hydrogen receivers /tanks/ (for example for generator filling system);
  
• 
  other storages for inflammable / explosive media.
  

There is no experience with damage induced by aircraft falling on nuclear islands. Therefore evaluation of fire brigades capabilities to cope with the fires induced by an aircraft crash is based mainly on engineering judgment, interviews of fire department personnel, and large pool fire estimates and experience. Some recommendations on estimation of fuel quantity penetrating into a building in the case of aircraft impact, pool fire size, and simulation of fire effects can be found in [55]. The time and means needed for emergency response can be estimated mainly on the experience of fire brigades with the fires of similar scale.

Appendix 3 contains additional material relevant to emergency response related to aircraft crash hazards.
The guidance on modelling the emergency response to a fire can be adopted for modelling of mobile equipment usage (e.g., mobile pumps for steam generators feed and service water supply, mobile diesel generators). For this case time available for emergency response is determined based on the results of thermal-hydraulic accident analyses, and typical response time is estimated from emergency drills records. As in the fire response evaluation the restricting conditions imposed by the hazard progression scenario need to be taken into account in estimating the scenario-specific timing. Criteria and considerations given in NUREG1852 [56] may be applied as a guidance for evaluating and demonstrating the correctness of assumptions on scenario-specific timing estimate. Sufficiency of the water sources inventory and fuel supply available for mobile equipment operation need to be evaluated considering the consumption rate in particular scenario and potential dependencies between water inventory discharged for fire suppression and for supply by mobile equipment if sharing of same water sources is permitted for both purposes.
Incorporation of emergency response to a PSA model involves:

• 
  introduction of additional top event(s) to the event trees representing plant response to a particular hazard (hazard event tree);
  
• 
  identification of end states for successful or unsuccessful ER sequences (with or without transfer to the internal initiators Level 1 PSA event trees);
  
• 
  modification of correspondent event and/or fault trees of basic Level 1 PSA model.
  

Depending on the specific features of software used to construct PSA model, the modifications of system or functional fault trees may be implemented either by incorporation of additional house events allowing to change fault tree logic for different accident sequences or by exchange events. It shall be noted that incorporation of several top events to the hazard event tree may be required depending on the complexity of potential hazard development and its consequences. Depending on the nature of the hazard and of its secondary effects, their progression, timing/effectiveness of emergency response, the following consequences may be distinguished:

A. The hazard and its secondary effects do not affect safety-related SSCs directly or due to their progression. In this case the end state of correspondent sequence in the hazard event tree is OK (see Figure 10 , sequence #1).

B. Hazard or its secondary effects may affect safety-related SSCs either directly or due to their progression, but cannot lead to initiating event. Emergency response can either prevent failure of safety-related SSCs or minimize number of failed SSCs. Similar to the above case the end state of correspondent sequence in the hazard event tree is OK (see Figure 10 , sequence #2).

C. Hazard or its secondary effects either directly or due to their progression may cause an occurrence of IE accounted in the internal initiators Level 1 PSA if emergency response actions are not successful. Then unsuccessful ER sequence in the hazard event tree ends with a transfer to IE considered in Level 1 PSA (see Figure 10 , sequences #3, 4). To reflect failures of equipment caused by the hazard (and, potentially, by emergency response) event tree and/or fault trees of basic Level 1 PSA model are modified.

D. Emergency response does not allow to preclude an occurrence of IE accounted in the internal initiators Level 1 PSA, but changes number/nomenclature of failed safety-related SSCs or provides additional means (e.g., mobile equipment or failed equipment recovery) to cope with the accident. Both sequences are accounted similar to unsuccessful ER path of case C, above. Additional means are accounted by incorporation of correspondent top event(s) representing new possibilities to perform the safety function to the Level 1 PSA ET. Probabilities of mobile equipment failure are accounted in the fault tree linked to this top event.

E. Hazard produces more severe consequences than initiating events accounted in Level 1 PSA for the internal initiators. In this case a representative IE from Level 1 PSA is selected as the end state of hazard event tree, and additional failures are reflected in correspondent event and/or fault trees (see Figure 10 , sequence #5).
Figure 10: Sample hazard event tree with fire brigade response modelled

In emergency response evaluation and modelling the number of difficulties and uncertainties may arise that need to be resolved. Generally these are associated with multiple hazard consequences (e.g., multiple fires requiring to assume particular fire suppression sequence), uncertainty in their number and severity (e.g., fuel quantity spilled outside and inside the building affected by aircraft impact), unavailability of representative data to estimate emergency response success, assessing co-ordinated emergency response to the hazard consequences that requires sharing of available resources (e.g., necessity to address both off-site and on-site hazard consequences), etc. Resolution of these difficulties involves introduction of bounding assumptions that allow limiting the number of potential scenarios to be evaluated.