Operating experience from HEAF events reported to INES and IRS (from Berg & Forell et al., 2009)
Operating experience from different industries has shown a considerable number of reportable events with non-chemical explosions and rapid fires resulting from high energy arcing faults (HEAF) in high voltage equipment such as circuit breakers and switchgears.
High energy arcing faults can occur in an electrical system or component through an arc path to ground or lower voltage, if sufficiently high voltage is present at a conductor with the capacity to release a high amount of energy in an extremely short time. High energy arcing faults may lead to the sudden release of electrical energy through the air.
The significant energy released in the arcing fault of a high voltage component rapidly vaporizes the metal conductors involved and can destroy the equipment involved. The intense radiant heat produced by the arc can cause significant damage or even destructions of equipment and can injure people. However, this problem has been underestimated in the past (Owen, 2011a and 2011b).
Arcing events are not limited to the nuclear industry. Examples for such events could be found, among others, in chemical plants, waste incineration plants, and in conventional as well as in nuclear power plants underlining that high-energetic arcing faults are one of the main root causes of fires in rooms with electrical equipment (HDI-Gerling, 2009).
An evaluation of several loss incidents in different types of industrial plants has shown that causes for the generation of arcing faults are mainly due to (HDI-Gerling, 2009):
contact faults at the screw-type or clamp connections of contactors, switches and other components due to, e.g., material fatigue, metal flow at pressure points, faulty or soiled clamp connections,
Creeping current due to humidity, dust, oil, coalification (creeping distances, arcing spots),
Mechanical damage due to shocks, vibration stress and rodent attack,
Insulation faults due to ageing (brittleness), introduction of foreign matter and external influences.
Investigations of HEAF events have also indicated failures of fire barriers and their elements as well as of fire protection features due to pressure build-up in electric cabinets, transformers and/or compartments, which could lead to physical explosions and fire. These events often occur during routine maintenance.
HEAF have been noted to occur from poor physical connections between the equipment and the bus bars, environmental conditions and failure of the internal insulation (Brown et al., 2009).
The interest in fire events initiated by high energy arcing faults has grown in nuclear industry due to more recent events having occurred at several nuclear installations.
In the ongoing discussion on an international level it appeared necessary to find a common understanding about the definition of high energy arcing faults.
Currently, high energy arcing faults are seen as high energy, energetic or explosive electrical equipment faults resulting in a rapid release of electrical energy in the form of heat, vaporized metal (e.g. copper), and pressure increase due to high current arcs created between energized electrical conductors or between an energized electrical conductor and neutral or ground.
Components that may be affected include specific high-energy electrical devices, such as switchgears, load centres, bus bars/ducts, transformers, cables, etc., operating mainly on voltage levels of more than 380 V (OECD/NEA, 2009a).
The energetic fault scenario consists of two distinct phases, each with its own damage characteristics and detection/suppression response and effectiveness:
First phase: Short, rapid release of electrical energy which may result in projectiles (from damaged electrical components or housing) and/or fire(s) involving the electrical device itself, as well as any external exposed combustibles, such as overhead exposed cable trays or nearby panels, that may be ignited during the energetic phase.
Second phase, i.e., the ensuing fire(s): this fire is treated similar to other postulated fires within the zone of influence.
However, a common definition of high energy arcing faults is expected as one result of a comprehensive international activity of the OECD on high energy arcing faults in the member states of the Nuclear Energy Agency (NEA) (see below).
A variety of fire protection features may be affected in case of high energy arcing faults events by the rapid pressure increase and/or pressure waves (e.g. fire barriers such as walls and ceilings and their active elements, e.g. fire doors, fire dampers, penetration seals, etc.).
The safety significance of such events with high energy arcing faults is non-negligible. Furthermore, these events may have the potential of event sequences strongly affecting the core damage frequency calculated in the frame of a probabilistic fire risk assessment.
2. High energy arcing faults and work safety
Although only the technical consequences for nuclear power plants and other nuclear installations in case of a HEAF event are discussed in the following in detail, another important hazard resulting from arcing faults should not be ignored. This is the possible injury of workers.
Based on previous statistics it is expected that solely in the U.S. more than 2,000 workers will be seriously burnt by the explosive energy released during arcing faults within one year (Lang, 2005). The magnitude of this problem is far reaching, and the following statistics are staggering (Burkhart, 2009):
44,363 electricity-related injuries occurred between 1992 and 2001,
27,262 nonfatal electrical shock injuries,
17,101 burn injuries,
2,000 workers admitted annually to burn centres for extended arc flash injury treatment.
Three main consequences for workers result from a high energy arcing fault: blinding light, intense heat and thermo-acoustic effects.
Blinding light: As the arc is first established, an extremely bright flash of light occurs. Although it diminishes as the arcing continues, the intensity of the light can cause immediate vision damage and increases the probability for future vision problems.
Intense heat: The electrical current flowing through the ionized air creates tremendously high levels of heat energy. This heat is transferred to the developing plasma, which rapidly expands away from the source of supply. Tests have shown that heat densities at typical working distances can exceed 40 cal/cm². Even at much lower levels, conventional clothing ignites, causing severe, often fatal, burns. At typical arc fault durations a heat density of only 1.2 cal/cm² on exposed flash is enough to cause the onset of a second-degree burn.
Thermo-acoustic effects: As the conductive element that caused the arc is vaporized, the power delivered to the arc fault rises rapidly. Rapid heating of the arc and surrounding air corresponds to a rapid rise in surrounding pressure. The resultant shock wave can create impulse very high sound levels. Forces from the pressure wave can rupture eardrums, collapse lungs and cause fatal injuries.
Most of these people will neither have been properly warned of the hazards associated with arc flash nor will they have been adequately trained in how to protect themselves.
While the potential for arc flash does exist for as long as plants have been powered by electricity several factors have pushed arc flash prevention and protection to the forefront.
The first is a greater understanding of arc flash hazards and the risk they pose to personnel. Research has started since a few years for quantifying energy and forces unleashed by arc flash events. This has resulted in the development of standards to better protect workers.
Arc-flash hazard analysis is important in determining the personal protective equipment required to keep personnel safe when working with energized equipment. Contact with energized equipment is a commonly known risk; however exposure to incident energy from an electrical arc is sometimes overlooked. On that background approach boundaries have been determined to improve the arc flash hazard protection (Lane, 2004)
There is much discussion regarding how thorough an arc-flash hazard assessment must be. A complete examination of the system would require assessment at each and every possible work location, a task that is unrealistic to complete. Even if this task was undertaken, some of the accepted analysis methods pose some concerns as to whether the assessment considers the ΄most likely΄ fault scenarios.
The fundamentals of arc-flash hazard analysis are discussed in (Avendt, 2008 and Lane, 2004). The methodology used in the arc-flash hazard analysis is recommended in (IEEE, 2002) where techniques for designers and facility operators are provided to determine the arc flash boundary and arc flash incident energy. How to use this IEEE standard is described in (Lippert et al., 2005).
First and foremost, when considering arc-flash hazards four primary factors have to be mentioned which determine the hazard category:
Bolted fault current – calculated at the location/equipment to be assessed and subsequently used to calculate the theoretical arcing fault current.
Working distance – as measured from the personnel´s head/torso to the location of the arc source.
Fault clearing time.
Two of the four primary factors determining the arc-flash hazard category have a larger impact than the others: working distance and fault clearing time.
In (Avendt, 2008) it is underlined that fault clearing time plays the largest role in the arc-flash hazard category. A time-current curve is frequently used to show the relationship between current (amps) and response time (seconds). Most protective devices have an inverse characteristic: as current increase, time decreases. Examples of such curves are given in (Avendt, 2008).
In order to fulfil the obligation to protect workers, several standards and guidelines are currently updated or under development.
For example, the Electricity Engineers Association has developed a discussion paper on the issue of arc flash (EEA, 2010) that will enable the subsequent preparation of a guide which will provide best practice advice for employers and asset owners needing to determine the probability of an arc flash occurring, its severity, means of mitigation and relevant personnel protection equipment.
An overview of various arc flash standards for arc flash protection and arc flash hazard incident energy calculations are presented in (Prasad, 2010).
3. Systematic query of international and national databases
In order to confirm these indications by feedback from national and world-wide operating experience, the national German database on reportable events occurring at nuclear power plants as well as international databases, such as IRS (Incident Reporting System) and INES (International Nuclear Event Scale), both provided by the International Atomic Energy Agency (IAEA), or the OECD FIRE Database (cf. OECD/NEA, 2009) have been analysed with respect to high energy arcing faults events which resulted in a fire and high energy arcing faults events with only the potential of deteriorating fire safety.
That systematic query underlined that a non-negligible number of reportable events with electrically induced explosions and extremely fast fire sequences resulting from high energy arcing faults partly lead to significant consequences to the environment of impacted components exceeding typical fire effects.
All results of the international and national databases are presented in Tables 1, 2 and 3 in the same manner, containing in particular the current plant operational state in case of the event, the information in which component the cause of the event was identified, the voltage level, if only the impacted component was damaged, and information if fire barriers being available had been deteriorated.
3.1. International OECD HEAF activity
Due to the high safety significance and importance to nuclear regulators OECD/NEA/CSNI (Committee on the Safety of Nuclear Installations) has initiated an international activity on “High Energy Arcing Faults (HEAF)” in 2009 (OECD/NEA, 2009a) to investigate these phenomena in nuclear power plants in more detail as an important part of better understanding fire risk at a nuclear power plants which is better accomplished by an international group to pool international knowledge and research means. In this task it is stated:
“The main objectives of this common international activity are to define in technical terms a HEAF event which is likely to occur on components such as breakers, transformers, etc., to share between experts from OECD/NEA member states HEAF events, experiences, research and potential mitigation strategies. In addition, the physical and chemical phenomena of a HEAF event shall be investigated and characterized from a fire dynamics perspective. In this context, a simple model and/or deterministic correlation is intended to be developed to reasonably and quickly predict the potential damage areas associated with a HEAF.
Furthermore, generally acceptable input criteria and boundary conditions for CFD (computerized fluid dynamics) models shall be defined being likely to be accepted by industry and regulatory agencies. In a last step, the needs for possible experiments and testing to develop input data and boundary conditions for HEAF events to support the development of HEAF models shall be identified and the correlations and models developed be validated and verified.”
The working group with members e.g. from Canada, France, Germany, Korea, and the United States decided during the Kick-Off Meeting at OECD/NEA in Paris in May 2009 that the goals of the task are to develop deterministic correlations to predict damage and establish a set of input data and boundary conditions for more detailed modelling which can be agreed to by the international community.
The output of the OECD activity may directly support development of improved methods in fire probabilistic risk assessment for nuclear power plant applications. The task may also result in the definition of experimental needs to be addressed later in a project structure (OECD/NEA, 2009a).
3.2. Information from of international databases
First information from the international operating experience collected within the IRS database - for more severe reportable incidents at nuclear power plants - and INES, both provided by IAEA, is given in Table 1.
In addition, applications of the OECD FIRE Database (cf. OECD/NEA, 2009) have indicated that a non-negligible contribution of approx. 6 % of the in total 343 fire events collected in the database up to the end of 2008 (cf. Berg & Forell et al., 2009) are high energy arcing faults induced fire events. Details can be found in Table 2.
At the time being, the existing data base on high energy arcing faults events in nuclear installations is still too small for a meaningful statistical evaluation.
However, the first rough analysis of the available international operating experience gives some indications on the safety significance of this type of events, which potentially will also result in relevant contributions to the overall core damage frequency.
Up to the end of 2009, thirty-eight high energy arcing faults events have been identified in the OECD FIRE Database. Details on these events are provided in the following paragraphs.
The database query was started in Germany. One application of the OECD FIRE Database selected by the German experts was an analysis of events associated with explosions. A query in this database on the potential combinations of fire and explosion events (cf. Berg & Forell et al., 2009) indicated a significant number of explosion induced fires. Most of such event combinations occurred at transformers on-site, but outside of the nuclear power plant buildings or in compartments with electrical equipment.
|2006||PWR||FP||transformer busbar||20 kV||yes||no||F|
|2006||BWR||FP||switchgear station||400 kV||yes||no||-|
|2001||PHWR||LP/SD||circuit breaker cables||not indicated||no||no||F|
|2001||PWR||FP||power switch||not indicated||no||no||E / F|
|2001||PWR||FP||circuit breaker||not indicated||no||yes||F|
|2000||PWR||FP||circuit breaker||6 kV||yes||yes||F|
|2000||PWR||FP||circuit breaker||12 kV||yes||no||F|
|1996||PWR||FP||power switch||not indicated||no||yes||E / F|
|1996||PWR||FP||lightning arrester||not indicated||no||no||F|
|1995||PWR||FP||circuit breaker||6 kV||no||no||E / F|
|1992||PWR||FP||switchgear room||6 kV||yes||no||F|
|1991||PWR||FP||control cabinet||6 kV||yes||no||F|
|1990||PWR||LP/SD||switchgear station||400 V||yes||no||-|
|1989||PWR||FP||distribution||6.9 kV||no||no||E / F|
|1988||PWR||FP||distribution||13.8 kV||yes||no||E / F|
|1984||BWR||FP||main transformer||not indicated||no||yes||E / F|
|1983||GCR||LP/SD||control panel||5.5 kV||no||yes||E / F|
|2007||PWR||FP||high voltage transformer||not indicated / 345 kV||yes||no||E / F|
|2006||PWR||FP||electrically driven pump||12 kV||yes||no||E / F|
|2006||PWR||FP||high voltage transformer||6 kV / 20 kV||no||yes||E / F|
|2006||PWR||LP/SD||medium and low voltage transformer - oil filled||not indicated / 400 kV||no||no||E / F|
|2005||BWR||FP||high voltage transformer||not indicated||yes||no||E / F|
|2005||PHWR||FP||high voltage transformer||not indicated / 500 kV||yes||no||E / F|
|2003||GCR||FP||high voltage transformer||6.6 kV / 400 kV||no||no||E / F|
|2002||BWR||LP/SD||high voltage transformer||not indicated||yes||no||E / F|
|2002||PWR||FP||high voltage breaker||34.5 kV||yes||no||E / F|
|2001||PWR||LP/SD||high or medium voltage electrical cabinet||6.6 kV||no||yes||E / F|
|2001||PWR||not indicated||high or medium voltage electrical cabinet||6.6 kV||no||no||E / F|
|1999||PWR||FP||high voltage transformer||20 kV / 161 kV||yes||no||E / F|
|1995||PWR||FP||medium and low voltage transformer – dry||not indicated / 130 kV||yes||no||E / F|
|1994||PWR||FP||high voltage transformer||not indicated / 400 kV||yes||no||E / F|
|1990||PWR||FP||high or medium voltage electrical cabinet||6.6 kV||yes||no||E / F|
|1988||PWR||LP/SD||high voltage transformer||20 kV / 400 kV||yes||no||E / F|
|1988||PWR||FP||high voltage transformer||20 kV / 400 kV||yes||no||E / F|
|1988||PWR||FP||high voltage transformer||20 kV / 400 kV||yes||no||E / F|
Approximately 50 % of the fires in the database were extinguished in the early (incipient) fire phase before the fire had fully developed.
As there is no specific coded field in the database to indicate explosions, the main source of information is provided by the event description field. The following terms were used as search filters:
search for *explo* (explosion, exploded, etc.): 26 events
search for *defla* (deflagration, deflagrated, etc.): no events
search for *deto* (detonation, detonated, etc.): no events
In three of the in total 26 cases no explosion occurred according to the event description but the term “explo” was used in another meaning.
In case of one event, the explosive release of ‘INERGEN’ gas from a gas cylinder occurred. The 22 reported explosions amount to 6.4 % of the 373 events reported up to date. Some details of the explosions are listed in (Berg & Forell et. al., 2009).
Concerning the process of explosion distinction should be made between an explosion as a process of rapid combustion (chemical explosion) and an explosion as a physical process resulting from a sudden gas pressure rise by a high energy arcing fault.
A chemical explosion was found for only three events (solvent vapour, diesel fuel, hydrogen). In the other 18 cases, high energy arcing faults events obviously took place at the same time indicating a physical explosion.
In some of these cases the electric fault might have caused a fuel pyrolysis/spread and acted as an ignition source for a chemical explosion, thus a high energy arcing fault event and a chemical explosion may have taken place simultaneously. In one event, a fire led to the explosion of diesel fuel vapour while in another event a fire and an explosion occurred independently from each other in parallel. In all other cases explosions induced the fire.
The buildings/locations where the events took place are also listed in (Berg et al., 2009). It was found that 13 (59 %) events took place outside buildings, 3 inside electrical buildings. A majority of 59 % of the reported explosions (again 13 events) started at transformers.
The other nine events took place at electrical cabinets, other electrical equipment, or process equipment (three each representing 14 %).
External fire brigades were needed in 4 of 22 cases (18 %). The 22 events were also evaluated concerning the fire duration with the following results:
Fire duration between 0 and less than 15 min: 11 events
Fire duration between 15 and less than 30 min: 3 events
Fire duration between 30 and 60 min: 3 events
Fire duration longer than 60 min: 3 events
For the remaining two events no information on the fire duration is provided. This result is in good agreement with the fire durations recorded in the database for all events, where for approx. 55 % of the events (i.e. 128 out of 233 events with fire duration provided) afire duration of less than 15 min could be found.
3.3. Information from of the German database
The German national operating experience from reportable events at nuclear power plants is summarized in Table 3. As one can see from this table different components were impacted, in particular – as expected – switchgears. In many cases the voltage level could not be identified. The damage was in most cases limited to the component where the HEAF occurred, only in one case a barrier was deteriorated. One third of these events were correlated with a fire.
|2007||BWR||FP||transformer||380 kV||yes||no||E / F|
|2006||BWR||LP/SD||auxiliary service pump||not indicated||yes||no||-|
|2006||PWR||FP||switchgear drawer||not indicated||yes||no||-|
|2006||BWR||FP||switchgear drawer||not indicated||yes||no||-|
|2004||PWR||LP/SD||emergency power feed line||not indicated||yes||no||-|
|2004||BWR||FP||diesel generator||6 kV||no||no||F|
|2004||BWR||FP||cable connection||not indicated||yes||no||F|
|2004||PWR||LP/SD||diesel generator. exciter||6 kV||yes||no||-|
|2003||BWR||FP||diesel generator. exciter||6 kV||yes||no||-|
|2003||PWR||FP||emergency power feed line||500 V||yes||no||F|
|2002||BWR||FP||emergency power busbar||500 V||no||no||F|
|2001||PWR||FP||generator transformer switch||not indicated||yes||no||-|
|2001||BWR||FP||emergency power distribution||660 V||yes||no||-|
|1999||PWR||FP||ventilation exhaust||not indicated||yes||yes||-|
|1998||PWR||FP||emergency power distribution||660 V||no||no||-|
|1996||BWR||FP||switch drawer||500 V||yes||no||F|
|1995||BWR||FP||switchgear drawer||not indicated||yes||no||-|
|1993||PWR||FP||currency converter||380 V||yes||no||-|
|1992||PWR||LP/SD||emergency power generator||not indicated||yes||no||F|
|1991||BWR||FP||emergency power busbar||10 kV||yes||no||-|
|1989||PWR||FP||switchgear feed cell||10 kV||no||no||F|
|1989||PWR||LP/SD||switchgear feed area||380 V?||no||no||F|
|1988||PWR||LP/SD||switchgear||220 kV||no||no||E / F|
|1987||BWR||FP||emergency diesel generator||not indicated||yes||no||-|
|1987||PWR||FP||auxiliary service water system||not indicated||yes||no||-|
|1984||BWR||LP/SD||auxiliary power supply||not indicated||yes||no||-|
|1981||PWR||FP||safety injection pump motor||not indicated||yes||no||-|
|1979||PWR||LP/SD||control rod distribution||not indicated||yes||no||F|
|1977||BWR||LP/SD||emergency switchgear||not indicated||yes||no||-|
In all three tables the following abbreviations are used:
PWR: pressurized water reactorBWR: boiling water reactor
PHWR: pressurized heavy water reactorGCR: gas cooled reactor
FP: full powerLP/SD: low power / shutdown
E: explosionF: fire
4. Questionnaire to gain further insights on HEAF
As a result of the evaluation of the above mentioned international databases IRS and INES, a questionnaire has been developed by German experts providing a list of questions, which mainly shall be answered by the licensees (see Röwekamp & Klindt, 2007 and Röwekamp et al., 2007).
The answers to this questionnaire shall provide further insights on the basic phenomena regarding high energy arcing faults and may allow the evaluation of such events as well as the identification of effective preventive measures to be taken in nuclear installations in the future.
This questionnaire has been discussed nationally and in an international experts group. The results of the international discussions as well as a first pilot completion of this questionnaire in a German nuclear power plant resulted in enhancing the questionnaire and its sub-division into two parts depending on the availability of experiences with this type of events in the plants under consideration.
The questions concerning events which occurred at the nuclear power plant cover the operating experience in the respective plant, consequences and effects of the events, fire suppression measures (if needed), event causes and resulting corrective actions.
Questions without plant-specific observations from events deal with preventive measures in the plant and assessment activities performed without direct observations from the events (Röwekamp & Berg, 2008 and Röwekamp et al., 2009). The complete list of elaborated questions is provided in the following.
Part I: Questions concerning events occurred at nuclear power plants
Does the operating experience of the nuclear power plant (including grid connection) reveal either reportable or minor, non-reportable events interconnected to a high energy electric (i.e. arcing) failure of electric components and equipment with > 6 kV?
What was the damage? What was the damage zone? Was there damage by the high energy release (explosion pressure wave, etc.), or by fire or by both?
In which buildings / compartments / plant areas did the event occur?
At what type of component was the fault initiated (e.g., switchgear, motor control centre, transformer (oil filled or dry ones), breakers, cables etc.)?
What voltage level did the component operate at? What was the nominal current load available to the component?
If known, what was the estimated overload current observed during the arcing fault?
How was the HEAF observed or detected? Directly by fire detectors, visual or auditory detection in the location where the fault occurred or indirectly by faulty/spurious signals indirect fire alarms, etc.? (An as far as feasible detailed and exhaustive description of the event is needed.) What were the observations and findings?
What was the arcing duration in case of arcing being the cause? How did the arcing stop? (Note: Due to expert judgment from international experts there may be a correlation between arcing duration and damage consequences/extent)
Consequences / Effects
Which consequences/effects including secondary ones (e.g. pressure waves, impact by missiles, i.e. induced high frequent voltage, etc.) to adjacent/nearby components (including cables) and compartments / plant areas have been observed besides the typical fire effects? Did, as a consequence, protective equipment fail or become ineffective?
Was the damage limited to one fire compartment and or one redundant safety train or were further compartments / trains affected?
Which functions of fire protection features (fire barriers and their elements as well as active means) have been impaired by the effects of high energy arcing faults, in particular by pressure waves and missiles?
Fire suppression (if needed)
Was fire extinguishing performed?
If yes, which extinguishing means were applied? Which were successful?
What was (rough estimate) the total fire duration?
Was it possible to find out the causes of the high energy impacts observed? If yes, what were the potential causes?
Were the initial causes (root causes) man-induced (mal-operation, errors), or purely technical ones, administrative causes, or combinations of different causes? Have the root causes been found? (Please list all the root causes.)
What are the corrective actions after the event for prevention of recurrence?
Part II: Questions without observations from events at nuclear power plants
In which compartments / plant areas are components and equipment with the potential of HEAF installed? Are there safety significant / safety related components available in these compartments / plant areas and/or adjacent ones? If yes, which ones? What are the preventive (structural) measures there against such events?
Which measures are foreseen (originally in the design as well as improved ones after the event) to limit the consequences of such high energy arcing faults failures?
Is it possible to practically exclude by the preventive measures that safety significant equipment is impaired?
Are further measures intended for prevention of these faults (continuous controls, in-service inspections, etc.), and if yes, which ones?
Assessment without direct observations from the events
In how far are such high energy arcing fault events and their potential effects considered in the frame of periodic safety reviews (deterministic safety status analysis as well as probabilistic safety assessment)?
This German questionnaire could be the basis for gaining plant-specific information also from nuclear power plants in other countries.
5. Some examples of HEAF events in nuclear power plants
In the following, typical examples of high energy arcing fault events which occurred in different nuclear power plants in the last thirty years are provided.
5.1. HEAF in a 10 kV cable with a spontaneous short circuit
A high energy arcing faults event from a spontaneous short circuit with a longer time duration took place in a German nuclear power plant.
This event, which occurred in a 10 kV cable at a BWR type plant, has been analyzed in detail by the responsible expert organization on behalf of the regulator in charge (Berg & Katzer et al., 2009). Details on the electric circuit are provided in Figure 1.
The affected cable was routed from the station service transformer together with various other cables through an underground cable channel to the switchgear building.
Due to the conditions in the ground, cables were partly imbedded in so-called ‘cable cylinder blocks’ manufactured from concrete (see Figure 2).
The short circuit with a duration of some seconds occurred in a single 10 kV cable inside one of the cylinder blocks. Neighboring cables were not affected. During this time period, the PVC insulated cable including the copper conductor evaporated completely on a length of approx. 1 m (see photos in Figure 3).
The pyrolysis and/or evaporation of the PVC cable insulations caused a strong smoke release inside the cable channel.
The automatic fire detectors directly gave an alarm. Due to the typically high air humidity inside the channel, a smoke exhaust system was installed for the cable channel, which removed the smoke rapidly after actuation by the fire detectors.
The overpressure arising from the high voltage short circuit was relieved via open cable conduits to the transformer and leakages.
Unfortunately, the pressure value having really occurred during the event could not been determined. Damage to fire doors, dampers, or fire stop seals were not observed. The high energy short circuit did not result in any fire propagation; the combustion was limited to the location where the short circuit occurred. The fire self-extinguished directly after the electric current had been switched off. The fire duration was only a few seconds, however, the smoke release was high.
It has to be mentioned that all cables inside the cable channel were protected by intumescent coating (see Figure 4 above). This coating ensured the prevention of fire spreading on the cables.
The detailed analysis led to the definite result that the event was mainly caused by ageing of the 10 kV cables. The ageing process was accelerated by the insufficient heat release inside the cable cylinder blocks.
As a corrective action, all high voltage (mainly 10 kV) cables with PVC shielding being older than 30 years were replaced by new ones.
Another effect of the event was the smoke propagation to an adjacent cable channels via a drainage sump. As a preventive measure, after the event each cable channel was supplied by its own drainage system. Moreover, all the channels were separated by fire barriers with a resistance rating of 90 min.
5.2. Arcing fault in an electrical cabinet of the exciter system of an emergency diesel generator
This event occurred at a German nuclear power plant in 1987.
Performing a load test during a regular in-service inspection (usually at an interval of four weeks) of the emergency diesel generator, an arcing fault with a short-to-ground took place in the electrical cabinet of the exciter system of the emergency diesel generator (cf. Figure 5 above).
The ground fault is assumed to be caused by a loose screw. The ionization of air by the arc developed to a short circuit within approximately four seconds.
The coupler breakers between the emergency power bus bar and the auxiliary bus bar opened 0.1 s after the occurrence of the short circuit, due to the signal “overload during parallel operation”.
1.5 s later the diesel generator breaker opened due to the signal "voltage < min” at the emergency power bus bar. Another 0.5 s later the emergency power bus bar was connected automatically to the offsite power bus bar.
The smouldering fire is believed to be caused by the short circuit of the emergency diesel generator.
Due to the high energy electric arcing fault a sudden pressure rise occurred in the room (room dimensions are approximately 3.6 m x 5.5 m x 5 m) that damaged the double-winged fire door.
Photographs of the damaged fire door from outside the room are shown in Figure 6 above.
5.3. Short circuit leading to a transformer fire
This event occurred at a German nuclear power plant in June 2007. A short circuit resulted in a fire in one of the two main transformers. The short circuit was recognized by the differential protection of the main transformer. Due to this, the circuit breaker between the 380 kV grid connection and the affected generator transformer (AC01) as well as the 27 kV generator circuit breaker of the unaffected transformer (AC02) were opened.
At the same time, de-excitation of the generator was actuated. The short circuit was thereby isolated. In addition, two of the four station service supply bus bars (3BC and 4BD) were switched to the 110 kV standby grid (VE). A simplified diagram is given in Figure 7 (Berg & Fritze, 2011).
Within 0.5 s, the generator protection system (initiating 'generator distance relay' by remaining current during de-excitation of the generator which still feeds the shot circuit) caused the second circuit breaker between the 380 kV grid connection and the intact generator transformer (AC02) to open. Subsequently the two other station service supply bus bars (2BB and 1BA) were also switched to the standby grid. After approx. 1.7 s, station service supply was re-established by the standby grid.
Due to the short low voltage signalization on station service supply bus bars the reactor protection system triggered a reactor trip.
As soon as the switch to the standby grid had taken place, feed water pump 2 was started automatically. After about 4 s the pump stopped injecting into the reactor pressure vessel and subsequently was switched off again. This caused the coolant level in the reactor pressure vessel to drop so that after about 10 min the reactor protection system actuated steam line isolation as well as the start-up of the reactor core isolation cooling system. About 4 min after the actuation of steam line isolation, two safety and relief valves were opened manually for about 4 min. This caused the pressure in the reactor to drop from 65 bar to approx.. 20 bar. As a result of the flow of steam into the pressure suppression pool, the coolant level in the reactor pressure vessel dropped further.
After closing the safety and relief valves the level of reactor coolant decreased further because of the collapse of steam bubbles inside the reactor pressure vessel. Thereby the limit for starting the high-pressure coolant injection system with 50 % feed rate was reached and the system was started up by the reactor protection system. Subsequently, the coolant level in the reactor pressure vessel increases to 14.07 m within 6 min. The reactor core isolation cooling system was then automatically switched off, followed by the automatic switch-over of the high-pressure coolant injection system to minimum flow operation. Subsequent reactor pressure vessel feeding was carried out by means of the control rod flushing water and the seal water.
Due to the damage caused by the fire in the transformer, the plant was shut down. The fire of the transformer showed the normal behaviour of a big oil-filled transformer housing, the fire lacks combustion air and produces a large amount of smoke (see Figure 8).
A detailed root cause analysis regarding the different deviations from the expected event sequence was carried out. The cause of the fire was a short circuit in the windings of the generator transformer. Due to the damages to the transformer it was not possible to resolve the failure mechanisms in all details.
To end the short circuit, the differential protection system of the generator transformer caused to open the circuit breaker between the 380 kV grid connection and the affected generator transformer as well as the generator circuit breaker to the unaffected transformer.
The generator circuit breaker to the affected transformer did not open since the generator circuit breakers are not able to interrupt the currents flowing during a short circuit. The opening of the circuit breaker between the second 380 kV grid connection and the remaining intact generator transformer is caused by the remaining current after de-exciting the generator which initiates the distance relay of the generator protection system.
The loss of the operational feed water supply was caused by the time margins in between the opening of the two 380 kV circuit breakers. The logical sequence in the re-starting program of the feed water pumps could not cope with the specific situation of the delayed low voltage signals during the incident.
The further drop in the reactor pressure vessel level following the actuation of steam line isolation and the reactor core isolation cooling system was caused by the manual opening of the two safety and relief valves for 4 min. The manual opening of safety and relief valves was not needed in the case of this event sequence and at that point in time. The reason for the manual opening of two safety and relief valves will be part of a detailed human factor analysis which is not completed.
As a consequence of these indications, improvements concerning the fire protection of transformers are intended in Germany (Berg et al., 2010).
5.4. Phase-to-phase electrical fault in an electrical bus duct
A phase-to-phase electrical fault, that lasted four to eight seconds, occurred in a 12 kV electrical bus duct at the Diablo Canyon nuclear power plant in May 2000 (Brown et al., 2009). This bus supplied the reactor coolant and water circulating pumps, thus resulting in a turbine trip and consequently in a reactor trip.
The fault in the 12 kV bus occurred below a separate 4 kV bus from the start-up transformer, and smoke resulting from the HEAF caused an additional failure.
When the circuit breaker tripped, there was a loss of power to all 4 kV vital and non-vital buses and a 480 V power supply to a switchyard control building, which caused a loss of power to the charger for the switchyard batteries. After 33 hours, plant personnel were able to energize the 4 kV and 480 V non-vital buses.
This event was initiated due to the centre bus overheating causing the polyvinyl chloride (PVC) insulation to smoke, which lead to a failure of the adjacent bus insulation. Having only a thin layer of silver plating on the electrodes, noticeably flaking off in areas not directly affected by the arc, contributed to the high-energetic arcing fault event.
Other factors that caused the failure were heavy bus loading and splice joint configurations, torque relaxation, and undetected damage from a 1995 transformer explosion. Two photos of this failure are shown in Figure 9. More photos are provided in (Brown et al, 2009).
5.5. Short circuit due to fall of a crane onto cable trays
This event occurs at a Ukrainian plant which was at that time under construction when work on dismounting of the lifting crane was fulfilled (IAEA, 2004).
The crane was located near the 330/6 kV emergency auxiliary transformers TP4 and TP5 which are designed for transformation 330 kV voltage to 6 kV for power supply of the 6kV AC house distribution system of the unit 4 and the emergency power supply system 6 kV for unit 3. They are located outside at a distance 50 m from the turbine hall of the unit 4. There are two metal clad switchgear rooms (with 26 cabinets and 8 switchers) about four meters from the emergency auxiliary transformers.
The supply of the sub-distribution buses building from the power centre rooms (see Figure 10), was ensured by a trestle with cable trays consisting of power, control and instrumentation cables for the units 3 and 4.
All trays were provided with the cut-off fire barriers. The transformer rooms were supplied by an automatic fire extinguishing system, which actuated when the gas and differential protection actuated.
The event started when the jib of the crane fell on the trestle with the cables passed from 330/6 kV transformer TP 4 and TP 5 to unit 4 and broke them. The cables fell on the ground. The diagram of the situation after the event is provided in Figure 10 (IAEA, 2004).
Damages of all cable trays lead to loss of instrumentation cables for relay protection of the transformers and the trunk line 6 kV.
As a result the earth fault of the cables 6kV could not be disconnected rapidly. The emergency relay protection of the transformers during earth fault 6 kV from the side 330 kV with the executive current from the storage buttery for open-type distribution substation 330 kV was not designed.
To remove this earth fault the plant was cut off from outside high-voltage transmission lines 330 kV by electrical protection actuation and the voltage on the power supply bus was decreased.
There was a loss of normal and emergency auxiliary power supply which resulted in a decrease of the frequency of ´the power supply buses of the main coolant pumps. The emergency protection was actuated and the reactors of units 2 and 3 were scrammed.
The long-term exposure of this earth fault (1 min and 36´sec.) caused a high earth fault currents which burn the cables. This lead to a fire spread to the 6 kV supply distribution buses and 6 kV metal clad switchgear rooms resulting inside these rooms in high temperature and release of the toxic substance. Also the equipment of the transformers TP 4 and TP 5 was damaged.
The earth fault has to be disconnected with differential protection of the line 330 kV but it was actuated with the output relays of the TP 4 and TP 5 which was damaged.
The fire was detected by the security guard, the on-site fire brigade was informed, including the outside agency. The automatic fire extinguishing system was activated but stopped working right away because of fire pump’s power supply loss. There was no water in the fire mains.
Then the fire brigade laid fire-fighting hoses and provided water with a mobile pump unit. Then the fire brigade waited for the permission from the shift leader.
In compliance with a written procedure, after elimination of the short circuit and restoration of the house distribution power supply the fire brigades could start fire fighting and extinguished the fire about one hour and thirty minutes after detection.
5.6. A triple-pole short circuit at the grounding switch caused by an electrician
In December 1975, a safety significant fire occurred in unit 1 of a nuclear power plant in the former Eastern Germany (see, e.g., Röwekamp & Liemersdorf, 1993and NEA, 2000). At that time, two units were under operation. Unit 1 was a PWR of the VVER-440-V230 type. The reactor had 6 loops and 2 turbine generators of 220 MWe each.
An electrician caused a triple-pole short-circuit at the grounding switch between one of the exits of the stand-by transformer and the 6 kV bus bar of the 6 kV back-up distribution that was not required during power operation. The circuit-breaker on the 220 kV side was defective at that time. Therefore, a short circuit current occurred for about 7.5 minutes until the circuit-breaker was actuated manually. The over current heated the 6 kV cable which caught fire over a long stretch in the main cable duct in the turbine building.
The reactor building is connected to the turbine building via an intermediate building, as typical in the VVER plants. The 6 kV distribution is located in this building and the main feed water and emergency feed water pumps all are located in the adjacent turbine building.
In the main cable routes nearly all types of cables for power supply, instrumentation and control were located near each other without any spatial separations or fire resistant coatings. In the cable route that caught fire there were, e.g., control cables of the three diesel generators.
Due to the fire in the 6 kV cable, most of those cables failed. The cable failures caused a trip of the main coolant pumps leading to a reactor scram and the unavailability of all feed water and emergency feed water pumps. The heat removal from the reactor was only possible via the secondary side by steam release. Due to the total loss of feed water, the temperature and pressure in the primary circuit increased until the pressuriser safety valves opened. This heating was slow, about 5 h, due to the large water volumes of the six steam generators, 45 m3 in each. In this situation one of the pressuriser safety valves was stuck open. Then the primary pressure decreased and a medium pressure level was obtained so that it was possible to feed the reactor by boron injection pumps. Due to cable faults, the instrumentation for the primary circuit was defective (temperature, pressuriser level). Only one emergency diesel could be started due to the burned control cables. The primary circuit could be filled up again with the aid of this one emergency diesel and one of six big boron injection pumps. With this extraordinary method it was possible to ensure the residual heat removal for hours.
The Soviet construction team personnel incidentally at the site then installed temporarily a cable leading to unit 2. With this cable one of the emergency feed water pumps could be started and it was possible to fill the steam generator secondary side to cool down the primary circuit to cold shutdown conditions. Fortunately, no core damages occurred.
Regarding the weak points with respect to fire safety, first of all, the cause for the fire has to be mentioned. This fire could only occur because there was no selective fusing of power cables.
Another very important reason for the wide fire spreading concerning all kinds of cables was the cable installation. Nearly all cables for the emergency power supply of the different redundancies as well as auxiliary cables were installed in the same cable duct, some of them on the same cable tray.
All the fire barriers were not efficient because the ignition was not locally limited but there were several locations of fire along the cable.
In the common turbine building for the units 1 to 4 of the Greifswald plant with its total length of about 1.000 m there were no fire detectors nor automatic fire fighting systems installed. Therefore, the stationary fire fighting system which could only be actuated manually was not efficient. The design as well as the capacity of the fire fighting system were not sufficient.
Although there were enough well trained fire fighting people, the fire-brigade had problems with manual fire fighting due to the high smoke density as there were no possibilities for an efficient smoke removal in the turbine hall.
5.7. Explosion in a switchgear room due to a failure of a circuit breaker
In December 1996, in a PWR in Belgium the following event occurred. The operator starts a circulating pump (used for cooling of a condenser with river water). This is the first start-up of the pump since the unit was shut down.
About eight seconds later, an explosion occurs in a non safety related circuit breaker room (located two floors below the control room), followed by a limited fire in the PVC control cables inside the cubicles. Due to some delay in the reaction time of the protection relays, normal (380 kV) and auxiliary (150 kV) power supply of train 1 are made unavailable. Safety related equipment of train 1 are supplied by the diesel generating set 1. Normal power supply of train 2 is still available.
The internal emergency plan is activated and the internal fire brigade is constituted. The fire is rapidly extinguished by the internal fire brigade.
As a direct consequence of the explosion five people were injured during the accident, one of them died ten days later.
The fire door at the room entrance was open at the moment of the explosion; this door opens on a small hall giving access to the stairs and to other rooms (containing safety and non safety related supply boards) at the same level; all the fire doors of these rooms were closed at the moment of the explosion and were burst in by the explosion blast. Three other fire doors were damaged (one of these is located on the lower floor); some smoke exhaust dampers did not open due to the explosion (direct destruction of the dampers, bending of the actuating mechanism). One wall collapsed, another one was displaced.
The explosion did not destroy the cubicle of the circulating pump circuit breaker; the supply board and the bus bar were not damaged, except for the effects of the small fire on the control cables; other supply boards located in the same room were not damaged. In the room situated in front of the room where the explosion occurred, the fire door felt down on a safety related supply board, causing slight damages to one cubicle (but this supply board remained available except for the voltage measurement).
A comprehensive root cause analysis has been performed and has shown that the explosion occurred due to the failure of the circuit breaker. The failure occurred probably when the protection relay was spuriously actuated 0.12 seconds after the start up of the pump (over current protection) and led to an inadvertently opening of the circuit.
Based on an investigation of the failing circuit breaker, it was concluded that two phases of a low oil content 6 kV circuit breaker did not open correctly and the next upstream protection device did not interrupt the faulting device. This has led to the formation of long duration high energy arcing faults inside the housing and to the production of intense heat release. This resulted in an overpressure with subsequent opening of the relief valve located at the upper part of the circuit breaker presumably introducing ionised gases and dispersed oil into the air of the cubicle/room. This mixture in combination with the arcs is supposed to be at the origin of the explosion. Indications of arcing between the three phases of the circuit breaker have been observed, resulting in a breach of the housing on two phases. Many investigations were conducted to identify the root cause of the circuit breaker failure (dielectric oil analyses, normal and penalising conditions tests, mechanical control valuations) but no clear explanation could be found. Moreover, the circuit breaker maintenance procedure was compared with the constructor recommendations and the practice in France. No significant difference was noticed.
Although the explosion occurred in a non safety related supply boards room, the event was of general importance, because the same types of circuit breakers were also installed in safety related areas. Therefore, this event was reported to IAEA and included in the IRS database.
6. First insights
Due to the safety significance of this type of events and the potential relevance for long-term operation of nuclear power stations there is a strong interest in these phenomena in various countries with nuclear energy. Investigations on high energy arcing faults are ongoing in several OECD/NEA member states.
The licensees of German nuclear power plants are principally willing and able to answer the questionnaire concerning HEAF events as far as possible and information being available. In particular, experts from nuclear power plants in Northern Germany have already answered this questionnaire. The licensees intend to use the feedback from the operational experience provided by the answers to the survey and by conclusions and recommendations from the analysis for potential improvements of fire protection features in this respect in their nuclear power plants.
The evaluation of the answers of the remaining licensees to the questionnaire is ongoing and is planned to be completed by the end of 2011.
Due to the most recent experience from German nuclear power plants, it is necessary from the regulatory point of view to investigate high energy arcing fault events. Moreover, it might be helpful to investigate precursors to such events in more detail.
Table 3 gives indications that more than 40 % of the reportable events in Germany related to high energy arcing faults have been reported since 2001. This underlines the increasing relevance of this type of events.
Moreover, nearly half of those events, for which information regarding voltage level is not available, are among the most recent events whereas usually specific information is more difficult to collect for events in the far past. All these different activities and explanations of the current state-of-the-art should be supported by the evaluation of the answers to the German questionnaire.
Concerning high energy arcing fault events, short circuit failure of high voltage cables (typically 10 kV) in cable rooms and cable ducts (channels, tunnels, etc.) is not assumed for German nuclear power plants at the time being. Moreover, a failure of high voltage switchgears (10 kV or more) and the resulting pressure increase are presumed to occur and to be controlled.
Specific investigations with respect to such scenarios have resulted in additional measures for pressure relief inside switchgear buildings of German nuclear power plants.
According to international fire testing standards (EN, 2009) fire barrier elements are designed predominantly against the thermal impact of fires given by the standard fire curve according ISO 834. The pressure build-up due to a HEAF is not considered as fire barrier design load. In the course of several events fire barrier elements such as fire doors were opened or deformed by a HEAF. One example is described in 5.7.
7. Concluding remarks and outlook
7.1. Improvement of the basic knowledge on HEAF
As soon as the questionnaire has been answered by the German nuclear power station licensees, the answers will be statistically examined and interpreted. In particular, potential consequences of events with this failure mechanism on equipment adjacent to that where the high-energetic arcing faults occurred (particularly safety related equipment including cables, fire protection features) as well as HEAF events in plant areas exceeding the typical fire effects (smoke, soot, heat, etc.) shall be identified. The major goal of this task is to provide first, still rough estimates on the contribution of high energy arcing faults events to the core damage frequency.
The results of the German survey may reveal additional findings on the event causes, possible measures either for event prevention or for limiting the consequences of such faults such that nuclear safety is not impaired. In this context, additional generic results from the OECD HEAF activity are expected.
A review of secondary effects of fires in nuclear power plants (Forell & Einarsson, 2010) based to the OECD FIRE database showed that HEAFs did not only initiated fire event but were also secondary effect of a fire. In two events included in the database, fire generated smoke propagated to an adjacent electrical cabinet, which was ignited by a HEAF. This can be interpreted as a special phenomenon of fire spread. In one case smoke from an intended brush fire spread between the near 230 kV lines and caused a phase-to-phase arc.
As soon as the answers to the questionnaire have been analyzed in detail and the results from the operation feedback are known, a discussion between licensees, reviewers and regulators can be started on the general conclusions and potential back fitting measures and improvements inside the nuclear installations.
Based on the international operating experience, state-of-the-art information and data on high energy arcing faults of electric components and equipment shall be collected and assessed with respect to the phenomena involved. In particular, potential consequences of events with this failure mechanism on adjacent equipment (particularly safety related equipment, fire protection features) and high energy arcing faults events in plant areas exceeding the typical fire effects (smoke, soot, heat, etc.) shall be identified. Based on the collected information and data a more comprehensive and traceable assessment can be performed.
7.2. HEAF assessment
The high energy arcing fault assessment approach developed in (USNRC, 2005) primarily represents an empirical model. As such, it depicts observations mainly based on a single event and characterizes a damaging zone affected this event. To capture variations in current and voltage level, insulation type and cabinet design a mechanistic model has been developed (Hyslop et al., 2008).
Some recent studies have further developed the understanding of the high energy arcing faults phenomena through experimentation and re-evaluation of previous theories.
Damage to cables and equipment by high energy impulses from arcing faults has been shown to be different from that caused by fires alone. Specific components, such as transformers, overhead power lines, and switchgears, have been identified as vulnerable to arc events. However, when looking at the dynamic nature of high energy arcing faults, there are still many factors being not well understood.
Computational fluid dynamics models have also been used to measure the pressure and temperature increase (e.g. in switchgear rooms) and present reasonable results on arc events (Friberg & Pietsch, 1999). However, fires were not evaluated.
The existing research is mainly limited in scope and has not yet addressed all factors important to perform a full-scope probabilistic fire risk assessment including high energy arcing faults. In general, high energy arcing faults events have been minimally explored but improvements in the early quantitative results have been made. In particular, fire PSA needs to assess the event behaviour beyond the initial arc-fault event itself (as past research has focussed) so as to encompass the issues related to the enduring fire. Issues that go beyond the initial arc fault event include the characterization of the potential for ignition of secondary combustibles, characterization of the fire growth and intensity following the enduring fire, and the effectiveness and timing of fire suppression efforts.
In order to improve the probabilistic fire safety assessment approach, further research including experimental studies with respect to the arc mechanisms and phenomena as well as to the damage criteria of the relevant equipment affected by high energy arcing faults is needed. To better address the needs of probabilistic fire safety assessment, the scope of the testing will need to be expanded as compared to past studies. These research activities will be started in the U.S. in the near future (Hyslop et al., 2008), partially together with other countries interested in high energy arcing faults and their significance.
7.3. Strategies for reducing arc flash hazards
An arc flash fault typically results in an enormous and nearly instantaneous increase in light intensity in the vicinity of the fault. Light intensity levels often rise to several thousand times normal ambient lighting levels. For this reason most, if not all, arc flash detecting relays rely on optical sensors to detect this rapid increase in light intensity. For security reasons, the optical sensing logic is typically further supervised by instantaneous over current elements operating as a fault detector. Arc flash detection relays are capable of issuing a trip signal in as little as 2.5 ms after initiation of the arcing fault (Inshaw & Wilson, 2004).
Arc flash relaying compliments existing conventional relaying. The arc flash detection relay requires a rapid increase in light intensity to operate and is designed with the single purpose of detecting very dangerous explosive-like conditions resulting from an arc flash fault. It operates independently and does not need to be coordinated with existing relaying schemes.
Once the arc flash fault has been detected, there are at least two design options. One option involves directly tripping the upstream bus breakers. Since the arc flash detection time is so short, overall clearing time is essentially reduced to the operating time of the upstream breaker. A second option involves creating an intentional three-phase bus fault by energizing a high speed grounding switch. This approach shunts the arcing energy through the high-speed grounding switch and both faults are then cleared by conventional upstream bus protection. Because the grounding switch typically closes faster than the upstream breaker opens, this approach will result in lower incident energy levels than the first approach. However, it also introduces a second three-phase bolted fault on the system and it requires that a separate high speed grounding switch be installed and operational (Inshaw & Wilson, 2004).
To prevent or alleviate HEAF effects, manufacturers have been working to develop arc arrestors and arc detection methods and to improve composite materials in the switchgear interior. The experiments conducted (see e.g. Jones et al., 2000) indicated that research and testing are required to determine the voltage level, insulation type, and construction where bus insulation may help extinguish or sustain arc once established. The use of such devices would likely impact estimates of fire ignition frequency for such events, but no methods currently exist to account for the presence, or absence, of such equipment.