Human Reliability Analysis-Based Method for Manual Fire Suppression Analysis in an Integrated Probabilistic Risk Assessment

After a major fire at the Browns Ferry Nuclear Power Plant (NPP) [1], fire protection at NPPs emerged as a controversial and complicated area of nuclear safety [2,3]. Traditionally, deterministic and prescriptive requirements per 10 CFR 50.48 and the associated Appendix R [4] have been used to regulate fire protection at U.S. NPPs. In 2004, the U.S. Nuclear Regulatory Commission (NRC) revised the 10 CFR 50.48 to allow licensees to voluntarily transition to the risk-informed, performance-based approach under NFPA 805 [5]. In the risk-informed, performance-based approach, fire probabilistic risk assessment (PRA) is used as a basis for the fire risk evaluation. As a result of joint research between the U.S. NRC and the Electric Power Research Institute (EPRI), NUREG/CR-6850, EPRI TR-1011989 [6,7] was published in 2005 to provide structured documentation on methodologies, tools, and data for NPP fire PRA. In this paper, this document is referred to as “NUREG/CR-6850” for brevity, and the fire PRA methodology in NUREG/CR-6850 is referred to as “current/existing fire PRA.”

An NPP has multiple layers of fire protection features that have two functions: detection and suppression. For each function, three success paths are typically considered: prompt, automatic, and manual. The prompt detection and suppression are credited only when a continuous fire watch is present in the fire compartment (e.g., under the hot work), the room is continuously occupied by plant crew, or high sensitivity detectors are installed [8]. The automatic detection is achieved by automatic fire detectors, such as heat detectors and smoke detectors, while the automatic suppression is achieved by fixed and automatic suppression systems, such as water-based, carbon-dioxide, or halon sprinklers. The manual detection refers to a delayed detection by a roving fire watch or fire patrol or a delayed detection by the main control room (MCR) through abnormal indications caused by fire-induced equipment damage. The manual suppression can be achieved in two ways: manual activation of the fixed suppression systems and manual suppression by the fire brigade. Based on the historical fire event records of NPPs in the U.S. [9], more than 70% of the fires were manually detected by nonfire protection personnel, while approximately 90% of the fires were manually suppressed either by the fire brigade or by the nonbrigade plant crew. This historical observation indicates that, among those fire protection features of NPPs, the ones involving manual action, including the prompt and manual detection and suppression performed by the onsite first responders, play a key role. Therefore, for accurate risk estimation in fire PRA, the realistic characterization and modeling of manual fire protection features are crucial.

The treatment of the manual fire protection in the current fire PRA methodology of NPPs, however, has two gaps. First, the quantification of the first responder performance in the manual fire protection actions (timing and failure probability) is solely based on empirical data. A probability distribution for the time to suppression, referred to as a “nonsuppression curve,” is developed based on the industry-wide historical fire event database [10]. In this data-driven nonsuppression curve, the plant-specific design and conditions of the manual fire protection features cannot be considered explicitly. Second, interactions between the first responder performance and fire propagation are not fully addressed. The current fire PRAs for NPPs use an implicit method based on the concept of competition between two timing quantities, one associated with fire progression and the other associated with manual suppression [7,11–15]. These timing parameters are computed by two independent models without interactions: the time-to-damage of a specific cable is computed by a fire model, assuming the burnout condition without detection and suppression, while the time-to-suppression is estimated by a data-driven nonsuppression curve [7,10,15]. The probability of fire-induced damage is computed as the probability that the time-to-damage is less than the time-to-suppression. As the fire–human interactions are not explicitly considered, the results based on the implicit interface are “conservative approximations” [16].

To address these gaps, this paper develops a human reliability analysis (HRA)-based method for modeling the first responder performance in manual fire protection actions with explicit modeling of interactions with fire propagation. The HRA-based method models the task sequence of manual fire protection actions, and the human error probabilities (HEPs) for the tasks are quantified by the HRA quantification techniques. In addition, the fire–human interactions are modeled by creating an explicit interface between the HRA-based first responder model and the fire propagation model, where an input–output relationship is generated with each other so that one model can “sense” the influences of the other model. While the basic concept of the HRA-based method can be applicable for all types of manual fire protection features, this paper focuses on manual suppression by the onsite fire brigade. An extension of the HRA-based method to the other manual fire protection features will be addressed in future research. In this paper, the HRA-based method is implemented in the integrated PRA (I-PRA) methodological framework for fire PRA, a new fire PRA methodology developed by the authors [17–21].

This paper is organized as follows: Section 1.1 provides an overview of the I-PRA framework for fire PRA that is used as a computational platform to implement the HRA-based first responder performance model in this study. Section 1.2 highlights the scope and research contributions of this paper. Section 2 explains the HRA-based method for modeling the first responder performance in manual suppression of NPPs. Section 3 demonstrates an implementation of the HRA-based first responder performance module for a switchgear room fire in an NPP. Section 4 discusses the potential limitations of the HRA-based method and how to deal with those potential limitations in practical applications. Section 5 provides conclusions and future work.

The current fire PRA methodology has excessive conservatism, induced by five major areas [20]: (1) fire ignition frequency, (2) fire progression and damage modeling, (3) modeling of interactions between fire progression and manual suppression, (4) circuit failure analysis, and (5) postfire HRA for the MCR operators. Excessive conservatism in fire PRA may provide biased risk information, which can prevent resources from being focused on truly significant risk-contributing factors and result in unnecessary and costly plant modifications; therefore, the excessive conservatism in fire PRA should be avoided. To address the excessive conservatism associated with areas #2 and #3, the authors of this paper developed the I-PRA framework (Fig. 1) [17–22].

The I-PRA framework is developed by integrating the simulation-based models of underlying physical and social phenomena with the existing plant PRA model through a probabilistic interface. The fire simulation module (FSM) (module “b”) includes models of physical failure mechanisms associated with fire-induced PRA scenarios. The plant-specific PRA module consists of event trees (ETs) and fault trees (FTs) obtained from the existing plant PRA model and that have been tailored to synchronize with the scope of the FSM. The core of the FSM is the fire hazard propagation model (#2 in module b), simulating spatiotemporal evolution of fire-induced conditions in the compartment. In fire I-PRA, a computational fluid dynamics (CFD) fire model, fire dynamics simulator (FDS) [23], is selected. The FDS numerically solves the transient governing equations for a low-Mach number turbulent reacting flow, including continuity, species mass fraction, momentum, sensible enthalpy, along with the equation of state for an ideal gas [24,25]. The inputs to the fire hazard propagation model include: (i) information on the fire source such as the heat release rate (HRR) curve, size, and shape of the fire provided by the fire initiation model (#1 in module b Fig. 1), (ii) initial and boundary conditions, and (iii) material properties, such as electrical cables and combustibles. The first responder performance module (module “c” in Fig. 1) predicts human performance in manual suppression by the fire brigade. To address the interactions between fire propagation and manual suppression, an explicit interface between FSM and the first responder performance module is created [20–22] by modifying the HRR curve based on the timings of manual suppression actions predicted by the first responder performance module (Fig. 2). The “burn-out” HRR curve (corresponding to the natural-burning fires without fire protection means; a solid line in Fig. 2) is modified based on three key timings associated with manual suppression [20]: (i) time to fire detection (t_det); (ii) fire brigade response (FBR) time (t_fb), representing the time period from fire detection to the time when the fire brigade begins manual suppression; and (iii) the duration of manual suppression (t_fb→sup). The burn-out HRR curve is used until t_det + t_fb. After the time t_det + t_fb, the HRR curve is assumed to begin decreasing until t_det + t_supp (the dotted line in Fig. 2). In the authors' previous publications, the HRR curve during the suppression phase (between the time t_det + t_fb and t_det + t_supp) was assumed to decrease as a linear function of time with a justification that the linear reduction is a conservative assumption [21]. By running the FSM and the first responder performance module coupled through the explicit interface, the physical key performance measures (KPMs) associated with the fire-induced cable damage, the maximum temperature inside the cable jacket (T_CB) and the maximum heat flux at the surface of the cable (q″_CB), are predicted.

The uncertainty propagation (#4 in module “d”) performs uncertainty quantification for the FSM and the first responder performance module. By considering damage thresholds for the physical KPMs, the cable damage probabilities (e.g., CBD in Fig. 1) are estimated. Probabilistic validation (#5 of module d) characterizes and propagates epistemic uncertainty in I-PRA and constructs the uncertainty bounds for the estimated cable damage probabilities [21,26]. The cable damage probabilities are then plugged into the scenario-based damage model (#6 of module d). The post-fire damage propagation model (#3 of module b) provides the conditional probabilities of the component-level failure, given the fire-induced cable damage. The outputs from models #3 and #4 are combined by the scenario logic in model #6 to develop component-level failure probabilities, e.g., Pr (c) in Fig. 1. The minimal cut-set probabilities are computed based on the fire-induced component probabilities obtained from models #4 and #5 with consideration of dependent failures [26,27]. If there are any sources of empirical data other than the simulation outputs, Bayesian integration with empirical data (#8 of module d) is conducted. The fire I-PRA was applied for one of the critical fire scenarios at an NPP (a small loss-of-coolant accident due to the stuck-open pressurizer valve caused by a switchgear room fire), and the results showed that, compared to the current fire PRA methodology [28], fire I-PRA could improve the realism of the core damage frequency estimate by 50% [21].

From the results of the case study [21], the authors recognized that the first responder performance module and its interface with the fire hazard propagation model is an area that is critical for reducing excessive conservatism. In previous studies by the authors [17–21], while an explicit interface between FSM and the first responder performance module was created to consider the influence of manual suppression on fire propagation, there were two remaining gaps: (i) the human performance in manual suppression was treated by the data-driven nonsuppression curve available in the current fire PRA methodology [10]; and (ii) the explicit interface in the previous work only addressed one of the directions of fire–human interactions (from fire brigade to fire propagation), while another direction (from fire propagation to the fire brigade) was not explicit addressed. To address these two gaps and further improve the realism of the first responder modeling in fire I-PRA, this paper advances the first responder performance module by developing an HRA-based method and creating a more explicit interface with the fire hazard propagation model (as indicated by the dotdash outline in Fig. 1).

Based on previous research on development and applications of fire I-PRA, the authors of this paper have initiated a new line of research to advance the first responder modeling in fire PRA of NPPs using two methods: the HRA-based method as reported in this paper; and the simulation-based method, simulating the behavior of “virtual” personnel in the simulation environment, as reported by Bui et al. [29]. In both methods, the treatment of the interactions between fire propagation and the first responder performance is advanced to be more explicit than that of the current fire PRA of NPPs [6,7] and the authors' previous work [17–22]. The authors' perspective is that the HRA-based and simulation-based methods should be used in a complementary way depending on the risk significance and the degree of fire–human interactions of each fire scenario (as discussed in Sec. 4 of this paper).

Bui et al. [29] provided a comprehensive review and categorization of the existing studies on manual suppression modeling from two angles: (1) modeling of the first responder performance and (2) modeling of interactions between the first responder and fire propagation. With respect to the first aspect, Bui et al. [29] identify several studies that utilize the HRA-based methods [8,30–35]. Among those HRA-based studies, Refs. [8,30], and [35] utilize a static HRA event tree to model task sequences and estimate the HEPs of individual tasks using the HRA quantification techniques, such as the technique for human error rate prediction (THERP) [36] and the standardized plant analysis risk human reliability analysis (SPAR-H) method [37]. In these studies, the timings of individual tasks are only considered as part of the performance shaping factors (PSFs) without quantifying the exact timings of individual tasks. Kloos et al. [31–34] extended the HRA-based method by developing a crew module and connected it to a dynamic event tree where the timings of individual tasks are quantified based on plant data and expert judgment. With respect to aspect (2), two directions of the fire–human interactions should be considered [29]: (i) influences of fire propagation on the first responder performance; and (ii) influences of the first responder actions on fire propagation. The HRA-based methods in Refs. [8] and [30–35] address the fire–human interactions in direction (i) by modifying the PSFs used in the HRA quantification techniques (e.g., considering a “high” state for the stress PSF due to the harsh environment). Kloos et al. [31–34] develop an interface between the time-based crew module and the CFD-based fire model through a dynamic event tree that can address the fire–human interactions in both directions. To address the fire–human interaction in direction (i), the time-dependent and location-specific smoke density is predicted by the CFD-based fire model, and its effects on the performance of manual suppression are considered by adding the “delay time” to the time-to-suppression depending on the predicted smoke density. Meanwhile, the fire–human interaction in direction (ii) is treated by conditioning the CFD-based fire model on the completed manual actions (e.g., opening the room door). Kloos et al. [31–34], however, do not provide a clear method for modifying the HRR curve after manual suppression begins. Compared to these existing studies in Refs. [8] and [30–35], this paper advances the HRA-based method for manual suppression actions by quantifying the timings of individual tasks (as well as the associated HEPs) and developing an explicit interface between a CFD-based fire model and the HRA-based first responder model that explicitly account for both directions of the fire–human interactions.

This line of research by the authors contributes to more accurate risk assessment by improving the realism of the manual detection and suppression analysis. As stated above, the current fire PRA methodology for NPPs uses a conservative and implicit method to address the fire–human interactions that ignores the reduction of fire intensity during manual suppression. The HRA-based and simulation-based methods developed in this line of research by the authors can relax this conservative assumption and improve the realism in fire PRA of NPPs. Also, by explicitly modeling the underlying physical and social contributing factors (e.g., design parameters related to physical systems and the fire brigade procedure), the advanced methods developed in this line of research can reflect the current as-built, as-operated plant conditions, instead of relying on the historical data that do not necessarily reflect the current plant-specific conditions. In addition, this line of research contributes to better risk management for fire protection features since the explicit incorporation of physical and social contributing factors through the HRA-based or simulation-based method with an explicit interface with fire propagation allows for a more in-depth sensitivity and importance measure analyses that can identify the most critical physical and social risk-contributing factors. The sensitivity and importance measure analyses can guide the plant and the regulatory agency toward a more efficient allocation of resources for risk management.

Figure 3 illustrates the structure of the HRA-based first responder performance module developed in this research. In relation to Fig. 1, this figure corresponds to the part highlighted by the dotdash outline.

The HRA event tree model (“c.1” in Fig. 3) generates the manual suppression scenarios after the fire ignition (i.e., an initiating event “FR”). The pivotal events in the event tree (e.g., “HA₁,” “HA₂,” and “HA₃”) represent the human actions necessary for manual suppression. The manual suppression scenarios are defined as a sequence of the states of the pivotal event HA_i, following the fire ignition FR. Each scenario leads to a specific end state associated with the outcome of manual suppression. These end states are defined as to whether the fire-induced damage to the safety-related equipment can be prevented; for instance, assuming that a cable tray connected to a safety-critical system is a damage target, the manual suppression is considered as success (OK) if the fire is suppressed before the cable damage occurs; otherwise, it is considered as failure (NS).

Each branching point in the HRA event tree has two attributes to characterize the manual suppression scenarios: the HEPs Pr(HA_i) and the timing of the corresponding human action t_i. Pr(HA_i) for each action is estimated by the HRA quantification model (“c.2” in Fig. 3), using the HRA quantification technique, while t_i for each action is estimated by the timeline analysis model (“c.3” in Fig. 3) based on the plant data and information. Using Pr(HA_i) and t_i as inputs, the HRA event tree model generates the manual suppression scenarios (S_j) and estimates the timing of the fire brigade response (t_fb). As explained below, these outputs are used to develop the updated HRR curve during manual suppression in the fire-suppressant interaction model.

An explicit interface between the fire hazard propagation model and the first responder performance module is developed to address two directions of the fire–human interactions: (A) the influences of the first responder on fire propagation; and (B) the influences of fire propagation on the first responder performance, using the following procedure:

• (i)

  The time to detection (t_det) is predicted by the fire hazard propagation model and provided as an input to the first responder performance module (arrow “B”).

• (ii)

  Using t_det as an input, the HRA event tree model generates the manual suppression scenarios and estimates t_fb in each scenario. t_fb is passed to the fire hazard propagation model (arrow “A”).

• (iii)

  The fire hazard propagation model is run until t_fb to obtain the burnout HRR curve, denoted by $Q˙burnoutt$⁠, which is passed to the first responder performance module (arrow B).

• (iv)

  Based on the predicted $Q˙burnoutt$⁠, the HRA event tree model generates the manual suppression scenarios after t_fb, and the fire-suppressant interaction model constructs the HRR curve under manual suppression, $Q˙suppt$⁠, which is then passed to the fire hazard propagation model (arrow A).

• (v)

  The fire hazard propagation model is run using $Q˙suppt$ to predict the physical KPMs of the fire-induced cable damage (T_CB and q^″_CB as introduced in Sec. 1.1) with explicit incorporation of the influences of manual suppression.

In this procedure, the influence of manual suppression on fire propagation is explicitly addressed through $Q˙suppt$⁠. The influence of fire propagation on the performance of manual suppression is considered by two methods. First, the upper limit of the HRR value that can be controlled by the firefighting strategy (e.g., a portable extinguisher) is considered in the generation of the manual suppression scenarios in the HRA event tree model. The HRR value at t_fb is predicted by the fire hazard propagation model and compared with the threshold HRR to determine if the manual suppression using the specific firefighting strategy is feasible; if it exceeds the threshold HRR, the conditional HEP for the corresponding suppression action is assumed to be unity (note that this is a conservative assumption because “partial” suppression, where the firefighting mean partially reduces fire growth, is not credited). Second, the influence of the fire-induced conditions (e.g., high temperature, smoke) on the HEPs of the first responder's actions is addressed through the “stress/stressor” and “complexity” PSFs in the HRA quantification model. It should be noted that, at this stage of research, the treatment of these influences is “qualitative,” where the levels of PSFs are determined based on the analyst's judgment, without developing a quantitative relationship between the PSFs and the fire-induced conditions predicted by the fire hazard propagation model.

For the implementation of the HRA-based first responder performance module (Fig. 3), this paper tailors the recent HRA method developed in NUREG-2180 [8], which was developed for modeling the human performance of prompt detection and suppression in response to the very early warning fire detection systems of NPPs. Compared to NUREG-2180, this paper makes several methodological advancements: (i) the HRA-based method is advanced for analyzing a different manual fire protection feature, i.e., manual suppression by the onsite fire brigade; (ii) the timings of human actions for manual suppression, in addition to the HEPs, are explicitly quantified in HRA; and (iii) the HRA-based first responder performance module is interfaced with a CFD fire model to account for the fire–human interactions. The HRA-based first responder performance module is implemented using the NUREG-2180 HRA process consisting of the following nine steps:

• Step 1: define and interpret the issue.

• Step 2: define the scope of the analysis.

• Step 3: identify and define the success criteria and human failure events (HFEs).

• Step 4: perform qualitative analysis.

  • ○

    Substep 4.1: develop an HRA scenario for manual suppression.

  • ○

    Substep 4.2: timeline analysis.

  • ○

    Substep 4.3: feasibility analysis.

• Step 5: perform quantitative analysis.

• Step 6: perform dependency analysis.

• Step 7: perform recovery analysis.

• Step 8: perform uncertainty analysis.

• Step 9: complete documentation.

The detailed methodological procedure of each step is explained in Sec. 3 where a case study for an NPP is demonstrated. In this paper, step 9 is not explicitly covered as Sec. 3 itself serves as documentation of the HRA implementation.

In this section, a case study using an NPP fire scenario is conducted to demonstrate the implementation of the HRA-based first responder performance module in the fire I-PRA framework. A representative NPP fire scenario provided in NUREG-1934 Scenario D, a motor control center panel fire in a switchgear room [38] (Fig. 4), is selected for the case study.

A concrete wall with a 0.6 m thickness is the boundary of this fire compartment. The fire compartment is equipped with supply and return vents that have a volume flow rate of 0.735 m³/s. Two doors of the fire compartment are assumed to be closed during the fire. Two electrical cabinets are placed: one of the cabinets is assumed to be a fire ignition source, while the other is a target of fire-induced damage. Three cable trays are installed near the ceiling. The cable trays are filled with cross-linked polyethylene insulated cable with a neoprene jacket. Each cable is modeled as a 1.5 cm cylinder with homogeneous physical properties using the thermally induced electrical failure (THIEF) method [39]. In this case study, cable tray B is assumed to be associated with the fire-induced initiating event in the plant PRA model (e.g., small-break loss-of-coolant accident due to a stuck-open pressurizer valve) and is considered as the damage target of interest. Fire propagation and its effects on the damage target are simulated by a CFD-based fire model, the FDS [20–22]. The FDS code was verified and validated for this fire scenario in NUREG/CR-1934 [38]. This case study assumes that the fire ignition in the electrical cabinet is detected by automatic detectors, and the prompt and automatic suppression are unavailable; hence, the only suppression path available is manual suppression by the fire brigade.

For this selected fire scenario, the HRA-based first responder performance module is implemented using the NUREG-2180 HRA process, consisting of nine steps listed in Sec. 2. Implementation of each step is described in Secs. 3.1–3.8.

This study focuses on the human performance of the fire brigade in manual suppression for the electrical cabinet fire in the switchgear room of an NPP.

The scope of the HRA-based first responder performance module is to estimate the HRR curves under manual suppression by the fire brigade, $Q˙suppt$⁠. As illustrated in Fig. 3, the HRA-based first responder performance module is coupled with the fire hazard propagation model in a way that (i) first responder performance module obtains $Q˙burnoutt$ and t_det from the fire hazard propagation model; and (ii) t_fb and $Q˙suppt$ estimated by the first responder performance module are passed to the fire hazard propagation model to incorporate the influences of manual suppression into the fire damage modeling. The FSM coupled with the first responder performance module predicts the physical KPMs associated with the fire-induced cable damage (T_CB and q″_CB in Fig. 1). Note that the input parameters used in this case study are generic and not representative of any specific NPP. The objective is to demonstrate the implementation of the HRA-based first responder performance module. To apply the proposed methodology for a specific NPP, the plant-specific analyses should be conducted.

This step identifies and defines the success criteria and HFEs for the problem identified in steps 1 and 2. The success criteria define under what conditions the human action is considered as a success. The potential human error that could impede the achievements of the success criteria is identified as the HFE. To facilitate the definition of success criteria and the HFEs, the fire drill records for the switchgear room at a representative plant are analyzed to identify the sequence of tasks required for achieving manual suppression of the switchgear room fire (Fig. 5).

Based on the drill record, three types of personnel involved in the manual suppression process are identified: (i) the MCR operators, (ii) the fire scout, and (iii) the fire brigade team. The MCR operators are responsible for detecting the fire alarm in the MCR and communicating with the fire brigade members to dispatch them. The fire scout, who is one of the fire brigade members, is dispatched to the fire location in advance of the fire brigade team and is responsible for checking and reporting the conditions of the fire room. The fire brigade team is responsible for performing manual suppression in the fire room. The vertical axis of Fig. 5 shows the chronological order of tasks that should be implemented for a successful manual suppression.

The first column shows the tasks implemented by the MCR operators. Their actions are initiated in response to the fire detection alarm in the MCR and include two tasks:

• Detect and diagnose the fire detection signal on the MCR computer (task 1.A).

• Communicate with the fire brigade team to dispatch them to the fire scene (task 1.B).

The second column shows the tasks implemented by the fire scout and includes the following four tasks:

• Following the notification from the MCR, arrive at the assembly area.

• Leave the assembly area and move to the fire room.

• Arrive at the door of the fire room.

• Check the indications of the fire and report the status to the fire brigade team.

The third column shows the tasks implemented by the fire brigade team, including the following tasks:

• Following the alarm notification from the MCR, gather at the assembly area (task 2.A).

• Communicate with the MCR to get an appropriate fire preplan number (task 2.B).

• Put on and peer check the personal protective equipment (task 2.C).

• Leave the assembly area and move to the staging area using a vehicle (task 2.D).

• Arrive at the staging area (task 2.E).

• Prepare for entering the fire room by laying out the water hose from the hose cabinet to the entrance of the room (task 2.F).

• Put on the self-contained breathing apparatus (task 2.G).

• Enter the fire room (task 2.H).

• Search for and locate the fire source (task 2.I).

• Manually suppress the fire using a portable fire extinguisher (task 2.J).

• ○

  Open the electrical cabinet door (task 2.J.i).

• ○

  Discharge the portable fire extinguisher (task 2.J.ii).

• If the fire is not suppressed by task 2.J using a portable extinguisher, suppress the fire using a water hose with an “e-rated” nozzle designed for electrical fires (task 2.K).

• ○

  Prepare the water hose (task 2.K.i).

• ○

  Open the electrical cabinet door if it has not been opened in task 2.J.i (task 2.K.ii).

• ○

  Discharge the water hose on the fire source (task 2.K.iii).

• Fire suppressed or under control

For simplicity, the first scout's action is assumed to be performed successfully; hence, the scope of HRA includes the actions taken by the MCR operators (tasks 1.A and 1.B) and those taken by the fire brigade team (tasks 2.A to 2.K). For the sake of reference, each task is numbered as “task [1 or 2].[alphabet]” where the number represents the type of personnel (1: MCR operators and 2: fire brigade), while the upper-case alphabet represents the task sequence.

The success criterion for the MCR operators' response is that they dispatch the fire brigade to the correct location in a timely manner upon recognizing the automatic detector's alarm in the MCR (i.e., tasks 1.A and 1.B are performed successfully). The success criterion for the fire brigade is that they arrive at the correct fire compartment as instructed by the MCR operators, search for and locate the fire source, and suppress or control the fire before the cable damage occurs (i.e., tasks from 2.A to 2.K are performed successfully and in a timely manner). The HFEs for the MCR operators and the fire brigade are defined as the failure to satisfy the success criteria above.

This step conducts three qualitative analyses: (4.1) develop an HRA scenario for manual suppression; (4.2) timeline analysis; and (4.3) feasibility analysis. The qualitative analysis is conducted based on (i) fire drill records and the fire brigade manual from the plant; and (ii) discussions with the fire protection experts from the plant.

Figure 6 shows the HRA event tree developed based on the plant data obtained in step 3. This corresponds to the HRA event tree model in Fig. 3 and is quantified in step 5 below.

The top events represent the human actions performed either by the MCR operator or by the fire brigade. In this study, as suggested by the NUREG-2180 HRA Process [8], each HFE is treated holistically, rather than breaking it down into various lower-level subtasks. This is because the lower level subtasks, defined in technique for human error rate prediction [36] for the MCR context, are not fully applicable for the context of manual suppression. In the HRA event tree (Fig. 6), therefore, the action by the MCR operators (i.e., combination of tasks 1.A and 1.B) is treated as one HFE (top event MCR), whereas the action by the fire brigade team is divided into three HFEs, including (i) “FBR” consisting of the presuppression actions (tasks 2.A–2.I), (ii) “MS1” where the fire brigade applies a portable fire extinguisher (task 2.J), and (iii) MS2 where the fire brigade uses a water hose to control the fire (task 2.K). FBR is treated separately from MS1 and MS2 because MS1 and MS2 induce the two-directional fire–human interactions, unlike FBR where one direction of the interactions (i.e., from fire progression to human performance) is dominant, and those two-directional interactions cannot be captured by the existing HRA quantification techniques.

This step estimates the times required for each task. When time data for human actions are collected, the uncertainty associated with the time to complete each task, in addition to the point estimate corresponding to a nominal plant crew under average conditions, needs to be addressed [8]. This case study identifies the upper and lower bounds of the time required for each task based on the plant data and fits the normal distributions (left truncated at zero) in a way that the upper and lower bounds become the 90th and 10th percentiles, respectively. This case study develops the time distributions based on the fire drill records collected at the representative NPP (Table 1). Note that these probability distributions are used only for demonstration and do not aim to provide accurate estimates at a specific plant. The fire drill records indicate that the plant crew was informed of the drill in advance; hence, the timing information in the drill records may not fully represent the fire brigade performance under a real fire scenario where the fire occurrence is typically unexpected. When the HRA-based method is implemented for practical applications, accurate timing distributions should be generated by conducting a more formal statistical analysis with consideration of other sources of data, such as the historical fire event records and opinions from the plant experts.

Estimation of the time required for task 2.K.iii (discharge the water hose until the fire is suppressed) needs the information from the fire hazard propagation model; therefore, the time required for task 2.K.iii is estimated in step 5 where the first responder performance module is coupled with the fire hazard propagation model.

The feasibility analysis evaluates whether it is feasible for operators to carry out the designated tasks under the given contexts and conditions [40]. For the feasibility analysis in fire HRA, NUREG-1921 [40] suggests six criteria: (1) sufficient time, (2) sufficient manpower, (3) primary cues available/sufficient, (4) proceduralized and trained actions, (5) accessible location, and (6) equipment and tools available and accessible.

Sufficient time: This criterion questions whether the designated task for the HFE can be completed within the available time, considering both cognitive and execution tasks [41]. The important contributors to this criterion include equipment accessibility, environmental conditions, and variability among individual crews. The uncertainty associated with the required time, due to the variability of those contributing factors, should be addressed [40]. In this research, this criterion is explicitly considered in step 5 by quantifying the timings of human actions.

Sufficient manpower: This criterion questions whether a sufficient number of trained personnel are available for completing the required tasks [41]. Based on the review of the plant fire protection manual and an interview with the plant experts, the MCR operators are guided to place the top priority on the fire detection signal, and the required number of fire brigade members is always available; therefore, sufficient manpower is available.

Primary cues available/sufficient: This criterion questions whether the cues, sufficient for initiating and implementing the designated human actions, are available in a timely manner [41]. In the context of manual suppression, the first cue for MCR is the fire detection signal generated by the automatic detectors. This case study assumes successful fire detection by the automatic detectors; hence, this first cue for the MCR operators is available and sufficient. The initial cues for FBR, MS1, and MS2 are the notifications provided by the MCR operators. The failure of the MCR to issue notifications is explicitly addressed by the HRA event tree. In the case where the MCR successfully provides the notifications, it is assumed that sufficient initial cues are available for the fire brigade actions. The physical cues of the fire source, such as smoke, heat, temperature, and visible flame, are also critical cues for FBR, especially for the fire search (task 2.I). This study assumes that the fires that can cause the equipment damage will generate a sufficient level of physical cues for fire search.

Proceduralized and trained actions: This criterion questions whether (i) the quality of the plant procedure is sufficiently high to provide an effective guidance for human actions; and (ii) the amount and quality of the training are adequate to provide the MCR operators and the fire brigade with the opportunity to practice their responses [41]. Based on the plant information, well-structured operational procedures are provided for the MCR operators when the fire detection alarms are received. The plant has a well-structured fire preplan for each fire compartment, which details the room geometry and the firefighting strategy. The fire drills for the MCR operators and the fire brigade are periodically conducted, with feedback from the internal and peer reviewers. The procedure and training, therefore, have no negative impact on the feasibility of the manual suppression tasks.

Accessible location: This criterion questions whether the location where the required tasks are implemented is accessible. The accessibility of the task location could be influenced by the travel path, environmental effects (e.g., smoke, heat stress), and physical obstructions (e.g., locked doors) [40,41]. The MCR response is performed in the MCR without being influenced by fire-induced conditions; hence, there is no concern about the accessibility of the location. For the fire brigade response, the accessibility of the location may be hampered by the fire-induced conditions, especially inside the fire room. Those fire-induced physical conditions can affect the accessibility of the locations for tasks 2.H (entering the fire room) through 2.K (manual suppression using the water hose). For the fire brigade tasks, however, this study assumes that the required tasks are feasible in terms of the accessible location criterion, considering that (i) the fire brigade is periodically trained under the real fire conditions, and (ii) the fire brigade crews wear protective gear designed such that the location accessibility is not compromised by the fire scenarios encompassed in the NPP fire PRA. There are a few additional considerations for this assumption: (a) for MS1, an upper limit of HRR value that can be controlled by the portable extinguisher is considered (in step 5), and (b) the effects of fire-induced conditions on the fire brigade response are addressed by the PSFs in the HRA quantification model.

Equipment and tools available and accessible: This criterion questions whether the portable and special equipment necessary for implementing the local tasks, such as the keys to open locked areas, portable radios, protective gear, portable extinguishers, and water hoses, is available and accessible by the plant personnel [40,41]. Based on the fire preplan of the plant, the equipment necessary for the fire brigade action is stored in the designated locations, clearly indicated in the fire preplan, and is periodically tested to check its availability; therefore, all equipment and tools needed for the fire brigade tasks are available and accessible.

This step executes the HRA-based first responder performance module using two substeps. In substep 5.1, the HRA quantification model is run to estimate the HEPs for the presuppression actions (MCR and FBR in Fig. 6). For the suppression actions by the fire brigade (MS1 and MS2), the existing HRA quantification techniques are not directly applicable. This is because, in those existing HRA techniques, while the influence of surrounding environment on the human performance is considered through the PSFs, the influence of human actions on the evolution of the surrounding environment cannot be addressed. In addition, the success criteria for MS1 and MS2 are defined in terms of the cable damage state that is beyond the scope of the existing HRA quantification techniques; therefore, for MS1 and MS2, the first responder performance module should be coupled with the fire hazard propagation model by creating an explicit interface. In substep 5.2, the HEPs and timings of MS1 and MS2 are quantified by running the first responder performance module coupled with the FSM. Specifically, HRA scenarios (outcomes of human actions, timings of each task) are generated by the Monte Carlo method and, for each scenario, the fire hazard propagation model is executed to predict the physical KPMs associated with the cable damage.

This substep quantifies the HEPs for MCR and FBR by the HRA quantification model (c.3 in Fig. 3). This case study uses the SPAR-H method [37], which was developed by the Idaho National Laboratory for the risk-informed regulatory applications [42,43]. The SPAR-H method is selected in this study considering its several advantages over the other techniques: (i) both execution and cognitive actions can be addressed, (ii) the treatment of PSFs has more resolution and flexibility than the other existing HRA methods to aid in accounting for the fire effects on human performance, and (iii) the detailed procedure is available in the public document [37]. The SPAR-H is a relatively simple method, aimed at obtaining the first-order approximation of the HEPs. Although the SPAR-H method has been applied for the external event PRA¹ in limited studies, e.g., for internal fire [44] and seismic [45], NUREG/CR-6883 [37] has reservations about the applicability of SPAR-H for external events, especially concerning the base HEP values and the PSF multipliers. In this study, the SPAR-H method is applied in the context of internal fires to obtain the first-order approximation of the HEP estimates. Note that the HRA-based first responder performance module is developed based on the modularized design in a way that, depending on the desired level of detail and accuracy, different HRA quantification techniques can be used. If the HEPs for MCR and FBR are identified as significant risk contributors, a more sophisticated HRA technique, such as IntegrateD Human Event Analysis System (IDHEAS) method [46,47], should be applied as the HRA quantification model to obtain more accurate and realistic HEP estimates.

The HEPs for MCR and FBR are estimated by applying the SPAR human error worksheet for the at-power operation mode [37]. For MCR, assuming that (i) diagnosis and execution errors are considered and (ii) the “experience/training” PSF has a high state considering frequent fire drills, while the other PSFs have a “nominal” state, the total failure probability is computed as Pr(MCR) = 0.0055. For FBR, assuming that (i) the stress/stressor PSF has a high state due to the fire-induced conditions, (ii) the “complexity” PSF has a “highly complex” state due to parallel tasks and large amount of communication among the fire brigade members, (iii) experience/training PSF has a high state considering frequent fire drills, and (iv) diagnosis and execution errors are considered, the total HEP is computed as Pr(FBR) = 0.055.

In this substep, the HRA-based first responder performance module is executed in fire I-PRA (Fig. 1) by generating the HRA scenarios and creating an explicit interface with the fire hazard propagation model.

The random samples of uncertain input parameters for the fire hazard propagation model are generated by the Monte Carlo method. In fire I-PRA [20–22], several physical input parameters in the FDS code are treated as random variables (Table 2).

where $Q˙max$ is the maximum HRR value, $t1$ is the time to fire growth under the burnout condition, $t2$ is the duration of the maximum HRR under the burnout condition, $t3$ is the time to decay under the burnout condition, and $x¯other$ is a vector of other random input parameters (e.g., material properties, geometry).

where the superscript $i; i∈1,2,…, nS,$ represents the index of the Monte Carlo scenarios generated for fire propagation. Then, for each Monte Carlo scenario, t_det is estimated. NUREG/CR-6850 [7] suggests t_det = 1 min as a generic point estimate for automatic detectors, and this point value is used in this study.

The HRA scenarios before the beginning of manual suppression (MCR and FBR), in terms of the fire propagation and the timings and outcomes of human actions, are generated. Two attributes are considered: (i) the HFEs associated with MCR and FBR and (ii) the time required before starting manual suppression (up to task 2.I).

First, the HFEs associated with MCR and FBR are considered. For each Monte Carlo scenario generated in substep 5.2.a, two independent uniformly distributed random numbers between 0 and 1, denoted by u_MR⁽ⁱ⁾ and u_FR⁽ⁱ⁾, are generated to consider the outcomes of MCR and FBR:

• If u_MR⁽ⁱ⁾ < 0.0055, namely, Pr(MCR) computed in substep 5.1, MCR is failure; hence, the entire manual suppression process fails, and the original burnout HRR curve is used in the FDS runs until the end of the natural decay of the fire. Go to substep 5.2.f.

• If u_MR⁽ⁱ⁾ ≥ 0.0055 and u_FR⁽ⁱ⁾ < 0.055, namely, Pr(FBR) computed in substep 5.1, MCR is success, but FBR is failure; hence, the entire manual suppression process fails, and the original burnout HRR curve is used in the FDS runs until the end of the natural decay of the fire. Go to substep 5.2.f.

• If u_MR⁽ⁱ⁾ ≥ 0.0055 and u_FR⁽ⁱ⁾ ≥ 0.055, both MCR and FBR are success. Continue the following process in this substep.

where $t1,li$ is the time to complete task 1.l (l = A, B) for the HRA scenario i, $t2,mi$ is the time to complete task 2.m (m = A, B, …, I) for the HRA scenario i.

Then, go to substep 5.2.c below.

This substep runs the fire hazard propagation model for each HRA scenario $i; i∈1,2,…, nS,$ until t_fb⁽ⁱ⁾ using the burnout HRR curve and the random samples of input parameters $X¯i$ generated in substep 5.2.a. When the simulation time reaches t_fb⁽ⁱ⁾, the fire hazard propagation model is stopped by taking advantage of the restart capability of the FDS code. This method assumes that the fire brigade actions before starting to discharge the suppressant on the fire source have no influence on fire propagation; thus, the FDS outputs with the burnout HRR curve can be used until t_fb⁽ⁱ⁾. Go to substep 5.2.d below.

This substep generates the HRA scenarios for MS1 with consideration of the fire hazard propagation model outputs from substep 5.2.c. For simplicity, this case study assumes that there is only one portable extinguisher available in the room; hence, after the fire brigade discharges the portable extinguisher, and if it fails to suppress/control the fire (MS1 fails), they attempt to suppress/control the fire by using the water hose (MS2), rather than bringing in another fire extinguisher.

For MS1, three failure modes are considered:

1. The fire brigade fails to open the electrical cabinet before using a portable fire extinguisher;

2. The fire is so large that the portable fire extinguisher cannot control or suppress it;

3. The fire brigade fails to use the portable fire extinguisher in an effective way.

For the first failure mode, using the SPAR-H [37] with assumptions that (i) this subtask only involves the execution error (assuming that the fire source has been correctly identified in task 2.I); (ii) stress/stressor PSF has an extreme state as this subtask is performed very close to the fire source; and (iii) experience/training PSF has a high state considering the frequent fire drills, the HEP is estimated as 0.00125. The second failure mode represents the situation that, even if the electrical cabinet is adequately opened, there is a possibility that the portable extinguisher cannot control the fire because the fire is too large. This study assumes that, if the HRR at the time when MS1 begins is higher than 1000 kW, the portable fire extinguisher fails to suppress the fire [48]. The third failure mode represents the situation that, even if the electrical cabinet is adequately opened and the fire intensity does not exceed 1000 kW, there is a possibility that the fire will not be fully controlled due to the ineffective use of the portable extinguisher. This case study assumes that, given the HRR is below 1000 kW, the probability that the fire is not suppressed by the portable extinguisher is 60% [49]. Note that these values (i.e., the HRR threshold and the failure probability) are based on generic data; hence, in practical applications of the HRA-based method, these parameters should be updated based on the plant-specific fire protection design.

where $t2.K.ii$ is a random sample of t_2.K.i for the HRA scenario i, $t2.K.iii$ is a random sample of t_2.K.ii for the HRA scenario i.

Restart and run the fire hazard propagation model until t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ using the burnout HRR curve. Then, go to substep 5.2.e.

If u₁⁽ⁱ⁾ > 0.00125, the first failure mode of MS1 does not occur. Generate a random sample of the time required for opening the electrical cabinet (t_2.J.i) from the corresponding probability distribution in Table 1. Then, restart and run the fire hazard propagation model until t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ + t_2.J.i⁽ⁱ⁾ using the burnout HRR curve. Check if the second failure mode of MS1 occurs due to excessively high intensity of the fire by the following procedure:

• If the HRR value at time t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ + t_2.J.i⁽ⁱ⁾ is larger than 1000 kW, the fire cannot be suppressed by the portable extinguisher, and MS1 fails. In this case, generate a random sample of the time required for discharging the portable extinguisher (t_2.J.ii) and for preparing the water hose (t_2.K.i) from the corresponding probability distributions in Table 1. Then, update t_fb⁽ⁱ⁾ considering those additional tasks by

  $tfbi←tfbi+t2.J.ii+t2.J.iii+t2.K.ii$

  (5)

  Restart and run the fire hazard propagation model until t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ using the burnout HRR curve. Then, go to substep 5.2.e.

• If the HRR value at time t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ + t_2.J.i⁽ⁱ⁾ is smaller than or equal to 1000 kW, the probability that the fire can be suppressed by the portable extinguisher is 40%. For each HRA scenario, a uniformly distributed random number between 0 and 1, denoted by u₂⁽ⁱ⁾, is generated.

If u₂⁽ⁱ⁾ ≤ 0.40, the fire is suppressed by MS1. A random sample of the time required for discharging the portable extinguisher (t_2.J.ii) is generated. This study assumes that, in this situation, the HRR curve during the manual suppression has the same time profile as the burnout condition, and at time t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ + t_fb→sup⁽ⁱ⁾, the HRR becomes zero. This is a conservative assumption since the influence of the portable extinguisher is ignored during the manual suppression. Go to step 5.2.f.

Restart and run the fire hazard propagation model until t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾, using the burnout HRR curve. Then, go to substep 5.2.e below. Note that, even when the fire brigade fails to suppress the fire in MS1, the use of a portable extinguisher most probably still provides some benefit in terms of the fire control, such as a partial reduction of the HRR and delay in the fire growth; however, this study conservatively assumes that, given that MS1 fails, there is no influence on the HRR curve induced by MS1.

where $m˙w′′$ is the water application rate on the fuel bed [kg/(s m²)], while a₁ and a₂ are regression parameters. Since there is no experimental data specific for electrical cabinet fires in NPPs to estimate the two empirical parameters, as the first-order approximation, this study uses the values obtained by Yu et al. [52] for the plastic commodity. In this research, to consider uncertainty associated with these two empirical parameters, the experimental data provided by Yu et al. [52] are reanalyzed by performing a linear regression analysis to construct the 95% confidence intervals (CIs) for a₁ and a₂ (Table 3). For each parameter, the uncertainty is characterized by a normal distribution whose mean value is set to the point estimate, while the 97.5th and 2.5th percentiles are set to the upper and lower bounds of the 95% CIs.

The empirical water suppression model requires $m˙w′′$⁠, representing the water application rate sprayed on the fuel bed. There are two possible approaches for estimating $m˙w′′$⁠: (i) perform a manual suppression test with the fire brigade to estimate the range of $m˙w′′$⁠; or (ii) develop an explicit model of the fire brigade performance. There is no literature, however, that has studied $m˙w′′$ for the NPP fire brigade; thus, the range of $m˙w′′$ observed in the test by Scheffey and Williams [60], where professional and well-trained firefighters tackled the wood crib fires, is used in this study. The uncertainty associated with $m˙w′′$ is represented by a uniform distribution (Table 3), which has the upper and lower bounds being set to the maximum and minimum values observed in Ref. [60]. Note that the range of $m˙w′′$ given in Table 3 exceeds the upper limit in the experimental data used by Yu et al. [52] to fit the empirical water suppression model (0.012 ≤ $m˙w′′$ ≤ 0.041 kg/s m²). In this research, it is assumed that their empirical water suppression model can be extrapolated beyond $m˙w′′$ = 0.041 kg/s m². Future research needs to advance the water suppression model for manual suppression in the NPP context.

For each HRA scenario $i; i∈1,2,…, nS,$ a set of random samples of $m˙w′′$⁠, a₁, and a₂, is generated from the probability distributions in Table 3, while the HRR value at t_det⁽ⁱ⁾ + t_fb⁽ⁱ⁾ is retrieved from the FDS outputs obtained in substep 5.2.d. Then, the HRR during MS2 is developed by using Eqs. (7) and (8). In the current scope, the time-profile of the HRR without manual suppression is based on the burnout HRR time profile prescribed in NUREG/CR-6850 [7]. Figure 7 shows the modified HRR curve generated in this substep, based on the HRA scenarios. For illustration, only 10 HRA scenarios are generated. The solid lines show the HRA scenarios where the fire is suppressed by MS2, the dotted-dashed lines show those where the fire is suppressed by MS1, and the dotted lines show those where both MS1 and MS2 fail to suppress the fire before its natural decay. The HRR curve generated in this step will be used in substep 5.2.f.

In this substep, for each HRA scenario $i; i∈1,2,…, nS,$ the fire hazard propagation model is run with the updated HRR curve obtained in substep 5.2.e. Under MS2, the empirical suppression model, shown in Eq. (7), asymptotically approaches zero but never reaches the zero HRR value. The fire is regarded as being fully controlled when the HRR value falls below 10 kW; thus, the FDS simulation for each HRA scenario is run until the HRR falls below 10 kW. After this substep, the fire hazard propagation model predicts the physical KPMs, T_CB and q″_CB, for the fire-induced cable damage.

The fire-induced damage probability for cable tray B (Fig. 4) is estimated based on the predicted T_CB and q″_CB using the I-PRA method [17–22]. The cable tray is assumed to fail when either T_CB or q″_CB exceeds the corresponding damage threshold (T_crt and q″_crt). The cable tray is filled with cross-linked polyethylene-insulated cables, and the damage thresholds are set to T_crt = 400 °C and q″_crt = 11 kW/m² [38]. The point estimate of the damage probability (⁠$p̂F$⁠) is obtained by $p̂F=nF/nS$ where n_F is the number of Monte Carlo runs resulting in the target damage, and n_S is the sample size. The 95% CIs of the damage probability are constructed by the replicated Monte Carlo method [61], which runs five independent Latin hypercube sampling batches (each consisting of 50 samples) and constructs the CIs based on the between-batch variation of the point estimates. Further detail of the computational method is provided in Refs. [20–22]. The cable damage probability is computed as 0.084 (95% CIs: [0.080, 0.092]). In the I-PRA framework (Fig. 1), this probability is used as an input to the scenario-based damage model, e.g., Pr(CBD) in Fig. 1, to compute the fire PRA inputs, e.g., the fire-induced basic event probabilities in the plant PRA model.

Dependency among the HFEs is explicitly addressed in the HRA event tree logic (Fig. 6) and the SPAR-H method. The dependency among the times required for the MCR and fire brigade tasks (Table 1) is not addressed as those times are assumed to be independent random variables. Qualitatively, the potential strength of dependency among the required times can be understood based on the dependency matrix in the SPAR-H method, using four criteria: (i) crew (same or different), (ii) time (close or not close in time), (iii) location (same or different), and (iv) cues (additional or no additional). For the MCR operators, as tasks 1.A and 1.B are performed by the same crew, closely in time, and in the same location, a high or complete level of dependency is expected. The fire brigade tasks are performed by the same crew and closely in time; therefore, a high degree of dependency is expected. A quantitative dependency analysis for the required times is left to future research and is further discussed in Sec. 4.

For the first responders in fire scenarios, human error recovery, where the failed human action could be corrected by the subsequent tasks or through double-checking by another crew, should be considered. The SPAR-H method [37] suggests that the human error recovery be addressed through adjustment to the PSFs, e.g., if the additional personnel double-checks the precedent task, a positive level is assigned to the “work-practice” PSF. This PSF-based approach is followed in this study.

In PRA, sources of uncertainty are commonly decomposed into two types: aleatory and epistemic. Aleatory uncertainty is induced by natural and inherent variabilities in the phenomena and processes, while epistemic uncertainty originates from a lack of knowledge about the phenomena and processes [62]. The potential sources of uncertainty in the HRA-based first responder performance module are as follows:

Aleatory uncertainty: (A.1) Variability in the times to complete individual tasks; (A.2) Randomness associated with the outcome of each task; and (A.3) Natural variability of fire characteristics.

Epistemic uncertainty: (E.1) Uncertainty associated with the choice of probability model and the estimation of parameters for probability distributions of the required times for the MCR and fire brigade tasks (Table 1); (E.2) parameter uncertainty associated with the physical input parameters of the FDS code (Table 2); (E.3) uncertainty associated with the basic HEP values and PSFs in SPAR-H; (E.4) model uncertainty associated with the FDS code, the HRA event tree model, and the fire-suppressant interaction model. This includes the uncertainty induced by the assumptions made in the HRA modeling, e.g., the one that the HRR curve during MS1 is unchanged from the burnout HRR curve; and (E.5) completeness uncertainty associated with the manual suppression scenarios considered in the HRA event tree.

In this study, the sources of aleatory uncertainty have been mostly addressed in the HRA quantification. The aleatory uncertainty due to (A.1) and (A.3) is represented by the probability distributions listed in Tables 1 and 2, respectively, and is explicitly treated in the uncertainty propagation conducted in step 5. The aleatory uncertainty due to (A.2) is explicitly treated by the HRA event tree logic. In contrast, the epistemic uncertainty has not been explicitly addressed in the HRA quantification. Indeed, a quantitative treatment of epistemic uncertainty in HRA is an evolving research area [40,63,64], and future research needs to examine the influences of the epistemic uncertainty.

While the HRA-based method can address two gaps in the current fire PRA methodology related to the modeling of the manual fire protection features identified in Sec. 1, it should be acknowledged that the HRA-based method has a limitation in the treatment of the human action dependency induced by the fire–human interactions. In the case study (Sec. 3), there can be strong dependency among FBR, MS1, and MS2. The “direct” dependency (e.g., the second task can be performed only if the first task is success) is explicitly treated in the HRA event tree. However, the “indirect” dependency among multiple tasks with respect to HEPs and timings induced by the fire–human interactions is not fully incorporated. The HRA-based first responder performance module partially addresses the dependency between MS1 and MS2 (induced through the HRR curve), namely, the one induced by the HRR impacts on the feasibility of MS1 and the HRR influence on the fire-suppressant interactions predicted by Eq. (7). The HRA-based method does not address the task dependency between FBR and MS1/MS2 due to the fire–human interactions, e.g., the higher HRR value can cause the denser smoke, which can impact the time to locate the fire source (task 2.I) in FBR, while it can impact the feasibility of MS1.

To alleviate this challenge, Bui et al. [29] have developed an explicit simulation model of the fire brigade movement during the fire search (task 2.I) using agent-based modeling, coupled with the fire hazard propagation model in the geographic information system (GIS). The agent-based modeling simulates the behavior of the fire brigade crews using the “movement rules” generated based on the plant fire protection procedures. The sources of dependency among the fire brigade subtasks during the fire search due to the fire–human interactions are captured in the simulation environment.

While the advanced first responder performance module using either the HRA-based or simulation-based method can contribute to improved realism of fire PRA, the balance between the desired level of realism and the additional resources required by the advanced methods (e.g., the time for model development and validation, and computational cost) should be considered in practical applications. In the authors' perspective, the level of sophistication of the first responder performance module needs to be gradually refined depending on the risk importance of each scenario and manual fire protection features. As the first step, the detection and suppression analysis for each fire scenario should be conducted using the data-driven approach available in the existing fire PRAs of NPPs, namely, using an implicit fire–human interface and using the data-driven nonsuppression curve. The risk importance measure [65–67] is then computed to determine whether timings of manual suppression (t_det and t_supp in Fig. 2) have significant influences on the plant risk metrics. If their effects on plant risk are negligible, there is no need to further advance the first responder performance module. If their effects are non-negligible, we should consider advancing the first responder performance module toward the model-based approach. In this situation, the authors suggest using the combination of the HRA-based and the simulation-based methods. For each task by the MCR operators and the fire brigade, the choice between the HRA-based and the simulation-based methods should be made based on the degree of dependency induced by the fire–human interactions. If the task has a high degree of fire-induced dependency, the simulation-based method is suggested; otherwise, the HRA-based method is applicable. Structured guidance on which type of first responder performance model should be selected will be developed in future research.

To improve realism of fire PRA of NPPs, the authors' previous studies [17–22] developed the I-PRA methodological framework. The previous I-PRA development advanced the treatment of interactions between fire propagation and first responder performance in manual suppression by creating an explicit interface through the HRR curve; however, there were still two gaps: (a) the human performance in manual suppression was treated by the data-driven method (i.e., nonsuppression curve available in the current fire PRAs [10]) and (b) the explicit interface addressed only one direction of the fire–human interactions (i.e., the influences of the first responder on fire propagation) using a conservative assumption. To further advance the manual suppression analysis in fire I-PRA, the authors have initiated a line of research where the first responder modeling is advanced with a more explicit fire–human interface that can address both directions of interactions. This paper reports on the advanced first responder performance modeling using the HRA-based method, while Bui et al. [29] report on the one using the simulation-based method. The advanced methods developed in this line of research can contribute to more realistic risk estimation by relaxing the conservative assumption used in the existing fire PRAs and by reflecting the current plant conditions through the explicit incorporation of physical and human contributing factors. Those advanced methods can also contribute to more efficient risk management as the most critical physical and human contributing factors can be identified by importance measure analyses.

The HRA-based first responder performance module is implemented in fire I-PRA by using the NUREG-2180 HRA process [8] with a few advancements: (i) it is advanced for analyzing the different manual fire protection features, i.e., manual suppression by the fire brigade; (ii) the timings of human actions, in addition to the HEPs, are explicitly quantified; and (iii) it is interfaced with a CFD-based fire model to address the bidirectional fire–human interactions. The detailed procedure is demonstrated by a case study using a switchgear room fire scenario at an NPP. Section 4 highlights that this research does not aim to propose the development of a sophisticated first responder performance module for all the tasks to be undertaken by the MCR and the fire brigade; the accuracy and the level of detail of the first responder performance module should be gradually increased based on the risk importance of each fire scenario and the degree of fire-induced dependency. For the risk-significant tasks identified by the risk importance measure analysis, a more sophisticated and realistic method with higher resolution should be developed. The HRA-based method developed in this paper and the simulation-based method developed by Bui et al. [29] are applicable as two complementary alternatives. The authors recommended that the choice between the HRA-based and simulation-based methods be made based on the degree of dependency among the manual suppression tasks induced by the fire–human interactions.

Future research needs to address: (i) development of a structured guidance on the choice between the HRA-based and simulation-based methods; (ii) assessment of epistemic uncertainty introduced by the use of the water suppression correlations, Eqs. (7) and (8), calibrated based on the fire test data from a different context; (iii) refinement of the estimation of water application rate for the NPP fire scenarios; (iv) an extension of the HRA-based method to the other manual fire protection features; and (v) a comprehensive uncertainty analysis using the probabilistic validation in fire I-PRA [21,26].

The authors wish to acknowledge the South Texas Project Nuclear Operating Company for sharing the plant information and providing feedback. This work made use of the Illinois Campus Cluster, a computing resource that is operated by the Illinois Campus Cluster Program in conjunction with the National Center for Supercomputing Applications and is supported by funds from the University of Illinois at Urbana-Champaign. The authors would like to thank all members of the Socio-Technical Risk Analysis (SoTeRiA) Research Laboratory² for their feedback, and especially appreciate the valuable feedback and the computational support provided by a Research Scientist Dr. Seyed Reihani and the review by a Ph.D. Candidate Ha Bui.

• The U.S. Department of Energy, Office of Science, Office of Nuclear Energy University Program (NEUP), Reactor Concepts Research Development and Demonstration (RCRD&D) (Award No. 17-12614; Funder ID: 10.13039/100000015).

a₁ and a₂ =

regression parameters of the fire-suppressant interaction model

FBR =

fire brigade response

FR =

fire ignition

$gFDSX¯$ =

functional representation of the fire dynamics simulator

HA_i =

human actions in manual suppression process

MCR =

main control room operator response

MS1 =

first attempt of manual suppression by the fire brigade

MS2 =

second attempt of manual suppression by the fire brigade

$m˙w″$ =

water application rate on the fuel bed

NS =

nonsuppression

$Q˙burnoutt$ =

burnout hear release rate curve

$Q˙max$ =

maximum HRR value

$Q˙suppt$ =

heat release rate curve during manual suppression

q″_CB =

maximum net heat flux at the surface of the cable jacket

T_CB =

maximum temperature inside the cable jacket

S_j =

manual suppression scenario j

t_det =

time to fire detection

t_fb =

fire brigade response time

t_fb→sup =

duration of manual suppression

t_i =

time required for executing task i

t_supp =

time to manual suppression

$t1$ =

time to the maximum heat release rate under the burnout condition

$t2$ =

duration of the maximum heat release rate under the burnout condition

$t3$ =

time to decay under the burnout condition

$X¯$ =

input parameters of the fire dynamics simulator

$x_other$ =

A vector of non-HRR input parameters (e.g., material properties, geometry)