Assessing the fire risk for a historic Hangar

NASA Ames Research Center (ARC) is evaluating options of reuse of its historic Hangar 1. As a part of this evaluation, a qualitative fire risk assessment study was performed to evaluate the potential threat of combustion on occupants and air vehicles. The study focused on the fire risk trade-off of either installing or not installing a Special Hazard Fire Suppression System in the Hangar 1 deck areas.


INTRODUCTION
In the early 1930s the Naval Air Station Sunnyvale, California was commissioned to house the USS Macon, a U.S. Naval Airship (dirigible). It is now part of a Historic District [1] consisting of a large number of buildings that were constructed from the 1930s on. By far the most famous and visible site is Hangar 1 which is visible from the nearby freeways and from the air. Hangar 1 housed the USS Macon, and was named as a Naval Historical Monument in the early 1950s. The floor covers eight acres and can accommodate 10 football fields; it is 1,133 feet long and 308 feet wide with walls forming an elongated dome 198 feet high.
Hangar 1 is the center of a debate over its future as its external structure was leaking toxic chemicals into the ground water. The US Navy has coated the exterior panels with an encapsulant and is evaluating options for remediating the toxic chemicals permanently. During this process, NASA ARC is evaluating options for the maximum practicable use of Hangar 1 subsequent to its proposed restoration. Potential uses of the hangar include storage and light, non-hazardous maintenance (unfueled air vehicles and no hot work allowed in the hangar) of air vehicles (e.g. fixed-wing aircraft, helicopters, and/or rigid/non-rigid airships), and special short-term events such as public engagements. The plan is to restore Hangar 1 to all current codes but assess the need for a Special Hazard Fire Suppression System (like, hangar floor sprinklers or under wing deluge system). The building code allows the exception of Special Hazard Fire Suppression Systems under certain circumstances. The California State Historic Preservation Office recommended a risk assessment be performed to evaluate the potential threat to the hangar of activities performed inside of it.
This paper provides an overview of the resulting fire risk assessment performed at NASA ARC in relation to the renovation of the historic hangar 1.

METHODOLOGY
The goal was to assess the alternatives in a 5x5 risk matrix. Managers at NASA ARC are comfortable with using these risk matrices in making risk informed decisions. Although routine in the aerospace program/project arena, this risk informed decision making approach is gaining a strong foothold in institutional or facility modification projects.
This was a limited-scope fire risk assessment for Hangar 1. The trade space was an analysis of the risk of major hangar fire with and without a Special Hazard Fire Suppression System for Hangar 1.
The authors chose to use the framework of a probabilistic risk analysis, consisting of event trees and fault trees. Potential accident sequences for a fire in Hangar 1 were developed in the SAPHIRE [2] software code by developing event and fault trees. The event tree displays an initiating event, which disrupts normal operations, followed by a sequence of events (in time) involving success and/or failure of system components. Each path in the event tree is an accident scenario sequence of systems that either succeed or fail during the accident sequence.
Each accident sequence was assessed in terms of its consequence and likelihood. The consequence is an assessment of the worst credible potential result. The likelihood is the probability that the identified accident sequence will occur.
Initially, three event trees were created to assess: • Aircraft Initiated Fire Risks in the Hangar • Airship Initiated Fire Risks in the Hangar • Short Term Special Event Fire Risks in the Hangar These event trees resulted in various event sequences that had consequences of major damage to the hangar, minor damage, and negligible damage. An example initial event tree is shown in section 4. The event sequences resulting from a major hangar fire were evaluated further in two subsequent event trees -one with a Special Hazard Fire Suppression System, and another without any Special Hazard Fire Suppression System (see sections 5 and 6).
Fault trees were generated for all initiating events and some pivotal events. They were used to generate the probabilities of the events in the various event trees. For reasons of conciseness, this paper only shows some of the event trees and none of the fault trees.
The consequences in the two event trees with and without Special Hazard Fire Suppression System were classified as Catastrophic, Critical, Major, Minor, and Negligible. Likelihoods were classified as Likely to occur, Probably will occur, May Occur, Unlikely to occur, and Improbable to occur, in the life of the facility, which for the purposes of this analysis is assumed to be approximately thirty years.
Given the consequence and likelihood, the risk assessment code is obtained from a 5x5 risk matrix shown in Figure 4. The risk is qualitatively rated as high, medium, or low (shown as red, yellow, or green in the matrix).

ASSUMPTIONS
Some of the major assumptions of the study are listed here It is assumed that the current Hangar 1 will be completely renovated as per the Navy's Engineering Evaluation. All new structure, material and components will be up to the current fire codes that include adequate fire detection, alarms and water supply system to the fire hoses. The hangar roof will be accessible to firefighters as part of the upgrades. The fire alarm system will have direct communication with the ARC Emergency Dispatch Center and the on-base Fire Station. Future operations within Hangar 1 are limited to light maintenance and storage of aircraft and airships, and short term special events. All Hangar 1 auxiliary shops and offices after proposed renovations are assumed to be code compliant.
Only fire risk was assessed for the hangar area, due to initiating events either in the hangar area or in an aircraft, airship or special event. Initiating fire events in office spaces are covered by the fire codes and were not addressed in the study. Other initiating events, like seismic or storm events, were not assessed.
Discussions with cognizant ARC personnel suggest that a Special Hazard Fire Suppression System will not be effective against a fire of the hangar itself, due to the hangar's very large volume and significant height and width. The effectiveness of a Special Hazard Fire Suppression System could not be quantified; however, it was conservatively judged by the authors to have a fifty-fifty effectiveness.

INITIAL EVENT TREES
This section shows one of the three initial event trees (see Section 2) as an illustration of the methodology. The event tree for an aircraft initiated risk of a "Major fire in Hangar 1" is shown in Figure 1.
The initiating event is that a local fire starts in an aircraft that is stored in the renovated hangar 1. This is assessed to be "Probable" in the life of the hangar. Local fire detection, meaning within the aircraft, occurs with a high probability. When detected, the ARC Emergency Dispatch Center is also alerted by phone. If the local-to-the-aircraft fire fighting (e.g., Figure 1 -Event Tree for Aircraft Initiated Hangar 1 Fire Risk personnel with fire extinguishers) is effective on the unfueled aircraft, it results in sequence #1 with a "Negligible Damage" consequence and a "Probable" likelihood in the life of the hangar. Event sequence #1 occurs whether or not there is a Special Hazard Fire Suppression System and this risk is shown in the risk assessment matrix of Figure 4. Event sequence #2 occurs if local fire fighting is ineffective and this results in a "Major fire in Hangar 1." Event sequence #3 occurs if the fire is not detected in time so that this event sequence also results in a "Major fire in Hangar 1." These two event sequences show that an aircraft related fire initiating event can spread and become a "Major fire in Hangar 1" with a "May Occur" likelihood in the life of the hangar.
These sequences feed the initiating event in event trees of "Fire Risk of Hangar 1 without any Special Hazard Fire Suppression System" (Figure 2) and "Fire Risk of Hangar 1 with a Special Hazard Fire Suppression System" (Figure 3).
Note that the event tree of Figure 1 does not include the ARC Fire Department's effectiveness in fighting the firethey are included in the event trees of Figures 2 and 3.
As mentioned in the methodology section, the study included initial event trees for "Airship Initiated Fire Risks in the Hangar" and "Short Term Special Event Fire Risks in the Hangar." Those initial event trees are not shown in this paper, but they both had "Major fire in Hangar 1" sequences with "May Occur" likelihoods. The "Major fire in Hangar 1" sequences from all three initial event trees feed the event trees of Figures 2 and 3.

RENOVATED HANGAR 1 WITHOUT ANY SPECIAL HAZARD FIRE SUPPRESSION SYSTEMS
This section assesses the first option in the trade study. Here it is assumed that the proposed renovated Hangar 1 will not have any Special Hazard Fire Suppression System like hangar floor sprinklers or under wing deluge system.
The event tree in Figure 2 represents event sequences in this trade study option that could lead to fire damage of Hangar 1 where the initiating event is a "Major fire in Hangar 1." The likelihood of this initiating event was assessed to be as "May Occur" in the life of the hangar from an assessment of the three event trees as described in the previous section.
The first branch that occurs in the event tree is fire detection. One can get to this state with a locally undetected fire (event sequence #3, Figure 1). Hence, this fire detection event is different from the local fire detection event in the initial event tree of Figure 1. Once the fire grows big enough it can be detected outside the aircraft by the hangar fire detection system. It was assessed that there is a high probability that a major fire in the hangar would be successfully detected by the new fire detection/alarm system, conversely it was assessed that there is a low probability that fire detection would fail.
No branching occurs at the second branch since there is no Special Hazard Fire Suppression System.
At the third branch, if the fire is detected the alarm is setoff and the ARC Emergency Dispatch Center is notified. Since the ARC fire station is very close to Hangar 1, the response (if ARC Fire Department resources are in quarters and not assigned to another emergency incident) should be immediate and the team assessed that fire fighting should be effective with a high probability occurrence; and only with a low probability that fire fighting would be ineffective.
In the upper part of the event tree ( Figure 2), a major fire occurrence with effective fire fighting (event sequence #1) was assessed to result in "Major damage" as a consequence with likelihood that it "May Occur" in the life of the hangar. A major fire with ineffective fire fighting (event sequence #2) was assessed to result in "Critical Damage" as a consequence with a likelihood of "Unlikely" to occur in the life of the hangar. In the lower part of the event tree, if the major fire is  detected automatically, it eventually will get detected by personnel and the fire station notified. However, the notification is relatively late in this case (as compared to when the fire is automatically detected and the fire station is automatically notified). So in this case late effective fire fighting results in "Critical Damage" (event sequence #3). Otherwise ineffective fire fighting (event sequence #4) would result in "Catastrophic Damage" to the hangar, which was judged to have an "Improbable" likelihood of occurrence in the life of the hangar.
The resulting consequence / likelihood of these accident sequence scenarios are shown in the risk matrix of Figure 4.

RENOVATED HANGAR 1 WITH SPECIAL HAZARD FIRE SUPPRESSION SYSTEMS
This section assesses the second option in the trade study. Here it is assumed that the proposed renovated Hangar 1 has a Special Hazard Fire Suppression System. The event tree is shown in Figure 3.
The initiating event (a major fire in hangar) in this event tree represents the same initiating event used in the previous event tree (Figure 2). The first pivotal event is fire detection and it is the same in both event trees.
The second pivotal event is different in the two event trees because of inclusion of the Special Hazard Fire Suppression System. In this event branch, if the fire suppression system is effective (event sequence #1, Figure 3), it results in "Minor Damage" to the hangar with a "May Occur" likelihood of occurrence in the life of the hangar. The probabilities are obtained from one of the major assumptions in section 2.
If the fire suppression system is not effective, fire fighting efforts (event sequence #2, Figure 3) were judged to have a high probability of limiting the fire damage. This pivotal event is the same as in Figure 2. Event sequences 2 and 3 are assessed to have "Major damage" and "Critical damage," respectively -just like in Figure 2. These event sequences also occur with the same likelihood, the reason being that the probabilities are reduced by a factor of two but not by an order of magnitude. When fire is not detected automatically, the lower part of the event tree of Figure 3, the accident sequences are identical to previous event tree of Figure 2.
The resulting consequence likelihood of these accident sequence scenarios are shown in the risk matrix of Figure 4.  Figure 4. In essence, this risk matrix only shows the largest risk boundary.
Examination of the risk matrix shows that there is very little difference between the two options in terms of their highest severity risk category -they are both yellow reflecting a medium level of risk. Therefore, installation of a Special Hazard Fire Suppression System does not appear to reduce the risk category of a major fire in the hangar. In most ARC applications, this risk can be accepted by a project/facility with suitable examination of the accident sequences and their risk management plan. Sensitivity analysis on the major assumptions showed only small differences with no change in the overall result.
The risk assessment process was very useful in discussing the important issues between the Facilities Engineering Division, Fire Protection Office, and the Safety and Mission Assurance Directorate. The assessed risks were communicated using the risk matrix to upper management. After internal State Historic Preservation Office. It was accepted by the review, the risk assessment was provided to the California California State Historic Preservation Officer.