ML071630478

EGR-NGGC-0102, Rev 6, Safe Shutdown/Fire Protection Review. 05/21/2007 Clarification Phone Call Regarding Pilot Plant (Shearon Harris) Transition to NFPA 805

ML071630478
Person / Time
Site:	Harris
Issue date:	05/21/2007
From:	Nuclear Generation Group, Progress Energy Co
To:	Office of Nuclear Reactor Regulation
References
EGR-NGGC-0102, Rev 6
Download: ML071630478 (92)

Text

R Reference Use NUCLEAR GENERATION GROUP STANDARD PROCEDURE VOLUME 99 BOOK/PART 99 EGR-NGGC-0102 SAFE SHUTDOWN/FIRE PROTECTION REVIEW REVISION 6 EGR-NGGC-0102 Rev. 6 Page 1 of 92

TABLE OF CONTENTS SECTION PAGE 1.0 PURPOSE ...................................................................................................... 4

2.0 REFERENCES

.................................................................................................... 4 3.0 DEFINITIONS...................................................................................................... 5 4.0 RESPONSIBILITIES ........................................................................................... 5 4.1 Safe Shutdown Reviewer........................................................................... 5 4.2 Fire Protection Engineer ............................................................................ 5 5.0 PREREQUISITES ............................................................................................... 5 6.0 PRECAUTIONS AND LIMITATIONS .................................................................. 6 7.0 SPECIAL TOOLS AND EQUIPMENT ................................................................. 6 8.0 ACCEPTANCE CRITERIA .................................................................................. 6 9.0 INSTRUCTIONS ................................................................................................. 6 9.1 General..................................................................................................... 6 9.1.1 Safety Shutdown Analysis ............................................................ 6 9.1.2 Fire Protection Analysis ................................................................ 7 9.2 Safe Shutdown Review Considerations.................................................... 8 9.2.1 Re-Fire or Post-Fire Rackout or Manual Operations .................... 8 9.2.2 Deletion of Safe Shutdown Equipment....................................... 10 9.2.3 Addition of New Manual SSD Equipment ................................... 11 9.2.4 Addition or Revision of Safe Shutdown Equipment .................... 11 9.2.5 Addition or Revision of Associated Circuits ................................ 13 9.2.6 Plant Communications ............................................................... 15 9.2.7 Emergency Lighting .................................................................... 16 9.3 Fire Protection Review Considerations................................................... 16 9.3.1 Water Suppression Systems ...................................................... 16 9.3.2 Gaseous Suppression Systems.................................................. 17 9.3.3 Fire Detection Systems............................................................... 17 9.3.4 Fire Barriers ................................................................................ 18 9.3.5 Heat Spread Control and Fuel Spread Limiters.......................... 18 9.3.6 Fixed Combustible Loading ........................................................ 19 9.3.7 Plant Access............................................................................... 19 9.3.8 Manual Fire Suppression Equipment.......................................... 20 10.0 RECORDS .................................................................................................... 20 ATTACHMENTS 1 Safe Shutdown Review Summary Form............................................................ 21 2 Fire Protection Review Summary Form............................................................. 23 3 Progress Energy Manual Action Feasibility Assessment Criteria ...................... 49 4 Progress Energy Fire Safe Shutdown Circuit Analysis Position ........................ 67 FIGURES 1 Safe Shutdown Flow Chart.. 25 2 Pre- or Post-Fire Deenergization or Manual Operations 26 3 Deletion of Safe Shutdown Equipment. 27 EGR-NGGC-0102 Rev. 6 Page 2 of 92

TABLE OF CONTENTS SECTION PAGE 4 New Safe Shutdown Manual Components... 29 5 Addition or Revision of Safe Shutdown Equipment.31 6 Addition or Revision of Associated Circuits ...32 7 Plant Communication System. 34 8 Emergency Lighting.. 35 9 Fire Protection Flow Chart.. 36 10 Fire Protection Water System 37 11 Fire Protection Gaseous Systems..39 12 Fire Protection - Fire Detection Systems..41 13 Fire Protection - Fire Barriers. 43 14 Fire Protection - Heat Spread Control and Fuel Spread Limiters 45 15 Fire Protection - Fixed Combustible Loading.. 46 16 Fire Protection - Plant Access....47 17 Fire Protection - Manual Fire Suppression Equipment.. 48 REVISION

SUMMARY

.................................................................................................. 90 EGR-NGGC-0102 Rev. 6 Page 3 of 92

1.0 PURPOSE 1.1 The purpose of this procedure is to provide the review methodology associated with maintenance of the long-term control of the Fire Protection (FP) and Safe Shutdown (SSD) programs. This assures that changes to the plant configurations are reviewed for compliance to the applicable requirements of 10CFR50, Appendix R, NUREG-0800, Section 9.5.1, Branch Technical Position CMEB 9.5-1, Appendix A and Branch Technical Position APCSB 9.5-1, Appendix A and applicable plant commitments. The requirements of Appendix R and NUREG-0800, Section 9.5.1 are similar and this procedure will refer to Appendix R as a Formatted: Indent: Left: 0.5", First point of reference. line: 0", Numbered + Level: 1 +

Numbering Style: 1, 2, 3, + Start at: 3 + Alignment: Left + Aligned at:

1.2 Progress Energy is in the process of revising the Fire Protection licensing 0.88" + Tab after: 0" + Indent at:

1.13" basis for each of the NGG plants to adopt the performance-based Formatted: Indent: Left: 0.5", First methods provided for in the NFPA 805 Standard. Adoption of this line: 0", Numbered + Level: 1 +

Standard as part of each plants Fire Protection Program to demonstrate Numbering Style: 1, 2, 3, + Start compliance with NRC requirements is allowed under 10CFR50.48(c), and at: 3 + Alignment: Left + Aligned at:

0.88" + Tab after: 0" + Indent at:

provides additional options to complying with fire protection regulations 1.13" and requirements under 10CFR50.48. The scheduled dates for Formatted: Indent: Left: 0.5",

submitting license amendment requests are identified in the NGG Fire Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start Protection Program Improvements Initiatives Project Plan. at: 3 + Alignment: Left + Aligned at:

0.88" + Tab after: 0" + Indent at:

1.13"

2.0 REFERENCES

Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1 2.1 Code of Federal Regulations + Numbering Style: 1, 2, 3, + Start A. 10CFR50.48 at: 3 + Alignment: Left + Aligned at:

0.88" + Tab after: 0" + Indent at:

B. 10CFR50 Appendix R 1.13" Formatted: Indent: Left: 0.5",

2.2 NUREG-0800, Section 9.5.1 Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start at: 3 + Alignment: Left + Aligned at:

2.3 Branch Technical Position CMEB 9.5-1,Appendix A 0.88" + Tab after: 0" + Indent at:

1.13" 2.4 FIR-NGGC-0001, Fire Detection Systems Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start 2.5 FIR-NGGC-0004, Determination of Combustible Loading and Equivalent at: 3 + Alignment: Left + Aligned at:

Fire Severity 0.88" + Tab after: 0" + Indent at:

1.13" Formatted: Indent: Left: 0.5",

2.6 FIR-NGGC-0005, Fire Door and Frame Repair Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start at: 3 + Alignment: Left + Aligned at:

2.7 Branch Technical Position APCSB 9.5-1, Appendix A 0.88" + Tab after: 0" + Indent at:

1.13" 2.8 EGR-NGGC-0003, Design Review Requirements Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start 2.9 EGR-NGGC-0005, Engineering Change at: 3 + Alignment: Left + Aligned at:

0.88" + Tab after: 0" + Indent at:

1.13" 2.10 CP-252, Commitment Management Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1 2.11 NEP-218, Fire Protection and Appendix R Safe Shutdown Capability + Numbering Style: 1, 2, 3, + Start Design Considerations at: 3 + Alignment: Left + Aligned at:

0.88" + Tab after: 0" + Indent at:

1.13" EGR-NGGC-0102 Rev. 6 Page 4 of 92

2.12 0PLP-01.1, Fire Protection Commitment Document Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1

+ Numbering Style: 1, 2, 3, + Start 2.13 Action Requests: at: 3 + Alignment: Left + Aligned at:

1. 111308-17 0.88" + Tab after: 0" + Indent at:

1.13"

2. 80340-29 Formatted: Indent: Left: 0.5",

3. 136517-10 Hanging: 0.5", Numbered + Level: 1

4. 148225-18 + Numbering Style: 1, 2, 3, + Start at: 3 + Alignment: Left + Aligned at:

5. 149509-12 0.88" + Tab after: 0" + Indent at:

6. 103982 1.13" 2.14 NFPA 805, Performance-Based Standard for Fire Protection for Light Formatted: Indent: Left: 0.5",

Hanging: 0.5", Numbered + Level: 1 Water Reactor Electric Generating Plants, 2001 Edition + Numbering Style: 1, 2, 3, + Start at: 3 + Alignment: Left + Aligned at:

2.15 NEI 00-01, Guidance for Post-Fire Safe Shutdown Circuit Analysis, 0.88" + Tab after: 0" + Indent at:

1.13" Revision 1 2.16 PM-175, Fire Door Maintenance (CR3 only) 2.17 Project Plan for NGG Fire Protection Improvement Initiatives, Revision 1, dated 10/24/05 3.0 DEFINITIONS N/A 4.0 RESPONSIBILITIES 4.1 Safe Shutdown Reviewer The Safe Shutdown Reviewer is responsible for ensuring the safe shutdown program documentation is being maintained through the review of plant changes. The Safe Shutdown/Appendix R reviews should be performed in accordance with the methodology of this procedure.

4.2 Fire Protection Engineer The Fire Protection Engineer is responsible for ensuring the fire protection program documentation is being maintained through the review of plant changes. The Fire Protection reviews should be performed in accordance with the methodology of this procedure.

5.0 PREREQUISITIES N/A EGR-NGGC-0102 Rev. 6 Page 5 of 92

6.0 PRECAUTIONS AND LIMITATIONS 6.1 If the use of NFPA 805 in any Fire Protection Program change is considered, as discussed in Section 1.2, prior to a plants transition to NFPA 805 being completed, the item under consideration needs to be entered into the CAP.

7.0 SPECIAL TOOLS AND EQUIPMENT N/A 8.0 ACCEPTANCE CRITERIA N/A 9.0 INSTRUCTIONS 9.1 General This procedure has been divided into two areas of responsibility;

- Safe Shutdown reviews

- Fire Protection reviews The appropriate sections must be utilized depending on the type of review being performed.

As addressed in Section 1.2, the Progress Energy NGG fleet is in the process of revising the Fire Protection licensing basis to adopt NFPA 805.

Until this licensing change process is complete, changes to the current licensing basis (CLB) should consider the potential impact and/or benefits of using the methods provided for in NFPA 805 during the review of major changes to the Fire Protection Program.

9.1.1 Safe Shutdown Analysis The Safe Shutdown Analysis Documentation for each plant provides a detailed description of the assumptions, definitions, shutdown methodologies and analysis processes. The Safe Shutdown Analysis Documentation must be utilized in performing safe shutdown assessments of plant changes.

Section 9.2 presents a detailed point-by-point evaluation of the impact of a plant change on the safe shutdown capability.

For plant changes which require a Safe Shutdown Review, the reviewer(s) shall start with the Safe Shutdown Flow Chart (Figure 1). Answers to review questions can be documented on the Safe Shutdown Review Summary Form (Attachment 1) as they move down the steps of the Flow Chart. If any questions on the Review Summary Form are answered "yes," indicating a potential EGR-NGGC-0102 Rev. 6 Page 6 of 92

Safe Shutdown compliance impact, the reviewer shall evaluate the potential effects as required, including any recommended actions.

If additional input is required from other disciplines, including Fire Protection, this input should be requested in accordance with established procedures (e.g. modification procedures). Inclusion of the Safe Shutdown Review Summary Form in the completed documentation is only necessary as may be required by EGR-NGGC-0003 (Design Review Requirements),EGR-NGGC-0005 (Engineering Change), or NEP-218 (Fire Protection and Appendix R Safe Shutdown Capability Design Considerations (CR-3))

depending on the reason for the review.

Attachments 3 and 4 to this procedure provide Progress Energy positions relative to Manual Action Feasibility Criteria and Fire Induced Circuit Failures, respectively. These positions form the basis of Progress Energys SSA re-validation projects that commenced in 2003. Revisions of each sites SSA analysis shall implement these positions.

9.1.2 Fire Protection Analysis The Fire Protection Analysis Documentation contains evaluations of the adequacy of active and passive fire protection features as required to ensure the viability of the post-fire shutdown capability.

Passive fire protection features subject to impact review include:

Fire barriers with particular concern for any modification Formatted: Indent: Left: 1.5",

instructions requiring penetration of a fire barrier or decreasing Hanging: 0.38", Bulleted + Level: 1

+ Aligned at: 1.5" + Tab after: 0" +

the barriers performance. Indent at: 1.75" Combustible loading, although not a fire protection feature, is reviewed to the extent that significant additional combustible loading introduced into an area by installation of new equipment is assessed to determine impact, if any, on fire barrier adequacy. This includes evaluating fire potential, severity and spread.

Active fire protection features subject to impact review include:

Fire detection Formatted: Indent: Left: 1.5",

Hanging: 0.38", Bulleted + Level: 1

+ Aligned at: 1.5" + Tab after: 0" +

Fire suppression (fixed and manual) Indent at: 1.75" Formatted: Indent: Left: 1.5",

Impact reviews of active features consider not only changes (e.g., Hanging: 0.38", Bulleted + Level: 1 revisions, temporary changes, removal) to the subject equipment, + Aligned at: 1.5" + Tab after: 0" +

Indent at: 1.75" but the installation of equipment or barriers that could impact the performance of these systems.

Section 9.3 presents a detailed point-by-point evaluation of the impact of a plant change on the passive and active fire protection features.

EGR-NGGC-0102 Rev. 6 Page 7 of 92

For plant changes which require a Fire Protection Review, the reviewer(s) shall start with the Fire Protection Flow Chart (Figure 9). Answers to review questions can be documented on the Fire Protection Review Summary Form (Attachment 2) as they move down the steps of the Flow Chart. If any questions on the Review Summary Form are answered "yes," indicating a potential Fire Protection compliance impact, the reviewer shall evaluate the potential effects as required, including any recommended actions.

If additional input is required from other disciplines, this input should be requested in accordance with established procedures (e.g. modification procedures). Inclusion of Fire Protection Review Summary Form in the completed documentation is only necessary as may be required by EGR-NGGC-0003 (Design Review Requirements), EGR-NGGC-0005 (Engineering Change), or NEP-218 (Fire Protection and Appendix R Safe Shutdown Capability Design Considerations (CR-3)) depending on the reason for the review.

9.2 SAFE SHUTDOWN REVIEW CONSIDERATIONS (FIGURE 1)

This section has been developed to facilitate a review of plant changes to determine the impact on Safe Shutdown compliance. The Safe Shutdown review is performed in accordance with the steps outlined in the Safe Shutdown Flow Charts in Figures 1 through 8. The intent is to lead the reviewer through all applicable concerns as quickly and efficiently as possible. To support this intent, the review process uses flow charts with detailed explanations of each step.

The review format consists of a Safe Shutdown Flow Chart (Figure 1) which identifies the areas of consideration for each review. The reviewer starts with the Safe Shutdown Flow Chart and, by answering questions and performing stated activities, is guided through the procedure.

Upon completion of the steps identified by the flow chart, the reviewer(s) should complete the appropriate Review Summary Form as shown in Attachment 1. These forms serve to document that the review of the plant change has been completed and the results of the review.

In the event an Appendix R/NUREG-0800 compliance issue is identified for a plant change, the form provides a mechanism for feedback of the information to the requestor. In this way, the issue can be resolved prior to completion of the plant change.

If during the process of performing this review, any deviation from the process provided in the Figures 1 - 8 should be noted on Attachment 1.

9.2.1 Pre-Fire or Post-Fire Rackout or Manual Operations (Figure 2)

1. Some Appendix R strategies include pre-fire opening of a breaker, post-fire opening of a breaker, or post-fire manual operation of a component. It is not necessary, then, to protect the cables or devices for the components that fall within these options.

EGR-NGGC-0102 Rev. 6 Page 8 of 92

9.2.1 Pre-Fire or Post-Fire Rackout or Manual Operations (Figure 2)

Pre-fire opening of a breaker means that these breakers are left open (racked out) during normal operation. In this way, the component cannot spuriously actuate during any given fire.

Components subject to pre-fire de-energization are specifically noted in the Safe Shutdown Analysis or Component Index.

2. Post-fire opening of a breaker indicates that the component must be operable for normal operation but not during post-fire shutdown, during which post-fire shutdown operating procedures are invoked. Once it is determined that a fire could jeopardize SSD equipment, these breakers will be opened to prevent spurious operation. Components subject to post-fire de-energization are also specifically noted in the Safe Shutdown Analysis or Component Index.

Assuming that the change does not alter the design performance of the system, both the pre-fire and post-fire opening of these breakers resolves the Appendix R concerns for safe shutdown.

3. Manual operations of given components in the event of fire damage to their electrical cables, devices, or power supplies has been evaluated on a fire area basis. Components requiring manual operation in the event of a fire in a specific area are identified in the post-fire shutdown operating procedures, Safe Shutdown Analysis or Component Index.

4. If any equipment subject to manual operation is added or deleted, or if access pathways to existing manually-operated components are modified or impeded, the manpower and operational impact must be considered and the post-fire shutdown operating procedures must be revised as required.

Changes in the rackout status also requires operational consideration and appropriate shutdown operating procedures revised as required. Refer to Figure 2 to review the pertinent questions for pre-fire or post-fire rackout or manual operation.

NOTE: Manual Actions taken as a compensatory action under the corrective action program (i.e.: an immediate corrective action) are allowed, provided they meet the feasibility criteria of Attachment 3, Progress Energy position relative to Manual Action Feasibility Criteria, until an appropriate design/licensing basis resolution can be implemented.

5. New manual actions required to meet Appendix R III.G.2 are not allowed without prior NRC approval. Other options to meet Appendix R III.G.2 shall be pursued before manual actions are considered.

EGR-NGGC-0102 Rev. 6 Page 9 of 92

9.2.2 Deletion of Safe Shutdown Equipment (Figure 3)

The deletion of safe shutdown equipment involves the complete removal of a safe shutdown primary component. If there is only a partial deletion (i.e., cable), the plant change will be considered a revision to safe shutdown equipment and is covered in Section 9.2.4.

Safe shutdown equipment is determined by reviewing the Safe Shutdown Analysis Drawings (flow diagrams) and/or other appropriate SSA references. If the plant change deletes any of the components shown and is in a primary flow or boundary path, the only affect on the Safe Shutdown analysis is a documentation change. However, if the deleted component is established boundary isolation, a new boundary must be determined. The new boundary may extend to or through an electrically-operated component or change the category of an existing component. In either case, a circuit and cable routing analysis must be performed.

These changes will be considered a revision to the safe shutdown equipment (Refer to Section 9.2.4, Addition or Revision of Safe Shutdown Equipment).

If the plant change is deleting a component which is being used to control system operation (e.g., throttle valve or process monitoring instrumentation), the effects on safe shutdown must be evaluated.

This type of change may affect the operation of safe shutdown systems.

The post-fire shutdown operating procedures and test procedures (associated with alternate shutdown capability) shall be reviewed and recommended revisions marked-up where appropriate. Refer to Figure 3 to review the pertinent questions for deletion of safe shutdown equipment.

9.2.3 Addition of New Manual Safe Shutdown Equipment (Figure 4)

The addition of a manual safe shutdown (SSD) primary component could have varying degrees of impact on Appendix R compliance.

The location of this new component can be divided into two basic types: (1) in the flow or boundary path or (2) in a branch to a flow or boundary path.

The addition of a manual component in the boundary or flow path will require only an update of the controlled Appendix R documents to reflect its addition. However, if the manual component is to be closed in the primary flow path, it would affect the design performance of the safe shutdown function and must be evaluated.

EGR-NGGC-0102 Rev. 6 Page 10 of 92

9.2.3 Addition of New Manual Safe Shutdown Equipment (Figure 4)

Branch connections present more of a concern since they may effectively extend the boundary of the primary flow path. An evaluation should be done on all new branches to determine if further Appendix R concerns are involved. If the evaluation indicates that the integrity of the system would be affected by this new component, a new boundary must be established. If the new component is normally closed and not subject to potential spurious operation, this effort will simply be a document revision. However, a branch line change that contains a normally open component or a component subject to potential spurious operation, which could affect the integrity of the system requires the establishment of a new boundary.

This new boundary might extend to or through an electrically operated component or change the category of an existing SSD component. In either case, a circuit and cable routing analysis must be performed.

The post-fire shutdown operating procedures and test procedures (associated with alternate shutdown capability) shall be reviewed and recommended revisions marked-up where appropriate. Refer to Figure 4 to review the pertinent questions for addition of new manual safe shutdown equipment.

9.2.4 Addition or Revision of Safe Shutdown Equipment (Figure 5)

Most design changes affecting safe shutdown equipment fall into this section. The initial method of analysis to derive the safe shutdown equipment is presented in this procedure. Through this review process, it can be determined which plant changes add or revise safe shutdown equipment and the effects, if any, on the safe shutdown analyses. This process first determines how the equipment is required to support the performance of the affected system. This information is then used to identify the electrical cables and support equipment that must be operable for the equipment to operate as required.

During the initial analysis, the location of all safe shutdown equipment was determined and the Appendix R,Section III.G separation criteria applied. The results of this analysis established unique trains to achieve safe shutdown for each fire area.

Separation between these unique trains must be maintained in plant changes. The specific safe shutdown train to be used for each specific fire area is identified in the Safe Shutdown Analysis.

EGR-NGGC-0102 Rev. 6 Page 11 of 92

9.2.4 Addition or Revision of Safe Shutdown Equipment (Figure 5)

These trains by fire area represent the train required to be used to achieve and maintain safe shutdown given a fire in that area.

Therefore, any components for the corresponding train located in that area must be evaluated for its impact on the safe shutdown capability.

In addition, the affects on the basis, inputs, assumptions, or results of SSD specific calculations such as those performed to address room heat up or to demonstrate assess thermo-hydraulics for SSD required plant system lineups need to be considered. These calculations were developed to demonstrate that plant systems can function to meet SSD performance objectives when the system operation is limited to SSD equipment.

Separation Zones, that restricts combustibles in designated locations, have been utilized in certain designs to provide separation in lieu of 3-hour barriers. These zones are unique to the plant configuration and must be reviewed in detail if the plant change affects components in or near the separation zone boundaries. The Safe Shutdown Analysis Documentation provides the location of these zones. Each zone configuration may be different, requiring research into the exemption basis and NRC Safety Evaluation Reports.

If safe shutdown train separation cannot be achieved by the above methods, the following are options for resolution of the separation discrepancy:

• Provide alternative capability for the affected zone (i.e.,

manual or local operation). This will require coordination with Operations to ensure that manual or local operation is acceptable, and will require revision of the post-fire shutdown procedures.

• Enclose the equipment in the affected fire area in a three-hour-rated barrier.

• Wrap the equipment in the affected fire area in a one-hour-rated barrier and ensure that there is adequate suppression and detection in the fire area.

• Submit to the NRC a request for an exemption from Appendix R or deviation from NUREG-0800.

The post-fire shutdown operating procedures and test procedures (associated with alternate shutdown capability) shall be reviewed and recommended revisions marked-up where appropriate. Refer to Figure 5 to review the pertinent questions for addition or revision of safe shutdown equipment.

EGR-NGGC-0102 Rev. 6 Page 12 of 92

9.2.5 Addition or Revision of Associated Circuits (Figure 6) 9.2.5.1 Circuits Associated by Common Power Supply Circuits associated by common power supply are non-safe shutdown circuits whose fire-induced failure could cause the loss of a power source (bus, distribution panel, or MCC) that is necessary to support safe shutdown.

This problem could exist for power, control, or instrumentation circuits. The problem of associated circuits of concern by common power supply is resolved by ensuring adequate electrical coordination (selective tripping) exists between the safe shutdown power source supply breaker and the component feeder breakers or fuses.

Coordination studies were developed to verify that under all abnormal conditions in an associated circuit, only the protective device immediately upstream of a fault or overload will operate. This coordination of protective devices will ensure that a fire-induced fault on an associated circuit will not prevent a safe shutdown circuit from performing its intended function.

These coordination studies analyzed the largest feeder protective device on each common power supply. Once coordination of this feeder with the upstream protective device(s) was established, it was assumed that all other feeder protective devices on the same common power supply were coordinated. Therefore, if the size/setting of the protective device for a 480 VAC, 120/208 VAC, or 125/250 VDC circuit being modified or added is less than the largest feeder protective device indicated in the applicable fault calculation/ coordination study, coordination with the upstream device is maintained. If, however, the size/setting of the protective device for the new or modified circuit equals or exceeds the value listed, reverification of circuit coordination will be required. Increases in available fault current can adversely affect coordination, e.g., addition of a large motor to a safe shutdown MCC.

The Associated Circuit Common Power Supply Analysis identifies the safe shutdown power supplies and the safe shutdown and non-safe shutdown loads. Addition of non-safe shutdown loads must be closely evaluated to ensure the effects of these additions do not adversely impact the existing coordination studies. Addition of safe shutdown loads onto new or existing power supplies will also EGR-NGGC-0102 Rev. 6 Page 13 of 92

9.2.5.1 Circuits Associated by Common Power Supply require detailed evaluation to ensure adequate protection is provided.

Also refer to the Safe Shutdown Analysis for alternative approaches utilized such as cable routing. Refer to Figure 6 to review the pertinent questions for addition or revision of associated circuits.

9.2.5.2 Circuits Associated by Common Enclosure Circuits can be associated by common enclosure in two ways. First, fire-induced damage to non-safe shutdown cables can create circuit faults in electrically unprotected cables. Such faults can be of sufficient magnitude to create secondary fires in the cables due to the fault currents. If such secondary fires were to occur in enclosures (raceways, panels, etc.) outside the fire area of concern, these fires could impact safe shutdown cables or equipment contained within this common enclosure. The reviewer must ensure that any cables which share a common enclosure with safe shutdown equipment have adequate electrical protection via circuit breakers, fuses or current-limiting devices which will prevent the occurrence of electrically induced secondary fires. This eliminates one possibility that associated circuits by common enclosure will affect safe shutdown.

The second common enclosure concern is that of fire propagating along intervening combustibles (i.e., cables) from one enclosure to a second enclosure containing redundant shutdown-related equipment. Such enclosures include sealed fire areas, as well as electrical raceways and cabinets. The concern of common raceways and cabinets has been resolved at RNP, in that Alternate A safe shutdown cables are routed only in dedicated raceways: i.e., Alternate A and B cables do not share common raceways or other electrical enclosures.

Furthermore, fires migrating out of individual electrical enclosures present no concern, in that rated penetration seals at fire area barriers prevent the direct propagation of the fire from one fire area to the next fire area, thus ensuring that redundant safe shutdown equipment enclosures (fire areas) remain independent. Refer to Figure 6 to review the pertinent questions for addition or revision of associated circuits.

EGR-NGGC-0102 Rev. 6 Page 14 of 92

9.2.5.3 Circuits Associated by Spurious Operation Potential Circuits associated due to spurious operation are those which can, by fire-induced failures, cause safe shutdown equipment or non-safe shutdown equipment to mal-operate in a way that defeats the function of safe shutdown systems or equipment. Examples include the uncontrolled opening or closing of valves, or of circuit breakers, due to fire-induced damage to non-safe shutdown instrument and control circuits which affect the control circuit interlocks of the components.

The components which present potential spurious operation concerns are identified in the Safe Shutdown Analysis or Component Index. Refer to Figure 6 to review the pertinent questions for addition or revision of associated circuits.

9.2.6 Plant Communications (Figure 7)

The plant communications system is vital to safe shutdown operations. Equipment operation from outside the Control Room requires coordination and timely operator actions following a fire.

This can only be accomplished with a reliable plant communications system.

BNP has installed two dedicated sound powered phone circuits to provide communication between the Reactor, Diesel, Service Water, and Control Buildings in the event a fire disables the existing system. A common circuit linking Unit 1 and Unit 2 Remote Shutdown Panels is also provided.

RNP utilizes portable radios for post-fire communication because of potential fire damage to other communication means.

HNP and CR3 utilize both portable radios and a sound powered phone system.

In the event a modification involves the installation of a new safe shutdown component which may require local manual operation during post-fire shutdown operations, then the communication capability must be verified from and to the new operating station.

Changes which could affect the sound power phone system must be evaluated to ensure that adequate communications will be maintained to safely shutdown the plant following a fire. Refer to Figure 7 to review the pertinent questions for plant communications.

EGR-NGGC-0102 Rev. 6 Page 15 of 92

9.2.7 Emergency Lighting (Figure 8)

Emergency lighting has been provided in all areas needed for operation of safe shutdown equipment and in access/egress routes thereto. Lights may be placed for area coverage or to illuminate a specific device needed for safe shutdown. The plant change must be evaluated for its potential impact on the intensity and coverage of the emergency lighting system. Refer to Figure 8 for review of pertinent questions with respect to changes in emergency lighting.

9.3 FIRE PROTECTION REVIEW CONSIDERATIONS (FIGURE 9)

This section has been developed to facilitate a review of plant changes to determine the impact on the Fire Protection Program. The Fire Protection review is performed in accordance with the Fire Protection Flow Chart Figures 9 through 17. The intent of the procedure is to lead the reviewer through all applicable concerns as quickly and efficiently as possible. To support this intent, the review uses flow charts with detailed explanations of each step.

To prevent the plant change from violating commitments associated with the specific fire protection features, each applicable change must be reviewed for its effects on fire fighting efforts, suppression/detection systems, fire barrier integrity, fire propagation control features, combustible loading, and plant access. This review should consider the impact on not only various plant fire protection documentation (e.g., plant drawings, sprinkler and combustible loading calculations), but must also consider the impact on compliance with applicable NFPA Codes and Design Basis Documents. The methodology to assess the impact of the plant change on these key elements is described by the following set of procedural steps and flow charts.

If during the process of performing this review, any deviation from the process provided in the Figures 9 - 17 should be noted on Attachment 2.

9.3.1 Water Suppression Systems (Figure 10)

This portion of the procedure addresses the potential impact a plant change may have upon a water suppression system. Water suppression is the most widely used and most reliable of the various methods. Included are wet pipe, dry pipe, deluge and preaction systems. Refer to Figure 10 to review the pertinent questions for water suppression systems.

EGR-NGGC-0102 Rev. 6 Page 16 of 92

9.3.2 Gaseous Suppression Systems (Figure 11)

Gaseous suppression systems are designed to promptly respond to a fire. It is necessary to confine the agent within its intended area to facilitate extinguishment, and provide "soak time" to prevent reignition. The systems required for containment of the agent (dampers, HVAC controls), add to the complexity of the system.

These requirements add to the scope of concern needed whenever plant changes are made in the area. Refer to Figure 11 to review the pertinent questions with respect to gaseous suppression systems.

9.3.3 Fire Detection Systems (Figure 12)

Equipment designed and installed for the detection of fire may be affected by a plant change in the areas of system components or the physical features of the protected zone.

Fire detection system components consist of the detectors (fixed temperature, thermal rate-of-rise; smoke-ionization and photo electric, infrared, ultraviolet or visible flame, etc.), all auxiliary equipment (power supplies, controls, annunciators, etc.) and interfaces to perform external functions upon activation. Reliance is placed upon the system to alert Control Room personnel to the fire and summon the fire brigade.

Various factors in the area of the detection system installation directly impact upon the systems ability to perform specified functions. Detectors must be configured to sense the presence of fire effects (heat, smoke or flame) as promptly as possible, unimpeded by structural or mechanical systems. Refer to Figure 12 to review the pertinent questions with respect to the fire detection systems and with respect to the fire area constraints.

Additional guidance is provided in FIR-NGGC-0001 (Reference 2.4).

EGR-NGGC-0102 Rev. 6 Page 17 of 92

9.3.4 Fire Barriers (Figure 13)

A plant change may affect the required integrity of a fire-rated barrier. The required fire rating of the barriers is dependent upon the fire severity in Btu/ft2 or equivalent fire severity (in minutes) to which the barrier is exposed.

Typically, characteristics of equivalent thickness of concrete, listed (testing laboratory) assemblies, heat transfer characteristics and accepted fire protection practices for protecting openings have been utilized in rating and justifying fire barriers. Changes to a tested/listed configuration will require further evaluation to ensure it meets the design intent of the fire barrier.

Specific actions are taken to slow the growth and spread of a fire in the most serious of hazards such as cable trays and flammable/combustible liquids systems. In planning a plant change, it is necessary to assure not only that the existing measures are not compromised, but to determine that the plant change is consistent with the existing measures.

Most cable insulation is of plastic or rubber formulation, and is subject to combustion. This insulation poses a major fire hazard, both to its surroundings and to the potential loss of power or signal being transmitted. To retard fire propagation, new cables installed must meet IEEE 383 or equivalent certification specifically approved for the site flame spread criteria, and existing cables in several critical plant areas for BNP and RNP have been coated with a flame-retardant mastic. Refer to Figure 13 to review pertinent questions with respect to fire barriers and cable insulation.

9.3.5 Heat Spread Control and Fuel Spread Limiters (Figure 14)

The transfer of heat beyond the vicinity of the initial fire may be controlled by area boundaries such as fire-rated walls and doors or flame impingement shields.

Various methods (e.g., curbs, dikes, drains) are used to control flammable and combustible liquids to prevent fire propagation.

Care must be taken to assure the integrity of all these measures are maintained during the plant change process. Refer to Figure 14 to review pertinent questions with respect to control of flammable and combustible liquids and with respect to the control of heat spread.

EGR-NGGC-0102 Rev. 6 Page 18 of 92

9.3.6 Fixed Combustible Loading (Figure 15)

Fixed combustibles are those materials subject to combustion which are in-situ within a fire area. Transient combustibles are those which are placed in an area temporarily, such as supplies needed during maintenance. This section will assist in determining if there will be an increase in fixed combustible loading as a result of the plant change. The quantity of fixed combustibles has been calculated in detail. It is necessary to keep this data updated if the area fire loading changes, particularly since fire barrier requirements and ratings are based upon this information. Refer to Figure 15 to review pertinent questions with respect to changes in fire loadings. Additional guidance is provided in FIR-NGGC-0004 (Reference 2.5).

9.3.7 Plant Access (Figure 16)

The ability to gain access to the fire incident and either automatic or manual suppression equipment is basic to the fire fighting effort.

The ability to reach the fire area by one or a combination of access routes can weigh heavily on the fire ground tactics and strategies.

Access to certain areas is also required for post-fire operations.

The Emergency Lighting drawings which reflect the access paths to and from the safe shutdown equipment should be utilized to determine potential impact. Refer to Figure 16 to review pertinent questions with respect to changes in plant access.

This section also addresses air flow within an area or from the affected area to an area which could impact on smoke, heat and fire spread within a structure. Maintaining the integrity of a safe ventilation path allows tenable access to the root of the fire for prompt extinguishment as well as preventing exposure of redundant safe shutdown components from hot gases during the fire. The redirection of air flow and/or its increase or decrease (CFM) may affect the fire spread and safe ventilation paths.

Typical plant changes such as installation/deletion or change in size of ventilation dampers, wall openings, floor/ceiling openings, or large ceiling beams should be reviewed with respect to air flow changes. Refer to Figure 16 to review pertinent questions with respect to ventilation effects.

EGR-NGGC-0102 Rev. 6 Page 19 of 92

9.3.8 Manual Fire Suppression Equipment (Figure 17)

Manual fire suppression equipment includes hose stations, hydrants and houses, and portable fire extinguishers. The specified capabilities of these systems are predicated upon the hazard protection and the anticipated tactics to be utilized in the fire fighting evolution. Refer to Figure 17 to review pertinent questions with respect to manual fire suppression equipment.

10.0 RECORDS No records are generated specifically from the performance of this procedure.

Documentation of the Safe Shutdown and Fire Protection reviews is per the requirements of EGR-NGGC-0003 (Design Review Requirements) and EGR-NGGC-0005 (Engineering Change), or NEP-218 (Fire Protection and Appendix R Safe Shutdown Design Considerations) for CR3.

EGR-NGGC-0102 Rev. 6 Page 20 of 92

ATTACHMENT 1 Sheet 1 of 2 Safe Shutdown Review Summary Form DOCUMENT NO.: REVISION:

DOCUMENT TITLE:

1.0 SAFE SHUTDOWN CAPABILITY IMPACT REVIEW Yes No 1.1 Does the change affect safe-shutdown (SSD) flow diagrams or components?

1.2 Does the change affect performance requirement of a safe-shutdown function?

1.3 Does the change affect pre- or post fire rackout or manual operation of safe-shutdown components?

a. Existing Actions

b. Additional Actions

c. Delete Existing Actions 1.4 Does the change delete SSD components?

1.5 Does the change add new manual SSD components?

1.6 Does the change add or revise SSD components?

1.7 Does the change affect associated circuits?

1.8 Does the change affect plant radio communications?

1.9 Does the change affect existing emergency lighting or establish the need for new emergency lighting?

1.10 Does the change affect inputs or results of SSD specific calculations such as those performed to address room heat up or to demonstrate assess thermo-hydraulics for SSD required plant system lineups?

1.11 Does the change need to consider the potential benefits, or impact, of utilizing NFPA 805 methodology?

Note: Items 1.10 and 1.11 are not currently shown on Figure 1.

EGR-NGGC-0102 Rev. 6 Page 21 of 92

ATTACHMENT 1 Sheet 2 of 2 Safe Shutdown Review Summary Form 2.0 DISPOSITION A. Does the change adversely affect the Safe Shutdown Capability?

B. Does the change affect Safe Shutdown documentation which requires revisions?

C. Are Permanent New Manual Action(s) required?

Safe Shutdown Reviewer Date EGR-NGGC-0102 Rev. 6 Page 22 of 92

ATTACHMENT 2 Sheet 1 of 2 Fire Protection Review Summary Form DOCUMENT NO.: REVISION:

DOCUMENT TITLE:

1.0 FIRE PROTECTION IMPACT REVIEW Yes No 1.1 Fixed Suppression Systems

a. Does design change affect a water suppression system?

b. Does design change affect a gaseous suppression system?

1.2 Fire Detection Systems

a. Does design change affect fire detection system components?

b. Does design change affect structural/air flow features that may deflect heat/smoke flow away from detectors?

1.3 Fire Barriers Does design change require breaching or modifying any fire barriers?

1.4 Fire Propagation Retardants

a. Does the design add non-IEEE cables?

b. Does design change affect flame impingement shields, curbs, dikes, or drains?

1.5 Fixed Combustible Loading Does design change introduce new or remove combustible material or equipment containing combustible lubricants?

EGR-NGGC-0102 Rev. 6 Page 23 of 92

ATTACHMENT 2 Sheet 2 of 2 Fire Protection Review Summary Form Yes No 1.6 Plant Access Does design change affect plant accessibility for fire fighting efforts or post-fire shutdown operations (including building access:

location of walls, doors, changing of door status from normally unlocked to normally locked; and ventilation air flows: impact on fire-fighting access)?

1.7 Manual Fire Suppression Equipment Does design change affect the location or type of manual fire suppression equipment?

1.8 Does the change need to consider the potential benefits, or impact, of utilizing NFPA 805 methodology?

Note: Item 1.8 is not currently shown on Figure 9.

2.0 DISPOSITION A. Does the plant change adversely affect the Fire Protection Program?

Recommended actions are identified on the attached sheet(s).

B. Does the plant change affect Fire Protection documentation which requires revisions? Fire Protection document changes reflected on the attached sheet(s).

FIRE PROTECTION ENGINEER DATE EGR-NGGC-0102 Rev. 6 Page 24 of 92

FIGURE 1SAFE SHUTDOWN FLOW CHART EXPLANATION FLOW CHART

1. The review procedure will be utilized to evaluate the impact on START Safe Shutdown Compliance.

2. By reviewing the Safe Shutdown Flow Diagrams and the Safe IS AN SSD NO Shutdown Analysis or Component Index, determine whether the FLOW DIAGRAM OR COMPONENT change will involve any safe-shutdown equipment. If it does, go AFFECTED to 3, else 10 below.

YES

3. Review the methodology presented in this procedure to derive REVIEW Formatted: Bullets and Numbering the background required to assess the change in accordance SAFE SHUTDOWN METHODOLOGY with safe shutdown separation. This section will form the basis for further considerations. Go to 4 below.

4. Determine if the proposed change will adversely affect the DOES THE performance capabilities of the shutdown function. If it does, COORDINATE CHANGE WITH CHANGE ALTER THE PERFORMANCE coordinate the change with the appropriate discipline to APPROPRIATE YES REQUIREMENTS OF A SHUTDOWN establish the affects and further considerations to be addressed DISCIPLINE INPUT FUNCTION then return to 1 above, else 5 below.

NO

5. Some safe shutdown separation deviations have been resolved DETERMINE IF THE by racking out the breaker (or equivalent) for the component AFFECTED COMPONENT IS GO TO (pre- or post-fire) or by crediting manual operation of the A PRE OR POST FIRE RACK-OUT OR A MANUAL "A"

component. Go to A and determine if the design change OPERATION affects these components: return at T.

T Ref: Section 9.2.1, Figure 2

6. If the change completely deletes safe-shutdown primary DOES THE CHANGE GO TO components, determine the design change effects by going to DELETE SSD YES "B"

COMPONENT B and return at U, else 7 below.

U NO Ref: Section 9.2.2, Figure 3 DOES THE

7. If the change is adding new manual safe-shutdown CHANGE ADD NEW YES GO TO components, go to C and return at V, else 8 below. MANUAL SSD EQUIPMENT "C"

Ref: Section 9.23, Figure 4 V NO

8. If the change adds safe-shutdown equipment other than manual or revises other safe-shutdown equipment, go to D DOES THE CHANGE ADD GO TO YES and return at W, else 9 below. OR REVISE SSD EQUIPMENT "D"

Ref: Section 9.2.4, Figure 5 NO W

9. Associated circuit effects (common power supply and common DETERMINE IF THE GO TO CHANGE AFFECTS enclosure) must be evaluated. Go to E and return at X. ASSOCIATED "E" CIRCUITS X

Ref: Section 9.2.5, Figure 6 DETERMINE IF THE

10. The communications system is required for safe-shutdown. Go CHANGE AFFECTS THE PLANT COMMUNICATION GO TO "F"

to F and return at Y. SYSTEM Y

Ref: Section 9.2.6, Figure 7 DETERMINE IF THE GO TO CHANGE AFFECTS

11. Emergency lighting has been provided for safe shutdown EMERGENCY LIGHTING "G"

operational steps. Go to G and return at Z. Z Ref: Section 9.2.7, Figure 8 REVIEW COMPLETE

12. The safe shutdown review is complete and should be documented by using Attachment 1.

EGR-NGGC-0102 Rev. 6 Page 25 of 92

FIGURE 2PRE- OR POST-FIRE DEENERGIZATION OR MANUAL OPERATIONS EXPLANATION FLOW CHART A

1. From the Safe Shutdown Flow Chart Is component pre- or post-fire rack-out or manually operated?

Ref: Section 9.2.1 IS AFFECTED COMPONENT ON PRE- OR POST-FIRE YES DEENERGIZED

2. Review the Safe Shutdown Analysis or Component Index to COMPONENTS LIST determine if the component is subject to pre- or post-fire  ?

de-energization. If it is, go to 4, else 3 below.

NO

3. Review the Safe Shutdown Analysis or Component Index or Formatted: Bullets and Numbering shutdown procedures to determine if the component is on the IS AFFECTED list as being manually operated. If component is not manually COMPONENT operated, go to 5, else 4 below. NO MANUALLY OPERATED

?

YES

4. Determine if the change affects the capability to de-energize the component pre- or post-fire or manually operate the component; if it does, go to 6, else 5 below.

DOES THE CHANGE AFFECT COMPONENT YES

5. Determine if the change affects or creates a manual operation OPERATION Formatted: Bullets and Numbering

?

of a safe-shutdown component such as transfer of power source or post-fire de-energization of the component for safe-shutdown. If it does, go to 6, or else 8 below.

NO

6. If the change affects the operation of manual components, Formatted: Bullets and Numbering indicate revisions to the Shutdown procedures required for DOES THE CHANGE safe-shutdown. Coordinate change with Operations to CREATE A MANUAL OPERATION OF determine impact, if any on manpower loadings. Go to 7 below. NO EXISTING SAFE SHUTDOWN EQUIPMENT

?

7. Determine affected documents and mark-up for revisions per Formatted: Bullets and Numbering YES existing procedures. Go to 8 below.

IDENTIFY CHANGES REQUIRED TO Formatted: Bullets and Numbering

8. Return to the Safe Shutdown Flow Chart, Figure 1, at T. SHUTDOWN PROCEDURES MARK-UP DOCUMENT REVISIONS PER PROCEDURES GO TO T

EGR-NGGC-0102 Rev. 6 Page 26 of 92

FIGURE 3, SHEET 1DELETION OF SAFE SHUTDOWN EQUIPMENT EXPLANATION FLOW CHART B

1. From the Safe Shutdown Flow Chart Does the change delete Safe Shutdown components?

Ref: Section 9.2.2 IS DELETED COMPONENT IN THE

2. By reviewing the Safe Shutdown Flow Diagrams, determine if PRIMARY FLOW NO the change deletes a component in the primary flow path, if so, PATH

?

go to 3, else 5 below.

YES

3. By reviewing the Safe Shutdown Flow Diagrams, determine if Formatted: Bullets and Numbering the change is deleting a component used to control system operation. If it is, go to 4, else 8 below.

IS DELETED

4. Evaluate effect on system operation and on the shutdown COMPONENT USED Formatted: Bullets and Numbering NO TO CONTROL procedures. Mechanical system and operations input may be SYSTEM OPERATION required to complete this evaluation. Go to 8.  ?

5. By reviewing the Safe Shutdown Flow Diagrams, determine if YES Formatted: Bullets and Numbering the change is a boundary isolation component. If it is, go to 6, else 9 below EVALUATE EFFECT ON SYSTEM OPERATION AND SHUTDOWN

6. By reviewing the Safe Shutdown methodology, establish a new PROCEDURES Formatted: Bullets and Numbering boundary. Go to 7.

IS DELETED COMPONENT IN A NO BOUNDARY ISOLATION

?

YES ESTABLISH NEW BOUNDARY CONTINUED EGR-NGGC-0102 Rev. 6 Page 27 of 92

FIGURE 3, SHEET 2DELETION OF SAFE SHUTDOWN EQUIPMENT EXPLANATION FLOW CHART CONTINUED

7. If the deleted component created a new boundary, and if this new boundary adds electrical support equipment or changes IS ADDITIONAL the category of a component, go to 9, else 8 below. ELECTRICAL EQUIPMENT YES INVOLVED

?

8. Determine affected documents and mark-up for revisions per Formatted: Bullets and Numbering existing procedures. Go to 9. NO Formatted: Bullets and Numbering

9. Return to the Safe Shutdown Flow Chart, Figure 1 at U.

MARK-UP DOCUMENT REVISIONS FOR EXISTING PROCEDURES GO TO U

EGR-NGGC-0102 Rev. 6 Page 28 of 92

FIGURE 4, SHEET 1NEW SAFE SHUTDOWN MANUAL COMPONENTS EXPLANATION FLOW CHART C

1. From the Safe Shutdown Flow Chart Does the change add new manual SSD equipment?

Ref: Section 9.2.3 IS MANUAL COMPONENT IN NO

2. By reviewing the Safe Shutdown Flow Diagrams, determine if PRIMARY FLOW PATH

?

the change is in the primary flow path. If it is, go to 3, else 5 below.

YES

3. By reviewing the Safe Shutdown Flow Diagrams, determine if Formatted: Bullets and Numbering the change is adding a new component that affects system operation. If it is, go to 4, else 9 below.

DOES THE NEW

4. Evaluate effect on system operation and on the Shutdown NO COMPONENT AFFECT Formatted: Bullets and Numbering Procedures. Go to 9. SYSTEM OPERATION

?

5. Determine if the change forms a branch off the primary flow YES Formatted: Bullets and Numbering path. If it does, go to 6, else 10 below.

EVALUATE EFFECT ON SYSTEM OPERATION AND SHUTDOW N

6. Evaluate the effects of the new branch if it were open. Provide PROCEDURES Formatted: Bullets and Numbering supporting calculations as required. If it will not adversely affect the design flow, go to 10, else 7 below.

IS MANUAL COMPONENT A BRANCH OFF THE NO PRIMARY FLOW PATH

?

YES COULD BRANCH SIZE ADVERSELY AFFECT THE PRIMARY FLOW NO REQUIREMENTS

?

YES CONTINUED EGR-NGGC-0102 Rev. 6 Page 29 of 92

FIGURE 4, SHEET 2NEW SAFE SHUTDOWN MANUAL COMPONENTS EXPLANATION FLOW CHART CONTINUED

7. By reviewing the Safe Shutdown methodology, establish a new boundary. Go to 8.

ESTABLISH NEW BOUNDARY

8. If this new boundary adds electrical support equipment or Formatted: Bullets and Numbering changes the category of a component, go to 10, else 9 below.

CONTINUED

9. Determine affected documents and mark-up for revision per Formatted: Bullets and Numbering existing procedures. Go to 10.

ARE ELECTRICAL COMPONENTS YES AFFECTED

?

Formatted: Bullets and Numbering

10. Return to the Safe Shutdown Flow Chart, Figure 1 at V. NO MARK-UP DOCUMENT REVISIONS FOR EXISTING PROCEDURES GO TO V

EGR-NGGC-0102 Rev. 6 Page 30 of 92

FIGURE 5ADDITION OR REVISION OF SAFE SHUTDOWN EQUIPMENT EXPLANATION FLOW CHART D

1. From the Safe Shutdown Flow Chart Does the change add or revise Safe Shutdown equipment?

Ref: Section 9.2.4

2. By the methodology presented in this procedure, perform the following analyses:

PERFORM ANALYSES PER METHODOLOGY

3. System AnalysisDetermine the system, train, mode of Formatted: Bullets and Numbering operation, and category for the added or revised equipment.

1. SYSTEM ANALYSIS

4. Cable AnalysisUtilizing the information derived above, Formatted: Bullets and Numbering determine the safe-shutdown cables, support components, and devices.

2. CABLE ANALYSIS

5. Using the information derived above, locate the equipment, Formatted: Bullets and Numbering cables, and support components by the zone layout drawings identified in the Safe Shutdown Analysis Report.

LOCATE EQUIPMENT PER

6. Determine affected documents and mark-up for revisions per ESTABLISHED CRITERIA Formatted: Bullets and Numbering existing procedures.

Formatted: Bullets and Numbering

7. Return to the Safe Shutdown Flow Chart, Figure 1 at W. MARK-UP DOCUMENT REVISIONS PER EXISTING PROCEDURES GO TO W

EGR-NGGC-0102 Rev. 6 Page 31 of 92

FIGURE 6, SHEET 1ADDITION OR REVISION OF ASSOCIATED CIRCUITS EXPLANATION FLOW CHART E

1. From the Safe Shutdown Flow Chart Determine if the change affects associated circuits?

Ref: Section 9.2.5 DOES THE CHANGE AFFECT EXISTING NO CIRCUIT PROTECTION

?

2. Determine if the change modifies the existing power or control circuit protection. If it does, go to 3, else 5 below.:

YES

3. By reviewing the safe-shutdown power supplies, determine if DOES THE Formatted: Bullets and Numbering CHANGE AFFECT the nonsafe-shutdown equipment is being supplied by a safe- ENSURE CIRCUIT AN EXISTING shutdown power supply. If it is not, ensure adequate circuit PROTECTION IS NO NON-SSD CIRCUIT PROVIDED W HICH IS FED FROM protection to alleviate all common enclosure concerns, and go AN SSD POW ER to 5, else 4 below. SUPPLY YES

4. Ensure modified nonsafe-shutdown circuit protection is Formatted: Bullets and Numbering coordinated with the SSD supply source, go to 5. ENSURE COORDINATION

& PROTECTION IS MAINTAINED

5. Determine if the change adds any new equipment to a safe- Formatted: Bullets and Numbering shutdown power supply. If it does not, ensure adequate circuit protection to alleviate all common enclosure concerns, and go to 7, else 6 below.

DOES THE CHANGE ENSURE CIRCUIT ADD A NEW NON-SSD PROTECTION IS NO CIRCUIT TO AN SSD PROVIDED POW ER SUPPLY

6. Ensure that the new nonsafe-shutdown circuit protection is  ?

Formatted: Bullets and Numbering coordinated with the safe-shutdown source; go to 7.

YES

7. Determine if the change adds new electrical circuitry or cables. ENSURE COORDINATION Formatted: Bullets and Numbering

& PROTECTION IS If it is, go to 8, else 9 below. MAINTAINED

8. Evaluate potential effects on common enclosure by fire Formatted: Bullets and Numbering propagation. Go to 9.

DOES THE CHANGE ADD NEW ELECTRICAL CIRCUITRY OR NO CABLES

?

YES EVALUATE POTENTIAL EFFECT ON COMMON ENCLOSURE CONTINUED EGR-NGGC-0102 Rev. 6 Page 32 of 92

FIGURE 6, SHEET 2ADDITION OR REVISION OF ASSOCIATED CIRCUITS EXPLANATION FLOW CHART CONTINUED

9. Determine affected documents and mark-up for revisions per existing procedures.

MARK-UP DOCUMENT REVISIONS PER EXISTING PROCEDURES Formatted: Bullets and Numbering

10. Return to the Safe Shutdown Flow Chart, Figure 1, at X.

GO TO X

EGR-NGGC-0102 Rev. 6 Page 33 of 92

FIGURE 7PLANT COMMUNICATION SYSTEM EXPLANATION FLOW CHART

1. From the Safe Shutdown Flow Chart Determine if the change affects plant communications.

Ref: Section 9.2.6

2. The installation of new components which may require local manual operation and establish new post-fire operating stations must be integrated into the shutdown procedures. The ability to communicate from and to these stations must be verified.

Formatted: Bullets and Numbering

3. BNP Does the change involve the safe shutdown sound-powered phone system? The continued acceptable operation of communications between safe shutdown operating stations must be verified.

RNP The installation of major new structural elements (walls, buildings) or large components (tanks, switchgear) or the addition or revision of local RF channels could effectively shield or impede some operating stations making radio communications difficult or impossible. The continued acceptable operation of radio communications between safe shutdown operating stations must be verified.

HNP & CR3 Both sound-powered phones and radio communications are used. The considerations identified for both BNP and RNP apply.

Formatted: Bullets and Numbering

4. Return to the Safe Shutdown Flow Chart, Figure 1 at Y.

EGR-NGGC-0102 Rev. 6 Page 34 of 92

FIGURE 8EMERGENCY LIGHTING EXPLANATION FLOW CHART G

1. From the Safe Shutdown Flow Chart.

Ref: Section 9.2.7 WILL THE CHANGE RESULT IN REMOVAL, RELOCATION, MODIFICATION, OR REAIMING YES

2. Emergency lighting has been installed at strategic locations to OF ANY EMERGENCY LIGHT

?

allow safe-shutdown operations and fire-fighting activities to occur as efficiently as possible during a blackout.

NO

3. Light emitted from emergency lighting units must illuminate the Formatted: Bullets and Numbering entire area uniformly or reach a specific device, depending on its purpose.

WILL THE CHANGE INVOLVE A STRUCTURAL CHANGE OR EQUIPMENT INSTALLATION OR CHANGE THAT COULD BLOCK A YES Formatted: Bullets and Numbering

4. Return to the Safe Shutdown Flow Chart, Figure 1 at Z. LIGHTS PATH OF ILLUMINATION

?

NO GO TO Z

RETURN TO FLOW CHART AFTER APPENDIX R ENGINEER MUST LAST "YES" ANSWER EVALUATE THE EFFECTS OF THE CHANGE AND SUGGEST CORRECTIVE ACTIONS IF REQUIRED REVIEW BY FP ENGINEER MAY BE NECESSARY FOR CHANGES AFFECTING FIRE-FIGHTING CAPABILITIES EGR-NGGC-0102 Rev. 6 Page 35 of 92

FIGURE 9FIRE PROTECTION FLOW CHART EXPLANATION FLOW CHART 1

1. The review procedure will be utilized to evaluate the impact on the Fire Protection Program.

2. If the change involves water suppression systems go to 1 and Formatted: Bullets and Numbering return at 21, else 3 below. IS THERE A CHANGE IN WATER YES SUPPRESSION PIPING Ref: Section 9.3.1, Figure 10  ?

3. If the change involves gaseous suppression systems, go to 2 NO and return at 22, else 4 below.

Ref: Section 9.3.2, Figure 11

4. If the change involves fire detection systems, go to 3 and ARE ANY SPRAY return at 23, else 5 below. NOZZLES BEING YES ADDED, REMOVED, OR RELOCATED Ref: Section 9.3.3, Figure 12  ?

5. If the change affects the rating of a fire barrier, go to 4 and NO return at 24, else 6 below.

Ref: Section 9.3.4, Figure 13

6. If the change involves heat spread control or fuel spread WILL THERE BE A CHANGE OF LOCATION limiters, go to 5 and return at 25, else 7 below. OR ADDITIVE TO AN YES EXISTING FOAM SYSTEM

?

Ref: Section 9.3.5, Figure 14

7. If the change involves combustible materials, go to 6 and return NO at 26, else 8 below.

Ref: Section 9.3.6, Figure 15

8. If the change involves plant access revisions, go to 7 and return at 27, else 9 below. WILL ANY STRUCTURES BE INSTALLED/REMOVED THAT MAY AFFECT HEAT FLOW TO YES Ref: Section 9.3.7, Figure 16 AND/OR WATER FLOW PATTERNS OF SPRAY NOZZLES

9. If the change involves manual suppression systems, go to 8  ?

and return at 28, else 10 below.

Ref: Section 9.3.8, Figure 17 NO

10. If the fire protection features were credited to support compliance with Appendix R exemptions, each change needs to consider the impact on safety evaluations and licensing conditions.

WILL THERE BE A CHANGE IN WALLS, CEILING, OR FLOORS THAT ACT AS HEAT COLLECTIONS YES OR UPSET COVERAGE OR PATTERN FOR ANY NOZZLE

11. The fire protection review is complete and should be  ?

documented using Attachment 2.

NO CONTINUED EGR-NGGC-0102 Rev. 6 Page 36 of 92

FIGURE 10, SHEET 1FIRE PROTECTION WATER SYSTEMS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart Ref: Section 9.3.1

2. System capability may be changed by increases or decreases in size or spacing of piping, changes in piping arrangement, or changes in pipe hanger location or spacing.

3. Changes in spray nozzle location or adding or removing spray nozzles may impair performance or require recalculation.

4. A change in foam system location or additive could adversely impact its specified performance.

5. Beams, ducts, or platforms may be placed such that the flow of heat to the sprinkler or water pattern from the sprinkler is interrupted or non-uniform. If sprinklers have been installed under a duct or cable tray and that structure is removed, heads may need to be raised to ceiling/roof height.

6. The addition, removal, or relocation of walls, ceilings, or floors that act as heat collectors for suppression may upset the coverage pattern or area for installed nozzles.

EGR-NGGC-0102 Rev. 6 Page 37 of 92

FIGURE 10, SHEET 2FIRE PROTECTION WATER SYSTEMS EXPLANATION FLOW CHART

7. Proper local and remote alarm actuation is necessary to ensure notification of area personnel as well as prompt Control Room action and fire brigade response.

8. Some water suppression systems include interlocks. Interlocks may prevent actuation until certain conditions exist or affect other equipment when the suppression system is actuated.

9. The location of manual suppression system actuators must provide easy access. If the change impedes access, existing actuators may be relocated or more actuators may be added.

Return to Fire Protection Flow Chart, Figure 9, at 21.

EGR-NGGC-0102 Rev. 6 Page 38 of 92

FIGURE 11, SHEET 1FIRE PROTECTION GASEOUS SYSTEMS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section

2. The agent pressure must be consistent with system design to ensure intended performance.

3. The supply gas volume must agree with the system design criteria.

4. Increases or decreases in size or spacing of piping, changes in piping arrangements, or changes in pipe hanger location or number may affect system capability.

5. Gaseous suppression systems are actuated by detectors placed strategically within the protected area. To prevent spurious suppression system actuation, detectors may be zoned so that specific signal pairs can be required for suppression system actuation.

6. Modifications that affect suppression system alarm circuitry may affect Control Room and fire brigade response time.

EGR-NGGC-0102 Rev. 6 Page 39 of 92

FIGURE 11, SHEET 2FIRE PROTECTION GASEOUS SYSTEMS EXPLANATION FLOW CHART

7. Manual system actuators must be accessible and spaced per the design specifications. The area of coverage and the assigned zone for automatic actuators (detectors) are critical to proper operations.

8. Upon actuation, the suppression agent must distribute promptly and evenly throughout the protected area.

9. Gaseous systems provide a predetermined amount of agent to be dispersed into a specific room volume. Any change in the volume into which the gas may discharge or paths through which the gas could escape affect the available concentration and could decrease or nullify the systems effectiveness.

10. Since suppression agent concentration can be diluted by the introduction of non-recirculated air or removed by exhaust flows, HVAC is usually interlocked with agent release. In some cases, a specified amount of dilution is calculated into increased agent volume. Changes in air flows must consider affects on gaseous suppression systems which credit closure of dampers under air flows.

11. In addition to HVAC interlocks discussed above, other systems may be affected by suppression actuation. For example, equipment may be de-energized.

12. Reliable power is required for gaseous suppression system operation. Alarm signals notify the Control Room of actuation and ensure prompt fire brigade response.

13. Return to Fire Protection Flow Chart, Figure 9 at 22.

EGR-NGGC-0102 Rev. 6 Page 40 of 92

FIGURE 12, SHEET 1FIRE PROTECTIONFIRE DETECTION SYSTEMS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section 9.3.3

2. Reliable primary and back-up power supplies are necessary for proper detector operation. Control panel circuits must operate as designed to ensure processing of alarm signals.

3. The choice of type and placement of detectors are critical to proper system operation.

4. Wiring for fire detection systems is designed and installed for reliable operation under adverse conditions.

5. If the addition of floor level equipment impedes access to existing manual alarm stations, additional manual pull stations may be required.

6. In an alarm condition, fire detection systems may initiate control and/or containment functions in addition to the basic notification function. These functions may include suppression actuation, door closure and/or damper operation.

EGR-NGGC-0102 Rev. 6 Page 41 of 92

FIGURE 12, SHEET 2FIRE PROTECTIONFIRE DETECTION SYSTEMS EXPLANATION FLOW CHART

7. Ventilation systems may dispense or remove sufficient heat and smoke in early fire stages to delay alarm actuation. Strong air currents may carry combustion products past smoke detection devices without triggering them.

8. Structural elements near fire detectors affect performance.

Walls and intermediate floors may block detectors from fire sources. Conversely, placing detectors properly within draft curtains or deep beams enhances performance.

9. Solid horizontal surfaces, such as roofs, act as collectors of heat and smoke, hastening actuation of a fire detector. Major obstructions placed under these surfaces may slow the sensing of a fire.

10. Return to the Fire Protection Flow Chart, Figure 9 at 23.

EGR-NGGC-0102 Rev. 6 Page 42 of 92

FIGURE 13, SHEET 1FIRE PROTECTIONFIRE BARRIERS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section 9.3.4

2. Structural elements which support or are an integral part of a barrier must provide barrier-integrity for the required rating period. Typical modifications that may jeopardize integrity include removing structural steel coating, adding unprotected structural or plate steel to the barrier (e.g., block wall supports or blast shields) and reducing concrete thickness below that required to maintain the fire rating. Changes in tested/listed configurations (such as material thickness or configuration) must be evaluated for impact on the barrier qualifications.

3. New electrical or mechanical penetration must be sealed in accordance with the design requirements to provide a fire rating equivalent to the required rating of the barrier. Modifications of existing penetration seals must conform to the original design or with another approved design.

4. Fire door and damper assemblies are approved by a testing laboratory for a specified fire rating. Any modification to such assemblies outside of label service (i.e., manufacturer and testing laboratory approval) will void the specified fire rating and must be evaluated by the Fire Protection Engineer. FIR-NGGC-0005 provides additional direction related to fire door and frame repairs, as applicable.

5. Changes in the air flow rates can affect fire damper closure requirements and affect gaseous suppression system performance.

6. Appendix R requires 20 feet of horizontal separation for redundant circuits in addition to suppression and detection. For redundant circuits not separated by 20 feet horizontally, three-hour and one-hour wraps have been utilized to provide equivalent protection.

EGR-NGGC-0102 Rev. 6 Page 43 of 92

FIGURE 13, SHEET 2FIRE PROTECTIONFIRE BARRIERS EXPLANATION FLOW CHART

7. Cable fire propagation potential can be reduced by using IEEE-383 (or equivalent) cables, placing cables in conduit, using a fire-rated wrap, or coating cables with fire-rated materials.

8. Cables may also be coated with materials which reduce fire propagation potential. The modification may affect the coating on existing cables or may introduce additional IEEE-383 cables into the area.

9. Fire stops confine potential fire spread along cable insulation.

10. Return to the Fire Protection Flow Chart, Figure 9, at 24.

EGR-NGGC-0102 Rev. 6 Page 44 of 92

FIGURE 14FIRE PROTECTION HEAT SPREAD CONTROL AND FUEL SPREAD LIMITERS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section 9.3.5

2. Removal or breaching of a plume impingement shield by combustibles may cause direct fire damage from postulated exposure fires.

3. Confinement of fuel by curbs, dikes, etc., may prevent the spread of fire to other fire areas or zones. For HNP, this includes changes to the Reactor Coolant Pump Oil Collection System.

4. Effective removal of fuel is dependent on its drain assemblies.

5. A change of a backflow preventer may cause the fuel to accumulate and substantially increase the fire hazard.

6. Return to the Fire Protection Flow Chart, Figure 9, at 25.

EGR-NGGC-0102 Rev. 6 Page 45 of 92

FIGURE 15FIRE PROTECTIONFIXED COMBUSTIBLE LOADING EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section 9.3.6

2. Cable insulation represents a major portion of the total fixed combustible loading in most fire areas and in the overall plant.

3. Equipment often contains a sufficient quantity of grease, hydraulic fluid or lubricating oil to require consideration as an additional fixed combustible load.

4. Other fixed combustibles must be considered in the combustible loading. These combustibles may include PVC pipe, Thermo-Lag material, charcoal, plastics, cloth, carpet, instruments (fire resistant or not), treated lumber, and process gas (H2).

5. Return to the Fire Protection Flow Chart, Figure 9, at 26.

EGR-NGGC-0102 Rev. 6 Page 46 of 92

FIGURE 16FIRE PROTECTIONPLANT ACCESS EXPLANATION FLOW CHART

1. From the Fire Protection Flow Chart.

Ref: Section 9.3.7

2. Although not fire protection related, access to components required for safe-shutdown is imperative. See the Emergency Lighting drawings.

3. Pre-fire planning may require access through an unlocked door in the event of a fire emergency. In this case, assess impact on shutdown procedures and manpower requirements.

4. The addition or deletion of walls, barriers, doors, etc., will affect access to the fire area.

5. If immediate access to Fire Protection System equipment or controls is blocked, equipment relocation or additional control stations may be required.

6. Air flow within an area or from area to area has a considerable impact on smoke, heat, and fire spread within a structure.

Accordingly, the control of ventilation during a fire is a prerequisite to fire containment and extinguishment.

Maintaining the integrity of safe ventilation paths is of utmost importance in preventing the exposure of redundant divisions from hot combustible gases and allowing tenable access to the seat of the fire for prompt extinguishment. Plant changes can possibly affect these ventilation paths; therefore, these paths must be considered in this determination.

7. Return to the Fire Protection Flow Chart, Figure 9, at 27.

EGR-NGGC-0102 Rev. 6 Page 47 of 92

FIGURE 17FIRE PROTECTION MANUAL FIRE SUPPRESSION EQUIPMENT EXPLANATION FLOW CHART

1. From Fire Protection Flow Chart.

Ref: Section 9.3.8

2. In most cases, manual suppression equipment is strategically located based on the hazard protected, length of hoselines, and reach of streams, visibility and accessibility.

3. As with equipment location, the type and size of manual suppression equipment are based on the hazard protected.

4. Return to the Fire Protection Flow Chart, Figure 9, at 28.

EGR-NGGC-0102 Rev. 6 Page 48 of 92

ATTACHMENT 3 Sheet 1 of 18 Manual Action Feasibility Assessment Criteria Table of Contents 1.0 Purpose 50 2.0 Background. 50 2.1 Historical Regulatory Interpretation.. 50 2.2 Recent NRC Manual Action Feasibility Guidance.. 51 2.3 Definitions. 51 3.0 Progress Energy Positions. 52 4.0 Manual Action Feasibility Acceptance Criteria 54 4.1 Recovery Time. 54 4.1.1 Demonstration... 54 4.1.2 Complexity and Number.. 54 4.2 Plant Staff and Training.. 55 4.3 Operator Considerations 55 4.3.1 Local Accessibility. 55 4.3.2 Environmental Considerations 56 4.4 Equipment Pre-Conditions. 58 4.5 Available Indications 60 4.6 Special Equipment.. 60 4.7 Communication 60 4.8 Procedural Guidance. 60 5.0 Special Considerations.. 61 5.1 Prioritization of Actions.. 61 5.2 Fire Area Complexity 63 5.3 Determination of Recovery Time Frames.. 64 5.3.1 Engineering Calculation Initial Conditions and Assumptions. 65 5.3.2 Evolution of Timeline.. 65 EGR-NGGC-0102 Rev. 6 Page 49 of 92

ATTACHMENT 3 Sheet 2 of 18 Manual Action Feasibility Assessment Criteria 1.0 Purpose The purpose of this paper is to provide the Progress Energy (PE) guidance on the evaluation of manual actions credited as Fire Area Analysis strategies.

This paper does not apply to cold shutdown actions and repairs.

2.0 Background 2.1 Historical Regulatory Interpretation Manual actions in support of post-fire shutdown are used to supplement other program elements to ensure post-fire safe shutdown capability. From a historical regulatory perspective, manual actions in support of post-fire shutdown were considered to be part of compliance with Section III.G.3 or Section III.G.1 of Appendix R.Section III.G.1 states:

Fire protection features shall be provided for structures, systems, and components important to safe shutdown. These features shall be capable of limiting fire damage so that:

a. One train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage; and

b. Systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

For the purposes of compliance with Appendix R, manual operator action locations were considered to be emergency control stations. Manual actions on equipment for the purpose of performing its required safe shutdown function have historically been credited under the definition of free of fire damage. For example, an MOV cable in the fire area that utilizes a manual action strategy to open the power supply breaker and cycle the valve is not considered required for a fire in that area. In this case, redundant trains are considered free of fire damage.

The following additional NRC interpretation was provided in the May 16, 2002 letter from the NRC to NEI:

We agree that 10 CFR 50.48 and Appendix R to 10 CFR Part 50 do not forbid the use of manual actions. With proper analysis, manual actions are allowed for fire safe shutdown activities under the following circumstances:

Operation of equipment for which cables are located in fire areas that meet Formatted: Indent: Left: 0.5",

Bulleted + Level: 1 + Aligned at:

Section III.G.1of Appendix R to 10 CFR Part 50, by having redundant cables and 0.63" + Tab after: 0.88" + Indent equipment in a completely different fire area at: 0.88", Tabs: Not at 0.88" Manual operation of normally operated manual switches and valves Staff-approved deviations and exemptions for specific manual actions in lieu of meeting the criteria of Section III.G.2 of Appendix R to 10 CFR Part 50 EGR-NGGC-0102 Rev. 6 Page 50 of 92

ATTACHMENT 3 Sheet 3 of 18 Manual Action Feasibility Assessment Criteria Manual operation of equipment used to meet the requirements of Section III.G.3 Formatted: Indent: Left: 0.5",

Bulleted + Level: 1 + Aligned at:

for Alternative or Dedicated Shutdown of Appendix R to 10 CFR Part 50, where 0.63" + Tab after: 0.88" + Indent meeting performance criteria of Section III.L is required at: 0.88", Tabs: Not at 0.88" 2.2 Recent NRC Manual Action Feasibility Guidance The NRC has issued the following documents that contain criteria for assessing the feasibility of manual actions. Note the criteria in Federal Register Notice, Draft Criteria for Determining Feasibility of Manual Actions to Achieve Post-Fire Safe Shutdown, November 26, 2003 is included in Section 4.0.

1. Federal Register Notice, Draft Criteria for Determining Feasibility of Manual Actions to Achieve Post-Fire Safe Shutdown, November 26, 2003. This document contains the acceptance criteria for determining if a previously unapproved manual action credited in lieu of a III.G.2 method, will be allowed enforcement discretion pending the NRCs rulemaking.

2. NRC Inspection Procedure 71111.05 dated, March 3, 2003. Enclosure 2 to this document contains the inspection criteria for fire protection manual actions. For an interim period while the rulemaking is in progress, the staff will use this acceptance criteria to facilitate evaluations of licensee manual actions. Note: Differences exist between the criteria in this document and that in the Federal Register above. Where these differences exist, the Federal Register will take precedence.

3. White Paper on Alternative Fire Protection Compensatory Measures, dated August 20, 2003. This paper establishes that Properly analyzed and implemented manual actions which meet the criteria of Inspection Procedure 71111.05 and additional actions or a combination thereof as discussed above could serve as interim measures (pending rulemaking) which provide a safety benefit greater than having hourly fire watch tours for uninstalled or missing fire barriers.

2.3 Definitions The following definitions apply to the assessment of operator intervention with respect to post fire safe shutdown. Feasibility criteria apply only to operator manual actions, i.e., ones taken outside the Main Control Room (MCR), not operator actions (inside the MCR) or repairs.

1. Operator Manual Actions (manual actions): Those actions taken by operators to perform manipulation of components and equipment from outside the main control room (MCR) to achieve and maintain post-fire safe shutdown. These actions are performed locally by operators, typically at the equipment.

2. Operator Actions: Those actions taken by operators from inside the MCR to achieve and maintain post-fire safe shutdown. These actions are typically performed by the operator controlling equipment located remote from the MCR.

EGR-NGGC-0102 Rev. 6 Page 51 of 92

ATTACHMENT 3 Sheet 4 of 18 Manual Action Feasibility Assessment Criteria

3. Cold shutdown repairs are defined as follows:

Formatted: Indent: Left: 0.25",

Replacement of damaged components to restore operability of equipment. Hanging: 0.25", Bulleted + Level: 2

+ Aligned at: 0.5" + Tab after:

Fuse removal and subsequent replacement for a control circuit to recover from the 0.75" + Indent at: 0.63", Tabs: Not effects of a fire. Removal of cartridge- or plug-type fuses, in which the action to at 0.75" remove the fuse is analogous to operating a circuit breaker, may be acceptable as a manual action provided the fuse is easily identifiable and accessible. Fuse removal, as a manual action will be addressed on a case-by-case basis. Fuse replacement is always considered a repair.

Replacement of cabling Modifications (e.g., wiring changes to systems or components to restore operability of equipment)

Manual actions requiring a tool are considered repairs. Operator aids for valve manipulation or circuit breaker operation are not considered tools.

All repairs should be of sufficient quality to assure safe operation until the plant is restored to an operating condition. Repairs not permitted include the use of clip leads in control panels (which means that hard wired terminal lugs must be used), and the use of jumper cables other than those fastened with terminal lugs.

3.0 Progress Energy Positions For currently credited manual actions, Progress Energy shall meet NRC expectations for feasibility as provided in Federal Register Notice, Draft Criteria for Determining Feasibility of Manual Actions to Achieve Post-Fire Safe Shutdown, November 26, 2003.

1. For manual action feasibility analysis the following information will be gathered:

a. The availability and adequacy of detection will be identified for those areas crediting Formatted: Indent: Left: 0.25",

Numbered + Level: 2 + Numbering manual actions. Style: a, b, c, + Start at: 1 +

Alignment: Left + Aligned at: 0.5" +

b. The availability and adequacy of fire suppression will be identified for those areas Tab after: 0.75" + Indent at: 0.75",

crediting manual actions. Tabs: Not at 0.75" The availability/adequacy of suppression and detection will be considered during the decision making process to resolve fire area casualties.

EGR-NGGC-0102 Rev. 6 Page 52 of 92

ATTACHMENT 3 Sheet 5 of 18 Manual Action Feasibility Assessment Criteria

2. Fire Area resolution strategies involving manual actions shall only be considered after all other options have been explored and costs/plant affects have been determined. These options include, but are not limited to:

Reroute cables to comply by meeting III.G.1 (Appendix R requirements are provided, NUREG 0800 has the same requirements for HNP)

Change system logic to comply with III.G.1 Subdivide Fire Areas and/or upgrade fire area barriers to comply with III.G.1 Install three hour wrap or chases to comply with III.G.2.a Credit 20 feet separation or greater with suppression and detection to comply with III.G.2.b Install one hour wrap or chases with suppression and detection to comply with III.G.2.c Install fire rated cable

3. New Safe Shutdown Analysis (SSA) manual actions credited as compliance strategies to address III.G.2 fire induced mal-operations shall only be used with prior approval from the NRC staff until such time as the NRC revises Appendix R III.G / NUREG 0800.

Manual actions that do not fall within this category are:

Manipulation of controls outside the Control Room for III.G.3 fire areas Operations of switches and manually operated valves outside the MCR that are manipulated during a normal shutdown sequence Actions with specific approval in an SER or exemption/deviation Actions not credited in the SSA that are for purposes other than Safe Shutdown (SSD) (e.g., Equipment protection)

Actions for mitigating high impedance faults (low safety significance, see Fire Induced Circuit Failure Position Paper)

4. Actions not credited in the SSA that are for purposes other than Safe Shutdown (SSD)

(e.g., Equipment protection) do not need to be formally evaluated for their feasibility, however, performing these actions can affect the available manpower and the time response of performing required manual action and therefore would have to be included, as necessary, in the resource requirements and timeline of performing required manual actions.

Note: Manual actions will be evaluated for their feasibility in accordance with the criteria in Section 4.

EGR-NGGC-0102 Rev. 6 Page 53 of 92

ATTACHMENT 3 Sheet 6 of 18 Manual Action Feasibility Assessment Criteria 4.0 Manual Action Feasibility Acceptance Criteria In order to demonstrate that the use of manual actions or repairs to achieve post-fire safe shutdown are feasible, certain criteria shall be met. NRC guidance is listed below in italics.

PE exceptions and clarifications to this guidance are provided with the criteria below.

4.1 Recovery Time The following are the Progress Energy guidelines for ensuring recovery time is available to perform manual operator actions.

4.1.1 Demonstration NRC Criteria: The capability to successfully accomplish required operator manual actions within the time allowable using the required procedures and equipment shall be demonstrated using the same personnel/crews who will be required to perform the actions during the fire; documentation of the demonstration shall be provided.

Progress Energy Implementing Position: Use of EOP or site equivalent procedure validation process for time critical actions adequately addresses this item. The process used shall ensure lighted paths are considered; refer to section 4.3.2 for emergency lighting requirements.

4.1.2 Complexity and Number NRC Criteria: The degree of complexity and total number of operator manual actions required to effect safe shutdown shall be limited such that their successful accomplishment under realistically severe conditions is assured for a given fire scenario. The need to perform operator manual actions in different locations shall be considered when sequential actions are required.

Analyses of the postulated fire time line shall demonstrate that there is sufficient time to travel to each action location and perform the action required to support the associated shutdown function(s) such that an unrecoverable condition does not occur.

Progress Energy Implementing Position: Section 5 includes the Progress Energys special considerations for this criterion.

EGR-NGGC-0102 Rev. 6 Page 54 of 92

ATTACHMENT 3 Sheet 7 of 18 Manual Action Feasibility Assessment Criteria 4.2 Plant Staff and Training NRC Criteria: There shall be a sufficient number of plant operators, under all staffing levels, to perform all of the required actions in the times required for a given fire scenario.

The use of operators to perform actions shall be independent of any collateral fire brigade or control room duties they may need to perform as a result of the fire.

Operators required to perform the manual actions shall be qualified and continuously available to perform the actions required to achieve and maintain safe shutdown. A training program on the use of operator manual actions and associated procedures during a postulated fire shall demonstrate that operators can successfully achieve these objectives.

Progress Energy Implementing Position:

The operations training program will include continuing SSA shutdown procedure training.

Brigade members may be credited for actions later in the timeline provided they are qualified to perform the actions and the other feasibility criteria are met.

4.3 Operator Considerations For actions in or adjacent to the fire area of concern, radiation levels, temperature, humidity, smoke and hot gasses resulting from the fire and fire suppression activities shall be assessed to ensure the operators can carry out the action. In addition, consideration should be given to the effects of firefighting activities (e.g. water vapor, water/drainage, and products of combustion). The component operated shall be physically accessible and the action to be taken shall be reasonable for the operator to perform. For example, manually opening a motor operated valve is not feasible if the valve has no handwheel.

4.3.1 Local Accessibility NRC Criteria: All locations where operator manual actions are performed shall be assessed as accessible without hazards to personnel, with controls needed to assure availability of any special equipment, such as keys or ladders, being demonstrated.

Progress Energy Implementing Position: If the actions have been analyzed to meet required functional performance objectives in Table 4-1, PE considers actions requiring entry into or travel through the fire area of concern acceptable if they occur after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or after sufficient time for a postulated fire to be extinguished, which ever is later. Note that for III.G.3 the safe shutdown capability must be independent of the area, room, or zone under consideration. So if a re-entry into the fire area of concern is required for a III.G.3 area, then an evaluation of the independence shall be performed as part of the feasibility evaluation.

EGR-NGGC-0102 Rev. 6 Page 55 of 92

ATTACHMENT 3 Sheet 8 of 18 Manual Action Feasibility Assessment Criteria 4.3.2 Environmental Considerations NRC Criteria: Environmental conditions encountered while accessing and performing operator manual actions shall be demonstrated to be consistent with the following human factor considerations for visibility and habitability:

Emergency lighting shall be provided as required in Appendix R,Section III.J, or by the licensee's approved fire protection program, [e.g., lit with 8-hr battery-backed emergency lighting], and sufficient lighting shall be provided for paths to and from locations requiring any actions.

Radiation shall not exceed 10 CFR Part 20, Section 20.1201, limits.

Temperature and humidity conditions shall be evaluated to ensure that temperature and humidity do not adversely affect the capability to perform the operator manual action (See, e.g.,

NUREG/CR-5680, vol. 2, "The Impact of Environmental Conditions on Human Performance) or the licensee shall provide an acceptable rationale for why temperature/humidity do not adversely affect performing the manual actions.

Fire effects shall be evaluated to ensure that smoke and toxic gases from the fire do not adversely affect the capability to access the required equipment or to perform the operator manual action.

EGR-NGGC-0102 Rev. 6 Page 56 of 92

ATTACHMENT 3 Sheet 9 of 18 Manual Action Feasibility Assessment Criteria Progress Energy Implementing Position: Tasks that are not required until after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> do not require emergency lights as there is time to establish temporary lighting.

The table below provides guidance as to the nature and extent of evaluation required for environmental considerations.

Table 4-1 Environmental Condition Evaluations Item Case for Consideration Extent of Evaluation 1 Operator required to enter into fire Quantitative evaluation of area of concern within the first Smoke and toxic gases hour or before the fire is Temperature extinguished.

Radiation Qualitative evaluation of Potential Fire Fighting effects such as 3/4 Water vapor Formatted: Indent: Left: 0.08",

Bulleted + Level: 1 + Aligned at: 0" 3/4 Water discharge/accumulation + Tab after: 0.25" + Indent at:

0.25", Tabs: Not at 0.25" 1A Operator required to enter into an Quantitative evaluation of adjacent Fire Area open to the Fire Smoke and toxic gases Area of concern within the first Temperature hour, or before the fire is extinguished. Radiation Qualitative evaluation of Potential Fire Fighting effects such as 3/4 Water vapor Formatted: Indent: Left: 0.08",

Bulleted + Level: 1 + Aligned at: 0" 3/4 Water discharge/accumulation + Tab after: 0.25" + Indent at:

0.25", Tabs: Not at 0.25" 2 Operator required to travel through Qualitative evaluation of the fire area of concern within the Smoke and toxic gases first hour, before the fire is Temperature extinguished, or until the environment is shown to be Radiation acceptable. Water vapor Water discharge/Floor drainage 3 Operator required to enter into fire None required. Equipment survivability area of concern after the first hour is addressed in section 4.4.

or after the fire is extinguished.

4 Operator required to travel through None required. Equipment survivability the fire area of concern after the is addressed in section 4.4.

first hour or after the fire is extinguished.

EGR-NGGC-0102 Rev. 6 Page 57 of 92

4.4 Equipment Pre-conditions NRC Criteria: Possible failure modes and damage that may occur to equipment during a fire shall be considered to the extent that the equipment's subsequent use could be prevented, or at least made difficult. Credit for using equipment whose operability may have been adversely affected by the fire due to smoke, heat, water, combustion products, or spurious actuation effects shall account for such possibilities (e.g., over-torquing an MOV due to a spurious signal, as discussed in Information Notice 92-18).

EGR-NGGC-0102 Rev. 6 Page 58 of 92

ATTACHMENT 3 Sheet 10 of 18 Manual Action Feasibility Assessment Criteria Progress Energy Implementing Position:

The following cases will be used to determine scope of equipment requiring additional consideration and possible additional evaluation:

Table 4-2 Equipment Survivability Evaluations Item Case for Consideration Extent of Evaluation 1 Equipment in the fire area of concern Evaluation that equipment can Formatted: Indent: Left: 0",

Hanging: 0.15", Bulleted + Level: 1 is required for manual actions survive the fire. Generically, items such + Aligned at: 0" + Tab after: 0.25" as pipe and mechanical valves are + Indent at: 0.25", Tabs: Not at assumed to survive the fire. No 0.25" additional analysis will be performed.

Handheld flashlights shall be required as a backup to fixed emergency lighting in the fire area of concern.

2 Equipment outside the area, but Evaluate to determine that equipment is requiring local manual or remote available manually. This includes the all electrical operation, is potentially points of the circuit for MOVs including affected by cable faults in the fire inside the MCC cubicle.

area of concern (e.g., IEN 92-18 issue).

3 Equipment outside the area, but Address conflicts between firefighting potentially affected by firefighting activities (assembly area, point of fire area activities. entry, etc.) and manual actions including access paths in Pre-fire Plans.

Also address the potential effects on equipment due to heat, smoke, water discharged, and products of combustion.

4 Equipment and cable outside the No additional analysis for equipment area, but potentially affected by effects.

smoke due to HVAC flows and spatial boundaries. Sandia National Labs generated a series of NUREG/CR, specifically addressing smoke effects on electrical equipment. The last report in the series is NUREG/CR-6597 Results and Insights on the Impact of Smoke on Digital Control. This report indicated that smoke affects is a long-term event (relative to fire and firefighting activities).

EGR-NGGC-0102 Rev. 6 Page 59 of 92

ATTACHMENT 3 Sheet 11 of 18 Manual Action Feasibility Assessment Criteria 4.5 Available Indications NRC Criteria: Diagnostic indication, if credited to support operator manual actions, shall be capable of:

Confirming that the action is necessary; Being unaffected by the postulated fire; Providing a means for the operator to detect whether spurious operation of safety-related equipment has occurred; and Verifying that the operator manual action accomplished the intended objective.

Progress Energy Implementing Position: Progress Energy will address the spurious operation of all SSA Credited Equipment, not only the safety-related equipment credited.

This indication is not required to be a direct reading instrument and may be a system change (level, pressure, flow, etc.), physical verification at the component operated, or indicating light change of state if its cables are part of the program.

4.6 Special Equipment NRC Criteria: Any special equipment required to support operator manual actions, including keys, self-contained breathing apparatus (SCBA), and personnel protective equipment, shall be readily available, easily accessible and demonstrated to be effective.

Progress Energy Implementing Position: Same as NRC Criteria.

4.7 Communication NRC Criteria: To achieve and maintain safe shutdown, adequate communications capability shall be demonstrated for operator manual actions that must be coordinated with other plant operations, with this communications capability continuously available.

Progress Energy Implementing Position: This criterion applies to manual operator actions that require constant communications back to the control room or alternate shutdown control station to ensure coordination with overall shutdown process or to establish a parameter. Most manual actions, such as repositioning a valve or tripping a breaker, do not require continuous communications. The need for continuous communications will be identified in the analysis.

4.8 Procedural Guidance NRC Criteria: Procedural guidance on the use of required operator manual actions shall be readily available, easily accessible and demonstrated to be effective.

Progress Energy Implementing Position: Guidance (e.g., procedures, pre-fire plan, etc.)

shall be provided to alert the operator as to when manual actions may be required in response to potential fire damage.

EGR-NGGC-0102 Rev. 6 Page 60 of 92

ATTACHMENT 3 Sheet 12 of 18 Manual Action Feasibility Assessment Criteria 5.0 Special Considerations The intent of this section is to transition the focus from individual manual actions that restore system functions to the process to evaluate and proceduralize these actions on a fire area basis. Progress Energy methodology to address the complexity and number of manual actions and timing issues are also included here.

5.1 Prioritization of Actions.

The Fire Induced Circuit Failure Position Paper establishes the design methodology for evaluating circuit failure, including number and type (concurrent or sequential) spurious actuations that will be postulated on a fire area basis. The intention of this section is to prioritize actions resulting from those postulated spurious actuations and failures based on time and consequences. Table 5-1 provides general guidelines to establish priority of actions. All high, medium, and low priority actions need to be addressed by the appropriate type of procedure as discussed in section 5.2.

EGR-NGGC-0102 Rev. 6 Page 61 of 92

ATTACHMENT 3 Sheet 13 of 18 Manual Action Feasibility Assessment Criteria Table 5-1 Prioritization of Manual Actions Priority Description Comments High Preemptive actions that are These manual actions are typically needed to preclude damage of only used for control room evacuation SSA credited equipment or an (such as the scram) or as part of a set unrecoverable event. of interim compensatory measures.

They may also be used to simplify later actions to respond to a spurious actuation (such as closing a PORV block valve at first indication of a fire).

Medium The recovery of components Multi-conductor, multi-component subject to a single spurious cables (as addressed in FICF Paper) actuation or failure, which, if left are not considered independent and unmitigated, could result in an would be included as a medium unrecoverable conditions or priority.

equipment damage.

Low* Components or systems that The likelihood of getting independent are subject to unrecoverable multiple concurrent/sequential failures conditions or equipment is low. Defense in depth is provided damage only in the event of two by the fact that two independent independent spurious failures are required to reach the operations. unrecoverable condition and/or equipment damage.

Not Components or systems that Required* are subject to unrecoverable conditions or equipment damage only in the event of three or more independent spurious operations.

Components or systems that are NOT subject to unrecoverable conditions or equipment damage in the event of two independent spurious operations.

• These categories are considered part of the PE revised SSA design methodology and will be incorporated into the manual action feasibility studies during the validation projects.

EGR-NGGC-0102 Rev. 6 Page 62 of 92

ATTACHMENT 3 Sheet 14 of 18 Manual Action Feasibility Assessment Criteria When evaluating the prioritization of manual actions note that the control room evacuation guidance provided in Generic Letter 86-10 Response to Question 3.8.4 states in part: "

Note that the only manual action in the control room prior to evacuation usually given credit for is the reactor trip. For any additional control room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such actions would have to be provided. Additionally, assurance would have to be provided that such actions could not be negated by subsequent spurious actuation signals resulting from the postulated fire.

5.2 Fire Area Complexity Fire areas shall be categorized by relative complexity of actions. Those that have a large number of actions or potentially competing high priority actions may need to utilize directive plant operations after the criteria for entry into that evolution is met. Effectively all plant responses are symptom based. Even those areas with directive procedure responses will need symptoms to trigger the criteria for entry.

Table 5-2 Fire Area Complexity Fire Area Description Procedure Treatment Comments Complexity High Area has a large Define symptoms Steps may not number of actions or and /or criteria* necessarily address potentially competing that require entry every component high priority actions. into the fire area loss/spurious specific procedure actuation identified in section. the fire area, but Once a section is positive control of entered, directive plant functions is steps are provided demonstrated by use to address critical of SSA credited, plant functions. available SSCs.

Medium Small number of List potential spurious actions that can easily actuation and remedy be handled by shift by fire area.

personnel.

Low Few generic manual Generic actions are actions or no manual included in top level actions. fire response procedure or procedure section.

No special fire area treatment is needed.

EGR-NGGC-0102 Rev. 6 Page 63 of 92

ATTACHMENT 3 Sheet 15 of 18 Manual Action Feasibility Assessment Criteria

• Typical criteria conditions for entry into a safe shutdown procedure to address a high complexity fire area includes Location, size and severity of the fire Formatted: Indent: Left: 0.38",

Hanging: 0.25", Bulleted + Level: 1 Effect of the fire on credited safe shutdown equipment + Aligned at: 0.38" + Tab after:

Limiting Conditions for Operation resulting from fire 0.63" + Indent at: 0.5", Tabs:

Control room habitability 0.63", Left Effect of the fire on balance of plant 5.3 Determination of Recovery Time Frames In the supplementary information presented in the promulgation of Appendix R, the Nuclear Regulatory Commission states in part: "...it is not possible to predict the specific conditions under which fires may occur and propagate." Based on this statement, it follows that it would not be possible to predict the exact behavior and interaction of plant systems given a fire. Historically, the magnitude, duration, or complexity of a fire cannot be foreseen to the extent of predicting the timing and quantity of circuit failures. NRC has drafted guidance for the number spurious actuations required to be considered during inspections. Progress Energy has developed a Fire Induced Circuit Failure (FICF) analysis paper (see Attachment

4) that establishes the requirements for performing future SSA analysis. The Progress Energy FICF paper and sections 5.1 and 5.2 of this attachment provide the basis consideration of multiple spurious actuations. Multiple spurious actuations or signals originating from fire-induced circuit failures may occur as a result of a postulated fire.

However, they are not expected to occur concurrently unless the spurious operations are caused by the fire-induced failure in circuits that can affect multiple components.

A review shall be performed to determine limiting thermo-hydraulic time frames to unrecoverable conditions or equipment damage for critical functions that could result from fire-induced equipment failures and spurious component actuations. This review will summarize the applicable calculations and evaluations that are utilized to address the recovery of the required safe shutdown success paths. These evaluations/calculations focus on restoration of fire damaged success paths rather than focusing on specific component losses and the order in which they occur. For example, for the make-up and purification system, a bounding calculation that identifies the time frame required to establish make-up (one of the success paths evaluated in the fire study) rather than determining which components are required to be lost in a particular order.

EGR-NGGC-0102 Rev. 6 Page 64 of 92

ATTACHMENT 3 Sheet 16 of 18 Manual Action Feasibility Assessment Criteria The timeframes that result from these evaluations and calculations would not be absolute values for acceptability of operator action or system performance, rather they would provide the maximum time available for mitigation to occur. The calculations and analysis results, in conjunction with considerations of the likelihood of the event, will be used to help prioritize the order in which manual actions are to be performed in response to fire. While this is particularly important for the alternative shutdown scenarios (i.e., response to a Control Room fire), it is also important in addressing responses to other challenging fire scenarios.

5.3.1 Engineering Calculation Initial Conditions and Assumptions Regulatory and guidance documents do not provide guidance as to the initial status of the plant. Some information can be obtained from GL 81-12 in that the regulation does not require single failures or other plant accidents (e.g., stuck open valves). Since there is no definitive guidance the following will be used:

The plant is stable at 100% power.

All plant systems are operating normally at the onset of the fire.

o Tank levels are normal (at set point, not low level) Formatted: Indent: Left: 0.25",

Bulleted + Level: 2 + Aligned at:

o The number of pumps normally running are running (i.e., if 2 charging pumps are 0.75" + Tab after: 1" + Indent at:

normally in service at 100% power, then that is the initial condition of the system) 1", Tabs: Not at 1" o The system line-up is normal (i.e., any special lineups are not in affect at the initiation of the event)

The spurious actuation occurs. This shall be assessed on a success path basis. Every success path (function) affected by the fire in an area shall be considered. This means that if charging, auxiliary feedwater, and component cooling water are all in the area, they will all be affected. Each success path will be evaluated independently.

For fire areas where the offsite power source is not protected or where offsite power must be postulated, a loss of offsite power is assumed to occur concurrent with the reactor trip. Note that components must be evaluated in both their normal and loss of power position.

5.3.2 Evolution of Timeline The regulatory or guidance documents reviewed do not provide guidance on when and how the fire-induced plant transient is initiated. The following will be used for the Progress Energy Nuclear Generation Group when preparing a manual action feasibility study.

EGR-NGGC-0102 Rev. 6 Page 65 of 92

ATTACHMENT 3 Sheet 17 of 18 Manual Action Feasibility Assessment Criteria Event Timeline Operations Timeline trt tor tgr Plant Transient Timeline tglst tf tal tsp tun tf - fire begins tal - fire alarm tsp - spurious actuation occurs trt - operator trips reactor tor - operator response (s) tglst - goal parameter (s) out of acceptable range (lost) tgr - goal recovery tun - unrecoverable condition is reached (fuel cladding damage)

A fire occurs in a fire area in the plant. This is depicted as tf on the figure above.

An alarm is received in the Control Room. This is represented as tal on the figure above.

The Operations staff becomes aware that there is a fire. They continue to operate the plant normally. They refer to the appropriate procedures that provide guidance as to what safe shutdown systems may be impacted.

Note: Availability of fire detection in the area or justification of alternative means of detection approaches is required for all locations a manual action is credited for fire SSD.

Other means of detection such as equipment alarms and/or personnel observations may be credited as long as the system timing is supportive. Suppression in the area is another example of a plant feature that could be credited to allow more time for detection of the fire.

EGR-NGGC-0102 Rev. 6 Page 66 of 92

ATTACHMENT 3 Sheet 18 of 18 Manual Action Feasibility Assessment Criteria Basis: There is an assumed, unspecified time delay between the initiation of the fire and the receipt of the first alarm. A low energy fire that results in a delay of the fire alarm is assumed to have a commensurate delay in causing the spurious actuation. Therefore the exact timing of the start of the fire is typically not needed. The safe shutdown procedures do not require immediate shutdown upon the receipt of a fire alarm. The fire area complexity (high, medium, or low) drives the type of operations procedure used.

At a subsequent, unspecified time, a spurious operation (mal-operation) occurs or the entry condition(s) for a directive shutdown procedure is met (see fire area complexity definitions above). This is represented as tsp. The plant shutdown is initiated in accordance with plant procedures (trt).

Actions that are pre-emptive in nature are taken after tal..

The plant transient is mitigated with the credited success path identified to continue safe shutdown (tgr).

Note: It is recognized that parameters relative to SSA performance goals may trend outside the desired range (tglst) during the event. Operations personnel will continue to respond to the fire-induced transient by maintaining and/or returning the plant to the desired conditions to meet the performance goals (tgr) and thereby avoiding unrecoverable conditions or equipment damage (tun). FP licensing condition change evaluation may be necessary for some indications out of range even though an unrecoverable condition (fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary) did not occur. (An example is pressurizer level that must be maintained per 10CFR50 Appendix R III L requirements (or the guidance of NUREG-0800, Section C.5.c) for Fire Areas that credit alternate shutdown strategies.

Some cases have NRC approval generically such as the BWR reactor water level when SRVs and low pressure systems are credited.)

NRC interim criteria in Step 4.1.2 above allows:

Analyses of the postulated fire time line shall demonstrate that there is sufficient time to travel to each action location and perform the action required to support the associated shutdown function(s) such that an unrecoverable condition(s) does not occur.

Basis: While the time for diagnosis will vary, the important timeframe to be considered is the time to goal recovery after the Operator Action (s) such that the plant does not reach an unrecoverable condition nor is there unrecoverable equipment damage. 10CFR50 Appendix R III L requirements shall, or the guidance of NUREG-0800 Section C.5.c should, be maintained when applicable. The Operations timeline will be measured from reactor trip until the transient is mitigated. The plant transient timeline will be developed from time of the spurious actuation to the time the plant is placed in an unrecoverable conditions or unrecoverable equipment damage.

The determination that the time to perform an operator action is acceptable will be based on successfully reaching tgr prior to reaching tun.

EGR-NGGC-0102 Rev. 6 Page 67 of 92

ATTACHMENT 4 Sheet 1 of 22 Fire Induced Circuit Failure - Circuit Analysis Table of Contents 1.0 Purpose .............................................................................................................. 69 2.0 Definitions ........................................................................................................... 69 3.0 Background......................................................................................................... 73 3.1 Licensing Basis and Design Methodology .......................................................... 74 3.2 Results of EPRI / Sandia Circuit Testing ............................................................ 74 3.3 NRC February, 2003, Circuit Analysis Workshop Results .................................. 75 3.4 NRC Risk Informed Post-Fire Safe-Shutdown Associated Circuit Inspections ... 76 4.0 Progress Energy Position ................................................................................... 78 5.0 Impact Progress Energy Position on Post-Fire Safe Shutdown Analysis Methodology .................................................................................................... 79 5.1 System and Equipment Selection and Success Path Identification.................... 79 5.2 Cable Selection / Circuit Analysis ....................................................................... 79 5.3 Fire Area Nuclear Safety Evaluation (Area Analysis) and Resolution Strategies 80 6.0 References ......................................................................................................... 81 EGR-NGGC-0102 Rev. 6 Page 68 of 92

ATTACHMENT 4 Sheet 2 of 22 Fire Induced Circuit Failure - Circuit Analysis 1.0 Purpose This document states the Progress Energy (PE) Fleet position on Fire Induced Circuit Failure Analysis (FICF) issues. Specifically, this document correlates the results of the NEI Circuit Testing effort, a subsequent NRC workshop and the resulting NRC draft inspection guidance with the impact on the following aspects of the post-fire Safe Shutdown Analysis tasks:

Formatted: Indent: Left: 0",

System / Equipment Selection and Success Path Identification Bulleted + Level: 1 + Aligned at:

0.5" + Tab after: 0.75" + Indent at:

Circuit selection / analysis 0.75", Tabs: Not at 0.75" Mitigating consequences on a fire area basis. Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

Further, this document provides the PE interpretation of the issues and outlines the Indent at: 0.25", Tabs: Not at 0.25" approach to their resolution.

2.0 Definitions Associated Circuit: In the context of Fire Protection (FP) safe shutdown analysis, Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

an associated circuit is defined as any circuit that can, through adverse interaction, Indent at: 0.25", Tabs: Not at 0.25" indirectly affect proper operation of critical equipment/systems due to a shared power supply, shared raceway, or spurious operation. Associated circuits result as a consequence of:

Formatted: Indent: Left: 0.25",

o Inadequate electrical coordination (common power supply associated circuit) Bulleted + Level: 2 + Aligned at:

0.75" + Tab after: 1" + Indent at:

o Inadequate circuit over-current protection (common enclosure associated circuit) 1", Tabs: Not at 1" o Undesired component operation (spurious operation associated circuit)

Associated circuits are those circuits that are not necessarily required to operate safe shutdown equipment, but whose fire-induced mal-operation could have a detrimental impact on the safe shutdown capability. Note that for some cases, an associated circuit for one function is also a required cable for a different function.

Cable: In this context, the term cable refers to assemblies designed to conduct Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

electrical current. Hence, a cable is an assembly of one (single-conductor cable) or more Indent at: 0.25", Tabs: Not at 0.25" (multi-conductor cable) insulated electrical conductors (generally copper or aluminum) that may or may not be surrounded by an outer jacket. (This definition excludes fiber-optic type cables that are not of interest in the current context.)

Cable Failure: A cable that is unable to perform its required function.

EGR-NGGC-0102 Rev. 6 Page 69 of 92

ATTACHMENT 4 Sheet 3 of 22 Fire Induced Circuit Failure - Circuit Analysis Cable Failure Mode: The mode by which a conductor or cable fails due to a fire. The four modes of cable failure are:

o A loss of conductor continuity is a physical break in the conductor that will result in electrical energy being unable to reach the intended circuit destination (i.e., an open circuit).

o A short circuit of one or more conductors to ground results in the diversion of electrical energy to ground. Electrical ground may be either external to the cable or one or more of the cable conductors.

o A conductor-to-conductor short circuit without ground may result in the diversion of electrical energy from one conductor (the source conductor) to one or more unintended conductors (the target conductor(s)). In Fire Protection Circuit Analysis, this has been referred to as a hot short.

o Conductor insulation resistance degradation may result in the partial diversion of the available electrical energy to an unintended conductor path. Electrical ground may or may not be involved. In Fire Protection Circuit Analysis, this has been referred to as a high impedance fault.

Circuit Analysis: The process of identifying cables and circuits that, if damaged by Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

fire, could prevent a component of interest from operating correctly. Indent at: 0.25", Tabs: Not at 0.25" Concurrent Multiple Spurious Operations: In this context, concurrent means that multiple faults causing spurious operations occur at discrete points in time, but that they endure for a sufficient period of time that the spurious operations overlap.

Conductor-to-Conductor Short: An abnormal connection (including an arc) of relatively low impedance between two conductors. A conductor-to-conductor short between an energized conductor of a grounded circuit and a grounded conductor results in a ground fault. A conductor-to-conductor short between an energized conductor and a non-grounded conductor results in a hot short.

Current Design Methodology (CDM): Current Safe Shutdown Analysis design methodology.

Fire Induced Circuit Failure (FICF) Effects (e.g. Circuit Failure Mode): The Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

manner in which a circuit fault is manifested in the circuit. Circuit failure modes include Indent at: 0.25", Tabs: Not at 0.25" loss of motive power, loss of control, loss of or false indication, open circuit conditions (e.g., a blown fuse or open circuit protective device), and spurious operation.

Ground Fault: Synonymous with short-to-ground.

EGR-NGGC-0102 Rev. 6 Page 70 of 92

ATTACHMENT 4 Sheet 4 of 22 Fire Induced Circuit Failure - Circuit Analysis Hot Short: A conductor-to-conductor short in which an energized conductor (source Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

conductor) shorts to a separate, ungrounded conductor (target conductor). In Fire Indent at: 0.25", Tabs: Not at 0.25" Protection Circuit Analysis, a hot short is characterized by an abnormal connection between conductors that does not produce a high fault current because of inherent impedance in the connection path attributable to circuit components. A defining characteristic of a hot short is that it is not detectable by normal circuit protective devices and thus will not trigger an over-current protective action. A hot short has the potential to cause undesired energization of components connected to the target conductor (i.e.,

spurious operation); however, the term hot short is not synonymous with the term spurious operation.

Hot Short, external: A hot short in which the source conductor and target conductor are from separate cables. Synonymous with inter-cable hot short and cable-to-cable hot short.

Hot Short, internal: A hot short in which both the source conductor and target conductor are of the same multi-conductor cable. Synonymous with intra-cable hot short.

Intra-Cable Conductor-to-Conductor Short Circuit: A specific subset of conductor-to-conductor short circuit cable failures wherein all conductors involved in a given short circuit are within a single multi-conductor cable.

Inter-Cable Conductor-to-Conductor Short Circuit: A specific subset of conductor-to-conductor short circuit cable failures wherein the short circuit formed involves the conductors of two or more separate cables.

Open Circuit: A loss of electrical continuity in an electrical circuit, either intentional or unintentional. As applied to wire and cable, open circuit faults may result, for example, from a loss of conductor continuity or from the triggering of circuit protection devices (e.g., a blown fuse or open circuit breaker).

Required safe shutdown circuits: are those clearly required to support the operation of a credited post-fire safe shutdown component in a particular fire area.

Sequential Multiple Spurious Operations: In this context, sequential means that one fault causing a spurious operation is mitigated before being followed by another fault at a later time. This is synonymous to any and all one at a time.

Shield: A conductive sheath or wrap around an insulated conductor or group of conductors within a cable. A shield is typically formed of either a metallic ribbon, a braided sheath of metallic wires or a composite metal coated tape. Shields are commonly applied where electromagnetic interference is a potential concern, either as a source (e.g., power cable) or a target (e.g., control, communications and instrument cables).

EGR-NGGC-0102 Rev. 6 Page 71 of 92

ATTACHMENT 4 Sheet 5 of 22 Fire Induced Circuit Failure - Circuit Analysis Short Circuit (general): An abnormal connection (including an arc) of relatively low Formatted: Bulleted + Level: 1 +

Aligned at: 0" + Tab after: 0.25" +

impedance between two conductors or points of different potential. A short circuit might Indent at: 0.25", Tabs: Not at 0.25" involve a ground fault or hot short, as applied to control circuit failures.

Short-to-Ground: A type of short circuit involving an abnormal connection between a conductor and a grounded conducting medium. The grounding medium refers to any conduction path associated with the reference ground of the circuit. This might include structural elements (tray, conduit, enclosures, metal beams, etc) or intentionally grounded conductors of the circuit (neutral conductor).

Simultaneous Multiple Spurious Operations: In this context, simultaneous means that faults causing spurious operations occur at essentially the same moment in time.

Source Conductor: The energized conductor of a hot short - the conductor representing the source of energy.

Spurious Operation: An operational occurrence initiated (in full or in part) by the failure(s) of one or more components (including cables) in a system.

Target Conductor: The non-energized conductor of a hot short - usually connected to one or more circuit components.

Unrecoverable Condition: In this context, an unrecoverable plant condition is defined as one in which fuel damage has occurred or will likely occur given a postulated plant condition.

Unrecoverable Equipment Damage: In this context, unrecoverable equipment damage is damage to safe shutdown equipment that cannot be mitigated by subsequent (manual) actions. For example, the suction valve of the normally running charging pump closes (spurious operation). That charging pump has been credited for shutdown in that fire area and damage occurs before the condition can be mitigated.

EGR-NGGC-0102 Rev. 6 Page 72 of 92

ATTACHMENT 4 Sheet 6 of 22 Fire Induced Circuit Failure - Circuit Analysis 3.0 Background When the NRC commenced triennial Fire Protection Inspections in 1999, several licensees expressed concern that findings were being generated regarding their circuit analysis practices even when the plant was in compliance with its licensing basis. Since generic activities to resolve the circuit analysis issue were already underway, NRC agreed to temporarily cease inspection of certain circuit analysis issues until the generic resolution was finalized. (Industry efforts to resolve this issue include the EPRI / Sandia testing program.)

In February 2000, NRC issued Revision 2 of Enforcement Guidance Memorandum 98-002 (EGM-98-002). This revision temporarily halted inspection and enforcement of circuit analysis issues regarding associated circuits specifically, multiple spurious operations and circuit failures under NRC IN 92-18 (This Attachment does not address NRC Information Notice 92-18). NRC Fire Protection Inspection Procedure 71111.05 was also revised to reflect the moratorium on inspection of the associated circuit issue.

In the interim, NRC continued to inspect required safe shutdown circuits. Required safe shutdown circuits are those clearly required to support the operation of a credited post-fire safe shutdown component in a particular fire area. Associated circuits are those circuits that are not necessarily required to operate safe shutdown equipment, but whose fire-induced mal-operation could have a detrimental impact on the safe shutdown capability. Note that for some cases, an associated circuit for one function is also a required cable for a different function.

To resolve this issue, the industry developed NEI 00-01, Guidance for Post-fire Safe Shutdown Analysis, to address the underlying technical and licensing FICF issues. The NRC has indicated that they plan to endorse NEI 00-01 in the future (likely with certain limitations). At this time, the industry resolution path on circuit analysis issues will be a result of the NRC endorsement of and clarifications provided to NEI 00-01.

In March, 2004, the NRC issued NRC RIS 2004-03, Risk Informed Approach for Post-Fire Safe-Shutdown Associated Circuit Inspections which was incorporated into the Progress Energy circuit analysis methodology. However, there were no methodology changes as a result of the issuance of the RIS.

This attachment will be updated and adapted as appropriate as new regulatory guidance is issued.

EGR-NGGC-0102 Rev. 6 Page 73 of 92

ATTACHMENT 4 Sheet 7 of 22 Fire Induced Circuit Failure - Circuit Analysis 3.1 Licensing Basis and Design Methodology In each Progress Energy (PE) Safe Shutdown Analysis (SSA), the current design methodology typically follows the sequential (any and all one at a time) philosophy of handling SSA fire induced circuit failures. There are exceptions and clarifications to the current methodology at the different PE sites that are detailed in the supporting program documentation such as NRC SERs. Progress Energy is adding additional steps to the fleet SSA methodology to address the results and insights gained from the EPRI / SANDIA Circuit testing (specifically multiple hot shorts and the resulting spurious operations). These revisions are identified as the revised design methodology in this position paper. The CDM in the table is not necessarily the current design basis for each PE site.

Progress Energy will track and identify additional Fire Area casualties that result due to the revised design methodology. In addition to the use of traditional design strategies (fire barriers, cable reroutes, separation, etc.), Risk Informed (RI) techniques such as those identified in NEI 00-01 or NFPA 805 and its proposed implementing guidance may be used to address any such new casualties.

3.2 Results of EPRI / Sandia Circuit Testing The results of the EPRI / Sandia Circuit Testing can be summarized in terms of cable failure modes, FICF effects (circuit failure modes) and cable attributes.

The cable failure modes (see definitions above) may result in various FICF effects (circuit failure modes). The cable attributes can be related to the cable failure modes observed during the EPRI fire testing program. For ease of discussion, the FICF effects can be summarized based upon circuit type (i.e., power, control, and instrumentation).

Power circuits:

Loss of primary or motive power to a system or component (due to either open circuits or short circuits including ground)

Hot shorts leading to spurious operation(s)

Multiple high impedance faults Control/Indication Circuits:

Loss of control function or power (due to either open circuits or short circuits including ground)

Hot shorts leading to spurious operation(s)

Multiple high impedance faults Loss of control indications False control indications EGR-NGGC-0102 Rev. 6 Page 74 of 92

ATTACHMENT 4 Sheet 8 of 22 Fire Induced Circuit Failure - Circuit Analysis Instrumentation circuits:

Failed instrument readings (high or low)

Erratic instrument measurement readings Cable failure modes may be related to cable attributes. Examples of cable attributes are conductor size, number of conductors within a cable, insulation type, raceway type, etc.

These relationships, where known, are described in Table 1.

3.3 NRC February, 2003, Circuit Analysis Workshop Results The purpose of this workshop was to develop inspector guidance to resume inspections of associated circuits during NRC FP triennial inspections.

The task of the workshop panel was to review the various cable failure modes and circuit failure effects (such as single spurious operation, multiple spurious operations, multiple high impedance faults (MHIFs), etc.) with the EPRI / Sandia fire test data (including cable attributes). Using this information as input, the panel then ranked the issues on their potential importance to safety. Issues were binned based on the panels discussion into one of three groups (as defined at the workshop):

Bin 1 Areas where inspection should focus. Items may have risk significance; however, plant-specific information will still have a large role in determining the risk significance.

Bin 2 Areas where more discussion or research is required to better understand risk. Inspections will not resume for these items until they are better characterized and moved to Bin 1 or Bin 3. Specific plans for research have not been identified.

Bin 3 Areas where inspections need not be performed. There is ample evidence that none of the items in this bin will be risk significant. Items in this bin are characterized as low risk.

Additional notes from the NRC workshop provided here as background information:

1. This guidance is not applicable to licensing basis Safe Shutdown Analysis (SSA) Formatted: Indent: Left: 0",

Numbered + Level: 1 + Numbering methodology. Licensee would still need to meet Current Licensing Basis (CLB) even if it Style: 1, 2, 3, + Start at: 1 +

is in Bin 3. Alignment: Left + Aligned at: 0.25"

+ Tab after: 0.5" + Indent at: 0.5",

2. Safety Significant items (e.g., spurious operations) need to be addressed even if Tabs: 0.25", List tab + Not at 0.5" beyond CLB.

3. NRC will likely issue a Regulatory Guide to endorse NEI 00-01. The process will start when the final NEI 00-01 draft is issued. The NRC endorsement will likely be with exceptions.

EGR-NGGC-0102 Rev. 6 Page 75 of 92

ATTACHMENT 4 Sheet 9 of 22 Fire Induced Circuit Failure - Circuit Analysis

4. The draft NUREG issued by NRC in December 2002 was intended to be a historical Formatted: Indent: Left: 0",

Numbered + Level: 1 + Numbering document only to capture information from several sources. It is not intended to be used Style: 1, 2, 3, + Start at: 1 +

in the future. Alignment: Left + Aligned at: 0.25"

+ Tab after: 0.5" + Indent at: 0.5",

5. Given certain cable attributes some cable failure modes are not likely to occur. For Tabs: 0.25", List tab + Not at 0.5" example, cable-to-cable shorts in armored cable are not probable and similar shorts in thermoset cable are not considered a particularly high-probability event. This same short in thermoplastic cable requires more analysis. Plants will need to capture and document the cable construction of their safe shutdown and associated circuits in the future.

The NRC issued an internal summary of results of the workshop via memorandum on March 19, 2003. This memorandum transmitted the proposed input for risk-informing the inspector guidance for post-fire safe shutdown associated circuits.

3.4 NRC Risk Informed Post-Fire Safe-Shutdown Associated Circuit Inspections The NRC formalized the results of the February 19, 2003 Workshop in a Federal Register Notice. A summary of the Regulatory Issue Summary (RIS) that the NRC planned to issue was presented at the NEI Fire Protection Information Forum in Baltimore in September 2003. NRC RIS 2004-03, Risk Informed Approach for Post-Fire Safe-Shutdown Associated Circuit Inspections was formally issued on March 2, 2004. The pertinent information from NRC presentation and the RIS is presented below.

MOST RISK SIGNIFICANT FAILURES RELATIVE TO TIMING Failures that impede hot shutdown within the first hour of event CABLE FAILURES TO CONSIDER - High Risk Scenarios (Bin 1)

Two cable failures per scenario Intra - cable failure for Thermoset and Thermoplastic (up to 3-4 circuit failures)

Any number of conductors/combinations possible within a cable with multiple components Inter - cable failures possible for Thermoplastic cable ISSUES REQUIRING FURTHER RESEARCH - Moderate Risk (Bin 2)

Inter - cable shorting of Thermoset cables or Thermoset to Thermoplastic cables Three or more cable configurations needed for the necessary spurious operations to cause the adverse plant conditions to occur Effects of control power transformers (Possible power limiting benefits are not credited at this time. These circuits are conservatively treated as any other control circuit.)

EGR-NGGC-0102 Rev. 6 Page 76 of 92

ATTACHMENT 4 Sheet 10 of 22 Fire Induced Circuit Failure - Circuit Analysis ISSUES REQUIRING FURTHER RESEARCH - Moderate Risk (Bin 2) continued Duration of hot shorts (Not credited by PE in this paper. Cable test data [Ref 1]

indicates that the duration of a hot short is limited; PE general methodology is to conservatively assume the hot short is maintained until an action is taken to mitigate its affects.)

ISSUES REQUIRING FURTHER RESEARCH - Low Risk (Bin 3)

Open circuits Inter - cable shorting involving conduits and armored cable Multiple high - impedance faults common power supply Three-phase failures occurring with proper polarity Reversible DC-motor power cable Example: Use of Criteria Established by Bins Above C

A B

Given this example, the Inspection Guidance would lead to the following conclusions:

Stop evaluation at two cables per scenario If 1 cable contains conductors for all 3 components (A, B, and C), then all 3 could spuriously operate If 2 cables contain conductors for all 3 components (A, B, and C) then all 3 could spuriously operate If 3 cables contain conductors for all 3 components (A, B, and C) then the spurious operation of all 3 would not be postulated EGR-NGGC-0102 Rev. 6 Page 77 of 92

ATTACHMENT 4 Sheet 11 of 22 Fire Induced Circuit Failure - Circuit Analysis 4.0 Progress Energy Position Progress Energy will address Bin 1 issues in the SSA. Care will be exercised to distinguish between the current and revised design methodologies.

Progress Energy will address Bin 2 issues in the SSA on a case-by-case basis. Specific item resolutions will be stated and justified for each issue or group of related issues. Care will be exercised to distinguish between the current and revised design methodologies items.

Progress Energy will only address Bin 3 issues in the SSA for the current design methodology. If Bin 3 items are in the current design methodology, PE may initiate design basis changes to remove them. Progress Energy will maintain current licensing basis compliance until the design documents are appropriately revised and approved.

For the purposes of this position, with the exception of hi/lo pressure boundaries, Progress Energy considers sequential spurious operations any and all, one at a time to be the current design methodology. Multiple spurious operations (concurrent) are considered current design basis for hi/lo pressure boundary valves. For all other multiple cable failures and spurious operations, Progress Energy will identify and track the changes in the SSA.

Protection issues that arise will be addressed as appropriate including the use of risk-informed (RI) techniques.

EGR-NGGC-0102 Rev. 6 Page 78 of 92

ATTACHMENT 4 Sheet 12 of 22 Fire Induced Circuit Failure - Circuit Analysis 5.0 Impact Progress Energy Position on Post-Fire Safe Shutdown Analysis Methodology The PE approach to address multiple hot shorts and spurious operations is addressed in the section that follows. Known FICF effects are listed in Table 1 below. They have been binned per the criteria established at the NRC Circuit Analysis Workshop. While it is understood that these bins were established for inspection purposes, they provide useful input into deciding the potential significance of items in the bins.

Figure 1 is a flow chart of the post-fire safe shutdown process and the impact of Fire Induced Circuit Failure during specific SSA tasks. As identified in the purpose above, the resolution of FICF issues manifests itself in different tasks of the post-fire SSA methodology.

The related SSA tasks are discussed below and the impact of the PE position to resolve the FICF on that task is discussed. These impacts are also included in the Table 1.

Relevant information will be identified and carried forward in the circuit and fire area analyses to ensure that equipment, conditions, impact and mitigating attributes have been identified and fully understood.

5.1 System and Equipment Selection and Success Path Identification In general, there is no change to the selection of plant equipment and the identification of success paths. However during the development of the safe shutdown success logic, bounding combinations of spurious operations where the resultant multiple spurious combinations would place the plant in an unrecoverable condition or result in unrecoverable damage to equipment will be identified. An example of this would be the closure of a suction valve to a running pump that is the credited path in a particular fire area.

These combinations will be identified on the system and component level logics, as required, for further evaluation during the fire area analysis tasks. Section 5.3 provides the methodology of how to analyze the combinations.

Section 5.1 is related to Steps 1 and 2 in Figure 1.

5.2 Cable Selection / Circuit Analysis Information that is required to support new circuit analysis criteria will be identified to ensure that new compliance issues identified can be attributed to current design methodology or revised design methodology:

Collect cable type information and add into SSA database.

Formatted: Indent: Left: 0.25",

• Application: power, control, instrumentation Bulleted + Level: 2 + Aligned at:

0.75" + Tab after: 1" + Indent at:

• Type: armor, thermoset or thermoplastic, shielding type; 1", Tabs: Not at 1"

• Basic Construction: conductor size and conductor count; EGR-NGGC-0102 Rev. 6 Page 79 of 92

ATTACHMENT 4 Sheet 13 of 22 Fire Induced Circuit Failure - Circuit Analysis Consider multiple circuit faults (including hot shorts) when performing cable selection for a specific component. Identify as such any new conductors selected only as a result of considering multiple hot short circuit failures.

Document information concerning the design of the circuit (i.e., no normally energized conductor within a cable) in the circuit analysis worksheets.

Section 5.2 is related to Steps 3 and 4 in Figure 1.

5.3 Fire Area Nuclear Safety Evaluation (Area Analysis) and Resolution Strategies The PE position utilizes a screening process in the fire area analysis step of the SSA to focus on redundant functions as a means of providing defense-in-depth for those cable attributes and failure characteristics that are still not fully understood due to the limited scope of the available test data. This screening process also recognizes that some of the items included in Table 1 are beyond current design methodology; for these situations, risk-informed (RI) techniques may be used to obtain clear insight into the actual risk posed by the identified condition.

Add the following criteria to incorporate new FICF positions into the PE SSA methodology.

(Note that all except the first of these positions below are beyond current design methodology):

For components whose loss from the fire area of concern does not result in unrecoverable damage to equipment or an unrecoverable plant condition, the loss will follow current design methodology and be postulated sequentially.

For components whose loss from the fire area of concern results in unrecoverable damage to equipment or an unrecoverable plant condition, the losses due to up to 2 spurious operations will be postulated concurrently. [CAPR - see Reference 9, AR 111308]

Perform a query of the FP cable database to identify all cables associated with multiple components. In each fire area where these cables are located, postulate concurrent spurious operation of all components associated with the multi-conductor, multi-component cable. For those concurrent interactions identified resulting in an unacceptable outcome, utilize one of the compliance strategies from Appendix R Section III.G.2 (or NUREG 800), or perform fire modeling to determine if damage to the cables occur. specific cable types are met. Section 5.3 is related to Steps 5 and 6 in Figure 1.

EGR-NGGC-0102 Rev. 6 Page 80 of 92

ATTACHMENT 4 Sheet 14 of 22 Fire Induced Circuit Failure - Circuit Analysis 6.0 References

1. EPRI FICF test data, EPRI Reports 1003326, Characterizations of Fire Induced Cable Faults, and 1006961, Spurious Actuation of Electrical Circuits Due to Cable Fires:

Results of an Expert Elicitation

2. Sandia test data, NUREG/CR-6776

3. NRC February 2003 Workshop Minutes (from PE, NRC, NEI)

4. NEI 00-01, Guidance for Post-Fire safe Shutdown Analysis, Rev 0, 5/2003

5. NRC 3/19/2003 Inspection Guidance letter

6. NRC Draft Regulatory Issue Summary (RIS), Risk-Informed Inspection Guidance for Post-Fire Safe-Shutdown Inspections, Federal Register Notice 49529, dated 8/18/2003

7. NRC presentation material, September, 2003 NEI information forum

8. NRC RIS 2004- 03 Risk Informed Approach for Post-Fire Safe-Shutdown Associated Circuit Inspections Issued to the public on March 3, 2004

9. AR111308, Time Transient Conditions for Appendix R Initiated on 11/19/03 EGR-NGGC-0102 Rev. 6 Page 81 of 92

ATTACHMENT 4 Sheet 15 of 22 Fire Induced Circuit Failure - Circuit Analysis Table 1: Issue Definitions and Resolutions B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions All Circuits 1 Open Circuit Y 3 An open circuit de-powers N/A N/A or disconnects control from the device. It cannot cause a spurious operation of an associated circuit.

Required circuits are covered by positive controls.

2 Inter-cable shorts Y 3 This failure mode is N/A N/A involving virtually impossible to conductors of achieve without first one cable within shorting to a grounded a conduit and the surface.

conductors of any other cable outside the conduit.

3 Inter-cable shorts Y 3 Essentially the same as N/A N/A involving armored Item 2 above.

or metallically shielded cable.

Power 4 AC hot shorts of Y 3 In theory, three-phase Steps 3 & 4 N/A the proper phase proper polarity hot short Cable Selection/Circuit rotation on power power cable failures could Analysis cables of AC cause a three-phase Current design MOVs. device to spuriously methodology is operate. However, such consistent. No change.

failures are considered of very low likelihood Steps 5 & 6 because the three distinct Fire Area Analysis phases of power would Current design have to align with the methodology is proper phase to operate. consistent. No change.

Progress Energy will continue to include the special case of high-low pressure interface valves.

EGR-NGGC-0102 Rev. 6 Page 82 of 92

ATTACHMENT 4 Sheet 16 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 5 DC hot shorts of Y 3 Essentially the same as Steps 3 & 4 N/A the proper AC MOVs above. While Cable Selection/Circuit polarity on power DC systems have only 2 Analysis cables of DC poles, such failures are Current design MOVs. considered unlikely methodology Area because there are also Analysis consistent. No shunts and fields change.

requiring five separate conductors to have the Steps 5 & 6 correct polarity and Fire Area Analysis sequence in order to operate. Current design methodology is Progress Energy will consistent. No change.

continue to include the special case of high-low pressure interface valves.

6 Multiple High Y 3 NRC agreed that there Steps 3 & 4 Retire MHIF Impedance are few if any cases Cable Selection/Circuit analysis.

Faults (MHIF) where this is a concern. Analysis Note:

Document Although such faults have Initiate CDM change to that all been considered using remove this high/low deterministic methods for commitment. pressure critical safe shutdown Document the technical interface circuits, such faults are basis for excluding a valves fail-considered of very low detailed circuit analysis safe and likelihood and often can for High Impedance thus are not be readily overcome by Faults using NEI 00-01, subject to manual operator actions Appendix B.2. Maintain MHIF should they occur. compliance until licensing concern.

basis is changed. This (removing commitment to MHIF) is a change to the current design methodology.

EGR-NGGC-0102 Rev. 6 Page 83 of 92

ATTACHMENT 4 Sheet 17 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions Control/Indication 7A Intra-cable Y 1 This is the typical MOV Steps 3 & 4 N/A shorts. Single hot control cable example. Cable Selection/Circuit short within multi- Analysis conductor Current design thermoset or methodology is thermoplastic consistent. No change.

control cable.

Steps 5 & 6 7

2 3 Fire Area Analysis 1

6 5

4 Any and all one at a time philosophy used in the Cable 1 Area Analysis bounds this item. No change.

Single hot short within 1 cable.

7B Multiple N 1 Any and all potential Steps 3 & 4 Additional concurrent intra- spurious operations that Cable Selection/Circuit cable/equipm cable shorts. may occur concurrently Analysis ent casualties Multiple from a single fire. Each individual spurious during the occurrences of operation would have Area Analysis single shorts For cases involving the been previously captured (Step 5 and within individually potential failure of more (Item 7A). No change. 6). Potential distinct thermoset than one multi conductor that more or thermoplastic cable, a maximum of two Steps 5 & 6 cable control cable. concurrent spurious Fire Area Analysis protective operations will be Combine the effects of features will 2

3 2

3 assumed. the spurious operations. be required.

7 7 6

1 4 6 1

4 The new safety function Can use RI 5 5 See also Item 8C. screen is also applied if parts of the Cable 1 Cable 2 needed. Except for hi/lo screen to pressure interface, this resolve is a change to the because this Single hot short current design is beyond within each cable CDM.

methodology.

up to a maximum of 2 cables involved.

EGR-NGGC-0102 Rev. 6 Page 84 of 92

ATTACHMENT 4 Sheet 18 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 8A Intra-cable N 1 For any individual Steps 3 & 4 Additional shorts. Multiple multiconductor cable Cable Selection/Circuit cable/equipm shorts within (thermoset or Analysis ent casualties single thermoset thermoplastic), any and Include multiple circuit during the or thermoplastic all potential spurious faults when performing Area Analysis control cable. actuations that may result cable selection. Identify (Steps 5 and (Applicable to from intra-cable shorting, that the new conductors 6). Potential multi-conductor, including any possible identified are a result of that more single component combination of this new requirement. cable and multi- conductors within the This is a change to the protective component cable, may theoretically current design features will cables.) be postulated to occur methodology. be required.

concurrently regardless of Can use RI 7

2 3

number. However, as a Steps 5 & 6 parts of the 6

1 4 practical matter, only a Fire Area Analysis screen to 5

few (three or four) of the Perform a query of FP resolve Cable 1 most critical postulated cable database to identify because this combinations will be all cables associated with is beyond Within Cable 1 up considered multiple components. CLB.

to 4 conductor to The screens associated conductor shorts with unrecoverable will be postulated. conditions and equipment damage are also applied if needed.

This is a change to the current design methodology.

EGR-NGGC-0102 Rev. 6 Page 85 of 92

ATTACHMENT 4 Sheet 19 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 8B Multiple N 1 For cases involving the Steps 3 & 4 N/A concurrent intra- potential failure of more Cable Selection/Circuit cable shorts. than one multiconductor Analysis Multiple cable, a maximum of two See Item 8A above. This occurrences of concurrent spurious is a change to the multiple shorts actuations should be current design within individually assumed. [CAPR - see methodology.

distinct thermoset Reference 9, AR 111308]

or thermoplastic For cases where more Steps 5 & 6 control cable. than two concurrent Fire Area Analysis spurious actuations can See Item 8A above. This 2 2 occur as the result of 7 3 7 3 is a change to the 1 1 intra-cable shorting within 6 4 6 4 current design 5 5 a single multiconductor Cable 1 Cable 2 cable they should be methodology.

considered. The consideration of Up to 2 cables concurrent spurious will be postulated. operations in more than two cables will be deferred pending additional research.

EGR-NGGC-0102 Rev. 6 Page 86 of 92

ATTACHMENT 4 Sheet 20 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 8C DC hot shorts of N 1 Postulate the potential Step 2 Additional the proper spurious operation of a Cable Selection/Circuit cable/equipm polarity on control direct current (DC) circuit Analysis ent hits cables of DC given failures of the Include proper polarity during the circuits. associated control cables hot shorts for DC control Area Analysis even if the spurious circuits when performing (Step 4).

operation requires two cable selection if the Potential that concurrent hot shorts of failure mode could occur more cable the proper polarity (e.g., as a result of intra-cable protective plus-to-plus and minus- shorting. Identify that the features will to-minus) provided the new conductors identified be required.

required source and are a result of this new Can use RI target conductors are requirement. This is a parts of the each located within the change to the current screen to same multiconductor design methodology. resolve cable. because this Step 3 is beyond Fire Area Compliance CDM.

The screens associated with unrecoverable conditions and equipment damage are applied if needed. This is a change to the current design methodology.

EGR-NGGC-0102 Rev. 6 Page 87 of 92

ATTACHMENT 4 Sheet 21 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 9 Inter-cable (cable Y 2 Inter-cable shorting Steps 3 & 4 No additional to cable) shorts in between thermoset Cable Selection/Circuit equipment or thermoset control cables is considered to be Analysis cable losses cable. substantially less likely For future information, expected.

than intra-cable shorting. collect data on cable type Potentially (Single and Hence, the potential and susceptibility of fewer Multiple spurious operation issues circuit design to intra- spurious occurrences of involving inter-cable cable hot shorts. Current operations.

inter-cable shorting for thermoset design methodology does shorts.) cables is being deferred not identify the source of Data will be a pending additional the hot short (i.e., intra benefit for 7

2 3 7 2

3 research. or inter cable); therefore, resolution of 6

1 4 6 1

4 it is conservative with future issues 5 5 Note: Inter-cable shorting respect to this item. No and for Fire Cable 1 Cable 2 between thermoplastic change. PRA.

and thermoset cables is considered less likely Steps 5 & 6 Cable 1 shorting than intra-cable shorting Fire Area Compliance to Cable 2. of either cable type or Current design inter-cable shorting of methodology is Conductor-to- thermoplastic cables. conservative with respect conductor shorts The spurious actuation to this item.

within Cable 1 issues involving inter-and 2 cable shorting between Initiate CDM change to thermoplastic and remove this thermoset cables is commitment.

therefore being deferred Include parallel path to pending additional address occurrences of research. this factor until CDM is changed. Reference NEI 00-01 for the basis.

Maintain compliance until licensing basis is changed. This is a change to the current design methodology.

EGR-NGGC-0102 Rev. 6 Page 88 of 92

ATTACHMENT 4 Sheet 22 of 22 Fire Induced Circuit Failure - Circuit Analysis B Probable Cable Failure Comments And General Impacted Post-Fire Safe CDM i Outcome Item Mode & Related Discussion Shutdown Analysis (Y/N) n Due to New Cable Attribute EPRI / Sandia Testing Task

• Positions 10 Inter-cable (cable Y 1 For any thermoplastic Steps 3 & 4 No additional to cable) shorts in cable, any and all Cable Selection/Circuit equipment or thermoplastic potential spurious Analysis cable losses control cable. actuations that may result For future information, expected.

from intra-cable and inter- collect data on cable type Potentially (Single and cable shorting with other and susceptibility of fewer Multiple thermoplastic cables, circuit design to intra- spurious occurrences of including any possible cable hot shorts. Current operations.

inter-cable combination of design methodology does shorts.) conductors within or not identify the source of Data will be a between the cables, may the hot short (i.e., intra benefit for 7

2 3 7 2

3 be postulated to occur or inter cable); therefore, resolution of 6

1 4 6 1

4 concurrently regardless of it is conservative with future issues 5 5 number. respect to this item. No and for Fire Cable 1 Cable 2 Note: Cables of concern change. PRA.

must be routed in raceway with other cables Steps 5 & 6 Cable 1 shorting for this to be of concern. Fire Area Compliance to Cable 2. (See Item 2 above.) Current design methodology is Conductor-to- Note: Inter-cable shorting conservative with respect conductor shorts between thermoplastic to this item.

within Cable 1 and thermoset cables is and 2. considered less likely Initiate CDM change to than intra-cable shorting remove this of either cable type or commitment.

inter-cable shorting of Include parallel path to thermoplastic cables. address occurrences of The spurious actuation this factor until CDM is issues involving inter- changed. Reference NEI cable shorting between 00-01 for the basis.

thermoplastic and Maintain compliance until thermoset cables is licensing basis is therefore being deferred changed. This is a pending additional change to the current research.

design methodology.

Instrumentation 11 All Y 1 Assume instrument N/A N/A failure. Alternate instrumentation or indication is required.

EGR-NGGC-0102 Rev. 6 Page 89 of 92

REVISION

SUMMARY

The following changes were made in EGR-NGGC-0102, Revision 4:

• Revised process to clearly indicate the undesirability of manual actions in lieu of physical Fire Protection approaches and to ensure NRC approval is obtained prior to crediting certain manual actions in the Fire Safe Shutdown Analysis.

• Made the following specific changes:

o As part of this change, revised Figure 2, Question #5, to read "Determine if the change affects or creates a manual operation." Revision tracking shows entire Figure as being revised, so a revision bar not used on this figure.

o Added note and step 5 to Section 9.2.1.

o Revised Step 1.3 Attachment 1 to include clarification of type of manual action affected (existing affected, new, or deletion).

o Added manual action to Disposition section of Attachment 1.

The following changes were made in EGR-NGGC-0102, Revision 5:

This revision incorporates PRR 141727.

• Incorporated Progress Energy SSA position papers as new Attachment 3 and Attachment 4. This is required per NCR 80340-29.

• Added minor clarifications to the procedure as suggested by reviewers. Latest revisions of position papers (Attachments 3 and 4) approved by the Fire Protection Program Team and management are included. Only used revision bars for the minor clarifications in the new attachments. .

• Added references to CR3 procedures: NEP-218, Fire Protection and Appendix R Safe Shutdown Capability Design Considerations.

• Added screening question 1.10 to Attachment 1 to highlight this expectation.

This provides a question to specifically ensure changes that affect inputs or results of SSD related calculations are reviewed under the SSA review checklist.

This is not a new requirement.

EGR-NGGC-0102 Rev. 6 Page 90 of 92

REVISION

SUMMARY

The following changes were made in EGR-NGGC-0102, Revision 5 (Continued):

• Added reference to RNP AR111308, Time Transient Conditions for Appendix R initiated on 11/19/03 at RNP during development of baseline Manual Action Feasibility analysis for EC 53219. AR action 17 requires updating this paper to provide a reference to the AR. This paper, which is utilized as an input into the ongoing PE Fleet SSA projects, is credited in the AR as corrective actions to prevent reoccurrence. This does not change the methodology in this paper.

Action required per AR 111308 assignment 17: This was part of the revision 2 of the position paper that is Attachment 2 of this revision.

Revise NGGC Fire Protection Technical Position Paper on Fire Induced Circuit Failure - Circuit Analysis to reference this NCR and link this NCR with the appropriate steps in position paper requiring that two concurrent spurious mal-operations are to be considered in Appendix R analyses.

The following changes were made in EGR-NGGC-0102, Revision 6:

• Added Section 1.2 to address the need for the Safe Shutdown Reviewer and Fire Protection Engineer to consider the potential impact and/or benefit of NFPA 805 becoming part of the plants fire protection licensing basis when reviewing major changes to the licensing basis.

• Added four (4) action requests to Reference 2.13 that were addressed in this revision of the procedure.

• Revised wording of NOTE under section 9.2.1.4 to identify that actions still need to meet Attachment 3 criteria.

• Added clarification to Attachment 3, Step 5.3.2, Evolution of Timeline, those 10CFR50 Appendix R III L requirements must be maintained for Fire Areas that credit shutdown outside the control room. Also included appropriate reference to equivalent NUREG-0800 sections This is per CORR AR 136517-10.

• Added clarification to Attachment 3, Step 4.4, Equipment Pre-conditions, that Information Notice 92-18 issues at all points in the MCC circuit, including inside the MCC Cubicle, as well as for electrical operation of MOV from a remote location, needs to be addressed by the analysis. This is per CORR AR 148225-18.

• Added clarification to Attachment 3, Step 4.3.2, Environmental Considerations, and Table 4-1, that adjacent areas to the Fire Area of concern must be treated similar to the Fire Area of concern when Firefighting activities or other activities require the areas to be open to each other. This is per CORR AR 149509-12.

• Table 4-1: Deleted reference to Table 4.2, Tenability Acceptance Criteria, that was deleted in a previous revision to Attachment 3, Step 4.3.2, Environmental Considerations.

• Table 4-2: Revised wording for Items 2 and 3.

EGR-NGGC-0102 Rev. 6 Page 91 of 92

• Figures have been added to Table of Contents. This is per CORR AR 103982.

• Added references to Section 2.0.

• Revised wording in Attachment 3, Section 2.2.1, to include previously unapproved.

• Attachments 1 and 2 revised to add consideration for NFPA 805.

• Minor editorial and grammatical changes to improve clarity and readability.

EGR-NGGC-0102 Rev. 6 Page 92 of 92