ML20231A835

Draft Regulatory Guide DG-1359, Fire Protection for Nuclear Power Plants

ML20231A835
Person / Time
Issue date:	11/30/2020
From:	Office of Nuclear Regulatory Research
To:
References
DG-1359 RG-1.189, Rev. 4
Download: ML20231A835 (132)

Text

U.S. NUCLEAR REGULATORY COMMISSION DRAFT REGULATORY GUIDE DG-1359 Proposed Revision 4 to Regulatory Guide 1.189 Issue Date: November 2020 Technical Leads: Charles Moulton and Shivani Mehta FIRE PROTECTION FOR NUCLEAR POWER PLANTS A. INTRODUCTION Purpose This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) to meet the regulatory requirements of Title 10 of the Code of Federal Regulations (10 CFR) section 50.48(a) and (b) (Ref. 1), and 10 CFR Part 50, Appendix R, Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979 (Ref. 2). These regulations state the requirements governing a civilian nuclear power generating plants fire protection program (FPP).

Applicability This RG applies to reactor licensees or applicants subject to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities and 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 3). Since not all of the fire protection regulations promulgated by the NRC apply to all plants, licensees should refer to their plant-specific licensing bases to determine the applicability of a specific regulation to their plant.

Applicable Regulations

• 10 CFR Part 50 provides regulations for licensing production and utilization facilities.

o 10 CFR 50.48, Fire protection, requires each operating nuclear power plant to have a fire protection plan that satisfies General Design Criterion (GDC) 3, Fire protection, in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50. The regulation specifies the contents of a fire protection plan and lists the basic fire protection guidelines for the plan.

o 10 CFR 50.48(b) states that Appendix R to 10 CFR Part 50 establishes fire protection features required to satisfy GDC 3 of Appendix A to 10 CFR Part 50 with respect to certain general issues for nuclear power plants licensed to operate before January 1, 1979.

This RG is being issued in draft form to involve the public in the development of regulatory guidance in this area. It has not received final staff review or approval and does not represent an NRC final staff position. Public comments are being solicited on this DG and its associated regulatory analysis. Comments should be accompanied by appropriate supporting data. Comments may be submitted through the Federal rulemaking Web site, http://www.regulations.gov, by searching for draft regulatory guide DG-1359. Alternatively, comments may be submitted to the Office of Administration, Mailstop: TWFN 7A-06M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN:

Program Management, Announcements and Editing Staff. Comments must be submitted by the date indicated in the Federal Register notice.

Electronic copies of this DG, previous versions of DGs, and other recently issued guides are available through the NRCs public Web site under the Regulatory Guides document collection of the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/. The DG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML20231A835. The regulatory analysis may be found in ADAMS under Accession No. ML20231A874.

o 10 CFR 50.48(b)(1) states that, with the exception of the requirements in Sections III.G, III.J, and III.O of Appendix R to 10 CFR Part 50, the provisions of Appendix R do not apply to nuclear power plants licensed to operate before January 1, 1979, to the extent that (1) Fire protection features proposed or implemented by the licensee have been accepted by the NRC staff as satisfying the provisions of Appendix A to BTP APCSB 9.5-1, reflected in NRC fire protection safety evaluation reports issued before the effective date of February 19, 1981; or (2) Fire protection features were accepted by the NRC staff in comprehensive fire protection safety evaluation reports issued before Appendix A to BTP APCSB 9.5-1was published in August 1976.

o 10 CFR 50.48(c) incorporates National Fire Protection Association (NFPA)

Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition (Ref. 4), by reference with certain exceptions and allows licensees to voluntarily adopt and maintain an FPP that meets the requirements of NFPA 805 as an alternative to meeting the requirements of 10 CFR 50.48(b) or the plant-specific fire protection license conditions. All currently licensed plants may voluntarily adopt a risk-informed, performance-based FPP in accordance with 10 CFR 50.48(c) and NFPA 805. However, the guidance provided in this RG does not apply for licensees who adopt 10 CFR 50.48(c). That guidance is contained in RG 1.205, Risk-Informed, Performance-Based Fire Protection for Existing Light-Water Nuclear Power Plants (Ref. 5), as discussed below in the related guidance section.

o 10 CFR Part 50, Appendix A, GDC 3, (Ref. 6), requires that structures, systems, and components (SSCs) important to safety be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Noncombustible and heat-resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and firefighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on SSCs important to safety. GDC 3 also requires that firefighting systems be designed to ensure that their rupture or inadvertent operation does not significantly impair the safety capability of these SSCs.

o 10 CFR Part 50, Appendix A, GDC 5, Sharing of structures, systems, and components, prohibits nuclear power units from sharing SSCs important to safety unless the licensees can show that such sharing will not significantly impair the units ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units.

o 10 CFR Part 50, Appendix A, GDC 19, Control room, requires that the licensee provide a control room from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 millirem (mrem) whole body, or its equivalent to any part of the body, for the duration of the accident. GDC 19 also requires that equipment at appropriate locations outside the control room have (1) a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and DG-1359, Page 2

(2) the potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.

o 10 CFR Part 50, Appendix A, GDC 23, Protection system failure modes, requires that the protection system be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis, if the plant experiences conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, radiation).

o 10 CFR Part 50, Appendix R, applies to licensed nuclear power electric generating stations that were operating before January 1, 1979, except as noted in 10 CFR 50.48(b). With respect to certain generic issues for such facilities, Appendix R identifies fire protection features required to satisfy GDC 3 of Appendix A. Two categories of Appendix R provisions apply to the fire protection features of these facilities:

(1) The first category consists of those provisions that licensees were required to comply with in their entirety, regardless of whether the NRC had previously approved alternatives to the specific requirements. The requirements appear in Section III.G, Fire protection of safe shutdown capability;Section III.J, Emergency lighting; and Section III.O, Oil collection system for reactor coolant pump. Those plants subject to the requirements of Section III.G.3 must also meet the requirements of Section III.L, Alternative and dedicated shutdown capability.

(2) The second category consists of requirements concerning the open items of previous NRC fire protection reviews. Open items are defined as fire protection features that the NRC staff had not previously approved as satisfying the provisions in Appendix A to Branch Technical Position (BTP) APCSB 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976, dated February 24, 1977 (Ref. 7), as reflected in NRC-issued safety evaluation reports (SERs).

• 10 CFR Part 52 governs the issuance of early site permits, standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities. The regulations in 10 CFR 52.47, 52.79, 52.137 and 52.157 for applications for standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities, respectively, state that the applicable 10 CFR Part 50 regulations cited above are also required for applicants for and holders of these 10 CFR Part 52 approvals. The staff notes that there are no similar requirements related to fire protection programs for applicants for and holders of early site permits.

Related Guidance

• Generic Letter (GL) 77-02, Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance, dated August 29, 1977 (Ref. 8), provides criteria used by the staff to review specific elements of a licensees FPP, including organization, training, combustible and ignition source controls, firefighting procedures, and quality assurance (QA).

• GL 81-12, Fire Protection Rule (45 FR 76602; November 19, 1980), dated February 20, 1981, and its associated clarification letter, dated March 22, 1982 (Ref. 9), provides information necessary to review licensee compliance with the alternative or dedicated shutdown requirements DG-1359, Page 3

of Section III.G.3 of Appendix R. Staff guidance in these letters defines safe-shutdown objectives, reactor performance goals, necessary safe-shutdown systems and components, and associated circuit identification and analysis methods.

• GL 83-33, NRC Positions on Certain Requirements of Appendix R to 10 CFR 50, dated October 19, 1983 (Ref. 10), clarifies certain requirements of Appendix R to 10 CFR Part 50 and the corresponding guidelines in NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Chapter 9, Section 9.5.1.1 Fire Protection Program, that were not being interpreted correctly by some licensees (Ref. 11).

Section 9.5.1 was issued as Section 9.5.1.1 to reflect re-numbering as result of issuance of the new SRP Section 9.5.1.2, Risk-Informed, Performance-Based Fire Protection Program (Ref. 12), in 2009.

• GL 86-10, Implementation of Fire Protection Requirements, dated April 24, 1986 (Ref. 13),

represents the staffs assessment of questions discussed during 1984 workshops with industry on fire protection requirements and provides guidance on acceptable methods of satisfying the Commissions regulatory requirements.

• GL 88-12, Removal of Fire Protection Requirements from Technical Specifications, dated August 2, 1988 (Ref. 14), gives licensees additional guidance for implementing the standard license condition and relocating the technical specifications associated with fire detection and suppression, fire barriers, and fire brigade staffing.

• Information Notice (IN) 99-17, Problems Associated with Post-Fire Safe-Shutdown Circuit Analysis, dated June 3, 1999 (Ref. 15), alerts addressees to potential problems associated with postfire safe-shutdown circuit analysis.

• NUREG-0800, Chapter 9, SRP Section 9.5.1.1 focuses on deterministic FPPs.

• NUREG-0800, Chapter 9, SRP Section 9.5.1.2 provides guidance on risk-informed, performance-based FPP licensing actions submitted pursuant to 10 CFR 50.48(c).

• NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire, issued October 2007 (Ref. 16), provides the technical bases in the form of criteria and technical guidance that may be used to demonstrate that operator manual actions are feasible and can be performed reliably under a wide range of plant conditions that an operator might encounter during a fire.

• NUREG/CR-7135, Compensatory and Alternative Regulatory Measures for Nuclear Power Plant Fire Protection (CARMEN-FIRE), issued August 2015 (Ref. 17), provides information related to interim compensatory measures and consolidates several NRC communications and technical documents on using compensatory measures to protect against fire at commercial nuclear power plants.

• RG 1.191, Fire Protection Program for Nuclear Power Plants During Decommissioning and Permanent Shutdown (Ref. 18), provides specific criteria and guidelines for FPPs for the shutdown and decommissioning of nuclear power plants. In addition, 10 CFR 50.48(f) notes that an FPP that complies with NFPA 805 shall be deemed to be acceptable for complying with the regulatory requirements for fire protection of plants that have been decommissioned and permanently shut down.

DG-1359, Page 4

• RG 1.205 will take precedence over the guidance in this RG for plants that adopt a risk-informed, performance-based FPP in accordance with 10 CFR 50.48(c). For plants that do not modify their licenses in accordance with 10 CFR 50.48(c), the NRC staff may accept risk-informed and performance-based alternatives to the guidance presented in this document that are in accordance with RG 1.205. Licensees that do not adopt a program based on NFPA 805 may use risk-informed, performance-based methods to determine the acceptability of a plant change; however, licensees should submit the methodology, including acceptance criteria, for NRC review and approval as a license amendment request (LAR), in accordance with 10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit, before implementing the change. In addition, the staff notes that RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Ref. 19), provides guidance on this topic.

• RG 1.188, Standard Format And Content For Applications To Renew Nuclear Power Plant Operating Licenses (Ref. 20), describes an approach that is acceptable to the NRC staff for the format and content of an application to renew or subsequently renew an NRC-issued operating license under 10 CFR Part 54, Requirements for Renewal of Operating Licenses for Nuclear Power Plants (Ref. 21).

• Regulatory Issue Summary (RIS) 2005-07, Compensatory Measures to Satisfy the Fire Protection Program Requirements, dated April 19, 2005 (Ref. 22), describes how licensees may use alternate approaches when the measures specified in the approved FPP do not ensure an appropriate level of safety for the specific circumstances.

• RIS 2005-30, Clarification of Post-Fire Safe-Shutdown Circuit Regulatory Requirements, dated December 20, 2005 (Ref. 23), clarifies regulatory requirements related to postfire safe-shutdown circuit analysis and protection. This revision of this regulatory guide provides the current guidance on how a licensee may address circuit analysis issues.

• RIS 2006-10, Regulatory Expectations with Appendix R Paragraph III.G.2 Operator Manual Actions, dated June 30, 2006 (Ref. 24), informs licensees about the staffs expectations, schedule, and enforcement policy for resolving issues related to crediting operator manual actions and the subsequent termination of EGM 98-002, Enforcement Guidance Memorandum Disposition of Violations of Appendix R, Sections III.G and III.L Regarding Circuit Failures, Revision 2, dated February 2, 2000 (Ref. 25).

• Review Standard (RS) for Extended Power Uprates (RS-001), issued December 2003 (Ref. 26),

provides guidance for the NRC staffs review of extended power uprate (EPU) applications to enhance consistency, quality, and completeness of reviews. This RS also informs licensees of the guidance documents the staff uses when reviewing EPU applications. This should allow licensees to prepare EPU applications that are complete for the areas that are within the staffs scope of review.

Purpose of Regulatory Guides The NRC issues RGs to describe to the public methods that the staff considers acceptable for use in implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific problems or postulated events, and to provide guidance to applicants. RGs are not substitutes for regulations and compliance with them is not required. Methods and solutions that differ DG-1359, Page 5

from those set forth in RGs will be deemed acceptable if they provide a basis for the findings required for the issuance or continuance of a permit or license by the Commission.

Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in 10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et.

seq.). These information collections were approved by the Office of Management and Budget (OMB),

approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the FOIA, Library, and Information Collections Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 and 3150-0151), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW, Washington, DC 20503; e-mail:

oira_submission@omb.eop.gov.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

DG-1359, Page 6

TABLE OF CONTENTS Page A. INTRODUCTION ................................................................................................................................... 1 Purpose 1 Applicability .................................................................................................................................... 1 Applicable Regulations .................................................................................................................... 1 Related Guidance ............................................................................................................................. 3 Purpose of Regulatory Guides ......................................................................................................... 5 Paperwork Reduction Act ................................................................................................................ 6 Public Protection Notification.......................................................................................................... 6 B. DISCUSSION .......................................................................................................................................... 9 Reason for Revision ......................................................................................................................... 9 Background ...................................................................................................................................... 9 Licensing and Design Basis ............................................................................................................. 9 Consideration of International Standards ....................................................................................... 11 Documents Discussed in Staff Regulatory Guidance .................................................................... 11 C. STAFF REGULATORY GUIDANCE .................................................................................................. 13

1. Fire Protection Program .................................................................................................... 13 1.1 Organization, Staffing, and Responsibilities ....................................................... 14 1.2 Fire Hazards Analysis .......................................................................................... 16 1.3 Safe-Shutdown Analysis ...................................................................................... 19 1.4 Fire Test Reports and Fire Data ........................................................................... 20 1.5 Compensatory Measures ...................................................................................... 20 1.6 Fire Protection Training and Qualifications ........................................................ 22 1.7 Quality Assurance ................................................................................................ 25 1.8 Fire Protection Program Changes and Code Deviations...................................... 32

2. Fire Prevention .................................................................................................................. 39 2.1 Control of Combustibles ...................................................................................... 39 2.2 Control of Ignition Sources.................................................................................. 42 2.3 Housekeeping ...................................................................................................... 43 2.4 Fire Protection System Maintenance and Impairments ....................................... 43

3. Fire Detection and Suppression ........................................................................................ 44 3.1 Fire Detection ...................................................................................................... 44 3.2 Fire Protection Water Supply Systems ................................................................ 46 3.3 Automatic Fire Suppression Systems .................................................................. 49 3.4 Manual Suppression Systems and Equipment ..................................................... 51 3.5 Manual Firefighting Capabilities ......................................................................... 53

4. Building Design and Passive Features .............................................................................. 57 4.1 General Building and Building System Design ................................................... 57 4.2 Passive Fire-Resistive Features ........................................................................... 67 4.3 Testing and Qualification of Electrical Raceway Fire Barrier Systems .............. 73

5. Safe-Shutdown Capability ................................................................................................ 74 5.1 Post-Fire Safe-Shutdown Performance Goals ..................................................... 75 5.2 Cold Shutdown and Allowable Repairs ............................................................... 76 5.3 Fire Protection of Safe-Shutdown Capabilities.................................................... 76 5.4 Alternative and Dedicated Shutdown Capability ................................................. 84 5.5 Post-fire Safe-Shutdown Procedures ................................................................... 89 DG-1359, Page 7

5.6 Shutdown and Low-Power Operations ................................................................ 90

6. Fire Protection for Areas Important to Safety ................................................................... 91 6.1 Areas Related to Power Operation....................................................................... 91 6.2 Other Areas .......................................................................................................... 97

7. Protection of Special Fire Hazards Exposing Areas Important to Safety ......................... 98 7.1 Reactor Coolant Pump Oil Collection ................................................................. 98 7.2 Turbine Generator Building ................................................................................. 99 7.3 Station Transformers.......................................................................................... 100 7.4 Diesel Fuel Oil Storage Areas ........................................................................... 100 7.5 Flammable Gas Storage and Distribution .......................................................... 100 7.6 Nearby Facilities ................................................................................................ 101

8. Fire Protection for New Reactors ................................................................................... 101 8.1 General ............................................................................................................... 101 8.2 Enhanced Fire Protection Criteria...................................................................... 101 8.3 Passive Plant Safe-Shutdown Condition ............................................................ 102 8.4 Applicable Industry Codes and Standards ......................................................... 102 8.5 Other New Reactor Designs .............................................................................. 103 8.6 Fire Protection Program Implementation Schedule ........................................... 103 8.7 Fire Protection for Nonpower Operation ........................................................... 103

9. Fire Protection for License Renewal............................................................................... 103 D. IMPLEMENTATION .......................................................................................................................... 105 REFERENCES ......................................................................................................................................... 113 APPENDIX A: EQUIVALENCY ..............................................................Error! Bookmark not defined.

APPENDIX B: TESTING AND QUALIFICATION OF ELECTRICAL RACEWAY FIRE BARRIER SYSTEMS .......................................................................................... B-1 REFERENCES FOR APPENDIX B ........................................................................................................ B-9 DG-1359, Page 8

B. DISCUSSION Reason for Revision This revision of the guide (Revision 4) addresses new issues identified since the guide was previously revised and released in 2018. This includes incorporation of the latest guidance on fire-induced circuit failures. Specifically, Section C 5.3, Fire Protection of Safe Shutdown Capabilities, includes new guidance on multiple high impedance faults, open secondary circuits on current transformers, and shorting switches. Section C 5.3 also includes partial endorsements of Nuclear Energy Institute (NEI) 00-01, Guidance for Post-Fire Safe-Shutdown Circuit Analysis, Revision 4, issued September 2016 (Ref. 27). In addition, Section C 5.3 contains guidance based on NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volumes 1, 2, and 3 (Refs. 28, 29, and 30). NUREG/CR-7150 is a consensus report by technical experts on issues related to post-fire circuit analysis, including multiple spurious operations (MSOs).

Background

The primary objectives of FPPs at U.S. nuclear power plants are to minimize both the probability of occurrence and the consequences of fire. To meet these objectives, the FPPs for operating nuclear power plants are designed to provide reasonable assurance, through defense in depth, that a fire will not prevent the necessary safe-shutdown functions from being performed and that radioactive releases to the environment in the event of a fire will be minimized.

The overall maturity of fire protection regulations, the many years of nuclear plant operating experience, the improvement of analysis methodologies, and the opportunity to incorporate these benefits in the original plant design provide the bases for enhanced fire protection in new reactor designs.

Revision 3 of this RG provides a detailed history of the fire protection issues at nuclear power plants and associated development of NRC regulations and guidance (Ref. 31) and is not repeated here.

Licensing and Design Basis The fire protection licensing and design bases for individual plants depend on several factors that may differ considerably. In particular, the fire protection regulations in 10 CFR 50.48 and Appendix R to 10 CFR Part 50 establish the applicability of certain fire protection requirements based on whether the licensing date for a given plant is before or after January 1, 1979.

The fire protection licensing basis is the set of NRC requirements applicable to a specific plant and a licensees written commitments for ensuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect.

Design basis means that information identifying the specific functions to be performed by an SSC, and the specific values or ranges of values chosen for controlling parameters that bound the design, as defined in 10 CFR 50.2, Definitions. These values may be (1) restraints derived from generally accepted state-of-the-art practices for achieving functional goals, or (2) requirements derived from analysis (based on calculations, experiments, or both) of the effects of a postulated event or accident for which an SSC must meet its functional goals.

Each operating plant falls into one of three groups: (1) plants with operating licenses issued before January 1, 1979, and a deterministic FPP (also known as pre-79 or Appendix R plants); (2) plants with operating licenses issued after January 1, 1979, and a deterministic FPP (also known as DG-1359, Page 9

post-79 or BTP plants); and (3) plants that have adopted a risk-informed, performance-based FPP through 10 CFR 50.48(c) (also known as NFPA 805 plants).

Plants Licensed before January 1, 1979 Plants licensed before January 1, 1979, are subject to the requirements of 10 CFR 50.48(a) and 10 CFR 50.48(b). The FPP-related licensing basis for these plants comprises the plant license conditions, Appendix R to 10 CFR Part 50, approved exemptions, and the staffs SERs on the FPP.

Plants Licensed after January 1, 1979 Plants licensed after January 1, 1979, are subject to the requirements of 10 CFR 50.48(a). The FPP-related licensing basis for these plants comprises the plant license conditions, approved license amendments, and the staffs SERs on the FPP.

Plants that have Adopted 10 CFR 50.48(c)

Plants that have adopted a performance-based FPP in accordance with 10 CFR 50.48(c) must meet both 10 CFR 50.48(a) and 10 CFR 50.48(c). See RG 1.205 for more information.

Safety Evaluation Reports The fire protection initial licensing SERs document the staff acceptance of the plant FPP or its elements. For plants licensed to operate before January 1, 1979, the staffs SERs also establish the extent to which the requirements of Appendix R to 10 CFR Part 50 apply. Plants for which the NRC accepted the fire protection features as satisfying the provisions of Appendix A to BTP APCSB 9.5-1, or were accepted in comprehensive SERs issued before the publication of Appendix A to BTP APCSB 9.5-1 in August 1976, were required to meet only the provisions of Sections III.G (III.L), III.J, and III.O of Appendix R.

Pre-1979 licensees need an exemption, even if a staff decision in an SER approves an aspect of the FPP that does not comply with regulatory requirements. For example, pre-1979 licensees that have SERs, but not a corresponding exemption from the regulatory requirements (e.g., an SER that approves operator manual actions as meeting the protective requirements of Appendix R,Section III.G.2), must request an exemption under 10 CFR 50.12, Specific exemptions, by (1) highlighting the special circumstances of 10 CFR 50.12(a)(2), (2) citing the SER as the safety basis, and (3) confirming that the safety basis established in the SER remains valid.

License Renewal The fire protection licensing and design basis under license renewal should not differ significantly from those in effect before renewal, with the exception that licensees must include fire protection SSCs in license renewal scoping and aging management programs (AMPs), as appropriate.

Licensees must submit an application to renew or subsequently renew an NRC-issued nuclear power plant operating license in accordance with the provisions of 10 CFR Part 54. RG 1.188 describes an approach that is acceptable to the NRC staff for the format and content of an application. Regulatory Position 9 of this document provides guidance on the fire protection aspects of license renewal and subsequent license renewal.

DG-1359, Page 10

Part 52 Licensees The FPPs for licensees that submit applications in accordance with 10 CFR Part 52 are subject to 10 CFR 50.48(a). The staff developed recommended criteria for enhanced fire protection, in accordance with SECY-90-016, Evolutionary Light-Water Reactor (LWR) Certification Issues and Their Relationship to Current Regulatory Requirements (Ref. 32); SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light Water Reactor (ALWR) Designs (Ref.

33); and SECY-94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non Safety Systems in Passive Plant Designs (Ref. 34). SECY-90-016 recommended enhanced fire protection criteria for evolutionary light-water reactors. SECY-93-087 recommended that the enhanced criteria be extended to include passive reactor designs. The Commission approved SECY-90-016 and SECY-93-087 in staff requirements memoranda (Refs. 35 and 36). SECY-94-084, in part, establishes criteria defining safe-shutdown conditions for passive light-water reactor designs and is discussed in a staff requirements memorandum (Ref. 37). Currently, the NRC staff uses the guidance and acceptance criteria in NUREG-0800, Chapter 9, SRP Section 9.5.1.1 to review Part 52 FPPs.

Consideration of International Standards The International Atomic Energy Agency (IAEA) works with member states and other partners to promote the safe, secure, and peaceful use of nuclear technologies. The IAEA develops Safety Standards and Safety Guides for protecting people and the environment from harmful effects of ionizing radiation.

This system of safety fundamentals, safety requirements, safety guides, and other relevant reports reflects an international perspective on what constitutes a high level of safety. To inform its development of this RG, the NRC considered IAEA Safety Requirements and Safety Guides1 pursuant to the Commissions International Policy Statement (Ref. 38) and Management Directive and Handbook 6.6 (Ref. 39).

In development of this RG, the following IAEA Safety Requirements and Guides were considered:

• NS-G-1.7, Protection Against Internal Fires and Explosions in the Design of Nuclear Power Plants (2004).

• NS-G-2.1, Fire Safety in the Operation of Nuclear Power Plants (2000).

Documents Discussed in Staff Regulatory Guidance This RG endorses, in part, the use of one or more codes or standards developed by external organizations, and other third-party guidance documents. These codes, standards, and third-party guidance documents may contain references to other codes, standards, or third-party guidance documents (secondary references). If a secondary reference has itself been incorporated by reference into NRC regulations as a requirement, then licensees and applicants must comply with that standard as set forth in the regulation. If the secondary reference has been endorsed in a RG as an acceptable approach for meeting an NRC requirement, then the standard constitutes a method acceptable to the NRC staff for meeting that regulatory requirement as described in the specific RG. If the secondary reference has 1 IAEA Safety Requirements and Guides may be found at www.IAEA.org/ or by writing the International Atomic Energy Agency, P.O. Box 100 Wagramer Strasse 5, A-1400 Vienna, Austria; telephone (+431) 2600-0; fax (+431) 2600-7; or e-mail Official.Mail@IAEA.Org. It should be noted that some of the international recommendations do not correspond to the requirements specified in the NRCs regulations, and the NRCs requirements take precedence over the international guidance.

DG-1359, Page 11

neither been incorporated by reference into NRC regulations nor endorsed in a RG, then the secondary reference is neither a legally binding requirement nor a generic NRC-approved acceptable approach for meeting an NRC requirement. However, licensees and applicants may consider and use the information in the secondary reference, if appropriately justified, consistent with current regulatory practice, and consistent with applicable NRC requirements.

DG-1359, Page 12

C. STAFF REGULATORY GUIDANCE This RG endorses certain sections of NEI 00-01, Guidance for Post-Fire Safe Shutdown Circuit Analysis, Revision 4. These endorsements do not imply the NRCs endorsement of the references cited in the endorsed sections of NEI 00-01, Revision 4, or to references in the endorsed sections of NEI 00-01 to other (unendorsed) sections of NEI 00-01, Revision 4. Further, examples in NEI 00-01, Revision 4, are for illustrative purposes and are not endorsed specifically.

Code of Record When existing plants were originally licensed, the licensees generally committed to complying with a specific edition of applicable industry codes and standards, such as the NFPA fire codes. The specific edition to which a licensee originally committed is still the code of record. Licensees are not required to comply with later editions of these codes and standards, except when they specifically adopt a later edition in accordance with regulatory guidelines or install new fire protection systems protecting SSCs important to safety. The code of record for the new fire protection system should be the edition that is in effect when the system is designed or when a commitment to add the system is made to the staff. The code of record for the unchanged fire protection systems will not change. For modifications to an existing fire protection system that are permitted by the code of record, the staff does not require that the system be brought into compliance with the current edition of the code.

1. Fire Protection Program In accordance with 10 CFR 50.48, each operating nuclear power plant must have a fire protection plan. The plan should establish the fire protection policy for the protection of SSCs important to safety at each plant and the procedures, equipment, and personnel required to implement the program at the plant site. The primary objectives of FPPs at U.S. nuclear plants are to minimize both the probability of occurrence and the consequences of fire. To meet these objectives, the FPPs for operating nuclear power plants are designed to provide reasonable assurance, through defense-in-depth, that a fire will not prevent the necessary safe-shutdown functions from being performed and that radioactive releases to the environment in the event of a fire will be minimized The FPP should extend the concept of defense-in-depth to fire protection in fire areas important to safety, with the following three objectives:

a. Prevent fires from starting.

b. Detect rapidly, control, and extinguish promptly those fires that do occur.

c. Provide protection for SSCs important to safety so that a fire that is not promptly extinguished by the fire suppression activities will not prevent the safe shutdown of the plant.

In accordance with 10 CFR 50.48, the fire protection plan must do the following:

a. Describe the overall FPP for the facility.

b. Identify the various positions within the licensees organization that are responsible for the program.

DG-1359, Page 13

c. State the authorities that are delegated to each of these positions to implement those responsibilities.

d. Outline the plans for fire protection, fire detection and suppression, and limitation of fire damage.

e. Describe the administrative controls and personnel requirements for fire protection and manual fire suppression activities.

f. Describe the automatic and manually operated fire detection and suppression systems.

g. Describe the means to limit fire damage to SSCs important to safety to ensure the ability to shut down the plant safely.

For reactor sites that have an operating reactor, as well as construction, modification, or decommissioning underway at other units, the FPP should provide for continuing evaluation of fire hazards associated with these activities. The licensee should provide additional fire barriers, fire protection capability, and administrative controls, as necessary, to protect the operating unit(s) from any fire hazards associated with construction or decommissioning activities.

The FPP, including the fire hazards analysis, should demonstrate that the plant will maintain the ability to minimize the potential for radioactive releases to the environment in the event of a fire. Fires are expected to occur over the life of a nuclear power plant and, thus, should be treated as anticipated operational occurrences, as defined in Appendix A to 10 CFR Part 50. Requirements for protection against radiation during normal operations appear in 10 CFR Part 20, Standards for Protection Against Radiation (Ref. 40). Anticipated operational occurrences should not result in unacceptable radiological consequences, and the exposure criteria of 10 CFR Part 20 apply. Prevention of a radiological release that could result in a radiological hazard to the public, environment, or plant personnel becomes the primary FPP objective for reactor shutdown and decommissioning.

1.1 Organization, Staffing, and Responsibilities The FPP should describe the organizational structure and responsibilities for its establishment and implementation. These responsibilities include FPP policy; program management (including program development, maintenance, updating, and compliance verification); fire protection staffing and qualifications; engineering and modification; inspection, testing, and maintenance of fire protection systems, features, and equipment; fire prevention; emergency response (e.g., fire brigades and offsite mutual aid); and general employee, operator, and fire brigade training.

The licensee should assign direction of the FPP to an individual who has been delegated authority commensurate with the responsibilities of the position and who has available staff personnel knowledgeable in both fire protection and nuclear safety.

The licensee should assign overall responsibility for the FPP to a person who has management control over all organizations involved in fire protection activities. Formulation and assurance of program implementation may be delegated to a staff composed of personnel prepared by training and experience in fire protection, as well as personnel prepared by training and experience in nuclear plant safety, to provide a comprehensive approach in directing the FPP for the nuclear power plant.

DG-1359, Page 14

The following responsibilities should be considered in designating positions or organizations:

a. The upper-level management position has overall responsibility for the formulation, implementation, and assessment of the effectiveness of the nuclear plant FPP.

b. Other management positions have direct responsibility for formulating, implementing, and periodically assessing the effectiveness of the FPP for the licensees nuclear power plant, including fire drills and training conducted by the fire brigade and plant personnel. The results of these assessments should be reported to the upper level management position responsible for fire protection, with recommendations for improvements or corrective actions as deemed necessary.

c. An onsite management position is responsible for the overall administration of the plant operations and emergency plans, which include the fire protection and prevention program, and which provide a single point of control and contact for all contingencies. On sites with an operating reactor, as well as ongoing construction, modification, or decommissioning of other units, the superintendent of the operating plant should have the lead responsibility for site fire protection.

d. Additional onsite positions are responsible for the following actions:

(1) Implement periodic inspections to minimize the amount of combustibles in plant areas important to safety; determine the effectiveness of housekeeping practices; ensure the availability and acceptable condition of all fire protection systems and equipment, emergency breathing apparatuses, emergency lighting, communications equipment, fire stops, penetration seals, and fire-retardant coatings; and ensure that prompt and effective actions are taken to correct conditions adverse to fire protection and prevent their recurrence.

(2) Provide fire response training for operating plant personnel and firefighting training for the plants fire brigade, design and select equipment, periodically inspect and test fire protection systems and equipment in accordance with established procedures, and evaluate test results and determine the acceptability of the systems being tested.

(3) Assist in the critique of all fire drills to determine how well the training objectives have been met.

(4) Review proposed work activities with regard to in-plant fire protection, identify potential transient fire hazards, and specify required additional fire protection in the work activity procedure.

(5) Implement a program to instruct all plant contractor personnel in appropriate administrative procedures that implement the FPP and the emergency procedures related to fire protection.

(6) Implement a program to instruct personnel on the proper handling of accidental events, such as leaks or spills of flammable materials that are related to fire protection.

(7) Review hot work.

DG-1359, Page 15

e. An onsite position is responsible for fire protection QA. This position ensures the effective implementation of the FPP by planned inspections, scheduled audits, and verification that the results of these inspections and audits are promptly reported to cognizant management personnel.

f. The licensee should identify the plants fire brigade positions with the following in mind (see also Regulatory Position 3.5.1 of this guide):

(1) The plant fire brigade positions should be responsible for fighting fires. The authority and responsibility of each fire brigade position related to fire protection should be clearly defined.

(2) The responsibilities of each fire brigade position should correspond to the actions required by the firefighting procedures.

(3) Collateral responsibilities of the fire brigade members should not conflict with their responsibilities related to the fire brigade during a fire emergency. A collateral responsibility would be a required action or decision that would adversely affect the fire brigade members ability to perform a required firefighting function.

(4) The minimum number of trained fire brigade members available on site for each operating shift should be consistent with the activities required to combat credible and challenging fires but should be no fewer than five members. The size of the fire brigade should be based on the functions required to fight fires, with adequate allowance for injuries. Fire brigade staffing should account for all operational and emergency response demands on shift personnel in the event of a significant fire.

1.2 Fire Hazards Analysis A fire hazards analysis should be performed to demonstrate that the plant will maintain the ability to perform safe-shutdown functions and minimize radioactive material releases to the environment in the event of a fire. This analysis should be revised as necessary to reflect plant design and operational changes.

The fire hazards analysis has the following objectives:

a. to consider potential in situ and transient fire hazards;

b. to determine the effects of a fire in any location in the plant on the ability to safely shut down the reactor or to minimize and control the release of radioactivity to the environment; and

c. to specify measures for fire prevention, detection, suppression, and containment for each fire area containing SSCs important to safety, in accordance with NRC guidelines and regulations.

The fire hazards analysis verifies that the FPP meets the applicable NRC regulatory requirements and guidance. The analysis lists applicable elements of the program, with explanatory statements, as needed, to identify location, type of system, and design criteria. The analysis should identify and justify any deviations from the regulatory guidelines. Justification for such deviations should demonstrate that an equivalent level of protection will be achieved (see Regulatory Position 1.8 of this guide regarding when DG-1359, Page 16

such deviations are subject to the exemption request process). Deletion of a protective feature without compensating alternative protection measures is typically unacceptable, unless it is clearly demonstrated that the protective measure is not needed because of the design and arrangement of the particular plant.

The fire hazards analysis should include the following elements and attributes:

a. The applicability of NRC fire protection requirements and guidance should be evaluated.

b. In situ and potential transient fire and explosion hazards, including amounts, types, configurations, and locations of flammable and combustible materials (e.g., electric cable insulation and jacketing material, lube oil, diesel fuel oil, flammable gases, chemicals, building materials and finishes) associated with operations, maintenance, and refueling activities should be identified. The continuity of combustible materials (e.g., exposed electrical cables that span the distance between redundant trains), the potential for fire spread, and sources of ignition should be identified and described in the analysis.

c. External exposure hazards (e.g., flammable and combustible liquid or gas storage, auxiliary boiler units, adjacent industrial facilities or transportation systems, natural vegetation, and adjacent plant support facilities) that could potentially expose SSCs important to safety to damage from the effects (e.g., heat, flame, smoke) of fires should be identified. Wildfire hazards should be addressed if there is the potential for a wildfire to damage SSCs important to safety.

d. The design, installation, operation, testing, and maintenance of automatic fire detection and suppression capabilities should be addressed. The fire hazards analysis should describe the level of automatic protection (e.g., water spray density, gaseous agent concentration) provided relative to the specific fire hazards that have been identified. The effects of lightning strikes should be included in the design of fire detection systems.

e. The layout and configurations of SSCs important to safety should be depicted. The protection for safe-shutdown systems (see Regulatory Positions 5.3 and 5.4 of this guide) within a fire area should be determined on the basis of the worst-case fire that is likely to occur and the resulting damage. The fire hazards analysis should explain and document the extent of such damage. The analysis should consider the degree of spatial separation between redundant shutdown systems, the presence of in situ and transient combustibles, the available fire protection systems and features, sources of ignition, and the susceptibility to fire damage of the cables, equipment, systems, and features in the area that are related to safe shutdown.

f. Reliance on and qualifications of fire barriers, including fire test results, the quality of the materials and barrier system, and the quality of the barrier installation should be described.

Regulatory Position 4.3 of this guide provides detailed guidelines for testing and qualifying electrical raceway fire barrier systems.

g. Fire area construction (walls, floor, and ceiling materials, including coatings and thicknesses; fireproofing of structural members; area dimensions and volume; normal ventilation and smoke removal capability; and level of congestion as it applies to access for manual firefighting activities) should be described. The fire hazards analysis should provide sufficient information to determine that fire areas have been properly selected, based on the fire hazards present and the DG-1359, Page 17

need for separation of SSCs important to safety. Regulatory Position 4.1.2 provides guidelines for fire areas and zones.

h. Manual fire suppression capability, including systems (e.g., hydrants, standpipes, extinguishers),

fire brigades, manual firefighting equipment, plans and procedures, training, drills, mutual aid, and accessibility of plant areas for manual firefighting should be identified. The fire hazards analysis should list the location and type of manual firefighting equipment and accessibility for manual firefighting.

i. Potential fire impacts on operations should be identified, including the following:

(1) fire in control rooms or other locations where operations important to safety are performed, (2) fire conditions that may necessitate evacuation from areas that are required to be attended for safe shutdown, and (3) lack of adequate access or smoke removal facilities that impede plant operations or fire extinguishment in plant areas important to safety.

j. Potential disabling effects of fire suppression systems on safe-shutdown capability should be identified. The term damage by fire in Appendix R also includes damage to equipment from the normal or inadvertent operation of fire suppression systems. The fire hazards analysis should address the effects of firefighting activities. GDC 3 of Appendix A to 10 CFR Part 50 states that Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components.

k. Explosion-prevention measures in areas subject to potentially explosive environments from flammable gases or other potentially energetic sources (e.g., chemical treatment systems, ion exchange columns, high-voltage electrical equipment) should be listed.

l. The availability of oxygen (e.g., inerted containment) should be identified.

m. Alternative or dedicated shutdown capability for those fire areas where adequate separation of redundant safe-shutdown systems cannot be achieved should be identified.

The analysis should assume fire initiation at the location within each fire area or zone that will produce the most severe fire with the potential to adversely affect SSCs important to safety. Fire development should consider the potential for involvement of other combustibles, both fixed and transient, in the fire area. Where automatic suppression systems are installed, the analysis should evaluate the effects of the assumed fire, with and without actuation of the automatic suppression system.

Worst-case fires need not be assumed to be concurrent with nonfire-related failures in safety systems, other plant accidents, or the most severe natural phenomena.

On multiple-reactor sites, unrelated fires in two or more units need not be assumed to occur simultaneously. The analysis should consider fires involving facilities shared between units and fires DG-1359, Page 18

caused by manmade site-related events that have a reasonable probability of occurring and affecting more than one reactor unit (such as an aircraft crash).

The fire hazards analysis should separately identify hazards and provide appropriate protection in locations where losses of SSCs important to safety can occur as a result of the following:

a. concentrations of combustible contents, including transient fire hazards of combustibles expected to be used in normal operations, such as refueling, maintenance, and modifications;

b. continuity of combustible contents, furnishings, building materials, or combinations thereof in configurations conducive to fire spread;

c. exposures to fire, heat, smoke, or water, including those that may necessitate evacuation from areas that are required to be staffed for safe shutdown;

d. fire in control rooms or other locations having critical functions important to safety;

e. lack of adequate access or smoke removal facilities that impedes plant operations or fire extinguishment in plant areas important to safety;

f. lack of explosion-prevention measures;

g. loss of electric power or control and instrumentation circuits; and

h. inadvertent operation of fire suppression systems.

Qualified fire protection and reactor systems engineers should perform the fire hazards analysis.

Identifying fire hazards and the consequences of an assumed fire starting at any location in the plant requires experienced judgment. Personnel who are thoroughly trained and experienced in reactor safety are able to evaluate the consequences of the assumed fire for nuclear safety. The person conducting the analysis of fire hazards should be thoroughly trained and experienced in the principles of industrial fire prevention and control and in fire phenomena from fire initiation, through its development, to propagation into adjoining spaces. An engineer with the qualifications listed in Regulatory Position 1.6.1.a of this guide should conduct or directly supervise the fire hazards analysis.

1.3 Safe-Shutdown Analysis In accordance with 10 CFR 50.48, each operating nuclear power plant must provide the means to limit fire damage to SSCs important to safety to ensure the ability to safely shut down the reactor.

Licensees should develop a safe-shutdown analysis to demonstrate the ability of the plant to safely shut down for a fire in any given area. Regulatory Position 5.1 of this guide identifies the safe-shutdown performance goals. The licensee should demonstrate the ability of the selected systems to accomplish these performance goals.

Analysts assess fire damage to safe-shutdown equipment or fires with the potential to result in the release of radioactive materials to the environment on the basis of a single fire, including an exposure fire.

An exposure fire is a fire in a given area that involves either in situ or transient combustibles and has the DG-1359, Page 19

potential to affect SSCs important to safety or the release of radioactive materials located in or adjacent to that same area. The effects of such a fire (e.g., smoke, heat, or ignition) can adversely affect those SSCs important to safety or the ability to prevent release of radioactive materials. Thus, a fire involving one safe-shutdown success path may constitute an exposure fire for the redundant success path located in the same area, and a fire involving combustibles not in either redundant success path may constitute an exposure fire for both redundant success paths located in the same area.

The analysis should identify the safe-shutdown components and circuits for each fire area and demonstrate that the plant meets the guidelines in Regulatory Position 5.3 or that it provides an alternative or dedicated shutdown, in accordance with Regulatory Position 5.4 of this guide. For each plant, the combinations of systems that provide the shutdown functions may be unique for each area; however, the shutdown functions provided should ensure that the plant achieves its safe-shutdown performance objectives.

The licensee should also develop and implement procedures necessary to implement safe shutdown as appropriate (see Regulatory Position 5.5 of this guide).

1.4 Fire Test Reports and Fire Data The licensee should evaluate fire reports and data (e.g., fire barrier testing results and cable derating data) that are used to demonstrate compliance with NRC fire protection requirements to ensure that the information is applicable and representative of the conditions for which the information is being applied.

NFPA 251, Standard Methods of Test of Fire Resistance of Building Construction and Materials (Ref. 41), recommends that test conditions be evaluated carefully, because variations from the construction of the test specimen or from the condition in which it is tested may substantially change the performance characteristics of the tested assembly.

Not all possible configurations of fire barrier assemblies can be tested; Regulatory Positions 1.8.3 and 4.3 of this guide provide additional information on evaluating installed configurations that deviate from tested conditions.

1.5 Compensatory Measures The licensee may implement compensatory measures for degraded and nonconforming conditions. In its evaluation of the impact of a degraded or nonconforming condition on plant and individual SSC operation, a licensee may decide to implement a compensatory measure as an interim step to restore operability or to otherwise enhance the capability of SSCs important to safety until the final corrective action is complete. Reliance on a compensatory measure for operability should be an important consideration in establishing the timeframe for completing the corrective action. Conditions that require interim compensatory measures to demonstrate operability should be resolved more promptly than conditions that are not dependent on compensatory measures to show operability; such reliance suggests a greater degree of degradation. Similarly, if an operability determination is based on operator action, the licensee should resolve the nonconforming condition expeditiously.

NUREG/CR-7135 (CARMEN-FIRE) documents the history of compensatory measures, details the NRCs regulatory framework established to ensure that they are appropriately implemented and DG-1359, Page 20

maintained, and explores technologies that did not exist when the current plants were licensed that may offer an effective alternative to the measures specified in a licensees approved FPP.

Temporary changes to specific fire protection features that may be necessary to accomplish maintenance or modifications are acceptable, provided that interim compensatory measures, such as fire watches, temporary fire barriers, or backup suppression capability, are implemented. Licensees should address any degraded or nonconforming condition in a time frame commensurate with the safety significance of the condition. Licensees should make reasonable efforts to complete corrective actions at the first opportunity or should appropriately justify a longer completion schedule.

Licensees may want to review and consider guidance provided to NRC inspectors and discussed in the most up-to-date generic communication on timeliness of corrective actions. The reliance on compensatory measures is one of the factors in the inspector guidance when evaluating timeliness of the corrective action. Licensees should promptly complete the corrective action at the first available opportunity and eliminate the reliance on the compensatory measure.

For common types of deficiencies, the technical specifications or the NRC-approved FPP generally note specific compensatory measures. For unique situations or for measures that the approved FPP does not include, the licensee may opt to use an alternative to the compensatory measure stated in its FPP, or a combination of measures. A licensee may use such alternative measures without prior approval of the Commission if allowed by its fire protection license condition (however, changes to compensatory measures defined in technical specifications require a license amendment).

A licensee with a fire protection license condition that allows certain FPP changes without prior Commission approval should have all of the following available when using the provision:

a. a documented evaluation showing the impact of the alternative compensatory measure on the FPP,

b. a documented evaluation comparing the adequacy of the alternative compensatory measure to the compensatory measure required by the licensees FPP, and

c. a documented evaluation showing that the alternative compensatory measure(s) will not adversely affect the ability of the plant to achieve and maintain safe shutdown in the event of a fire.

Any change to the FPP must maintain compliance with GDC 3 and the requirements of 10 CFR 50.48(a) and must be retained as a record pursuant to 10 CFR 50.48(a). The licensees change to the FPP is subject to inspection by the NRC.

The evaluation of the alternative compensatory measure should incorporate risk insights regarding the location, quantity, and type of combustible material in the fire area; the presence of ignition sources and their likelihood of occurrence; the automatic fire suppression and fire detection capability in the fire area; the manual fire suppression capability in the fire area; and the human error probability, where applicable.

DG-1359, Page 21

1.6 Fire Protection Training and Qualifications The FPP should be under the direction of an individual who has available staff personnel knowledgeable in both fire protection and nuclear safety. Plant personnel should be adequately trained in the administrative procedures that implement the FPP and the emergency procedures related to fire protection.

1.6.1 Fire Protection Staff Training and Qualifications Fire protection staff should meet the following qualifications:

a. The formulation of the FPP and its implementation should be the responsibility of personnel prepared by training and experience in fire protection and in nuclear plant safety to provide a comprehensive approach in directing the FPP for the nuclear power plant. A fire protection engineer (or a consultant) who is a graduate of an engineering curriculum of accepted standing and who: (1) has at least four years of practice indicative of growth in engineering competency and achievement, three of which were in responsible charge (this satisfies the eligibility requirements as a Professional Member grade in the Society of Fire Protection Engineers (SFPE) in October 2020); or (2) is a graduate of an engineering curriculum of accepted standing and is a licensed professional fire protection engineer in the State in which the plant is located, should be a member of the organization responsible for the formulation and implementation of the FPP.

b. The fire brigade members qualifications should include satisfactory completion of a physical examination for performing strenuous activity and fire brigade training, as described in Regulatory Position 1.6.4.

c. The personnel responsible for maintaining and testing the fire protection systems should be qualified by training and experience for such work.

d. The personnel responsible for training the fire brigade should be qualified by knowledge, suitable training, and experience for such work.

1.6.2 General Employee Training Each nuclear plant employee has a responsibility to respond to plant fires. General site employee training should introduce all personnel to the elements of the sites FPP, including the responsibilities of the fire protection staff. Training should also include information on the types of fires and related extinguishing agents, specific fire hazards at the site, and actions in the event of a fire suppression system actuation.

General employee training should provide specific instruction to site and contractor personnel on the following:

a. appropriate actions to take upon discovering a fire, including, for example, notification of the control room, attempts to extinguish the fire, and actuation of local fire suppression systems;

b. actions upon hearing a fire alarm; DG-1359, Page 22

c. administrative controls on the use of combustibles and ignition sources; and

d. actions necessary in the event of a combustible liquid spill, gas release, or leaks.

1.6.3 Fire Watch Training Fire watches provide for observation and control of fire hazards associated with hot work, and they may act as compensatory measures for degraded fire protection systems and features. Specific fire watch training should provide appropriate instruction on fire watch duties, responsibilities, and required actions for the different types of fire watches, such as continuous hot-work fire watches and hourly fire watches, etc. Fire watch qualifications should include hands-on training on a practice fire with the extinguishing equipment to be used while on fire watch, if applicable. If fire watches are to be used as compensatory actions, the fire watch training should include recordkeeping requirements.

1.6.4 Fire Brigade Training and Qualifications The fire brigade training program should establish and maintain the capability to fight credible and challenging fires. The program should consist of initial classroom instruction followed by periodic classroom instruction, firefighting practice, and fire drills (see Regulatory Position 3.5.1.4 for drill guidance).

Numerous NFPA standards provide guidelines applicable to the training of fire brigades. The NRC staff considers the training recommendations of NFPA 600, Standard on Industrial Fire Brigades (Ref. 42), including the applicable NFPA publications referenced in NFPA 600, to be appropriate criteria for training the plant fire brigade. The licensee may also use NFPA 1410, Standard on Training for Initial Emergency Scene Operations (Ref. 43), and NFPA 1500, Standard on Fire Department Occupational Safety and Health Program (Ref. 44), as appropriate. The licensee may use the NFPA booklets and pamphlets listed in NFPA 600, as applicable, for training references and should use courses in fire prevention and fire suppression that are recognized or sponsored by the fire protection industry.

1.6.4.1 Qualifications The brigade leader and at least two brigade members should have sufficient training in or knowledge of plant systems to understand the effects of fire and fire suppressants on safe-shutdown capability. The brigade leader should be competent to assess the potential safety consequences of a fire and advise control room personnel. Such competence by the brigade leader may be evidenced by possession of an operators license or equivalent knowledge of plant systems. Nuclear power plants staffed with a dedicated professional fire department may use a fire team advisor to assess the potential safety consequences of a fire and advise the control room and incident commander. The fire team advisor should possess an operators license or equivalent knowledge of plant systems and be dedicated to supporting the fire incident commander during fire emergency events. The fire team advisor does not need to meet the qualifications of a fire brigade member, but if he or she does not, there should be five available qualified fire brigade members in addition to the fire team advisor.

The qualification of fire brigade members should include an annual physical examination to determine their ability to perform strenuous firefighting activities.

DG-1359, Page 23

1.6.4.2 Instruction Instruction should be provided by qualified individuals who are knowledgeable, experienced, and suitably trained in fighting the types of fires that could occur and in using the types of equipment available in the nuclear power plant. The licensee should provide instruction to all fire brigade members and fire brigade leaders. The initial classroom instruction should include the following:

a. knowledge of the plant firefighting plan, with specific identification of each individuals responsibilities;

b. identification of the type and location of fire hazards and associated types of fires that could occur in the plant;

c. the toxic and corrosive characteristics of expected products of combustion;

d. identification of the location of firefighting equipment for each fire area and familiarization with the layout of the plant, including access and egress routes to each area;

e. the proper use of available firefighting equipment and the correct method of fighting each type of fire, including the following:

(1) fires involving radioactive materials, (2) fires in energized electrical equipment, (3) fires in cables and cable trays, (4) hydrogen fires, (5) fires involving flammable and combustible liquids or hazardous process chemicals, (6) fires resulting from construction or modifications (welding), and (7) record file fires;

f. the proper use of communications, lighting, ventilation, and emergency breathing equipment;

g. the proper method for fighting fires inside buildings and confined spaces;

h. the direction and coordination of the firefighting activities (fire brigade leaders only);

i. a detailed review of firefighting strategies and procedures; and

j. a review of the latest plant modifications and corresponding changes in firefighting plans.

The licensee should coordinate training of the plant fire brigade with the local fire department to delineate responsibilities and duties in advance. This coordination should be part of the training course and should be included in the training of the local fire department staff.

Instruction should provide the techniques, equipment, and skills for the use of water in fighting electrical cable fires in nuclear plants, particularly in areas containing a high concentration of electric cables with plastic insulation, as applicable to plant-specific conditions.

DG-1359, Page 24

The licensee should hold regularly planned meetings at least quarterly for all brigade members to review changes in the FPP and other subjects, as necessary.

The licensee should offer periodic refresher training sessions to repeat the classroom instruction program for all brigade members over a 2-year period. These sessions may be concurrent with regularly planned meetings.

The licensee should schedule retraining or broadened training for firefighting within buildings for all brigade members whose performance records show deficiencies.

1.6.4.3 Fire Brigade Practice The licensee should hold practice sessions for each shift fire brigade on the proper method of fighting the various types of fires that could occur in a nuclear power plant. These sessions should provide brigade members with experience in actual fire extinguishment and the use of self-contained breathing apparatuses under the strenuous conditions encountered in firefighting. The licensee should provide these practice sessions at least once a year for each fire brigade member.

1.6.4.4 Fire Brigade Training Records The licensee should maintain individual records of training provided to each fire brigade member, including drill critiques, for at least 3 years to ensure that each member receives training in all parts of the training program. These training records should be available for NRC inspection.

1.7 Quality Assurance The overall plant QA plan should include the QA program for fire protection. The licensee should maintain a QA program that provides assurance that the fire protection systems are designed, fabricated, erected, tested, maintained, and operated so that they will function as intended. Fire protection systems are not safety related and, therefore, are not within the scope of Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, unless the licensee has committed to including these systems under the plants Appendix B program. The NRC staff has generally used guidance for an acceptable QA program for fire protection systems, previously given in Section C.4 of BTP CMEB 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants, Revision 2, issued July 1981 (Ref. 45), in the review and acceptance of approved FPPs for plants licensed after January 1, 1979. This RG incorporates that guidance, and the NRC staff will continue to use it in the review and acceptance of approved FPPs for new reactors. For plants licensed before January 1, 1979, BTP APCSB 9.5-1, its Appendix A, and GL 77-02 contain similar guidance.

The plants QA organization should manage the fire protection QA program. This control consists of (1) formulating the fire protection QA program and verifying that it incorporates suitable requirements and is acceptable to the management responsible for fire protection, and (2) verifying the effectiveness of the QA program for fire protection through review, surveillance, and audits. Personnel outside the QA organization may perform other QA program functions to meet the FPP requirements.

Licensees have the option of either (1) including the fire protection QA program as part of the plants overall QA program under Appendix B to 10 CFR Part 50, or (2) providing, for NRC inspection, a description of the fire protection QA program and its implementation measures.

DG-1359, Page 25

The fire protection QA program should satisfy the specific criteria that apply to items within the scope of the FPP, such as fire protection systems and features, emergency lighting, communications equipment, self-contained breathing apparatuses, and the fire protection requirements of applicable equipment important to safety.

1.7.1 Design and Procurement Document Control The licensee should establish measures to include the guidance presented in this RG in its design and procurement documents. The licensee should also control deviations from this guidance to ensure that the following occurs:

a. Design and procurement document changes, including field changes and design deviations, are subject to the same level of controls, reviews, and approvals that applied to the original document.

b. The design documents, such as appropriate fire protection codes and standards, specify quality standards, and deviations and changes from these quality standards are controlled.

c. Qualified personnel review new designs and plant modifications, including fire protection systems, to ensure inclusion of appropriate fire protection requirements. These reviews should include items such as the following:

(1) design reviews to verify the adequacy of wiring isolation and cable separation criteria; and (2) design reviews to verify appropriate requirements for room isolation (sealing penetrations, floors, and other fire barriers) (see Regulatory Position 1.8 for guidance on FPP changes and code deviations).

d. Qualified personnel perform and document the review and approval of the adequacy of fire protection requirements and quality requirements stated in procurement documents. This review should determine that fire protection requirements and quality requirements are correctly stated, able to be inspected, and controllable; there are adequate acceptance and rejection criteria; and the procurement document has been prepared, reviewed, and approved in accordance with applicable QA program requirements.

1.7.2 Instructions, Procedures, and Drawings Documented instructions, procedures, or drawings should prescribe inspections, tests, administrative controls, fire drills, and training that govern the FPP, and the licensee should ensure that the following activities occur:

a. Indoctrination and training programs for fire prevention and firefighting are implemented in accordance with documented procedures.

b. Activities such as design, installation, inspection, test, maintenance, and modification of fire protection systems are prescribed and accomplished in accordance with documented instructions, procedures, and drawings.

DG-1359, Page 26

c. Instructions and procedures for design, installation, inspection, test, maintenance, modification, and administrative controls are reviewed to ensure that the proper fire protection requirements are addressed, such as control of ignition sources and combustibles, provisions for backup fire protection capability, disablement of a fire protection system, and restrictions on material substitutions unless specifically evaluated.

d. The installation or application of penetration seals, fire barrier systems, and fire-retardant coatings is performed by trained personnel using approved procedures.

1.7.3 Control of Purchased Material, Equipment, and Services The licensee should establish the following measures to ensure that purchased material, equipment, and services conform to the procurement documents:

a. provisions, as appropriate, for source evaluation and selection, objective evidence of quality furnished by the contractor, inspections at suppliers, or receipt inspections; and

b. source or receipt inspection, for those items that, once installed, cannot have their quality verified.

1.7.4 Inspection The licensee should establish and execute a program for independent inspection of activities affecting fire protection. The program should allow the organization performing the activity to verify conformance to documented installation drawings and test procedures. This program should include the following:

a. inspection of installation, maintenance, and modification of fire protection systems or features;

b. inspection of emergency lighting and communications equipment to ensure conformance to design and installation requirements;

c. inspection of the installations of penetration seals, fire barriers, and fire-retardant coating to verify that the activity is satisfactorily completed;

d. inspection of cable routing to verify conformance to design requirements;

e. inspections to verify that appropriate requirements for room isolation (sealing penetrations, floors, and other fire barriers) are met during construction;

f. measures to ensure that inspection personnel are independent from the individuals performing the activity being inspected and are knowledgeable in the design and installation requirements for fire protection;

g. inspection procedures, instructions, and checklists that provide for the following:

(1) identification of characteristics and activities to be inspected; (2) identification of the individuals or groups responsible for performing the inspection operation; DG-1359, Page 27

(3) acceptance and rejection criteria; (4) a description of the method of inspection; (5) recording of evidence of the completion and verification of a manufacturing, inspection, or test operation; and (6) recording of inspector or data recorder and the results of the inspection operation.

h. periodic inspections of fire protection systems, emergency breathing and auxiliary equipment, emergency lighting, and communications equipment to ensure their acceptable condition; and

i. periodic inspection of materials subject to degradation, such as fire barriers, stops, seals, and fire-retardant coatings, to ensure that these items have not deteriorated or been damaged.

1.7.5 Test and Test Control The licensee should establish and implement a test program to ensure that testing is performed and verified by inspection and audit to demonstrate conformance to design and system readiness requirements. The tests should follow written test procedures; test results should be properly evaluated, and corrective actions taken as necessary. The test program should include the following:

a. Installation Testing: Following construction, modification, repair, or replacement, the licensee should perform sufficient testing to demonstrate that fire protection systems, emergency lighting, and communications equipment will perform satisfactorily in service and that design criteria are met. Written test procedures for installation tests should incorporate the requirements and acceptance limits contained in applicable design documents.

b. Periodic Testing: The licensee should develop and document the schedules and methods for periodic testing. Periodic testing of fire protection equipment, emergency lighting, and communications equipment will ensure that the equipment will function properly and continue to meet the design criteria.

c. Quality Assurance: The licensee should establish programs for QA and quality control (QC) to verify testing of fire protection systems and features and to determine whether test personnel are effectively trained.

d. Documentation: A qualified individual or group should be responsible for ensuring that test results are documented, evaluated, and acceptable.

1.7.6 Inspection, Test, and Operating Status The licensee should establish measures to document or identify items that have satisfactorily passed required tests and inspections. These measures should include identification by means of tags, labels, or similar temporary markings to indicate operating status and completion of required inspections and tests.

DG-1359, Page 28

1.7.7 Nonconforming Items The licensee should establish measures to control items that do not conform to specified requirements to prevent inadvertent use or installation. These measures should include provisions to ensure the following:

a. Nonconforming, inoperable, or malfunctioning fire protection systems, emergency lighting, and communication equipment are appropriately tagged or labeled.

b. The identification, documentation, segregation, review disposition, and notification to the affected organization of nonconforming materials, parts, components, or services are procedurally controlled.

c. Documentation identifies the nonconforming item, describes the nonconformance and the disposition of the nonconforming item, and includes signature approval of the disposition.

d. Provisions are established to identify those individuals or groups delegated the responsibility and authority for the disposition and approval of nonconforming items.

1.7.8 Corrective Action The licensee should establish measures to ensure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible materials, and nonconformances, are promptly identified, reported, and corrected. These measures should ensure the following:

a. Procedures are established to evaluate conditions adverse to fire protection (such as nonconformance, failures, malfunctions, deficiencies, deviations, and defective material and equipment) to determine the necessary corrective action.

b. In the case of significant or repetitive conditions adverse to fire protection, including fire incidents, the cause of the conditions is determined and analyzed, and prompt corrective actions are taken to prevent recurrence. The cause of the condition and the corrective action taken are promptly reported to cognizant levels of management for review and assessment.

1.7.9 Records The licensee should prepare and maintain records to furnish evidence that the plant meets the criteria enumerated above for activities affecting the FPP, so that the following is true:

a. Records are identifiable and retrievable and should demonstrate conformance to fire protection requirements. The records should include results of inspections, tests, reviews, and audits; nonconformance and corrective action reports; construction, maintenance, and modification records; and certified manufacturers data.

b. Record retention requirements are established.

DG-1359, Page 29

1.7.10 Audits The licensee should conduct and document audits to verify compliance with the FPP. The licensee should ensure the following:

a. Audits are performed to verify compliance with the administrative controls and implementation of QA criteria, including design and procurement documents, instructions, procedures, drawings, and inspection and test activities as they apply to fire protection features and safe-shutdown capability. QA personnel perform these audits in accordance with preestablished written procedures or checklists. The trained personnel who conduct the audits should not have direct responsibilities in the areas being audited.

b. Audit results are documented and then reviewed with management responsible for the area audited.

c. Responsible management takes follow-up action to correct the deficiencies revealed by the audit.

d. Audits are performed annually to provide an overall assessment of conformance to fire protection requirements.

A qualified audit team should perform fire protection audits. The team should include at least a lead auditor from the licensees QA organization, a systems engineer, and a fire protection engineer. The lead auditor should be qualified, for example, in accordance with American Society of Mechanical Engineers (ASME) NQA-1, Quality Assurance Program Requirements for Nuclear Facilities (Ref. 46),

or an alternative consistent with the general QA program requirements. The systems engineer should be knowledgeable in safety systems, operating procedures, and emergency procedures. The fire protection engineer (or engineering consultant) should meet the qualifications described in Regulatory Position 1.6.1.a. The fire protection engineer can be a licensee employee who has not been directly responsible for the sites FPP for 2 out of 3 years. However, every third year, an independent fire protection consultant should be part of the audit team. This audit team approach will ensure that the technical and QA requirements are adequately assessed.

Insurance company inspections do not satisfy the fire protection audit requirements because they do not evaluate plant FPPs against the NRC requirements, including the requirements for post-fire safe shutdown. If an insurance company develops an inspection that has the proper scope and the inspection team includes a person knowledgeable in nuclear safety, an insurance company may perform these audits in conjunction with a lead auditor from the licensees QA organization.

The following paragraphs specify three distinct fire protection audits. Originally, licensees were required to incorporate these audits into their technical specifications, consistent with Standardized Technical Specification Section 6.5.2.8, Items h, i, and j. Some licensees may have elected to relocate technical specification requirements related to review and audit requirements to their QA plan.

Incorporation of such requirements into the QA plan may revise the frequency of existing technical specification audits by implementing a performance-based schedule.

DG-1359, Page 30

1.7.10.1 Annual Fire Protection Audit For those licensees who have relocated audit requirements from their technical specifications to the QA program, the annual fire protection audit frequency may be changed if a performance-based schedule is used. American National Standards Institute/American Nuclear Society (ANSI/ANS) 3.2-2006, Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants (Ref. 47), should be used in establishing the audit frequency. The annual audit should incorporate the following elements:

a.

Purpose:

The purpose of the annual audit is to assess the plant fire protection equipment and program implementation to verify that a level of safety consistent with NRC guidelines continues to be provided.

b. Scope: Each audit should verify that the commitments of the safety analysis report and the requirements of the technical specifications and license conditions have been met and that modifications to systems and structures or changes in operating procedures have not decreased the level of safety in the plant. The audit should include an inspection of all plant areas for which fire protection is provided and, in particular, examination of fire barriers, fire detection systems, and fire extinguishing systems provided for equipment important to safety. The audit should verify the following:

(1) The installed fire protection systems and barriers are appropriate for the SSCs important to safety, based on a comparison with NRC regulatory requirements and the approved FPP. Deviations should be noted.

(2) The fire hazard in each fire area has not increased above that specified in the safety analysis report.

(3) Regularly scheduled maintenance is performed on plant fire protection systems.

(4) Identified deficiencies have been promptly and adequately corrected.

(5) Special permit procedures (hot work, valve positioning) are being followed.

(6) Plant personnel receive appropriate training in fire prevention and firefighting procedures, and the training program is consistent with approved standards. (The audit team should witness a typical training session.)

(7) Plant response to fire emergencies is adequate, based on auditors analyzing incident records and witnessing an unannounced fire drill.

(8) Administrative controls limit transient combustibles in areas important to safety.

(9) Problem areas identified in previous audits have been corrected.

The audit should analyze all problem areas identified and recommend appropriate fire protection measures to provide a level of safety consistent with NRC guidelines.

DG-1359, Page 31

1.7.10.2 24-Month Fire Protection Audit The 24-month audit of the FPP and implementing procedures should ensure that the requirements for design, procurement, fabrication, installation, testing, maintenance, and administrative controls for the respective programs are included in the plant QA program for fire protection and meet the criteria of the QA/QC program established by the licensee, consistent with this guide. Personnel from the licensees QA organization who do not have direct responsibility for the program being evaluated should perform these audits. These audits would normally include an evaluation of existing program documents to verify continued adherence to NRC requirements.

1.7.10.3 Triennial Fire Protection Audit The triennial audit is basically the same as the annual audit; the difference lies in the source of the auditors. Qualified utility personnel who are not directly responsible for the site FPP, or an outside independent fire protection consultant, may perform the annual audit. However, only an outside independent fire protection consultant should perform the triennial audit. The outside consultant should not be an employee of the licensee of the plant being audited. These audits would normally include evaluating existing documents (other than those addressed under the 24-month audit) and inspecting fire protection system operability or functionality, inspecting the integrity of fire barriers, and witnessing the performance of procedures to verify that the licensee has fully implemented the FPP and that the plan is adequate for the objects protected. Duplicate audits are not required (i.e., the 3-year audit replaces the annual audit for the year in which it is performed).

1.8 Fire Protection Program Changes and Code Deviations This section provides guidance on the regulatory mechanisms for addressing changes, deviations, exemptions, and other issues affecting compliance with fire protection requirements. Risk-informed, performance-based methodologies may be used to evaluate the acceptability of FPP changes; however, for this approach, the licensee should use methodologies and acceptance criteria that the NRC has reviewed and approved. RG 1.174 includes guidance for risk-informed changes to a plants current licensing basis.

1.8.1 Change Evaluations If an existing plant has adopted the standard license condition for fire protection and incorporated the FPP in the FSAR, the licensee may make changes to the approved FPP without the Commissions prior approval only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The FSAR should include or reference the evaluation that documents the change. In addition to planned changes, nonconforming conditions may also require an evaluation. An FPP change is any change to plant hardware or plant program documents and procedures that affects the FPP. In addition to changes directly related to fire protection, this type of change may include plant changes that are not directly associated with the fire protection system or procedures but could, for example, affect the results of the post-fire, safe-shutdown circuit analysis. Another example of an FPP change is an in-situ condition (physical or programmatic) that is an FPP regulatory noncompliance or a fire protection licensing-basis noncompliance and which the licensee does not intend to correct through a plant or programmatic modification.

DG-1359, Page 32

GL 86-10 recommends that licensees incorporate the FPP in the facility FSAR. Incorporation of the FPP and major commitments, including the fire hazards analysis, by reference in the FSAR places the FPP, including the systems, administrative and technical controls, organization, and other plant features associated with fire protection, in a status consistent with other plant features described in the FSAR.

GL 86-10 further recommends the adoption of the standard license condition (see Regulatory Position 1.8.1.2 of this guide), requiring licensees to comply with the provisions of the approved FPP as described in the FSAR and establishing when changes to the program require NRC approval.

The standard fire protection license condition recommended by GL 86-10 does not apply to the FPP for reactors that are licensed under 10 CFR Part 52. The change process for a combined license (COL) under 10 CFR Part 52 is described in 10 CFR 52.98, Finality of combined licenses; information requests.

The staff notes that industry guidance document NEI 02-03, Guidance for Performing a Regulatory Review of Proposed Changes to the Approved Fire Protection Program, Revision 0, issued June 2003 (Ref. 48), can provide useful guidance for performing change evaluations in accordance with the plants fire protection licensing condition and approved FPP. However, the NRC has not endorsed NEI 02-03.

1.8.1.1 Nonstandard License Condition If the FPP committed to by the licensee is required by a specific license condition and is not part of the FSAR for the facility, then the NRC may require the licensee to submit amendment requests even for relatively minor changes to the FPP.

1.8.1.2 Standard License Condition The NRC transmitted the standard license condition for fire protection to licensees in April 1986 as part of GL 86-10, with information on its applicability to specific plants.

GL 88-12 provides additional guidance to implement the standard license condition and remove the technical specifications associated with fire detection and suppression, fire barriers, and fire brigade staffing.

Within the context of the standard fire protection license condition, the phrase not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire means to maintain sufficient safety margins. An acceptable set of guidelines for making that assessment is summarized below. Other equivalent acceptance guidelines may also be used. With sufficient safety margins, the following applies:

a. Codes and standards or their alternatives approved for use by the NRC are met.

b. Safety analysis acceptance criteria in the licensing basis are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Licensees can maintain applicable safety margins by relating item (a) above specifically to:

changes to the FPP under the standard license condition; changes that maintain compliance with the applicable NFPA codes and standards endorsed by the NRC; Appendix R to 10 CFR Part 50; this RG; DG-1359, Page 33

and the applicable BTPs, NUREG series reports, and other NRC-approved or NRC-issued documents.

Licensees may perform code and standard equivalency evaluations without NRC review and approval, in accordance with the guidance in Regulatory Position 1.8.6.

Other documents approved or issued by the NRC that provide a basis for compliance would include topical reports endorsed by the staff or other staff-documented generic positions or generic communications. If the licensee has an analysis in a retrievable format that demonstrates compliance with the applicable NRC-approved document(s), the change is acceptable, provided that the change meets current regulations (e.g., 10 CFR 50.48; Appendix R to 10 CFR Part 50, where applicable; and GDC 3),

and is consistent with the defense-in-depth philosophy for fire protection (see Section II.A of Appendix R to 10 CFR Part 50). The NRC does not require an assessment of the risk impact of the change to demonstrate regulatory compliance.

The NRC may find the substitution of repairs in lieu of installed fire protection systems and features for systems and components required to achieve and maintain cold shutdown acceptable, as long as the time to repair the cold shutdown capability did not exceed the limits prescribed in Appendix R to 10 CFR Part 50. An assessment of the risk impact may or may not be necessary to satisfy the provisions under item (b), above, depending on the nature of the change and the analysis used to justify it.

Regulatory Position 5 of this guide provides additional guidance on acceptable operator manual actions.

The licensee is responsible for demonstrating that the change has not resulted in an adverse effect on safe shutdown or noncompliance with the applicable NRC requirements. An appropriate analysis is required to demonstrate that the change is acceptable. The licensees failure to conduct the appropriate analysis is a failure to meet the plants fire protection license condition. The depth and scope of the analysis depend on the nature of the change and the type of analytical tool relied on to justify it. A change that does not maintain a sufficient margin of safety fails to meet the plants license condition.

FPP changes that adversely affect the ability to achieve and maintain safe shutdown in the event of a fire and that do not comply with the FPP-related licensing basis need prior approval by the NRC in the form of an appropriate licensing action (i.e., exemption or license amendment). Changes submitted to the NRC as licensing actions should include a technical justification for the proposed alternative approach.

1.8.1.3 Exemptions, License Amendments, and the Standard License Condition A proposed change that alters compliance with a regulation requires an exemption from the regulation, in accordance with 10 CFR 50.12 or 10 CFR 52.7, as appropriate. If a proposed change alters a license condition or technical specification that was used to satisfy NRC requirements, the licensee should submit a license amendment request. When a change that falls within the scope of the changes allowed under the standard fire protection license condition is planned, the licensees evaluation should be made in conformance to the standard fire protection license condition to determine whether the change would adversely affect the ability to achieve and maintain safe shutdown. The assessment should include the effect on the fire hazards analysis and should consider whether SSCs for a success path for safe shutdown are affected or a new element is introduced in the area. If the evaluation concludes that there are no adverse effects, the licensee should document this conclusion and its basis and make it available for future inspection and reference. If the evaluation finds that there are adverse effects, or that it is outside the basis for an exemption that was granted for the area involved, the licensee should make DG-1359, Page 34

modifications to achieve conformance, justify and request an exemption, or seek a license amendment from the NRC.

1.8.1.4 Nonconforming Conditions In addition to an evaluation of planned changes, an evaluation may be required for nonconforming conditions. See Regulatory Position 1.5 for additional information on compensatory measures.

In the case of a degraded or nonconforming condition, an evaluation depends on the licensees compensatory and corrective actions. Three potential conditions exist for determining the need for an evaluation: (1) the use of interim compensatory actions, (2) corrective actions that result in a change, or (3) corrective actions that restore the nonconforming or degraded condition to the previous condition.

If the licensee takes an interim compensatory action to address the condition that falls within the scope of the standard fire protection license condition, it should conduct a review that may result in a change evaluation. The intent of the review is to determine whether the compensatory action itself (not the degraded condition) affects other aspects of the facility described in the FSAR.

If the condition is accepted as is, resulting in something different from that described in the FSAR, or is modified to something that differs from the FSAR, the condition should be considered a change and a change evaluation should be performed.

1.8.1.5 Reporting Guidelines The licensee should maintain records of FPP-related changes to the facility, changes in procedures, and tests and experiments made in accordance with the standard fire protection license condition. These records should include a written evaluation that provides the bases for the determination that the change does not adversely affect safe-shutdown capability.

The licensee should maintain, in retrievable form, a current record of all such changes and should make such records available to NRC inspectors upon request. All changes to the approved program should be reported, along with the FSAR revisions required by 10 CFR 50.71(e).

In accordance with 10 CFR 50.48, the licensee must maintain records of all changes in the facility until the termination of the license. Records of superseded procedures must be maintained for 3 years from the date the record was superseded.

1.8.2 Exemptions to Appendix R to 10 CFR Part 50 For plants licensed before January 1, 1979, the NRC requires requests for exemption from the requirements of Appendix R for modifications or conditions that do not comply with the applicable sections of Appendix R. The exclusion of the applicability of sections of Appendix R other than Sections III.G, III.J, and III.O (and Section III.L, as applicable) is limited to those features accepted by the NRC staff as satisfying the provisions of Appendix A to BTP APCSB 9.5-1 reflected in staff fire protection SERs issued before the effective date of the regulation. For these previously approved features, the NRC does not require an exemption request, except for proposed modifications that would alter previously approved features used to satisfy NRC requirements.

DG-1359, Page 35

Plant-specific conditions may prevent compliance with one or more of the provisions specified in Appendix R. In such a case, the licensee should demonstrate, by means of a detailed fire hazards analysis, that the existing protection, or the existing protection in conjunction with proposed modifications, will provide a level of safety equivalent to the technical requirements of Appendix R.

When the fire hazards analysis (Regulatory Position 1.2 of this guide) shows that an alternative approach (i.e., an approach different from a specified requirement, such as the use of a 1-hour fire-rated barrier where a 3-hour barrier is specified) can provide adequate fire safety, licensees required to meet Appendix R may request NRC approval of an exemption from its technical requirements. Any exemption request should include a sound technical basis clearly demonstrating that the fire protection defense-in-depth philosophy is appropriately maintained and that the exemption is technically justified.

As part of its evaluation, the licensee should provide a sound technical justification if it does not propose to install or improve the automatic suppression or detection capabilities in the area of concern or if it does not intend to implement other more restrictive fire prevention, detection, or suppression measures.

Generally, the staff will accept an alternative fire protection configuration on the basis of a detailed fire hazards analysis if the following conditions are met:

a. The alternative configuration ensures that one success path necessary to achieve hot shutdown from either the control room or emergency control stations is free of fire damage.

b. The alternative configuration ensures that fire damage to equipment necessary to achieve cold shutdown is limited and can be repaired within a reasonable time (minor repair using components stored on the site).

c. Modifications required to meet Appendix R requirements would not enhance fire protection safety levels above those provided by either existing or proposed alternatives.

The staff will also accept an alternative fire protection configuration on the basis of a detailed fire hazards analysis, when the licensee can demonstrate that modifications required to meet the requirements of Appendix R would be detrimental to overall facility safety, the alternative configuration satisfies the above criteria, and the alternative configuration provides an adequate level of fire safety.

The licensee should file requests for exemptions from the requirements of 10 CFR 50.48 and Appendix R to 10 CFR Part 50 in accordance with 10 CFR 50.12.

1.8.3 Appendix R Equivalency Evaluations The NRCs interpretations of certain Appendix R requirements allow a licensee to choose not to seek prior NRC review and approval of, for example, a fire-area boundary, in which case a fire protection engineer (assisted by others, as needed) should perform an evaluation. The licensee should ensure that such evaluations are written and organized to facilitate review by a person not involved in the evaluation.

The evaluation should include all supporting calculations and clearly state all assumptions at the outset.

The licensee should retain these evaluations for subsequent NRC inspections. Appendix A to this guide provides examples of previously accepted equivalency evaluations.

DG-1359, Page 36

1.8.4 License Amendments Plants licensed after January 1, 1979, that have committed to meet the requirements of Sections III.G, III.J, and III.O of Appendix R to 10 CFR Part 50, 10 CFR Part 52, or NRC guidance (e.g., BTP CMEB 9.5-1), and are required to do so as a license condition, do not need to request exemptions for alternative configurations. However, the FSAR or fire hazards analysis should identify and justify deviations (i.e., departures from the approved FPP) from the requirements of Sections III.G, III.J, and III.O, or other applicable requirements or guidance, and these deviations may require a license amendment to change the license condition. Licensees should include a technical justification for the proposed alternative approach in any license amendment they submit to the NRC for review and approval.

The technical justification should address the criteria described in Regulatory Position 1.8.1 for change evaluations and Regulatory Position 1.8.2 for exemptions.

1.8.5 10 CFR 50.72 Notification and 10 CFR 50.73 Reporting The requirements of 10 CFR 50.72, Immediate Notification Requirements for Operating Nuclear Power Reactors, and 10 CFR 50.73, Licensee Event Report System, apply to reporting certain events and conditions related to fire protection at nuclear power plants. Licensees should report to the NRC fire events or fire protection deficiencies that meet the criteria of 10 CFR 50.72 and 10 CFR 50.73, as appropriate, and in accordance with the requirements of these regulations. NUREG-1022, Event Report Guidelines 10 CFR 50.72 and 10 CFR 50.73 (Ref. 49), provides guidance for meeting the requirements of 10 CFR 50.72 and 10 CFR 50.73 and consolidates important NRC reporting guidelines into one reference document. The document is structured to assist licensees in promptly and completely reporting specified events and conditions.

The statements of considerations for the 10 CFR 50.72 and 10 CFR 50.73 final rules include additional reporting guidance.

1.8.6 National Fire Protection Association Code and Standard Deviation Evaluations For those fire protection SSCs installed to satisfy the NRC requirements and designed to NFPA codes and standards, the code of record is the code edition in force at the time of the design or at the time the commitment is made to the NRC for a fire protection feature. The FSAR or the fire hazards analysis should identify and justify deviations from the codes. Deviations should not degrade the performance of fire protection systems or features. As stated in SRP 9.5.1.1, Appendix A Section 3, the standards of record related to the design and installation of fire protection systems and features required to satisfy NRC requirements in all new reactor designs are those NFPA codes and standards in effect 180 days before the submittal of the application under 10 CFR Part 50 or 10 CFR Part 52. The 180-day deadline is based on the application requirements in 10 CFR 50.34(h)(1)(i), 50.34(h)(1)(ii), 52.47(a)(9), 52.79(a)(41),

52.137(a)(9), and 52.157(f)(30).

A licensee may apply the equivalency concept in meeting the provisions of the NFPA codes and standards. Nothing in the NFPA codes or standards is intended to prevent the use of methods, systems, or devices of equivalent or superior quality, strength, fire resistance, effectiveness, durability, and safety as alternatives to those prescribed by the codes or standards, provided that technical documentation demonstrates equivalency and the method, system, or device is listed or approved for the intended purpose.

DG-1359, Page 37

An exemption is not required to deviate from NFPA codes, except as required for NFPA codes referenced in NRC regulations such as NFPA 805 in 10 CFR 50.48(c). The NRC guidelines reference certain NFPA codes as providing guidance acceptable to the staff; therefore, such codes may be accorded the same status as RGs. More recent editions of the NFPA codes require submittal of technical documentation to the authority having jurisdiction (AHJ) to demonstrate equivalency of an alternative system, method, or device for AHJ approval. Whether or not the code of record includes this requirement, the NRC does not require review and approval of equivalency evaluations. However, the licensee should document these evaluations and make them available for NRC inspection.

Since 2007, some NFPA codes require plans and calculations to be submitted to the AHJ before installation. The NRC monitors plant modifications in a variety of ways, such as periodic inspections, 10 CFR 50.59 evaluations, and updating and periodic submittal of the FSAR. Therefore, licensees need not submit informational transmittals, such as fire protection system plans and calculations, to the NRC, except as otherwise required. Since some NFPA codes require this transmittal, licensees should document these deviations from NFPA codes.

When the applicant or licensee states that its design meets the NFPA code(s) or meets the intent of the NFPA code(s) and does not identify any deviations from such codes, the NRC understands that the design conforms to the codes and is subject to inspection against the NFPA code of record.

The AHJ (as described in NFPA documents) refers to the Director of the Office of Nuclear Reactor Regulation, or designee, consistent with the authority specified in 10 CFR 1.43, Office of Nuclear Reactor Regulation (Ref. 50).

1.8.7 Fire Modeling When the evaluation of an FPP change is based on fire modeling, licensees should document the fact that its fire models and methods meet the NRC requirements. The licensee should also document that the models and methods in the analyses were used within their limitations and with the rigor required by the nature and scope of the analyses. These analyses may use simple hand calculations or more complex computer models, depending on the specific conditions of the scenario being evaluated. NUREG-1934, Nuclear Power Plant Fire Modeling Analysis Guidelines (NPP FIRE MAG), issued November 2012 (Ref. 51), and Appendix C to NFPA 805 contain discussions that are useful in determining which fire models to use and applying those fire models within their limitations. Licensees that do not make the transition to an NFPA 805 FPP can use fire models endorsed by the NRC as part of an engineering evaluation process. However, the NRC endorses the fire models, methodologies, data, and examples in these documents only to the extent that they have been or can be adequately verified and validated or to the extent that they are appropriate for the specific application.

The NRC and the Electric Power Research Institute (EPRI) have documented the verification and validation (V&V) process for parts of five fire models in NUREG-1824/EPRI 1011999, Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications, issued May 2007 (Ref. 52),

and NUREG-1805, Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis Methods for the U.S.

Nuclear Regulatory Commission Fire Protection Inspection Program, issued December 2004 (Ref. 53).

The specific fire models documented are (1) FDTs, (2) Fire-Induced Vulnerability Evaluation (FIVE),

Revision 1, (3) the National Institute of Standards and Technology (NIST) Consolidated Model of Fire Growth and Smoke Transport, (4) the Electricité de France MAGIC code, and (5) the NIST Fire Dynamics Simulator. NUREG-1824/EPRI 3002002182, Supplement 1, Verification and Validation of DG-1359, Page 38

Selected Fire Models for Nuclear Power Plant Applications, issued November 2016 (Ref. 54), updates the V&V for the most current versions of the five fire models, provides additional test data thus expanding the V&V ranges, and addresses additional submodels such as the Thermally Induced Electrical Failure (THIEF) model.

Licensees may propose the use of fire models that have not specifically undergone V&V by the NRC; however, licensees are responsible for providing evidence of acceptable V&V of these fire models.

The V&V documents for licensee-proposed fire models are subject to NRC review and approval.

2. Fire Prevention Fire prevention is the first line of defense in depth for fire protection. The fire prevention attributes of the program are directly related to the fire protection objective to minimize the potential for fire to occur. These attributes involve design and administrative measures that provide a reasonable level of assurance that the plant is adequately protected against fire hazards, which are managed, and that fire consequences will be limited for those fires that do occur.

The licensee should establish administrative controls and procedures to minimize fire hazards in areas containing SSCs important to safety. Appropriate levels of management should review normal and abnormal conditions or other anticipated operations, such as modifications (e.g., breaching fire barriers or fire stops, impairment of fire detection and suppression systems) and transient fire hazard conditions, such as those associated with maintenance and refueling activities. The licensee should implement appropriate compensatory measures, such as fire watches or temporary fire barriers, to ensure adequate fire protection and reactor safety.

For those plants that are permanently shutdown, are undergoing decommissioning, or both, the licensing basis changes in accordance with the requirements in 10 CFR 50.82, Termination of License.

For permanently shutdown reactors, 10 CFR 50.48(f) and RG 1.191 relate to fire protection. The objectives of the FPP listed in 10 CFR 50.48(f)(1) are to: (1) reasonably prevent fires from occurring, (2) rapidly detect, control, and extinguish those fires that do occur and that could result in a radiological hazard, and (3) ensure that the risk of fire-induced radiological hazards to the public, environment, and plant personnel is minimized. In addition, 10 CFR 50.48(f) notes that an FPP that complies with NFPA 805 shall be deemed acceptable for complying with the regulatory requirements for the fire protection of plants that have been decommissioned or permanently shut down.

The following sections provide guidance on fire prevention measures, including control of combustibles and ignition sources and housekeeping inspections. Regulatory Position 1.1 discusses organizational responsibilities for implementing fire prevention measures. Portions of NFPA 1, Fire Code (Ref. 55), contain additional guidance that may be used to develop and implement fire prevention measures.

2.1 Control of Combustibles Administrative controls for fire prevention should include procedures to control handling and use of combustibles, prohibit storage of combustibles in plant areas important to safety, establish designated storage areas with appropriate fire protection, and control use of specific combustibles (e.g., wood) in plant areas important to safety.

DG-1359, Page 39

2.1.1 Transient Fire Hazards Bulk storage of combustible materials should be prohibited inside or adjacent to buildings or systems important to safety during all modes of plant operation. Procedures should limit and govern the handling of transient fire hazards, such as combustible and flammable liquids, wood and plastic products, high-efficiency particulate air (HEPA) and charcoal filters, dry ion exchange resins, or other combustible materials in buildings containing systems or equipment important to safety during all phases of operation, particularly during maintenance, modification, or refueling operations.

Licensees should control and provide suitable protection against transient fire hazards that cannot be eliminated. Specific controls and protective measures include the following:

a. Unused ion exchange resins should not be stored in areas that contain or expose equipment important to safety.

b. Hazardous chemicals should not be stored in areas that contain or expose equipment important to safety.

c. Use of wood inside buildings containing systems or equipment important to safety should be permitted only when suitable noncombustible substitutes are not available. All wood smaller than 152 millimeters (mm) x152 mm (6 inches (in.) x 6 in.) used in plant areas important to safety during maintenance, modification, or refueling operations (such as lay down blocks or scaffolding) should be treated with a flame retardant. (For guidance, see NFPA 703, Standard for Fire-Retardant Treated Wood and Fire-Retardant Coatings for Building Materials (Ref. 56).)

Wood should be allowed into plant areas important to safety only when it is to be used immediately.

d. The use of plastic materials should be minimized. Halogenated plastics, such as polyvinyl chloride and neoprene, should be used only when substitute noncombustible materials are not available. All plastic materials, including flame and fire-retardant materials, will burn with an intensity and British thermal unit (Btu) production in a range similar to that of ordinary hydrocarbons. When burning, they produce heavy smoke that obscures visibility and can plug air filters, especially charcoal and HEPA filters. Halogenated plastics also release free chlorine and hydrogen chloride when burning, which are toxic to humans and corrosive to equipment.

NFPA 701, Standard Methods of Fire Tests for Flame Propagation of Textiles and Films (Ref. 57), provides guidance on fire tests for flame-resistant plastic films (e.g., plastic sheeting, tarpaulins).

e. Use of combustible material such as HEPA and charcoal filters, dry ion exchange resins, or other combustible supplies in areas important to safety should be controlled. Such materials should be allowed into areas important to safety only when they are to be used immediately.

f. Equipment or supplies (such as new fuel) shipped in untreated combustible packing containers may be unpacked in areas containing equipment or systems important to safety, if required for valid operating reasons. However, all combustible materials should be removed from the area immediately following unpacking. Such transient combustible material, unless stored in approved containers, should not be left unattended. Loose combustible packing material, such as wood or DG-1359, Page 40

paper excelsior or polyethylene sheeting, should be placed in metal containers with tight-fitting, self-closing metal covers.

g. Materials that collect and contain radioactivity, such as spent ion exchange resins, charcoal filters, and HEPA filters, should be stored in closed metal tanks or containers that are located in areas free from ignition sources or combustibles. These materials should be protected from exposure to fires in adjacent areas as well. Requirements for removal of decay heat from entrained radioactive materials should be considered.

2.1.2 Modifications Fire prevention elements of the FPP should be maintained when plant modifications are made.

The modification procedures should contain provisions that evaluate the impacts of modifications on the fire prevention design features and programs. In the design of plant modifications, the licensee should follow the guidelines of Regulatory Position 4.1.1. Personnel in the fire protection organization should review modifications of SSCs to ensure that fixed fire loadings are not increased beyond those accounted for in the fire hazards analysis, or if increased, suitable protection is provided, and the fire hazards analysis is revised accordingly.

2.1.3 Flammable and Combustible Liquids and Gases Flammable and combustible liquids and gases are potentially significant fire hazards and procedures should clearly define their use, handling, and storage, which should comply with the provisions of NFPA 30, Flammable and Combustible Liquids Code (Ref. 58).

Miscellaneous storage and piping for flammable or combustible liquids or gases should not create a potential fire exposure hazard to systems important to safety.

Systems important to safety should be isolated or separated from combustible materials. When this is not possible, because of the nature of the safety system or the combustible material, licensees should provide special protection to prevent a fire from defeating the safety system function. Such protection may involve a combination of automatic fire suppression and construction capable of withstanding and containing a fire that consumes all combustibles present. Examples of such combustible materials that may not be separable from the remainder of its system are emergency diesel generator (EDG) fuel oil day tanks, turbine-generator oil and hydraulic control fluid systems, and reactor coolant pump (RCP) lube oil collection systems.

Diesel fuel oil tanks should meet the guidelines of Regulatory Positions 6.1.8 and 7.4.

Turbine-generator lube oil and hydraulic systems should meet the guidelines in Regulatory Position 7.2.

Regulatory Position 7.1 provides guidelines for RCP oil collection systems.

Bulk gas storage and use should meet the guidelines of Regulatory Position 7.5.

2.1.4 External and Exposure Fire Hazards When an SSC important to safety is near installations such as flammable liquid or gas storage, the licensee should evaluate the risk of exposure fires (originating in such installations) to the SSCs and take appropriate protective measures. NFPA 80A, Recommended Practice for Protection of Buildings from DG-1359, Page 41

Exterior Fire Exposures (Ref. 59), provides guidance on such exposure protection. NFPA 30 provides guidance on minimum separation distances from flammable and combustible liquid storage tanks.

NFPA 55, Compressed Gases and Cryogenic Fluids Code (Ref. 60), gives separation distances for gaseous and liquefied hydrogen (see Regulatory Position 7.5 of this guide). NFPA 58, Liquefied Petroleum Gas Code (Ref. 61), contains guidance for liquefied petroleum gas.

Miscellaneous areas, such as shops, warehouses, auxiliary boiler rooms, fuel oil tanks, radwaste buildings, and flammable and combustible liquid storage tanks, should be located and protected to prevent a fire or the effects of a fire, including smoke, from adversely affecting any SSCs important to safety (see the previous section for guidelines related to locating diesel fuel oil tanks and compressed gas supplies external to structures important to safety).

In geographic areas where there is a potential for damage from wildfires (i.e., forest, brush, vegetation), the licensee should evaluate the risk potential for SSCs important to safety and take appropriate measures. NFPA 1144, Standard for Reducing Structure Ignition Hazards from Wildland Fire (Ref. 62), provides guidance on assessing wildfire severity and appropriate protection measures.

2.2 Control of Ignition Sources Electrical equipment (permanent and temporary), hot-work activities (e.g., open flame, welding, cutting, and grinding), high-temperature equipment and surfaces, heating equipment (permanent and temporary installation), reactive chemicals, static electricity, and smoking are all potential ignition sources. Design, installation, modification, maintenance, and operational procedures and practices should control potential ignition sources.

Engineering design practices should ensure that electrical equipment is properly designed and installed in accordance with industry standards, heat-generating equipment or equipment with hot surfaces is properly cooled or separated from combustible materials, and systems containing flammable and combustible liquids or gases are properly designed and located to minimize the exposure of these materials to ignition sources.

Regulatory Position 3.5 of RG 1.191 contains similar guidelines for those plants that have permanently ceased operation.

2.2.1 Open Flame, Welding, Cutting, and Grinding (Hot Work)

Work involving ignition sources such as welding and flame cutting should be carried out under closely controlled conditions. Persons performing such work should be trained and equipped to prevent and combat fires. In addition, a person qualified in performing hot-work fire watch duties should directly monitor the work and function as a fire watch.

A hot-work permit system to control open flames, welding, cutting, and other hot work should govern the use of ignition sources. A separate permit should be issued for each area where work is to be done. If work continues over more than one shift, the permit should be valid for not more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> when the plant is operating or for the duration of a particular job during plant shutdown. NFPA 51B, Standard for Fire Prevention During Welding, Cutting and Other Hot Work (Ref. 63), includes guidance for protecting against the hazards associated with welding, cutting, and other hot-work operations.

DG-1359, Page 42

2.2.2 Temporary Electrical Installations The use of temporary services at power reactor facilities is routine, especially to support maintenance and other activities during outages. In view of the magnitude and complexity of some temporary services, proper engineering and, once installed, maintenance of the design basis become significant. The temporary cables should be considered as transient combustibles and may represent ignition sources. Plant administrative controls should provide for an engineering review of temporary installations. These reviews should ensure that appropriate precautions, limitations, and maintenance practices are established for the term of such installations. The Institute of Electrical and Electronics Engineers (IEEE) Standard 835, Standard Power Cable Ampacity Tables (Ref. 64), and ANSI/IEEE C.2, National Electrical Safety Code (Ref. 65), contain guidance on temporary electrical installations, including derating closely spaced cables.

2.2.3 Other Sources Leak testing and similar procedures, such as airflow determination, should not use open flames or combustion-generated smoke.

Procedures and practices should provide for control of temporary heating devices. Use of space heaters and maintenance equipment (e.g., tar kettles for roofing operations) in plant areas should be strictly controlled and reviewed by the plants fire protection staff. Engineering procedures and practices should ensure that temporary heating devices are properly installed according to the listing, including required separations from combustible materials and surfaces. Temporary heating devices should be placed so as to avoid overturning and installed in accordance with their listing, including clearance to combustible material, equipment, or construction. Asphalt and tar kettles should be located in a safe place or on a fire-resistive roof, at a point where they avoid ignition of combustible material below. Continuous supervision should be maintained while kettles are in operation, and metal kettle covers, and fire extinguishers should be provided.

2.3 Housekeeping The licensee should establish administrative controls to minimize fire hazards in areas containing SSCs important to safety. These controls should govern removal of waste, debris, scrap, oil spills, and other combustibles after completion of a work activity or at the end of the shift. Administrative controls should also include procedures for performing and maintaining periodic housekeeping inspections to ensure continued compliance with fire protection controls. Housekeeping practices should ensure that drainage systems, especially drain hub grills, in areas containing fixed water-based suppression systems, remain free of debris to minimize flooding if the systems discharge. RG 1.39, Housekeeping Requirements for Water-Cooled Nuclear Power Plants (Ref. 66), provides guidance on housekeeping, including the disposal of combustible materials.

2.4 Fire Protection System Maintenance and Impairments The licensee should establish fire protection administrative controls to address the following issues:

a. Qualified personnel should maintain and test fire protection features (see Regulatory Position 1.6.1.c of this guide).

DG-1359, Page 43

b. A permit system should control impairments to fire barriers, fire detection, and fire suppression systems. Compensatory measures (see Regulatory Position 1.5 of this guide) should be established in areas where systems are disarmed.

c. Successful fire protection requires inspection, testing, and maintenance of the fire protection equipment. A test plan that lists the individuals and their responsibilities in connection with routine tests and inspections of the fire protection systems should be developed. The test plan should contain the types, frequency, and detailed procedures for testing. Frequency of testing should be based on the code of record for the applicable fire protection system. Procedures should also contain instructions on maintaining fire protection during those periods when the fire protection system is impaired or during periods of plant maintenance (e.g., fire watches).

d. Fire barriers, including dampers, doors, and penetration seals, should be routinely inspected.

Penetration seals may be inspected on a frequency and relative sample basis that ensures that the seals are functional. Sample size and inspection frequency should be determined by the total number of penetrations and observed failure rates.

NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems (Ref. 67), contains additional guidance.

3. Fire Detection and Suppression 3.1 Fire Detection In general, the fire hazards analysis and regulatory requirements determine the scope of fire detection and suppression in the plant, whereas the applicable industry codes and standards (generally NFPA codes, standards, and recommended practices) determine the design, installation, and testing requirements of the systems and components. The design of fire detection systems should minimize the adverse effects of fires on SSCs important to safety. Automatic fire detection systems should be installed in all areas of the plant that contain or present an exposure fire hazard to SSCs important to safety. These fire detection systems should be capable of operating with or without offsite power.

With regard to protection of safe-shutdown systems, Regulatory Positions 5.3.1.1.b and 5.3.1.1.d of this guide state, In addition, fire detectors and an automatic fire suppression system should be installed in the fire area. Where automatic fire detection is installed, it should provide complete protection throughout the fire area. For those areas where only partial coverage is installed, the fire hazards analysis should demonstrate the adequacy of the design to provide the necessary protection.

The fire detection and alarm system should be designed with the following objectives:

a. Detection systems are to be provided for all areas that contain or present a fire exposure to equipment important to safety.

b. Fire detection and alarm systems should comply with the requirements of Class A systems, as defined in NFPA 72, National Fire Alarm Code (Ref. 68), and Class I circuits, as defined in NFPA 70, National Electrical Code (Ref. 69).

DG-1359, Page 44

c. Fire detectors are selected and installed in accordance with NFPA 72. Preoperational and periodic testing of a pulsed-line type of heat detector demonstrates that the frequencies used will not affect the actuation of protective relays in other plant systems.

d. Fire detection and alarm systems give audible and visible alarms and annunciation in the control room. Where zoned detection systems are used in a given fire area, local means identify which detector zone has actuated.

e. Fire alarms are distinctive and unique to avoid confusion with any other plant system alarms.

f. Primary and secondary power supplies are provided for the fire detection system and for electrically operated control valves for automatic suppression systems. Such primary and secondary power supplies should satisfy the provisions of NFPA 72. This can be accomplished by using normal offsite power as the primary supply, with a 4-hour battery supply as a secondary supply, and by providing the capability for manual connection to the Class 1E emergency power bus within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of loss of offsite power. Such connection should follow the applicable guidance in RG 1.6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems (Ref. 70); RG 1.32, Criteria for Power Systems for Nuclear Power Plants (Ref. 71); and RG 1.75, Physical Independence of Electric Systems (Ref. 72).

g. In areas of high seismic activity, licensees should consider the need to design the fire detection and alarm systems to function following a safe-shutdown earthquake.

h. The fire detection and alarm systems should retain their original design capability for (1) natural phenomena of less severity and greater frequency than the most severe natural phenomena (approximately once in 10 years), such as tornadoes, hurricanes, floods, ice storms, or small-intensity earthquakes that are characteristic of the geographic region, and (2) potential manmade site-related events, such as oil barge collisions or aircraft crashes, that have a reasonable probability of occurring at a specific plant site.

i. Noninerted containments should have fire detection systems, in accordance with the guidance in Regulatory Position 6.1.1.3 of this guide.

j. Control rooms should have fire detection systems and alarms, in accordance with the guidance in Regulatory Position 6.1.2 of this guide.

k. The following areas that contain equipment important to safety should have automatic fire detectors that alarm and annunciate in the control room: plant computer rooms, switchgear rooms, alternative or dedicated shutdown panels, battery rooms, diesel generator areas, pump rooms, new and spent fuel areas, and radwaste and decontamination areas (see also Regulatory Positions 6.1 and 6.2 of this guide).

DG-1359, Page 45

3.2 Fire Protection Water Supply Systems 3.2.1 Fire Protection Water Supply NFPA 22, Standard for Water Tanks for Private Fire Protection (Ref. 73), and NFPA 24, Standard for the Installation of Private Fire Service Mains and Their Appurtenances (Ref. 74), provide guidance on fire protection water supplies. The fire protection water supply system should meet the following criteria:

a. Two separate, reliable freshwater supplies should be available. Saltwater or brackish water should not be used unless all freshwater supplies have been exhausted.

b. The fire-water supply should be calculated on the basis of the largest expected flow rate for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, but not less than 1,136,000 liters (L) (300,000 gallons (gal)). This flow rate should be based (conservatively) on 1,900 liters per minute (L/min) (500 gal/min) for manual hose streams, plus the largest design demand of any sprinkler or deluge system, as determined in accordance with NFPA 13, Standard for the Installation of Sprinkler Systems (Ref. 75), or NFPA 15, Standard for Water Spray Fixed Systems for Fire Protection (Ref. 76).

c. If tanks are used for water supply, two 100-percent system capacity tanks (minimum of 1,136,000 L (300,000 gal) each) should be installed. They should be interconnected to allow pumps to take suction from either or both. However, a failure in one tank or its piping should not cause both tanks to drain. Water supply capacity should be capable of refilling either tank in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or less.

d. Common water supply tanks are acceptable for fire and sanitary or service water storage. When they are used, however, minimum fire-water storage requirements should be dedicated by passive means (for example, use of a vertical standpipe for other water services). Administrative controls, including locks for tank outlet valves, are unacceptable as the only means to ensure minimum water volume.

e. Freshwater lakes or ponds of sufficient size may qualify as the sole source of water for fire protection but require separate redundant suctions in one or more intake structures. These supplies should be separated, so that a failure of one supply will not result in a failure of the other supply.

f. When a common water supply is permitted for fire protection and the ultimate heat sink, the following conditions should also be satisfied:

(1) The additional fire protection water requirements are designed into the total storage capacity.

(2) Failure of the fire protection system should not degrade the function of the ultimate heat sink.

g. Other water systems that may be used as one of the two fire-water supplies should be permanently connected to the fire main system and should be capable of automatic alignment to the fire main system. Pumps, controls, and power supplies in these systems should satisfy the DG-1359, Page 46

requirements for the main fire pumps. The use of other water systems for fire protection should be compatible with their safe-shutdown functions. Failure of the other system should not degrade the fire main system.

h. For multiunit nuclear power plant sites with a common yard fire main loop, common water supplies may be used.

i. Fire-water supplies should be filtered and treated as necessary to prevent or control biofouling or microbiologically induced corrosion of fire-water systems. If the supply is raw service water, fire-water piping runs should be periodically flushed and flow-tested.

j. Provisions should be made to supply water to at least two standpipes and hose connections for manual firefighting in areas containing equipment required for safe plant shutdown in the event of a safe-shutdown earthquake. The piping system serving such hose stations should be analyzed for safe-shutdown earthquake loading and should be provided with supports to ensure system pressure integrity. The piping and valves for the portion of the hose standpipe system affected by this functional requirement should satisfy ASME B31.1, Power Piping (Ref. 77). The water supply for this condition may be obtained by manual operator actuation of valves in a connection to the hose standpipe header from a normal seismic Category I water system, such as the essential service water system. The cross-connection should be (1) capable of providing flow to at least two hose stations (approximately 284 L/min (75 gal/min) per hose station), and (2) designed to the same standards as the seismic Category I water system (i.e., it should not degrade the performance of the seismic Category I water system).

3.2.2 Fire Pumps Fire pump installations should conform to NFPA 20, Standard for the Installation of Stationary Pumps for Fire Protection (Ref. 78), and should meet the following criteria:

a. If fire pumps are required to meet system pressure or flow requirements, a sufficient number of pumps is provided to ensure that 100-percent capacity will be available, assuming failure of the largest pump or loss of offsite power (e.g., three 50-percent pumps or two 100-percent pumps).

This can be accomplished, for example, by providing either electric-motor-driven fire pumps and diesel-driven fire pumps or two or more seismic Category I Class 1E electric-motor-driven fire pumps connected to redundant Class 1E emergency power buses (see RG 1.6, RG 1.32, and RG 1.75).

b. Individual fire pump connections to the yard fire main loop are separated with sectionalizing valves between connections. Each pump and its driver and controls are located in a room separated from the remaining fire pumps by a fire wall with a minimum rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

c. The fuel for the diesel fire pumps is separated so that it does not provide a fire source that exposes equipment important to safety.

d. The control room contains alarms or annunciators to indicate pump running, driver availability, failure to start, and low fire main pressure.

DG-1359, Page 47

3.2.3 Fire Mains An underground yard fire main loop should be installed to furnish anticipated water requirements.

NFPA 24 provides appropriate guidance for such an installation. NFPA 24 references other design codes and standards developed by such organizations as ANSI and the American Water Works Association. The following specific criteria should be addressed:

a. The type of pipe and water treatment are design considerations, with tuberculation as one of the parameters.

b. The means for inspecting and flushing the fire main are provided.

c. Sectional control valves should be visually indicating (e.g., post indicator valves).

d. Control and sectionalizing valves in fire mains and water-based fire suppression systems are electrically supervised or administratively controlled (e.g., locked valves with key control, tamper-proof seals). The electrical supervision signal indicates in the control room. All valves in the fire protection system are periodically checked to verify position.

e. The fire main system piping is separate from service or sanitary water system piping, except as described in Regulatory Position 3.2.1 of this guide, with regard to providing a seismically designed water supply for standpipes and hose connections.

f. A common yard fire main loop may serve multiunit nuclear power plant sites if cross-connected between units. Sectional control valves permit independence of the individual loop around each unit. For multiple-reactor sites with widely separated plants (approaching 1.6 kilometer (km)

(1 mile (mi) or more)), separate yard fire main loops are used.

g. Sectional control valves are provided to isolate portions of the fire main for maintenance or repair without shutting off the supply to primary and backup fire suppression systems serving areas that contain or expose equipment important to safety.

h. Valves are installed to permit isolation of outside hydrants from the fire main for maintenance or repair without interrupting the water supply to automatic or manual fire suppression systems in any area containing or presenting a fire hazard to equipment important to safety.

i. Sprinkler systems and manual hose station standpipes have connections to the yard main system, so that a single active failure or a line break cannot impair both the primary and backup fire suppression systems. Alternatively, headers fed from each end are permitted inside buildings to supply both sprinkler and standpipe systems, provided that steel piping and fittings meeting the requirements of ASME B31.1 are used for the headers, up to and including the first valve supplying the sprinkler systems, when such headers are part of the seismically analyzed hose standpipe system. When provided, such headers are considered an extension of the yard main system. Each sprinkler and standpipe system should be equipped with an outside screw and yoke gate valve or other approved shutoff valve and water flow alarm.

DG-1359, Page 48

3.3 Automatic Fire Suppression Systems Automatic suppression systems should be installed as determined by the fire hazards analysis and as necessary to protect redundant systems or components necessary for safe shutdown and SSCs important to safety (see Regulatory Positions 5.3.1.1.b, 5.3.1.1.d, and 6 of this guide).

In areas of high seismic activity, licensees should consider the need to design the fire suppression systems to be functional following a safe-shutdown earthquake.

The fire suppression systems should retain their original design capability for (1) natural phenomena of less severity and greater frequency than the most severe natural phenomena (approximately once in 10 years), such as tornadoes, hurricanes, floods, ice storms, or small-intensity earthquakes that are characteristic of the geographic region, and (2) potential manmade site-related events, such as oil barge collisions or aircraft crashes, that have a reasonable probability of occurring at a specific plant site.

For water suppression systems and fire detection systems that use metal plates for heat collection above individual sprinkler heads or detectors that are located well below the ceiling of a fire area (e.g., at some intermediate height in the room, below a ceiling-mounted pipe and cable tray), licensees should demonstrate that this design will ensure acceptable actuation times. In general, the use of such plates has not been shown to provide adequate heat collection to effectively activate the sprinkler head or detector and may impair system response.

3.3.1 Water-Based Fire Suppression Systems Equipment important to safety that does not itself require protection by water-based suppression systems, but is subject to unacceptable damage if wetted by suppression system discharge, should be appropriately protected (e.g., water shields or baffles). Drains should be provided as required to protect equipment important to safety from flooding damage.

3.3.1.1 Sprinkler and Spray Systems Water sprinkler and spray suppression systems are the most widely used means of implementing automatic water-based fire suppression. Sprinkler and spray systems should conform to requirements of appropriate standards such as NFPA 13 and NFPA 15.

3.3.1.2 Water Mist Systems Water mist suppression systems may be useful in specialized situations, particularly in those areas where the application of water needs to be restricted. Water mist systems should conform to appropriate standards, such as NFPA 750, Standard on Water Mist Fire Protection Systems (Ref. 79).

3.3.1.3 Foam-Water Sprinkler and Spray Systems Certain fires, such as those involving flammable liquids, respond well to foam suppression.

Licensees should consider the use of foam sprinkler and spray systems, which should conform to appropriate standards, such as NFPA 16, Standard for the Installation of Foam-Water Sprinkler and Foam-Water Spray Systems (Ref. 80), and NFPA 11, Standard for Low-, Medium-, and High-Expansion Foam (Ref. 81).

DG-1359, Page 49

3.3.2 Gaseous Fire Suppression Systems Gaseous systems should be evaluated for potential impacts on the habitability of areas containing equipment important to safety where operations personnel perform safe-shutdown actions or where firefighting activities may become necessary. Where gas suppression systems are installed, openings in the area should be adequately sealed or the suppression system should be sized to compensate for the loss of the suppression agent through floor drains and other openings (see also Regulatory Position 4.1.5 of this guide).

The design of gaseous suppression systems should consider the following, as applicable:

a. the minimum required gas concentration, distribution, soak time, and ventilation control;

b. the anoxia and toxicity hazards associated with the gas;

c. the possibility of damage from secondary thermal shock (cooling);

d. conflicting requirements for venting during system discharge to prevent overpressurization versus sealing to prevent loss of agent;

e. location and selection of the activating detectors; and

f. the toxicity and corrosive characteristics of the thermal decomposition products of the agent.

Where total-flooding gas extinguishing systems are used, area intake and exhaust ventilation dampers should be controlled, in accordance with appropriate standards, to maintain the necessary gas concentration (see NFPA 12, Standard on Carbon Dioxide Extinguishing Systems (Ref. 82);

NFPA 12A, Standard on Halon 1301 Fire Extinguishing Systems (Ref. 83); and NFPA 2001, Standard for Clean Agent Fire Extinguishing Systems (Ref. 84). Also, see Regulatory Position 4.1.4.4 of this guide).

The adequacy of gaseous suppression systems and protected-area boundary seals to contain the gas suppressant should be tested, as specified in the applicable NFPA standards.

Manually actuated gaseous suppression systems should not be used as the primary suppression system for protecting SSCs important to safety. Manually actuated gaseous systems are acceptable as a backup to automatic water-based fire suppression systems.

3.3.2.1 Carbon Dioxide Systems Carbon dioxide (CO2) extinguishing systems should comply with the requirements in NFPA 12.

Where automatic CO2 systems are used, they should be equipped with a predischarge alarm system and a discharge delay to permit personnel egress. Provisions for locally disarming automatic CO2 systems should be key locked and under strict administrative control. Automatic CO2 extinguishing systems should not be disarmed unless controls, as described in Regulatory Position 2.4 of this guide, are provided.

DG-1359, Page 50

In addition to the guidelines of NFPA 12, licensees should ensure preventive maintenance and testing of the systems, including verifying agent quantity of high-pressure CO2 cylinders.

3.3.2.2 Halon Halon fire extinguishing systems should comply with the requirements of NFPA 12A. When automatic Halon systems are used, they should be equipped with a pre-discharge alarm and a discharge delay to permit personnel to exit. Provisions for locally disarming automatic Halon systems should be key locked and under strict administrative control. Automatic Halon extinguishing systems should not be disarmed unless controls, as described in Regulatory Position 2.4 of this guide, are provided.

In addition to the guidelines of NFPA 12A, licensees should ensure preventive maintenance and testing of the systems, including verifying agent quantity of the Halon cylinders.

3.3.2.3 Clean Agents Halon alternative (or clean agent) fire extinguishing systems should comply with applicable standards, such as NFPA 2001. Only listed or approved agents should be used. Provisions for locally disarming automatic systems should be key locked and under strict administrative control. Automatic extinguishing systems should not be disarmed unless controls, as described in Regulatory Position 2.4 of this guide, are provided.

In addition to the guidelines of NFPA 2001, licensees should ensure preventive maintenance and testing of the systems, including verifying agent quantity of the clean agent cylinders or containers.

3.4 Manual Suppression Systems and Equipment The licensee should provide a manual firefighting capability throughout the plant to limit the extent of fire damage. Standpipes, hydrants, and portable equipment consisting of hoses, nozzles, and extinguishers should be provided for use by properly trained firefighting personnel.

3.4.1 Standpipes and Hose Stations Interior manual hose installations should be able to reach, with at least one effective hose stream, any location that contains, or could present, a fire exposure hazard to equipment important to safety. To accomplish this, all buildings on all floors should have standpipes with hose connections equipped with a maximum of 30.5 meters (m) (100 feet (ft)) of 38-mm (1.5-in.) woven-jacket, lined fire hose and suitable nozzles. These systems should conform to NFPA 14, Standard for the Installation of Standpipe and Hose Systems (Ref. 85), for sizing, spacing, and pipe support requirements for Class III standpipes. Water supply calculations should demonstrate that the water supply system can meet the standpipe pressure and flow requirements of NFPA 14.

Hose stations should be located as dictated by the fire hazards analysis to facilitate access and use for firefighting operations. Alternative hose stations should be provided for an area if the fire hazard could block access to a single hose station serving that area.

The proper type of hose nozzle to be supplied to each area should be based on the fire hazards analysis. The usual combination spray/straight-stream nozzle should not be used in areas where the DG-1359, Page 51

straight stream can cause unacceptable mechanical damage. Fixed fog nozzles should be provided at locations where high-voltage shock hazards exist. All hose nozzles should have shutoff capability.

Volume II, Section 10, Chapter 1, of the 19th Edition of the NFPA Fire Protection Handbook, issued in 2003 (Ref. 86), provides guidance on safe distances for water application to live electrical equipment.

Fire hoses should meet the recommendations of NFPA 1961, Standard on Fire Hose (Ref. 87),

and should be hydrostatically tested in accordance with the recommendations of NFPA 1962, Standard for the Care, Use, Inspection, Service Testing and Replacement of Fire Hose Couplings, Nozzles, and Fire Hose Appliances (Ref. 88).

3.4.2 Fire Hydrants and Hose Houses Outside manual hose installations should be sufficient to provide an effective hose stream to any onsite location where fixed or transient combustibles could jeopardize equipment important to safety.

Hydrants should be installed approximately every 76 m (250 ft) on the yard main system. A hose house equipped with hose and combination nozzle and other auxiliary equipment recommended in NFPA 24 should be provided as needed, but at least every 305 m (1,000 ft). Alternatively, a mobile means of providing hose and associated equipment, such as hose carts or trucks, may be used. When provided, such mobile equipment should be equivalent to the equipment supplied by three hose houses. Mobile equipment should be maintained in good working order and should be readily available for firefighting activities.

Threads compatible with those used by local fire departments should be provided on all hydrants, hose couplings, and standpipe risers. Alternatively, a sufficient number of hose thread adapters may be provided.

Fire hoses should be hydrostatically tested in accordance with the recommendations of NFPA 1962. Fire hoses stored in outside hose houses should be tested annually.

3.4.3 Manual Foam For flammable and combustible liquid fire hazards, licensees should consider the use of foam systems for manual fire suppression protection. These systems should comply with the provisions of NFPA 11.

3.4.4 Fire Extinguishers Fire extinguishers should be provided in areas that contain or could present a fire exposure hazard to equipment important to safety. Extinguishers should be installed with due consideration given to possible adverse effects on equipment important to safety in the area. NFPA 10, Standard for Portable Fire Extinguishers (Ref. 89), provides guidance on the installation (including location and spacing) and the use and application of fire extinguishers.

3.4.5 Fixed Manual Fire Suppression Systems Some fixed fire suppression systems may be manually actuated (e.g., fixed suppression systems provided in accordance with Section III.G.3 of Appendix R to 10 CFR Part 50). Manual actuation is generally limited to water spray systems and should not be used for gaseous suppression systems, except DG-1359, Page 52

when the system provides backup to an automatic water suppression system. Fixed manual suppression systems should be designed in accordance with applicable guidance in the appropriate NFPA standards. A change from an automatic system to a manually actuated system should be supported by an appropriate evaluation.

3.5 Manual Firefighting Capabilities 3.5.1 Fire Brigade A site fire brigade, trained and equipped for firefighting, should be established and should be on site at all times to ensure adequate manual firefighting capability for all areas of the plant containing SSCs important to safety. The fire brigade leader should have ready access to keys for any locked doors.

Regulatory Position 1.6.4 of this guide provides guidance on fire brigade training and qualifications. The guidelines of NFPA 600 are considered appropriate criteria for organizing, training, and operating a plant fire brigade.

3.5.1.1 Fire Brigade Staffing The fire brigade should include at least five members on each shift. The shift supervisor should not be a member of the fire brigade.

3.5.1.2 Equipment The equipment provided for the brigade should consist of personal protective equipment, such as turnout coats, bunker pants, boots, gloves, hard hats, emergency communications equipment, portable lights, portable ventilation equipment, and portable extinguishers. Self-contained breathing apparatuses using full-face positive-pressure masks approved by the National Institute for Occupational Safety and Health (approval formerly given by the U.S. Bureau of Mines) should be provided for fire brigade, damage control, and control room personnel. At least 10 masks should be available for fire brigade personnel. Control room personnel may be furnished breathing air by a manifold system piped from a storage reservoir, if practical. Service or rated operating life should be at least 30 minutes for the self-contained units. NFPA 1404, Standard for Fire Service Respiratory Protection Training (Ref. 90),

provides additional guidance.

Fire brigade equipment should be stored in accordance with manufacturers recommendations (e.g., firefighter clothing should not be stored where it will be subjected to ultraviolet light from the sun, welding, or fluorescent lights).

At least a 1-hour supply of breathing air in extra bottles should be located on the plant site for each self-contained breathing apparatus. In addition, an onsite 6-hour supply of reserve air should be provided for the fire brigade personnel and arranged to permit quick and complete replenishment of exhausted air supply bottles as they are returned. If compressors serve as a source of breathing air, only units approved for breathing air should be used, and the compressors should be operable in the event of a loss of offsite power. Special care should be taken to locate the compressor in areas free of dust and contaminants.

DG-1359, Page 53

During refueling and maintenance periods, adequate self-contained breathing apparatuses should be provided near the containment entrances for firefighting and damage control personnel. These units should be independent of any breathing apparatuses or air supply systems provided for general plant activities and should be clearly marked as emergency equipment.

3.5.1.3 Procedures and Pre-Fire Plans Procedures should be established to control actions by the fire brigade upon notification by the control room of a fire and to define firefighting strategies. These procedures should include the following:

a. actions to be taken by control room personnel to notify the fire brigade upon report of a fire or receipt of an alarm on the control room fire alarm panel (e.g., announcing the location of the fire over the public address system, sounding fire alarms, and notifying the shift supervisor and the fire brigade leader of the type, size, and location of the fire);

b. actions to be taken by the fire brigade after notification by the control room of a fire (e.g., assembling in a designated location, receiving directions from the fire brigade leader, and discharging specific firefighting responsibilities, including selection and transportation of firefighting equipment to the fire location, selection of protective equipment, operating instructions for use of fire suppression systems, and use of preplanned strategies for fighting fires in specific areas); and

c. strategies for fighting fires in all plant areas, including the following:

(1) fire hazards in each area covered by the specific pre-fire plans; (2) SSCs in the affected fire area credited for fire safe shutdown that require protection from fire, fire suppressants, or both; (3) fire suppression agents best suited for extinguishing the fires associated with the fire hazards in that area and the nearest location of these suppression agents; (4) most favorable direction from which to attack a fire in each area, in view of the ventilation direction, access hallways, stairs, and doors that are most likely to be free of fire, and the best station or elevation for fighting the fire, as well as all access and egress routes involving locked doors and the appropriate precautions and methods for access specified; (5) plant systems that should be managed to reduce the damage potential during a local fire and the location of local and remote controls for such management (e.g., any hydraulic or electrical systems in the area or zone covered by the specific firefighting procedure that could increase the hazards in the area because of overpressurization or electrical hazards);

(6) vital heat-sensitive system components that need to be kept cool while fighting a local fire (in particular, hazardous combustibles that need cooling);

(7) organization of firefighting brigades and the assignment of special duties specific to the affected fire area; DG-1359, Page 54

(8) potential radiological and toxic hazards in fire areas or zones; (9) ventilation system operation that ensures desired plant air distribution when the ventilation flow is modified for fire containment or smoke clearing operation; (10) operations requiring control room and shift engineer coordination or authorization; (11) instructions for plant operators and general plant personnel during fires; and (12) communications among the fire brigade leader, fire brigade, offsite mutual aid responders, control room, and licensees emergency response organization.

Appropriate firefighting procedures should identify the techniques and equipment for the use of water in fighting electrical cable fires in nuclear plants, particularly in areas containing a high concentration of electric cables with plastic insulation. NFPA 1620, Standard for Pre-Incident Planning (Ref. 91), provides additional guidance on pre-fire planning.

3.5.1.4 Performance Assessment and Drill Criteria Fire brigade drills should be performed in the plant so that the fire brigade can practice as a team.

Drills should be performed quarterly for each shifts fire brigade. Each fire brigade member should participate in at least two drills annually.

A sufficient number of these drills, but not less than one for each shifts fire brigade per year, should be unannounced to determine the firefighting readiness of the plants fire brigade, brigade leader, and fire protection systems and equipment. Persons planning and authorizing an unannounced drill should ensure that the responding shift fire brigade members are not aware that a drill is being planned until it has begun. At least one drill per year should be performed on a back shift for each shifts fire brigade.

The licensee should preplan the drills to establish training objectives and critique them to determine how well the training objectives have been met. Members of the management staff responsible for plant safety and fire protection should plan and critique unannounced drills. Performance deficiencies of a fire brigade or of individual fire brigade members should be remedied by scheduling additional training for the brigade or members. Unsatisfactory drill performance should be followed by a repeat drill within 30 days.

The local fire department should be invited to participate in drills at least annually.

At 3-year intervals, qualified individuals independent of the licensees staff should critique a randomly selected unannounced drill. A copy of the written report from such individuals should be available for NRC inspection.

Drills should include the following objectives:

a. The effectiveness of the fire alarms; time required to notify and assemble the fire brigade; and selection, placement, and use of equipment and firefighting strategies should be assessed.

DG-1359, Page 55

b. Each brigade members knowledge of his or her role in the firefighting strategy for the area assumed to contain the fire, and the brigade members conformance with established plant firefighting procedures and use of firefighting equipment, including self-contained emergency breathing apparatuses, communication, lighting, and ventilation should be assessed.

c. The simulated use of firefighting equipment required to cope with the situation and type of fire selected for the drill should be evaluated. The area and type of fire chosen for the drill should differ from those used in the previous drills, so that brigade members are trained in fighting fires in various plant areas. The situation selected should assume loss of automatic suppression capability and simulate the size and arrangement of a fire that could reasonably occur in the area selected, allowing for fire development during the time required to respond, obtain equipment, and organize for the fire.

d. The brigade leaders direction of the firefighting effort should be assessed with regard to thoroughness, accuracy, and effectiveness.

Drill records should be retained for a period of 3 years and be made available for NRC inspection (see Regulatory Position 1.6.4 of this guide for additional direction on drill records).

3.5.2 Offsite Manual Firefighting Resources Onsite fire brigades typically fulfill the role of first responder but may not have sufficient personnel, equipment, and capability to handle all possible fire events. Arrangements with offsite fire services may be necessary to augment onsite firefighting capabilities, consistent with the fire hazards analysis and pre-fire planning documents. The FPP should describe the capabilities (e.g., equipment compatibility, training, drills, and command control) of offsite responders.

3.5.2.1 Capabilities The local offsite fire departments that provide backup manual firefighting resources should have the following capabilities:

a. personnel and equipment with capacities consistent with those assumed in the plants fire hazards analysis and pre-fire plans; and

b. hose threads or adapters to connect with onsite hydrants, hose couplings, and standpipe risers.

(Regulatory Position 3.4.2 states that onsite fire suppression water systems should have threads compatible with those used by local fire departments or a sufficient number of thread adapters available.)

3.5.2.2 Training Local offsite fire department personnel who provide backup manual firefighting resources should be trained in the following:

a. operational precautions when fighting fires on nuclear power plant sites and the need for radiological protection of personnel and the special hazards associated with a nuclear power plant site; DG-1359, Page 56

b. the procedures for notification and expected roles of the offsite responders;

c. site access procedures and the identity (by position and title) of the individual in the onsite organization who will control the responders support activities (offsite response support personnel should be provided with appropriate identification cards where required);

d. fire protection authorities, responsibilities, and accountabilities with regard to responding to a plant fire, including the fire event command structure between the plant fire brigade and offsite responders; and

e. plant layout, plant fire protection systems and equipment, plant fire hazards, and pre-fire response plans and procedures.

3.5.2.3 Agreements and Plant Exercises The licensee should establish written mutual aid agreements between the utility and the offsite fire departments that are listed in the fire hazards analysis and pre-fire plans as providing a support response to a plant fire. These agreements should delineate fire protection authorities, responsibilities, and accountabilities with regard to responding to plant fire or emergency events, including the fire event command structure between the plant fire brigade and offsite responders.

The plant fire brigade drill schedule should provide for periodic local fire department participation (at least annually). These drills should effectively exercise the fire event command structure between the plant fire brigade and offsite responders (see Regulatory Position 3.5.1.4 for guidance on the conduct and evaluation of fire brigade drills). Offsite fire department response should be tested periodically, in conjunction with the required exercises of the radiological emergency response plan required by 10 CFR 50.47, Emergency plans.

4. Building Design and Passive Features 4.1 General Building and Building System Design This section provides guidance on building layout (e.g., fire areas and zones), materials of construction, and building system design (e.g., heating, ventilating, and air conditioning (HVAC),

electrical, lighting, and communication systems) important to effective fire prevention and protection.

Regulatory Position 4.2 provides guidance for passive fire barriers.

4.1.1 Combustibility of Building Components and Features According to GDC 3 in Appendix A to 10 CFR Part 50, noncombustible and heat-resistant materials must be used wherever practical throughout the unit. Interior wall and structural components, thermal insulation materials, radiation shielding materials, and soundproofing should be noncombustible.

The fire hazards analysis should identify in situ combustible materials used in plant SSCs and specify suitable fire protection.

Metal deck roof construction should be noncombustible and listed as acceptable for fire in the Underwriters Laboratories, Inc. (UL) Building Materials Directory (Ref. 92) or listed as Class I in the DG-1359, Page 57

Factory Mutual Research Corp., Factory Mutual Research Approval GuideEquipment, Materials, and Services for Conservation of Property, issued September 2000 (Ref. 93).

4.1.1.1 Interior Finish Interior finishes should be noncombustible. The following materials are acceptable for use as interior finish without evidence of test and listing by a recognized testing laboratory:

a. plaster, acoustic plaster, and gypsum plasterboard (gypsum wallboard), either plain, wallpapered, or painted with oil- or water-based paint;

b. ceramic tile and ceramic panels;

c. glass and glass blocks;

d. brick, stone, and concrete blocks, plain or painted;

e. steel and aluminum panels, plain, painted, or enameled; and

f. vinyl tile, vinyl-asbestos tile, linoleum, or asphalt tile on concrete floors.

Suspended ceilings and their supports should be of noncombustible construction. Concealed spaces should be devoid of combustibles except as noted in Regulatory Position 6.1.2 of this guide.

In situ fire hazards should be identified and suitable protection provided.

4.1.1.2 Testing and Qualification Interior finishes should be noncombustible (see the Glossary of this guide) or listed by an approving laboratory for the following:

a. surface flame spread rating of 25 or less and a smoke development rating of 450 or less, when tested under ASTM International (ASTM) E84, Standard Test Method for Surface Burning Characteristics of Building Materials (Ref. 94);

b. potential heat release of 8,141 kilojoules per kilogram (kJ/kg) (3,500 Btu/pound (lb)) or less when tested under ASTM D3286, Standard Test Method for Gross Calorific Value of Coal and Coke by the Isoperibol Bomb Calorimeter (Ref. 95), or NFPA 259, Standard Test Method for Potential Heat of Building Materials (Ref. 96). The concept of using a potential heat release limit of 8,141 kJ/kg (3,500 Btu/lb) is like the limited combustible concept with its similar limit, as set forth in NFPA 220, Standard on Types of Building Construction (Ref. 97);

c. floor covering critical radiant flux as determined by testing in accordance with NFPA 253, Standard Method of Test for Critical Radiant Flux of Floor Covering Systems Using a Radiant Heat Energy Source (Ref. 98).

DG-1359, Page 58

4.1.2 Compartmentalization, Fire Areas, and Zones In accordance with GDC 3 in Appendix A to 10 CFR Part 50, SSCs important to safety must be designed and located to minimize the probability and effect of fires and explosions. The concept of compartmentalization meets GDC 3, in part, by using passive fire barriers to subdivide the plant into separate areas or zones. The primary purpose of these fire areas or zones is to confine the effects of fires to a single compartment or area, thereby minimizing the potential for adverse effects from fires on redundant SSCs important to safety.

4.1.2.1 Fire Areas A fire area is defined as that portion of a building or plant that is separated from other areas by fire barriers, including components of construction such as beams, joists, columns, penetration seals or closures, fire doors, and fire dampers. Fire barriers that define the boundaries of a fire area should have a fire-resistance rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> or more and should achieve the following:

a. separation of SSCs important to safety from any potential fires in nonsafety-related areas that could affect their ability to perform their safety function;

b. separation of redundant trains of systems and components important to safety from each other so that both are not subject to damage from a single fire; and

c. separation of individual units on a multiunit site unless the requirements of GDC 5, Sharing of Structures, Systems, and Components, in Appendix A to 10 CFR Part 50 are met with respect to fires.

The fire hazards analysis should be used to establish fire areas. Particular design attention to the use of separate, isolated fire areas for redundant cables will help to avoid loss of redundant cables important to safety. Separate fire areas should also be employed to limit the spread of fires between components, including high concentrations of cables important to safety that are major fire hazards within a safety division.

Where fire area boundaries are not 3-hour rated, or not wall-to-wall or floor-to-ceiling boundaries with all penetrations sealed to the fire rating of the boundaries, the licensee should evaluate the adequacy of the fire area boundaries (i.e., barriers) to determine whether the boundaries will withstand the hazards associated with the area and, as necessary, protect important equipment within the area from a fire outside the area. Unsealed openings should be identified and considered when evaluating the overall effectiveness of the barrier (see Regulatory Position 4.2.1 of this guide for positions related to fire barrier testing and acceptance).

If a wall or floor/ceiling assembly contains major unprotected openings, such as hatchways and stairways, plant locations on either side of such a barrier should be considered part of a single fire area. If success path A is separated by a cumulative horizontal distance of 6.1 m (20 ft) from success path B, with no intervening combustible materials or fire hazards, and both elevations are provided with fire detection and suppression, the area would be considered acceptable.

Exterior walls, including penetrations, should be qualified as rated fire barriers if they are required to separate safe-shutdown equipment on the interior of the plant from the redundant equipment DG-1359, Page 59

located in the immediate vicinity of the exterior wall, if they separate plant areas important to safety from nonsafety-related areas that present a significant fire exposure to the areas important to safety, or if otherwise designated by the FSAR or fire hazards analysis.

An exterior yard area without fire barriers should be considered as one fire area. The area may consist of several fire zones (see Regulatory Position 4.1.2.2 of this guide).

4.1.2.2 Fire Zones Fire zones are subdivisions of a fire area and are typically based on fire hazards analyses that demonstrate that the fire protection systems and features within the fire zone provide an appropriate level of protection for the associated hazards. Fire zone concepts may be used to establish zones within fire areas where further subdivision into additional fire areas is not practical on the basis of existing plant design and layout (e.g., inside containment).

Evaluations by some licensees made before Appendix R to 10 CFR Part 50 was published were based on fire zones that do not meet the strict definition of fire areas. In some cases, the separation of redundant success paths within the fire zone boundaries and the separation between fire zones do not comply with the separation requirements of Appendix R. Such configurations may be acceptable under the exemption process.

An exterior yard area considered as one fire area may consist of several fire zones. The fire hazards analysis should be used to determine the boundaries of the fire zones. The protection for redundant, alternative, or dedicated shutdown systems within a yard area should be determined on the basis of the largest postulated fire that is likely to occur and the resulting damage. The boundaries of such damage should be justified with a fire hazards analysis. The analysis should consider the degree of spatial separation between divisions; the presence of in situ and transient combustibles, including vehicular traffic; grading; available fire protection; sources of ignition; and the vulnerability and criticality of the shutdown-related systems.

4.1.2.3 Access and Egress Design The plant layout should provide adequate means of access to all plant areas for manual fire suppression. The plant layout should also allow for safe access and egress to areas for personnel performing safe-shutdown operations. Considerations should include fire and post-fire habitability in safe-shutdown areas, protection or separation from fire conditions of access and egress pathways to safe-shutdown SSCs, and potential restrictions or delays to safe-shutdown area access potentially caused by security locking systems.

Stairwells outside primary containment serving as escape routes, access routes for firefighting, or access routes to areas containing equipment necessary for safe shutdown should be enclosed in masonry or concrete towers with a minimum fire rating of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and self-closing Class B fire doors. Fire exit routes should be clearly marked.

Prompt emergency ingress into electrically locked areas by essential personnel should be ensured through the combined use and provision of the following features:

DG-1359, Page 60

a. reliable and uninterruptible auxiliary power to the entire electrical locking system, including its controls,

b. electrical locking devices that are required to fail in the secure mode for security purposes, with secure mechanical means and associated procedures to override the devices upon loss of both primary and auxiliary power (e.g., key locks with keys held by appropriate personnel who know when and how to use them), and

c. periodic tests of all locking systems and mechanical overrides to confirm their operability or functionality and their capability to switch to auxiliary power.

Regulatory Positions 4.1.6 and 4.1.7 of this RG provide direction related to emergency lighting and communication capabilities during fires.

4.1.3 Electrical Cable System Fire Protection Design 4.1.3.1 Cable Design Electric cable construction should pass the flame test in IEEE Standard 383, IEEE Standard for Type Test of Class IE Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations (Ref. 99), or IEEE Standard 1202, IEEE Standard for Flame Testing of Cables for Use in Cable Trays in Industrial and Commercial Occupancies (Ref. 100) (this does not imply that cables passing either test will not require additional fire protection). In the more recent editions of these standards, the flame testing requirements for cable that were originally included in IEEE 383 have been moved to IEEE 1202. For cable installations in operating plants and plants under construction before July 1, 1976, that do not meet the IEEE Standard 383 flame test requirements, all cables should be covered with an approved flame-retardant coating and properly derated or be protected by automatic suppression.

Although cable coatings have been shown to reduce flame spread, coated cables are considered intervening combustibles when determining the protection requirements of Section III.G.2 of Appendix R to 10 CFR Part 50. Coated cables do not have higher damage thresholds and, therefore, are not equivalent to IEEE 383 or IEEE 1202 cables. In addition, coated cables can and do ignite in fires. Fire-retardant coatings alone may not be credited as equivalent to 1- or 3-hour fire barriers.

New reactor fiber optic cable insulation and jacketing should also meet the fire and flame test requirements of IEEE 1202.

4.1.3.2 Raceway/Cable Tray Construction Only metal should be used for cable trays. Only metallic tubing should be used for conduit.

Thin-wall metallic tubing should not be used. Flexible metallic tubing should be used only in short lengths to connect components to equipment. Other raceways should be made of noncombustible material. Cable raceways should be used only for cables.

4.1.3.3 Electrical Cable System Fire Detection and Suppression Redundant cable systems important to safety outside the cable spreading room should be separated from each other and from potential fire exposure hazards in nonsafety-related areas by fire barriers with a minimum fire rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to the extent feasible. Those fire areas that contain cable DG-1359, Page 61

trays important to safety should be provided with fire detection. Cable trays should be accessible for manual firefighting, and cables should be designed to allow wetting down with fire suppression water without electrical faulting. Manual hose stations and portable hand extinguishers should be provided.

Manual hose standpipe systems may be relied on to provide the primary fire suppression (in lieu of automatic water suppression systems) for cable trays of a single division important to safety that are separated from redundant safety divisions by a fire barrier with a minimum rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and are normally accessible for manual firefighting if all of the following conditions are met:

a. The number of equivalent standard 610-mm (24-in.)-wide cable trays (both important to safety and nonsafety related) in a given fire area is six or less. Trays exceeding 610 mm (24 in.) should be counted as two trays; trays exceeding 1,220 mm (48 in.) should be counted as three trays, regardless of tray fill.

b. The cabling does not provide instrumentation, control, or power to systems required to achieve and maintain hot shutdown.

c. Smoke detectors are provided in the area of these cable routings, and continuous line-type heat detectors are provided in the cable trays.

In other areas where overriding design features necessary for nuclear safety prevent the separation of redundant cable systems important to safety by 3-hour-rated fire barriers, or if cable trays are not accessible for manual firefighting, an automatic fire suppression system should protect the cable trays.

4.1.3.4 Electrical Cable Separation Redundant systems used to mitigate the consequences of design-basis accidents, but not necessary for safe shutdown, may be lost to a single exposure fire. However, protection should be provided so that a fire within only one such system will not damage the redundant system. Therefore, the separation guidelines of Regulatory Position 5.3.1.1 of this guide apply only to the electrical cabling needed to support the systems that are used for post-fire safe shutdown. All other redundant Class 1E electrical cables should meet the separation guidelines of RG 1.75.

When the electrical cabling is covered by separation criteria required for both post-fire safe shutdown and accident mitigation, the more stringent criteria of Regulatory Position 5.3.1.1 apply.

(Compliance with post-fire safe-shutdown requirements may be achieved without separation of redundant Class 1E cabling by providing alternative or dedicated shutdown capability (see Regulatory Position 5.4);

however, this does not preclude the separation criteria of RG 1.75 for redundant Class 1E cables used in accident mitigation.)

For plants with a construction permit issued before July 1, 1976, where cables important to safety do not satisfy the provisions of RG 1.75, all exposed cables should be covered with an approved fire-retardant coating or a fixed automatic water fire suppression system.

DG-1359, Page 62

4.1.3.5 Transformers Transformers that present a fire hazard to equipment important to safety should be protected as described in Regulatory Position 7.3 of this guide.

4.1.3.6 Electrical Cabinets Electrical cabinets present an ignition source for fires and a potential for explosive electrical faults that can damage not only the cabinet of origin, but also equipment, cables, and other electrical cabinets in the vicinity of the cabinet of origin. Fire protection systems and features provided for the general area containing the cabinet may not be adequate to prevent damage to adjacent equipment, cables, and cabinets following an energetic electrical fault. Energetic electrical faults are more of a concern with high-voltage electrical cabinets (i.e., 480 volts (V) and above). High-voltage cabinets should be provided with adequate spatial separation or substantial physical barriers to minimize the potential for an energetic electrical fault to damage adjacent equipment, cables, or cabinets important to safety.

Rooms containing electrical cabinets important to safety should be provided with areawide automatic fire detection, automatic fire suppression, and manual fire suppression capability.

Electrical cabinets containing a quantity of combustible materials (e.g., cabling) sufficient to propagate a fire outside the cabinet of fire origin should be provided with in-cabinet automatic fire detection.

4.1.4 Heating, Ventilation, and Air Conditioning Design Suitable design of the ventilation systems can limit the consequences of a fire by preventing the spread of the products of combustion to other fire areas. It is important that means be provided to ventilate, exhaust, or isolate the fire area as required and that consideration be given to the consequences of ventilation system failure caused by the fire, resulting in a loss of control for ventilating, exhausting, or isolating a given fire area.

Special protection for ventilation power and control cables may be necessary. The power supply and controls for mechanical ventilation systems should be run outside the fire area served by the system where practical.

Release of smoke and gases containing radioactive materials to the environment should be monitored in accordance with emergency plans as described in RG 1.101, Emergency Planning and Preparedness for Nuclear Power Reactors (Ref. 101). Any ventilation system designed to exhaust potentially radioactive smoke or gases should be evaluated to ensure that inadvertent operation or single failures will not violate the radiologically controlled areas of the plant design. This should include containment functions for protecting the public and maintaining habitability for operations personnel.

Fresh air supply intakes to areas containing equipment or systems important to safety should be located away from the exhaust air outlets and smoke vents of other fire areas to minimize the possibility of contaminating the intake air with the products of combustion.

DG-1359, Page 63

Where total-flooding gaseous fire suppression systems are used, area intake and exhaust ventilation dampers should be controlled in accordance with NFPA 12, NFPA 12A, or NFPA 2001 to maintain the necessary gas concentration (see also Regulatory Position 3.3.2 of this guide).

4.1.4.1 Combustibility of Filter Media Filters for particulate and gaseous effluents may be fabricated of combustible media (e.g., HEPA and charcoal filters). The ignition and burning of these filters may result in a direct release of radioactive material to the environment or may provide an unfiltered pathway upon failure of the filter. Filter combustion may spread fire to other areas.

Engineered safety feature filters should be protected in accordance with the guidelines of RG 1.52, Design, Inspection, and Testing Criteria for Air Filtration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup System Light-Water-Cooled Nuclear Power Plants (Ref. 102). Any filter that includes combustible materials and is a potential exposure fire hazard that may affect components important to safety should be protected as determined by the fire hazards analysis.

4.1.4.2 Smoke Control and Removal Smoke from fires can be toxic and corrosive and may obscure visibility for emergency egress and access to plant areas. Smoke control and removal may be necessary to support manual suppression activities and safe-shutdown operations.

The installation of automatic suppression systems to limit smoke and heat generation should be considered. Smoke and corrosive gases should generally be discharged directly outside to an area that will not affect plant areas important to safety. The normal plant ventilation system may be used for this purpose, if capable and available. To facilitate manual firefighting, separate smoke and heat vents should be considered in areas such as cable spreading rooms, diesel fuel oil storage areas, switchgear rooms, and other areas where the potential exists for heavy smoke conditions (see NFPA 204, Standard for Smoke and Heat Venting (Ref. 103)).

4.1.4.3 Habitability Protection of plant operations staff from the effects of fire and fire suppression (e.g., gaseous suppression agents) may be necessary to ensure safe shutdown of the plant. For control room evacuation, egress pathways and remote control stations should also be habitable. The protection of safe-shutdown areas from infiltration of gaseous suppression agents should be considered. The capability to ventilate, exhaust, or isolate is particularly important to ensuring the habitability of rooms or spaces that should be attended in an emergency. The design should provide for personnel access to and escape routes from each fire area. Habitability of the following areas should be considered:

a. control room,

b. safe-shutdown areas, and

c. personnel access and egress pathways.

Stairwells should be designed to minimize smoke infiltration during a fire. Staircases may serve as escape routes and access routes for firefighting. Fire exit routes should be clearly marked. Stairwells, DG-1359, Page 64

elevators, and chutes should be enclosed in fire-rated construction with automatic fire doors at least equal to the enclosure construction at each opening into the building. Elevators should not be used during fire emergencies.

4.1.4.4 Fire Dampers Redundant safe-shutdown components may be separated by fire-resistant walls, floors, enclosures, or other types of barriers. For the fire barriers to be effective in limiting the propagation of fire, ventilation duct penetrations of fire barriers should be protected by means of fire dampers that are arranged to automatically close in the event of fire. NFPA 90A, Standard for the Installation of Air-Conditioning and Ventilating Systems (Ref. 104), provides additional guidance (see also Regulatory Position 4.2.1.3 of this guide).

4.1.5 Drainage Floor drains sized to remove expected firefighting water without flooding equipment important to safety should be provided in areas where fixed water fire suppression systems are installed. Floor drains should also be provided in other areas where hand hose lines may be used if such firefighting water could cause unacceptable damage to equipment important to safety in the area. Facility design should ensure that fire-water discharge in one area does not impact equipment important to safety in adjacent areas.

Housekeeping procedures should ensure that accumulated dirt or other debris does not block drains.

Where gaseous suppression systems are installed, the drains should be provided with adequate seals, or the gas suppression system should be sized to compensate for the loss of the suppression agent through the drains (see Regulatory Position 3.3.2 of this guide).

Drainage in areas containing equipment important to safety should be designed to minimize the potential to propagate fire from areas containing flammable or combustible liquids via the drainage system.

Water drainage from areas that may contain radioactivity should be collected, sampled, and analyzed before discharge to the environment.

4.1.6 Emergency Lighting Emergency lighting should be provided throughout the plant as necessary to support fire suppression actions and safe-shutdown operations, including access and egress pathways to safe-shutdown areas during a fire event.

4.1.6.1 Egress Safety Emergency lighting should be provided in support of the emergency egress design guidelines outlined in Regulatory Position 4.1.2.3 of this guide.

4.1.6.2 Post-fire Safe Shutdown Lighting is vital to post-fire safe shutdown and emergency response in the event of fire. The licensee should provide suitable fixed and portable emergency lighting, as follows:

DG-1359, Page 65

a. Fixed, self-contained lighting consisting of fluorescent or sealed-beam units with individual 8-hour minimum battery power supplies should be provided in areas needed for operation of safe-shutdown equipment and for access and egress routes to these areas.

The level of illumination provided by emergency lighting in access routes to and in areas where shutdown functions are performed is sufficient to enable an operator to reach that area and perform the shutdown functions. At the alternative or dedicated shutdown panels, the illumination levels should be sufficient for control panel operators. If a licensee has provided emergency lighting in accordance with Section III.J of Appendix R to 10 CFR Part 50, the licensee should verify by field testing that this lighting is adequate to perform the intended tasks.

Routine maintenance and initial and periodic field testing of emergency lighting systems should ensure their ability to support access, egress, and operations activities for the full 8-hour period accounting for anticipated environmental conditions, battery conditions, and bulb life.

b. Suitable sealed-beam battery-powered portable hand lights should be provided for emergency use by the fire brigade and other operations personnel required to achieve safe plant shutdown.

If a central battery or batteries power the emergency lights, the distribution system should contain protective devices necessary to preclude a fire in one area from causing a loss of emergency lighting in any unaffected area required for safe-shutdown operations.

4.1.7 Communications The communication system design should provide effective communication between plant personnel in all vital areas during fire conditions under maximum potential noise levels.

Two-way voice communications are vital to safe shutdown and emergency response in the event of fire. Suitable communication devices should be provided, as follows:

a. Fixed emergency communications independent of the normal plant communication system should be installed at preselected stations.

b. A portable radio communications system should be provided for use by the fire brigade and other operations personnel required to achieve safe plant shutdown. This system should not interfere with the communications capabilities of the plant security force. Fixed repeaters installed to permit use of portable radio communication units should be protected from exposure or fire damage. Preoperational and periodic testing should demonstrate that the frequencies used for portable radio communication will not affect the actuation of protective relays.

4.1.8 Explosion Prevention In situ and transient explosion hazards should be identified and suitable protection provided.

Transient explosion hazards that cannot be eliminated should be controlled and suitable protection provided (see Regulatory Position 2.1 of this guide for information on control of combustibles).

DG-1359, Page 66

Miscellaneous storage and piping for flammable or combustible liquids or gases should not create a potential exposure hazard to systems important to safety or the fire protection systems that serve those areas (see also Regulatory Positions 2.1.3 and 7.5 of this guide).

Systems or processes that involve hydrogen supplies (e.g., generator cooling systems and reactor coolant hydrogen addition systems) and those that may give off hydrogen or explosive gases (e.g., waste gas and solid radioactive waste processing systems) should be designed to prevent development of explosive mixtures by limiting the concentration of explosive gases and vapors within enclosures to less than 50 percent of the lower explosive limit, or by limiting oxygen within systems containing hydrogen.

Hydrogen distribution and supply systems should include design features that mitigate the consequences of system damage, such as excess flow valves or flow restrictors, double-walled pipe with annulus leak detection, and rupture diaphragms (see also Regulatory Position 7.5 of this guide).

The construction, installation, operation, and maintenance of bulk gas (including liquefied gas) storage and the related loading and dispensing systems should comply with good industry practice and the relevant NFPA standards, as applicable (e.g., NFPA 54, National Fuel Gas Code (Ref. 105), and NFPA 55).

If the potential for an explosive mixture of hydrogen and oxygen exists in offgas systems, the systems should either be designed to withstand the effects of a hydrogen explosion or be provided with dual gas analyzers with automatic control functions to preclude the formation or buildup of explosive mixtures. RG 1.143, Design Guidance for Radioactive Waste Management Systems, Structures, and Components Installed in Light-Water-Cooled Nuclear Power Plants (Ref. 106), includes information for explosion protection for offgas systems.

RG 1.91, Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants (Ref. 107), provides guidance for the assessment of explosion hazards related to transportation near the plant site.

4.2 Passive Fire-Resistive Features 4.2.1 Structural Fire Barriers Fire barriers are those components of construction (walls, floors, and their supports), including beams, joists, columns, penetration seals or closures, fire doors, and fire dampers that are rated by approving laboratories in hours of resistance to fire and are used to prevent the spread of fire.

Where exact replication of a tested configuration cannot be achieved, the field installation should meet all of the following criteria:

a. The continuity of the fire barrier material is maintained.

b. The thickness of the barrier is maintained.

c. The nature of the support assembly is unchanged from the tested configuration.

d. The application or end use of the fire barrier is unchanged from the tested configuration.

DG-1359, Page 67

e. A qualified fire protection engineer has reviewed the configuration and found that it provides an equivalent level of protection.

For new reactor designs, see the enhanced fire protection criteria described in Regulatory Position 8.2 of this guide.

See Regulatory Position 4.1.2 of this guide for additional guidance on the design of fire barriers relative to compartmentalization and separation of equipment.

4.2.1.1 Wall, Floor, and Ceiling Assemblies Wall, floor, and ceiling construction should be noncombustible (see Regulatory Position 4.1.1 of this guide). NFPA 221, Standard for High-Challenge Fire Walls, Fire Walls, and Fire Barrier Walls (Ref. 108), can be used as guidance for the construction of fire barrier walls. Materials of construction for walls, floors, and ceilings serving as fire barriers should be rated by approving laboratories in hours of resistance to fire.

Building design should ensure that openings through fire barriers are properly protected.

Openings through fire barriers that separate fire areas should be sealed or closed to provide a fire-resistance rating at least equal to that required of the barrier itself. The construction and installation techniques for penetrations through fire barriers should be qualified by fire endurance tests (see Regulatory Position 4.2.1.5 of this guide).

4.2.1.2 Fire Doors Building design should ensure that door openings are properly protected with fire doors that have been qualified by a fire test. The construction and installation techniques for doors and door openings through fire barriers should be consistent with the door manufacturers recommendations and the tested configuration.

Modifications to fire doors should be evaluated. Where a door is part of a fire area boundary, and a modification does not affect the fire rating (e.g., installation of security contacts), no further analysis need be performed. If the modifications could reduce the fire rating (e.g., installation of a vision panel),

the fire rating of the door should be reassessed to ensure that it continues to provide a level of protection equivalent to a rated fire door.

Fire doors should be self-closing or provided with closing mechanisms and should be inspected semiannually to verify that automatic hold-open, release, and closing mechanisms and latches are operable. One of the following measures should be provided to ensure that the fire doors will protect the opening as required in case of fire:

a. Fire doors should be kept closed and electrically supervised at a continuously manned location.

b. Fire doors should be locked closed and inspected weekly to verify that the doors are in the closed position.

c. Fire doors should be provided with automatic hold-open and release mechanisms and inspected daily to verify that doorways are free of obstructions.

DG-1359, Page 68

d. Fire doors should be kept closed and inspected daily to verify that they are in the closed position.

Areas protected by automatic total-flooding gas suppression systems should have electrically supervised self-closing fire doors or should satisfy option (a) above.

NFPA 80, Standard for Fire Doors and Other Opening Protectives (Ref. 109), provides additional guidance for fire doors.

4.2.1.3 Fire Dampers Building design should ensure that ventilation openings are properly protected. These openings should be protected with fire dampers that have been fire tested. In addition, the construction and installation techniques for ventilation openings through fire barriers should be qualified by fire endurance tests. For ventilation ducts that penetrate or terminate at a fire wall, guidance in NFPA 90A indicates that ventilation fire dampers should be installed within the fire wall penetration for barriers with a fire rating greater than or equal to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. NFPA 90A requires that fire dampers be installed in all air transfer openings within a rated wall.

Until recently, the only industry standard governing the design, fabrication, and testing of fire dampers was UL Standard 555, Fire Dampers (Ref. 110). That standard does not evaluate whether fire dampers will close under airflow conditions. Therefore, the UL fire damper rating indicates only whether a fire damper in the closed position will maintain its integrity under fire conditions for a specific time period.

Fire damper testing methods that do not simulate the actual total differential pressure at the damper (i.e., visual inspection or drop testing with duct access panels open) may not show operability or functionality under airflow conditions. Fire damper surveillance testing should model airflow to ensure that the dampers will close fully when called to do so. This can be addressed by (1) type testing worst-case airflow conditions of plant-specific fire damper configurations, (2) testing under airflow conditions all dampers installed in required fire barriers, or (3) administratively shutting down the ventilation systems to an area upon confirmation of a fire. The plant emergency procedures should incorporate the latter approach.

4.2.1.4 Penetration Seals Openings through fire barriers for pipe, conduit, and cable trays that separate fire areas should be sealed or closed to provide a fire-resistance rating at least equal to that required of the barrier itself.

Openings inside conduit larger than 102 mm (4 in.) in diameter should be sealed at the fire barrier penetration. Openings inside conduit 102 mm (4 in.) or less in diameter should be sealed at the fire barrier unless the conduit extends at least 1.5 m (5 ft) on each side of the fire barrier and is sealed either at both ends or at the fire barrier with material to prevent the passage of smoke and hot gases. Fire barrier penetrations that maintain environmental isolation or pressure differentials should be qualified by test to maintain the barrier integrity under such conditions.

Qualified individuals who are trained and certified by the manufacturer should install penetration seals. Appropriate QA/QC methods should be in force during installation. As part of the installation process, penetration seals should be specifically labeled and documented and then inspected to ensure that the seal does not have voids or gaps and has been installed in accordance with its design.

DG-1359, Page 69

4.2.1.5 Testing and Qualification

a. Structural fire barriers: The design adequacy of fire barrier walls, floors, ceilings, and enclosures should be verified by fire endurance testing. The NRC fire protection guidance refers to NFPA 251 and ASTM E119, Standard Test Methods for Fire Tests of Building Construction and Materials (Ref. 111), as presenting acceptable test methods for demonstrating fire endurance performance. The guidance of NFPA 251 and ASTM E119 should be consulted with regard to construction, materials, workmanship, and details such as dimensions of parts and the size of the specimens to be tested. In addition, NFPA 251 and ASTM E119 should be consulted with regard to the placement of thermocouples on the specimen.

The following are the fire endurance test acceptance criteria that wall, floor, ceiling, and enclosure fire barriers should meet:

(1) The fire barrier design has withstood the fire endurance test without the passage of flame or the ignition of cotton waste on the unexposed side for a period of time equivalent to the fire-resistance rating required of the barrier.

(2) The temperature levels recorded on the unexposed side of the fire barrier are analyzed and demonstrate that the maximum temperature does not exceed 121 degrees Celsius (C)

(250 degrees Fahrenheit (F)) above the ambient atmosphere.

(3) The fire barrier remains intact and does not allow projection of water beyond the unexposed surface during the hose stream test.

b. Penetration fire barriers: An independent testing authority should qualify penetration fire barriers by tests conducted in accordance with NFPA 251 or ASTM E119. In addition, ASTM E814, Standard Test Method for Fire Tests of Penetration Firestop Systems (Ref. 112), or IEEE Standard 634, IEEE Standard Cable Penetration Fire Stop Qualification Test (Ref. 113), could be used in the development of a standard fire test. ANSI withdrew IEEE Standard 634 on April 9, 1990, and the standard should not be used for qualification testing performed after that date.

The barrier should meet the following criteria (1) The fire barrier design has withstood the fire endurance test without passage of flame or the ignition of cables on the unexposed side for a period of time equivalent to the fire-resistance rating required of the barrier.

(2) The temperature levels recorded for the unexposed side of the fire barrier are analyzed and demonstrate that the maximum temperature does not exceed 163 degrees C (325 degrees F) or 121 degrees C (250 degrees F) above the ambient temperature. Higher temperatures at through-penetrations may be permitted when justified in terms of cable insulation ignitability.

(3) The fire barrier remains intact and does not allow projection of water beyond the unexposed surface during the hose stream test. The stream should be delivered (1) through a 38-mm (1.5-in.) nozzle set at a discharge angle of 30 percent with a nozzle DG-1359, Page 70

pressure of 517 kilopascals (kPa) (75 pounds per square inch (psi)) and a minimum discharge of 284 L/min (75 gal/min) with the tip of the nozzle a maximum of 1.5 m (5 ft) from the exposed face, or (2) through a 38-mm (1.5-in.) nozzle set at a discharge angle of 15 percent with a nozzle pressure of 517 kPa (75 psi) and a minimum discharge of 284 L/min (75 gal/min) with the tip of the nozzle a maximum of 3 m (10 ft) from the exposed face, or (3) through a 64-mm (2.5-in.) national standard playpipe equipped with a 29-mm (1 1/8-in.) tip, nozzle pressure of 207 kPa (30 psi), located 6.1 m (20 ft) from the exposed face.

The construction and installation techniques for door and ventilation openings and other penetrations through fire barriers should be qualified by fire endurance tests. The test specimen should be truly representative of the construction for which classification is desired, in terms of materials, workmanship, and details such as dimensions of parts, and should be built under conditions representative of those practically applied in building construction and operation. The physical properties of the materials and ingredients used in the test specimen should be determined and recorded.

In view of the many possible penetration seal configurations, it may not be practical to test every penetration configuration. The following section provides guidance on evaluating penetration seal designs against the results of limited fire test programs.

4.2.1.6 Evaluation of Penetration Seal Designs with Limited Testing The results of fire test programs that include a limited selection of test specimens that have been specifically designed to encompass or bound the entire population of in-plant penetration seal configurations may be acceptable. In such cases, the engineering evaluation performed to justify the seal designs should consider the following:

a. Size of sealed opening: In some cases, a successful fire endurance test of a particular fire barrier penetration seal configuration for a particular size opening may be used to justify the same configuration for smaller openings.

b. Penetrating items: A satisfactory test of a seal configuration that contains a particular pattern of penetrating items can be used to qualify variations on the tested pattern. Acceptable variations include eliminating or repositioning one or more of the penetrating items, reducing the size (cross-sectional area) of a particular penetrating item, or increasing the spacing between penetrating items. However, since penetrating items provide structural support to the seal, the free area of the seal material and the dimensions of the largest free span may also be factors that affect the fire-resistive performance of the seal assembly. The thickness of the seal material needed to obtain a particular fire rating may also be a function of the free area or the distance between the penetrating items and the outside edge of the seal assembly. In other cases, consideration of the penetrating items takes on special importance because of the heat sink they provide.

c. Cable type and fill: A satisfactory test of a seal configuration with certain electrical penetrations containing a specified fill ratio and cable type can be used to qualify similar configurations containing the same or a smaller cable fill ratio and the same cable jacket material or a less-combustible jacket material. The thermal conductivity of the penetrating cables is also important.

DG-1359, Page 71

d. Damming materials: The fire-resistive performance of a given seal configuration can be improved if a fire-resistant damming material covers one or both surfaces of the seal. A satisfactory test of a seal configuration without a permanent fire-resistant dam can be used to qualify the same configuration with a permanent fire-resistant dam, all other seal attributes being equal. The converse is not true.

e. Configuration orientation: A satisfactory test of a particular seal configuration in the horizontal orientation (with the test fire below the seal) can be used to qualify the same configuration in a vertical orientation if the symmetry of the design configurations is comparable. For example, if a nonsymmetrical penetration seal configuration (e.g., a seal with a damming board on the bottom but not on the top) is qualified for a floor-ceiling orientation with the damming board on the fire side of the test specimen, the configuration could be qualified for a wall orientation only if a damming board was installed on both sides of the seal or if the potential fire hazard is limited to the side with the damming board.

f. Material type and thickness: Satisfactory testing of a particular seal configuration with a specific seal material thickness can be used to qualify the same configuration with a greater seal material thickness of the same type of seal material. The converse is not true: testing of a particular seal configuration with a specific seal material thickness cannot be used to qualify the same configuration with a lesser seal material thickness of the same type of seal material.

g. Type testing: In cases in which a single test of a particular seal configuration is to serve as a qualification test for the same or similar design configurations with different design parameters, the tested configuration should be the worst-case design configuration with the worst-case combination of design parameters. This would test and qualify a condition that would fail first, if failure occurs at all. Successful testing of the worst-case condition can then serve to qualify the same or similar design configurations for design parameters within the test range. It would be appropriate to conduct multiple tests to assess a range of design parameters.

4.2.2 Structural Steel Protection Structural steel forming a part of or supporting fire barriers should be protected to provide fire resistance equivalent to that required of the barrier. Where the structural steel is not protected and has a lower fire rating than the required rating of the fire barrier, the fire hazards analysis should justify the configuration by demonstrating the temperature that the steel will reach during fire and the ability of the steel to carry the required loads at that temperature. The need to protect structural steel that forms a part of or supports fire barriers is consistent with sound fire protection engineering principles as delineated in NFPA codes and standards and in the NFPA Fire Protection Handbook, issued in 2008 (Ref. 114).

Structural steel with the sole purpose of carrying dynamic loads from a seismic event need not be protected to meet fire barrier requirements, unless the failure of any structural steel member owing to a fire could result in significant degradation of the fire barrier.

DG-1359, Page 72

4.2.3 Fire-Resistive Protection for Electrical Circuits 4.2.3.1 Electrical Raceway Fire Barrier Systems Redundant cable systems important to safety should be separated from each other and from potential fire exposure hazards in accordance with the separation means of Regulatory Position 5.3.1.1.a, b, and c of this guide. In areas where electrical circuits important to post-fire safe shutdown cannot be separated by means of rated structural fire barriers, cable protection assemblies should be applied to conduit and cable trays to meet 1-hour and 3-hour separation requirements, as required. Where 1-hour fire-resistive barriers are applied, automatic fire detection and suppression should also be installed.

The design of fire barriers for horizontal and vertical cable trays should meet the requirements of ASTM E119, including a hose stream test. Regulatory Position 4.3 of this guide discusses the acceptance criteria for raceway fire barriers.

4.2.3.2 Fire-Rated Cables Pre-1979 licensees should request an exemption when relying on fire-rated cables to meet NRC requirements for protection of safe-shutdown systems or components from the effects of fire. Post-1979 licensees relying on fire-rated cables should perform an evaluation to demonstrate that the use of fire-rated cables does not adversely affect safe shutdown in accordance with their license condition and submit a license amendment if required (see Regulatory Position 1.8 of this guide).

4.3 Testing and Qualification of Electrical Raceway Fire Barrier Systems Fire barriers relied on to protect post-fire shutdown-related systems and to meet the separation means discussed in Regulatory Position 5.3 should have a fire rating of either 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Fire rating is defined as the endurance period of a fire barrier or structure, which relates to the period of resistance to a standard fire exposure before the first critical point in behavior is observed.

Fire endurance ratings of building construction and materials are demonstrated by testing fire barrier assemblies in accordance with the provisions of the applicable sections of NFPA 251 and ASTM E119. Assemblies that pass specified acceptance criteria (e.g., standard time-temperature fire endurance exposure, unexposed side temperature rise, hose stream impingement) are considered to have a specific fire-resistance rating.

The basic premise of the fire-resistance criteria is that those fire barriers that do not exceed 163 degrees C (325 degrees F) cold-side temperature and pass the hose stream test provide reasonable assurance that the shutdown capability is protected without further analyses. If the temperature criterion is exceeded, sufficient additional information is needed to permit an engineering evaluation to demonstrate that the shutdown capability is protected. The temperature condition of 163 degrees C (325 degrees F) was established by allowing the temperature of the unexposed side of the fire barrier rise to 139 degrees C (250 degrees F) above the assumed ambient air temperature of 24 degrees C (75 degrees F), as measured by the thermocouples within the test specimen at the onset of the fire exposure during the fire test.

Appendix B to this guide provides detailed guidance for the testing and qualification of electrical raceway fire barrier systems.

DG-1359, Page 73

5. Safe-Shutdown Capability When considering the consequences of a fire in a given fire area during the evaluation of the safe-shutdown capabilities of the plant, licensees should demonstrate that one success path of SSCs that can be used to bring the reactor to hot-shutdown or hot-standby conditions remains free of fire damage.

Some plant designs (those that use low-pressure systems for their success path) pass through hot shutdown in a short time and then proceed directly to cold shutdown. For the purpose of this guide, the term safe shutdown indicates bringing a plant to safe-shutdown condition, either hot shutdown or cold shutdown (when low-pressure systems are used as the success path), as applicable to each reactor design and as defined by the plant technical specifications. The analysis should also demonstrate that fire damage to one success path of SSCs needed for achieving cold shutdown will be limited so that a success path will be returned to an operating condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, or for areas requiring alternative or dedicated shutdown, the licensee should demonstrate that cold-shutdown capability can be restored and cold shutdown achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For reactor designs that cannot safely remain in hot shutdown for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the analysis should demonstrate that a cold-shutdown condition can be achieved and maintained within the required period of time.

For existing reactor plants, the success path should be capable of meeting Regulatory Positions 5.1 and 5.2 of this RG and performing the necessary shutdown functions. The capability of the required shutdown functions should be based on a previous analysis, if possible (e.g., those analyses in the FSAR). The equipment required for alternative or dedicated shutdown should have the same or equivalent capability as that relied on in the above-referenced analyses.

The FPP should include a safe-shutdown analysis to demonstrate that the SSCs important to safety can accomplish their respective post-fire safe-shutdown functions. The safe-shutdown analysis should demonstrate that the success path SSCs, including electrical circuits, remain free of fire damage in the event of postulated fires. As required by applicable regulations, fire barriers, physical separation with no intervening combustibles, and/or automatic detection and suppression should provide this protection.

When a success path cannot be adequately protected, an alternative or dedicated shutdown success path should be identified and protected to the extent necessary to ensure post-fire safe shutdown.

The safe-shutdown analysis for new reactor designs should demonstrate that safe shutdown can be achieved, assuming that all equipment in any one fire area (except for the control room and containment) will be rendered inoperable by fire and that reentry into the fire area for repairs and operator actions is not possible (see Regulatory Position 8.2 of this guide). The control room is excluded from this approach, provided that the design includes an independent alternative shutdown capability that is physically and electrically independent of the control room. Designs incorporating reactor containment buildings should provide fire protection for redundant shutdown systems in the reactor containment building that will ensure, to the extent practicable, that at least one post-fire shutdown success path will be free of fire damage.

The safe-shutdown analysis should evaluate a fire in each fire area containing SSCs important to safety and identify a post-fire safe-shutdown success path. The analysis should also identify all fire-induced circuit failures that could directly or indirectly (e.g., by causing spurious actuations) prevent safe shutdown. There is no regulatory requirement to prevent the fire-induced failure of redundant systems necessary to mitigate the consequences following design-basis accidents if the system is not required to operate to achieve safe shutdown after a fire. However, the licensee is required to prevent (or mitigate, where permitted by regulatory requirements) fire-induced failures of these systems if the failure DG-1359, Page 74

could prevent safe shutdown (e.g., because of spurious actuations). The most stringent fire damage limit should apply to those systems that fall into more than one category.

For the application of fire protection regulatory requirements, redundant trains of systems may be two or more similar trains of equivalent capacity in the same system powered by separate electrical divisions, or they may be two or more separate systems designed to perform the same post-fire safe-shutdown function. In cases where the regulatory requirements for protection (e.g., fire barriers, separation, suppression, detection) of at least one of the redundant trains in a single fire area cannot be met, or where the post-fire safe-shutdown function of the train or system is not the design function, the regulatory requirements for alternative or dedicated shutdown systems apply. In the context of post-fire safe shutdown, the redundant train and the alternative or dedicated shutdown system credited with performing the required functions are also referred to as success paths.

5.1 Post-Fire Safe-Shutdown Performance Goals Licensees should ensure that fire protection features are provided for SSCs important to safe shutdown that are capable of limiting fire damage, so that one success path necessary to achieve and maintain hot-shutdown conditions from either the control room or the emergency control station(s) is free of fire damage.

The post-fire safe-shutdown performance goal is that the plant achieves and maintains hot shutdown, as defined by the technical specifications.Section III.L of Appendix R to 10 CFR Part 50 provides the following specific performance goals to achieve the post-fire safe-shutdown goals for alternative or dedicated shutdown capability in accordance with Section III.G.3 of Appendix R:

a. The reactivity control function should be capable of achieving and maintaining cold-shutdown reactivity conditions.

b. The reactor coolant makeup function should be capable of maintaining the reactor coolant level above the top of the core for boiling-water reactors (BWRs) and within the level indication of the pressurizer for pressurized-water reactors (PWRs). Temporary core uncovery in BWRs when depressurizing and using low-pressure systems for post-fire safe shutdown may be acceptable for plants licensed under 10 CFR Part 50.

c. The reactor heat removal function should be capable of achieving and maintaining decay heat removal.

d. The process monitoring function should be capable of providing direct readings of the process variables necessary to perform and control the above functions.

e. The supporting functions should be capable of providing the process cooling, lubrication, and other activities necessary to permit the operation of the equipment used for safe-shutdown functions.

GL 81-12 describes the systems and instrumentation that are generally necessary for achieving post-fire safe shutdown for existing PWRs and BWRs. The plant licensing basis includes the systems and instrumentation required for specific plants, and the plant technical specifications address the operating parameters that determine post-fire safe shutdown.

DG-1359, Page 75

GDC 3 of Appendix A to 10 CFR Part 50 requires that the FPP protect SSCs important to safety from the effects of fire. However, the post-fire loss of function of systems used to mitigate the consequences of design-basis accidents does not per se affect public safety. The FPP must protect all equipment important to safety; however, the need to limit fire damage to systems required to achieve and maintain post-fire safe-shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design-basis accidents.

5.2 Cold Shutdown and Allowable Repairs For normal safe shutdown, a single fire may damage redundant systems necessary to achieve cold shutdown. As described in the plant-specific licensing basis (i.e., 10 CFR Part 50, Appendix R, Section III.G.1.b, or applicable BTP), fire damage must be limited so that at least one success path can be repaired or made operable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using onsite capability or within the time period required to achieve a safe-shutdown condition, if less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

For alternative or dedicated shutdown, equipment or systems that are the means to achieve and maintain cold-shutdown conditions may be damaged by fire. If fire damage does occur to alternative or dedicated shutdown equipment and systems, the damage should be limited so that the systems can be made operable and cold shutdown achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (or less time, if required) using only onsite power. Systems and components used for safe shutdown after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (or less time, if required) may be powered from offsite power only.

Repairs made to ensure cold-shutdown capability (e.g., the replacement of fuses and cabling) are permitted. Selected equipment replacement is also allowed, if practicable. Procedures should be prepared for repairing damaged equipment (see Regulatory Position 5.5.3 of this guide), and dedicated replacement equipment should be stored on site and controlled. Repairs should be of sufficient quality to ensure safe operation until the normal equipment is restored to an operating condition. Repairs not permitted include the use of clip leads in control panels (i.e., hard-wired terminal lugs should be used) and the use of jumper cables other than those fastened with terminal lugs.

When repairs are necessary in the fire area, the licensee should demonstrate that sufficient time is available to allow the area to be reentered, that expected fire and fire suppressant damage will not prevent the repairs from taking place, and that the repair procedures will not adversely affect operating systems.

5.3 Fire Protection of Safe-Shutdown Capabilities The post-fire safe-shutdown analysis should ensure that one success path remains free of fire damage for a single fire in any single plant fire area. The NRC developed NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volumes 1, 2, and 3 (Refs. 116, 117, 118), as a consensus report by technical experts on issues related to multiple spurious operations (MSOs). The report is based on the current best available evidence and represents the current state of the art. The electrical expert phenomena identification and ranking table (PIRT) panel provided the following recommendations, as documented in NUREG/CR-7150, Volume 3:

a. Number of Hot Shorts for Transient Inrush ConsiderationsIf the MSO scenario involves the potential failure of a safe-shutdown power supply resulting from a temporary overload condition caused by multiple, concurrent inrush currents (i.e., overlapping inrush transient current from multiple separate loads) due to spurious operation of multiple loads as a result of hot shorts on the DG-1359, Page 76

control cable for each load, then the MSO does not need to be considered. This recommendation is based on (1) normal transient inrush current duration, (2) the spurious operations are caused by fire damage to control cables for the loads from the power supply of concern, and the loads are otherwise operating correctly and have no potential for power cable fire damage, (3) the load sequencer, if applicable, for the associated power supply is not damaged by the fire such that it may cause multiple loads to simultaneously spuriously start, and (4) target conductors that could spuriously start or energize loads powered from the same power supply are in separate cables. In this case, the power supply availability for the fire event can be assessed by the steady-state loading (i.e., anticipated load plus fire-induced spurious operation load) in combination with the worst-case individual (or anticipated by design) inrush current transient load.

b. Number of Inter-Cable Hot Shorts Regardless of Latching Characteristics or Coping TimeIf the MSO requires four or more separate target cables with inter-cable hot shorts (excluding ground fault equivalent hot shorts (GFEHS)), then the MSO does not need to be considered, regardless of whether the circuits are latching or non-latching. For ungrounded power supplies, credible GFEHS is significantly more likely than inter-cable hot shorts and, as such, is not included in this recommendation. Spurious operation(s) for the MSO scenario that can be caused by GFEHS should be considered unless otherwise limited. Inter-cable failures that can result in a GFEHS cannot be counted as part of this limit of four or more separate inter-cable hot shorts.

Consideration of sustained time duration is not required for this case.

c. Number of Non-Latching Hot Shorts with 10-Minute Coping Time Regardless of Circuit Failure ModeIf the MSO requires (1) three or more concurrent fire-induced hot shorts on separate target cables in non-latching circuits and (2) the hot shorts must be sustained for more than 10 minutes to cause a condition that cannot be tolerated (refer to NEI 00-01, Revision 4, Appendix H), then the MSO does not need to be considered regardless of conductor hot short failure mode (i.e., intra-cable, inter-cable, or GFEHS). For MSO scenarios that result in conditions that cannot be tolerated for 10 minutes or less, any number of non-latching intra-cable circuit failures should be considered, unless otherwise limited. In addition, for latching fire-induced hot shorts, any number of intra-cable circuit failures should be considered unless otherwise limited.

d. Sequentially Selected Fire-Induced Circuit FailuresIf the MSO requires a selective sequence of five or more separate target cables, each with specific fire-induced cable failures, and the adverse condition will not occur if the sequence is not produced by the fire-induced circuit failures (e.g., hot short, short to ground, open circuit) with at least two of these failures being hot shorts, then the MSO does not need to be considered regardless of fire-induced failure durations, circuit configurations, or fire-induced failure types. To be beyond what needs to be considered for MSOs, the total number of sequential failures must exceed the threshold established above without including (1) the more probable failures of conductor grounding of grounded alternating current (AC) circuits in armored cable or (2) for ungrounded direct current (DC) circuits, the more probable failures of intra-cable short or GFEHS in armored cable as one of the sequential failures. The metal armor of armored cable is assumed to always be grounded in accordance with NFPA 70.

e. In general, the duration of a hot short may be assumed to be limited to 20 minutes in AC circuits, and 40 minutes in DC circuits.

DG-1359, Page 77

For circuits not sealed in or latched for equipment important to safe shutdown, licensees should consider multiple fire-induced circuit failures in at least two separate cables. For circuits not sealed in or latched for equipment important to safe shutdown that involves high-low pressure interfaces, licensees should consider circuit failures in at least three cables. This applies when there are defense-in-depth features, such as automatic suppression and limits on ignition sources and combustibles. When there are no defense-in-depth features, the number of cables to consider should not be limited to two or three as described above. In addition, for multiconductor cables, all circuit faults that could occur within the cable should be assumed to occur. The analysis should address all circuits for which fire-induced failure could prevent safe shutdown, and appropriate protection should be provided. Chapter 3 of industry guidance document NEI 00-01, Revision 4, provides an acceptable deterministic methodology for the analysis of post-fire safe-shutdown circuits, when applied in conjunction with this RG.

5.3.1 Identification and Evaluation of Post-fire Safe-Shutdown Circuits Two classifications of equipment in the plant are important when evaluating the ability to achieve and maintain shutdown during and following a fire. Regulatory Position 5.3.1.1 describes the equipment on the success path necessary to achieve and maintain hot-shutdown conditions. This equipment is a subset of the second and more general set of SSCs important to safe shutdown described in Position 5.3.1.2. These classifications are not applicable to alternative or dedicated shutdown systems credited for post-fire safe shutdown as defined in Appendix R,Section III.G.3. Position 5.4 discusses alternative or dedicated shutdown. The information included in Appendix H to NEI 00-01, Revision 4, may be used in classifying components on the success path required for hot shutdown and those important to safe shutdown, when applied in conjunction with this RG. Note that the NRC will treat the phrase required for hot shutdown in NEI 00-01, Revision 4, as having the same meaning as the phrase the safe-shutdown success path used in this guide.

The post-fire safe-shutdown circuit analysis should address all possible fire-induced failures that could affect the safe-shutdown success path, including multiple spurious actuations. Some licensees have based this analysis on the assumption that multiple spurious actuations will not occur simultaneously or in rapid succession. This is known as the one-at-a-time assumption. Cable fire testing performed by the NRC and industry has demonstrated that multiple cable faults occur when cables are exposed to fire.

These faults depend on multiple factors, including cable insulation or jacketing materials and cable configurations. The success path SSCs and the components important to safe shutdown should be protected from fire damage so that the capability to shut down the plant safely is ensured; specifically, all spurious actuations that could affect safe-shutdown success path SSCs are required to be protected in accordance with Position 5.3.1.1. The one-at-a-time assumption may still pertain to the protection of components important to safe shutdown as applied per the plants licensing basis, using the information in Position 5.3.1.2. However, a safety and technical analysis that demonstrates the assumptions validity for each application should support the use of this assumption.

5.3.1.1 Protection for the Safe-Shutdown Success Path For the success path of SSCs necessary to achieve and maintain hot-shutdown conditions, fire barriers, physical separation, or automatic suppression should protect redundant systems or components.

Except in those circumstances in which alternative or dedicated shutdown systems are required, where equipment or cables (including electrical circuits that could prevent operation or cause maloperation caused by hot shorts, open circuits, or shorts to ground) of redundant success paths necessary to achieve and maintain hot-shutdown conditions are located within the same fire area outside the primary DG-1359, Page 78

containment, the licensee should provide, for currently operating reactor plants, one of the following means of ensuring that one of the success paths (of SSCs for hot shutdown) is free of fire damage.

(Regulatory Position 8.2 of this guide provides the protection requirements for redundant post-fire safe-shutdown success paths in new reactor plants.)

a. Separation of redundant post-fire safe-shutdown success paths by a fire barrier having a 3-hour rating should be achieved. Structural steel forming part of or supporting the fire barrier should be protected to provide fire resistance equivalent to that of the barrier.

b. Separation of redundant post-fire safe-shutdown success paths by a horizontal distance of more than 6.1 m (20 ft) with no intervening combustible or fire hazards should be achieved. In addition, fire detectors and an automatic fire suppression system should be installed in the fire area.

c. Insulation of electrical cables, including those with fire-resistive coatings, should be considered as intervening combustibles in other than negligible quantities (i.e., isolated cable runs), as determined by engineering and fire hazards analysis. Cables in conduits are not considered intervening combustibles.

d. Enclosure of one redundant post-fire safe-shutdown success path in a fire barrier having a 1-hour rating should be achieved. In addition, fire detectors and an automatic fire suppression system should be installed in the fire area.

To meet the provisions of items b and c above, the installation of fire suppression and detection equipment in a fire area should be sufficient to protect against the hazards of the area. In this regard, detection and suppression providing less than full area coverage may be evaluated as adequate to comply with the regulation (see Regulatory Position 1.8.3).

Inside noninerted containments, the licensee should provide fire protection that meets the criteria above or as specified in Regulatory Position 6.1.1 of this guide.

For this classification of equipment, there is no allowance for manual actions or methods other than combinations of the above options (see Regulatory Position 5.3.1.5 for the types of equipment included in this classification).

For most plants licensed before January 1979, the methods described in Regulatory Position 5.3.1.2 are not available for the protection of the safe-shutdown success path without the approval of an exemption from 10 CFR 50.48(b) under 10 CFR 50.12. For pre-1979 licensees, a staff decision in an SER that approves the use of operator manual actions, in lieu of one of the means specified in Section III.G.2 of Appendix R, does not eliminate the need for an exemption. Pre-1979 licensees that have SERs, but not a corresponding exemption that approves operator manual actions, must request an exemption under 10 CFR 50.12, by citing the special circumstances of 10 CFR 50.12(a)(2)(ii), identifying the SER as the safety basis, and confirming that the safety basis established in the SER remains valid.

Proceduralized actions taken by operators in the main control room to mitigate potential spurious actuations are not considered operator manual actions and are permitted.

If permitted by the plant license, plants licensed after January 1979 may credit protection other than that described in items a, b, and c above (or Position 6.1.1 for inside noninerted containments), if DG-1359, Page 79

they can show that the use of the protection does not adversely affect safe shutdown. Positions 5.3.1.2, 5.3.1.3, and 5.3.1.4 below present additional ways of demonstrating adequate protection. The omission or elimination of these capabilities in an area containing SSCs (including circuits) important to safety may be considered an adverse effect on safe shutdown, since it would reduce, at a minimum, fire protection defense in depth. Where safe shutdown would be adversely affected because of a reduction in the protection discussed above, the licensee should submit a license amendment to the NRC for review and approval.

The approach outlined in Chapter 4 of NEI 00-01, Revision 4, which relies on the Expert Panel Process and the Generic List of Multiple Spurious Operations contained in Appendices F and G to that document, provides an acceptable methodology for the identification of multiple spurious actuations that may affect safe-shutdown success path SSCs, when applied in conjunction with this RG. Spurious actuations, either single or multiple, with the potential to affect safe-shutdown success path components should be mitigated in accordance with the features described in this section; tools such as fire modeling and manual actions should not be used.

5.3.1.2 Protection for Components Important to Safe Shutdown The protection options described in Regulatory Position 5.3.1.1 are available but not required for the protection of SSCs (including circuits) important to safe shutdown. Additional protection options available for this category are, for example, operator manual actions (Position 5.3.1.3) and fire modeling (Position 5.3.1.4). These additional options are not available for safe-shutdown success path equipment without prior NRC approval (Position 5.3.1.1).

The approach outlined in Chapter 4 of NEI 00-01, Revision 4, which relies on the Expert Panel Process and the Generic List of Multiple Spurious Operations contained in Appendices F and G of that document, provides an acceptable methodology for the analysis of MSOs for protection of components important to safe shutdown, when applied in conjunction with this RG.

5.3.1.3 Operator Manual Actions When one of the redundant safe-shutdown trains in a fire area is maintained free of fire damage by one of the means specified in Regulatory Position 5.3.1.1, then the use of operator manual actions may be credited with mitigating fire-induced operation or maloperation of components that are not part of the protected success path. The crediting of operator manual actions should be in accordance with the licensees FPP and license condition. Operator manual actions may also be credited when an alternative or dedicated shutdown capability is provided as described in Position 5.4.

All post-fire operator manual actions should be feasible and reliable. NUREG-1852 provides the technical bases in the form of criteria and technical guidance that may be used to demonstrate that operator manual actions are feasible and can be performed reliably under the wide range of plant conditions that an operator might encounter during a fire. The use of feasible and reliable manual actions alone may not be sufficient to address all levels of defense in depth. Therefore, fire prevention, detection, and suppression should be considered, in addition to the feasibility and reliability of operator manual actions.

Because the fire protection requirements, including the protection of safe-shutdown capability and the prevention of radiological release, can be integrated in the planning and design phase, a new DG-1359, Page 80

reactor plant should have minimal reliance on operator manual actions and alternative or dedicated shutdown systems (protection for fires in the main control room will require alternative shutdown capability).

5.3.1.4 Fire Modeling When one of the redundant safe-shutdown trains in a fire area is maintained free of fire damage by one of the specified means in Regulatory Position 5.3.1.1, then fire modeling may be used to demonstrate that components important to safe shutdown, including SSCs that are not part of the success path, are protected from fire damage. The use of fire modeling should be in accordance with the licensees FPP and license condition.

Regulatory Position 1.8.7 of this guide provides information on fire modeling. When fire modeling is used to demonstrate that components important to safe shutdown are protected from fire damage, the analysis should consider in situ and transient fire sources in the area and all targets that involve components important to safe shutdown. The fire models should be used within the bounds of their capability. By considering expected room configurations (e.g., doors open or closed), the fire modeling analysis should show that the largest expected fire will not affect the components important to safe shutdown. In addition, the area being analyzed should include effective automatic suppression in the fire area, a significant margin between the expected fire and the damage threshold of the target, or other features to provide an adequate safety margin and defense in depth.

5.3.1.5 Examples of Safe-Shutdown Success Path Components and Components Important to Safe Shutdown General examples of components that should be considered part of the safe-shutdown success path and components that are important to safe shutdown are listed below. Appendix H to NEI 00-01, Revision 4, provides additional information about the classification of safe-shutdown equipment when applied in conjunction with this guide.

Examples of Safe-Shutdown Success Path SSCs

• reactivity control SSCs that are required to achieve and maintain cold-shutdown reactivity conditions

• reactor coolant makeup SSCs that are required to maintain the reactor coolant level above the top of the core for BWRs and within the level indication in the pressurizer for PWRs

• reactor heat removal SSCs that are required to achieve and maintain decay heat removal

• process monitoring SSCs that are required to provide direct readings of the process variables necessary to achieve and maintain safe shutdown

• supporting SSCs that are required to provide the process cooling, lubrication, and other functions necessary to permit the operation of the equipment used to achieve and maintain safe shutdown

• significant diversion paths from flowpath that would lead to core damage or cause reactor coolant loss if diverted for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or less DG-1359, Page 81

• power supplies for safe-shutdown success path components Examples of SSCs Important to Safe Shutdown

• success path supply tank spurious drain or bypass

• decay heat removal system valves, when not part of safe-shutdown success path

• HVAC systems and components required to provide cooling to success path components to the extent that cooling is required for post-fire safe shutdown

• power-operated relief valves and safety relief valves not part of safe-shutdown success path

• spurious start of equipment not relied on for a safe-shutdown success path, which could cause overfill conditions

• small diversion paths from success path flowpath (smaller than the significant diversion paths described above)

• multiple separate small diversion paths that, when combined, would lead to core damage, rupture of the primary coolant boundary, or rupture of primary containment

• a connection to circuits of equipment where spurious operation would adversely affect the SSCs important to safe shutdown (e.g., residual heat removal (RHR)/reactor coolant system isolation valves) 5.3.2 High-Low Pressure Interface The licensee should evaluate the circuits associated with high-low pressure interfaces for the potential to adversely affect safe shutdown. For example, the RHR system is generally a low-pressure system that interfaces with the high-pressure primary coolant system. Thus, the interface most likely consists of two redundant and independent motor-operated valves. Both of these motor-operated valves and their power and control cables may be subject to damage from a single fire. This single fire could cause the two valves to spuriously open, resulting in an interfacing system loss-of-coolant accident (LOCA) through the subject high-low pressure systems interface. To ensure adequate protection of this interface and other high-low pressure interfaces from the effects of a single fire, the licensee should perform an evaluation, as follows:

a. Identify each high-low pressure interface that uses redundant, electrically controlled devices (such as two-series motor-operated valves) to isolate or preclude the rupture of any primary coolant boundary.

b. For each set of redundant valves, verify that the redundant cabling (power and control) has adequate physical separation, as stated in Regulatory Positions 5.3 or 6.1.1.1 of this guide, as applicable.

DG-1359, Page 82

c. Where adequate separation is not provided, demonstrate that fire-induced failures (multiple hot shorts, open circuits, and shorts to ground) of the cables will not cause maloperation and result in an interfacing system LOCA that would adversely affect safe shutdown.

The electrical expert PIRT panel, as documented in NUREG/CR-7150, Volume 3, has determined that the potential for a fire to cause hot shorts on all three phases in proper sequence of an AC power circuit to cause a spurious operation of a motor is incredible and need not be considered in the evaluation.

The approach outlined in Appendix C to NEI 00-01, Revision 4, provides an acceptable methodology for the determination of components as high-low pressure interface components, when applied in conjunction with this RG.

5.3.3 Multiple High-Impedance Faults The concept of multiple high-impedance faults (MHIFs) deviates from baseline assumptions associated with conventional electrical protective devices coordination. The MHIF failure mode is based on presuming that a fire can cause short circuits that generate abnormally high currents below the trip point of the individual overcurrent-interrupting devices for the affected circuits. Under the assumed conditions, circuit overcurrent-protective devices will not detect and interrupt the abnormal current flow.

It follows that if several circuits experience a high-impedance fault (HIF), the cumulative current flow could exceed the trip setting of the supply breaker or fuse, causing it to trip.

The NUREG/CR-7150, Volume 1, electrical expert PIRT panel evaluated the potential MHIF phenomenon and concluded that it need not be considered as a failure mode in the safe-shutdown circuit analysis as long as certain criteria are met. Of critical importance is the use of certain robust design criteria outlined in NEI 00-01, Revision 4, Appendix B.1, that ensure HIFs do not persist in an electrical system for extended periods of time. These criteria include the use of properly coordinated protective devices as outlined in IEEE 242, IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems (Ref. 115), and the use of proper protective devices that are designed and constructed according to applicable industry standards and applied within their vendor ratings. Additionally, appropriate testing and maintenance should be performed on these protective devices by following accepted industry guidelines and specific vendor recommendations for maintenance and testing. The consensus position of the panel was that the guidance in NEI 00-01, Revision 4, Appendix B.1, can be safely applied to fire safe-shutdown methodologies throughout the plant.

5.3.4 Open Secondary Circuits on Current Transformers Current transformers (CTs), a subgroup of instrument transformers, are used throughout AC electrical distribution systems in nuclear power plants to monitor current levels at select locations (e.g., cable, bus bar) and provide a signal from their secondary winding that is proportional to the current flowing through the main (primary) winding. In many cases, the protective relays and indicators associated with the CT are located at the same locations as the CT. For these cases, the secondary circuit is typically confined to the switchgear or equipment containing the CT. In other instances, the secondary circuit of the CT may provide a signal to remotely located protective relay(s) or indicator(s)

(e.g., differential protective relays and remote ammeters). As such, the secondary circuit may span many fire areas within a nuclear power plant. These latter cases present a potential safety concern as an open circuit in a CTs secondary can cause high crest (or peak) voltage on the secondary circuit as the CT attempts to maintain the current relationship dictated by the transformers winding turn ratio. This condition can generate voltages that may exceed the dielectric strength of the CTs insulating materials DG-1359, Page 83

and may then cause arcing to connected or nearby components, potentially damaging the components.

Should a fire-induced open circuit occur in the run of instrumentation cable, a high-voltage condition in the secondary circuit would result. In theory, this high-voltage condition could result in a secondary fire because of insulation breakdown. In this context, a secondary fire refers to a fire at a remote location, (i.e., in a separate fire area) from the original fire that is responsible for the initial open circuit in the CTs secondary circuit. The resulting secondary fire introduces a potential concern for fire protection strategies in nuclear power plants for both deterministic and performance-based approaches.

The NUREG/CR-7150, Volume 1, electrical expert PIRT panel investigated the above postulated failure mode and considered the concern of a secondary fire resulting from a fire-induced, open-circuited CT was more theoretical than real. Based on the availability of objective test data at that time, the panel determined that the unique combination of low-probability events makes this failure mode incredible for CTs with turn ratios of 1200:5 or below. Upon subsequent testing and evaluation of CTs with higher turn ratios (2000:5 and 4000:5), the NUREG/CR-7150, Volume 3, electrical expert PIRT panel, given the absence of secondary fires or any other fire precursors and the unique combination of low-probability events needed for their occurrence, concluded that secondary fires resulting from open-circuited CT installations up to and including 15-kilovolt (kV) primary circuit voltage are incredible. The panel recommended no further consideration of secondary fires as a result of CT failures for low- and medium-voltage applications (up to and including 15-kV primary voltage).

5.3.5 Shorting Switch In response to MSO concerns, several licensees have proposed the use of shorting switches as a design feature to protect against hot short-induced spurious operations caused by fire damage. The shorting switch functions to prevent spurious operation of a component by placing a short across a coil in the circuit of concern when the circuit is in its standby state. When the component is desired to be operated, the motion of the hand switch removes the short before energizing the coil to actuate the component. Any circuit using a shorting switch should have this feature of removing the short provided by the shorting switch prior to energizing the coil (i.e., break-before-make).

An NEI task force was formed to develop generic guidance on the design, use, and implementation of shorting switches to protect against the spurious operation concerns. The NUREG/CR-7150, Volume 3, electrical expert PIRT panel subsequently reviewed the proposed NEI guidance and provided supplemental technical information to form a comprehensive set of design considerations and recommendations for the reliable use and application of shorting switches. The guidelines, including the revisions and additions from NUREG/CR-7150, were then included in NEI 00-01, Revision 4, Appendix I. The design considerations for shorting switches outlined in Appendix I to NEI 00-01, Revision 4, provide an acceptable methodology for shorting switch applications when applied in conjunction with this RG.

5.4 Alternative and Dedicated Shutdown Capability 5.4.1 General Guidelines Appendix R to 10 CFR Part 50 defines alternative shutdown capability as being provided by rerouting, relocating, or modifying existing systems, whereas dedicated shutdown is defined as being provided by installing new structures and systems for the function of post-fire shutdown. Since post-fire repairs cannot be credited for achieving and maintaining hot shutdown, the licensee should implement the DG-1359, Page 84

required rerouting, relocating, or modifying of the existing system for alternative shutdown capability in existing plants when the need for additional alternative shutdown capability is identified.

Where alternative or dedicated shutdown capability is required, the licensee should provide fixed fire suppression and detection for the fire area or zone containing the redundant success paths (detection and suppression are not necessarily required for the area or zone containing the alternative or dedicated shutdown system except where required by the fire hazards analysis).

The safe-shutdown analysis should demonstrate that alternative or dedicated shutdown systems and components, including electrical circuits, necessary to achieve and maintain hot shutdown are free of fire damage and capable of performing the necessary safe-shutdown functions or are prevented from causing actions that prevent safe shutdown.

The alternative or dedicated shutdown capability for specific fire areas may be unique for each such area, or it may be one combination of systems for all such areas. In either case, the alternative shutdown capability should be independent of the specific fire areas and should accommodate post-fire conditions when offsite power is available and when offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The licensee should provide procedures to implement the alternative or dedicated shutdown capability, as described in Regulatory Position 5.5 of this guide.

The licensee should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system for fires in areas that require alternate or dedicated shutdown. After the operators transfer control from the control room to the alternative or dedicated shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plants approved FPP.

The approach outlined in Appendix D to NEI 00-01, Revision 4, provides an acceptable methodology for evaluating alternative and dedicated shutdown, when applied in conjunction with this RG. In addition, the second paragraph of Appendix G to NEI 00-01, Revision 4, provides information on the analysis of multiple spurious actuations for alternative and dedicated shutdown systems.

5.4.2 Loss of Offsite Power/Station Blackout In evaluating the ability to accomplish safe-shutdown after fires, the licensee should consider whether offsite power will be available. However, the licensee need not consider loss of offsite power for a fire in nonalternative or nondedicated shutdown areas, if it can show that offsite power cannot be lost because of a fire in that area.

As described in Regulatory Position 5.4.1 of this guide, alternative shutdown capability should accommodate post-fire conditions when offsite power is available and conditions when offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In an evaluation of safe-shutdown circuits, the availability of uninterrupted power (i.e., offsite power remains available) may affect the ability to control the safe shutdown of the plant by increasing the potential for circuit interactions resulting from fire damage to energized power and control circuits that may result in spurious actuations.

Several operating plant licensees have alternative methodologies that rely on intentional disconnection of AC power to specific equipment or to the entire plant as a means to achieve safe shutdown after a fire. The purpose of the self-induced station blackout (SISBO) is to eliminate potential DG-1359, Page 85

spurious actuations that could prevent safe shutdown and allow manual control of required equipment.

Some licensees have procedures that cause a SISBO condition to be created as a result of fire effects (e.g., procedures that direct operators to manually trip the credited safe-shutdown EDG in the event of fire damage to circuits of vital EDG support systems). The acceptability of safe-shutdown procedures that voluntarily enter, or otherwise create, a SISBO condition is determined on a case-by-case basis.

The ability to cope with a SISBO as part of the post-fire safe-shutdown methodology depends on such issues as time-line logic; assumptions and bases for plant and operator response relative to component realignment; the ability of plant operators to monitor and control plant parameters and align plant components before, during, and after a SISBO has caused control room evacuation and abandonment; and the practicality and reliability of EDG start and load (and restart, if applicable) under post-fire safe-shutdown SISBO conditions.

The risk of a SISBO may exceed the actual risk posed by the fire, and the licensee should consider the risk carefully when evaluating the safe-shutdown design and procedures. A plant typically uses this approach to avoid or minimize the need for operator manual actions after a fire. However, acceptable operator manual actions that are implemented in accordance with Regulatory Position 5.3.1.3 of this guide and NUREG-1852 may present a lower risk than the SISBO approach.

5.4.3 Associated Circuits of Concern When alternative or dedicated shutdown systems are credited for achieving post-fire safe shutdown, a specific category of circuits has been defined (referred to as associated circuits of concern),

and acceptable approaches to mitigating the consequences of fire-induced failure of these circuits have been identified. The licensee should evaluate these circuits, which are nonsafety or safety circuits that could adversely affect the identified shutdown equipment by feeding back potentially disabling conditions (e.g., hot shorts or shorts to ground) to power supplies or control circuits of that equipment. Such disabling conditions should be prevented to ensure that the identified safe-shutdown equipment will function as designed.

Associated circuits of concern are defined as those cables (safety-related, nonsafety-related Class 1E and non-Class 1E) outside containment that have a physical separation less than that specified in Regulatory Positions 5.3.1.1.a, b, and c of this guide (or less than that specified in Regulatory Position 6.1.1.1 for cables inside a noninerted containment) and that meet one of the following criteria:

a. A common power source with the shutdown equipment (redundant or alternative) is not electrically protected from the circuit of concern by coordinated breakers, fuses, or similar devices.

b. A connection to circuits of equipment would adversely affect the shutdown capability if spuriously operated (e.g., RHR or reactor coolant system isolation valves, automatic depressurization system valves, power-operated relief valves, steam generator atmospheric dump valves, instrumentation, steam bypass).

For consideration of spurious actuations, the licensee should evaluate all possible functional failure states; that is, the component could be energized or deenergized by one or more circuit failure modes (i.e., hot shorts, open circuits, and shorts to ground). Therefore, valves could fail open or closed, pumps could fail running or not running, or electrical distribution breakers could DG-1359, Page 86

fail open or closed. For three-phase AC circuits, the probability of getting a hot short on all three phases in the proper sequence to cause spurious actuation of a motor is considered sufficiently low that an evaluation is not required, except for cases involving high- and low-pressure interfaces. For ungrounded DC circuits, if the licensee can show that at least two hot shorts of the proper polarity without grounding are required to cause spurious actuation, no further evaluation is necessary, except for cases involving high- and low-pressure interfaces.

Hot short conditions are assumed to exist until action has been taken to isolate the circuit from the fire area or other appropriate actions have been taken to negate the effects of the spurious actuation.

c. A common enclosure (e.g., raceway, panel, junction box) with shutdown cables (redundant or alternative) (1) is not electrically protected by circuit breakers, fuses, or similar devices or (2) will allow propagation of the fire into the common enclosure.

5.4.4 Protection of Associated Circuits of Concern The shutdown capability may be protected from the adverse effect of damage to associated circuits of concern by the separation and protection guidelines of Regulatory Position 5.3 of this guide (or Regulatory Position 6.1.1.1 for cables inside a noninerted containment) or, alternatively, by the following methods, as applied to each type of associated circuit of concern.

5.4.4.1 Common Power Source It may be necessary to coordinate a load fuse or breaker (i.e., interrupting devices) with a feeder fuse or breaker to prevent the loss of the redundant or alternative shutdown power source. IEEE Standard 242 provides detailed guidance on achieving proper coordination.

To ensure that the coordination criteria are met, the following should apply:

a. The time-overcurrent trip characteristic for all circuit faults associated with the interrupting devices (breakers or fuses) of the circuit of concern should cause the interrupting device to interrupt the fault current before initiation of a trip of any upstream interrupting device that will cause a loss of the common power source.

b. The power source should supply the necessary fault current for enough time to ensure the proper coordination without loss of function of the shutdown loads.

The acceptability of a particular interrupting device can be demonstrated by meeting the following criteria:

a. The interrupting device design should be factory tested to verify overcurrent protection, in accordance with the applicable UL, ANSI, or National Electrical Manufacturers Association standards.

b. For low- and medium-voltage switchgear (480 V and below), periodic testing of circuit breakers and protective relays should demonstrate that the overall coordination scheme remains within the DG-1359, Page 87

limits specified in the design criteria. This testing may be performed as a series of overlapping tests.

c. Molded case circuit breakers should periodically be manually exercised and inspected to ensure ease of operation. On a rotating refueling outage basis, a sample of these breakers should be tested to determine that breaker drift is within that allowed by the design criteria. Breakers should be tested in accordance with an accepted QC testing methodology.

d. Fuses, when used as interrupting devices, do not require periodic testing because of their stability, lack of drift, and high reliability. Administrative controls should ensure that replacement fuses with ratings other than those selected for proper coordinating are not accidentally used.

5.4.4.2 Spurious Actuation Circuits Spurious actuation is considered to be mitigated if one of the following criteria is met (the fire-induced spurious actuations of components included in the safe-shutdown success path should be prevented using the methods described in Regulatory Position 5.3.1):

a. Provide a means to isolate the equipment and components from the fire area before the fire (i.e., remove power, open circuit breakers).

b. Provide electrical isolation that prevents spurious actuation. Potential isolation devices include breakers, fuses, amplifiers, control switches, CTs, fiber optic couplers, relays, and transducers.

c. Provide a means to detect spurious actuations and develop procedures to mitigate the maloperation of equipment (e.g., closure of the block valve if a power-operated relief valve spuriously operates, opening the breakers to remove the spurious actuation of safety injection).

5.4.4.3 Common Enclosures To ensure that the coordination criteria are met, one of the following the following should be provided:

a. Provide appropriate measures to prevent propagation of the fire.

b. Provide electrical protection (e.g., breakers, fuses, or similar devices).

5.4.5 Control Room Fires The control room fire area contains the controls and instruments for redundant shutdown systems in proximity. (Separation is usually a few inches.) Alternative or dedicated shutdown capability for the control room and its required circuits should be independent of the cables, systems, and components in the control room fire area.

The damage to systems in the control room for a fire that causes evacuation of the control room cannot be predicted. The licensee should conduct a bounding analysis to ensure that safe conditions can be maintained from outside the control room. This analysis is dependent on the specific design. The following assumptions usually apply:

DG-1359, Page 88

a. The reactor is tripped in the control room.

b. Offsite power is lost, as well as automatic starting of the onsite AC generators and the automatic function of valves and pumps with control circuits that could be affected by a control room fire.

The analysis should demonstrate the capability to manually achieve safe-shutdown conditions from outside the control room by restoring AC power to designated pumps, ensuring that valve lineups are correct, and assuming that any malfunctions of valves that permit the loss of reactor coolant can be corrected before unrestorable conditions occur.

The only operator action in the control room before evacuation for which credit is usually given is reactor trip. For any additional control room actions deemed necessary before evacuation, a licensee should be able to demonstrate that such actions can be performed. Additionally, the licensee should ensure that such actions cannot be negated by subsequent spurious actuation signals resulting from the postulated fire. The design basis for the control room fire should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system.

After the alternative or dedicated shutdown system achieves control of the plant, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plants approved FPP. Licensees have SERs for their alternate and dedicated shutdown strategies outlining the specific considerations needed in response to a control room fire scenario. Each plants fire protection license condition references these SERs.

Procedures and conditions described in Regulatory Position 5.5.2 should govern post-fire return to the control room.

After returning to the control room, the operators can take any actions compatible with the condition of the control room. Controls in any area (cabinet where the fire occurred) may not be available.

Smoke and fire suppressant damage in other areas (cabinets) should also be assessed and corrective action taken before controls in such cabinets are deemed functional. Controls in undamaged areas (cabinets) may be operated as required. Repairs inside the control room may be performed to reach cold shutdown.

5.5 Post-fire Safe-Shutdown Procedures Procedures for effecting safe shutdown should reflect the results and conclusions of the safe-shutdown analysis. Implementation of the procedures should not further degrade plant safety functions. Time-critical operations for effecting safe shutdown identified in the safe-shutdown analysis and incorporated in post-fire procedures should be validated.

5.5.1 Safe-Shutdown Procedures Post-fire safe-shutdown operating procedures should be developed for those areas where alternative or dedicated shutdown is required. For other areas of the plant, shutdown would normally be achieved using the normal operating procedures, plant emergency operating procedures, or other abnormal operating procedures (see also Regulatory Position 5.3.1.3 for a discussion of the feasibility and reliability of operator manual actions).

DG-1359, Page 89

5.5.2 Alternative or Dedicated Shutdown Procedures Procedures should be in effect that describe the tasks to implement alternative or dedicated shutdown capability when offsite power is available and when offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

These procedures should also address necessary actions to compensate for spurious actuations and HIFs, if such actions are necessary to affect safe shutdown. Information in NEI 00-01, Revision 4, Appendix B.1, may be used to address multiple HIFs when used in a manner consistent with this guide.

The NRC does not endorse the information in NEI 00-01, Revision 4, Appendix B.1, for analysis of Kapton cables. Kapton is a specific cable insulation material that has been shown to experience arc tracking phenomena.

Procedures governing the return to the control room should consider the following conditions:

a. The fire has been extinguished and so verified by appropriate fire protection personnel.

b. Appropriate fire protection personnel and the shift supervisor have deemed the control room to be habitable.

c. Damage has been assessed and, if necessary, corrective action has been taken to ensure that necessary safety, control, and information systems are functional (some operators may assist with these tasks), and the shift supervisor has authorized the return of plant control to the control room.

d. Turnover procedures that ensure an orderly transfer of control from the alternative or dedicated shutdown panel to the control room have been completed.

5.5.3 Repair Procedures The licensee should develop procedures for performing repairs necessary to achieve and maintain cold-shutdown conditions. For alternative shutdown, procedures should be in effect to accomplish repairs necessary to achieve and maintain cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For plants that must proceed to cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the procedures should support the required time for initiation of cold shutdown.

The performance of repair procedures should not adversely affect operating systems needed to maintain hot shutdown.

5.6 Shutdown and Low-Power Operations Safe-shutdown requirements and objectives focus on achieving shutdown conditions for fires occurring during normal at-power operations. During shutdown operations (i.e., maintenance or refueling outages), fire risk may increase significantly as a result of work activities. In addition, redundant systems important to safety may not be available as allowed by plant technical specifications and plant procedures.

The FPP should be reviewed to verify that fire protection systems, features, and procedures will minimize the potential for fire events to affect safety functions (e.g., reactivity control, reactor decay heat removal, spent fuel pool cooling) or result in the unacceptable release of radioactive materials, under the differing conditions that may be present during shutdown operations.

DG-1359, Page 90

6. Fire Protection for Areas Important to Safety Several areas within a nuclear power plant present unique hazards or design issues related to fire protection and safe shutdown. This section provides guidance applicable to specific plant areas.

6.1 Areas Related to Power Operation 6.1.1 Containment Fire protection for the primary and secondary containment areas should be provided for the hazards identified in the fire hazards analysis. Under normal conditions, containment fire hazards may include lubricating oils, hydraulic fluids, cables, electrical penetrations, electrical cabinets, and charcoal filters. During refueling and maintenance operations, additional hazards may be introduced, including contamination control and decontamination materials and supplies, scaffolding, plastic sheathing, wood planking, chemicals, and hot work. The fire hazards analysis should evaluate the effects of postulated fires within the primary containment to ensure that the performance objectives described in Regulatory Position 5.1 of this guide are met.

Regulatory Position 7.1 provides guidance for RCP oil collection.

6.1.1.1 Containment Electrical Separation For secondary containment areas, cable fire hazards that could affect safety should be protected as described in Regulatory Position 4.1.3.3 of this guide.

Inside noninerted containments, one of the fire protection means specified in Regulatory Position 5.3.1.1, or one of the following, should be provided:

a. separation of cables and equipment and associated nonsafety circuits of redundant trains by a horizontal distance of more than 6.1 m (20 ft) with no intervening combustibles or fire hazards;

b. installation of fire detectors and an automatic fire suppression system in the fire area; or

c. separation of cables and equipment and associated nonsafety circuits of redundant trains by a noncombustible radiant energy shield having a minimum fire rating of 30 minutes, as demonstrated by testing or analysis.

6.1.1.2 Containment Fire Suppression The licensee should provide fire suppression systems on the basis of a fire hazards analysis.

During normal operations, containment is generally inaccessible, and therefore, automatic fixed systems should provide fire protection.

Automatic fire suppression capability need not be provided in primary containment atmospheres that are inerted during normal operations. However, inerted containments should have manual firefighting capability, including standpipes, hose stations, and portable extinguishers, for protection during refueling and maintenance operations.

DG-1359, Page 91

Standpipe and hose stations should also be installed inside PWR containments and BWR containments that are not inerted. Standpipe and hose stations inside containment may be connected to a high-quality water supply of sufficient quantity and pressure other than the fire main loop if plant-specific features prevent extending the fire main supply inside containment. For BWR drywells, standpipe and hose stations should be placed outside the drywell with adequate lengths of hose, no longer than 30.5 m (100 ft), to reach any location inside the drywell with an effective hose stream.

The containment penetration of the standpipe system should meet the isolation requirements of GDC 56, Primary Containment Isolation, of Appendix A to 10 CFR Part 50 and should be in seismic Category I and Quality Group B.

Operation of the fire protection systems should not compromise the integrity of the containment or other systems important to safety. Fire protection activities in the containment areas should function in conjunction with total containment requirements such as ventilation and control of contaminated liquid and gaseous release.

The licensee should place adequate self-contained breathing apparatuses near the containment entrances for firefighting and damage control personnel. These units should be independent of any breathing apparatuses or air supply systems provided for general plant activities and should be clearly marked as emergency equipment. For normally inerted containments, self-contained breathing apparatuses need be staged near the containment hatches only when the containment is not inerted, such as during maintenance outages.

6.1.1.3 Containment Fire Detection Fire detection systems should alarm and annunciate in the control room. In primary containment, fire detection systems should be provided for each fire hazard. For primary and secondary containment, the type of detection used and the location of the detectors should be the most suitable for the particular type of fire hazard identified by the fire hazards analysis.

A general area fire detection capability should be provided in the primary containment as backup to the above-described hazard detection. To accomplish this, suitable smoke or heat detectors compatible with the radiation environment should be installed in the air recirculation system ahead of any filters.

6.1.2 Control Room Complex The control room complex (including galleys and office spaces) should be protected against disabling fire damage and should be separated from other areas of the plant by floors, walls, and roof having minimum fire-resistance ratings of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Peripheral rooms in the control room complex should have automatic water suppression and should be separated from the control room by noncombustible construction with a fire-resistance rating of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Ventilation system openings between the control room and peripheral rooms should have automatic smoke dampers that close upon operation of the fire detection or suppression system. If a gas extinguishing system is used for fire suppression, these dampers should be strong enough to support the pressure rise accompanying the agent discharge and seal tightly against infiltration of the agent into the control room. CO2 total-flooding systems are not acceptable for these areas.

Breathing apparatuses for control room operators should be readily available.

DG-1359, Page 92

All cables that enter the control room should terminate in the control room. That is, no cabling should be routed through the control room from one area to another. Cables in underfloor and ceiling spaces should be rated and meet the separation criteria necessary for fire protection.

Equipment that is important to safety should be mounted on pedestals, or the control room should have curbs and drains to direct water away from such equipment. Such drains should be provided with a means for closing to maintain the integrity of the control room in the event of other accidents requiring control room isolation.

The control room should not be carpeted. Where carpeting has been installed (e.g., for sound abatement or other human factors), it should be tested to standards such as ASTM D2859, Standard Test Method for Ignition Characteristics of Finished Textile Floor Covering Materials (Ref. 116), to establish the flammability characteristics of the material. The fire hazards analysis should address these characteristics.

6.1.2.1 Control Room Fire Suppression Manual firefighting capability should be provided for both of the following:

a. fire originating within a cabinet, console, or connecting cables; and

b. exposure fires involving combustibles in the general room area.

Portable Class A and Class C fire extinguishers should be located in the control room. A hose station should be installed inside or immediately outside the control room.

Nozzles that are compatible with the hazards and equipment in the control room should be provided for the manual hose station. The nozzles chosen should meet actual firefighting needs, satisfy electrical safety, and minimize physical damage to electrical equipment from hose stream impingement.

Fully enclosed electrical raceways located in underfloor and ceiling spaces, if over 0.09 m2 (1 ft2) in cross-sectional area, should have automatic fire suppression inside. Area automatic fire suppression should be provided for underfloor and ceiling spaces if these spaces are used for cable runs, unless all cable is run in 10-centimeter (4-in.) or smaller steel conduit or the cables are in fully enclosed raceways internally protected by automatic fire suppression.

6.1.2.2 Control Room Fire Detection Smoke detectors should be provided in the control room, cabinets, and consoles. If redundant safe-shutdown equipment is located in the same control room cabinet or console, additional fire protection measures should be provided. Alarm and local indication should be provided in the control room.

The outside air intake(s) for the control room ventilation system should be provided with smoke detection capability to alarm in the control room to enable manual isolation of the control room ventilation system and, thus, prevent smoke from entering the control room.

DG-1359, Page 93

6.1.2.3 Control Room Ventilation Venting of smoke produced by fire in the control room by means of the normal ventilation system is acceptable; however, provision should be made to permit isolation of the recirculating portion of the normal ventilation system. The operators should be able to manually operate venting of the control room.

Air-handling functions should be ducted separately from cable runs in ceiling and floor spaces. If cables are routed in underfloor or ceiling spaces, these spaces should not be used as air plenums for ventilation of the control room.

6.1.3 Cable Spreading Room A separate cable spreading room should be provided for each redundant division. Cable spreading rooms should not be shared between reactors. Each cable spreading room should be separated from the others and from other areas of the plant by barriers with a minimum fire rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. If this is not possible, an alternative or dedicated shutdown capability should be provided.

Cable spreading rooms should have the following:

a. at least two remote and separate entrances for access by fire brigade personnel,

b. an aisle separation between tray stacks at least 0.9 m (3 ft) wide and 1.5 m (5 ft) high,

c. hose stations and portable extinguishers installed immediately outside the room, and

d. area fire detection.

If division cables are not separated by 3-hour barriers, separation should meet the guidelines of RG 1.75, and the cables should have a suitable fire-retardant coating. (New reactor cables should meet the fire and flame test requirements of IEEE 1202.)

The primary fire suppression in the cable spreading room should be an automatic water system, such as closed-head sprinklers, open-head deluge system, or open directional water spray system. Deluge and open spray systems should have provisions for manual operation at a remote station; however, there should also be provisions to preclude inadvertent operation. Determination of the location of sprinkler heads or spray nozzles should consider cable tray arrangements and possible transient combustibles to ensure adequate water coverage for areas that could present exposure hazards to the cable system. Cables should be designed to allow wetting down with water supplied by the fire suppression system without electrical faulting.

Open-head deluge and open directional spray systems should be zoned so that a single failure will not deprive the entire area of automatic fire suppression capability.

The use of foam is acceptable so long as it is a type that can be delivered by a sprinkler or deluge system.

Alternative gas systems (Halon, clean agent, or CO2) may be used for primary fire suppression if they are backed up by an installed water spray system and hose stations and portable extinguishers immediately outside the room. The access requirements stated above should also be met.

DG-1359, Page 94

Floor drains should be provided to remove firefighting water. When gas systems are installed, drains should have adequate seals, or the gas extinguishing systems should be sized to compensate for losses through the drains.

The ventilation system for each cable spreading room should be designed to isolate the area upon actuation of any gas extinguishing system in the area. Separate, manually actuated smoke venting that is operable from outside the room should be considered for the cable spreading room.

6.1.4 Plant Computer Rooms Rooms for computers performing functions important to safety that are not part of the control room complex should be separated from other areas of the plant by barriers having a minimum fire-resistance rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and should be protected by automatic detection and fixed automatic suppression. Computers that are part of the control room complex but are not located in the control room should be separated and protected as described in Regulatory Position 6.1.2 for peripheral rooms.

Computer cabinets located in the control room should be protected as other control room equipment and cable runs in the room. Nonsafety-related computers outside the control room complex should be separated from plant areas important to safety by fire barriers with a minimum rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and should be protected as needed to prevent fire and smoke damage to equipment important to safety.

Manual hose stations and portable extinguishers should be located in areas containing equipment important to safety. NFPA 75, Standard for the Protection of Information Technology Equipment (Ref. 117), provides additional guidance.

New reactor designs with individual digital control system servers located throughout the plant should include 3-hour fire barrier protection between redundant servers performing functions that are important to safety; however, nonsafety-related servers outside the control room complex do not need to be separated by fire barriers from plant areas important to safety, and servers that are important to safety do not need to be protected by detection and suppression unless required by the fire hazards analysis.

6.1.5 Switchgear Rooms Switchgear rooms containing equipment important to safety should be separated from the remainder of the plant by barriers with a minimum fire rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Redundant switchgear safety divisions should be separated from each other by barriers with a 3-hour fire rating. Automatic fire detectors should alarm and annunciate in the control room and alarm locally. Cables entering the switchgear room that do not terminate or perform a function should be kept at a minimum to minimize the fire hazard. These rooms should not be used for any other purpose. Automatic fire suppression should be provided consistent with other safety considerations. Fire hose stations and portable fire extinguishers should be readily available outside the area.

Some high-voltage electrical equipment (e.g., switchgear and transformers) has the potential for an energetic electrical fault that can damage SSCs important to safety. The fire hazards analysis should consider the potential for this type of fault.

Equipment should be located to facilitate access for manual firefighting. Drains (see Regulatory Position 4.1.5 of this guide) should be provided to prevent water accumulation from damaging equipment important to safety. Remote, manually actuated ventilation should be considered for venting smoke when manual fire suppression effort is needed (see Regulatory Position 4.1.4 of this guide).

DG-1359, Page 95

6.1.6 Alternative and Dedicated Shutdown Panels Barriers with a minimum fire rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> should separate panels providing alternative and dedicated shutdown capability from the control room complex. Panels providing alternative and dedicated shutdown capability should be electrically isolated from the control room complex so that a fire in either area will not affect shutdown capability from the other area. The general area housing remote panels important to safety should be provided with automatic fire detectors that alarm locally and alarm and annunciate in the control room. Combustible materials should be controlled and limited to those required for operation. Portable extinguishers and manual hose stations should be readily available in the general area.

Locations containing alternative and dedicated shutdown panels should be habitable under fire and post-fire conditions that require their use. Habitability should also be addressed for alternative and dedicated shutdown panels protected by or adjacent to areas with gaseous fire suppression systems.

6.1.7 Station Battery Rooms Battery rooms important to safety should be protected against fires and explosions. Battery rooms should be separated from each other and from other areas of the plant by barriers having a minimum fire rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> inclusive of all penetrations and openings. These battery rooms should not house DC switchgear and inverters. Automatic fire detection should alarm and annunciate in the control room and alarm locally. Battery room ventilation systems should be capable of maintaining the hydrogen concentration well below 2 percent. Loss of ventilation should be alarmed in the control room.

Standpipes, hose stations, and portable extinguishers should be readily available outside the room.

6.1.8 Diesel Generator Rooms Diesel generators important to safety should be separated from each other and from other areas of the plant by fire barriers that have a fire-resistance rating of at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Diesel generators that are not important to safety should be separated from plant areas containing equipment and circuits important to safety by fire barriers that have a fire-resistance rating of at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

Automatic fire suppression should be installed to suppress or control any diesel generator or lubricating oil fires. Such systems should be designed to operate without affecting the diesel when it is running. Automatic fire detection should alarm and annunciate in the control room and alarm locally.

Hose stations and portable extinguishers should be readily available outside the area. Drainage for firefighting water should be provided, and a means for local manual venting of smoke should be considered.

Day tanks with a total capacity of up to 4,164 L (1,100 gal) may be located in rooms with diesel generators important to safety under the following conditions:

a. The day tank is located in a separate enclosure with a fire-resistance rating of at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, including doors or penetrations. These enclosures should be capable of containing the entire contents of the day tanks and should be protected by an automatic fire suppression system.

b. The day tank is located inside the diesel generator room in a diked enclosure that has sufficient capacity to hold 110 percent of the contents of the day tank or is drained to a safe location.

DG-1359, Page 96

6.1.9 Pump Rooms Pump houses and rooms housing redundant pump trains important to safety should be separated from each other and from other areas of the plant by fire barriers having at least 3-hour ratings. These rooms should be protected by automatic fire detection and suppression unless a fire hazards analysis can demonstrate that a fire will not endanger other equipment required for safe plant shutdown. Fire detection should alarm and annunciate in the control room and alarm locally. Hose stations and portable extinguishers should be readily accessible.

Equipment pedestals, curbs, and floor drains should be provided to prevent water accumulation from damaging equipment important to safety (see Regulatory Position 4.1.5 of this guide).

Provisions should be made for manual control of the ventilation system to facilitate smoke removal if required for manual firefighting operation (see Regulatory Position 4.1.4 of this guide).

6.2 Other Areas Other areas within the plant may contain hazards or equipment that warrant special consideration related to fire protection, including areas containing significant quantities of radioactive materials, yard areas containing water supplies or systems important to safety, and the plant cooling tower.

6.2.1 New Fuel Areas Portable hand fire extinguishers should be located near this area. Also, hose stations should be located outside but within hose reach of this area. Automatic fire detection should alarm and annunciate in the control room and alarm locally. Combustibles should be kept to a minimum in the new fuel area.

The storage area should be provided with a drainage system to prevent accumulation of water.

The storage configuration of new fuel should always be maintained to preclude criticality for any water density that might occur during fire-water application.

6.2.2 Spent Fuel Areas Local hose stations and portable fire extinguishers should provide protection for the spent fuel pool. Automatic fire detection should alarm and annunciate in the control room and alarm locally.

RG 1.191 provides additional guidelines for fire protection of spent fuel areas for permanently shutdown reactors where removal of the spent fuel to an independently licensed storage facility is incomplete.

6.2.3 Radwaste Building, Radwaste Storage Areas, and Decontamination Areas Radioactive waste buildings, storage areas, and decontamination areas should be separated from other areas of the plant by fire barriers having at least 3-hour ratings. Automatic sprinklers should be used in all areas where combustible materials are located. Alternatively, manual hose stations and portable extinguishers (handheld and large-wheeled units sized according to the hazards) are acceptable.

Automatic fire detection should annunciate and alarm in the control room and alarm locally. Ventilation systems in these areas should be capable of being isolated to prevent the release of radioactive materials DG-1359, Page 97

to other areas or the environment. Water from firefighting activities should drain to liquid radwaste collection systems.

Materials that collect and contain radioactivity, such as spent ion exchange resins, charcoal filters, and HEPA filters, should be stored in closed metal tanks or containers that are located in areas free from ignition sources or combustibles. These materials should be protected from exposure to fires in adjacent areas as well. Requirements for removal of decay heat from entrained radioactive materials should be considered.

6.2.4 Independent Spent Fuel Storage Areas The requirements of 10 CFR 72.122(c) address fire protection of dry cask storage and other independent spent fuel storage facilities. The fire protection provided for these facilities should be commensurate with the potential fire hazards and with the potential for an unacceptable release of radiation during and following a fire. In addition to the requirements of 10 CFR Part 72, Licensing Requirements for the Independent Storage of Spent Nuclear Fuel, High-Level Radioactive Waste, and Reactor-Related Greater Than Class C Waste (Ref. 118), fire protection for independent spent fuel storage installations should ensure that fires involving such installations will not impact plant operations and plant areas important to safety.

6.2.5 Water Tanks Important to Safety Storage tanks that supply water for safe shutdown should be protected from the effects of an exposure fire. Combustible materials should not be stored next to outdoor tanks.

6.2.6 Cooling Towers Cooling towers should be constructed of noncombustible materials or be located and protected in such a way that a fire will not adversely affect any systems or equipment important to safety. Cooling towers should be of noncombustible construction when the basins are used for the ultimate heat sink or for the fire protection water supply. For the latter, provisions should be made to ensure a continuous supply of fire protection water whenever the cooling tower basin is drained for cleaning or other maintenance.

7. Protection of Special Fire Hazards Exposing Areas Important to Safety 7.1 Reactor Coolant Pump Oil Collection External RCPs with oil lubrication systems should be equipped with an oil collection system if the containment is not inerted during normal operation. The oil collection system should be designed, engineered, and installed to ensure that failure will not lead to fire during normal or design-basis accident conditions and that the system will withstand the safe-shutdown earthquake.

Such collection systems should be capable of collecting lube oil from all potential pressurized and unpressurized leakage sites in the RCP lube oil systems. Leakage should be collected and drained to a vented closed container that can hold the entire lube oil system inventory. A flame arrester is required in the vent if the flashpoint characteristics of the oil present the hazard of fire flashback, as described in the plant-specific licensing basis (i.e., 10 CFR Part 50, Appendix R, Section III.O, or applicable BTP).

DG-1359, Page 98

Leakage points to be protected should include, but are not limited to, lift pump and piping, overflow lines, lube oil cooler, oil fill and drain lines and plugs, flanged connections on oil lines, and lube oil reservoirs when such features exist on the RCPs. The drain line should be large enough to accommodate the largest potential oil leak.

As described in the plant-specific licensing basis (i.e., 10 CFR Part 50, Appendix R, Section III.O, or applicable BTP), one or more tanks need to be provided with sufficient capacity to collect the total lube oil inventory from all RCPs draining to the container.

Alternatives that may be acceptable include the following:

a. One or more tanks are provided with sufficient capacity to hold the total lube oil inventory of one RCP with margin if the tank is located such that any overflow from the tank will be drained to a safe location where the lube oil will not present an exposure fire hazard to or otherwise endanger equipment important to safety.

b. Where the RCP lube oil system is shown, by analysis, to be capable of withstanding the safe-shutdown earthquake (eliminating the consideration of simultaneous lube oil system ruptures from a seismic event), protection is provided for random leaks at mechanical joints in the lube oil system (e.g., flanges, resistance temperature detector connections, sightglasses). Alternative methods of protection may be deemed acceptable for such designs. In RCP lube oil collection systems of such designs, one or more tanks need to be provided with sufficient capacity to hold the total lube oil inventory of one RCP with margin. Because protection is required only against possible leakage resulting from random leaks from the one pump at a time, any overflow from the tanks need not be considered.

c. For pumps with the lube oil contained entirely within the pump casing, an oil collection system may not be required, provided that it can be shown that there are no potentially significant leakage points.

7.2 Turbine Generator Building The turbine building should be separated from adjacent structures containing equipment important to safety by a fire barrier with a rating of at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. The fire barriers should be designed to maintain structural integrity even in the event of a complete collapse of the turbine structure. Openings and penetrations in the fire barrier should be minimized and should not be located where the turbine oil system or generator hydrogen cooling system creates a direct fire exposure hazard to the barrier.

Considering the severity of the fire hazards, defense in depth may dictate additional protection to ensure barrier integrity, and the potential effect of a major turbine building fire on the ability to maintain operator control of the plant and safely shut down should be evaluated.

7.2.1 Oil Systems Turbine buildings contain large sources of combustible liquids, including reservoirs and piping for lube oil, seal oil, and electrohydraulic systems. These systems should be separated from systems important to safety by 3-hour rated barriers. Additional protection should be provided on the basis of the hazard or where fire barriers are not provided (see Regulatory Position 2.1.3 of this guide).

DG-1359, Page 99

7.2.2 Hydrogen System Turbine generators may use hydrogen for cooling. Hydrogen storage and distribution systems should meet the guidelines in Regulatory Position 7.5 of this guide.

7.2.3 Smoke Control Smoke control should be provided in the turbine building to mitigate potential heavy smoke conditions associated with combustible liquid and cable fires. Regulatory Position 4.1.4 provides specific guidance.

7.3 Station Transformers Transformers installed inside fire areas containing systems important to safety should be of the dry type or insulated and cooled with noncombustible liquid. Transformers filled with combustible fluid that are located indoors should be enclosed in a transformer vault. NFPA 70 offers additional guidance.

Outdoor oil-filled transformers should have oil spill confinement features or drainage away from the buildings. Such transformers should be located at least 15.2 m (50 ft) distant from the building, or building walls within 15.2 m (50 ft) of oil-filled transformers should be without openings and have a fire-resistance rating of at least 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

7.4 Diesel Fuel Oil Storage Areas Diesel fuel oil tanks with a capacity greater than 4,164 L (1,100 gal) should not be located inside buildings containing equipment important to safety. If aboveground tanks are used, they should be located at least 15.2 m (50 ft) from any building containing equipment important to safety, or if located within 15.2 m (50 ft), they should be housed in a separate building constructed with materials having a minimum fire-resistance rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Potential oil spills should be confined or directed away from buildings containing equipment important to safety. Totally buried tanks are acceptable outside or under buildings (see NFPA 30 for additional guidance).

An automatic fire suppression system should protect aboveground oil storage, including those tanks located in a separate building.

7.5 Flammable Gas Storage and Distribution Bulk gas storage (either compressed or cryogenic) should not be permitted inside structures housing equipment important to safety. Storage of flammable gas such as hydrogen should be located outdoors or in separate, detached buildings so that a fire or explosion will not adversely affect any systems or equipment important to safety.

Care should be taken to locate high-pressure gas storage containers with the long axis parallel to building walls. This will minimize the possibility of wall penetration in the event of a container failure.

Acetylene-oxygen gas cylinder storage locations should not be in areas that contain or expose equipment important to safety or the fire protection systems that serve those equipment areas. NFPA 55 provides additional guidance.

DG-1359, Page 100

Risks to equipment important to safety from hydrogen supply systems can be minimized by designing hydrogen lines in plant areas important to safety to seismic Category I requirements, sleeving the piping such that the pipe is directly vented to the outside. Risks can also be minimized through the use of restricting orifices or excess flow valves to limit the maximum flow rate from the storage facility to the areas of concern so that, in case of a line break, the hydrogen concentration in the affected areas will not exceed 2 percent. This approach includes preoperational testing and subsequent retesting of excess flow valves and measures to prevent buildup of unacceptable amounts of trapped hydrogen and inadvertent operation with the safety features bypassed. A somewhat less cost-effective alternative involves use of a normally isolated supply with intermittent manual makeup. EPRI NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations, issued in 1987 (Ref. 119), provides additional guidelines and criteria for the design, installation, and operation of flammable cryogenic and compressed gas systems.

7.6 Nearby Facilities The FPP should address plant support facilities (e.g., offices, maintenance shops, warehouses, temporary structures, equipment storage yards), collocated power generating units (e.g., nuclear, coal, natural gas), and nearby industrial facilities (e.g., chemical plants, refineries, manufacturing facilities) to the extent that fires and or explosions in these facilities may affect equipment important to safety. Fire protection systems and features should be adequate to protect against potential exposure fires and explosions from nearby facilities.

8. Fire Protection for New Reactors 8.1 General Many of the current fire protection requirements and guidelines for operating reactors were issued after Commission approval of construction permits or operating licenses. The imposition of these requirements and guidelines on existing plant designs created the need for considerable flexibility in the application of the regulations on a plant-by-plant basis. New reactor designs should integrate fire protection requirements, including the protection of safe-shutdown capability and the prevention of radiological release, into the planning and design phase for the plant. In addition, new reactor designs should minimize or eliminate the use of alternative or dedicated shutdown systems and should rely on such systems only when it is not feasible to provide the required protection for redundant safe-shutdown systems, such as in the main control room. Similarly, when practical, reliance on operator manual actions should be avoided.

Unless specifically noted otherwise, the guidance in this RG applies to the FPP for new reactor plants. RG 1.206, Applications for Nuclear Power Plants (Ref. 120), provides guidance on the scope and content of the COL application for new reactors.

8.2 Enhanced Fire Protection Criteria New reactor designs should ensure that safe shutdown can be achieved by assuming that all equipment in any one fire area will be rendered inoperable by fire and that reentry into the fire area for repairs and operator actions is not possible. Because of its physical configuration, the control room is excluded from this approach, provided that the design includes an independent alternative shutdown capability that is physically and electrically independent of the control room. The control room should be DG-1359, Page 101

evaluated to ensure that the effects of fire do not adversely affect the ability to achieve and maintain safe shutdown. Designs incorporating reactor containment buildings should provide fire protection for redundant shutdown systems in the reactor containment building that will ensure, to the extent practicable, that one shutdown division will be free of fire damage. Additionally, new reactor designs should ensure that smoke, hot gases, or the fire suppressant will not migrate into other fire areas to the extent that they could adversely affect safe-shutdown capabilities, including operator actions.

8.3 Passive Plant Safe-Shutdown Condition As discussed in SECY-94-084, the definitions of safe shutdown in the Commissions regulations and guidelines do not address the inherent limitations of passive RHR systems.

In GDC 34, Residual Heat Removal, of Appendix A to 10 CFR Part 50, the NRC regulations require that the design include an RHR system to remove residual heat from the reactor core so that specified acceptable fuel design limits are not exceeded. GDC 34 further requires suitable redundancy of the components and features of the RHR system to ensure that the system safety functions can be accomplished, assuming a loss of offsite power or onsite power, coincident with a single failure.

Passive reactor designs are limited by the inherent ability of the passive heat removal processes and cannot reduce the temperature of the reactor coolant system below the boiling point of water for heat transfer to occur between the reactor coolant and the heat sink. The plant designs include cooling systems to bring the reactor to cold shutdown or refueling condition; however, these systems are not safety grade.

These nonsafety-grade systems (i.e., makeup water to the heat sink and cooldown capability) are necessary to maintain long-term cooling (i.e., beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) and must be capable of accomplishing their respective functions without damage to the fuel as demonstrated by design and analysis.

Based on the discussion and recommendations of SECY-94-084, the passive decay heat removal systems should be capable of achieving and maintaining a temperature of 215.6 degrees C (420 degrees F) or below for non-LOCA events. This safe-shutdown condition is predicated on demonstration of acceptable passive safety system performance.

New reactor designs should not rely on a SISBO to mitigate potential fire damage to safe-shutdown systems.

8.4 Applicable Industry Codes and Standards In general, the FPP for new LWR designs should comply with the provisions specified in NFPA 804, Standard for Fire Protection for Advanced Light Water Reactor Electric Generating Plants (Ref. 121), as they relate to the protection of post-fire safe-shutdown capability and the mitigation of a radiological release resulting from a fire. However, the NRC has not formally endorsed NFPA 804, and some of the guidance in the NFPA standard may conflict with regulatory requirements. When conflicts occur, the applicable regulatory requirements and guidance, including the guidance in this RG, will govern.

As stated in SRP 9.5.1.1, Appendix A Section 3, the standards of record related to the design and installation of fire protection systems and features required to satisfy NRC requirements in all new reactor designs are those NFPA codes and standards in effect 180 days before the submittal of the application under 10 CFR Part 50 or 10 CFR Part 52. The 180-day deadline is based on the application requirements DG-1359, Page 102

in 10 CFR 50.34(h)(1)(i), 50.34(h)(1)(ii), 52.47(a)(9), 52.79(a)(41), 52.137(a)(9), and 52.157(f)(30). For COL applications that reference a certified design, the standards of record will be those approved for the certified design, except for FPP features that are not included in the certified design, such as unique site-specific fire protection systems or equipment. FPP features that are not addressed in the certified design, including the programmatic aspects of the FPP, should be in accordance with those NFPA codes and standards in effect 180 days before the submittal of the COL application.

8.5 Other New Reactor Designs FPPs for proposed new non-LWR designs should meet the overall fire protection objectives and guidance in the applicable regulations and this RG as they relate to safe shutdown and radiological release, as well as the specific fire protection requirements that apply. Fire hazards should be identified and evaluated, and an appropriate level of protection provided to meet these objectives. Design reviews and testing programs should confirm the safe-shutdown capability. SSCs important to safe shutdown should be protected in accordance with the enhanced criteria described above for LWRs.

8.6 Fire Protection Program Implementation Schedule SECY-05-0197, Review of Operational Programs in a Combined License Application and Generic Emergency Planning Inspections, Tests, Analyses, and Acceptance Criteria, dated October 28, 2005 (Ref. 122), identifies fire protection as an operation program. However, only those elements of the FPP that will not be implemented fully until the completion of the plant should be addressed as an operational program. These may include, but are not limited to, the fire brigade, combustible and ignition source control program, procedures and pre-fire plans, and portable extinguishing equipment. The COL application should identify the operational program aspects of the FPP and the implementation schedule for each. In lieu of the implementation schedule, the applicant may propose inspections, tests, analyses, and acceptance criteria for these aspects of the program.

8.7 Fire Protection for Nonpower Operation The guidance for fire prevention in Regulatory Position 2 of this guide applies to all modes of plant operation, including shutdown. License applications for new reactors should also address any special provisions to ensure that, in the event of a fire during a nonpower mode of operation, the plant can be maintained in safe shutdown.

9. Fire Protection for License Renewal Licensees may apply for an initial license renewal and subsequent license renewal to permit continued plant operation beyond the original operating license period of operation, in accordance with the provisions of 10 CFR Part 54. The fire protection licensing and design basis under initial license renewal and subsequent license renewal should not differ significantly from that in effect before renewal, with the exception that fire protection SSCs must be included in an aging management program (AMP) as appropriate.

As stated in 10 CFR 54.21, Contents of applicationtechnical information, those components with intended functions that are identified within the scope of license renewal and those components that are passive (i.e., they do not perform their functions with moving parts) and long lived (i.e., they are not subject to replacement based on qualified life or routine replacement) are subject to an aging management DG-1359, Page 103

review (AMR). Examples of passive and long-lived fire protection components that are subject to an AMR include fire barrier assemblies (e.g., ceilings, floors, walls, penetration seals, damper housing and doors), sprinklers, fire suppression system piping and valve casings, fire protection tanks and pump casings, and fire hydrant casings. Active components are defined as components that perform an intended function as described in 10 CFR 54.4, Scope, with moving parts or with a change in configuration or properties; as such, they are excluded from the AMR. For example, smoke/heat detectors are considered active components.

Certain passive and long-lived components are considered consumables and therefore are not subject to an AMR. System filters, fire extinguishers, fire hoses, and air packs (within the scope of license renewal) may be excluded, on a plant-specific basis, from an AMR under 10 CFR 54.21(a)(1)(ii). These components are considered to be within the scope of license renewal and are typically replaced based on specific performance and condition monitoring activities that clearly establish a routine replacement practice based on a qualified life of the component. An AMR may exclude these components based on specific performance and condition monitoring activities provided that the applicant (1) identifies and lists in the license renewal application each component type subject to such replacement and (2) identifies the applicable monitoring and replacement programs that conform to appropriate standards (e.g., NFPA standards).

For all components identified within the scope of license renewal and subject to an AMR, the licensee must demonstrate that the effect of aging on the intended function(s) will be adequately managed for the period of extended operation in accordance with 10 CFR 54.21(c)(1)(iii). For example, the intended function of fire suppression piping or the fire pump casing is to provide a pressure boundary.

Programs to manage the aging effects of the pressure boundary can be existing plant programs, modified (or enhanced) programs, or new programs specifically created to address aging concerns. The development of modified or newly created programs depends on (1) the aging effect that needs to be managed and (2) the ability of the current program to manage the aging effect throughout the period of extended operation.

Plants that have installed Halon 1301 extinguishing systems that will be credited during the extended life of the plant should have a plan for continued access to an adequate supply of replacement Halon or a plan to replace the system.

DG-1359, Page 104

D. IMPLEMENTATION The NRC staff may use this regulatory guide as a reference in its regulatory processes, such as licensing, inspection, or enforcement. However, the NRC staff does not intend to use the guidance in this regulatory guide to support NRC staff actions in a manner that would constitute backfitting as that term is defined in 10 CFR 50.109, Backfitting, and as described in NRC Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests (Ref. 123), nor does the NRC staff intend to use the guidance to affect the issue finality of an approval under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. The staff also does not intend to use the guidance to support NRC staff actions in a manner that constitutes forward fitting as that term is defined and described in Management Directive 8.4. If a licensee believes that the NRC is using this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfitting or forward fitting appeal with the NRC in accordance with the process in Management Directive 8.4.

DG-1359, Page 105

GLOSSARY administrative controls: Policies, procedures, and other elements that relate to the FPP. Administrative controls include but are not limited to inspection, testing, and maintenance of fire protection systems and features; compensatory measures for fire protection impairments; review of the impact of plant modifications on the FPP; fire prevention activities; fire protection staffing; control of combustible and flammable materials; and control of ignition sources.

alternative shutdown: The ability to shut down the reactor that is required when it is not feasible to provide the required protection for redundant safe-shutdown trains in one or more fire areas or where fire suppression activities, including inadvertent operation or rupture of a suppression system, could prevent safe shutdown. Appendix R to 10 CFR Part 50 allows an existing plant system to be rerouted, relocated, or modified (at the time the need for an alternative means of shutdown is identified but not during or after the fire) so that it can perform the required safe-shutdown function that the redundant system damaged by fire or damaged by suppression system discharge would normally perform (see also dedicated shutdown and success path).

approved: Tested and accepted for a specific purpose or application by a recognized testing laboratory or reviewed and specifically approved by the NRC in accordance with the appropriate regulatory process (e.g., 10 CFR 50.12).

automatic: Self-acting, operating by its own mechanism when actuated by some monitored parameter such as a change in current, pressure, temperature, or mechanical configuration.

combustible material: Any material that will burn or sustain the combustion process when ignited or otherwise exposed to fire conditions.

common enclosure: An enclosure (e.g., cable tray, conduit, junction box) that contains circuits required for the operation of safe-shutdown components and circuits for nonsafe-shutdown components.

common power supply: A power supply that feeds safe-shutdown circuits and nonsafe-shutdown circuits.

control room complex: The area served by the control room emergency ventilation system.

dedicated shutdown: The capability to shut down the reactor and maintain shutdown conditions by adding to an existing plant new SSCs that are dedicated to performing post-fire safe-shutdown functions. Like alternative shutdown, plant operators use dedicated shutdown when it is not feasible to provide the required protection for redundant safe-shutdown trains in one or more fire areas (see also alternative shutdown and success path).

electrical raceway fire-barrier system: A nonload-bearing partition-type envelope system installed around the electrical components and cabling that are rated by test laboratories in hours of fire resistance and are used to maintain safe-shutdown functions free of fire damage.

emergency control station: A location outside the main control room where actions are taken by operations personnel to manipulate plant systems and controls to achieve the safe shutdown of the reactor.

DG-1359, Page 106

exposure fire: A fire in a given area that involves either in situ or transient combustibles and is external to any SSCs important to safety located in or adjacent to that same area. The effects of such a fire (e.g., smoke, heat, ignition) can adversely affect those SSCs important to safety. Thus, a fire involving one success path of safe-shutdown SSCs may constitute an exposure fire for the redundant success path located in the same area, and a fire involving combustibles other than those in either redundant success path may constitute an exposure fire to multiple redundant success paths located in the same area.

fire area: The portion of a building or plant that is separated from other areas by rated fire barriers adequate for the fire hazard.

fire barrier: Components of construction (walls, floors, and their supports), including beams, joists, columns, penetration seals or closures, fire doors, and fire dampers, that are used to prevent the spread of fire and that are rated by approving laboratories in hours of resistance to fire.

fire brigade: A team of onsite plant personnel that is qualified and equipped to perform manual fire suppression activities.

fire hazards: Conditions that involve the necessary elements to initiate and support combustion, including in situ or transient combustible materials, ignition sources (e.g., heat, sparks, open flames), and an oxygen environment.

fire hazard analysis: An analysis used to evaluate the capability of a nuclear power plant to perform safe-shutdown functions and minimize radioactive releases to the environment in the event of a fire. The analysis includes the following features:

a. identification of fixed and transient fire hazards;

b. identification and evaluation of fire prevention and protection measures related to the identified hazards; and

c. evaluation of the impact of fire in any plant area on the ability to safely shut down the reactor and maintain shutdown conditions, as well as to minimize and control the release of radioactive material.

fire protection compensatory measures: Any action that is put in place by the licensee for impaired, nonfunctional, out-of-service, degraded or inoperable fire protection systems, equipment, or features required by the nuclear power plants post-fire safe-shutdown analysis and the action is needed to maintain compliance with applicable fire protection regulations in 10 CFR 50.48.

fire protection feature: Administrative controls, emergency lighting, fire barriers, fire detection and suppression systems, fire brigade personnel, and other features provided for fire protection purposes.

fire protection program: The integrated effort involving components, procedures, analyses, and personnel used in defining and carrying out all activities of fire protection. It includes system and facility design, fire prevention, fire detection, annunciation, confinement, suppression, DG-1359, Page 107

administrative controls, fire brigade organization, inspection and maintenance, training, quality assurance, and testing.

fire protection system: Fire detection, notification, and suppression systems designed, installed, and maintained in accordance with the applicable nationally recognized codes and standards endorsed by the NRC.

fire resistance: The ability of an element of building construction, component, or structure to fulfill, for a stated period of time, the required load-bearing functions, integrity, thermal insulation, or other expected duty specified in a standard fire-resistance test.

fire-resistance rating: The time that materials or assemblies have withstood a fire exposure as established in accordance with the test procedures of NFPA 251, Standard Methods of Tests of Fire Resistance of Building Construction and Materials.

fire-retardant material: Material that has been coated or treated with chemicals, paints, or other materials that are designed to reduce the combustibility of the treated material.

fire risk: The combination of the probability and consequences of a given fire event based on consideration of (1) what can go wrong? (2) how likely is it? and (3) what are the consequences if it occurs?

fire stop: A feature of construction that prevents fire propagation along the length of cables or prevents fire from spreading to nearby combustibles within a given fire area or fire zone.

fire suppression: Control and extinguishing of fires (firefighting). Manual fire suppression is the use of hoses, portable extinguishers, or manually actuated fixed systems by plant personnel. Automatic fire suppression is the use of automatically actuated fixed systems such as water, Halon, or CO2 systems.

fire watch: Individuals responsible for providing additional (e.g., during hot work) or compensatory (e.g., for system impairments) coverage of plant activities or areas to detect fires or to identify activities and conditions that present a potential fire hazard. The individuals should be trained in identifying conditions or activities that present potential fire hazards, as well as in the use of fire extinguishers and the proper fire notification procedures.

fire zones: Subdivisions of fire areas.

free of fire damage: The SSCs (including electrical circuits) under consideration are capable of performing their required post-fire safe-shutdown functions during and after the postulated fire, as needed, without repair. The crediting of operator actions to restore damaged SSCs or to mitigate the consequences of the fire-induced damage should be in accordance with Regulatory Position 5.3.1.3 of this guide.

hazardous material: A substance that, upon release, has the potential to cause harm to people, property, or the environment.

DG-1359, Page 108

high-impedance fault: A circuit fault condition resulting in a short-to-ground, or conductor-to-conductor hot short, where residual resistance in the faulted connection maintains the fault current level below the long-term setpoint of the components circuit breaker.

hot short: Individual conductors of the same or different cables that come in contact with each other and that may result in an impressed voltage or current on the circuit being analyzed.

hot work: Activities that involve the use of heat, sparks, or open flames, such as cutting, welding, and grinding.

impairment: The degradation of a fire protection system or feature that adversely affects the ability of the system or feature to perform its intended function.

important to safety: Nuclear power plant SSCs important to safety are those required to provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. In Appendix R to 10 CFR Part 50, important to safety and safety related apply to all safety functions.

interrupting device: A breaker, fuse, or similar device installed in an electrical circuit to isolate the circuit (or a portion of the circuit) from the remainder of the system in the event of an overcurrent or fault downstream of the interrupting device.

in situ combustibles: Combustible materials that constitute part of the construction, fabrication, or installation of plant SSCs and, as such, are fixed in place.

isolation device: A device in a circuit that prevents malfunctions in one section of a circuit from causing unacceptable influences in other sections of the circuit or other circuits.

listed: Equipment or materials included on a list published by a recognized testing laboratory, inspection agency, or other organization concerned with product evaluation that periodically inspects the production of listed equipment or materials and states that certain specific equipment or materials meet nationally recognized standards and have been tested and found suitable for use in a specified manner.

mitigate: Perform an action that stops the progression of or reduces the severity of an unwanted condition. With respect to nuclear plant fire protection, mitigation generally refers to operator actions inside or outside the main control room to restore the capability to achieve and maintain safe shutdown when a fire has degraded that capability.

new reactors: Those reactors that are significantly different in operation from the current generation of LWRs and that provide enhanced margins of safety or use simplified, inherent, or other innovative means to accomplish their safety functions.

noncombustible material: (1) Material that, in the form in which it is used and under conditions anticipated, will not ignite, burn, support combustion, or release flammable vapors when subjected to fire or heat, or (2) material having a structural base of noncombustible material, with a surfacing not over 3 mm (1/8 in.) thick that has a flame spread rating no higher than 50 when DG-1359, Page 109

measured in accordance with ASTM E84, Standard Test Method for Surface Burning Characteristics of Building Materials.

open circuit: A failure condition that results when a circuit (either a cable or individual conductor within a cable) loses electrical continuity.

operator action: A normal action taken by an operator inside the main control room to achieve and maintain a post-fire safe shutdown, not including repairs.

operator manual action: Actions performed by operators to manipulate components and equipment from outside the main control room to achieve and maintain post-fire hot shutdown, not including repairs. Operator manual actions include an integrated set of actions needed to ensure that hot shutdown can be accomplished for a fire in a specific plant area. The manual operation of valves, switches, and circuit breakers is allowed to operate equipment and isolate systems in accordance with Regulatory Position 5.3.1.3 and is not considered a repair.

post-fire safe-shutdown analysis: A process or method of identifying and evaluating the capability of SSCs necessary to accomplish and maintain safe-shutdown conditions in the event of a fire.

post-fire safe-shutdown circuits: Electrical circuits in which a fire-induced failure (e.g., short circuit, short to ground) could prevent safe shutdown, either directly (e.g., loss of power to a safe-shutdown pump) or indirectly (e.g., spurious opening of a flow diversion path because of one or more control circuit hot shorts, failure of a motor-operated valve to perform an active post-fire safe-shutdown function caused by the fire-induced failure of a valve protective circuit).

post-fire safe-shutdown system and equipment: Systems and equipment that perform functions needed to achieve and maintain safe shutdown during and following a fire (regardless of whether the system or equipment is part of the success path for safe shutdown). This includes systems and equipment for which a fire-induced spurious actuation could prevent safe shutdown.

pre-fire plans: Documentation that describes the facility layout, access, contents, construction, hazards, hazardous materials, types and locations of fire protection systems, and other information important to the formulation and planning of emergency fire response.

raceway: An enclosed channel of metal or nonmetallic materials designed expressly for holding wires, cables, or busbars, with additional functions as permitted by code. Raceways include, but are not limited to, rigid metal conduit, rigid nonmetallic conduit, intermediate metal conduit, liquid-tight flexible conduit, flexible metallic tubing, flexible metal conduit, electrical nonmetallic tubing, electrical metallic tubing, underfloor raceways, cellular concrete floor raceways, cellular metal floor raceways, surface raceways, wireways, and busways.

radiant energy (heat) shield: A noncombustible or fire-resistive barrier installed to provide separation protection of redundant cables, equipment, and associated nonsafety circuits within containment.

redundant train or system: One of two or more similar trains of equivalent capacity in the same system powered by separate electrical divisions or one of two or more separate systems that each perform the same post-fire safe-shutdown function as its design function. With respect to fire protection DG-1359, Page 110

regulatory requirements and guidance, a redundant train or system is distinct from an alternative or dedicated shutdown train or system (see also success path).

repair: An action that may be credited with achieving and maintaining cold shutdown, including the replacement of fuses and cabling. Selected equipment replacement is also allowed if practicable.

Repairs not permitted include the use of clip leads in control panels (i.e., hard-wired terminal lugs should be used) and the use of jumper cables other than those fastened with terminal lugs. Repairs should be of sufficient quality to ensure safe operation until the normal equipment is restored to an operating condition.

restricted area: Any area to which the licensee controls access for purposes of protecting individuals from exposure to radiation and radioactive materials.

safe shutdown: For fire events, those plant conditions specified in the plant technical specifications as hot standby, hot shutdown, or cold shutdown.

safe-shutdown analysis: A process or method of identifying and evaluating the capability of SSCs necessary to accomplish and maintain safe-shutdown conditions in the event of a fire.

safe-shutdown system or safe-shutdown equipment: Systems and equipment that perform functions needed to achieve and maintain safe shutdown (regardless of whether the system or equipment is part of the success path for safe shutdown).

safety-related systems and components: Systems and components required to mitigate the consequences of postulated design-basis accidents.

secondary containment: The combination of physical boundaries and ventilation systems designed to limit the release of radioactive material.

short circuit: An abnormal connection (including an arc) of relatively low impedance, whether made accidentally or intentionally, between two points of different potential.

short-to-ground: A short circuit between a conductor and a grounded reference point (e.g., grounded conductor, conduit or other raceway, metal enclosure, shield wrap, or drain wire within a cable).

spurious actuation: The undesired operation of equipment, considering all possible functional states, resulting from a fire that could affect the capability to achieve and maintain safe shutdown.

standards (code) of record: The specific editions of the nationally recognized codes and standards accepted by the NRC that constitute the licensing and design basis for the plant.

success path: The minimum set of structures, systems (including power, instrument, and control circuits and instrument-sensing lines), and components that must remain free of fire damage to achieve and maintain safe shutdown in the event of a fire. Success path is synonymous with the safe-shutdown train free of fire damage and includes electrical circuits where fire-induced failure could prevent operation or cause maloperation of redundant trains necessary to achieve and maintain hot-shutdown conditions. In the context of Section III.G of Appendix R to DG-1359, Page 111

10 CFR Part 50, redundant train (Section III.G.2) and alternative or dedicated systems (Section III.G.3) are both success paths, and this definition applies to both.

SSCs important to safe shutdown: Nuclear power plant SSCs that, if damaged by fire, could prevent safe shutdown.

temporary structures: Buildings, tents, shelters, platforms, trailers, or other structures that are erected to support plant operations and maintenance but are not permanent site facilities.

turnout gear: Personnel protective clothing for firefighting, such as coats, pants, boots, helmets, gloves, and self-contained breathing apparatuses.

transient combustibles: Combustible materials that are not fixed in place or not an integral part of an operating system or component.

DG-1359, Page 112

REFERENCES2

1. U.S. Code of Federal Regulations (CFR), Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

2. CFR, 10 CFR Part 50, Appendix R, Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979.

3. CFR, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Subpart A, Early Site Permits; Subpart B, Standard Design Certifications; and Subpart C, Combined Licenses for Nuclear Power Plants, Chapter 1, Title 10, Energy.

4. National Fire Protection Association (NFPA), NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, Quincy, MA, 2001.3

5. NRC, Regulatory Guide (RG) 1.205 Risk-Informed, Performance-Based Fire Protection for Existing Light Water Nuclear Power Plants, Washington, DC.

6. CFR, 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants.

7. U.S. Nuclear Regulatory Commission (NRC), BTP APCSB 9.5-1, Appendix A, Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976, Washington, DC, February 24, 1977. (ADAMS Accession No. ML070660458)

8. NRC, Generic Letter (GL) 77-02, Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance, Washington, DC, August 29, 1977. (ADAMS Accession No. ML010850152)

9. NRC, GL 81-12, Fire Protection Rule (45 FR 76602, November 19, 1980), Washington, DC, February 20, 1981, and Clarification Letter, March 1982.

10. NRC, GL 83-33, NRC Positions on Certain Requirements of Appendix R to 10 CFR 50, Washington, DC, October 19, 1983.

11. NRC, NUREG-0800, Chapter 9, Standard Review Plan (SRP) Section 9.5.1.1, Fire Protection Program, Washington, DC.

2 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.

3 The National Fire Protection Association (NFPA) makes important safety codes and standards available for free online, and documents are available at http://www.nfpa.org/codes-and-standards/document-information-pages. They may also be purchased by calling NFPA Customer Sales (800) 344-3555 or writing NFPA, 1 Batterymarch Park, Quincy, MA 02169 7471.

DG-1359, Page 113

12. NRC, NUREG-0800, Chapter 9, SRP Section 9.5.1.2, Risk-Informed (RI), Performance-Based (PB) Fire Protection Program (FPP), Washington, DC.

13. NRC, GL 86-10, Implementation of Fire Protection Requirements, April 24, 1986, and Supplement 1, Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe-Shutdown Trains Within the Same Fire Area, Washington, DC, March 25, 1994.

14. NRC, GL 88-12, Removal of Fire Protection Requirements from Technical Specifications, Washington, DC, August 2, 1988.

15. NRC, Information Notice 99-17, Problems Associated with Post-Fire Safe-Shutdown Circuit Analyses, Washington, DC, June 3, 1999.

16. NRC, NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire, Washington, DC, October 2007. (ADAMS Accession No. ML073020676)

17. NRC, NUREG/CR-7135, BNL-NUREG-104309-2014, Compensatory and Alternative Regulatory Measures for Nuclear Power Plant Fire Protection (CARMEN-FIRE), Washington, DC, August 2015. (ADAMS Accession No. ML15226A446)

18. NRC, RG 1.191, Fire Protection Program for Nuclear Power Plants During Decommissioning and Permanent Shutdown, Washington, DC.

19. NRC, RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant-Specific Changes to the Licensing Basis, Washington, DC.

20. NRC, RG 1.188, Standard Format and Content for Applications to Renew Nuclear Power Plant Operating Licenses, Washington, DC.

21. CFR, Requirements for Renewal of Operating Licenses for Nuclear Power Plants, Part 54, Chapter I, Title 10, Energy.

22. NRC, Regulatory Issue Summary (RIS) 2005-07, Compensatory Measures to Satisfy the Fire Protection Program Requirements, Washington, DC, April 19, 2005.

23. NRC, RIS 2005-30, Clarification of Post-Fire Safe-Shutdown Circuit Regulatory Requirements, Washington, DC, December 20, 2005.

24. NRC, RIS 2006-10, Regulatory Expectations with Appendix R Paragraph III.G.2 Operator Manual Actions, Washington, DC, June 30, 2006.

25. NRC, EGM 98-002, Enforcement Guidance MemorandumDisposition of Violations of Appendix R, Sections III.G and III.L Regarding Circuit Failures, Revision 2, Washington, DC, February 2, 2000. (ADAMS Accession No. ML003710123)

26. NRC, RS-001, Review Standard for Extended Power Uprates, December 2003. (ADAMS Accession No. ML033640024)

DG-1359, Page 114

27. Nuclear Energy Institute (NEI), NEI 00-01, Guidance for Post-Fire Safe-Shutdown Circuit Analysis, Revision 4, Washington, DC, September 2016. (ADAMS Accession No. ML16312A019).4

28. NRC, NUREG/CR-7150, BNL NUREG 98204-2012, EPRI 1026424, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE), Vol. 1, Phenomena Identification and Ranking Table (PIRT) Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure, Washington, DC, October 2012. (ADAMS Accession No. ML12313A105)

29. NRC, NUREG/CR-7150, BNL NUREG 98204 2012, EPRI 3002001989, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE), Vol. 2, Expert Elicitation Exercise for Nuclear Power Plant Fire Induced Electrical Circuit Failure, Washington, DC, May 2014. (ADAMS Accession No. ML14141A129)

30. NRC, NUREG/CR-7150, BNL-NUREG-98204-2012, EPRI 3002009214, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE), Vol. 3, Technical Resolution to Open Issues on Nuclear Power Plant Fire Induced Circuit Failure, Washington, DC, November 2017. (ADAMS Accession No. ML17331B098)

31. NRC, RG 1.189, Fire Protection for Nuclear Power Plants, Revision 3, Washington, DC, February 2018. (ADAMS Accession No. ML17340A875)

32. NRC, SECY-90-016, Evolutionary Light-Water Reactor (LWR) Certification Issues and Their Relationship to Current Regulatory Requirements, Washington, DC, January 12, 1990.

33. NRC, SECY-93-087, Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light Water Reactor (ALWR) Designs, Washington, DC, April 2, 1993.

34. NRC, SECY 94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non Safety Systems in Passive Plant Designs, Washington, DC, March 28, 1994.

35. NRC, Staff Requirements Memorandum (SRM)-SECY 90-016, Washington, DC, June 26, 1990.

(ADAMS Accession No. ML003707885)

36. NRC, SRM-SECY 93-087, Washington, DC, July 21, 1993. (ADAMS Accession No. ML003708056)

37. NRC, SRM-SECY 94-084, Washington, DC, June 30, 1994. (ADAMS Accession No. ML003708098) 4 Publications from the Nuclear Energy Institute (NEI) are available at their Web site: http://www.nei.org or by contacting the headquarters at Nuclear Energy Institute, 1201 F St., NW, Suite 1100, Washington DC 20004-1218, Phone: 202-739-8000, Fax 202-785-4019.

DG-1359, Page 115

38. NRC, Nuclear Regulatory Commission International Policy Statement, Federal Register, Vol.

79, No. 132, July 10, 2014, pp. 39415-39418.

39. NRC, Management Directive (MD) 6.6, Regulatory Guides, Washington, DC, May 2, 2016 (ADAMS Accession No. ML18073A170).

40. CFR, Standards for Protection Against Radiation, Part 20, Chapter I, Title 10, Energy.

41. NFPA, NFPA 251, Standard Methods of Tests of Fire Resistance of Building Construction and Materials, Quincy, MA.

42. NFPA, NFPA 600, Standard on Industrial Fire Brigades, Quincy, MA.

43. NFPA, NFPA 1410, Standard on Training for Initial Emergency Scene Operations, Quincy, MA.

44. NFPA, NFPA 1500, Standard on Fire Department Occupational Safety and Health Program, Quincy, MA.

45. NRC, BTP CMEB 9.5-l, Guidelines for Fire Protection for Nuclear Power Plants, Revision 2, Washington, DC, July 1981. (ADAMS Accession No. ML070660454)

46. American Society of Mechanical Engineers (ASME), ASME NQA-1, Quality Assurance Program Requirements for Nuclear Facilities, New York, NY.5

47. American Nuclear Society (ANS), American National Standards Institute (ANSI)/ANS 3.2 2006 (formerly ANSI N18.7), Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants, La Grange Park, IL.

48. NEI, NEI 02-03, Guidance for Performing a Regulatory Review of Proposed Changes to the Approved Fire Protection Program, Revision 0, Washington, DC, June 2003.

49. NRC, NUREG-1022, Event Report Guidelines 10 CFR 50.72 and 50.73, Revision 3, January 2013. (ADAMS Accession No. ML13032A220)

50. NRC, 10 CFR 1.43, Office of Nuclear Reactor Regulation, Washington, DC.

51. NRC, NUREG-1934, Electric Power Research Institute (EPRI) 1023259, Nuclear Power Plant Fire Modeling Analysis Guidelines (NPP FIRE MAG)Final Report, Washington, DC, November 2012. (ADAMS Accession No. ML12314A165) 5 Copies of American Nuclear Society (ANS) standards may be purchased from the ANS Web site (http://www.new.ans.org/store/), or by writing to: American Nuclear Society, 555 North Kensington Avenue, La Grange Park, IL 60526; telephone (800) 323-3044.

DG-1359, Page 116

52. NRC, NUREG-1824, Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications, Washington, DC, May 2007. (ADAMS Accession Nos. ML071650546, ML071730305, ML071730493, ML071730499, ML071730527, ML071730504, ML071730543)

53. NRC, NUREG 1805, Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program, Washington, DC, December 2004. (ADAMS Accession No. ML043290075)

54. NRC, NUREG-1824, Supplement 1, Verification and Validation of Selected Fire Models for Nuclear Power Plant Applications, Washington, DC, November 2016. (ADAMS Accession Nos.

ML16309A011, ML16132A545, ML16132A547, ML16132A549, ML16132A560)

55. NFPA, NFPA 1, Fire Code, Quincy, MA.

56. NFPA, NFPA 703, Standard for Fire-Retardant Treated Wood and Fire-Retardant Coatings for Building Materials, Quincy, MA.

57. NFPA, NFPA 701, Standard Methods of Fire Tests for Flame Propagation of Textiles and Films, Quincy, MA.

58. NFPA, NFPA 30, Flammable and Combustible Liquids Code, Quincy, MA.

59. NFPA, NFPA 80A, Recommended Practice for Protection of Buildings from Exterior Fire Exposures, Quincy, MA.

60. NFPA, NFPA 55, Compressed Gases and Cryogenic Fluids Code, Quincy, MA.

61. NFPA, NFPA 58, Liquefied Petroleum Gas Code, Quincy, MA.

62. NFPA, NFPA 1144, Standard for Reducing Structure Ignition Hazards from Wildland Fire, Quincy, MA.

63. NFPA, NFPA 51B, Standard for Fire Prevention During Welding, Cutting and Other Hot Work, Quincy, MA.

64. Institute of Electrical and Electronics Engineers (IEEE), IEEE 835, Standard Power Cable Ampacity Tables, Piscataway, NJ. 6

65. IEEE, ANSI/IEEE C.2, National Electrical Safety Code, Piscataway, NJ.

66. NRC, RG 1.39, Housekeeping Requirements for Water-Cooled Nuclear Power Plants, Washington, DC.

6 Publications by the Institute of Electrical and Electronics Engineers (IEEE) may be purchased from the IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854 (800-678-4333).

DG-1359, Page 117

67. NFPA, NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems, Quincy, MA.

68. NFPA, NFPA 72, National Fire Alarm Code, Quincy, MA.

69. NFPA, NFPA 70, National Electrical Code, Quincy, MA.

70. NRC, RG 1.6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems, Washington, DC.

71. NRC, RG 1.32, Criteria for Power Systems for Nuclear Power Plants, Washington, DC.

72. NRC, RG 1.75, Physical Independence of Electric Systems, Washington, DC.

73. NFPA, NFPA 22, Standard for Water Tanks for Private Fire Protection, Quincy, MA.

74. NFPA, NFPA 24, Standard for the Installation of Private Fire Service Mains and Their Appurtenances, Quincy, MA.

75. NFPA, NFPA 13, Standard for the Installation of Sprinkler Systems, Quincy, MA.

76. NFPA, NFPA 15, Standard for Water Spray Fixed Systems for Fire Protection, Quincy, MA.

77. ASME, ASME Standard B31.1, Power Piping, New York, NY.

78. NFPA, NFPA 20, Standard for the Installation of Stationary Pumps for Fire Protection, Quincy, MA.

79. NFPA, NFPA 750, Standard on Water Mist Fire Protection Systems, Quincy, MA.

80. NFPA, NFPA 16, Standard for the Installation of Foam-Water Sprinkler and Foam-Water Spray Systems, Quincy, MA.

81. NFPA, NFPA 11, Standard for Low-, Medium-, and High-Expansion Foam, Quincy, MA.

82. NFPA, NFPA 12, Standard on Carbon Dioxide Extinguishing Systems, Quincy, MA.

83. NFPA, NFPA 12A, Standard on Halon 1301 Fire Extinguishing Systems, Quincy, MA.

84. NFPA, NFPA 2001, Standard for Clean Agent Fire Extinguishing Systems, Quincy, MA.

85. NFPA, NFPA 14, Standard for the Installation of Standpipe and Hose Systems, Quincy, MA.

86. NFPA, Fire Protection Handbook, Volume II, Section 10, Chapter 1, 19th Edition, Quincy, MA, 2003.

87. NFPA, NFPA 1961, Standard on Fire Hose, Quincy, MA.

DG-1359, Page 118

88. NFPA, NFPA 1962, Standard for the Care, Use, Inspection, Service Testing, and Replacement of Fire Hose, Couplings, Nozzles, and Fire Hose Appliances, Quincy, MA.

89. NFPA, NFPA 10, Standard for Portable Fire Extinguishers, Quincy, MA.

90. NFPA, NFPA 1404, Standard for Fire Service Respiratory Protection Training, Quincy, MA.

91. NFPA, NFPA 1620, Standard for Pre-Incident Planning, Quincy, MA.

92. Underwriters Laboratories, Inc. (UL), UL Building Materials Directory, Northbrook, IL. 7

93. Factory Mutual Research Corp., Factory Mutual Research Approval GuideEquipment, Materials, and Services for Conservation of Property, Johnston, RI, September 2000. 8

94. ASTM International (ASTM), ASTM E84, Standard Test Method for Surface Burning Characteristics of Building Materials, West Conshohocken, PA. 9

95. ASTM, ASTM D3286, Standard Test Method for Gross Calorific Value of Coal and Coke by the Isoperibol Bomb Calorimeter, West Conshohocken, PA.

96. NFPA, NFPA 259, Standard Test Method for Potential Heat of Building Materials, Quincy, MA.

97. NFPA, NFPA 220, Standard on Types of Building Construction, Quincy, MA.

98. NFPA, NFPA 253, Standard Method of Test for Critical Radiant Flux of Floor Covering Systems Using a Radiant Heat Energy Source, Quincy, MA.

99. IEEE, IEEE 383, IEEE Standard for Type Test of Class IE Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations, Piscataway, NJ.

100. IEEE, IEEE 1202, IEEE Standard for Flame Testing of Cables for Use in Cable Trays in Industrial and Commercial Occupancies, Piscataway, NJ.

101. NRC, RG 1.101, Emergency Planning and Preparedness for Nuclear Power Reactors, Washington, DC.

7 Underwriters Laboratories, Inc. (UL) documents may be purchased from Underwriters Laboratories, which is located at 320 37th Avenue, St. Charles, IL 60174.

8 Copies are available from Factory Mutual Research Corporation, 1301 Atwood Avenue, P.O. Box 7500, Johnston, Rhode Island 02919; telephone (401) 275-3000 and fax (401) 275-3029. Purchase information is available through the Web based FM Global Resource Catalog at https://www.fmglobalcatalog.com/ProductInfo.aspx?productid=P7825CD.

9 Copies of ASTM International (ASTM) standards may be purchased from ASTM, 100 Barr Harbor Drive, P.O. Box C700, West Conshohocken, PA 19428-2959; telephone (610) 832-9585. Purchase information is available through the ASTM Web site at http://www.astm.org.

DG-1359, Page 119

102. NRC, RG 1.52, Design, Inspection, and Testing Criteria for Air Filtration and Adsorption Units of Post Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light Water Cooled Nuclear Power Plants, Washington, DC.

103. NFPA, NFPA 204, Standard for Smoke and Heat Venting, Quincy, MA.

104. NFPA, NFPA 90A, Standard for the Installation of Air-Conditioning and Ventilating Systems, Quincy, MA.

105. NFPA, NFPA 54, National Fuel Gas Code, Quincy, MA.

106. NRC, RG 1.143 Design Guidance for Radioactive Waste Management Systems, Structures, and Components Installed in Light-Water-Cooled Nuclear Power Plants, Washington, DC.

107. NRC, RG 1.91 Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants, Washington, DC.

108. NFPA, NFPA 221, Standard for High-Challenge Fire Walls, Fire Walls, and Fire Barrier Walls, Quincy, MA.

109. NFPA, NFPA 80, Standard for Fire Doors and Other Opening Protectives, Quincy, MA.

110. UL, UL 555, Fire Dampers, Northbrook, IL.

111. ASTM, ASTM E119, Standard Test Methods for Fire Tests of Building Construction and Materials, West Conshohocken, PA.

112. ASTM, ASTM E814, Standard Test Method for Fire Tests of Penetration Firestop Systems, West Conshohocken, PA.

113. IEEE, IEEE 634, IEEE Standard Cable Penetration Fire Stop Qualification Test, Piscataway, NJ. (Withdrawn April 1990) 114. NFPA, Fire Protection Handbook, Quincy, MA, 2008.

115. IEEE, IEEE 242, IEEE Recommended Practices for Protection and Coordination of Industrial and Commercial Power Systems, Piscataway, NJ.

116. ASTM, ASTM D2859, Standard Test Method for Ignition Characteristics of Finished Textile Floor Covering Materials, West Conshohocken, PA.

117. NFPA, NFPA 75, Standard for the Protection of Information Technology Equipment, Quincy, MA.

118. CFR, Licensing Requirements for the Independent Storage of Spent Nuclear Fuel, High Level Radioactive Waste, and Reactor-Related Greater Than Class C Waste, Part 72, Chapter 1, Title 10, Energy.

DG-1359, Page 120

119. Electric Power Research Institute (EPRI), EPRI NP-5283-SR-A, Guidelines for Permanent BWR Hydrogen Water Chemistry Installations, Palo Alto, CA, 1987.10 120. NRC, RG 1.206, Applications for Nuclear Power Plants, Washington, DC.

121. NFPA, NFPA 804, Standard for Fire Protection for Advanced Light Water Reactor Electric Generating Plants, Quincy, MA.

122. NRC, SECY-05-0197, Review of Operational Programs in a Combined License Application and Generic Emergency Planning Inspections, Tests, Analyses, and Acceptance Criteria, Washington, DC, October 28, 2005.

123. NRC, Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests, Washington, DC, September 20, 2019. (ADAMS Accession No. ML18093B087) 10 Copies of Electric Power Research Institute (EPRI) standards and reports may be purchased from EPRI, 3420 Hillview Ave., Palo Alto, CA 94304; telephone (800) 313-3774; fax (925) 609-1310.

DG-1359, Page 121

APPENDIX A FIRE PROBABILISTIC RISK ASSESSMENTS In addition to existing plants that have not adopted a risk-informed, performance-based fire protection program (FPP) in accordance with Title 10 of the Code of Federal Regulations (10 CFR) section 50.48(c), licensees that have not adopted 10 CFR 50.48(c) and licensees preparing new reactor FPPs may apply risk-informed methodologies, including fire probabilistic risk assessment (PRA),

to the evaluation of an FPP change. However, the U.S. Nuclear Regulatory Commission (NRC) should review and approve the proposed methodologies, including the acceptance criteria, before implementation of the plant change.

According to 10 CFR 52.47(a)(v), new reactor applications submitted under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants, must include a design-specific PRA.

A detailed fire PRA is not necessarily required for a new reactor FPP. However, if an applicant for a combined license (COL) references a certified design and if that certified design developed a fire PRA, then the COL applicant should use that PRA and update it to reflect site- and plant-specific information that may not have been available at the design stage. In addition, a licensee that has a risk-informed, performance-based FPP (similar to a National Fire Protection Association (NFPA) 805 program) or that plans to evaluate plant changes using a risk-informed approach must have a detailed fire PRA.

The term fire PRA encompasses all levels and types of PRAs, ranging from a simplified bounding analysis to a detailed analysis in accordance with NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, issued September 2005 (Ref. A-1). NUREG/CR-6850 and NUREG/CR-6850, Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements, issued September 2010, should be the basis for the review of the proposed methodologies. Chapter 19, Severe Accidents, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), contains additional guidance on the review of nuclear power plant PRAs. The American Nuclear Society has developed a standard for fire PRA (ANSI/ANS-58.23-2007, Fire PRA Methodology) (Ref. A-2).

A fire PRA should receive a peer review to the extent that adequate industry guidance is available. The NRC should review and accept the industry guidance before its application to specific fire PRAs. The NRC should also review the results of the plant-specific peer reviews. All types and levels of fire PRAs should be subject to a peer review. If adequate industry guidance is not available for conducting a fire PRA peer review, the NRC should review the fire PRA for acceptability.

Licensees may use PRA, risk insights gained from other methods, or both in support of proposed changes to the plant licensing basis, such as license amendment requests per 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, and 10 CFR 50.92, Issuance of amendment, or for exemption requests per 10 CFR 50.12, Specific exemptions. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, provides guidelines for the use of PRA in support of plant changes that require NRC approval but does not apply to plant changes that are not subject to NRC approval.

DG-1359, Appendix A, Page A-1

REFERENCES FOR APPENDIX A11 A-1. NRC, NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Washington, DC, September 2005. (ADAMS Accession Nos. ML052580075 and ML052580118)

A-2. ANS, ANSI/ANS-58.23-2007, Fire PRA Methodology, Washington, DC.12 11 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e mail pdr.resource@nrc.gov.

12 Copies of American Nuclear Society (ANS) standards may be purchased from the ANS Web site (http://www.new.ans.org/store/), or by writing to: American Nuclear Society, 555 North Kensington Avenue, La Grange Park, IL 60526; telephone (800) 323-3044.

DG-1359, Appendix A, Page A-2

APPENDIX B TESTING AND QUALIFICATION OF ELECTRICAL RACEWAY FIRE BARRIER SYSTEMS B-1. Fire Endurance Test Acceptance Criteria for Electrical Raceway and Component Fire Barrier Systems for Separating Safe-Shutdown Functions within the Same Fire Area The fire endurance qualification test for fire barrier materials applied directly to a raceway or component is considered to be successful if all three of the following conditions are met:

a. The average unexposed side temperature of the fire barrier system, as measured on the exterior surface of the raceway or component, does not exceed 139 degrees Celsius (C)

(250 degrees Fahrenheit (F)) above its initial temperature.

National Fire Protection Association (NFPA) 251, Standard Methods of Test of Fire Endurance of Building Construction and Materials, (Ref. B-1) and American Society for Testing and Materials (ASTM) E119, Standard Test Methods for Fire Tests of Building Construction and Materials, allow this temperature to be determined by averaging thermocouple temperature readings. For the purposes of this criterion, the licensee may use thermocouple averaging if similar series of thermocouples (e.g., cable tray side rail) are averaged together to determine temperature performance of the raceway fire barrier system. In addition, conditions of acceptance are placed on the temperatures measured by a single thermocouple. If any single thermocouple exceeds 30 percent of the maximum allowable temperature rise (i.e., 139 ºC + 42 ºC = 181 ºC (250 ºF + 75 ºF = 325 ºF), the test exceeds the temperature criteria limit.

b. Irrespective of the unexposed side temperature rise during the fire test, if the fire barrier test specimen includes cables or components, a visual inspection is performed. When the temperature criteria are exceeded or damage occurs, component operability or functionality at the temperatures experienced during the fire test should be assessed. Fire endurance tests that are judged acceptable on the basis of a visual inspection of specific components or cables included in the test specimen may not be applied to other components or cables without a specific evaluation.

Cables should not show signs of degraded conditions resulting from the thermal effects of the fire exposure. Examples of thermal cable degradation are jacket swelling, splitting, cracking, blistering, melting, or discoloration; shield exposed; conductor insulation exposed, degraded, or discolored; and bare copper conductor exposed.

When signs of thermal degradation are present, the fire barrier did not perform its intended fire-resistive function. For barriers that are not capable of performing their intended function, an engineering analysis should be performed to demonstrate that the functionality of thermally degraded cables or components was maintained and that the cables or components would have adequately performed their intended functions during and after a postulated fire exposure. A methodology for demonstrating the functionality of cables during and after a fire test exposure is provided below. The purpose of the functionality tests is to justify observed deviations in fire barrier performance. For fire barrier specimens that are tested without cables, an engineering analysis justifying internal fire barrier temperature conditions greater than allowed can be based on a comparison of the fire barrier internal temperature profile measured during the fire endurance test to existing cable-specific performance data, such as environmental qualification (EQ) tests.

DG-1359, Appendix B, Page B-1

c. The cable tray, raceway, or component fire barrier system remains intact during the fire exposure and water hose stream test without developing any openings through which the cable tray, raceway, or component (e.g., cables) is visible.

The test specimen should represent the construction for which the fire rating is desired in terms of materials, workmanship, and details, such as dimensions of parts, and should be built under representative conditions. Raceway fire barrier systems being subjected to qualification fire endurance tests should represent their end use. For example, if the licensee intends to install a cable tray fire barrier system in the plant without protecting the cable tray supports, the test program should duplicate these field conditions.

In addition, the fire test program should encompass or bound raceway sizes and the various configurations for those fire barrier systems installed in the plant. Several test specimens will be required to qualify various sizes of horizontal and vertical runs of cable trays and conduits, junction boxes and pull boxes, and similar configurations. The cable tray or raceway design used for the tests should be constructed with materials and configurations representative of in-plant conditions (e.g., the mass associated with typical steel conduits and cable trays, representative internal and external penetration seals). If the raceway fire barrier test specimen includes cables, these cables should represent the installed plant-specific cables.

Measuring cable temperatures is not a reliable means of determining excessive temperature conditions that may occur at any point along the length of the cable during the fire test. In lieu of measuring the unexposed surface temperature of the fire barrier test specimen, methods that will measure the surface temperature of the raceway (e.g., exterior of the conduit, side rails of cable trays, bottom and top of cable tray surfaces, junction box external surfaces) can be considered equivalent if the raceway components used to construct the fire test specimen represent plant-specific components and configurations. The metal surfaces of the raceway, under fire test conditions, exhibit good thermal conductivity properties. Temperatures measured on these surfaces indicate the actual temperature rise within the fire barrier system.

In 1979, American Nuclear Insurers (ANI) issued a fire endurance test method for raceway fire barrier systems for insurance purposes (Ref. B-2). This method specifies that cable temperatures be monitored by thermocouples. Since cable jackets have a low thermal conductivity, the actual local temperatures of the cable jackets indications of barrier failure and internal fire barrier temperature rise conditions during the fire exposure are masked. Monitoring cable temperatures can give indications of low internal fire barrier temperature conditions during the fire endurance test. Using this temperature monitoring approach, cable damage can occur without indication of excessive temperatures on the cables.

This, linked with no loss of circuit integrity, indicates a successful test. The staff considers monitoring the cable temperature as the primary means of determining cable tray or raceway fire barrier performance to be nonconservative. Therefore, the staff has incorporated the provision for a post-fire visual inspection of cables that are installed in fire barrier test specimens. As discussed above, temperatures monitored on the exterior surface of the raceway provide a more representative indication of fire barrier performance.

Fire endurance tests of raceway fire barrier systems may be performed with or without cables in the raceway. Excluding cables from the test specimen eliminates bias in the test results created by the thermal mass of the cables and is the method preferred by the U.S. Nuclear Regulatory Commission (NRC). Without the thermal mass of the cables, the internal temperature conditions measured by the test specimen thermocouples during the fire exposure will provide a more accurate determination of fire barrier thermal performance. The following sections provide guidance for both approaches.

B-1.1 Thermocouple PlacementTest Specimens Containing Cables The following are acceptable placements of thermocouples for determining the thermal performance of raceway or cable tray fire barrier systems that contain cables during fire exposure:

DG-1359, Appendix B, Page B-2

a. Conduits: The temperature rise on the unexposed surface of a fire barrier system installed on a conduit should be measured by placing the thermocouples every 152 millimeters (mm)

(6 inches (in.)) on the exterior conduit surface under the fire barrier material. For the thermocouples installed on conduits, cable tray side rails, and bare copper conductors, a +13-mm

(+0.5-in.) installation tolerance is acceptable. The thermocouples should be attached to the exterior conduit surface located opposite the test deck and closest to the furnace fire source.

Thermocouples should also be placed immediately adjacent to all structural members, supports, and barrier penetrations.

b. Cable trays: The temperature rise on the unexposed surface of a fire barrier system installed on a cable tray should be measured by placing the thermocouples on the exterior surface of the tray side rails between the cable tray side rail and the fire barrier material. In addition to placing thermocouples on the side rails, thermocouples should be attached to two American wire gauge (AWG) 8 stranded bare copper conductors. The first copper conductor should be installed on the bottom of the cable tray rungs along the entire length and down the longitudinal center of the cable tray run. The second conductor should be installed along the outer top surface of the cables closest to the top and toward the center of the fire barrier. Thermocouples should be placed every 152 mm (6 in.) down the longitudinal center along the outside surface of the cable tray side rails and along the bare copper conductors. Thermocouples should also be placed immediately adjacent to all structural members, supports, and barrier penetrations.

c. Junction boxes: The temperature rise on the unexposed surface of a fire barrier system installed on junction boxes should be measured by placing thermocouples on either the inside or the outside of each junction box surface. Each junction box surface or face should have a minimum of one thermocouple, located at its geometric center. In addition, one thermocouple should be installed for every 0.09 square meter (m2) (1 square foot (ft2)) of junction box surface area. These thermocouples should be located at the geometric centers of the 0.09-m2 (1-ft2) areas. At least one thermocouple should also be placed within 25 mm (1 in.) of each penetration connector/interface.

d. Airdrops: The internal airdrop temperatures should be measured by thermocouples placed every 305 mm (12 in.) on the cables routed within the airdrop and by a stranded AWG 8 bare copper conductor routed inside and along the entire length of the airdrop system with thermocouples installed every 152 mm (6 in.) along the length of the copper conductor. The copper conductor should be in proximity to the unexposed surface of the fire barrier material. Thermocouples should also be placed immediately adjacent to all supports and barrier penetrations.

B-1.2 Thermocouple PlacementTest Specimens without Cables The following are acceptable thermocouple placements for determining the thermal performance of raceway or cable tray fire barrier systems that do not contain cables:

a. Conduits: The temperature rise of the unexposed surface of a fire barrier system installed on a conduit should be measured by placing thermocouples every 152 mm (6 in.) on the exterior conduit surface between the conduit and the unexposed surface of the fire barrier material. These thermocouples should be attached to the exterior conduit surface opposite the test deck and closest to the furnace fire source. The internal raceway temperatures should be measured by a stranded AWG 8 bare copper conductor routed through the entire length of the conduit system with thermocouples installed every 152 mm (6 in.) along the length of the copper conductor.

Thermocouples should also be placed immediately adjacent to all structural members, supports, and barrier penetrations.

DG-1359, Appendix B, Page B-3

b. Cable trays: The temperature rise on the unexposed surface of a fire barrier system installed on a cable tray should be measured by placing thermocouples every 152 mm (6 in.) on the exterior surface of each trays side rails between the side rail and the fire barrier material. Internal raceway temperatures should be measured by a stranded AWG 8 bare copper conductor routed on the top of the cable tray rungs along the entire length and down the longitudinal center of the cable tray run with thermocouples installed every 152 mm (6 in.) along the length of the copper conductor. Thermocouples should be placed immediately adjacent to all structural members, supports, and barrier penetrations.

c. Junction boxes: The temperature rise on the unexposed surface of a fire barrier system installed on junction boxes should be measured by placing thermocouples on either the inside or the outside of each junction box surface. Each junction box surface or face should have a minimum of one thermocouple, located at its geometric center. In addition, one thermocouple should be installed for every 0.09 m2 (1 ft2) of junction box surface area. These thermocouples should be located at the geometric centers of the 0.09-m2 (1-ft2) areas. At least one thermocouple should also be placed within 25 mm (1 in.) of each penetration connector/interface.

d. Airdrops: The internal airdrop temperatures should be measured by a stranded AWG 8 bare copper conductor routed inside and along the entire length of the airdrop system with thermocouples installed every 152 mm (6 in.) along the length of the copper conductor. The copper conductor should be in proximity to the unexposed surface of the fire barrier material.

Thermocouples should also be placed immediately adjacent to all supports and penetrations.

B-1.3 Criteria for Averaging Temperatures Temperature conditions on the unexposed surfaces of the fire barrier material during the fire test will be determined by averaging the temperatures measured by the thermocouples installed in or on the raceway. To determine these temperature conditions, the thermocouples measuring similar areas of the fire barrier should be averaged together. Acceptance will be based on the individual averages. The following methods of averaging should be followed:

a. Conduits: The thermocouples applied to the outside metal surface of the conduit should be averaged together.

b. Cable trays: The thermocouples on each cable tray side rail should be averaged separately. For example, thermocouples placed on one side rail will be averaged separately from the other side rail. In addition, the temperature conditions measured by thermocouples on the bare copper conductor should be averaged separately from the side rails.

c. Junction boxes: For junction boxes that have only one thermocouple on each junction box surface, the individual junction box surface thermocouples should be averaged together. For junction boxes that have more than one thermocouple on each junction box surface, the thermocouples on the individual junction box surfaces should be averaged together.

d. Airdrops: The thermocouples placed on the copper conductor within the airdrop fire barrier should be averaged together.

The average temperature of any thermocouple group should not exceed 139 degrees C (250 degrees F) above the unexposed side temperature within the fire barrier test specimen at the onset of the fire endurance test. In addition, the temperature of each individual thermocouple will be evaluated.

DG-1359, Appendix B, Page B-4

Individual thermocouple conditions should not exceed the temperature rise of 139 degrees C (250 degrees F) by more than 30 percent.

If a fire barrier test specimen without cables does not meet the average or maximum single point temperature criteria, the internal raceway temperature profile as measured by the instrumented bare copper conductors during the fire exposure can be used to assess cable functionality through air oven tests of plant-specific cable types and construction, as discussed below.

B-2. Hose Stream Tests NFPA 251 and ASTM E119 allow flexibility in hose stream testing. The standards allow the hose stream test to be performed on a duplicate test specimen subjected to a fire endurance test for a period equal to one-half of that indicated as the fire-resistance rating, but not for more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (e.g., 30-minute fire exposure to qualify a 1-hour fire-rated barrier).

For safe-shutdown-related fire barrier systems and duplicate electrical cable tray or raceway and component fire barrier test specimens that have been exposed to the test fire exposure of one-half duration, the staff finds the hose stream application specified by NFPA 251 to be acceptable. NFPA 251 requires the stream of water to be delivered through a 64-mm (2.5-in.) hose discharging through a standard 38-mm (1.5-in.) playpipe nozzle onto the test specimen after the fire exposure test. The stream is applied with the nozzle orifice positioned 6.1 meters (m) (20 feet (ft)) from the center of the test specimen at a pressure of 207 kilopascals (kPa) (30 pounds per square inch (psi)). The application of the stream is to all exposed parts of the specimen for a duration of at least 1 minute for a 1-hour barrier and 2.5 minutes for a 3-hour barrier.

As an alternative to electrical raceway fire barrier test specimens, the hose stream test can be performed immediately after the completion of the full fire endurance test period. If this method is used to satisfy the hose stream test criteria, any one of the following hose stream applications is acceptable:

a. The stream applied at random to all exposed surfaces of the test specimen through a 64-mm (2.5-in.) national standard playpipe with a 38-mm (1.5-in.) orifice at a pressure of 207 kPa (30 psi) at a distance of 6.1 m (20 ft) from the specimen (durations of the hose stream applications should be 1 minute for a 1-hour barrier and 2.5 minutes for a 3-hour barrier).

b. The stream applied at random to all exposed surfaces of the test specimen through a 38-mm (1.5-in.) fog nozzle set at a discharge angle of 30 degrees with a nozzle pressure of 517 kPa (75 psi) and a minimum discharge of 284 liters per minute (L/min) (75 gallons per minute (gal/min)) with the tip of the nozzle at a maximum of 1.5 m (5 ft) from the test specimen (duration of the hose stream application should be 5 minutes for both 1-hour and 3-hour barriers).

c. The stream applied at random to all exposed surfaces of the test specimen through a 38-mm (1.5-in.) fog nozzle set at a discharge angle of 15 degrees with a nozzle pressure of 517 kPa (75 psi) and a minimum discharge of 284 L/min (75 gal/min) with the tip of the nozzle at a maximum of 3 m (10 ft) from the test specimen (duration of the hose stream application should be 5 minutes for both 1-hour and 3-hour barriers).

B-3. Demonstrating Functionality of Cables Protected by Raceway Fire Barrier Systems during and after Fire Endurance Test Exposure During fire tests of raceway fire barrier systems, thermal damage to the cables has led to cable jacket and insulation degradation without the loss of circuit integrity as monitored using ANI criteria DG-1359, Appendix B, Page B-5

(applied voltage of 8-10 volts (V) direct current (DC)). Since cable voltages used for ANI circuit integrity tests do not replicate cable operating voltages, loss of cable insulation conditions can exist during the fire test without a dead short occurring. It is expected that if the cables were at rated power and current, a fault would propagate. The use of circuit integrity monitoring during the fire endurance test is not a valid method for demonstrating that the protected shutdown circuits are capable of performing their required function during and after the test fire exposure. Therefore, the NRC does not require circuit integrity monitoring using the ANI criteria to satisfy its acceptance criteria for fire barrier qualification. The approaches described below are acceptable for evaluating cable functionality.

B-3.1 Use of Environmental Qualification Data Comparison of the fire barrier internal time-temperature profile measured during the fire endurance test to existing cable performance data, such as data from EQ tests, may be used as a method for demonstrating cable functionality. EQ testing is typically performed to rigorous conditions, including rated voltage and current. When the EQ test time-temperature profile is correlated to the fire test time-temperature profile, the EQ test data provide a viable mechanism to ensure cable functionality. A large body of EQ test data for many cable types exists today. The use of EQ data represents a cost-effective approach for addressing cable functionality for fire tests for those cases in which the limit of 181 degrees C (325 degrees F) is exceeded. A comparison of fire test temperature profiles to existing EQ and loss-of-coolant accident test results or air oven test results is an acceptable approach to demonstrating cable functionality, provided that the subject analysis incorporates the anticipated temperature rise caused by the self-heating effects of installed power cables with the fire test results.

B-3.2 Cable Insulation Tests The nuclear industry uses two principal materialsthermoplastics and thermosetting polymeric materialsas cable insulation and cable jackets. A thermoplastic material can be softened and resoftened by heating and reheating. Conversely, thermosetting cable insulation materials cure by chemical reaction and do not soften when heated. Under excessive heating, thermosetting insulation becomes stiff and brittle. Electrical faults may be caused by softening and flowing of thermoplastic insulating materials at temperatures as low as 149 degrees C (300 degrees F). Thermosetting electrical conductor insulation materials usually retain their electrical properties under short-term exposures to temperatures as high as 260 degrees C (500 degrees F). Insulation resistance (Megger) tests indicate the condition of the cable insulation resistance, whereas the high-potential (Hi-Pot) test ensures that the cable has sufficient dielectric strength to withstand the applied rated voltage. A cable insulation failure usually results from two breakdown modes. One failure mode is excessive dielectric loss resulting from low insulation resistance, and the other failure mode is overpotential stress caused by loss of dielectric strength of the insulation material.

To provide reasonable assurance that the cables will function during and after fire exposure, Megger tests need to be performed before the fire test, at multiple time intervals during the fire exposure (i.e., every 20 minutes during the 1-hour fire test and every hour during the 3-hour fire test) for instrumentation cables only and immediately after the fire endurance test to assess the cable insulation resistance levels. This testing will ensure that the cables will maintain the insulation resistance levels necessary for proper operation of instruments.

The Megger tests (pre-fire, during the fire (if performed), and immediately after the fire test conditions) should be done conductor-to-conductor for multiconductor cables and conductor-to-ground for all cables. The minimum acceptable insulation resistance (IR) value, using the test voltage values as shown in Table B-1 (below), is determined by using the following expression:

DG-1359, Appendix B, Page B-6

IR (mega-ohms) = {[K+1 mega-ohm]

• 1000 (ft)}/length (ft) where K = 1 mega-ohm/kV

• operating voltage (expressed in kilovolts (kV))

In addition, to determine the IR levels required for nuclear instrumentation cables, the minimum IR value (e.g., 1 mega-ohm) and its potential impact on the functionality of these cables should be evaluated. An AC or DC Hi-Pot test for power cables greater than 1,000 V should also be performed after the post-fire Megger tests to assess the dielectric strength. This test provides assurance that the cable will withstand the applied voltage during and after a fire. The Hi-Pot test should be performed for a 5-minute duration at 60 percent of either 80 V/mil AC or 240 V/mil DC (e.g., 125-mil conductor insulation thickness x 240 V/mil DC x 0.6 = 18,000 V DC).

Table B-1 summarizes the Megger and Hi-Pot test voltages that, when applied to power, control, and instrumentation cables, would constitute an acceptable cable functionality test.

Table B-1. Functionality Test Voltages OPERATING MEGGER TEST HIGH-POTENTIAL TYPE VOLTAGE VOLTAGE TEST VOLTAGE Power >1,000 V AC 2,500 V DC 60% x 80 V/mil (AC) 60% x 240 V/mil (DC)

Power <1,000 V AC 1,500 V DC1 None Instrument and Control <250 V DC <120 V AC 500 V DC None The review guidance for Megger and Hi-Pot test voltages was derived from Institute of Electrical and Electronics Engineers (IEEE) 383, IEEE Standard for Type Test of Class IE Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations, and IEEE 690-1984, IEEE Standard for the Design and Installation of Cable Systems for Class 1E Circuits in Nuclear Power Generating Stations (Ref. B-3). The electrical cable functionality tests recommended above are one acceptable method to assess degradation of cable functionality. The NRC staff will evaluate alternative methods on a case-by-case basis. The above table summarizes the typical Megger and Hi-Pot test voltages, and the applicant can follow the applicable industry standards and manufacturers recommendations for the specific cable application in the performance of the IR and Hi-Pot tests.

B-3.3 Air Oven Tests Air oven tests can evaluate the functionality of cables for those cable tray or raceway fire barrier test specimens tested without cables. This testing method consists of exposing insulated wires and cables at rated voltage to elevated temperatures in a circulating air oven. The temperature profile for regulating the temperature in the air oven during this test is the temperature measured by the AWG 8 bare copper conductor during the fire exposure of cable tray or raceway test specimens tested without cables.

The test method described by Underwriters Laboratories, Inc. (UL) Subject 1724, Outline of Investigation for Fire Tests for Electrical Circuit Protective Systems (Ref. B-4), Appendix B, 1 A Megger test voltage of 1,000 V DC is acceptable provided that a Hi-Pot test is performed after the Megger test for power cables rated at less than 1,000 V AC.

DG-1359, Appendix B, Page B-7

Qualification Test for Circuit Integrity of Insulated Electrical Wires and Cables in Electrical Circuit Protection Systems, is acceptable, with the following modifications:

a. During the air oven test, the cables are to be energized at rated voltage. The cables are to be monitored for conductor-to-conductor faults in multiconductor cables and conductor-to-ground faults in all conductors.

b. The cables being evaluated should be subjected to the Megger and Hi-Pot tests, previously recommended in Section C-3.2 of this appendix.

c. The impact force test, which simulates the force of impact imposed on the raceway by the solid stream test, described in UL 1724, Appendix B, paragraph B3.16, does not need to be performed.

B-3.4 Cable Thermal Exposure Threshold The following analysis is an acceptable method for evaluating cable functionality. It is based on determining whether a specific insulation material will maintain electrical integrity and operability or functionality within a raceway fire barrier system during and after an external fire exposure. To determine cable functionality, it is necessary to consider the operating cable temperatures within the fire barrier system at the onset of the fire exposure and the thermal exposure threshold (TET) temperature of the cable. For example, if the TET of a specific thermoplastic cable insulation (Brand X) is 149 degrees C (300 degrees F) and the normal operating temperature within the fire barrier system is 66 degrees C (150 degrees F), the maximum temperature rise within the fire barrier system should not exceed 83 degrees C (181 degrees F) during exposure to an external fire of a duration equal to the required fire-resistance rating of the barrier. For this example, the TET limit for Brand X cable is 83 degrees C (181 degrees F) above the cable operating temperatures within the fire barrier system at the onset of the external fire exposure. The cable TET limits in conjunction with a posttest visual cable inspection and the Hi-Pot test described above should readily demonstrate the functionality of the cable circuit during and after a fire.

The normal cable operating temperature can be determined by loading cable specimens installed within a thermal barrier system in the test configuration with rated voltage and current. The TET temperature limits for most cable insulation may be obtained from the manufacturers published data, which are given as the short-circuit rating limit. With the known TET and normal operating temperature for each thermal barrier system configuration, the maximum temperature rise limit within a fire barrier system may then be determined.

DG-1359, Appendix B, Page B-8

REFERENCES FOR APPENDIX B B-1. National Fire Protection Association (NFPA), NFPA 251, Standard Methods of Tests of Fire Resistance of Building Construction and Materials, Quincy, MA.2 B-2. American Nuclear Insurers Information Bulletin 5 (79), ANI/MAERP Standard Fire Endurance Test Method to Qualify a Protective Envelope for Class 1E Electrical Circuits, July 1979.

B-3. IEEE, IEEE 690-1984, IEEE Standard for the Design and Installation of Cable Systems for Class 1E Circuits in Nuclear Power Generating Stations, Piscataway, NJ.3 B-4. Underwriters Laboratories Inc. (UL), UL Subject 1724, Appendix B, Qualification Test for Circuit Integrity of Insulated Electrical Wires and Cables in Electrical Circuit Protection Systems (Paragraph B3.16), to Outline of Investigation for Fire Tests for Electrical Circuit Protective Systems, Issue No. 2, August 1991.4 2 The National Fire Protection Association (NFPA) makes important safety codes and standards available for free online, and documents are available at http://www.nfpa.org/codes-and-standards/document-information-pages. They may also be purchased by calling NFPA Customer Sales (800) 344-3555 or writing NFPA, 1 Batterymarch Park, Quincy, MA 02169 7471.

3 Publications by the Institute of Electrical and Electronics Engineers (IEEE) may be purchased from the IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854 (800-678-4333).

4 Underwriters Laboratories Inc. (UL) documents may be purchased from Underwriters Laboratories, which is located at 320 37th Avenue, St. Charles, IL 60174.

DG-1359, Appendix B, Page B-9