1776 I Street, NW l Suite 400 l Washington, DC l 20006-3708 l P: 202.739.8080 l F: 202.533.0164 l am@nei.org l www.nei.org 

Alexander Marion 

VICE PRESIDENT

NUCLEAR OPERATIONS

NUCLEAR GENERATION DIVISION

June 5, 2009 

Mr. John A. Grobe 

Associate Director for Engineering and Safety Systems 

Office of Nuclear Reactor Regulations 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

Subject: NEI 00-01, Revision 2, “Guidance for Post-Fire Safe Shutdown Circuit Analysis”. 

Project Number: 689 

Dear Mr. Grobe: 

Enclosed is a copy of NEI 00-01, Revision 2, “Guidance for Post-Fire Safe Shutdown Circuit Analysis”, 

for NRC use and endorsement. The NEI Circuit Failure Issue Task Force (CFITF) has been working 

closely with your staff over the past several months to address remaining questions on the 

methodology that is outlined in the document. Thank you and your staff for the time and effort 

provided toward the development and finalization of the industry guidance document. 

We believe that the enclosed revision addresses the issues raised by your staff in public meetings 

and through written comments on the draft revision. Revision 2 also incorporates lessons learned 

from pilot application of the methodology. During a public meeting on May 20, 2009, we discussed 

possible resolution paths for two remaining comments. We believe the enclosed revision to 

NEI 00-01 satisfactorily addresses both comments. Table 1 (Enclosure 2) provides a summary of 

the changes made to NEI 00-01 following the May 20 meeting and supporting basis for the changes. 

We look forward to NRC endorsement of NEI 00-01, Revision 2. Endorsement of the document by 

the NRC will fulfill the shared goal of Industry and NRC for resolving the multiple spurious circuit 

failure issue by having a method acceptable to the regulator for performing circuit analysis. 
Mr. John A. Grobe 

June 5, 2009 

Page 2 

If you have any questions regarding this document, please feel free to contact me at 202-739-8080; 

am@nei.org or John Butler at 202-739-8108; jcb@nei.org. 

Sincerely, 

Alexander Marion 

Enclosures 

c: Mr. Sunil D. Weerakkody, NRR/ADES/DRA/AFP, NRC 

Mr. Alex R. Klein, NRR/ADES/DRA/AFP, NRC 

Mr. Daniel Frumkin, NRR/ADES/DRA/AFP, NRC 
ENCLOSURE 2 

Table 1 

Resolution of NEI 00-01 Issues Discussed at 

May 20, 2009 Public Meeting

Issue Description 

In NEI 00-01, Rev 2(c), it was stated that there was no need to consider co-existent hot shorts in 

separate cables for non-latching, non-seal-in effects on components. This position was derived from 

a review of the various cable tests. We originally asked that this criterion be applied to circuits for 

both required for hot shutdown and important to safe shutdown components. 

NEI 00-01 Changes 

During the May 20th public meeting, the NRC Staff indicated that additional justification would be 

required before the NRC could accept the position taken in the guidance document on co-existent 

hot shorts. To that end, NEI has placed addition justification and background material into Appendix 

B of NEI 00-01, further expanding on cable test data from other sources and allowing credit for 

existing defense in depth components. Also, a modification was made to Chapter 5 to remove the 

application of these criteria to “hot shutdown components”. 

Supporting Basis 

Results from each of the referenced cable fire testing programs have demonstrated that hot shorts 

resulting in spurious operations are possible given a fire of sufficient magnitude that will result in 

cable damage. The probabilities developed to capture the likelihood of a hot short resulting in a 

spurious operation, however, were conditional and based on the subject cable being damaged by 

the fire. Testing has also shown that cable failure is not instantaneous. When cable damage did 

result in a hot short, with the potential to cause a spurious operation, the hot short was typically of 

short duration, lasting much less than the worst case value of 11.7 minutes. 

In the NEI/EPRI Cable Fire Tests and in the CAROLFIRE Intermediate Scale Fire Tests, simultaneous 

failure of adjacent cables, even for cables within the same cable tray, in the same fire test did not 

occur except for one instance (Test No. 9 of the NEI/EPRI testing). In each of these testing 

programs, there were approximately 15 tests conducted with each test having four cable bundles. 

This equates to a total of 120 cables. With simultaneous failures occurring in only one instance, it 

can be concluded that the probability of simultaneous cables failures in reasonable low for the type 

of fire environment in which these cables were tested. 

Accepting the fact that circuit failures are not likely until temperature conditions in the vicinity of the 

cable reach elevated temperatures, cables that are located in areas with limited combustibles are 

very unlikely to fail. This condition is directly applicable to nuclear power plants where strict 

controls are placed on the introduction of in-situ and transient combustibles into plant areas where 

equipment required for hot shutdown or important to safe shutdown are located. 

Additionally, in areas where the in-situ fire hazards are greater, nuclear power plants typically use 

automatic suppression and detection for early identification and suppression of any fire that could 

occur. The availability of automatic fire suppression in these plant areas will prevent plant 

temperatures in the area of the hazard from reaching the levels necessary for cable failure. 
2 

When the factors listed above are integrated with the actual fire hazards present in an operating 

nuclear power plant and with the defense-in-depth fire protection programs described above, it can 

be concluded that the use of a reasonably bounded circuit failure criteria is appropriate. We provide 

the basis behind our determination for bounding criteria in Appendix B of NEI 00-01. 

Issue Description 

Difference existed between treatment of III.G.3 areas by NEI 00-01 and DG-1214. Specifically, NEI 

00-01 stated that if a Plant had an established III.G 3 license basis, documented in an SER, no 

additional reviews would be necessary. 

NEI 00-01 Changes 

Statements in NEI 00-01, Rev 2(c) concerning III.G.3 indicated that if a licensee, with an NRC issued 

SER for their Alternative/Dedicated Shutdown methodology, meet all of the regulatory requirements 

related to Alternative/Dedicated Shutdown, they would not be required to perform additional 

reviews to demonstrate compliance. 

The “Issue for Use” version of NEI 00-01 Rev 2 has been revised to include the following: 

“Additional actions are being recommended which could be useful, if included in a plant’s 

Alternative/Dedicated Safe Shutdown Analysis and the procedures used for Alternative/Dedicated 

Shutdown, in helping to minimize the impact of the effects of a fire on the ability to safely shutdown 

the unit”. See supporting basis below and Appendix D. 

Supporting Basis 

The generic MSO lists provided in Appendix G to NEI 00-01 may include scenarios that are 

applicable to III.G 2 and/or III.G.3 areas. As outlined in Appendix D, the criteria for addressing 

spurious operations for III.G.3 areas are different than for III.G.2 areas. Plant specific reviews 

should be performed to confirm that the scenarios are, in fact, applicable to III.G.2 areas only. 

Although MSOs with applicability to III.G.3 areas are not intended to alter a licensee’s current 

licensing basis related to III.G.3, where the III.G.3 areas have been approved by NRC, some 

evaluation of the risk implications of the scenario are warranted. The licensing basis for NRC 

approved III.G.3 areas is as outlined in Appendix D and/or in a licensee’s current licensing basis. 

The MSOs with applicability to III.G.3 areas for these licensees are intended, at most, for use in a 

voluntary effort performed by a licensee to assess fire risk in III.G.3 areas. Since this type of a 

review is voluntary, a licensee electing to assess risk in these previously approved III.G.3 areas may 

use any of the available tools to disposition the MSO. This includes operator manual actions, fire 

modeling and focused-scope fire PRA or qualitative assessments of risk without prior NRC approval. 

However, III.G.3 areas not previously approved by the NRC in an SER, which were re-classified from 

III.G.2 to III.G.3 by a licensee under the standard license condition, should evaluate the MSOs using 

the generic list and the expert panel as though the area were still a III.G.2 area. 
NEI 00-01 [Revision 2] 

GUIDANCE FOR POST

FIRE SAFE SHUTDOWN 

CIRCUIT ANALYSIS 

May 2009 

NEI 00-01 [Revision 2] 

Nuclear Energy Institute 

Guidance for Post-Fire

Safe Shutdown Circuit 

Analysis 

May 2009 

i 

ACKNOWLEDGEMENTS

NEI appreciates the extensive efforts of the utility members of the Circuit Failures Issue Task 

Force in developing and reviewing this document, as well as their utility management in 

supporting the members’ participation. 

Amir Afzali, Dominion Power 

Gordon Brastad, Energy Northwest 

Maurice Dingler, Wolf Creek Nuclear Operating Corporation 

Tom Gorman, PPL, Susquehanna 

Dennis Henneke, GE Hitachi 

Robert Kassawara, EPRI 

Harvey Leake, Arizona Public Service 

Bijan Najafi, SAIC 

Clarence Worrell, Westinghouse 

Chris Pragman, Exelon 

David Parker, Southern Company 

Vicki Warren, Exelon 

Woody Walker, Entergy 

NEI also extends its thanks to the following organizations playing important roles in the 

completion of this guidance and development of the revision: 

• EPRI: Funded a significant series of circuit failure tests and the Expert Panel who 

developed spurious actuation probabilities from the test results 

• BWR Owners Group: Developed the deterministic portion of the NEI 00-01 guidance 

• Westinghouse/CE and B&W Owners Groups: Along with the BWROG, funded the pilot 

applications of NEI 00-01 and a significant portion of the report preparation 

• Duke Energy and NMC Corporation: Hosted pilot applications of NEI 00-01 

• Omega Point Laboratories: Provided a cost-effective test facility for circuit failure 

testing 

• The NRC and Sandia National Laboratories: Provided extensive participation in the 

EPRI/NEI circuit failure testing, and review and comment on NEI 00-01 

• Edan Engineering: Wrote the EPRI report on the circuit failure testing and the analysis in 

Appendix B.1 on Multiple High Impedance Faults. 

• Exelon Generation: Host the pilot application of the Expert Panel Process 

NOTICE

Neither NEI, nor any of its employees, members, supporting organizations, contractors, or 

consultants make any warranty, expressed or implied, or assume any legal responsibility for the 

accuracy or completeness of, or assume any liability for damages resulting from any use of, any 

information apparatus, methods, or process disclosed in this report or that such may not 

infringe privately owned rights. 
ii 

EXECUTIVE SUMMARY 

NEI 00-01 was developed to provide a deterministic methodology for performing post-fire safe 

shutdown analysis. In addition, NEI 00-01 includes information on risk-informed methods 

(when allowed within a Plant’s License Basis) that may be used in conjunction with the 

deterministic methods for resolving circuit failure issues related to Multiple Spurious Operations 

(MSOs). The risk-informed method is intended for application by utilities to determine the risk 

significance of identified circuit failure issues related to MSOs. The deterministic safe shutdown 

analysis method described in Revision 0 of this document reflected practices in place for many 

years at a wide cross-section of U.S. nuclear plants and widely accepted by NRC. These 

practices were generally reflected in the plant’s licensing basis. In Revision 1, these 

deterministic methods were revised to address insights gained from EPRI/NEI circuit failure 

testing and reflected in NRC’s RIS 2004-03. While these insights do not change a plant’s 

licensing basis, they reflect the NRC’s new emphasis on considering potential safety 

implications of MSOs. This emphasis on MSOs became apparent as the NRC revised their 

inspection guidance to resume the inspection of circuits in January 2005. The methods presented 

in Revision 1 were intended to support licensees preparing for the resumed NRC circuit failure 

inspections. 

In Revision 2, changes were made to document the Resolution Methodology presented by the 

Industry to the NRC Staff for resolving the MSO Issue subsequent to the rejection of the Staff’s 

generic letter on MSOs by the Commission. The methodology in Revision 2 reflects insights 

gained from, not only the EPRI/NEI Cable Fire Testing, but also the CAROLFIRE Cable Fire 

Testing, the outcome of meetings with the NRC Staff and information provided within SECY 

08-0093 and a draft revision to Reg Guide 1.189. These changes were made to address NRC 

comments related to segregating those components necessary for post-fire hot shutdown (“green 

box”, defined in 10CFR50, Appendix R, Section III.G.1.a as one train of systems necessary to 

achieve and maintain hot shutdown conditions) and those whose mal-operation could provide a 

potential impact to post-fire safe shutdown (“orange box”, defined 10CFR50, Appendix R, 

Section III.G.1 as components important to safe shutdown that could adversely affect safe 

shutdown capability or cause mal-operation of safe shutdown systems). The methodology 

contained in Revision 2 is one method of addressing post-fire safe shutdown and the MSO Issue. 

This document neither changes nor supports any individual plant’s licensing basis. The 

assumptions used in the licensing basis and the nature of any approvals the NRC may have 

provided for these assumptions, are a plant specific matter between each licensee and the NRC. 

NEI 00-01 Revision 2, Section 5, provides a methodology for a focused-scope Fire PRA for 

assessing the risk significance of specific MSOs. This method is intended for application to 

circuit failures involving MSOs. All MSO impacts deemed to be risk significant should be 

placed in the plant Corrective Action Program with an appropriate priority for action. Since a 

large number of low significance findings of uncertain compliance status could result from 

industry applications of this method to MSOs, separate discussions are being held with NRC to 

address the handling of such issues without unnecessary resource impacts for licensees and NRC 

alike. 
iii 

It is expected that plants adopting a new fire protection licensing basis using NFPA 805 will be 

able to reference certain sections of NEI 00-01 as an acceptable method for addressing circuit 

failure issues, including the MSO Issue. It is noted that plants adopting the NFPA 805 licensing 

basis in accordance with NEI 04-02, Revision 1 utilized NEI 00-01 Revision 1 as part of the 

review and confirmation process of the nuclear safety methodology review. NEI 00-01 Revision 

1 Section 3 serves as the basis for nuclear safety methodology reviews performed in accordance 

with NEI 04-02, Revision 1, Regulatory Guide 1.205, Revision 0, as supplemented by NFPA 805 

Frequently Asked Question 07-0039, Revision 2 (ADAMS Accession No. ML082590466). 

[Note: Technical agreement on this FAQ has been reached, but the closure memo is still to be 

issued.] 

v 

TABLE OF CONTENTS

1 INTRODUCTION .......................................................................................................... 1

1.1 PURPOSE .........................................................................................................................1

1.2 BACKGROUD ...................................................................................................................3

1.3 OVERVIEW OF POST-FIRE SAFE SHUTDOWN ANALYSIS ...............................................5

1.3.1 General Methodology Description ................................................................7

1.3.2 Deterministic Method .....................................................................................7

1.3.3 Risk Significance Methods ...........................................................................13

2 APPENDIX R REQUIREMENTS AND CONSIDERATIONS ......................................... 15

2.1 REGULATORY REQUIREMENTS ....................................................................................15

2.2 REGULATORY GUIDANCE ON ASSOCIATED CIRCUITS OF CONCERN ..........................19

2.3 REGULATORY INTERPRETATION ON LOSS OF OFFSITE POWER .................................20

3 DETERMINISTIC METHODOLOGY ............................................................................ 23

3.1 SAFE SHUTDOWN SYSTEMS AND PATH DEVELOPMENT ..............................................23

3.1.1 Criteria/Assumptions ...................................................................................27

3.1.2 Shutdown Functions .....................................................................................29

3.1.3 Methodology for Shutdown System Selection ............................................34

3.2 SAFE SHUTDOWN EQUIPMENT SELECTION .................................................................36

3.2.1 Criteria/Assumptions ...................................................................................37

3.2.2 Methodology for Equipment Selection .......................................................38

3.3 SAFE SHUTDOWN CABLE SELECTION AND LOCATION ................................................42

3.3.1 Criteria/Assumptions ...................................................................................42

3.3.2 Associated Circuit of Concern Cables ........................................................44

3.3.3 Methodology for Cable Selection and Location .........................................45

3.4 FIRE AREA ASSESSMENT AND COMPLIANCE STRATEGIES .........................................48

3.4.1 Criteria/Assumptions ...................................................................................49

3.4.2 Methodology for Fire Area Assessment ......................................................51

3.5 CIRCUIT ANALYSIS AND EVALUATION.........................................................................55

3.5.1 Criteria/Assumptions ...................................................................................55

3.5.2 Types of Circuit Failures ..............................................................................59

4 IDENTIFICATION AND TREATMENT OF MULTIPLE SPURIOUS OPERATIONS ......... 71

4.1 INTRODUCTION .............................................................................................................71

4.2 OVERVIEW OF THE MSO IDENTIFICATION AND TREATMENT PROCESS ...................72

4.3 GENERIC LIST OF MSOS ..............................................................................................74

4.4 EXPERT PANEL REVIEW OF MSOS ..............................................................................75

4.4.1 The Following Provides A Discussion of Each Phase.Phase I: Pre-Review 

of Fire-Induced MSOs ..................................................................................75
vi 

Phase I: Pre-Review of Fire-Induced MSOs .............................................................76

4.4.2 Phase II: Preparation for the Expert Panel Meeting ................................80

4.4.3 Phase III: Performance of the Expert Panel Meetings ..............................81

4.4.4 Phase IV: Develop Comprehensive Plant Specific MSO List ...................85

4.4.5 Expert Panel Review Supporting NFPA 805 ..............................................86

4.5 ADDRESSING THE PLANT SPECIFIC LIST OF MSOS ....................................................87

4.5.1 Cable Selection & Association for Each Component in an MSO .............87

4.5.2 Fire Area Assessment and Compliance Strategies for MSOs ...................87

4.5.3 Feedback to the Generic MSO List .............................................................89

4.6 DOCUMENTATION .........................................................................................................90

5 RISK SIGNIFICANCE ANALYSIS .............................................................................. 91

5.1 COMPONENT COMBINATION IDENTIFICATION ............................................................92

5.1.1 Consideration of Consequences ...................................................................92

5.1.2 Selection of MSO Scenarios to be Analyzed ...............................................92

5.2 PRELIMINARY SCREENING ...........................................................................................92

5.2.1 Screening Factors ..........................................................................................93

5.2.2 Six-Factor Frequency of Core Damage (F*P*G*S*C*Z) .........................96

5.2.3 Final Screening Table ...................................................................................97

5.2.4 Example Application ....................................................................................99

5.2.5 Summary .....................................................................................................101

5.3 PLANT SPECIFIC RISK SIGNIFICANCE SCREENING ....................................................108

5.3.1 EPRI/NEI Test Results ...............................................................................108

5.3.2 Large Early Release Frequency Evaluation (LERF) ..............................112

5.3.3 Uncertainty and Sensitivity Analysis ........................................................112

5.4 INTEGRATED DECISION MAKING ...............................................................................113

5.4.1 Defense-In-Depth and Safety Margins Considerations ...........................114

5.4.2 Corrective Action ........................................................................................116

5.4.3 Documentation ............................................................................................116

5.5 PRA QUALITY ............................................................................................................117

5.5.1 Applicability of the ANS/ASME FPRA Section of the Combined PRA 

Standard ......................................................................................................117

5.5.2 Peer Review of the Focused-Scope or Full Fire PRA ..............................118

6 DEFINITIONS .......................................................................................................... 119

7 REFERENCES ......................................................................................................... 127

7.1 NRC GENERIC LETTERS ............................................................................................127

7.2 BULLETINS ..................................................................................................................127

7.3 NRC INFORMATION NOTICES ....................................................................................128

7.4 OTHER RELATED DOCUMENTS ..................................................................................131

7.5 ADMINISTRATIVE LETTERS ........................................................................................134

7.6 REGULATORY ISSUE SUMMARIES ..............................................................................134
vii 

ATTACHMENTS

ATTACHMENT 1 EXAMPLE OF TYPICAL BWR SAFE SHUTDOWN PATH 

DEVELOPMENT ...................................................................................................... 135

ATTACHMENT 2 ANNOTATED P&ID ILLUSTRATING SSD SYSTEM PATHS [BWR 

EXAMPLE] .............................................................................................................. 136

ATTACHMENT 3 EXAMPLE OF SAFE SHUTDOWN EQUIPMENT LIST ............................ 137

ATTACHMENT 4 SAFE SHUTDOWN LOGIC DIAGRAM [BWR EXAMPLE] ....................... 139

ATTACHMENT 5 EXAMPLE OF AFFECTED EQUIPMENT REPORT .................................. 140

ATTACHMENT 6 EXAMPLE OF FIRE AREA ASSESSMENT REPORT .............................. 142

APPENDICES

APPENDIX A SAFE SHUTDOWN ANALYSIS AS PART OF AN OVERALL FIRE 

PROTECTION PROGRAM ........................................................................................ A-1

APPENDIX B DETERMINISTIC CIRCUIT FAILURE CRITERIA ......................................... B-1

APPENDIX B.1 JUSTIFICATION FOR THE ELIMINATION OF MULTIPLE HIGH IMPEDANCE 

FAULTS................................................................................................................. B.1.1

APPENDIX C HIGH / LOW PRESSURE INTERFACES ..................................................... C-1

APPENDIX D ALTERNATIVE/DEDICATED SHUTDOWN REQUIREMENTS ...................... D-1

APPENDIX E ACCEPTANCE CRITERIA OPERATOR MANUAL ACTIONS 

 AND REPAIRS ........................................................................................................ E-1

APPENDIX F SUPPLEMENTAL SELECTION GUIDANCE (DISCRETIONARY) ................... F-1

APPENDIX G GENERIC LIST OF MSOS ........................................................................... G-1

APPENDIX H REQUIRED FOR HOT SHUTDOWN VERSUS IMPORTANT TO SSD 

COMPONENTS ........................................................................................................ H-1
viii 

FIGURES Page #

Figure 1-1 Deterministic Post-fire Safe Shutdown Overview 10 

Figure 2-1 Appendix R Requirements Flowchart 17 

Figure 3-1 Deterministic Guidance Methodology Overview 25 

Figure 3-2 Safe Shutdown System Selection and Path Development 35 

Figure 3-3 Safe Shutdown Equipment Selection 41 

Figure 3-4 Safe Shutdown Cable Selection 47 

Figure 3-5 Fire Area Assessment Flowchart 53 

Figure 3.5.2-1 Open Circuit (Grounded Control Circuit) 61 

Figure 3.5.2-2 Short to Ground (Grounded Control Circuit) 62 

Figure 3.5.2-3 Short to Ground (Ungrounded Control Circuit) 63 

Figure 3.5.2-4 Hot Short Grounded Control Circuit) 65 

Figure 3.5.2-5 Hot Short (Ungrounded Control Circuit) 66 

Figure 3.5.2-6 Common Power Source (Breaker Coordination) 67 

Figure 4.1 Resolution Methodology 73 

Figure 5-1 Simplified Process Diagram 91 

Figure 5-2 Fragility Curves Thermoset 109

TABLES Page #

TABLE 5-1 Maxima for the Pairings F*P 102

TABLE 5-2 Maxima That Result from Maximum Credits for G (0.01), S (0.01), 102 

C (0.01) and Z (0.9)

TABLE 5-3 Point Requirements for Screening 103

TABLE 5-4 Establishing Relative Risk Ranking When All Zones Preliminarily 104 

Screen

TABLE 5-5 Generic Location Fire Frequencies 105

TABLE 5-6 Probabilities of Spurious Actuation Based on Cable Type and 106 

Failure Mode (Range) 

TABLE 5-7 General Fire Scenario Characterization Type Bins Mapped 106 

to Fire Intensity Characteristics

TABLE 5-8 Total Unavailability Values for SSD Path-Based Screening CCDP 107

TABLE 5-9 Summary of the Probabilities (PSACD) 111 
NEI 00-01, Revision 2 

May 2009 

1 

GUIDANCE FOR POST-FIRE 

SAFE SHUTDOWN CIRCUIT ANALYSIS

1 INTRODUCTION 

For some time there has been a need for a comprehensive industry guidance document for the 

performance of post-fire safe shutdown analysis to implement existing fire protection 

regulations. Such a document is needed to consistently apply the regulatory requirements for 

post-fire safe shutdown analysis contained in 10 CFR 50.48 (Reference 7.4.1) and 10 CFR 50 

Appendix R (Reference 7.4.3). 

From the standpoint of deterministic safe shutdown analysis, Generic Letter 86-10 (Reference 

7.1.10) provided standardized answers to certain questions related to specific issues related to 

this topic. The answers provided, however, did not comprehensively address the entire subject 

matter. The lack of comprehensive guidance for post-fire safe shutdown analysis, in 

combination with the numerous variations in the approach used by the architect engineers 

responsible for each plant design, have resulted in wide variation in plant specific approaches to 

deterministic post-fire safe shutdown analysis. 

Some of these approaches are based on long-held industry interpretations of the NRC regulations 

and guidance. In many cases, these interpretations were not documented in a manner that 

indicated a clear NRC acceptance of the position. In an NRC letter to NEI in early March 1997 

(Reference 7.4.30) NRC stated that the regulatory requirements and staff positions are well 

documented, and that regulatory requirements recognize that fires can induce multiple hot shorts. 

The industry responded (Reference 7.4.31) that industry and NRC staff interpretations of existing 

regulations and regulatory guidance differ significantly on, at least, some aspects of the post-fire 

safe shutdown analysis requirements and provided reasons for these differing interpretations. 

The Boiling Water Reactor Owners Group (BWROG) developed a comprehensive document for 

BWRs to compile deterministic safe shutdown analysis practices based on existing regulatory 

requirements and guidance. That document was adopted into NEI 00-01 with minor changes to 

address PWR-specific safe shutdown analysis considerations. 

Changes were made in Revision 2 to provide an approach for addressing fire-induced multiple 

spurious operations (MSOs). 

1.1 PURPOSE 

The purpose of this document is to provide a consistent process for performing a post-fire safe 

shutdown circuit analysis. While it describes differences between NRC and industry licensing 

positions, NEI 00-01 does not define what any plant’s licensing basis is or should be. Plant 

licensing bases have been developed over many years of licensee interactions with NRC staff, 

and the interpretation of these licensing bases is a matter between each licensee and NRC staff. 

The guidance provided in this document accounts for differences and uncertainties in licensing 

basis assumptions about circuit failures. It also provides a method for the resolution of the 

differences between the NRC and the industry related to fire-induced circuit failures resulting in 

MSOs. 
NEI 00-01, Revision 2 

May 2009 

2 

This document provides deterministic methods for addressing potential fire-induced circuit 

failure issues, either within or beyond the existing plant’s licensing basis, as determined by each 

licensee using their currently approved licensing basis for Fire protection and Post-Fire Safe 

Shutdown. The deterministic method, derived from NRC regulations, guidance, and plant 

licensing bases is provided for analyzing and resolving circuit failure issues. Methods are 

provided to (1) select circuits and appropriate combinations thereof for the analysis of MSOs 

(note: the terms spurious actuation and spurious operation are considered synonymous. The term 

“spurious operation” is used in this document for consistency), and (2) determine the risk 

significance of identified circuit failure combinations, called MSOs. While the selection of 

circuit failure combinations, MSOs, has not traditionally been included in plant circuit analysis 

methods to date, it is appropriate to consider such combinations in the light of the results of 

recent cable failure testing, both EPRI/NEI and CAROLFIRE. The Resolution Methodology for 

MSOs included in this document will assist the licensee in determining whether potentially risksignificant interactions could impact safe shutdown, but this Resolution Methodology does not 

change the plant licensing basis. Where an individual licensee’s licensing basis is either unclear 

or silent on the need to or method for addressing MSOs, the Resolution Methodology provides 

an industry consensus approach for addressing the issue. Each licensee must be prepared to 

defend the integrity of their licensing basis relative to any actions taken to classify conditions 

relative to the resolution of the MSO issue as not being part of the current licensing basis. 

The methods in this document do not require the systematic re-evaluation of a plant’s post-fire 

safe shutdown circuit analysis. A decision to perform such a systematic re-evaluation is entirely 

a licensee decision that may be based on NRC inspection findings, licensee self-assessment 

results, or industry experience. Neither do these methods take precedence over specific 

requirements accepted by the NRC in a plant’s post-fire safe shutdown analysis. The 

deterministic methods in this document rely on approved licensing bases for individual plants. 

In addition, this document provides criteria for assessing the risk significance of those MSO 

issues that may not be included in current safe shutdown analyses, but that may be a concern 

because of potential risk significance. 

The guidance in this document reflects the position that licensees should address potential risksignificant issues regardless of whether they involve compliance with the licensing basis. When 

issues are identified, the licensee should consider whether they involve violations of the licensing 

basis, are beyond the licensing basis, or are of uncertain compliance status and subject to possible 

disagreement with NRC. Licensees should also consider the risk significance of the findings 

consistent with the fire protection Significance Determination Process (SDP). Consideration of 

these parameters is illustrated in the following table: 

Type of Issue 

Action to Address Issue 

Issue Risk Significant Issue Not Risk Significant

Issue outside Current 

Licensing Basis 

[CLB]) 

Address in Corrective 

Action Program (CAP) 

Address in CAP or provide 

licensing basis changes 

(using approved regulatory 

processes) 
NEI 00-01, Revision 2 

May 2009 

3 

Type of Issue 

Action to Address Issue 

Issue Risk Significant Issue Not Risk Significant

Violation of CLB Address in CAP Address in CAP or provide 

licensing basis changes 

(using approved regulatory 

processes) 

Compliance status/ 

CLB not clear 

Address in CAP Address in CAP or provide 

licensing basis changes 

(using approved regulatory 

processes) 

As seen in the table above, NEI 00-01 concludes that the licensees should address risksignificant circuit failure issues regardless of whether they involve potential violations. Issues 

that are both risk-insignificant and outside the licensing basis should be treated in accordance 

with current ROP guidelines as illustrated in the table. Remaining low significance issues 

potentially involving compliance should be addressed consistent with current regulatory 

guidelines; licensing basis changes (using approved regulatory processes) may be in order, 

supported by the risk analysis performed using Section 5 risk analysis or the fire protection SDP 

methods. 

An example will illustrate the use of NEI 00-01. In this example, assume that the licensee 

conducts a self-evaluation using this document and determines that he should postulate more than 

one simultaneous spurious operation in a certain fire area. Further, assume that the licensing basis 

is inconclusive. The licensee could determine the risk significance of the issue using the methods 

of NEI 00-01, the revised fire protection Significance Determination Process, or other plant 

specific risk analyses. The licensee should place the issue in the plant Corrective Action Program 

(CAP) if it is significant according to the risk criteria used, or could request licensing basis 

changes (using approved regulatory processes), or change the fire protection plan, if it is not. The 

compliance aspects would also be addressed in cases where it is not clear whether an issue is 

within the licensing basis (a “compliance issue”) or not. 

1.2 BACKGROUD 

Reviewing past fire events can substantiate the uncertainty associated with the behavior of actual 

plant fires. On March 22, 1975, the Browns Ferry Nuclear Power Plant had the worst fire ever to 

occur in a commercial nuclear power plant operating in the United States. (Reference U.S. 

Nuclear Regulatory Commission (NRC) Inspection and Enforcement (IE) Bulletin Nos. 50-

259/75 and 50-260/75-1, dated 2/25/75.) The Special Review Group that investigated the 

Browns Ferry fire made two recommendations pertaining to assuring that the effectiveness of the 

fire protection programs at operating nuclear power plants conform to General Design Criterion 

(GDC) 3. 

 The NRC should develop specific guidance for implementing GDC 3. 

 The NRC should review the fire protection program at each operating plant, comparing 

the program to the specific guidance developed for implementing GDC 3. 
NEI 00-01, Revision 2 

May 2009 

4 

In response to the first recommendation, the NRC staff developed Branch Technical Position 

(BTP) Auxiliary Power Conversion Systems Branch (APCSB) 9.5-1, “Guidance for Fire 

Protection for Nuclear Power Plants," May 1, 1976; and Appendix A to BTP APCSB 9.5-1, 

“Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976," 

August 23, 1976. The guidance in these documents focused on the elements of fire protection 

defense-in-depth (DID): (1) prevention; (2) mitigation through the use of detection and 

suppression (automatic and manual); (3) passive protection of structures, systems and 

components (SSCs) important to safety and post-fire safe shutdown. 

In response to the second recommendation, each operating plant compared its fire protection 

program with the guidelines of either BTP APCSB 9.5-1 or Appendix A to BTP APCSB 9.5-1. 

The staff reviewed the fire protection programs for compliance with the guidance. 

The guidance in BTP APCSB 9.5-1 and Appendix A to BTP APCSB 9.5-1, however, did not 

provide sufficiently specific guidance for performing post-fire safe shutdown analysis. Also, 

independent testing sponsored by the NRC indicated that some of the separation concepts 

proposed by licensees under the BTP, such as coating intervening cable trays with fire retardant 

coatings, would not provide sufficient protection in the event of a severe fire. Thirdly, some 

licensees did not implement aspects of the BTP that the NRC Staff considered essential in order 

to achieve adequate protection. To address these issue and to provide the necessary guidance, 

the NRC issued 10 CFR 50.48, “Fire Protection,” and Appendix R, “Fire Protection Program for 

Nuclear Power Facilities Operating Prior to January 1, 1979,” to 10 CFR Part 50 (45 FR 36082). 

The NRC published in the Federal Register (45 FR 76602) the final fire protection rule (10 CFR 

50.48) and Appendix R to 10 CFR Part 50 on November 19, 1980. The Appendix R Regulation 

required compliance with sections III.G, III.J, and III.O for all plants licensed to operate before 

January 1, 1979, and also required individual licensees to comply with other lettered sections, 

based on the status of their outstanding items under the BTP review, as reflected by NRC 

correspondence to the individual licensees. Section III.G.2 of Appendix R reflected the results 

of the NRC's independent cable tray fire testing program, overriding any previous approvals the 

NRC may have granted regarding the protection of cables with fire retardant coatings. 

This regulation applies to plants licensed to operate prior to January 1, 1979. For plants licensed 

to operate after January 1, 1979, the NRC staff, in most cases, required compliance with 

Appendix A to BTP APCSB 9.5-1 and Sections III.G, J & O of Appendix R. For these licensees, 

the sections of Appendix R apply to the plant as a licensing commitment, rather than as a legal 

requirement imposed by the code of federal regulations. Some other licensees provided 

comparisons to the guidelines of Section 9.5-1, “Fire Protection Program,” of NUREG-0800, 

“Standard Review Plan,” which incorporated the guidance of Appendix A to BTP APCSB 9.5-1 

and the criteria of Appendix R, or BTP CMEB 9.5-1. Additionally, some plants had aspects of 

their programs reviewed to the criteria contained in Draft Regulatory Guide 1.120 Revision 1 

(“Fire Protection Guidelines for Nuclear Power Plants,” November 1977), which primarily 

reflected the content of BTP APCSB 9.5-1 Revision 1. Therefore, even though fire protection 

programs can be essentially equivalent from plant to plant, the licensing basis upon which these 

programs are founded can be very different. Most plants licensed after January 1, 1979 have also 

been granted by the NRC a standard fire protection license condition allowing them to selfapprove and make changes to their NRC approved fire protection program provided such 
NEI 00-01, Revision 2 

May 2009 

5 

changes do not adversely affect the ability to achieve and maintain safe shutdown in the event of 

a fire. Therefore, even for plants with a common regulatory basis traceable back to one of the 

regulations and/or guidance listed above, the details of implementing the fire protection program 

can be different. 

The plant design changes required for passive and active fire protection features and 

administrative controls required by the regulations discussed were fairly specific. These changes 

have been implemented throughout the industry. These changes have been effective in 

preventing a recurrence of a fire event of the severity experienced at Browns Ferry; have 

increased the likelihood that a fire will be detected rapidly and extinguished; and have reduced 

the potential consequences of a fire (see Appendix A for a brief history of the Browns Ferry fire 

and a description of the fire protection improvements for nuclear plants since the Browns Ferry 

fire). 

To clarify the regulations, the NRC staff has issued numerous guidance documents in the form of 

Regulatory Guides, memorandums, Regulatory Issue Summaries, Generic Letters and 

Information Notices. These documents provide insights as to the NRC staff’s interpretation of 

the regulations, their views on acceptable methods for complying with the regulations, and 

clarity of the requirements necessary in performing a post-fire safe shutdown analysis. 

1.3 OVERVIEW OF POST-FIRE SAFE SHUTDOWN ANALYSIS 

A fire in an operating nuclear power plant is a potentially serious event. In general, the 

likelihood of a large fire with the potential to damage plant equipment important to safe 

shutdown is considered to be small. The expected fire would be contained in a single electrical 

panel or a localized portion of one room or area. Typical plant design segregates important 

cables and equipment from threats such as missiles, flooding, and significant fire sources. The 

expected plant response to this type of event would be to maintain continued operation and to 

dispatch the plant fire brigade to extinguish the fire. 

Despite this, the consequences of an event that damages plant equipment important to safe 

shutdown can be significant. The Browns Ferry fire resulted in damage to plant equipment 

important to safe shutdown. Although safe shutdown of the Browns Ferry unit was ultimately 

accomplished, the event was of sufficient significance to warrant major changes in fire protection 

design features of a nuclear power plant. Appendix A to this document provides a description of 

the improvements made in the fire protection design of nuclear power plants in response to the 

Browns Ferry fire event. 

In addition to plants making changes to the fire protection design features, they have also placed 

increased attention on identifying those systems and equipment important to the post-fire safe 

shutdown of each unit. A safe plant design is achieved by identifying the systems and equipment 

important to post-fire safe shutdown in each area of the plant; making conservative assumptions 

regarding the extent of fire damage; and assuring adequate separation of the redundant safe 

shutdown trains or protection of an alternative/dedicated shutdown train. When applied to the 

fire protection program of a nuclear power plant, these aspects of post-fire safe shutdown design, 

in combination with the other changes made in the design of the plant fire protection programs in 
NEI 00-01, Revision 2 

May 2009 

6 

response to the Browns Ferry fire, provide reasonable assurance that a plant fire will not prevent 

safe plant shutdown. 

The goal of post-fire safe shutdown is to assure that a single fire in any plant fire area will not 

result in any fuel cladding damage, rupture of the primary coolant boundary or rupture of the 

primary containment. This goal serves to prevent an unacceptable radiological release as a result 

of the fire. This goal is accomplished by assuring, in accordance with NRC Regulatory 

requirements, the following deterministic criteria are satisfied for a single fire in any plant fire 

area: 

 One safe shutdown path necessary to achieve and maintain hot shutdown is free of fire 

damage. The set of components necessary to achieve and maintain post-fire hot 

shutdown is referred to throughout this document as the “required for hot shutdown”. 

 Potential fire-related impacts to components with the potential to mal-operate and 

adversely impact the ability of the safe shutdown path described above to perform its 

post-fire safe shutdown functions are prevented or can be adequately mitigated. The set 

of components whose mal-operation could impact the components on the required safe 

shutdown path in a particular fire area are referred to throughout this document as 

“important to safe shutdown”. 

 Repairs to systems and equipment required to achieve and maintain cold shutdown can be 

accomplished within the required time frame. 

 Any operator manual actions required to support achieving either hot or cold shutdown 

are identified and meet the applicable regulatory acceptance requirements. 

The deterministic methods in Section 3 integrate the requirements and interpretations related to 

post-fire safe shutdown into a single location, and assure that these criteria are satisfied. These 

methods: 

 Identify the systems, equipment and cables required to support the operation of each safe 

shutdown path. 

 Identify the equipment and cables whose spurious operation could adversely impact the 

ability of these safe shutdown paths to perform their required safe shutdown function. 

 Provide techniques to mitigate the effects of fire damage to components on or affecting 

the required safe shutdown path in each fire area. 

Using these methods to perform the post-fire safe shutdown analysis will meet deterministic 

regulatory requirements and provide an acceptable level of safety resulting in a safe plant design. 

These methods are consistent with the fire protection defense-in-depth concept that addresses 

uncertainties associated with the actual behavior of fires in a nuclear power plant. Post-fire safe 

shutdown is one part of each plant’s overall defense-in-depth fire protection program. The extent 

to which the requirements and guidance are applicable to a specific plant depends upon the age of 

the plant and the commitments established by the licensee in developing its fire protection 

program. 
NEI 00-01, Revision 2 

May 2009 

7 

The information contained in Sections 4 and 5 are provided for use in resolving the longstanding 

issues of MSOs. Using the Resolution Methodology described in these Sections and in the 

appendices referenced within Sections 4 and 5 is one way for a licensee to address the MSO issue. 

1.3.1 GENERAL METHODOLOGY DESCRIPTION

The deterministic methodology described in this document can be used to perform a post-fire 

safe shutdown analysis to address the current regulatory requirements. The Resolution 

Methodology for MSOs evaluates the risk significance of potential failures or combinations of 

failures. [Note: The term “MSOs” will be used throughout this document to denote one or 

more fire-induced component failures due to fire-induced circuit failures, including, but not 

limited to spurious operations resulting from hot shorts.] The baseline deterministic approach to 

performing a post-fire safe shutdown analysis is contained in Sections 1, 2 and 3. Certain 

aspects of the deterministic approach, such as Alternate or Dedicated Shutdown under 

III.G.3/III.L and High/Low Pressure Interface Components have criteria slightly different from 

the baseline methodology. In an effort to provide as much clarity as possible and to not confuse 

the baseline approach with numerous exception statements, these areas with criteria differences 

have been addressed for their differences from the baseline criteria in appendices. High/Low 

Pressure Interfaces have been addressed in Appendix C. Alternate and Dedicated Shutdown has 

been addressed in Appendix D. The Resolution Methodology for addressing MSOs, which 

addresses a longstanding issue between the Industry and the NRC, is contained in Section 4, 

Appendix B, Appendix F and Appendices G-1 and G-2. In an effort to clarify which fireinduced component impacts may be allowed to use operator manual actions, Appendix H has 

been added. Appendix E provides additional guidance on operator manual actions. Finally, 

Section 5 contains information useful for assessing the risk associated with fire-induced circuit 

failures. 

1.3.2 DETERMINISTIC METHOD

When using the deterministic methodology described in Section 3 of this document to address 

the current regulatory requirements, a basic assumption of the methodology is that there will be 

fire damage to systems and equipment located within a common fire area. The size and intensity 

of the fire required causing this type of system and equipment damage is not determined. Rather, 

fire damage is assumed to occur regardless of the level of combustibles in the area, the ignition 

temperatures of any combustible materials, the lack of an ignition source or the presence of 

automatic or manual fire suppression and detection capability. Fire damage is also postulated for 

all cables and equipment in the fire area that may be used for safe shutdown, even though most 

plant fire areas do not contain sufficient fire hazards for this to occur. 

It is with these basic and conservative assumptions regarding fire damage that use of the Section 

3 methodology begins. The methodology progresses by providing guidance on selecting systems 

and equipment needed for post-fire safe shutdown, on identifying the circuits of concern relative 

to these systems and equipment and on mitigating each fire-induced effect to the systems, 

equipment and circuits for the required safe shutdown path in each fire area. This methodology 

represents a comprehensive and safe approach for assuring that an operating plant can be safely 

shut down in the event of a single fire in any plant fire area. 
NEI 00-01, Revision 2 

May 2009 

8 

To address the MSO issue, consideration is given to the MSO List in Appendix G and the circuit 

failure criteria contained in Appendix B. The circuit failure criteria contained in Appendix B is 

intended for use with the MSO List in Appendix G and the MSO Resolution Methodology 

described in Section 4. Using the Resolution Methodology described in Section 4, a licensee can 

determine the potential fire-induced MSO impacts applicable to its facility. These potential fireinduced impacts can then be dispositioned using the deterministic methods described in Section 

3 or by using the risk-informed method described in Section 5. Additionally, fire modeling, as 

described in Section 4, may be used to assess whether or not a particular MSO in a particular 

location presents a potential impact to post-fire safe shutdown. In addressing MSOs, the 

conservative assumptions discussed above for the Section 3 analysis are not necessarily applied, 

e.g. fire modeling or risk assessment may be an acceptable resolution approach. The mitigating 

techniques available for use with any particular MSO is a function of whether that MSO is 

classified as being comprised of required for hot shutdown components or important to safe 

shutdown components. Refer to Appendix H for a description of the criteria to be used to 

classify components as either required for hot shutdown or important to safe shutdown 

components. Additionally, the MSOs listed in Appendix G are to be evaluated separately. Other 

than the cases described in Section 4 involving an evaluation by the Expert Panel of the need to 

combine MSOs, there is no need to evaluate for the combined effect of multiple MSOs. The 

potential affect of each MSO on post-fire safe shutdown is to be evaluated individually. 

In performing a deterministic post-fire safe shutdown analysis, the analyst must be cautious not 

to improperly apply the conservative assumptions described above. For example, one cannot 

rule out fire damage to unprotected circuits in a given fire area. This assumption is conservative 

only in terms of not being able to credit the systems and equipment associated with these circuits 

in support of post-fire safe shutdown. If the analyst, however, were to assume that these circuits 

were to be damaged by the fire when this provided an analytical advantage, this would be nonconservative. For example, assuming that fire damage results in a loss of offsite power may be 

non-conservative in terms of heat load, assumptions used in an analysis to determine the need for 

room cooling systems for the 72-hour fire coping period. 

The methodology for performing deterministic post-fire safe shutdown analysis is depicted in 

Figure 1-1. The specific steps are summarized in Sections 1.3.2.1 through 1.3.2.6, and discussed 

in depth in Section 3. The criteria for determining whether a component is a required for hot 

shutdown or important to safe shutdown component is contained in Appendix H. 

1.3.2.1 Safe Shutdown Function Identification 

The goal of post-fire safe shutdown is to assure that a single fire in any single plant fire area will 

not result in any fuel cladding damage, rupture of the primary coolant boundary or rupture of the 

primary containment. This goal is accomplished by determining those functions important to 

safely shutting down the reactor and assuring that systems with the capability to perform these 

functions are not adversely impacted by a single fire in any plant fire area. The safe shutdown 

functions important to the plant are: (1) reactivity control; (2) pressure control; (3) inventory 

control; and (4) decay heat removal. To accomplish the required safe shutdown functions, 

certain support system functions (e.g., electrical power, ventilation) and process monitoring 

capability (e.g., reactor level, pressure indication) are also required. 
NEI 00-01, Revision 2 

May 2009 

9 

 

In addition, the analyst must assure that fire-induced spurious operations do not occur that can 

prevent equipment in the required safe shutdown path from performing its intended safe 

shutdown function. Examples of spurious operations that present a potential concern for the safe 

shutdown functions described above are those that can cause a: (1) loss of inventory in excess of 

the make up capability; (2) flow diversion or a flow blockage in the safe shutdown systems being 

used to accomplish the inventory control function; (3) flow diversion or a flow blockage in the 

safe shutdown systems being used to accomplish the decay heat removal function1

. 

[BWR] Although an inadvertent reactor vessel overfill condition is not a safe shutdown function 

listed above, the NRC has identified this as a concern. The acceptability of the current design 

features of the BWR to mitigate the effects of an inadvertent reactor vessel overfill condition as a 

result of either a fire or equipment failure has been addressed by the BWROG in GE Report No. 

EDE 07—390 dated April 2, 1990, in response to NRC Generic Letter 89-19. The NRC 

subsequently accepted the BWROG position in a Safety Evaluation dated June 9, 1994. Despite 

this, some of the MSOs listed in Appendix G for BWRs relate to an inadvertent reactor vessel 

overfill. These will be addressed as a part of the MSO review. 

When performing a post-fire safe shutdown analysis, the decision as to whether to include 

specific components on the post-fire safe shutdown component list may be made by the use of 

thermal-hydraulic analysis. If by use of a thermal-hydraulic analysis, the worst-case failure of 

the component can be demonstrated to have no impact on the ability to achieve and maintain 

post-fire hot shutdown, then the component need not be included on the post-fire safe shutdown 

component list and it need not be included in the post-fire safe shutdown analysis. The same is 

true of evaluations performed to address the MSOs contained in Appendix G to this document. 

When performing thermal-hydraulic analysis in support of post-fire safe shutdown impacts 

determinations, the criteria contained in Appendix H should be applied. 

Therefore, thermal-hydraulic analysis is an acceptable basis for excluding plant components 

from consideration in the post-fire safe shutdown analysis. Similarly, thermal-hydraulic analysis 

is an acceptable basis for excluding a particular MSO from further consideration in a plant postfire safe shutdown analysis. Finally, thermal-hydraulic analysis coupled with a generic operator 

manual action(s) meeting all of the requirements of this document can be an acceptable way of 

addressing a potential impact to post-fire safe shutdown without including all of the affected 

cabling for a component or set of components into the post-fire safe shutdown analysis. 

1

 Licensing Citation: Brown’s Ferry SER dated November 2, 1995 Section 3.7.3 third paragraph. Monticello 

Inspection report dated December 3, 1986 paragraph (2) page 16. 
NEI 00-01, Revision 2 

May 2009 

10 
NEI 00-01, Revision 2 

May 2009 

11 

1.3.2.2 Safe Shutdown System and Path Identification 

Using the safe shutdown functions described above, the analyst identifies a system or 

combination of systems with the ability to perform each of these shutdown functions. The 

systems are combined to form safe shutdown paths. 

1.3.2.3 Safe Shutdown Equipment Identification 

Using the Piping and Instrument Diagrams (P&IDs) for the mechanical systems comprising each 

safe shutdown path, the analyst identifies the mechanical equipment required for the operation of 

the system and the equipment whose spurious operation could affect the performance of the safe 

shutdown systems. Equipment that is required for the operation of a safe shutdown system for a 

particular safe shutdown path is related to that path (and is designated as a required hot shutdown 

component). 

From a review of the associated P&IDs, the equipment that could spuriously operate and result in 

a flow blockage, a flow diversion (e.g., inventory makeup capability), loss of pressure control 

(due to overfeeding, excessive steam leakage, etc.), is identified. Similarly, this equipment is 

related to the particular safe shutdown path that it can affect. 

Using the criteria in Appendix H, the analyst classifies the components identified above either as 

required for hot shutdown component or as an important to SSD component. 

The required safe shutdown path for any particular fire area is comprised of required for hot 

shutdown and important to SSD components. The classification for a particular component in 

regards to being either a required for hot shutdown or an important to SSD component can vary 

from fire area to fire area. Refer to Appendix H for additional details. 

The analyst reviews the P&IDs for the systems physically connected to the reactor vessel to 

determine the equipment that can result in a loss of reactor inventory in excess of make up 

capability. This includes a special class of valves known as “high/low pressure interfaces.” 

Refer to Appendix C for the special requirements associated with high/low pressure interface 

valves. Equipment in this category is typically related to all safe shutdown paths, since a loss of 

reactor vessel inventory or an interfacing system LOCA would be a concern for any safe 

shutdown path. The classification criteria contained in Appendix H also applies to high/low 

pressure interface components. 

1.3.2.4 Safe Shutdown Cable Identification 

Using the electrical schematic drawings for the equipment identified above, the analyst identifies 

all the cables required for the proper operation of the safe shutdown equipment. This will 

include, in addition to the cables that are physically connected to the equipment, any cables 

interlocked to the primary electrical schematic through secondary schematics. The cables 

identified are related to the same safe shutdown path as the equipment they support. 
NEI 00-01, Revision 2 

May 2009 

12 

 

While reviewing the electrical schematics for the equipment, the analyst identifies the safe 

shutdown equipment from the electrical distribution system (EDS). The EDS equipment (bus) 

for the safe shutdown path is associated with the equipment that it powers. All upstream busses 

are identified and similarly related to the safe shutdown path. In addition, all power cables 

associated with each bus in the EDS are identified and related to the same safe shutdown path as 

the EDS equipment. This information is required to support the Breaker Coordination Analysis. 

1.3.2.5 Safe Shutdown Circuit Analysis 

Using information on the physical routing of the required cables and the physical locations of all 

safe shutdown equipment, the analyst determines equipment and cable impacts for each safe 

shutdown path in each plant fire area. Based on the number and types of impacts to these paths, 

each fire area is assigned a required safe shutdown path(s). Initially, it is assumed that any 

cables related to a required safe shutdown component in a given fire area will cause the 

component to fail in the worst-case position (i.e. if the safe shutdown position of a valve is 

closed, the valve is assumed to open if the required cable is routed in the fire area). 

If necessary, a detailed analysis of the cable for the specific effect of the fire on that safe 

shutdown path is performed. This is accomplished by reviewing each conductor in each of these 

cables for the effects of a hot short, a short-to-ground or an open circuit2

 (test results indicate 

that open circuits are not the initial fire-induced failure mode) and determining the impact on the 

required safe shutdown component. The impact is assessed in terms of the effect on the safe 

shutdown system, the safe shutdown path, the safe shutdown functions and the goal for post-fire 

safe shutdown. 

1.3.2.6 Safe Shutdown Equipment Impacts 

Using the process described above, the analyst identifies the potential impacts to safe shutdown 

equipment, systems, paths, and functions relied upon in each fire area, and then mitigate the 

effects on safe shutdown for each safe shutdown component impacted by the fire. The 

mitigating techniques must meet the regulations. For example, for required for hot shutdown 

components the mitigating techniques listed in Figure 1-1 for required hot shutdown components 

apply. For required for hot shutdown components, unless the available options of re-designing 

the systems and/or re-designing/re-routing the affected circuits and processing Exemption 

Requests or License Amendment Requests (LARs), the protection schemes of Appendix R 

Section III.G.2 must be applied. If the component, however, is classified as an important to SSD 

component, mitigating tools in addition to those available for required safe shutdown 

components may be credited as an alternate to those available for required for safe shutdown 

components. Refer to Figure 1-1 and Appendix H for additional details. One of the mitigating 

tools for an important to SSD circuit component is the use of an operator manual action. If an 

operator manual action is relied upon as the mitigating tool, then it must meet the regulatory 

2

 Licensing Citation: Waterford III Submittal to NRR dated February 7, 1985, Item No. 5 on page 3. Susquehanna 

Steam Electric Station NRC Question 40.97 paragraph 3a. Wolf Creek/Callaway SSER 5 Section 9.5.1.5 second 

paragraph. 
NEI 00-01, Revision 2 

May 2009 

13 

acceptance criteria related to operator manual actions. Refer to Appendix E for additional 

information related to the regulatory acceptance criteria for operator manual actions. 

The process of identifying and mitigating impacts to the required safe shutdown path(s) 

described above is explained in more detail throughout this document. 

1.3.3 RISK SIGNIFICANCE METHODS

The Resolution Methodology for determining the Plant Specific List of MSOs is contained in 

Section 4. Refer to Section 4 for additional details. The method details both the determination 

of applicable plant specific MSOs and the disposition/mitigation of the MSOs using either 

deterministic methods, Fire Modeling or risk (e.g. Focused Scope Fire PRA) methods. The use 

of risk significance methods, such as a focused-scope Fire PRA is documented in Section 5. 

NEI 00-01, Revision 2 

May 2009 

15 

2 APPENDIX R REQUIREMENTS AND CONSIDERATIONS 

This section provides a general overview of the Appendix R regulatory requirements including 

the criteria for classifying the various shutdown methods. It describes the distinctions between 

redundant, alternative and dedicated shutdown capabilities and provides guidance for 

implementing these shutdown methods. In addition, the considerations dealing with a loss of 

offsite power and associated circuits are also discussed. Refer to Figure 2-1. 

2.1 REGULATORY REQUIREMENTS 

10 CFR 50 Appendix A, General Design Criterion 3 establishes the overarching goals of NRC's 

fire protection requirements. 

Criterion 3 -- Fire Protection. Structures, systems, and components important to safety 

shall be designed and located to minimize, consistent with other safety requirements, the 

probability and effect of fires and explosions. Noncombustible and heat resistant 

materials shall be used wherever practical throughout the unit, particularly in locations 

such as the containment and control room. Fire detection and fighting systems of 

appropriate capacity and capability shall be provided and designed to minimize the 

adverse effects of fires on structures, systems, and components important to safety. 

Firefighting systems shall be designed to assure that their rupture or inadvertent operation 

does not significantly impair the safety capability of these structures, systems, and 

components.

10 CFR 50.48 Appendix R establishes the regulatory requirements for protecting structures, 

systems and components important to safety, in order to satisfy the first sentence of GDC 3. 

Appendix R Section III.G establishes the safe shutdown requirements to address the third level 

of defense-in-depth. Sections III.G.1 and III.G.2 discuss the requirements for “required for hot 

shutdown” and “important to safe shutdown” and Section III.G.3 discusses the requirements for 

“alternative or dedicated” shutdown. The requirements for each of these shutdown 

classifications will be considered separately. 

The following sections discuss the regulations and distinctions regarding redundant shutdown 

methods. Requirements specifically for alternative/dedicated shutdown methods that are 

different from those used for redundant shutdown methods are discussed in Appendix D to this 

document: 
NEI 00-01, Revision 2 

May 2009 

16 

Requirements for Redundant Safe Shutdown

Section III.G.1 provides the requirements for fire protection of safe shutdown capability and 

states the following: 

III. G. Fire protection of safe shutdown capability. 

1. Fire protection features shall be provided for structures, systems, and components 

important to safe shutdown. These features shall be capable of limiting fire 

damage so that: 

a. One train of systems necessary to achieve and maintain hot shutdown conditions 

from either the control room or emergency control station(s) is free of fire 

damage; and 

b. Systems necessary to achieve and maintain cold shutdown from either the control 

room or emergency control station(s) can be repaired within 72 hours.
NEI 00-01, Revision 2 

May 2009 

17 

Figure 2-1 

Appendix R Requirements Flowchart 

Does the protection of 

systems whose function 

is required for hot 

shutdown satisfy the 

requirement of III.G.2? 

Are the cables or 

equipment located within 

the same fire area, 

protected by 3-hr fire 

barriers, outside primary 

containment? 

III.G.1 Fire protection 

features shall be provided 

for structures, systems, 

and components important 

to safe shutdown 

One train of systems 

necessary (or required) 

to achieve and maintain 

hot shutdown is free of 

fire damage (*) 

Systems necessary to 

achieve and maintain cold 

shutdown from either the 

MCR or Emergency Control 

Stations can be repaired 

within 72 hours 

III.G.2 Ensure that one 

of the redundant trains 

is free of fire damage 

(*) by one of the 

following: 

Separation of cables and equipment 

including associated non-safety circuits 

of redundant trains by a horizontal 

distance of more than 20 feet with no 

intervening combustible or fire hazards. 

(**)

Separation of cables and equipment 

including associated non-safety 

circuits of redundant trains by a fire 

barrier having a 3-hour rating 

(**) 

Ensure that fire detectors and an 

automatic fire suppression system are 

installed in the area. 

Identify and locate the cables and 

equipment, including associated nonsafety circuits that could prevent 

operation or cause mal-operation 

due to hot shorts, open circuits, or 

shorts to ground, of redundant trains 

of systems necessary to achieve and 

maintain hot shutdown 

Refer to Appendix D for the 

requirements of 

Alternative/Dedicated Shutdown 

Capability

III.G.3 Alternative or dedicated shutdown 

capability and its associated circuits, 

independent of cables, systems or 

components in the areas, room or zone 

under consideration, shall be provided. Done

Enclosure of cable and equipment 

including associated non-safety 

circuits of one redundant train in a 

fire barrier having a 1-hour rating

(**) 

Yes

No

No (***)

Yes

(*)”Free of Fire Damage” is achieved when the structure, system or component under consideration is capable of performing its intended function 

during and after the postulated fire, as needed 

 (**) Exemption Requests, Deviation Requests, LARs, GL 86-10 Fire Hazards Evaluations or Fire Protection Design Change Evaluations may be 

developed as necessary. 

(***) For non-inerted containments, provide one of the protection methods identified in Appendix R Section III.G.2 (a), (b), or (c)or provide for 20 ft 

separation with no intervening combustibles or fire hazards, fire detection and automatic suppression, systems. or non-combustible radiant energy 

shields as specified in Appendix R Section III.G.2 (d), (e), or (f)
NEI 00-01, Revision 2 

May 2009 

18 

In Section III.G.1 there are no functional requirements specifically itemized for the structures, 

systems or components. The only requirements identified are those to initially achieve and 

maintain hot shutdown and to subsequently achieve cold shutdown once any required repairs 

have been completed. 

Section III.G.1 establishes the requirement to ensure that adequate fire protection features exist 

to assure that one train of systems necessary to achieve and maintain hot shutdown is free of fire 

damage. Section III.G.1 presumes that some preexisting fire protection features have been 

provided, such as barriers (previously approved by the NRC under Appendix A to BTP APCSB 

9.5-1). 

III.G.2 Except as provided for in paragraph G.3 of this section, where cables or 

equipment, including associated non-safety circuits that could prevent operation 

or cause mal-operation due to hot shorts, open circuits, or shorts to ground, of 

redundant trains of systems necessary to achieve and maintain hot shutdown 

conditions are located within the same fire area outside of primary containment, 

one of the following means of ensuring that one of the redundant trains is free of 

fire damage shall be provided: 

a. Separation of cables and equipment and associated non-safety circuits of 

redundant trains by a fire barrier having a 3-hour rating. Structural steel 

forming a part of or supporting such fire barriers shall be protected to provide 

fire resistance equivalent to that required of the barrier; 

b. Separation of cables and equipment and associated non-safety circuits of 

redundant trains by a horizontal distance of more than 20 feet with no intervening 

combustible or fire hazards. In addition, fire detectors and automatic fire 

suppression system shall be installed in the fire area; or 

c. Enclosure of cable and equipment and associated non-safety circuits of one 

redundant train in a fire barrier having a 1-hour rating. In addition, fire 

detectors and an automatic fire suppression system shall be installed in the fire 

area; 

Inside non-inerted containments one of the fire protection means specified above or one 

of the following fire protection means shall be provided: 

d. Separation of cables and equipment and associated non-safety circuits of 

redundant trains by a horizontal distance of more than 20 feet with no intervening 

combustibles or fire hazards; 

e. Installation of fire detectors and an automatic fire suppression system in the fire 

area; or 

f. Separation of cables and equipment and associated non-safety circuits of 

redundant trains by a noncombustible radiant energy shield.
NEI 00-01, Revision 2 

May 2009 

19 

 

Section III.G.2 provides separation requirements that must be utilized where redundant trains are 

located in the same fire area. To comply with the regulatory requirements in Section III.G.1 and 

2, the analyst must determine which fire barriers are needed to provide separation essential for 

safe shutdown. Those barriers previously reviewed and approved by the NRC under Appendix 

A to APCSB 9.5-1 may be credited. Where redundant trains of systems necessary to achieve hot 

shutdown are located in the same fire area outside of primary containment, one must provide fire 

protection features consistent with the requirements of Section III.G.2.a, b, or c (III.G.2.d, e, and 

f are also acceptable options inside non-inerted containments) to protect structures, systems, 

components and cables for one train capable of achieving and maintaining hot shutdown 

conditions. One must also assure that any repairs required to equipment necessary to achieve 

and maintain cold shutdown, from either the MCR or emergency control station(s) can be made 

within 72 hours. 

Depending on a plant’s current licensing basis and Fire Protection License Condition, 

exemptions, or deviations, LARs or GL 86-10 fire hazards analyses and/or fire protection design 

change evaluations may be used to justify configurations that meet the underlying goals of 

Appendix R but not certain specific requirements. 

2.2 REGULATORY GUIDANCE ON ASSOCIATED CIRCUITS OF CONCERN 

2.2.1 To ensure that safe shutdown systems remain available to perform their intended 

functions, the post-fire safe shutdown analysis also requires that other failures be 

evaluated to ensure that the safe shutdown system functions are not defeated. The 

analysis requires that consideration be given to cable failures that may cause spurious 

operations resulting in unwanted conditions. Also, circuit failures resulting in the loss of 

support systems such as the electrical power supply from improperly coordinated circuit 

protective devices must be considered. As defined in Generic Letter 81-12, these types of 

circuits are collectively referred to as “Associated circuits of concern”.3

 

2.2.2 Associated circuits of concern need to be evaluated to determine if cable faults can 

prevent the operation or cause the mal-operation of redundant systems used to achieve 

and maintain hot shutdown or adversely affect the post-fire safe shutdown capability. 

From time to time, the NRC has issued Staff Positions (e.g., memorandum, Information 

Notices, Generic Letters, inspection findings) documenting their positions as to what 

systems they consider necessary to achieve and maintain hot shutdown conditions, as 

well as documenting what types of fire-induced faults should be considered credible for 

affecting these necessary systems. 

2.2.3 NRC GL 81-12, Fire Protection Rule (45 FR 76602, November 19, 1980), dated February 

20, 1981, provides additional clarification related to associated circuits of concern. With 

respect to these associated circuits of concern, GL 81-12 describes three types of 

associated circuits of concern. The Clarification of Generic Letter 81-12 defines 

associated circuits of concern as those cables and equipment that: 

3

 See the definition of “associated circuits of concern” in GL 81-12. 
NEI 00-01, Revision 2 

May 2009 

20 

a). Have a physical separation less than that required by Section III.G.2 of Appendix R, 

and: 

b). Have either: 

i) A common power source with the shutdown equipment (redundant or alternative) 

and the power source is not electrically protected from the circuit of concern by 

coordinated breakers, fuses, or similar devices, or 

ii) A connection to circuits of equipment whose spurious operation would adversely 

affect the shutdown capability (i.e., RHR/RCS isolation valves, ADS valves, 

PORVs, steam generator atmospheric dump valves, instrumentation, steam 

bypass, etc.), or 

iii) A common enclosure (e.g., raceway, panel, junction) with the shutdown cables 

(redundant and alternative) and, 

(1) are not electrically protected by circuit breakers, fuses or similar devices, or 

(2) will not prevent propagation of the fire into the common enclosure. 

Although protecting the fire-induced failures of associated circuits of concern is required, 

to reinforce that Generic Letter 81-12 simply provides guidance rather than requirements, 

the Clarification of Generic Letter 81-12 further states the following regarding 

alternatives for protecting the safe shutdown capability: 

The guidelines for protecting the safe shutdown capability from fire-induced failures of 

associated circuits are not requirements. These guidelines should be used only as 

guidance when needed. These guidelines do not limit the alternatives available to the 

licensee for protecting the safe shutdown capability. All proposed methods for protection 

of the shutdown capability from fire-induced failures will be evaluated by the [NRC] staff 

for acceptability. 

2.3 REGULATORY INTERPRETATION ON LOSS OF OFFSITE POWER 

2.3.1 The loss of offsite power has the potential to affect safe shutdown capability. In addition, 

the regulatory requirements for offsite power differ between the redundant and 

alternative/dedicated shutdown capability. Therefore, consideration must be given for the 

loss of offsite power when evaluating its effect on safe shutdown. The Appendix R 

requirement to consider a loss of offsite power is specified in Section III.L.3 as follows: 

The shutdown capability for specific fire areas may be unique for each such area, or it 

may be one unique combination of systems for all such areas. In either case, the 

alternative shutdown capability shall be independent of the specific fire area(s) and shall 

accommodate post-fire conditions where offsite power is available and where offsite 

power is not available for 72 hours. Procedures shall be in effect to implement this 

capability.
NEI 00-01, Revision 2 

May 2009 

21 

2.3.2 Alternative/dedicated systems must demonstrate shutdown capability where offsite power 

is available and where offsite power is not available for 72 hours. If such equipment and 

systems used prior to 72 hours after the fire will not be capable of being powered by both 

onsite and offsite electric power systems because of fire damage, an independent onsite 

power system shall be provided. Equipment and systems used after 72 hours may be 

powered by offsite power only. 

2.3.3 For redundant shutdown, offsite power may be credited if demonstrated to be free of fire 

damage, similar to other safe shutdown systems. 

2.3.4 If offsite power is postulated to be lost for a particular fire area, and is not needed for the 

required safe shutdown path for 72 hours, actions necessary for its restoration are 

considered to be performed under the purview of the emergency response organization 

and do not require the development of specific recovery strategies or procedures in 

advance. 

2.3.5 Since in an actual fire event offsite power may or may not be available, the potential 

availability of offsite power should also be considered to confirm that it does not pose a 

more challenging condition. For example, additional electric heat loads may affect 

HVAC strategies. 

NEI 00-01, Revision 2 

May 2009 

23 

3 DETERMINISTIC METHODOLOGY 

This section discusses a generic deterministic methodology and criteria that licensees can use to 

perform a post-fire safe shutdown analysis to address regulatory requirements. For a complete 

understanding of the deterministic requirements, work this section in combination with the 

information in Appendix C, High/Low Pressure Interfaces, Appendix D, Alternative and 

Dedicated Shutdown Requirements, Appendix E, Acceptance Criteria for Operator Manual 

Actions and repairs, and Appendix H, Hot Shutdown versus Important to Safe Shutdown 

Components. To resolve the industry issue related to MSOs, refer to Section 4, Appendix B, 

Appendix F and Appendix G. The plant specific analysis approved by NRC is reflected in the 

plant’s licensing basis. The methodology described in this section is an acceptable method of 

performing a post-fire safe shutdown analysis. This methodology is depicted in Figure 3-1. 

Other methods acceptable to NRC may also be used. Regardless of the method selected by an 

individual licensee, the criteria and assumptions provided in this guidance document may apply. 

The methodology described in Section 3 is based on a computer database oriented approach, 

which is utilized by several licensees to model Appendix R data relationships. This guidance 

document, however, does not require the use of a computer database oriented approach. 

The requirements of Appendix R Sections III.G.1, III.G.2 and III.G.3 apply to equipment and 

cables required for achieving and maintaining safe shutdown in any fire area. Although 

equipment and cables for fire detection and suppression systems, communications systems and 

8-hour emergency lighting systems are important features, this guidance document does not 

address them. The requirements of Appendix R Section III.G.2 do not apply to the circuits for 

fire detection and suppression systems, communications systems and 8-hour emergency lighting 

systems. 

Additional information is provided in Appendix B to this document related to the circuit failure 

criteria to be applied in assessing impacts to post-fire safe shutdown, including MSOs. The 

criteria in Appendix B developed for MSOs has also been included in Section 3.5.1.1 for 

assessing the potential affects of fire-induced impacts to individual components on the required 

safe shutdown path for a particular III.G.1 and 2 fire area. Section 4 provides the Resolution 

Methodology for determining the Plant Specific List of MSOs to be evaluated. Section 5 

provides a focused-scope Fire PRA risk methodology for assessing, on an individual basis, the 

risk significance of any MSOs determined to be impacted within a common plant fire area. The 

appropriate use of these tools for mitigating the effects of fire-induced circuit failures for this 

section and for the MSOs addressed in Section 4 and Appendix G are discussed in Appendix H. 

3.1 SAFE SHUTDOWN SYSTEMS AND PATH DEVELOPMENT 

This section discusses the identification of systems necessary to perform the required safe 

shutdown functions. It also provides information on the process for combining these systems 

into safe shutdown paths. Appendix R Section III.G.1.a requires that the capability to achieve 

and maintain hot shutdown be free of fire damage. Appendix R Section III.G.1.b requires that 

repairs to systems and equipment necessary to achieve and maintain cold shutdown be completed 

within 72 hours. This section provides some guidance on classifying components as either 

required or important to SSD circuit components. It also provides some guidance on the tools 
NEI 00-01, Revision 2 

May 2009 

24 

available for mitigating the effects of fire-induced circuit failures to each of these classes of 

equipment. For a more detailed discussion of the topic of required and important to SSD 

components refer to Appendix H. 
NEI 00-01, Revision 2 

May 2009 

25 

Establish Appendix R Requirements 

Regulatory Requirements 

Regulatory Guidance on Associated Circuits of 

concern 

Regulatory Interpretation on Loss of Offsite Power

Section 2.0 

Determine SSD Functions, Systems & Paths

Reactivity Control, Pressure Control, Inventory 

Control, DHR, Process Monitoring, Supporting 

Functions 

Include those that can defeat SSD 

 RPV/RCS Loss of Inventory (*) 

 Flow Diversion (*)/Blockage 

 Inventory Makeup System being used for 

SSD in FA 

 Decay Heat Removal being used for SSD in 

FA 

 * In excess of required makeup

Section 3.1 

Select Safe Shutdown Equipment

Equipment that may perform or defeat SSD 

functions 

Select Safe Shutdown Cables

Identify cables required for operation or that can 

cause mal-operation of listed equipment including 

improperly coordinated power circuits. 

Section 3.3 

Fire Area Assessment

Determine fire impact to equipment required for 

SSD functions and establish SSD path for each 

fire area. 

Section 3.4 

Associate cables to equipment 

Locate cable raceway & endpoints by fire area 

Join data & identify SSD cables & equipment by 

fire area 

Evaluate effects of a hot short, open circuit, & 

short to ground on each conductor for each cable. 

Refer to Section 3.5 for Circuit Analysis Criteria. 

Develop Methods for Prevention or 

Mitigation

Required Components:

1. Re-design or re-analyze the circuit or 

component to eliminate the concern 

2. Reroute Cable of Concern 

3. Protect Cable of Concern in accordance with 

III.G.2 

4. Perform Repair for Cold Shutdown only 

5. Develop Exemption 

6. Develop Deviation or LARs 

7. Perform GL 86-10 Fire Hazards Evaluation 

8. Enter Fire Protection Change Process 

9. Identify other equipment to perform same 

function 

Important to SSD Components: 

1. Perform an operator manual action 

2. Address using fire modeling or a focused-scope 

Fire PRA using the methods of Section 5 for 

MSO impacts (if permitted under current license 

conditions).

Figure 3-1 

Deterministic Guidance Methodology Overview 

Section 3.2 
NEI 00-01, Revision 2 

May 2009 

26 

The goal of post-fire safe shutdown is to assure that a one train of shutdown systems, structures, 

and components remains free of fire damage for a single fire in any single plant fire area. This 

goal is accomplished by determining those functions required to achieve and maintain hot 

shutdown. Safe shutdown systems are selected so that the capability to perform these required 

functions is a part of each safe shutdown path. The functions required for post-fire safe 

shutdown generally include, but are not limited to the following: 

 Reactivity control 

 Pressure control systems 

 Inventory control systems 

 Decay heat removal systems 

 Process monitoring (as defined in NRC Information Notice 84-09) 

 Support systems 

 Electrical power and control systems 

 Component Cooling systems 

 Component Lubrication systems 

These functions are of importance because they have a direct bearing on the safe shutdown goal 

of being able to achieve and maintain hot shutdown, which ensures the integrity of the fuel, the 

reactor pressure vessel and the primary containment. If these functions are preserved, then the 

plant will be safe because the fuel, the reactor and the primary containment will not be damaged. 

By assuring that this equipment is not damaged and remains functional, the protection of the 

health and safety of the public is assured. 

The components required to perform these functions are classified as required for hot shutdown 

components. These components are necessary and sufficient to perform the required safe 

shutdown functions assuming that fire-induced impacts to other plant equipment/cables do not 

occur. Since fire-induced impacts to other plant equipment/cables can occur in the fire 

condition, these impacts must also be addressed. The components not necessary to complete the 

required safe shutdown functions, but which could be impacted by the fire and cause a 

subsequent impact to the required safe shutdown components are classified as either required for 

hot shutdown or important to SSD components. Depending on the classification of the 

components, the tools available for mitigating the affects of fire-induced damage vary. The 

available tools are generally discussed in this section and in detail in Appendix H. The 

classification of a component or its power or control circuits may vary from fire area to fire area. 

Therefore, the required safe shutdown path for any given fire area is comprised of required for 

hot shutdown components and important to SSD components. The distinction and classification 

for each required safe shutdown path for each fire area should be discernible in the post-fire safe 

shutdown analysis. 
NEI 00-01, Revision 2 

May 2009 

27 

Generic Letter 81-12 specifies consideration of associated circuits of concern with the potential 

for spurious equipment operation and/or loss of power source, and the common enclosure 

failures. As described above, spurious operations/actuations can affect the accomplishment of 

the required safe shutdown functions listed above. Typical examples of the effects of the 

spurious operations of concern are the following: 

 A loss of reactor pressure vessel/reactor coolant inventory in excess of the safe shutdown 

makeup capability 

 A flow loss or blockage in the inventory makeup or decay heat removal systems being 

used for the required safe shutdown path. 

Spurious operations are of concern because they have the potential to directly affect the ability to 

achieve and maintain hot shutdown, which could affect the fuel and cause damage to the reactor 

pressure vessel or the primary containment. To address the issue of multiple spurious operations, 

Section 4 provides a Resolution Methodology for developing a Plant Specific List of MSOs for 

evaluation. Appendix B provides the circuit failure criteria applicable to the evaluation of the 

Plant Specific list of MSOs. 

Common power source and common enclosure concerns could also affect the safe shutdown path 

and must be addressed. 

In addition to the tools described for components classified as required for hot shutdown, fireinduced impacts to cables and components classified as important to SSD may be mitigated 

using some additional tools. For important to SSD component failures, operator manual actions, 

fire modeling and/or a focused-scope fire PRA may be used to mitigate the impact. (If the use of 

a Focused-Scope Fire PRAs is not permitted in the Plants Current License Basis, then, a License 

Amendment Request (LAR) will be necessary to use the Focused-Scope Fire PRA). 

3.1.1 CRITERIA/ASSUMPTIONS

The following criteria and assumptions should be considered, as applicable, when identifying 

systems available and necessary to perform the required safe shutdown functions and combining 

these systems into safe shutdown paths. This list provides recognized examples of 

criteria/assumptions but should not be considered an all-inclusive list. The final set of 

criteria/assumptions should be based on regulatory requirements and the performance criteria for 

post-fire safe shutdown for each plant. 

3.1.1.1 [BWR] GE Report GE-NE-T43-00002-00-01-R01 entitled “Original Safe 

Shutdown Paths For The BWR” addresses the systems and equipment 

originally designed into the GE boiling water reactors (BWRs) in the 1960s 

and 1970s, that can be used to achieve and maintain safe shutdown per 

Section III.G.1 of 10 CFR 50, Appendix R. Any of the shutdown paths 

(methods) described in this report are considered to be acceptable methods for 

achieving redundant safe shutdown. 

3.1.1.2 [BWR] GE Report GE-NE-T43-00002-00-03-R01 provides a discussion on 

the BWR Owners' Group (BWROG) position regarding the use of Safety 
NEI 00-01, Revision 2 

May 2009 

28 

Relief Valves (SRVs) and low pressure systems (LPCI/CS) for safe shutdown. 

The BWROG position is that the use of SRVs and low pressure systems is an 

acceptable methodology for achieving redundant safe shutdown in accordance 

with the requirements of 10 CFR 50 Appendix R Sections III.G.1 and III.G.2. 

The NRC has accepted the BWROG position and issued an SER dated Dec. 

12, 2000. 

3.1.1.3 [PWR] Generic Letter 86-10, Enclosure 2, Section 5.3.5 specifies that hot 

shutdown can be maintained without the use of pressurizer heaters (i.e., 

pressure control is provided by controlling the makeup/charging pumps). Hot 

shutdown conditions can be maintained via natural circulation of the RCS 

through the steam generators. The cooldown rate must be controlled to 

prevent the formation of a bubble in the reactor head. Therefore, feedwater 

(either auxiliary or emergency) flow rates as well as steam release must be 

controlled. 

3.1.1.4 The classification of shutdown capability as alternative/dedicated shutdown is 

made independent of the selection of systems used for shutdown. 

Alternative/dedicated shutdown capability is determined based on an inability 

to assure the availability of a redundant safe shutdown path. Compliance to 

the separation requirements of Sections III.G.1 and III.G.2 may be 

supplemented by the use of operator manual actions to the extent allowed by 

the regulations and the licensing basis of the plant (see Appendix E), repairs 

(cold shutdown only), exemptions, deviations, GL 86-10 fire hazards 

analysesor fire protection design change evaluations permitted by GL 86-10, 

as appropriate. These may also be used in conjunction with 

alternative/dedicated shutdown capability. A discussion of time zero for the 

fire condition, as it relates to operator manual actions and repairs, is contained 

in Appendix E. 

3.1.1.5 At the onset of the postulated fire, all safe shutdown systems (including 

applicable redundant trains) are assumed operable and available for post-fire 

safe shutdown. Systems are assumed to be operational with no repairs, 

maintenance, testing, Limiting Conditions for Operation, etc. in progress. The 

units are assumed to be operating at full power under normal conditions and 

normal lineups. 

3.1.1.6 No Final Safety Analysis Report accidents or other design basis events (e.g. 

loss of coolant accident, earthquake), single failures or non-fire-induced 

transients need be considered in conjunction with the fire. 

3.1.1.7 For the case of redundant shutdown, offsite power may be credited if 

demonstrated to be free of fire damage. Offsite power should be assumed to 

remain available for those cases where its availability may adversely impact 

safety (i.e., reliance cannot be placed on fire causing a loss of offsite power if 

the consequences of offsite power availability are more severe than its 

presumed loss). No credit should be taken for a fire causing a loss of offsite 
NEI 00-01, Revision 2 

May 2009 

29 

power. For areas where train separation cannot be achieved and alternative 

shutdown capability is necessary, shutdown must be demonstrated both where 

offsite power is available and where offsite power is not available for 72 

hours. 

3.1.1.8 Post-fire safe shutdown systems and components are not required to be safetyrelated. 

3.1.1.9 The post-fire safe shutdown analysis assumes a 72-hour coping period starting 

with a reactor scram/trip. Fire-induced impacts that provide no adverse 

consequences to hot shutdown within this 72-hour period need not be included 

in the post-fire safe shutdown analysis. At least one train can be repaired or 

made operable within 72 hours using onsite capability to achieve cold 

shutdown. 

3.1.1.10 Manual initiation from the main control room or emergency control stations of 

systems required to achieve and maintain safe shutdown is acceptable where 

permitted by current regulations or approved by NRC (See Appendix E); 

automatic initiation of systems selected for safe shutdown is not required but 

may be included as an option, if the additional cables and equipment are also 

included in the analysis. Spurious actuation of automatic systems (Safety 

Injection, Auxiliary Feedwater, High Pressure Coolant Injection, Reactor Core 

Isolation Cooling, etc.) due to fire damage, however, should be evaluated. 

3.1.1.11 Where a single fire can impact more than one unit of a multi-unit plant, the 

ability to achieve and maintain safe shutdown for each affected unit must be 

demonstrated. 

3.1.2 SHUTDOWN FUNCTIONS

The following discussion on each of these shutdown functions provides guidance for selecting 

the systems and equipment required for hot shutdown. For additional information on BWR 

system selection, refer to GE Report GE-NE-T43-00002-00-01-R01 entitled “Original Safe 

Shutdown Paths for the BWR.” 

3.1.2.1 Reactivity Control 

[BWR] Control Rod Drive System

The safe shutdown performance and design requirements for the reactivity control function can 

be met without automatic scram/trip capability. Manual scram/reactor trip is credited. The postfire safe shutdown analysis must only provide the capability to manually scram/trip the reactor. 

Each licensee should have an operator manual action to either vent the instrument air header or 

to remove RPS power in their post-fire safe shutdown procedures. The presence of this action 

precludes the need to perform circuit analysis for the reactivity control function and is an 

acceptable way to accomplish this function. If this action is a “time critical” action, the timing 

must be justified. 
NEI 00-01, Revision 2 

May 2009 

30 

[PWR] Makeup/Charging

There must be a method for ensuring that adequate shutdown margin is maintained from initial 

reactor SCRAM to cold shutdown conditions, by controlling Reactor Coolant System 

temperature and ensuring borated water is utilized for RCS makeup/charging. 

3.1.2.2 Pressure Control Systems 

The systems discussed in this section are examples of systems that can be used for pressure 

control. This does not restrict the use of other systems for this purpose. 

[BWR] Safety Relief Valves (SRVs)

Initial pressure control may be provided by the SRVs mechanically cycling at their setpoints 

(electrically cycling for EMRVs). Mechanically-actuated SRVs require no electrical analysis to 

perform their overpressure protection function. The SRVs may also be opened to maintain hot 

shutdown conditions or to depressurize the vessel to allow injection using low pressure systems. 

These are operated manually. Automatic initiation of the Automatic Depressurization System 

(ADS) is not a required function. Automatic initiation of the ADS may be credited, if available. 

If automatic ADS is not available and use of ADS is desired, an alternative means of initiation of 

ADS separate from the automatic initiation logic for accomplishing the pressure control function 

should be provided. 

[PWR] Makeup/Charging 

RCS pressure is controlled by controlling the rate of charging/makeup to the RCS. Although 

utilization of the pressurizer heaters and/or auxiliary spray reduces operator burden, neither 

component is required to provide adequate pressure control. Pressure reductions are made by 

allowing the RCS to cool/shrink, thus reducing pressurizer level/pressure. Pressure increases are 

made by initiating charging/makeup to maintain pressurizer level/pressure. Manual control of 

the related pumps is acceptable. 

3.1.2.3 Inventory Control 

[BWR] Systems selected for the inventory control function should be capable of supplying 

sufficient reactor coolant to achieve and maintain hot shutdown. Manual initiation of these 

systems is acceptable. Automatic initiation functions are not required. Spurious actuation of 

automatic systems, however, should be evaluated (High Pressure Coolant Injection, High 

Pressure Core Spray, Reactor Core Isolation Cooling, etc.). 

[PWR]: Systems selected for the inventory control function should be capable of maintaining 

level to achieve and maintain hot shutdown. Typically, the same components providing 

inventory control are capable of providing pressure control. Manual initiation of these systems is 

acceptable. Automatic initiation functions are not required. Spurious actuation of automatic 

systems, however, should be evaluated (Safety Injection, High Pressure Injection, Auxiliary 

Feedwater, Emergency Feedwater, etc.). 
NEI 00-01, Revision 2 

May 2009 

31 

3.1.2.4 Decay Heat Removal 

[BWR] Systems selected for the decay heat removal function(s) should be capable of: 

 Removing sufficient decay heat from primary containment, to prevent containment overpressurization and failure. 

 Satisfying the net positive suction head requirements of any safe shutdown systems 

taking suction from the containment (suppression pool). 

 Removing sufficient decay heat from the reactor to achieve cold shutdown. (This is not a 

hot shutdown requirement.) 

[PWR] Systems selected for the decay heat removal function(s) should be capable of: 

 Removing sufficient decay heat from the reactor to reach hot shutdown conditions. 

Typically, this entails utilizing natural circulation in lieu of forced circulation via the 

reactor coolant pumps and controlling steam release via the Atmospheric Dump valves. 

 Removing sufficient decay heat from the reactor to reach cold shutdown conditions. 

(This is not a hot shutdown requirement.) 

This does not restrict the use of other systems. 

3.1.2.5 Process Monitoring 

The process monitoring function is provided for all safe shutdown paths. IN 84-09, Attachment 

1, Section IX “Lessons Learned from NRC Inspections of Fire Protection Safe Shutdown 

Systems (10 CFR 50 Appendix R)” provides guidance on the instrumentation acceptable to and 

preferred by the NRC for meeting the process monitoring function. This instrumentation is that 

which monitors the process variables necessary to perform and control the functions specified in 

Appendix R Section III.L.1. Such instrumentation must be demonstrated to remain unaffected by 

the fire. The IN 84-09 list of process monitoring is applied to alternative/dedicated shutdown 

(III.G.3). The use of this same list for III.G.2 redundant Post-Fire Safe Shutdown is acceptable, 

but the analyst needs to review the specific license basis for the plant under evaluation. In 

general, process monitoring instruments similar to those listed below are needed to successfully 

use existing operating procedures (including Abnormal Operating Procedures). 

BWR 

• Reactor coolant level and pressure 

• Suppression pool level and temperature 

• Emergency or isolation condenser level 

• Diagnostic instrumentation for safe shutdown systems 

• Level indication for tanks needed for safe shutdown 

PWR

• Reactor coolant temperature (hot leg / cold leg) 
NEI 00-01, Revision 2 

May 2009 

32 

• Pressurizer pressure and level 

• Neutron flux monitoring (source range) 

• Level indication for tanks needed for safe shutdown 

• Steam generator level and pressure 

• Diagnostic instrumentation for safe shutdown systems 

The specific instruments required may be based on operator preference, safe shutdown 

procedural guidance strategy (symptomatic vs. prescriptive), and systems and paths selected for 

safe shutdown. 

3.1.2.6 Support Systems 

3.1.2.6.1 Electrical Systems 

AC Distribution System

Power for the Appendix R safe shutdown equipment is typically provided by a medium voltage 

system such as 4.16 KV Class 1E busses either directly from the busses or through step down 

transformers/load centers/distribution panels for 600, 480 or 120 VAC loads. For redundant safe 

shutdown performed in accordance with the requirements of Appendix R Section III.G.1 and 2, 

power may be supplied from either offsite power sources or the emergency diesel generator 

depending on which has been demonstrated to be free of fire damage. No credit should be taken 

for any beneficial effects of a fire causing a loss of offsite power. Refer to Section 3.1.1.7. 

DC Distribution System

Typically, the 125VDC distribution system supplies DC control power to various 125VDC 

control panels including switchgear breaker controls. The 125VDC distribution panels may also 

supply power to the 120VAC distribution panels via static inverters. These distribution panels 

may supply power for instrumentation necessary to complete the process monitoring functions. 

For fire events that result in an interruption of power to the AC electrical bus, the station 

batteries are necessary to supply any required control power during the interim time period 

required for the diesel generators to become operational. Once the diesels are operational, the 

125VDC distribution system can be powered from sources feed from the diesels through the 

battery chargers. 

[BWR] Certain plants are also designed with a 250VDC Distribution System that supplies 

power to Reactor Core Isolation Cooling and/or High Pressure Coolant Injection equipment. 

The DC control centers may also supply power to various small horsepower Appendix R safe 

shutdown system valves and pumps. If the DC system is relied upon to support safe shutdown 

without battery chargers being available, it must be verified that sufficient battery capacity exists 

to support the necessary loads for sufficient time (either until power is restored, or the loads are 

no longer required to operate). 
NEI 00-01, Revision 2 

May 2009 

33 

3.1.2.6.2 Cooling Systems 

Various cooling water systems are required to support safe shutdown system operation, based on 

plant specific considerations. Typical uses include: 

 RHR/SDC/DH Heat Exchanger cooling water 

 Safe shutdown pump cooling (seal coolers, oil coolers) 

 Diesel generator cooling 

3.1.2.6.3 HVAC Systems 

HVAC Systems may be required to assure that safe shutdown equipment remains within its 

operating temperature range, as specified in manufacturer’s literature or demonstrated by suitable 

test methods, and to assure protection for plant operations staff from the effects of fire (smoke, 

heat, toxic gases, and gaseous fire suppression agents). 

HVAC systems, however, are not required to support post-fire safe shutdown in all cases. The 

need for HVAC system operation is based on plant specific configurations and plant specific heat 

loads. Typical potential uses include: 

 Main control room, cable spreading room, relay room 

 ECCS pump compartments 

 Diesel generator rooms 

 Switchgear rooms 

Plant specific evaluations are necessary to determine which HVAC systems could be required or 

useful in supporting post-fire safe shutdown. Transient temperature response analyses are often 

utilized to demonstrate that specific HVAC systems would or would not be required. If HVAC 

systems are credited, the potential for adverse fire effects to the HVAC system must also be 

considered, including: 

• Dampers closing due to direct fire exposure or due to hot gases flowing through 

ventilation ducts from the fire area to an area not directly affected by the fire. Where 

provided, smoke dampers should consider similar effects from smoke. 

• Recirculation or migration of toxic conditions (e.g., smoke from the fire, suppressants 

such as Carbon Dioxide). 

In certain situations, adequate time exists to open doors to provide adequate cooling to allow 

continued equipment operation. Therefore, the list of required safe shutdown components as it 

relates to HVAC Systems may be determined based on transient temperature analysis. Should 

this analysis demonstrate that adequate time exists to open doors to provide the necessary 

cooling, this is an acceptable approach to achieving HVAC Cooling. The temperature analysis 

must demonstrate the adequacy of the cooling effect from opening the door within the specified 

time. Only those components whose operation is required to provide HVAC Cooling for 

required safe shutdown components in a time frame that cannot be justified for operator manual 

actions are considered themselves to be required safe shutdown components. This latter set of 
NEI 00-01, Revision 2 

May 2009 

34 

HVAC Cooling Components are required to meet the criteria for required safe shutdown 

components with regard to the available mitigating tools. 

3.1.3 METHODOLOGY FOR SHUTDOWN SYSTEM SELECTION

Refer to Figure 3-2 for a flowchart illustrating the various steps involved in selecting safe 

shutdown systems and developing the shutdown paths. 

The following methodology may be used to define the safe shutdown systems and paths for an 

Appendix R analysis: 

3.1.3.1 Identify safe shutdown functions 

Review available documentation to obtain an understanding of the available plant systems and 

the functions required to achieve and maintain safe shutdown. Documents such as the following 

may be reviewed: 

 Operating Procedures (Normal, Emergency, Abnormal) 

 System descriptions 

 Fire Hazard Analysis 

 Single-line electrical diagrams 

 Piping and Instrumentation Diagrams (P&IDs) 

 [BWR] GE Report GE-NE-T43-00002-00-01-R02 entitled “Original Shutdown Paths for 

the BWR” 
NEI 00-01, Revision 2 

May 2009 

35 

Step 1

Define Appendix R 

requirements. 

Refer to Figure 2-1 

Step 2

Identify safe 

shutdown functions.

Step 3

Identify combinations of systems that 

satisfy each safe shutdown function. 

Step 4

Define combination of 

systems for each 

shutdown path. 

Step 5

Assign shutdown path to 

each combination of 

systems. 

Refer to Attachment 1 

for an example of a Safe 

Shutdown Path 

Development List. 

Additional 

support systems 

based on Step 4 

of Fig. 3-3 

Figure 3-2 

Safe Shutdown System Selection and Path Development 
NEI 00-01, Revision 2 

May 2009 

36 

3.1.3.2 Identify Combinations of Systems That Satisfy Each Safe Shutdown 

Function 

Given the criteria/assumptions defined in Section 3.1.1, identify the available combinations of 

systems capable of achieving the safe shutdown functions of reactivity control, pressure control, 

inventory control, decay heat removal, process monitoring and support systems such as electrical 

and cooling systems (refer to Section 3.1.2). This selection process does not restrict the use of 

other systems. In addition to achieving the required safe shutdown functions, consider other 

equipment whose mal-operation or spurious operation could impact the required safe shutdown 

function. The components in this latter set are classified as either required for hot shutdown or 

as important to SSD as explained in Appendix H. 

3.1.3.3 Define Combination of Systems for Each Safe Shutdown Path 

Select combinations of systems with the capability of performing all of the required safe 

shutdown functions and designate this set of systems as a safe shutdown path. In many cases, 

paths may be defined on a divisional basis since the availability of electrical power and other 

support systems must be demonstrated for each path. During the equipment selection phase, 

identify any additional support systems and list them for the appropriate path. 

3.1.3.4 Assign Shutdown Paths to Each Combination of Systems 

Assign a path designation to each combination of systems. The path will serve to document the 

combination of systems relied upon for safe shutdown in each fire area. Refer to Attachment 1 

to this document for an example of a table illustrating how to document the various combinations 

of systems for selected shutdown paths. 

3.2 SAFE SHUTDOWN EQUIPMENT SELECTION 

The previous section described the methodology for selecting the systems and paths necessary to 

achieve and maintain safe shutdown for an exposure fire event (see Section 5.0 DEFINITIONS 

for “Exposure Fire”). This section describes the criteria/assumptions and selection methodology 

for identifying the specific safe shutdown equipment necessary for the systems to perform their 

Appendix R functions. The selected equipment should be related back to the safe shutdown 

systems that they support and be assigned to the same safe shutdown path as that system. The 

list of safe shutdown equipment will then form the basis for identifying the cables necessary for 

the operation or that can cause the mal-operation of the safe shutdown systems. For each path it 

will be important to understand which components are classified as required safe shutdown 

components and which are classified as important to safe shutdow components. When 

evaluating the fire-induced impact to each affected cable/component in each fire area, this 

classification dictates the tools available for mitigation the affects. 
NEI 00-01, Revision 2 

May 2009 

37 

3.2.1 CRITERIA/ASSUMPTIONS

Consider the following criteria and assumptions when identifying equipment necessary to 

perform the required safe shutdown functions: 

3.2.1.1 Safe shutdown equipment can be divided into two categories. Equipment may 

be categorized as (1) primary components or (2) secondary components. 

Typically, the following types of equipment are considered to be primary 

components: 

 Pumps, motor operated valves, solenoid valves, fans, gas bottles, 

dampers, unit coolers, etc. 

 All necessary process indicators and recorders (i.e., flow indicator, 

temperature indicator, turbine speed indicator, pressure indicator, level 

recorder) 

 Power supplies or other electrical components that support operation 

of primary components (i.e., diesel generators, switchgear, motor 

control centers, load centers, power supplies, distribution panels, etc.). 

Secondary components are typically items found within the circuitry for a 

primary component. These provide a supporting role to the overall circuit 

function. Some secondary components may provide an isolation function or a 

signal to a primary component via either an interlock or input signal 

processor. Examples of secondary components include flow switches, 

pressure switches, temperature switches, level switches, temperature elements, 

speed elements, transmitters, converters, controllers, transducers, signal 

conditioners, hand switches, relays, fuses and various instrumentation devices. 

3.2.1.2 Assume that exposure fire damage to manual valves and piping does not 

adversely impact their ability to perform their pressure boundary or safe 

shutdown function (heat sensitive piping materials, including tubing with 

brazed or soldered joints, are not included in this assumption). Fire damage 

should be evaluated with respect to the ability to manually open or close the 

valve should this be necessary as a part of the post-fire safe shutdown 

scenario. For example, post-fire coefficients of friction for rising stem valves 

cannot be readily determined. Handwheel sizes and rim pulls are based on 

well lubricated stems. Any post-fire operation of a rising stem valve should 

be well justified using an engineering evaluation. 
NEI 00-01, Revision 2 

May 2009 

38 

3.2.1.3 Assume that all components, including manual valves, are in their normal 

position as shown on P&IDs or in the plant operating procedures, that there 

are no LCOs in effect, that the Unit is operating at 100% power and that no 

equipment has been taken out of service for maintenance. 

3.2.1.4 Assume that a check valve closes in the direction of potential flow diversion 

and seats properly with sufficient leak tightness to prevent flow diversion. 

Therefore, check valves do not adversely affect the flow rate capability of the 

safe shutdown systems being used for inventory control, decay heat removal, 

equipment cooling or other related safe shutdown functions. 

3.2.1.5 Instruments (e.g., resistance temperature detectors, thermocouples, pressure 

transmitters, and flow transmitters) are assumed to fail upscale, midscale, or 

downscale as a result of fire damage, whichever is worse. An instrument 

performing a control function is assumed to provide an undesired signal to the 

control circuit. 

3.2.2 METHODOLOGY FOR EQUIPMENT SELECTION

Refer to Figure 3-3 for a flowchart illustrating the various steps involved in selecting safe 

shutdown equipment. 

Use the following methodology to select the safe shutdown equipment for a post-fire safe 

shutdown analysis: 

3.2.2.1 Identify the System Flow Path for Each Shutdown Path 

Mark up and annotate a P&ID to highlight the specific flow paths for each system in support of 

each shutdown path. Refer to Attachment 2 for an example of an annotated P&ID illustrating 

this concept. When developing the SSEL, determine which equipment should be included on the 

Safe Shutdown Equipment List (SSEL). As an option, include secondary components with a 

primary component(s) that would be affected by fire damage to the secondary component. By 

doing this, the SSEL can be kept to a manageable size and the equipment included on the SSEL 

can be readily related to required post-fire safe shutdown systems and functions. 
NEI 00-01, Revision 2 

May 2009 

39 

3.2.2.2 Identify the Equipment in Each Safe Shutdown System Flow Path 

Including Equipment That May Spuriously Operate and Affect System 

Operation 

Review the applicable documentation (e.g. P&IDs, electrical drawings, instrument loop 

diagrams) to assure that all equipment in each system’s flow path has been identified. Assure 

that any equipment that could spuriously operate and adversely affect the desired system 

function(s) is also identified. Additionally, refer to Section 4 for the Resolution Methodology for 

determining the Plant Specific List of MSOs requiring evaluation. Criteria for making the 

determination as to which of these components are to be classified as required for hot shutdown 

or as important to SSD is contained in Appendix H. If additional systems are identified which 

are necessary for the operation of the safe shutdown system under review, include these as 

required for hot shutdown systems. Designate these new systems with the same safe shutdown 

path as the primary safe shutdown system under review (Refer to Figure 3-1). 

3.2.2.3 Develop a List of Safe Shutdown Equipment and Assign the 

Corresponding System and Safe Shutdown Path(s) Designation to Each. 

Prepare a table listing the equipment identified for each system and the shutdown path that it 

supports. Identify any valves or other equipment that could spuriously operate and impact the 

operation of that safe shutdown system. Criteria for making the determination as to which of 

these components are to be classified as required for hot shutdown or as important to SSD is 

contained in Appendix H. Assign the safe shutdown path for the affected system to this 

equipment. During the cable selection phase, identify additional equipment required to support 

the safe shutdown function of the path (e.g., electrical distribution system equipment). Include 

this additional equipment in the safe shutdown equipment list. Attachment 3 to this document 

provides an example of a (SSEL). The SSEL identifies the list of equipment within the plant 

considered for post-fire safe shutdown and it documents various equipment-related attributes 

used in the analysis. 

Identify instrument tubing that may cause subsequent effects on instrument readings or signals as 

a result of fire. Determine and consider the fire area location of the instrument tubing when 

evaluating the effects of fire damage to circuits and equipment in the fire area. 

3.2.2.4 Identify Equipment Information Required for the Safe Shutdown 

Analysis 

Collect additional equipment-related information necessary for performing the post-fire safe 

shutdown analysis for the equipment. In order to facilitate the analysis, tabulate this data for 

each piece of equipment on the SSEL. Refer to Attachment 3 to this document for an example of 

a SSEL. Examples of related equipment data should include the equipment type, equipment 

description, safe shutdown system, safe shutdown path, drawing reference, fire area, fire zone, 

and room location of equipment. Other information such as the following may be useful in 

performing the safe shutdown analysis: normal position, hot shutdown position, cold shutdown 

position, failed air position, failed electrical position, high/low pressure interface concern, and 
NEI 00-01, Revision 2 

May 2009 

40 

spurious operation concern. Criteria for making the determination as to which of these 

components are to be classified as required for hot shutdown or as important to SSD is contained 

in Appendix H. 

3.2.2.5 Identify Dependencies Between Equipment, Supporting Equipment, Safe 

Shutdown Systems and Safe Shutdown Paths. 

In the process of defining equipment and cables for safe shutdown, identify additional supporting 

equipment such as electrical power and interlocked equipment. As an aid in assessing identified 

impacts to safe shutdown, consider modeling the dependency between equipment within each 

safe shutdown path either in a relational database or in the form of a Safe Shutdown Logic 

Diagram (SSLD). Attachment 4 provides an example of a SSLD that may be developed to 

document these relationships. 
NEI 00-01, Revision 2 

May 2009 

41 

Step 1

Define proposed shutdown 

paths.

Step 2

Identify the system flow path 

for each shutdown path. 

Step 3

Identify combinations of 

equipment that satisfy each 

safe shutdown function. 

Step 5

Develop a list of safe shutdown 

equipment and assign the 

corresponding system and 

shutdown path(s). 

Step 6

Identify equipment 

information related to the 

safe shutdown analysis. 

Refer to Attachment 2 for 

an example of an 

annotated P&ID. 

Additional 

equipment found 

from cable 

selection 

Refer to Step 5 in 

Fig. 3-4. 

Step 7

Identify dependencies 

between equipment, support 

equipment, systems and 

paths.

Step 4

Is any equipment 

part of other 

systems? 

Refer to Attachment 3 

for an example of a 

Safe Shutdown 

Equipment List 

Refer to Attachment 4 

for an example of a 

Safe Shutdown Logic 

Diagram 

Refer to 

Step 4 in 

Fig. 3-2.

Yes

No

Figure 3-3 

Safe Shutdown Equipment Selection 
NEI 00-01, Revision 2 

May 2009 

42 

3.3 SAFE SHUTDOWN CABLE SELECTION AND LOCATION 

This section provides industry guidance on one acceptable approach for selecting safe shutdown 

cables and determining their potential impact on equipment required for achieving and 

maintaining safe shutdown of an operating nuclear power plant for the condition of an exposure 

fire. The Appendix R safe shutdown cable selection criteria are developed to ensure that all 

cables that could affect the proper operation or that could cause the mal-operation of safe 

shutdown equipment are identified and that these cables are properly related to the safe shutdown 

equipment whose functionality they could affect. Through this cable-to-equipment relationship, 

cables become part of the safe shutdown path assigned to the equipment affected by the cable. 

The classification of a cable as either an important to SSD circuit cable or a required safe 

shutdown cable is also derived from the classification applied to the component that it supports. 

This classification can vary from one fire area to another depending on the approach used to 

accomplish post-fire safe shutdown in the area. Refer to Appendix H for the criteria to be used 

for classifying required and important to SSD components. 

3.3.1 CRITERIA/ASSUMPTIONS

To identify an impact to safe shutdown equipment based on cable routing, the equipment must 

have cables that affect it identified. Carefully consider how cables are related to safe shutdown 

equipment so that impacts from these cables can be properly assessed in terms of their ultimate 

impact on safe shutdown components, systems and functions. 

Consider the following criteria when selecting cables that impact safe shutdown equipment: 

3.3.1.1.1 The list of cables whose failure could impact the operation of a piece of 

safe shutdown equipment includes more than those cables connected to the 

equipment. The relationship between cable and affected equipment is 

based on a review of the electrical or elementary wiring diagrams. To 

assure that all cables that could affect the operation of the safe shutdown 

equipment are identified, investigate the power, control, instrumentation, 

interlock, and equipment status indication cables related to the equipment. 

Review additional schematic diagrams to identify additional cables for 

interlocked circuits that also need to be considered for their impact on the 

ability of the equipment to operate as required in support of post-fire safe 

shutdown. As an option, consider applying the screening criteria from 

Section 3.5 as a part of this section. 

3.3.1.1.2 In cases where the failure (including spurious operations) of a single cable 

could impact more than one piece of safe shutdown equipment, associate 

the cable with each piece of safe shutdown equipment. 

3.3.1.1.2.1 Electrical devices such as relays, switches and signal resistor units 

are considered to be acceptable isolation devices. In the case of 

instrument loops and electrical metering circuits, review the 
NEI 00-01, Revision 2 

May 2009 

43 

isolation capabilities of the devices in the loop to determine that an 

acceptable isolation device has been installed at each point where 

the loop must be isolated so that a fault would not impact the 

performance of the safe shutdown instrument function. Refer to 

Section 3.5 for the types of faults that should be considered when 

evaluating the acceptability of the isolation device being credited. 

3.3.1.1.3 Screen out cables for circuits that do not impact the safe shutdown 

function of a component (i.e., annunciator circuits, space heater circuits 

and computer input circuits) unless some reliance on these circuits is 

necessary. To be properly screened out, however, the circuits associated 

with these devices must be isolated from the component’s control scheme 

in such a way that a cable fault would not impact the performance of the 

circuit. Refer to Section 3.5 for the types of faults that should be 

considered when evaluating the acceptability of the isolation device being 

credited. 

3.3.1.1.4 For each circuit requiring power to perform its safe shutdown function, 

identify the cable supplying power to each safe shutdown and/or required 

interlock component. Initially, identify only the power cables from the 

immediate upstream power source for these interlocked circuits and 

components (i.e., the closest power supply, load center or motor control 

center). Review further the electrical distribution system to capture the 

remaining equipment from the electrical power distribution system 

necessary to support delivery of power from either the offsite power 

source or the emergency diesel generators (i.e., onsite power source) to the 

safe shutdown equipment. Add this equipment to the safe shutdown 

equipment list. The set of cables described above are classified as 

required safe shutdown cables. Evaluate the power cables for breaker 

coordination concerns. The non-safe shutdown cables off of the safe 

shutdown buses are classified as required for hot shutdown or as important 

to SSD based on the criteria contained in Appendix H. 

3.3.1.1.4.1 The automatic initiation logics for the credited post-fire safe 

shutdown systems are generally not required to support safe 

shutdown. Typically, each system can be controlled manually by 

operator actuation in the main control room or emergency control 

station. The emergency control station includes those plant 

locations where control devices, such as switches, are installed for 

the purpose of operating the equipment. If operator actions to 

manually manipulate equipment at locations outside the MCR or 

the emergency control station are necessary, those actions must 

conform to the regulatory requirements on operator manual actions 

(See Appendix E). If not protected from the effects of fire, the 

fire-induced failure of automatic initiation logic circuits should be 

considered for their potential to adversely affect any post-fire safe 

shutdown system function. 
NEI 00-01, Revision 2 

May 2009 

44 

3.3.1.1.5 Cabling for the electrical distribution system is a concern for those 

breakers that feed circuits and are not fully coordinated with upstream 

breakers. With respect to electrical distribution cabling, two types of 

cable associations exist. For safe shutdown considerations, the direct 

power feed to a primary safe shutdown component is associated with the 

primary component and classified as a required safe shutdown cable. For 

example, the power feed to a pump is necessary to support the pump. 

Similarly, the power feed from the load center to an MCC supports the 

MCC. However, for cases where sufficient branch-circuit coordination is 

not provided, the same cables discussed above would also support the 

power supply. For example, the power feed to the pump discussed above 

would support the bus from which it is fed because, for the case of a 

common power source analysis, the concern is the loss of the upstream 

power source and not the connected load. Similarly, the cable feeding the 

MCC from the load center would also be necessary to support the load 

center. Additionally, the non-safe shutdown circuits off of each of the 

required safe shutdown components in the electrical distribution system 

can impact safe shutdown if not properly coordinated. These cables are 

classified as required for hot shutdown based on the criteria contained in 

Appendix H. 

3.3.1.1.6 Exclusion analysis may be used to demonstrate a lack of potential for any 

impacts to post-fire safe shutdown from a component or group of 

components regardless of the cable routing. For these cases, rigorous 

cable searching and cable to component associations may not be required. 

3.3.2 ASSOCIATED CIRCUIT OF CONCERN CABLES

Appendix R, through the guidance provided in NRC Generic Letter 81-12, requires that 

separation features be provided for associated non-safety circuits that could prevent operation or 

cause mal-operation due to hot shorts, open circuits, or shorts to ground, of redundant trains of 

systems necessary to achieve hot shutdown. The three types of associated circuits were 

identified in Reference 7.1.5 and further clarified in a NRC memorandum dated March 22, 1982 

from R. Mattson to D. Eisenhut, Reference 7.1.6. They are as follows: 

 Spurious actuations4 

 Common power source 

 Common enclosure. 

Each of these cables is classified as an associated circuit of concern cable. 

Cables Whose Failure May Cause Spurious Operations

 

4

 As explained in NRC RIS 2005-30 and in Appendix H, components whose spurious operations could directly 

prevent the required safe shutdown path in any fire area from performing its required hot shutdown function are 

classified as required for hot shutdown components. Components whose spurious operation could affect 

important to safe shutdown components might be associated circuits of concern for spurious actuation. 
NEI 00-01, Revision 2 

May 2009 

45 

Safe shutdown system spurious operation concerns can result from fire damage to a cable whose 

failure could cause the spurious operation/mal-operation of equipment whose operation could 

affect safe shutdown. These cables are identified in Section 3.3.3 together with the remaining 

safe shutdown cables required to support control and operation of the equipment. 

Common Power Source Cables

The concern for the common power source associated circuits of concern is the loss of a safe 

shutdown power source due to inadequate breaker/fuse coordination. In the case of a fireinduced cable failure on a non-safe shutdown load circuit supplied from the safe shutdown power 

source, a lack of coordination between the upstream supply breaker/fuse feeding the safe 

shutdown power source and the load breaker/fuse supplying the non-safe shutdown faulted 

circuit can result in loss of the safe shutdown bus. This would result in the loss of power to the 

safe shutdown equipment supplied from that power source preventing the safe shutdown 

equipment from performing its required safe shutdown function. Identify these cables together 

with the remaining safe shutdown cables required to support control and operation of the 

equipment. Refer to Section 3.5.2.4 for an acceptable methodology for analyzing the impact of 

these cables on post-fire safe shutdown.

Common Enclosure Cables

The concern with common enclosure associated circuits of concern is fire damage to a cable 

whose failure could propagate to other safe shutdown cables in the same enclosure either because 

the circuit is not properly protected by an isolation device (breaker/fuse) such that a fire-induced 

fault could result in ignition along its length, or by the fire propagating along the cable and into 

an adjacent fire area. This fire spread to an adjacent fire area could impact safe shutdown 

equipment in that fire area, thereby resulting in a condition that exceeds the criteria and 

assumptions of this methodology (i.e., multiple fires). Refer to Section 3.5.2.5 for an acceptable 

methodology for analyzing the impact of these cables on post-fire safe shutdown. 

3.3.3 METHODOLOGY FOR CABLE SELECTION AND LOCATION

Refer to Figure 3-4 for a flowchart illustrating the various steps involved in selecting the cables 

necessary for performing a post-fire safe shutdown analysis. 

Use the following methodology to define the cables required for safe shutdown including cables 

that may be circuits of concerns for a post-fire safe shutdown analysis. Criteria for making the 

determination as to which circuits are to be classified as required for hot shutdown or as 

important to SSD is contained in Appendix H. 

3.3.3.1 Identify Circuits Necessary for the Operation of the Safe Shutdown 

Equipment 

For each piece of safe shutdown equipment defined in section 3.2, review the appropriate 

electrical diagrams including the following documentation to identify the circuits (power, 

control, instrumentation) required for operation or whose failure may impact the operation of 

each piece of equipment: 
NEI 00-01, Revision 2 

May 2009 

46 

 Single-line electrical diagrams 

 Elementary wiring diagrams 

 Electrical connection diagrams 

 Instrument loop diagrams. 

For electrical power distribution equipment such as power supplies, identify any circuits whose 

failure may cause a coordination concern for the bus under evaluation. 

If power is required for the equipment, include the closest upstream power distribution source on 

the safe shutdown equipment list. Through the iterative process described in Figures 3-2 and 3-

3, include the additional upstream power sources up to either the offsite or the emergency power 

source. 

3.3.3.2 Identify Interlocked Circuits and Cables Whose Spurious Operation or 

Mal-operation Could Affect Shutdown 

In reviewing each control circuit, investigate interlocks that may lead to additional circuit 

schemes, cables and equipment. Assign to the equipment any cables for interlocked circuits that 

can affect the equipment. 
NEI 00-01, Revision 2 

May 2009 

47 

Figure 3-4 

Safe Shutdown Cable Selection

Step 1

Define safe shutdown equipment 

Refer to Figure 3-3 

Step 2

Identify circuits (power, control, 

instrumentation) required for the operation 

of each safe shutdown equipment. (*) 

Step 4

Identify interlocked circuits and cables 

whose failure may cause spurious 

actuations. (*) 

Step 7

Assign cables to equipment. 

Step 8

Identify routing of cables. 

Step 3

Identify equipment whose spurious 

operation or mal-operation could affect 

safe shutdown 

Step 5

Step 9

Identify location of cables by fire area. 

Is power required 

for equipment 

operation?

Yes

No

Step 6

Identify closest 

upstream power supply 

and verify that it is on 

the safe shutdown list.

Refer to Step 5 in Figure 3-3 

(*) For electrical distribution equipment including power 

supplies, identify circuits whose failure may cause a 

coordination concern for the bus under evaluation. 
NEI 00-01, Revision 2 

May 2009 

48 

While investigating the interlocked circuits, additional equipment or power sources may be 

discovered. Include these interlocked equipment or power sources in the safe shutdown 

equipment list (refer to Figure 3-3) if they can impact the operation of the equipment under 

consideration in an undesirable manner that impacts post-fire safe shutdown. 

3.3.3.3 Assign Cables to the Safe Shutdown Equipment 

Given the criteria/assumptions defined in Section 3.3.1, identify the cables required to operate or 

that may result in mal-operation of each piece of safe shutdown equipment. Cables are classified 

as either required for hot shutdown or important to SSD based on the classification of the 

component to which they are associated and the function of that component in supporting postfire safe shutdown in each particular fire area. Refer to Appendix H for additional guidance. 

Tabulate the list of cables potentially affecting each piece of equipment in a relational database 

including the respective drawing numbers, their revision and any interlocks that are investigated 

to determine their impact on the operation of the equipment. In certain cases, the same cable 

may support multiple pieces of equipment. Relate the cables to each piece of equipment, but not 

necessarily to each supporting secondary component. 

If adequate coordination does not exist for a particular circuit, relate the power cable to the 

power source. This will ensure that the power source is identified as affected equipment in the 

fire areas where the cable may be damaged. Criteria for making the determination as to which 

cables are to be classified as required for hot shutdown or as important to SSD is contained in 

Appendix H. 

3.3.3.4 Identify Routing of Cables 

Identify the routing for each cable including all raceway and cable endpoints. Typically, this 

information is obtained from joining the list of safe shutdown cables with an existing cable and 

raceway database. 

3.3.3.5 Identify Location of Raceway and Cables by Fire Area 

Identify the fire area location of each raceway and cable endpoint identified in the previous step 

and join this information with the cable routing data. For raceway and cable endpoints in 

multiple fire areas, each fire area where the raceway or cable endpoint exists must be included. 

In addition, identify the location of field-routed cable by fire area. This produces a database 

containing all of the cables requiring fire area analysis, their locations by fire area, and their 

raceway. 

3.4 FIRE AREA ASSESSMENT AND COMPLIANCE STRATEGIES 

By determining the location of each component and cable by fire area and using the cable to 

equipment relationships described above, the affected safe shutdown equipment in each fire area 

can be determined. Using the list of affected equipment in each fire area, the impacts to safe 

shutdown systems, paths and functions can be determined. Based on an assessment of the 

number and types of these impacts, the required safe shutdown path for each fire area can be 
NEI 00-01, Revision 2 

May 2009 

49 

determined. The specific impacts to the selected safe shutdown path can be evaluated using the 

circuit analysis and evaluation criteria contained in Section 3.5 of this document. Knowing 

which components and systems are performing which safe shutdown functions, the required and 

important to SSD components can be classified. Once these component classifications have been 

made the tools available for mitigating the affects of fire induced damage can be selected. Refer 

to Appendix H for additional guidance on classifying components as either required for hot 

shutdown or important to safe shutdown. For MSOs the Resolution Methodology outlined in 

Section 4, Section 5, Appendix B and Appendix G should be applied. Components in each MSO 

are classified as either required for hot shutdown or important to safe shutdown components 

using the criteria from Appendix H. Similarly, this classification determines the available tools 

for mitigating the affects of fire-induced damage to the circuits for these components. 

Having identified all impacts to the required safe shutdown path in a particular fire area, this 

section provides guidance on the techniques available for individually mitigating the effects of 

each of the potential impacts. 

3.4.1 CRITERIA/ASSUMPTIONS

The following criteria and assumptions apply when performing "deterministic" fire area 

compliance assessment to mitigate the consequences of the circuit failures identified in the 

previous sections for the required safe shutdown path in each fire area. 

3.4.1.1 Assume only one fire in any single fire area at a time. 

3.4.1.2 Assume that the fire may affect all unprotected cables and equipment within 

the fire area. This assumes that neither the fire size nor the fire intensity is 

known. This is conservative and bounds the exposure fire that is postulated in 

the regulation. 

3.4.1.3 Address all cable and equipment impacts affecting the required safe shutdown 

path in the fire area. All potential impacts within the fire area must be 

addressed. The focus of this section is to determine and assess the potential 

impacts to the required safe shutdown path selected for achieving post-fire 

safe shutdown and to assure that the required safe shutdown path for a given 

fire area is properly protected. 

3.4.1.4 Use the criteria from Appendix H to classify each impacted cable/component 

as either a required or important to SSD cable/component. 

3.4.1.5 Use operator manual actions where appropriate, for cable/component impacts 

classified as important to SSD cable/components, to achieve and maintain 

post-fire safe shutdown conditions in accordance with NRC requirements 

(refer to Appendix E). For additional criteria to be used when determining 

whether an operator manual action may be used for a flow diversion off of the 

primary flow path, refer to Appendix H. 

3.4.1.6 Where appropriate to achieve and maintain cold shutdown within 72 hours, 

use repairs to equipment required in support of post-fire shutdown. 
NEI 00-01, Revision 2 

May 2009 

50 

3.4.1.7 For the components on the required safe shutdown path classified as required 

hot shutdown components as defined in Appendix H, Appendix R compliance 

requires that one train of systems necessary to achieve and maintain hot 

shutdown conditions from either the control room or emergency control 

station(s) is free of fire damage (III.G.1.a). When cables or equipment are 

within the same fire area outside primary containment and separation does not 

already exist, provide one of the following means of separation for the 

required safe shutdown components impacted circuit(s): 

 Separation of cables and equipment and associated non-safety circuits 

of redundant trains within the same fire area by a fire barrier having a 

3-hour rating (III.G.2.a) 

 Separation of cables and equipment and associated non-safety circuits 

of redundant trains within the same fire area by a horizontal distance 

of more than 20 feet with no intervening combustibles or fire hazards. 

In addition, fire detectors and an automatic fire suppression system 

shall be installed in the fire area (III.G.2.b). 

 Enclosure of cable and equipment and associated non-safety circuits of 

one redundant train within a fire area in a fire barrier having a onehour rating. In addition, fire detectors and an automatic fire 

suppression system shall be installed in the fire area (III.G.2.c). 

For fire areas inside non-inerted containments, the following additional 

options are also available: 

 Separation of cables and equipment and associated non-safety circuits 

of redundant trains by a horizontal distance of more than 20 feet with 

no intervening combustibles or fire hazards (III.G.2.d); 

 Installation of fire detectors and an automatic fire suppression system 

in the fire area (III.G.2.e); or 

 Separation of cables and equipment and associated non-safety circuits 

of redundant trains by a noncombustible radiant energy shield 

(III.G.2.f). 

Use exemptions, deviations, LARs and licensing change processes to satisfy 

the requirements mentioned above and to demonstrate equivalency depending 

upon the plant's license requirements. 

3.4.1.8 Consider selecting other equipment that can perform the same safe shutdown 

function as the impacted equipment. In addressing this situation, each 

equipment impact, including spurious operation, is to be addressed in 

accordance with regulatory requirements and the NPP’s current licensing 

basis. With respect to MSOs, the criteria in Section 4, Appendix B, Appendix 

G and Appendix H should be used. 
NEI 00-01, Revision 2 

May 2009 

51 

3.4.1.9 Consider the effects of the fire on the density of the fluid in instrument tubing 

and any subsequent effects on instrument readings or signals associated with 

the protected safe shutdown path in evaluating post-fire safe shutdown 

capability. This can be done systematically or via procedures such as 

Emergency Operating Procedures. 

3.4.2 METHODOLOGY FOR FIRE AREA ASSESSMENT

Refer to Figure 3-5 for a flowchart illustrating the various steps involved in performing a fire 

area assessment. 

Use the following methodology to assess the impact to safe shutdown and demonstrate Appendix 

R compliance: 

3.4.2.1 Identify the Affected Equipment by Fire Area 

Identify the safe shutdown cables, equipment and systems located in each fire area that may be 

potentially damaged by the fire. Provide this information in a report format. The report may be 

sorted by fire area and by system in order to understand the impact to each safe shutdown path 

within each fire area (see Attachment 5 for an example of an Affected Equipment Report). 

3.4.2.2 Determine the Shutdown Paths Least Impacted By a Fire in Each Fire 

Area 

Based on a review of the systems, equipment and cables within each fire area, determine which 

shutdown paths are either unaffected or least impacted by a postulated fire within the fire area. 

Typically, the safe shutdown path with the least number of cables and equipment in the fire area 

would be selected as the required safe shutdown path. Consider the circuit failure criteria and 

the possible mitigating strategies, however, in selecting the required safe shutdown path in a 

particular fire area. Review support systems as a part of this assessment since their availability 

will be important to the ability to achieve and maintain safe shutdown. For example, impacts to 

the electric power distribution system for a particular safe shutdown path could present a major 

impediment to using a particular path for safe shutdown. By identifying this early in the 

assessment process, an unnecessary amount of time is not spent assessing impacts to the frontline 

systems that will require this power to support their operation. Determine which components are 

required hot shutdown components and which components are important to SSD components 

using the guidance in Appendix H. 

Based on an assessment as described above, designate the required safe shutdown path(s) for the 

fire area. Classify the components on the required safe shutdown path necessary to perform the 

required safe shutdown functions as required safe shutdown components. Identify all equipment 

not in the safe shutdown path whose spurious operation or mal-operation could affect the 

shutdown function. Criteria for classifying these components as required for hot shutdown or as 

important to SSD is contained in Appendix H. Include the affected cables in the shutdown 

function list. For each of the safe shutdown cables (located in the fire area) that are part of the 

required safe shutdown path in the fire area, perform an evaluation to determine the impact of a 
NEI 00-01, Revision 2 

May 2009 

52 

fire-induced cable failure on the corresponding safe shutdown equipment and, ultimately, on the 

required safe shutdown path. 

When evaluating the safe shutdown mode for a particular piece of equipment, it is important to 

consider the equipment’s position for the specific safe shutdown scenario for the full duration of 

the shutdown scenario. It is possible for a piece of equipment to be in two different states 

depending on the shutdown scenario or the stage of shutdown within a particular shutdown 

scenario. Document information related to the normal and shutdown positions of equipment on 

the safe shutdown equipment list. 
NEI 00-01, Revision 2 

May 2009 

53 

Figure 3-5 

Fire Area Assessment Flowchart 

Step 1

Identify and locate safe 

shutdown cables by fire area.

Step 2

Determine the cables and 

equipment affected in the fire area.

Step 4

Determine the equipment impacts to the 

Required Safe Shutdown Path using the 

circuit failure criteria in Section 3.5. 

Step 5

Develop a compliance strategy or disposition to mitigate the 

effects due to fire damage to each required equipment or 

cable. 

Refer to Attachment 5 

for an example of an 

Affected Equipment 

Report by fire area. 

Step 6

Document the compliance strategy 

or disposition determined to 

mitigate the effects of the potential 

fire damage to each piece of 

equipment or cable of the required 

safe shutdown path. 

Step 3

Determine the shutdown path least impacted by 

the fire in each fire area and designate it as the 

Required Safe Shutdown Path. 

Required Components:

1. Re-design the circuit or component to eliminate the concern 

2. Reroute Cable of Concern 

3. Protect Cable of Concern in accordance with III.G.2 

4. Perform Repair for Cold Shutdown only 

5. Develop Exemption 

6. Develop Deviation or LARs 

7. Perform GL 86-10 Fire Hazards Evaluation 

8. Enter Fire Protection Change Process 

9. Identify other equipment to perform same function 

Important to Safe Shutdown Components

Refer to Attachment 6 for an 

example of a Fire Area 

: Assessment Report 

1. Perform an operator manual action 

2. Address using fire modeling or a focused-scope Fire PRA using 

the methods of Section 5 for MSO impacts.*

* Seek regulatory approval where necessary 
NEI 00-01, Revision 2 

May 2009 

54 

 

3.4.2.3 Determine Safe Shutdown Equipment Impacts 

Using the circuit analysis and evaluation criteria contained in Section 3.5 of this document, 

determine the equipment that can impact safe shutdown and that can potentially be impacted by a 

fire in the fire area, and what those possible impacts are. 

3.4.2.4 Develop a Compliance Strategy or Disposition to Mitigate the Effects Due 

to Fire Damage to Each Required Component or Cable 

The available deterministic methods for mitigating the effects of circuit failures are summarized 

as follows (see Figure 1-1): 

Required for Hot Shutdown Components: 

 Re-design the circuit or component to eliminate the concern. This option will 

require a revision to the post-fire safe shutdown analysis. 

 Re-route the cable of concern. This option will require a revision to the post-fire 

safe shutdown analysis. 

 Protect the cable in accordance with III.G.2. 

 Provide a qualified 3-fire rated barrier. 

 Provide a 1-hour fire rated barrier with automatic suppression and detection. 

 Provide separation of 20 feet or greater with automatic suppression and detection 

and demonstrate that there are no intervening combustibles within the 20 foot 

separation distance. 

 Perform a cold shutdown repair in accordance with regulatory requirements. 

 Identify other equipment not affected by the fire capable of performing the same 

safe shutdown function. 

 Develop exemptions, deviations, LARs, Generic Letter 86-10 evaluation or fire 

protection design change evaluations with a licensing change process. 

Important to Safe Shutdown Components: 

 Any of the options provided for required for hot shutdown components. 

 Perform and operator manual action in accordance with Appendix E. 

 Address using fire modeling or a focused-scope fire PRA using the methods of 

Section 5 for MSO impacts. [Note: The use of fire modeling will require a 

review by the Expert Panel and the use of a focused-scope fire PRA will require a 

LAR.] 

Additional options are available for non-inerted containments as described in 10 CFR 50 

Appendix R section III.G.2.d, e and f. 
NEI 00-01, Revision 2 

May 2009 

55 

3.4.2.5 Document the Compliance Strategy or Disposition Determined to 

Mitigate the Effects Due to Fire Damage to Each Required Component or 

Cable 

Assign compliance strategy statements or codes to components or cables to identify the 

justification or mitigating actions proposed for achieving safe shutdown. The justification 

should address the cumulative effect of the actions relied upon by the licensee to mitigate a fire 

in the area. Provide each piece of safe shutdown equipment, equipment not in the path whose 

spurious operation or mal-operation could affect safe shutdown, and/or cable for the required 

safe shutdown path with a specific compliance strategy or disposition. Refer to Attachment 6 for 

an example of a Fire Area Assessment Report documenting each cable disposition. 

3.5 CIRCUIT ANALYSIS AND EVALUATION 

This section on circuit analysis provides information on the potential impact of fire on circuits 

used to monitor, control and power required for hot shutdown and important to safe shutdown 

equipment. Applying the circuit analysis criteria will lead to an understanding of how fire 

damage to the cables may affect the ability to achieve and maintain post-fire safe shutdown in a 

particular fire area. This section should be used in conjunction with Section 3.4, to evaluate the 

potential fire-induced impacts that require mitigation. Additionally, when assessing fire-induced 

damage to circuits that could potentially result in MSOs, the circuit failure criteria in Appendix B 

should be used. 

Appendix R Section III.G.2 identifies the fire-induced circuit failure types that are to be 

evaluated for impact from exposure fires on safe shutdown equipment. Section III.G.2 of 

Appendix R requires consideration of hot shorts, shorts-to-ground and open circuits. 

3.5.1 CRITERIA/ASSUMPTIONS

Apply the following criteria/assumptions when performing fire-induced circuit failure 

evaluations. Refer to the assessment of the NEI/EPRI and CAROLFIRE Cable Test Results in 

Appendix B to this document for the basis for these criteria and for further elaboration on the 

application of the criteria. 

3.5.1.1 Circuit Failure Criteria: The criteria provided below addresses the effects 

of multiple fire-induced circuit failures impacting circuits for components 

classified as either “required for hot shutdown” or “important to safe 

shutdown”. Consider the following circuit failure types on each conductor of 

each unprotected cable. Criteria differences, however, do apply depending on 

whether the component is classified as required for hot shutdown or important 

to safe shutdown. 

• A hot short may result from a fire-induced insulation breakdown 

between conductors of the same cable, a different cable or from some 

other external source resulting in a compatible but undesired 

impressed voltage or signal on a specific conductor. A hot short may 

cause a spurious operation of safe shutdown equipment. 
NEI 00-01, Revision 2 

May 2009 

56 

o A hot short in the control circuitry for an MOV can bypass the 

MOV protective devices, i.e. torque and limit switches. This is 

the condition described in NRC Information Notice 92-18. In 

this condition, the potential exists to damage the MOV motor 

and/or valve. Damage to the MOV could result in an inability 

to operate the MOV either remotely, using separate controls 

with separate control power, or manually using the MOV hand 

wheel. This condition could be a concern in two instances: (1) 

For fires requiring Control Room evacuation and remote 

operation from the Remote Shutdown Panel, the Auxiliary 

Control Panel or Auxiliary Shutdown Panel; (2) For fires 

where the selected means of addressing the effects of fire 

induced damage is the use of an operator manual action. In 

each case, analysis must be performed to demonstrate that the 

MOV can be subsequently operated electrically or manually, as 

required by the safe shutdown analysis. 

• An open circuit may result from a fire-induced break in a conductor 

resulting in the loss of circuit continuity. An open circuit may prevent 

the ability to control or power the affected equipment. An open circuit 

may also result in a change of state for normally energized equipment. 

(e.g. [for BWRs] loss of power to the Main Steam Isolation Valve 

(MSIV) solenoid valves due to an open circuit will result in the closure 

of the MSIVs). [Note: Open circuits as a result of conductor melting 

have not occurred in any of the recent cable fire testing and they are 

not considered to be a viable form of cable failure.] 

• A short-to-ground may result from a fire-induced breakdown of a 

cable insulation system, resulting in the potential on the conductor 

being applied to ground potential. A short-to-ground may have all of 

the same effects as an open circuit and, in addition, a short-to-ground 

may also cause an impact to the control circuit or power train of which 

it is a part. A short-to-ground may also result in a change of state for 

normally energized equipment. 

Circuits for “required for hot shutdown” components: Because Appendix 

R Section III.G.1 requires that the hot shutdown capability remain "free of fire 

damage", there is no limit on the number of concurrent/simultaneous fireinduced circuit failures that must be considered for circuits for components 

“required for hot shutdown: located within the same fire area. For 

components classified as “required for hot shutdown”, there is no limit on the 

duration of the hot short. It must be assumed to exist until an action is taken 

to mitigate its effects. Circuits required for the operation of or that can cause 

the mal-operation of “required for hot shutdown” components that are 

impacted by a fire are considered to render the component unavailable for 

performing its hot shutdown function unless these circuits are properly 

protected as described in the next sentence. The required circuits for any 
NEI 00-01, Revision 2 

May 2009 

57 

“required for hot shutdown” component, if located within the same fire area 

where they are credited for achieving hot shutdown, must be protected in 

accordance with one of the requirements of Appendix R Section III.G.2 or 

plant specific license conditions. 

Circuits for “important to safe shutdown” components: Circuits for 

components classified as “important to safe shutdown” are not specifically 

governed by the requirements of Appendix R Section III.G.1, III.G.2 or 

III.G.3. To address fire-induced impacts on these circuits, consider the three 

types of circuit failures identified above to occur individually on each 

conductor with the potential to impact any “important to safe shutdown” 

component with the potential to impact components “required for hot 

shutdown”. In addition, consider the following additional circuit failure 

criteria for circuits for “important to safe shutdown” components located 

within the same fire area with the potential to impact components “required 

for hot shutdown”: 

• As explained in Figure 3.5.2-3, multiple shorts-to-ground are to be 

evaluated for their impact on ungrounded circuits. 

• As explained in Figure 3.5.2-5, for ungrounded DC circuits, a single 

hot short from the same source is assumed to occur unless it can be 

demonstrated that the occurrence of a same source short is not possible 

in the affected fire area. If this approach is used, a means to 

configuration control this condition must be developed and 

maintained. 

• For the double DC break solenoid circuit design discussed in the NRC 

Memo from Gary Holahan, Deputy Director Division of Systems 

Technology, dated December 4, 1990 and filed under ML062300013, 

the effect of two hot shorts of the proper polarity in the same multiconductor cable should be analyzed for non-high low pressure 

interface components. [Reference Figure B.3.3 (f) of NFPA 805-

2001.] 

• Multiple spurious operations resulting from a fire-induced circuit 

failure affecting a single conductor must be included in the post-fire 

safe shutdown analysis. 

• Multiple fire-induced circuit failures affecting multiple conductors 

within the same multi-conductor cable with the potential to cause a 

spurious operation of an “important to safe shutdown” component 

must be assumed to exist concurrently. 

• Multiple fire-induced circuit failures affecting separate conductors in 

separate cables with the potential to cause a spurious operation of an 

“important to safe shutdown” component must be assumed to exist 

concurrently when the effect of the fire-induced circuit failure is 

sealed-in or latched. 
NEI 00-01, Revision 2 

May 2009 

58 

• Conversely, multiple fire-induced circuit failures affecting separate 

conductors in separate cables with the potential to cause a spurious 

operation of an “important to safe shutdown” component need not be 

assumed to exist concurrently when the effect of the fire-induced 

circuit failure is not sealed-in or latched. This criterion applies to 

consideration of concurrent hot shorts in secondary circuits and to their 

effect on a components primary control circuit. It is not to be applied 

to concurrent single hot shorts in primary control circuit for separate 

components in an MSO combination. 

• For components classified as “important to safe shutdown”, the 

duration of a hot short may be limited to 20 minutes. (If the effect of 

the spurious actuation involves a "sealing in" or "latching" mechanism, 

that is addressed separately from the duration of the spurious 

actuation, as discussed above.) 

• For any impacted circuits for “important to safe shutdown” 

components that are located within the same fire area, protection in 

accordance with the requirements of Appendix R Section III.G.2 or 

plant specific license conditions may be used. In addition, 

consideration may be given to the use of fire modeling or operator 

manual actions, as an alternative to the requirements of Appendix R 

Section III.G.2. (Other resolution options may also be acceptable, if 

accepted by the Authority Having Jurisdiction.) 

3.5.1.2 Spurious Operation Criteria: The following criteria address the effect of 

multiple spurious operations of components classified as either “required for 

hot shutdown” or “important to safe shutdown” on post-fire safe shutdown. 

These criteria are to be applied to the population of components whose 

spurious operation has been determined to be possible based on an application 

of the circuit failure criteria described above when assessing impacts to postfire safe shutdown capability in any fire area. 

• The set of concurrent combinations of spurious operations provided 

through the MSO Process outlined in Section 4 and the list of MSO 

contained in Appendix G must be included in the analysis of MSOs. 

• MSOs do not need to be combined, except as explained in Section 

4.4.3.4 of this document. 

• Section 4.4.3.4 states that the expert panel should review the plant 

specific list of MSOs to determine whether any of the individual 

MSOs should be combined due to the combined MSO resulting in a 

condition significantly worse than either MSO individually. 

• In this review, consideration of key aspects of the MSOs should be 

factored in, such as the overall number of spurious operations in the 

combined MSOs, the circuit attributes in Appendix B, and other 

physical attributes of the scenarios. 
NEI 00-01, Revision 2 

May 2009 

59 

o Specifically, if the combined MSOs involve more than a total 

of four components or if the MSO scenario requires 

consideration of sequentially selected cable faults of a 

prescribed type, at a prescribed time, in a prescribed sequence 

in order for the postulated MSO combination to occur, then this 

is considered to be beyond the required design basis for MSOs. 

3.5.1.3 Assume that circuit contacts are initially positioned (i.e., open or closed) 

consistent with the normal mode/position of the “required for hot shutdown” 

or “important to safe shutdown” equipment as shown on the schematic 

drawings. The analyst must consider the position of the “required for hot 

shutdown” and “important to safe shutdown” equipment for each specific 

shutdown scenario when determining the impact that fire damage to a 

particular circuit may have on the operation of the “required for hot 

shutdown” and “important to safe shutdown equipment”. 

3.5.2 TYPES OF CIRCUIT FAILURES

Appendix R requires that nuclear power plants must be designed to prevent exposure fires from 

defeating the ability to achieve and maintain post-fire safe shutdown. Fire damage to circuits 

that provide control and power to equipment required for hot shutdown and important to safe 

shutdown in each fire area must be evaluated for the effects of a fire in that fire area. Only one 

fire at a time is assumed to occur. The extent of fire damage is assumed to be limited by the 

boundaries of the fire area. Given this set of conditions, it must be assured that one redundant 

train of equipment necessary to achieve and maintain hot shutdown is free of fire damage for 

fires in every plant location. To provide this assurance, Appendix R requires that equipment and 

circuits required for hot shutdown be free of fire damage and that these circuits be designed for 

the fire-induced effects of a hot short, short-to-ground, or an open circuit. With respect to the 

electrical distribution system, the issue of breaker coordination must also be addressed. Criteria 

for making the determination as to which breakers are to be classified as required for hot 

shutdown is contained in Appendix H. 

This section will discuss specific examples of each of the following types of circuit failures: 

 Open circuit 

 Short-to-ground 

 Hot short 

Also, refer to Appendix B for the circuit failure criteria to be applied in assessing the impact of 

the Plant Specific List of MSOs on post-fire safe shutdown. 
NEI 00-01, Revision 2 

May 2009 

60 

3.5.2.1 Circuit Failures Due to an Open Circuit 

This section provides guidance for addressing the effects of an open circuit for required for hot 

shutdown and important to safe shutdown equipment. An open circuit is a fire-induced break in 

a conductor resulting in the loss of circuit continuity. An open circuit will typically prevent the 

ability to control or power the affected equipment. An open circuit can also result in a change of 

state for normally energized equipment. For example, a loss of power to the main steam 

isolation valve (MSIV) solenoid valves [for BWRs] due to an open circuit will result in the 

closure of the MSIV. 

 Loss of electrical continuity may occur within a conductor resulting in deenergizing the circuit and causing a loss of power to, or control of, the required 

for hot shutdown and important to safe shutdown equipment. 

 In selected cases, a loss of electrical continuity may result in loss of power to an 

interlocked relay or other device. This loss of power may change the state of the 

equipment. Evaluate this to determine if equipment fails safe. 

 Open circuit on a high voltage (e.g., 4.16 kV) ammeter current transformer (CT) 

circuit may result in secondary damage, possibly resulting in the occurrence of an 

additional fire in the location of the CT itself. 
NEI 00-01, Revision 2 

May 2009 

61 

Figure 3.5.2-1 shows an open circuit on a grounded control circuit. 

Figure 3.5.2-1 

Open Circuit 

(Grounded Control Circuit)

Grounded Circuit

Energize to 

Open/Start 

Energize to 

Close/Stop

Open Circuit 

No. 1 

Control Switch 

Open Circuit (Typical)

No. 2

Cable Fault

Grounded Control Power

Fuse (Typ.)

Open circuit No. 1

An open circuit at location No. 1 will prevent operation of the subject equipment. 

Open circuit No. 2

An open circuit at location No. 2 will prevent opening/starting of the subject equipment, but will 

not impact the ability to close/stop the equipment. 

3.5.2.2 Circuit Failures Due to a Short-to-Ground 

This section provides guidance for addressing the effects of a short-to-ground on circuits for 

required for hot shutdown and important to safe shutdown equipment. A short-to-ground is a 

fire-induced breakdown of a cable insulation system resulting in the potential on the conductor 

being applied to ground potential. A short-to-ground can cause a loss of power to or control of 

required safe shutdown equipment. In addition, a short-to-ground may affect other equipment in 

the electrical power distribution system in the cases where proper coordination does not exist. 

There is no limit to the number of shorts-to-ground that could be caused by the fire. 
NEI 00-01, Revision 2 

May 2009 

62 

Consider the following consequences in the post-fire safe shutdown analysis when determining 

the effects of circuit failures related to shorts-to-ground: 

• A short to ground in a power or a control circuit may result in tripping one or more 

isolation devices (i.e. breaker/fuse) and causing a loss of power to or control of required 

safe shutdown equipment. 

• In the case of certain energized equipment such as HVAC dampers, a loss of control 

power may result in loss of power to an interlocked relay or other device that may cause 

one or more spurious operations. 

Short-to-Ground on Grounded Circuits

Typically, in the case of a grounded circuit, a short-to-ground on any part of the circuit would 

present a concern for tripping the circuit isolation device thereby causing a loss of control power. 

Figure 3.5.2-2 illustrates how a short-to-ground fault may impact a grounded circuit. 

Figure 3.5.2-2 

Short-to-Ground 

(Grounded Control Circuit) 

Grounded Circuit 

Energize to 

Open/Start 

Energize to 

Close/Stop

Short-to-Ground 

No. 1 

Control Switch 

Grounded Control Power

Short-to-Ground 

No. 2 

Fuse (Typ.)

Short-to-ground No. 1

A short-to-ground at location No. 1 will result in the control power fuse blowing and a loss of 

power to the control circuit. This will result in an inability to operate the equipment using the 

control switch. Depending on the coordination characteristics between the protective device on 

this circuit and upstream circuits, the power supply to other circuits could be affected. 
NEI 00-01, Revision 2 

May 2009 

63 

Short-to-ground No. 2

A short-to-ground at location No. 2 will have no effect on the circuit until the close/stop control 

switch is closed. Should this occur, the effect would be identical to that for the short-to-ground 

at location No. 1 described above. Should the open/start control switch be closed prior to closing 

the close/stop control switch, the equipment will still be able to be opened/started. 

Short-to-Ground on Ungrounded Circuits

In the case of an ungrounded circuit, postulating only a single short-to-ground on any part of the 

circuit may not result in tripping the circuit isolation device. Another short-to-ground on the 

circuit or another circuit from the same source would need to exist to cause a loss of control 

power to the circuit. 

Figure 3.5.2-3 illustrates how a short to ground fault may impact an ungrounded circuit. 

Energize to 

Open/Start 

Energize to 

Close/Stop

Short-to-Ground 

No. 1 

Control Switch 

Figure 3.5.2-3 

Short-to-Ground 

(Ungrounded Control Circuit) 

Ungrounded Control Power

Short-to-Ground

No. 3 

Short-to-Ground

No. 2 

Fuse (Typ.) 

Short-to-ground No. 1

A short-to-ground at location No. 1 will result in the control power fuse blowing and a loss of 

power to the control circuit if short-to-ground No. 3 also exists either within the same circuit or 

on any other circuit fed from the same power source. This will result in an inability to operate 

the equipment using the control switch. Depending on the coordination characteristics between 

the protective device on this circuit and upstream circuits, the power supply to other circuits 

could be affected. If multiple grounds can occur in a single fire area, they should be assumed to 

occur simultaneously unless justification to the contrary is provided. 
NEI 00-01, Revision 2 

May 2009 

64 

Short-to-ground No. 2

A short-to-ground at location No. 2 will have no effect on the circuit until the close/stop control 

switch is closed. Should this occur, the effect would be identical to that for the short-to-ground 

at location No. 1 described above. Should the open/start control switch be closed prior to closing 

the close/stop control switch, the equipment will still be able to be opened/started. If multiple 

grounds can occur in a single fire area, they should be assumed to occur simultaneously unless 

justification to the contrary is provided. Note that a simultaneous short-to-ground at locations 

No. 1 and No. 2 could result in a spurious close/stop. This condition is identical to that portrayed 

in Figure 3.5.2-5 should a hot short occur on the ungrounded circuit shown in Figure 3.5.2-5 at 

location No. 1. 

3.5.2.3 Circuit Failures Due to a Hot Short 

This section provides guidance for analyzing the effects of a hot short on circuits for required for 

required for hot shutdown and important to safe shutdown equipment. A hot short is defined as a 

fire-induced insulation breakdown between conductors of the same cable, a different cable or 

some other external source resulting in an undesired impressed voltage on a specific conductor. 

The potential effect of the undesired impressed voltage would be to cause equipment to operate 

or fail to operate in an undesired manner. 

Consider the following specific circuit failures related to hot shorts as part of the post-fire safe 

shutdown analysis: 

 A hot short between an energized conductor and a de-energized conductor within the 

same cable may cause a spurious operation of equipment. The spuriously operated 

device (e.g., relay) may be interlocked with another circuit that causes the spurious 

operation of other equipment. This type of hot short is called an intra-cable hot short 

(also known as conductor-to-conductor hot short or an internal hot short). 

 A hot short between any external energized source such as an energized conductor from 

another cable and a de-energized conductor may also cause a spurious operation of 

equipment. This is called an inter-cable hot short (also known as cable-to-cable hot 

short/external hot short). 

 A hot short in the control circuitry for an MOV can bypass the MOV protective devices, 

i.e. torque and limit switches. This is the condition described in NRC Information Notice 

92-18. In this condition, MOV motor damage can occur. Damage to the MOV motor 

could result in an inability to operate the MOV either remotely, using separate controls 

with separate control power, or manually using the MOV hand wheel. This condition 

could be a concern in two instances: (1) For fires requiring Control Room evacuation and 

remote operation from the Remote Shutdown Panel; (2) For fires where the selected 

means of addressing the effects of fire induced damage is the use of an operator manual 

action. In this latter case, analysis must be performed to demonstrate that the MOV 

thrust at motor failure does not exceed the capacity of the MOV hand wheel. For either 
NEI 00-01, Revision 2 

May 2009 

65 

case, analysis must demonstrate the MOV thrust at motor failure does not damage the 

MOV pressure boundary. 

A Hot Short on Grounded Circuits

A short-to-ground is another failure mode for a grounded control circuit. A short-to-ground as 

described above would result in de-energizing the circuit. This would further reduce the 

likelihood for the circuit to change the state of the equipment either from a control switch or due 

to a hot short. Nevertheless, a hot short still needs to be considered. Figure 3.5.2-4 shows a 

typical grounded control circuit that might be used for a motor-operated valve. However, the 

protective devices and position indication lights that would normally be included in the control 

circuit for a motor-operated valve have been omitted, since these devices are not required to 

understand the concepts being explained in this section. In the discussion provided below, it is 

assumed that a single fire in a given fire area could cause any one of the hot shorts depicted. 

The following discussion describes the impact of these individual cable faults on the operation of 

the equipment controlled by this circuit. 

Figure 3.5.2-4 

Hot Short 

(Grounded Control Circuit) 

Fuse (Typ.) 

Hot short No. 1

A hot short at this location would energize the close relay and result in the undesired closure of a 

motor-operated valve. 

Hot short No. 2

Grounded Circuit

Energize to 

Open/Start 

Energize to 

Close/Stop

Control Switch 

Grounded Control Power

Hot Short 

No. 1

No. 2 
NEI 00-01, Revision 2 

May 2009 

66 

A hot short at this location would energize the open relay and result in the undesired opening of a 

motor-operated valve. 

A Hot Short on Ungrounded Circuits

In the case of an ungrounded circuit, a single hot short may be sufficient to cause a spurious 

operation. A single hot short can cause a spurious operation if the hot short comes from a circuit 

from the positive leg of the same ungrounded source as the affected circuit. 

In reviewing each of these cases, the common denominator is that in every case, the conductor in 

the circuit between the control switch and the start/stop coil must be involved. 

Figure 3.5.2-5 depicted below shows a typical ungrounded control circuit that might be used for 

a motor-operated valve. However, the protective devices and position indication lights that 

would normally be included in the control circuit for a motor-operated valve have been omitted, 

since these devices are not required to understand the concepts being explained in this section. 

In the discussion provided below, it is assumed that a single fire in a given fire area could cause 

any one of the hot shorts depicted. The discussion provided below describes the impact of these 

cable faults on the operation of the equipment controlled by this circuit. 

Energize to 

Open/Start

Energize to 

Close/Stop 

Control Switch 

Figure 3.5.2-5

Hot Short 

(Ungrounded Control Circuit) 

Ungrounded Control Power

Fuse (Typ.) 

Hot Short 

No. 1

No. 2 

Hot short No. 1

A hot short at this location from the same control power source would energize the close relay 

and result in the undesired closure of a motor operated valve. 
NEI 00-01, Revision 2 

May 2009 

67 

Hot short No. 2

A hot short at this location from the same control power source would energize the open relay 

and result in the undesired opening of a motor operated valve. 

3.5.2.4 Circuit Failures Due to Inadequate Circuit Coordination 

The evaluation of circuits of a common power source consists of verifying proper coordination 

between the supply breaker/fuse and the load breakers/fuses for power sources that are required 

for hot shutdown. The concern is that, for fire damage to a single power cable, lack of 

coordination between the supply breaker/fuse and the load breakers/fuses can result in the loss of 

power to a safe shutdown power source that is required to provide power to safe shutdown 

equipment. 

For the example shown in Figure 3.5.2-6, the circuit powered from load breaker 4 supplies power 

to a non-safe shutdown pump. This circuit is damaged by fire in the same fire area as the circuit 

providing power to from the Train B bus to the Train B pump, which is redundant to the Train A 

pump. 

To assure safe shutdown for a fire in this fire area, the damage to the non-safe shutdown pump 

powered from load breaker 4 of the Train A bus cannot impact the availability of the Train A 

pump, which is redundant to the Train B pump. To assure that there is no impact to this Train A 

pump due to the circuits’ common power source breaker coordination issue, load breaker 4 must 

be fully coordinated with the feeder breaker to the Train A bus. 

1 2 3 4 5

Safe Shutdown 

Pump Train A 

(Redundant Pump) 

Non-Safe 

Shutdown 

Pump X 

Load 

Breaker

(T yp.)

Train A Bus 

Safe Shutdown 

Pump Train B 

(Redundant Pump) Exposure Fire 

Train B Bus 

Feeder 

Figure 3.5.2-6

Common Power Source 

(Breaker Coordination) 

Fire Area Boundary 

(Typical) 
NEI 00-01, Revision 2 

May 2009 

68 

A coordination study should demonstrate the coordination status for each required common 

power source. For coordination to exist, the time-current curves for the breakers, fuses and/or 

protective relaying must demonstrate that a fault on the load circuits is isolated before tripping 

the upstream breaker that supplies the bus. Furthermore, the available short circuit current on the 

load circuit must be considered to ensure that coordination is demonstrated at the maximum fault 

level. 

The methodology for identifying potential circuits of a common power source and evaluating 

circuit coordination cases on a single circuit fault basis is as follows: 

 Identify the power sources required to supply power to safe shutdown equipment. 

 For each power source, identify the breaker/fuse ratings, types, trip settings and 

coordination characteristics for the incoming source breaker supplying the bus and the 

breakers/fuses feeding the loads supplied by the bus. 

 For each power source, demonstrate proper circuit coordination using acceptable industry 

methods. For example, for breakers that have internal breaker tripping devices and do 

not require control power to trip the breaker, assure that the time-current characteristic 

curve for any affected load breaker is to the left of the time-current characteristic curve 

for the bus feeder breaker and that the available short circuit current for each affected 

breaker is to the right of the time-current characteristic curve for the bus feeder breaker or 

that the bus feeder breaker has a longer time delay in the breaker instantaneous range 

than the load breaker. For breakers requiring control power for the breaker to trip, the 

availability of the required control power must be demonstrated in addition to the proper 

alignment of the time-current characteristic curves described above. The requirement for 

the availability of control power would apply to load breakers fed from each safe 

shutdown bus where a fire-induced circuit failure brings into questions the availability of 

coordination for a required for hot shutdown component. 

 For power sources not properly coordinated, tabulate by fire area the routing of cables 

whose breaker/fuse is not properly coordinated with the supply breaker/fuse. Evaluate 

the potential for disabling power to the bus in each of the fire areas in which the circuit of 

concern are routed and the power source is required for hot shutdown. Prepare a list of 

the following information for each fire area: 

 Cables of concern. 

 Affected common power source and its path. 

 Raceway in which the cable is enclosed. 

 Sequence of the raceway in the cable route. 

 Fire zone/area in which the raceway is located. 

For fire zones/areas in which the power source is disabled, the effects are mitigated by 

appropriate methods. 
NEI 00-01, Revision 2 

May 2009 

69 

 Develop analyzed safe shutdown circuit dispositions for the circuit of concern cables 

routed in an area of the same path as required by the power source. Evaluate adequate 

separation and other mitigation measures based upon the criteria in Appendix R, NRC 

staff guidance, and plant licensing bases. 

3.5.2.5 Circuit Failures Due to Common Enclosure Concerns 

The common enclosure concern deals with the possibility of causing secondary failures due to 

fire damage to a circuit either whose isolation device fails to isolate the cable fault or protect the 

faulted cable from reaching its ignition temperature, or the fire somehow propagates along the 

cable into adjoining fire areas. 

The electrical circuit design for most plants provides proper circuit protection in the form of 

circuit breakers, fuses and other devices that are designed to isolate cable faults before ignition 

temperature is reached. Adequate electrical circuit protection and cable sizing are included as 

part of the original plant electrical design maintained as part of the design change process. 

Proper protection can be verified by review of as-built drawings and change documentation. 

Review the fire rated barrier and penetration designs that preclude the propagation of fire from 

one fire area to the next to demonstrate that adequate measures are in place to alleviate fire 

propagation concerns. 

NEI 00-01, Revision 2 

May 2009 

71 

4 IDENTIFICATION AND TREATMENT OF MULTIPLE SPURIOUS 

OPERATIONS 

4.1 INTRODUCTION 

The purpose of this section is to provide a methodology for addressing multiple fire- induced 

circuit failures and multiple spurious operations (MSOs) by individual licensees. This 

methodology uses identification and analysis techniques similar to methods applied under NEI 

04-02 for Risk-Informed Fire Protection, but do not include steps for self-issued change analysis 

as allowed under NEI 04-02 and NFPA-805. MSOs identified during this process will include 

both required for hot shutdown and important to SSD circuit components, with different 

mitigation strategies for each type of MSO as shown on Figure 3-1 above. 

With NRC acceptance, the methodology presented in this document addresses multiple spurious 

operations resulting from fire-induced circuit failures for safe shutdown in accordance with 

10 CFR 50 Appendix R, Sections III.G.1 and III.G.2. 

The basic philosophy behind this method is that the Fire Safe Shutdown Procedures and 

associated Operator Actions should focus on potentially risk important scenarios. This agrees 

with the philosophy as described in RIS 2004-03, which was developed for inspection criteria. 

Application of the deterministic criteria in Section 3 of this document to multiple spurious 

operations would require all potential fire-induced spurious operations to be identified and a 

mitigating action to be developed for each. This mitigating action may be an action taken prior 

to the start of the fire event that precludes the condition from occurring or as a post-fire action 

that mitigates the effects of the condition prior to it reaching an unrecoverable condition relative 

to safe shutdown. The corresponding mitigating action for each potential spurious operation 

must be known and this action must be capable of limiting the potential adverse affects of the 

spurious operation without reliance on any other equipment that is also potentially susceptible to 

a spurious operation resulting from a fire in the same fire area. 

If the procedures and actions were expanded to include very low risk scenarios, the operator 

actions would become too complex, resulting in higher expected operator failures for the 

important scenarios. Additionally, if the required timing for actions were to consider all low risk 

scenarios, the resulting procedural actions would likely be modified to include actions that can 

raise the overall plant risk, such as implementing a Self-Induced Station Blackout. Mitigation 

might also require significant modification to plant safety-related systems and logics that could 

have the undesired consequence of reducing their reliability in mitigating the affects of other 

events, thereby causing an overall increase in plant risk. By placing bounds on the number of 

scenarios that the procedures address, this results in lower plant risk by ensuring optimal 

operator response for the potential risk important scenarios. 

This philosophy is similar to the development of plant emergency operating procedures, where 

low risk scenarios are not included in the procedures while potentially high-risk scenarios and 

"Design Basis" scenarios are addressed. 
NEI 00-01, Revision 2 

May 2009 

72 

If a mitigating action is not taken for multiple spurious operations identified using the methods 

described below, a regulatory submittal (Exemption/Deviation) must be developed. In order to 

minimize the number of regulatory submittals, the method provided must limit the multiple 

spurious operations to be consistent with RIS 2004-03 by concentrating identification on circuit 

failures that have a relatively high likelihood of occurrence. 

Additionally, the methodology must provide a process for incorporating new information on 

spurious operations that are determined to be likely to occur. This may include new information 

gained from additional fire testing, or as a result of feedback from plants implementing this 

method (or NFPA 805). 

The list of Generic Multiple Spurious Operations developed by the Owner’s Groups and required 

to be considered in conjunction with the information in this section are contained in Appendix G. 

The Generic MSO lists include both required for hot shutdown and important to SSD component 

MSO combinations. The classification for each MSO in Appendix G should be determined by 

licensees depending on the safe shutdown methodology used in each of their fire areas based on 

the guidance discussed in Appendix H. The types of circuit failures and the number of these 

types of circuit failures that are to be considered in each circuit type when evaluating the impact 

of an MSO on post-fire safe shutdown are described in Appendix B. 

 

Appendix B is used to address multiple spurious operations (both required for hot shutdown and 

important to SSD MSOs. The affects of single spurious operations due to single fire induced 

circuit failure is to be addressed using the methods in Section 3 of this document. 

The process described below, including the generic MSO lists, do not artificially limit the 

number of spurious operations or hot shorts included in each scenario considered. In some cases, 

spurious operation of a specific component may require multiple hot shorts. Depending on the 

type of circuit involved, guidance on the appropriate assumptions to be made relative to this 

condition is contained in Appendix B. It is also intended that if multiple hot shorts are required 

to cause the MSO, this should not result in any screening of MSOs from consideration prior to 

the inclusion of the MSO combination in the Safe Shutdown analysis. The multiple hot shorts 

would be considered when reviewing the hot shorts against the cable criteria in Appendix B or in 

the PRA calculations. 

4.2 OVERVIEW OF THE MSO IDENTIFICATION AND TREATMENT PROCESS 

Figure 4-1 provides an overview of the MSO Identification and Treatment Process. Sections 4.3 

to 4.5 below provide a description of each of the steps in the figure. 
NEI 00-01, Revision 2 

May 2009 

73 

SSA

[OG Industry Surveys]

NEI 04-06

[OG Industry Surveys]

Other:

- PRA

- NRC Inspection

[OG Industry Surveys]

Generic List of 

MSOs

[OG Industry Surveys]

Generic Analysis

[4.3] 

Successful

[4.3] 

Generic Analysis 

Files

[4.3] 

Generic list 

of MSOs

[Appendix G]

Plant Expert 

Panel Review

[4.4]

Documented basis for acceptance

[4.6] 

Plant Specific List of MSOs

[4.4]

Use the methods in NEI 00-01 Chapter 3, as supplemented by the information in Appendix B to identify the cables 

associated with each piece of equipment in each MSO and identify which fire areas, if any, each component in the 

MSO is impacted by the postulated fire.

[4.5] 

Disposition using NEI 00-01 Chapter 4, including 

fire modeling and/or focused scope Fire PRA 

(a License Amendment maybe required)

[4.5] 

Disposition using the deterministic methods of 

NEI 00-01, Chapter 3, Section 3.4.2.4, excluding fire 

modeling or focused-scope fire PRA.

[4.5] 

Plant Expert 

Panel Review

[4.5] 

No

Yes

Yes

No

Deletions

Accepted

Not Accepted

OG Industry Survey
NEI 00-01, Revision 2 

May 2009 

74 

4.3 GENERIC LIST OF MSOS

Appendix G provides a list of generic scenarios to consider in a plant specific evaluation for 

multiple spurious operations. The generic list of MSOs was developed from an industry survey 

of all US plants. The survey asked the plants to “Describe the extent to which multiple hot 

shorts and multiple spurious operations (MSOs) have been addressed for your facility in each of 

the following areas:” 

1) Licensing Basis Safe Shutdown Analysis 

2) Assessments performed for NRC RIS 2004-03 using NEI 04-06 

3) Evaluations performed as a result of NRC Inspections 

4) MSO Expert Panel Reviews conducted for Fire PRA or NFPA 805 

5) Other Instances where MSOs [Combined Equipment Impacts] with potential risk 

significance been identified (e.g. PRA Analysis Internal Events Model, Fire PRA or 

other source) 

The results of the survey responses were then compiled into a table, and draft lists were 

developed for each reactor type. The draft lists were used in the NEI 00-01 pilot application and 

during initial NFPA 805 applications, and were revised based on feedback from both. The final 

generic lists are contained in Appendix G to Revision 2 of this document. The final lists contain 

some clarifications to certain scenarios originally contained on the draft lists. Additionally, the 

final lists contain additional scenarios identified during the pilots. 

Although not all scenarios for a reactor type are considered applicable to every reactor, the list is 

provided here as an input to the MSO identification and treatment process. 

The generic MSO list in Appendix G requires a classification of each MSO as either “required 

for hot shutdown” or “important to SSD” component MSO. MSOs for required circuit 

components are addressed differently than MSOs for important to SSD components, with the use 

Operator Manual Actions, Fire Modeling or Focused-scope FPRA not generically authorized by 

the NRC to be applied to MSOs categorized as required for hot shutdown component MSOs. 

Exemptions, deviations or LARs, depending on a licensee’s current licensing basis, may be 

required to use operator manual actions, fire modeling or focused-scope fire PRAs for required 

for hot shutdown MSOs. Operator manual actions may be used for important to safe shutdown 

components within the bounds established in Appendix E. Fire modeling and focused-scope fire 

PRA may also be used for important to safe shutdown components with the following 

stipulations: (1) A review by the Expert Panel is required; (2) A LAR has been obtained form 

the NRC to use focused-scope fire PRA. The categorization for each MSO in Appendix G 

should be developed by licensees depending on the safe shutdown methodology used in each of 

their fire areas using the guidance in Appendix H. 
NEI 00-01, Revision 2 

May 2009 

75 

As can be seen from Figure 4-1, generic Owner’s Group analysis can be performed for a given 

reactor type to disposition generic MSO scenarios. The generically dispositioned scenarios do 

not need to be included in the plant specific MSO list, provided an individual licensee performs a 

review of the generic analysis, verifies plant specific parameters bound those critical parameters 

used in the generic analysis and obtain the concurrence of its plant specific Expert Panel. The 

method and the critical parameters used for each generic analysis will vary, depending on the 

MSO. These aspects of the generic analysis are not described further in this document. Refer to 

each generic analysis for the required information. 

4.4 EXPERT PANEL REVIEW OF MSOS

The Expert Panel Review is performed to systematically and completely review all spurious and 

MSO scenarios and determine whether or not each individual scenario is to be included or 

excluded from the plant specific list of multiple spurious operations to be considered in the plant 

specific post-fire SSA. Input to the expert panel is provided from a number of sources, resulting 

in a comprehensive review of spurious operation scenarios. Determinations made by the Expert 

Panel during the initial development of the Plant Specific MSO List may change as more 

detailed analysis is performed. Whenever such changes arise, the Expert Panel should be reconvened to provide their concurrence with such changes. 

The team for an expert panel review includes operations, engineering, electrical, PRA, and 

others. This process involves four phases: 

• Phase 1: Pre-Review of Fire Induced MSOs 

• Phase 2: Preparation for the Expert Panel Meeting

• Phase 3: Performance of the Expert Panel Review 

• Phase 4: Develop Comprehensive Plant Specific MSO List 

4.4.1 THE FOLLOWING PROVIDES A DISCUSSION OF EACH PHASE.
NEI 00-01, Revision 2 

May 2009 

76 

PHASE I: PRE-REVIEW OF FIRE-INDUCED MSOS

This phase involves the analytical preparation performed prior to conducting the MSO expert 

panel review with the full complement of expert panel members. The step may take a number of 

weeks or months to perform, depending on the level of support (number of people) involved in 

the preparation. The key steps in this phase are discussed in the following sections. 

4.4.1.1 Review of the generic MSO List for Applicability 

The screening of generic MSO scenarios can be performed to remove from consideration 

scenarios not applicable for a given plant. The screening process involves the review of each 

scenario in the generic list for applicability and disposition. Scenarios can be screened from the 

plant specific MSO list, given the following: 

1) Components identified in the scenario do not exist in the plant, and the scenario is not 

applicable to similar components or systems, or 

2) Specific plant design features (see additional comments below) make the scenario 

either not possible, or the MSO does not fail the safe shutdown function. 

Some of the scenarios that are listed in Appendix G are described as being applicable to a 

specific vintage of plant design. For example, most of the scenarios listed for BWR 2’s, might 

be assumed to have no applicability to BWR 3’s or 4’s. This may be the case for the particular 

scenario listed. Item 1 above, however, requires that each licensee look at the scenarios provided 

and examine them for similar components or systems used in the design of the plant under 

evaluation. Conversely, even when the scenario is listed for a particular design vintage of plants, 

such as the BWR 2’s, a scenario related to isolation condensers would only be applicable to 

BWR 2’s that have isolation condensers. The considerations described above need to be 

employed in each licensee’s plant specific evaluation of MSOs. 

Additionally, scenarios screened from the plant specific MSO list should be reviewed with the 

following considerations: 

1) If the design feature that makes the scenario not possible for the plant involves cable 

routing, circuit design, electrical protection, or other similar design feature, the 

scenario should not be screened from consideration at this step. Similarly, if an 

operator manual action or operational configuration (e.g., maintaining a breaker open 

during normal operation) is in place that would prevent/mitigate the consequences of 

the scenario, the scenario should not be screened at this step. The process for these 

scenarios would be to include the scenario in the Plant Specific MSO list, and to use 

the design feature as a disposition for the MSO within the plant’s post-fire safe 

shutdown analysis. This way, as future plant and plant procedure changes are made, 

the impact of these changes can be reviewed relative to the basis for dispositioning of 

the MSO. 

2) Documentation that the scenario does not fail the safe shutdown function should be 

based on the original SSA assumptions. If specific analysis is performed to show the 
NEI 00-01, Revision 2 

May 2009 

77 

MSO doesn’t fail the function, then the MSO should be included in the plant specific 

MSO list, and the analysis used in the disposition of the MSO. This way, as future 

plant and plant procedure changes are made, the impact of these changes can be 

reviewed relative to the basis for dispositioning of the MSO. 

3) If a generic analysis is available for an MSO, the generic analysis should be reviewed 

to verify that the analysis is applicable to the plant being reviewed and that no plant 

unique features invalidate the inputs, assumptions, methodology, results or 

conclusions of the generic analysis. The expert panel should review the MSO in 

conjunction with the generic analysis and, if acceptable, disposition the MSO for the 

plant under review without additional consideration in the plant specific analysis. 

The MSO, the generic analysis used to disposition the MSO and any additional 

considerations should be documented in the expert panel report and in the licensee’s 

SSA. 

For item 1) above, the general concept is that if the design/operational feature can possibly 

change as a result of a design/operational change, the MSO needs to be included in the site 

specific MSO list. This would ensure that changes to the design/operation would be reviewed 

against the MSO to ensure the MSO remains not possible as changes are made to the plant over 

the course of time. For item 2) it is intended that whenever a specific assumption is credited in 

the original SSA, the specific MSO under review is carried forward to the Plant Specific MSO 

list to assure continued compliance. For example, if there are two injection trains credited for all 

“A” train fire areas, and an MSO fails only one of the two trains, then the MSO can be screened 

at this point. In this example, however, the post-fire SSA must be revised to make it clear that 

only a single injection train is credited in all “A” train fire areas. Another example would be a 

scenario that drains a water supply tank into the containment sump, and analysis is performed to 

show the water can be provided from the sump to an injection pump using equipment unaffected 

by fires that could cause the draindown. In this example, if the sump flow path was not in the 

original SSA, the MSO should not be screened. 

Screening of the Generic List of MSOs is subject to review and concurrence by the expert panel. 

One alternative to the initial screening of generic MSOs is to perform the screening during the 

expert panel process. This can be done simultaneously with the expert panel exploration of new 

MSO scenarios. Documentation of screened MSOs would be required, whether performed with 

the initial screening or by the expert panel. Screening of the MSOs during the expert panel 

review may add significant time to the performance of the panel meetings, so pre-screening is 

generally recommended. 

It is helpful to address as a part of the pre-screening the question of whether the MSO Scenario is 

already addressed in the SSA. This can be answered through the coordinated review of the SSA, 

discussed below. The review helps in the preparation for the expert panel review, and also 

provides information as to the plant response given the MSO. For example, if the MSO is 

addressed by analysis, showing a diversion flow path is small and does not fail the SSA train, the 

information is captured in the pre-review. Finally, this information can be used during the 

review of possible combinations of MSO scenarios, as discussed in 4.4.3.3 below. 
NEI 00-01, Revision 2 

May 2009 

78 

4.4.1.2 Perform PRA Runs per Appendix F 

The plant PRA model may evaluate combinations of components that are not explicitly treated in 

the SSA. These combinations may also be non-intuitive. As a prudent measure, the PRA model 

may be exercised to highlight these MSO combinations for consideration by the Expert Panel. 

The method used for this process is described in Appendix F. The outcome of the review is a list 

of possible MSO combinations that may fail SSA and potentially lead to core damage. Only new 

MSO combinations not already included in the generic MSO list or already addressed in the SSA 

should be included in the Plant Specific MSO List. 

Based on the Pilot Application of NEI 00-01, the PRA Run results can provide MSO scenarios 

that are not in the generic MSO list. The Pilot Application results show additional scenarios in 

support systems would be most likely found using the PRA methods. 

4.4.1.3 Review of the Existing SSA 

As an input to the expert panel process, a list of the existing SSA spurious operations 

components and scenarios should be developed. Much of the information for this list is already 

available in SSA supporting documents, but may not be in a form to support external review or 

an expert panel review. This list should provide both a description of the scenario of concern 

and the disposition of the scenario in the SSA. Operator Manual Actions associated with any 

disposition should also be documented, including documentation of feasibility criteria (timing, 

etc.). Key to the documentation are any assumptions made for the SSA, since these assumptions 

may not be valid for MSO scenarios. Both generic and scenario specific assumptions should be 

documented as an input to the expert panel review. 

Scenarios that are dispositioned as not needing operator manual action (or other compliance 

strategies), due to the presence of additional components down stream of the initial component, 

should be reviewed by the expert panel in detail. Pre-identification of these scenarios as 

additions to the MSO list should be performed. For example, if a diversion includes two MOVs, 

and the first MOV is dispositioned as not a concern due to the presence of the second MOV, then 

the expert panel should consider spurious operation of both MOVs as a potential multiple 

spurious operation scenario. Similarly, if a non-post-fire safe shutdown credited pump start is 

not a concern due to a closed discharge MOV/AOV, then the expert panel should consider the 

scenario (Pump spuriously starts and valve spuriously opens). 

Similarly, for a post-fire safe shutdown credited pump start with a normally open minimum flow 

valve, then the expert panel should consider the scenario (Pump spuriously starts and the 

minimum flow valve spuriously closes). 

Scenarios where positive operator manual action is taken where both single and multiple 

spurious operations are addressed may need to be considered further. The scenario would need 

to be reviewed for the effect on timing and operator action feasibility to ensure no further review 

is required. For example, if operator action on a flow path is determined to have 20 minutes 
NEI 00-01, Revision 2 

May 2009 

79 

prior to reaching an unrecoverable state, but a second spurious operation can change the timing 

to 10 minutes, then a review by the expert panel is needed. This timing issue is especially 

critical for spurious pump operation. For example, for PWR SG overfeed or for the pressurizer 

going solid, the timing for single pump spurious start/run can be much different that when two or 

three pumps start/run, and the credited operator manual action may not be completed in time for 

the MSO. 

An Example SSA Results Table is provided in Table 1 below. Notice that in the table, there are 

several examples where expert panel consideration will be required. For example, for MOV-1, 

the expert panel will need to consider the timing to see if additional spurious operations will 

result in failure of the feasibility criteria. For MOV-2, the credited disposition is the use of 

another valve, MOV-3. If the same fire can damage this MOV-3, then an MSO scenario may 

result. MOV-4 is likely to not be a concern for MSO scenarios, unless it can be involved in 

scenarios involving hot standby. In this case, it could affect the timing of an existing scenario or 

result in a new scenario being introduced. 

Table 1 (example) 

Existing SSA Spurious Operations Components and Scenarios 

Component Scenario Disposition Reference for 

Disposition 

MOV-1 Spurious Opening 

Results in 

Excess Letdown 

Local Operator 

Manual Action 

per procedure OP3 

Procedure OP-3, 

step 12 

MOV-2 Spurious Closure 

results in a loss of 

injection 

Use of second 

injection valve, 

MOV-3 

Procedure OP-3, 

step 17 

MOV-4 Spurious Closure will 

result in failure of 

letdown. This will 

result in the inability 

to achieve cold 

shutdown in 72 hours 

Manual Action per 

procedure OP-3 

Procedure OP-3, 

step 18 

Based on the pilot application of the NEI 00-01 methods, the focus of the above table should be 

to document any MSOs already addressed (or discussed) in the existing SSA. If the MSO is 

already addressed, then this documentation can assist in the review of the generic MSO list. If 

the MSO is addressed, but not on the generic MSO list, then the MSO is added to the plant 

specific MSO list and should be considered a candidate to send to NEI and the applicable 

Owner’s Group for addition to the MSO list. Finally, if the MSO is discussed in the SSA, but 

does not have a compliance strategy, then this will need to be addressed in the SSA. In this last 

category, if the SSA specifically mentions that the MSO requires multiple hot shorts (or multiple 

spurious operations), which is considered beyond the design, then, the original SSA disposition 

would need to be revisited based on the guidance in this document. However, the MSO may 

need additional analysis in order to verify the MSO fails safe shutdown. 
NEI 00-01, Revision 2 

May 2009 

80 

Development of Table 1 above is not intended to be a review of whether the existing SSD 

method (including manual action feasibility) is sufficient for each MSO per the Section 3 

requirements. This validation would be performed on all MSOs in the plant specific MSO list 

during the Fire Area Assessment performed in 4.5 below. 

4.4.2 PHASE II: PREPARATION FOR THE EXPERT PANEL MEETING

The following steps are performed in preparation for the expert panel once Phase I is complete. 

4.4.2.1 Select Expert Panel 

Key to the expert panel process is the diverse review of Safe Shutdown Functions. This diverse 

review is performed by an expert panel comprised of experienced personnel in the major aspects 

of plant operation and fire safe shutdown. The expert panel should include the following 

expertise: 

• Fire Protection 

• Fire Safe Shutdown Analysis: This expert should be familiar with the SSA input to 

the expert panel and with the SSA documentation for existing spurious operations. 

• PRA: This expert should be familiar with the PRA input to the expert panel. 

• Operations 

• System Engineering 

• Electrical Circuits 

Additional experts may be needed, depending on the system interactions that are discussed. For 

example, water relief from a safety valve may require expertise in relief valve. Additionally, a 

single individual may provide expertise in multiple areas, such as Fire Protection and Fire SSA. 

4.4.2.2 Schedule Expert Panel 

The expert panel review for identification of MSOs performed per the guidance in Phase III 

below will likely require 2-4 days of time, depending on a number of factors. If the prescreening 

of non-applicable MSOs is performed and well documented, this should save time for the panel. 

Additionally, if the existing SSA addresses many of the MSOs in the generic list, the panel 

review would be easier. 
NEI 00-01, Revision 2 

May 2009 

81 

The expert panel review may result in questions and open action items from the MSO review. It 

may be necessary to schedule follow-up meetings of the expert panel, depending on the outcome 

of the action items. Additionally, if Fire Modeling or Focused-Scope PRA are used to 

disposition one or more MSOs, expert panel review of the dispositions would be required. 

4.4.2.3 Training 

Training is performed prior to the beginning of the expert panel. This training should include: 

1) Purpose and scope of the SSA 

2) PRA overview and results 

3) Overview training on the MSO issue, including 

a. Appendix G to this document 

b. Background on Fire-Induced MSOs 

c. “Required for Hot Shutdown” vs. “Important to Safe Shutdown” 

d. Types of circuit failures that can occur, including shorts to ground that can cause 

spurious component operation. 

e. Results of the Fire Testing (EPRI/NEI Testing), including: 

i. Likelihood of various spurious operation probabilities. 

ii. Timing including the likelihood that failures will occur close in time, and 

issues affecting time to damage. 

iii. Duration 

An Example training package for the expert panel is provided in Appendix F. 

4.4.3 PHASE III: PERFORMANCE OF THE EXPERT PANEL MEETINGS

Experts used in the MSO expert Panel are provided the information developed in Phase I above, 

and the training discussed above, prior to the performance on the expert panel meetings. The 

meetings provide a systematic review to identify any fire-induced MSOs that should be 

addressed in the plant’s SSA. The process involves a number of steps, which can be addressed 

together or as separate steps during the meeting. For example, when reviewing scenarios for 

applicability, the panel would likely also ask additional questions of whether there are similar 

scenarios of concern or whether the MSO combined with other MSOs would be a concern. Each 

of the key functions of the expert panel is discussed in the following sections. 

If the expert panel is held over a several day period, and substitute expert panel members are 

used, substitute members should also be provided the information developed in Phase I and 

training prior to participating. 
NEI 00-01, Revision 2 

May 2009 

82 

4.4.3.1 Review MSOs on the Generic List for Applicability 

The MSO expert panel will review all recommended screening dispositions on the generic MSO 

list. In this review, the expert panel will perform the following functions: 

1) Review the justification for screening. Ensure the justification follows the guidance 

above in 4.4.1, and the justification is adequate. 

2) Discuss the possible addition of alternate and similar MSO scenarios applicable for 

the plant. 

The expert panel review of the screened MSOs should be documented in a report and retained in 

support of the MSO review process. 

4.4.3.2 Review Generic MSO List for Similar or Additional MSOs 

The MSO expert panel review results in a list of potential MSOs that supplements the generic 

MSO list. The identification of similar scenarios (to those on the MSO list) is performed in a 

similar manner to the systematic review discussed in the next section. 

4.4.3.3 Review P&IDs and Electrical Diagrams for New Scenarios 

The expert panel will review and discuss one Safe Shutdown Function at a time. For that Safe 

Shutdown Function, the panel will identify possible failure mechanisms that can result from 

spurious operation or a combination of spurious operation and direct fire damage. Using various 

tools, identify “Choke Points” that could defeat safe shutdown through the previously identified 

failure mechanisms: 

• Flow Diagrams 

• Safe Shutdown Logic Diagrams 

• PRA Event Trees 

• PRA Results or Sensitivity Analysis 

The panel will build these “Choke Points” into fire scenarios to be investigated. The scenario 

descriptions that result should include the identification of specific components whose failure or 

spurious operation would result in a loss of a safe shutdown function or lead to core damage. 

The expert panel process can be run in a number of ways. A typical expert panel process 

involves a structured team review of systems and functions using a P&ID review. The P&ID 

review progresses through each P&ID by having the group review each possible flow path and 

consider the possibility and effect of a fire-induced MSO for that flow path. This consideration 

includes: 
NEI 00-01, Revision 2 

May 2009 

83 

a) Consideration of an MSO resulting in failure of the primary flow path or 

function. 

b) Consideration of an MSO that combines the failure of the flow path being 

considered in combination with other possible spurious operation to fail the 

primary flow path or function. 

The first example would occur if two or more valves spuriously open, resulting in a diversion 

and failure of the credited train. The second example could occur given spurious closure of an 

RCP seal-cooling valve, and a simultaneous spurious closure of a seal injection valve, resulting 

in a possible RCP seal LOCA. 

The expert panel review can also be performed using a review of flow diagrams, PRA events 

trees, Safe Shutdown Logic Diagrams, or similar logic structure. The general process for review 

of each is similar, although the methods for discussion may differ, given the variation in the 

information being presented to the expert panel. 

The expert panel systematically reviews each system (P&IDs, etc) affecting safe shutdown and 

the core, for the following Safe Shutdown Functions: 

o Reactivity Control 

o Decay Heat Removal 

o Reactor Coolant 

 Inventory Control 

 Pressure Control 

o Process Monitoring 

o Support Functions 

Safe Shutdown Failure Mechanisms to be considered are discussed in Appendix B. These 

mechanisms are supplemented with input from: 

o The PRA Results and sensitivity 

o Additional scenarios as previously identified in the corrective action program, 

inspections, or other identification methods (i.e., previously identified issues). 

The expert panel should make a conservative determination of the impact and likelihood of the 

scenario. This determination should be documented for each scenario, with specific information 

on each scenario being provided. Where needed, the expert panel should identify where 

additional information is needed to justify a disposition. For example, if a diversion flow path is 

considered too small to affect flow in a main flow path but some additional calculations are 

needed to justify the opinion, then the additional calculations should be noted. These open items 

should be closed prior to completion of the expert panel report. 

The expert panel will likely have to meet several times to initially disposition all possible 

systems and flow paths potentially affecting plant safe shutdown. Additional follow-up meetings 

may be needed, if open items are found to not support the initial disposition of the expert panel. 
NEI 00-01, Revision 2 

May 2009 

84 

If, for example, the small diversion flow path discussed above does result in a significant 

diversion where the main flow path does not provide sufficient flow to fulfill its function, the 

expert panel would need to meet again on this issue. 

4.4.3.4 Review of MSO Combinations 

As a final measure, the expert panel should review the plant specific list of MSOs to determine 

whether any of the individual MSOs should be combined due to the combined MSO resulting in 

a condition significantly worse than either MSO individually. This step may involve a review of 

MSOs which were previously screened as too insignificant to impact safe shutdown by 

themselves, but which might provide a significant impact to safe shutdown when combined with 

another MSO. Considerations might include MSOs where the timing of critical actions could be 

significantly impacted, and the available time to perform a required operator manual action is 

significantly reduced for the new combined MSO scenario. Consideration might also include 

situations where the combined affect of flow diversions from systems credited for post-fire safe 

shutdown provides a drastically different result than the affect of any of the individual flow 

diversions. 

In this review, consideration of key aspects of the MSOs should be factored in, such as the 

overall number of spurious operations in the combined MSOs, the circuit attributes in Appendix 

B, and other physical attributes of the scenarios. Specifically, if the combined MSOs involve 

more than a total of four components or if the MSO scenario requires consideration of 

sequentially selected cable faults of a prescribed type, at a prescribed time, in a prescribed 

sequence in order for the postulated MSO combination to occur, then this is considered to be 

beyond the required design basis for MSOs. 

The goal of this additional step is to identify any new MSO combinations (which are 

combinations of other MSOs) that could potentially provide worse consequences or timing than 

any of the individual MSOs of which it is comprised. The results of this review should be 

documented. New combined MSOs that are potentially significant should be added to the Plant 

Specific MSO List. New combined MSO should also be forwarded to NEI and the responsible 

OG for their consideration in revising the generic list of MSOs. 

4.4.3.5 Review PRA Results 

During the expert panel review, the PRA scenarios identified in Phase I are reviewed by the 

expert panel. The expert panel should review the potential scenarios to determine: 

1) Do the scenarios fail Fire Safe Shutdown? 

2) Are the scenarios already identified in the previously review MSOs, such as MSOs on 

the generic MSO list? 

If the scenario is applicable and not previously analyzed, the new scenario should be added to the 

plant specific MSO list discussed below. New MSOs should also be forwarded to NEI and the 

responsible Owner’s Group for their consideration in revising the generic list of MSOs. 
NEI 00-01, Revision 2 

May 2009 

85 

4.4.4 PHASE IV: DEVELOP COMPREHENSIVE PLANT SPECIFIC MSO LIST

Once the expert panel review is complete, the following steps are performed resulting in the 

development and documenting of a plant specific MSO list. 

4.4.4.1 Develop the Comprehensive Plant Specific MSO List 

Based on the expert panel Review above, the final MSO list would include all MSO scenarios. 

The details of the scenarios should be expanded to include the applicable components, which 

will eventually be included in the SSA (if not already included). 

4.4.4.2 MSO Categorization 

Prior to looking at the compliance strategies for each MSO, the plant specific list is reviewed to 

determine the MSO categorization (i.e.: Required for hot shutdown or important to safe 

shutdown, as explained in Appendix H). Some of the MSOs on the generic list were precategorized for the generic list. However, most required a plant specific review. Guidance for 

the categorization for each MSO is provided in Appendix H. 

4.4.4.3 Document Expert Panel Review and Post-Review 

A report of the expert panel findings should be developed. This report should be treated as a 

living calculation/report, and updated if any new information is developed or if any additional 

multiple spurious scenarios require disposition. The expert panel report should identify a list of 

scenarios that need to be addressed by the SSA. Documentation of both issues and non-issues, 

and the reason for the classification, is important. For example, if a possible scenario was 

considered not possible due to power being removed from a valve, then this is documented. This 

documentation can be carried over into the SSA. 

One of the lessons learned from the initial expert panels performed was that all scenarios 

considered, including those considered low likelihood or scenarios that would not go to core 

damage, should be documented. Additionally, the reason the scenario was not added to the plant 

specific MSO list should be documented in the report. Any supporting or supplemental analysis 

should be either added to the report or referenced. 

The documentation should include details of the new MSOs to be considered, as well as possible 

MSO scenarios that were not considered for treatment under the SSA and the reasoning for not 

recommending them for consideration. 

4.4.4.4 Fire Area Assessment of MSOs 

This step is discussed in 4.5 below. Documentation should be included in the Fire Area 

Assessment, as discussed in 3.4.2.5. The Fire Area Assessment may refer to additional analysis 

supporting the disposition such as the PRA or Fire Modeling Analysis. 
NEI 00-01, Revision 2 

May 2009 

86 

4.4.4.5 Expert Panel Review of Fire Modeling & Focused-Scope Fire PRA 

Dispositions 

As can be seen from Figure 4-1 above, MSOs dispositioned using the methods described in 

3.4.2.4 or using the circuit failure criteria from Appendix B as explained above do not need to be 

reviewed by the expert panel. All other methods of disposition, however, need to be reviewed by 

the expert panel (See 4.5.2.2 & 4.5.2.3 below). 

In this review, the expert panel will review the disposition for adequacy, as well as take into 

account additional deterministic factors, including whether the MSO is for a required for hot 

shutdown or an important to SSD component combination. This review includes: 

1) Review the justification for disposition. Ensure the justification follows the guidance 

above (or in Section 5), and the justification is adequate. 

2) Discuss the possible alternative dispositions for the MSO scenario, including traditional 

compliance methods discussed in 3.4.2. 

The review in item 2 should include the uncertainty/sensitivity of the evaluation being 

performed, the effect the traditional compliance strategy would have on other MSOs or spurious 

operations, the cumulative effect of spurious operations and fire risk in the area, and other factors 

the expert panel determines are important. 

The review of the disposition of an MSO using Fire PRA will vary slightly between the MSO 

using a focused-scope Fire PRA and a Full Fire PRA. With a full Fire PRA, the analysis of a 

compartment or area will include analysis of all potentially important fire scenarios. The expert 

panel should become familiar with the general compartment/area results, and the characteristics 

of the area that affect both overall risk and the risk for the MSO. These characteristics should be 

consistent, and given they are consistent; the expert panel review of the MSO analysis is 

somewhat simpler. With a focused-scope Fire PRA, the expert panel will need to ensure that the 

characteristics affecting the MSO analysis are consistently and accurately applied. The 

sensitivity and uncertainty analysis should include the affects of assumptions made for the fire 

characteristics, including basic factors such as fire size assumptions, non-suppression 

probabilities, etc. 

4.4.5 EXPERT PANEL REVIEW SUPPORTING NFPA 805 

The expert panel review supporting application of NFPA 805 has similar steps to the above 

process, as discussed in NFPA 805 FAQ 07-38, Lessons Learned on Multiple Spurious 

Operations. The proposed NFPA 805 process involves the identification of a plant specific MSO 

list, which is then used to update the Fire PRA model and the Nuclear Safety Capability 

Assessment (i.e., safe shutdown analysis). 

Since the NFPA 805 process differs slightly from the NEI 00-01 process, several of the steps 

above are not needed under NFPA 805. For example, the analysis of the PRA model using 

Appendix F is not needed, since the PRA model would be used as the basis for the Fire PRA 

model. Additionally, the development of Table 1 (pre-review of the SSA for spurious 
NEI 00-01, Revision 2 

May 2009 

87 

operations) may not be needed if the Fire PRA steps involve the review of the SSA scope versus 

the PRA scope to ensure the Fire PRA model includes or dispositions all SSA spurious 

operations. 

The actual performance of the expert panel to review the generic MSO list and to systematically 

review for additional scenarios beyond the generic list is basically performed the same. Once the 

plant specific MSO list is developed, the treatment of the MSOs are significantly different, with 

the PRA results being used to help determine SSA requirements (referred to as Nuclear Safety 

Capability Assessment) during the NFPA 805 process. 

4.5 ADDRESSING THE PLANT SPECIFIC LIST OF MSOS

4.5.1 CABLE SELECTION & ASSOCIATION FOR EACH COMPONENT IN AN MSO 

Components contained in any MSO that are not already included in the base SSA are added to 

the Safe Shutdown Equipment list and analyzed in the same manner as other components in that 

list. The approach outlined in Section 3.3 can be used to determine the cables associated with 

each component in an MSO combination. Cables are associated with MSO components in the 

same manner as they are associated with any other safe shutdown component. In some cases, 

only those cables with the potential to spuriously operate the component need to be added to the 

SSA. 

4.5.2 FIRE AREA ASSESSMENT AND COMPLIANCE STRATEGIES FOR MSOS

Impacts to specific MSOs are assessed on a fire area basis in the same manner as other impacts 

to post-fire safe shutdown components. If all components associated with a particular MSO are 

located in a common fire area where they have the potential, if damaged by a fire, to impact the 

required safe shutdown path for that fire area, then a mitigating strategy must be provided for the 

MSO. 

Mitigation strategies applicable to MSOs include the following as described in Section 3.4.2.4: 

1) Disposition based on consideration of Circuit Failure Criteria as applied to required 

for hot shutdown components 

2) Disposition based on use of operator manual actions. 

3) Disposition based on Fire Modeling 

4) Disposition based on a Focused-Scope Fire PRA 

Mitigation strategy 2, 3 and 4 are not generically authorized by the NRC for use with required 

for hot shutdown component MSOs. Exemptions, deviations or LARs, depending on a licensee’s 

current licensing basis, are required when using mitigation strategies 2, 3 and 4 for required for 

hot shutdown MSOs. Operator manual actions may be used within the bounds established in 

Appendix E for components classified as important to safe shutdown. Use of fire modeling 

and/or focused-scope fire PRA requires review by the Expert Panel. Finally, use of focusedscope fire PRA requires a LAR. 
NEI 00-01, Revision 2 

May 2009 

88 

Several considerations may affect the disposition method chosen for an MSO. First, the least 

expensive method for dispositioning an MSO may be the traditional compliance strategy, such as 

a design change or use of an approved operator manual action. If the PRA or Fire Modeling 

analysis takes more resources to perform than fixing the design or adding a simple operator 

manual action, then cost may dictate the approach used. If an approved operator manual action 

is used, however, consideration of the effect of this operator manual action on other fire response 

operator manual actions should be considered. For example, if the addition of a new operator 

manual action means the fire response procedure is more difficult, then the existing actions may 

become less reliable. In this case, the addition of the operator manual action may increase 

overall risk rather than reducing risk as intended. 

This balance is to be considered prior to selecting a mitigating strategy that relies upon operator 

manual action. 

4.5.2.1 Mitigation through Consideration of Circuit Failure Criteria 

Circuit failure criteria applicable to MSOs is contained in Appendix B. When evaluating the 

impact of an MSO on a particular fire area, the circuit failure types for the circuit types contained 

in Appendix B should be considered. Using the circuit failure criteria, MSOs should be 

considered as potential “combined equipment impacts”. Stated differently, if any of the fire 

induced circuit failures as described in Appendix B can cause an impact to the group of 

components in the MSO, this must be evaluated. For example, if the listed MSO were the failure 

of the block valve to close in conjunction with a spurious opening of a PORV, the block valve 

would need to be evaluated for circuit failure types that could prevent closure of the block valve, 

(i.e. a short-to-ground causing a loss of control power or an open circuit causing a loss of circuit 

continuity). Similarly, if an immediate operator manual action to close the block valve at the 

start of the fire were credited and, if a hot short could subsequently spuriously open the block 

valve in the same fire area where another hot short could cause the spurious opening of the 

PORV, then this condition also needs to be addressed. 

If all potential fire-induced circuit failures outlined in Appendix B are addressed and, if none 

leads to all components in the MSO being damaged in a manner that impacts the required postfire safe shutdown path, then the MSO is dispositioned on the basis of circuit analysis. 

If mitigation by the use of circuit analysis is not possible, then another means of mitigation, 

either one of the traditional means described in Section 3.4.2.4 for required for hot shutdown 

components, operator manual actions for important to safe shutdown components or one of the 

means listed below, must be developed. If either of the means listed below is used as the 

mitigating strategy for the MSO, then review and acceptance of the disposition by the Expert 

Panel is required. 

4.5.2.2 Fire Modeling Disposition 

Licensees currently perform qualitative fire ignition, fire spread and fire damage analysis as a 

part of fire hazard analyses, engineering equivalency evaluations, deviation requests and/or 

exemption requests, as appropriate. Use of industry accepted Fire Modeling Programs serve as 

an upgrade to this current practice. As an alternative to obtaining NRC review and concurrence 
NEI 00-01, Revision 2 

May 2009 

89 

for these types of equivalency evaluations, the Resolution Methodology proposes an additional 

enhancement to the equivalency evaluation process by the introduction of an Expert Panel 

review and concurrence for those instances where fire modeling is used to disposition an 

identified MSO Impact. 

Fire Modeling used for the disposition of MSOs must be performed consistent with the methods 

described in NUREG/CR-6850, using verified fire models as described in NUREG-1824. 

Additionally, process improvements developed for NFPA-805 applications should be considered, 

as applicable. 

When selecting a fire size for the analysis, the 98% upper bound of the fire size should be used. 

Additionally, the location of the fire would include consideration of the pinch points for the 

cables, possible ignition of secondary combustibles, etc. For transient combustibles, any location 

within the plant should be considered unless it is physically impossible. 

As discussed above, dispositions using Fire Modeling are not generically authorized by the NRC 

to be applied to MSOs categorized as required for hot shutdown component MSOs. Exemptions, 

deviations or LARs, depending on a licensee’s current licensing basis, are required to use fire 

modeling for required for hot shutdown MSOs. 

4.5.2.3 Fire PRA Disposition 

Disposition using a Focused-Scope Fire PRA is performed using Section 5, Risk Significant 

Screening. As discussed above, dispositions using Focused-scope Fire PRA are not generically 

authorized by the NRC to be applied to MSOs categorized as required for hot shutdown 

component MSOs. Exemptions, deviations or LARs, depending on a licensee’s current licensing 

basis, are required to use Focused-scope Fire PRAs for required for hot shutdown MSOs. The 

Licensee will need to review their existing Licensing basis to determine if a focused-scope Fire 

PRA is currently permitted. If not, a License Amendment may be required. Use of a focusedscope fire PRA as a mitigating measure requires review by the Expert Panel. 

4.5.3 FEEDBACK TO THE GENERIC MSO LIST

As this and other MSO methods are implemented (e.g., implementation of NFPA 805), the MSO 

list has the potential to grow. For the method above, the following criteria should be used to 

determine if any new MSO should be added to the generic MSO list: 

a. Any new MSO not on the generic list, 

b. The MSO does not screen using the conservative screening in Section 5 (i.e., 

requires detailed Fire PRA to determine the risk), or is not analyzed using Fire 

PRA resulting in a compliance strategy being applied. 

Each new MSO is to be provided to NEI and the responsible Owner’s Group. When provided, 

the new MSO should include a preliminary classification as to whether the MSO is for a required 

for hot shutdown or an important to SSD component combination. The responsible Owner’s 

Group will review the new MSO for generic applicability and revise their generic MSO list, as 
NEI 00-01, Revision 2 

May 2009 

90 

appropriate. NEI will add the new MSO list to their webpage and notify the industry of the 

change. The list of MSOs will be maintained on the NEI Webpage and by each responsible 

Owner’s Group. 

4.6 DOCUMENTATION 

Documentation should be included in the Fire Area Assessment, as discussed in 3.4.2.5 above. 

The Fire Area Assessment may refer to additional analysis supporting the disposition such as the 

PRA or Fire Modeling Analysis. 
NEI 00-01, Revision 2 

May 2009 

91 

5 RISK SIGNIFICANCE ANALYSIS 

This section provides a method for determining the risk significance of identified fire 

induced circuit failure component combinations (MSOs) to address the risk significance 

of the current circuit failure issues. 

Section 5.1 provides a translation of the plant specific MSOs that are selected for 

focused-scope fire PRA review into scenarios that can be analyzed by Fire PRA. 

Section 5.2 focuses on the preliminary screening of these circuit failures to determine if 

more detailed analysis methods are warranted. Section 5.3 provides a quantitative 

method for evaluating the risk significance of identified component combinations. 

Section 5.4 covers integrated decision making for the risk analysis, including 

consideration of safety margins and defense-in-depth considerations. 

Fire-induced circuit failure combination is identified (Section 5.1) 

Perform preliminary screening (Section 5.2). Perform safety 

margins and defense-in-depth analysis (Section 5.4.1) for any 

component combinations that screen out.

Identify the circuits and routing affecting the component 

combination of concern (Section 3) 

Evaluate the risk significance of the component combination of 

concern (Section 5.3). 

Corrective Action Program

Assess compliance status, risk significance, and possible 

corrective action as described in Sections 1.1 and 5.4 of this 

document 

Perform safety margins and defense-in-depth analysis. Screen if CDF, LERF, 

uncertainty, safety margin and defense-in-depth considerations allow. 

Figure 5-1 

Simplified Process Diagram 
NEI 00-01, Revision 2 

May 2009 

92 

5.1 COMPONENT COMBINATION IDENTIFICATION 

The purpose of this initial step is to translate the plant specific MSOs that are selected for 

Focused-scope Fire PRA review into scenarios that can be analyzed by Fire PRA. 

5.1.1 CONSIDERATION OF CONSEQUENCES

This first step limits consideration to component combinations whose mal-operation could result 

in loss of a safe shutdown function, or in immediate, direct, and unrecoverable consequences 

comparable to high/low pressure interface failures. The component combinations identified in 

Section 4 above, would initially be reviewed to ensure that the MSO scenario results in a 

consequence of concern. This review must take into account all possible fire-induced failures, 

and the overall effect of the MSO on the plant risk. 

5.1.2 SELECTION OF MSO SCENARIOS TO BE ANALYZED

The purpose of this review is to ensure the proper level of risk is assessed for the possible 

component combinations prior to screening a combination for consideration. Given an MSO 

combination is provided, this combination will result in one or more PRA scenarios of interest. 

The MSO scenario may need further definition at this point, including identification of additional 

fire-damaged components, timing issues, etc. Timing issues may include details such as 

component A would need to spuriously operate before component B for the scenario to affect 

safe shutdown. 

At the end of this step, the MSO description would be translated into one or more scenarios that 

can be analyzed using a focused scope Fire PRA. The scenarios may be slightly different for 

each fire area or compartment where the MSO is possible, but this differentiation would occur 

later in the steps below. 

5.2 PRELIMINARY SCREENING 

The “risk screening tool” presented here is taken directly from Reference 7.4.43, as updated by 

the original authors. It is the result of the NRC’s effort to develop this method. Adapted from 

NEI 00-01 Rev 0 [Ref. 7.4.46], it is relatively simple, based on measures readily available from 

the FP SDP [Ref.7.4.45], but conservative in that credits are limited to ensure the likelihood of 

“screening out” a circuit issue that could be of greater-than-very-low-risk-significance is 

minimized. Examples of this conservatism include use of generic fire frequencies based on fire 

zone or major components; treatment of potentially independent spurious actuations as 

dependent (i.e., no multiplication of more than two probabilities); crediting of manual 

suppression in a fire zone only if detection is present there; and choice of the most stringent 

screening criterion from Ref. 7.4.46. Note that none of the “additional considerations” among 

the screening factors below is permitted to introduce a factor <0.01 as a multiplier. 
NEI 00-01, Revision 2 

May 2009 

93 

5.2.1 SCREENING FACTORS 

The following screening factors are used. 

5.2.1.1 Fire Frequency (F) 

Table 1.4.2 of the FP SDP [Ref. 7.4.45] (modified here as Table 4-5 for use in the subsequent 

example application) and Table 4-3 of EPRI-1003111 [Ref. 7.4.44] list the mean fire frequencies 

at power by plant location and ignition source. The frequencies are characteristic of a fire 

occurring anywhere within the location. The mean fire frequencies by location range from a 

minimum of ~0.001/yr (Cable Spreading Room in Ref. 7.4.45; Battery Room in Ref. 7.4.44) to 

maximum of ~0.1/yr (Boiling Water Reactor Building in Ref. 674.45; Turbine Building in both 

Ref.7.4.44 and Ref. 7.4.45). These values used in Ref. 7.4.44 and Ref. 7.4.45 eliminate fire 

events judged to be “non-challenging.” Considering uncertainties in their probability 

distributions (somewhat reflected in the two-sided 90% upper and lower confidence bounds in 

Ref. 7.4.44), the following ranges for fire frequencies are used: 

• HIGH, >0.03/yr but <1/yr 

• MEDIUM, >0.003/yr but <0.03/yr 

• LOW, <0.003/yr 

5.2.1.2 Probability of Spurious Actuation (P) 

Table 2.8.3 of the Ref. 7.4.45 (modified here as Table 5-6 for use in the subsequent example 

application) and Tables 7.1 and 7.2 of Ref. 7.4.40 provide point estimates for the probability of 

spurious actuation ranging from a minimum of “virtually impossible” (armored inter-cable 

interactions in Ref. 7.4.45; armored thermoset inter-cable interactions in Ref. 7.4.40) to a 

maximum approaching 1.0 (“no available information about cable type or current limiting 

devices” in Ref. 7.4.45; any intra-cable short in Ref. 7.4.40). Ref. 7.4.40 also provides ranges for 

these estimates. The lowest non-zero values are 0.01 for “in-conduit, inter-cable only” in Ref. 

7.4.45. 

NRC Regulatory Issue Summary 2004-03 [Ref. 6.6.1] states that “for cases involving the 

potential damage of more than one multiconductor cable, a maximum of two cables should be 

assumed to be damaged concurrently”. Therefore, no more than two multiple spurious 

actuations within separate cables are assumed to be independent when calculating the probability 

P, i.e., no more than two of the spurious actuation probabilities in Ref. 7.4.40 or Ref. 7.4.45 

should be multiplied together. Consideration of this conservative assumption and the ranges cited 

in these reports suggests the following ranges for conditional probability of spurious actuation: 

• HIGH, >0.3 but <1 _ 

• MEDIUM, >0.03 but <0.3 

• LOW, >0.003 but <0.03 _ 

• VERY LOW, <0.003 
NEI 00-01, Revision 2 

May 2009 

94 

Multiplying F and P over their respective ranges yields the maxima shown in Table 5-1 for the 

pairings F*P. 

5.2.1.3 Additional Considerations 

The F*P pairings represent the frequency of a fire-induced spurious actuation of a component 

combination. Core damage will occur only if (1) the fire is localized and severe enough to 

induce spurious actuation; (2) the fire is not suppressed prior to inducing the spurious actuation; 

and (3) other non-fire related contingencies, including human actions and equipment operation, 

are unsuccessful. Thus, for core damage to occur, there must also be a “challenging” fire; failure 

to suppress the fire prior to the spurious actuation; and failure to avoid core damage via non-fire 

means, represented by the conditional core damage probability (CCDP). The number of 

potentially vulnerable locations (zones) addresses possible variation in the screening threshold 

frequency depending upon the number of zones that the equipment traverses where there is a 

potential for fire damage. 

5.2.1.4 Challenging Fire (G) 

Fires can vary in magnitude, ranging from small, essentially self-extinguishing, electrical relay 

fires to complete combustion of an entire compartment. To estimate how challenging a fire 

could be for screening purposes, we consider the largest fire source in the zone and combustible 

type. Ref. 7.4.45 specifies categories (bins) for both fire type and size.5

 The factor (G), 

independent from the fire frequency, for a challenging fire is based on combustible type. 

Table 2.3.1 of the Ref. 7.4.45 (modified here as 5-7 for use in the subsequent example 

application) assigns both 50th and 95th percentile fires for various combustibles to fire size bins 

ranging from heat release rates of 70 kW to 10 MW. Fires in the 70 kW-200 kW range are 

considered small; 200 kW-650 kW moderate; and >650 kW large. Typically, some train 

separation is built into plant designs in accordance with NRC Regulatory Guide 1.75 [Ref. 

7.4.50]. Therefore, small fires are not likely to damage separated trains. Although moderate 

fires are more damaging, some credit for train separation can still be expected. 

Based on the above, for small or moderate size fires that are not expected to be challenging, such 

as small electrical fires, a factor of 0.01 is applied. For moderate severity fires, including larger 

electrical fires, a factor of 0.1 is applied. For large fires, including those from oil-filled 

transformers or very large fire sources, the factor is 1. 

5.2.1.5 Fire Suppression (S) 

Both automatic and manual fire suppression (including detection by automatic or manual means) 

are creditable. It is assumed that automatic is preferred and a more reliable suppressor than 

manual, suggesting a non-suppression probability of 0.01 for automatic and 0.1 for manual.6

 If 

automatic can be credited, then manual will not. Manual will only be credited if automatic 

 5

 Room size and other spatial factors also influence how challenging a fire can be. However, we do not 

consider these for screening purposes. 6

 To credit manual suppression, this method assumes that detection must be present in the fire zone. 
NEI 00-01, Revision 2 

May 2009 

95 

 

cannot. Thus, the product F*P will be reduced by a factor of either 0.01 (if automatic 

suppression is creditable) or 0.1 (if automatic suppression is not creditable, but manual is).7 

Both, implying a reduction by 0.001, will never be credited. Thus, the maximum reduction in 

the product F*P that can be achieved through consideration of fire suppression is 0.01. 

Note the following exception. Energetic electrical fires and oil fires, which are likely to be the 

most severe fires at a nuclear power plant, may grow too quickly or too large to be controlled 

reliably by even a fully creditable automatic suppression system. This is not due to degradation 

of the system but to the characteristics of the fire. Therefore, for fire zones where energetic 

electrical8

 or oil fires may occur, no credit will be given to manual suppression, while that for 

automatic will be reduced to 0.1. 

5.2.1.6 CCDP (C) 

There should be at least one fire-independent combination of human actions and equipment 

operation to prevent core damage, provided these are not precluded by the fire itself or its effects. 

To incorporate this, a CCDP, given the preceding ignition and failures, must be appended to the 

F*P*G*S value. Table 2.1.1 of the FPSDP (modified here as Table 5-8 for use in the subsequent 

example application) specifies three types of “remaining mitigation capability” for screening 

CCDP unavailabilities based on safe shutdown path. These are (1) 0.1 if only an automatic 

steam-driven train can be credited; (2) 0.01 if a train that can provide 100% of a specified safety 

function can be credited; and (3) 0.1 or 0.01 depending upon the credit that can be assigned to 

operator actions.9

 

For this last group, a value of 0.1 is assumed if the human error probability (HEP) lies between 

0.05 and 0.5, and 0.01 if the HEP lies between 0.005 and 0.05. Credit is based on additional 

criteria being satisfied, as listed in Table 2.1.1 of the FPSDP.10 

5.2.1.7 Factor for Number of Vulnerable Zones (Z) 

While there is no way to know a priori the exact number of fire zones through which the 

vulnerable equipment will pass, or the number of these where there is potential for fire damage, 

something on the order of 10 zones will be conservatively assumed for screening purposes. 

7

 If neither is creditable (e.g., no automatic suppression system and timing/location/nature/intensity of fire 

precludes manual suppression), there will be no reduction in the product F * P. This would apply to 

scenarios where the source and target are the same or very close to one another. Fire suppression may not 

be creditable due to insufficient time for suppression prior to cable damage. This is expected to be a rare 

event and should not be considered unless the configuration clearly shows that immediate component 

damage is likely to occur. 

8

 Ref. 7.4.48 documents energetic faults only in nuclear power plant switchgear >4 kV. The FP SDP 

considers both switchgear and load centers as low as ~400 V subject to energetic faults. Consistent with 

the nature of this screening tool, the FP SDP approach is suggested (i.e., considering switchgear and load 

centers down to ~400 V as subject to energetic faults). 

9

 Even the lower value of 0.01 is considered conservative based on Ref. 8, which cites several examples 

where non-proceduralized actions by plant personnel averted core damage during severe fires. Of the 25 

fires reviewed, none resulted in core damage. 

10 These criteria include available time and equipment; environmental conditions; procedural guidance; and 

nature of training. 
NEI 00-01, Revision 2 

May 2009 

96 

 

Typically, plant control wiring follows a relatively direct path from control cabinet to actuated 

device, so it is unlikely that 10 fire zones would be involved. In many plants, the number of fire 

zones involved could be as small as 2 or 3. Theoretically, the total frequency of core damage 

from spurious actuation would be the sum of the frequencies from the individual zones. In 

general, a higher value would be expected for a higher number of zones. Thus, some type of 

credit is given for a scenario where the number of vulnerable zones is less than the assumed 

generic number of 10, say, e.g., five zones or less. 

This type of credit would translate into an increase in the screening threshold frequency per zone 

(call it X), or equivalently a decrease in the zonal core damage frequency (call it D). If we 

assume limiting the number of vulnerable zones to five or less produces at least a 10% increase 

in the allowable frequency for zonal screening, i.e., 1.1X, this translates into a decrease in the 

zonal core damage frequency (D) by a factor Z. To estimate Z, consider the following. 

For zonal core damage frequency (D) to meet the threshold (X), D must be < X. For five or less 

vulnerable zones, we allow an increase to at least 1.1X, such that the zonal core damage 

frequency meets this new threshold, D < 1.1X. Relative to the original threshold, X, we require 

X > D/1.1, or X > 0.9D. The factor 0.9 corresponds to a maximum value for Z for five or less 

vulnerable zones. 

5.2.2 SIX-FACTOR FREQUENCY OF CORE DAMAGE (F*P*G*S*C*Z) 

The maximum frequencies that result from assuming the maximum credits for G (0.01), S (0.01), 

C (0.01) and Z (0.9), i.e., a joint credit of 9E-7, for the F*P pairings are shown in Table 4-2. 

Revision 0 of this document stated that “[t]he criteria for risk significance are ... consistent with 

Regulatory Guide 1.174 [Reference 7.4.50] guidance.” The plant specific risk significance 

screening in Revision 0 states that “the criteria for determining that component combinations are 

not risk significant are as follows: 

• If the change in core damage frequency (delta-CDF) for each component combination for 

any fire zone is less than 1E-7 per reactor year, AND 

• If the delta-CDF for each component combination is less than 1E-6 per reactor year for 

the plant, i.e., sum of delta-CDF for all fire zones where circuits for the component 

combinations (circuits for all) are routed, AND 

• If the delta-CDF for each fire zone is less than 1E-6 per reactor year for the plant, i.e., the 

sum of delta-CDF for all combinations of circuits in the fire zone.” 

Of these three criteria, the most stringent is the first, requiring the delta-CDF to be <1E7/yr. This seems to be the appropriate criterion to apply to the Six-Factor Frequency of 

Core Damage since this is the preliminary screening stage.11 In Table 5-2, neither of the 

shaded boxes satisfies this criterion exclusively, while the unshaded boxes may satisfy 

this criterion in certain cases. 

11 For this preliminary screening delta-CDF is conservatively approximated by CDF itself. 
NEI 00-01, Revision 2 

May 2009 

97 

5.2.3 FINAL SCREENING TABLE

Restricting the values for challenging fires (G), fire suppression (S), CCDP (C), and the factor 

for number of vulnerable zones (Z) as shown via the point assignments below,12 the cases where 

this criterion is satisfied are indicated in Table 5-3. These correspond to the cases where 

preliminary “screening to green” can be assumed successful.13 

5.2.3.1 Steps to Use Table 5-3 

1. Determine the fire frequency. Use either the generic fire zone frequency or the fire 

frequency refined by the component-based fire frequency tool in the FPSDP. 

2. Determine the probability of spurious actuation, from the FPSDP. If multiple spurious 

actuations are involved, no more than two of the spurious actuation probabilities should 

be multiplied together. 

3. Determine the block on the table that corresponds to the fire frequency and probability of 

spurious actuation. 

4. Determine if the fire is challenging and, if so, to what degree. Use the fire type for the 

single largest fire source in the zone. For example, a zone with both small and large fires 

would be considered subject to large fires only (i.e., there is no combination). 

5. Determine the fire suppression factor. If both manual and automatic suppression can be 

credited, the more effective (automatic) is the only one receiving credit (i.e., there is no 

combination).14 

6. Determine the CCDP. If no mitigation capability remains, assume a CCDP = 1. 

7. Determine the number of vulnerable zones. 

8. Sum the points as assigned below to determine if the zone can be screened to green. 

Challenging Fires (G)

Large fires = 0 point 

Moderate fires = 1 point 

Small fires = 2 points 

 12 Each point is roughly equivalent to a factor of ten reduction or the negative exponent of a power of 10, 

e.g., 1 point corresponds to 1E-1 = 0.1, 2.5 points correspond to 1E-2.5 = 0.003 

13 “Screening to green” in the FPSDP indicates a finding of very low risk-significance that need not be 

processed further. 

14 Credit is reduced for energetic electrical and oil fires. 
NEI 00-01, Revision 2 

May 2009 

98 

Fire Suppression (S)

None fully creditable = 0 point 

Only manual fully creditable = 1 point 15(reduced to 0 point for energetic 

electrical or oil fires) 

Automatic fully creditable = 2 points (reduced to 1 point for energetic electrical or 

oil fires) 

CCDP (C)

No mitigation capability creditable = 0 point 

Only an automatic steam-driven train or operator actions with 0.05 < HEP < 0.5 

creditable = 1 point16 

A train providing 100% of a specified safety function creditable = 2 points 

Factor for Number of Vulnerable Zones (Z) 

Greater than five zones = 0 point 

Five zones or less = 0.5 point 

As shown in Table 5-3, screening at this preliminary stage is not possible if the fire 

frequency is HIGH and the probability of spurious actuation is HIGH or MEDIUM. All 

other combinations may be screenable if the point criteria are satisfied. 

5.2.3.2 Relative Ranking Evaluation 

For analyses where all zones screen, Table 5-4 can be used to evaluate which zone is likely to be 

the most risk-significant. Table 5-4 converts the F*P maximum frequencies from Table 5-1 into 

their point equivalents for each F*P pairing.17 The pairing point equivalent should be added to 

the total point credits from the preliminary screening to establish the total risk-significance of 

each zone. The zone with the lowest point total is viewed as the most risk-significant. At least 

this one zone should be processed through the FPSDP to verify the validity of the tool, i.e., to 

verify that the tool did not give a false positive. These FPSDP results, and not the results from 

the preliminary screening tool, should be used to determine the risk-significance of the finding in 

Phase 2 of the FPSDP. 

 15 As mentioned earlier, detection must be present in the fire zone to take credit for manual suppression. 

16 As mentioned earlier, the credit for operator actions is based on additional criteria being satisfied, 

including available time and equipment; environmental conditions; procedural guidance; and nature of 

training. 

17 Recall that each point is roughly equivalent to a factor of ten reduction, or the negative exponent of a 

power of 10. Thus, the F*P pairing for HIGH-HIGH in Table 1 (1/yr = 1E-0/yr) receives 0 point in Table 4, 

while that for LOW-VERY LOW (1E-5/yr) receives 5 points. 
NEI 00-01, Revision 2 

May 2009 

99 

 

5.2.4 EXAMPLE APPLICATION 

The following example, somewhat exaggerated for illustration purposes, presents the use of the 

preliminary screening tool. Assume an FPSDP inspection finding that cables for a pressurized 

water reactor (PWR) power-operated relief valve and its accompanying block valve are routed 

through the following five fire zones: the auxiliary building, battery room, cable spreading room, 

emergency diesel generator room, and main control room. Fire damage to the cables can result 

in the spurious opening of these valves. The cables are thermoset throughout and are encased in 

an armor jacket only in the battery room. Table 5-6 assigns a probability of spurious actuation of 

0.6 to thermoset cables for which no other information is known, which lies in the HIGH range 

in Table 5-3. 

The auxiliary building and emergency diesel generator room are protected by automatic sprinkler 

systems. The switchgear room has an automatic Halon-1301 system. The battery room and main 

control room have smoke detectors but rely on hand-held extinguishers and hoses for manual fire 

suppression. 

5.2.4.1 Auxiliary Building 

Table 5-5 indicates a generic fire frequency for an auxiliary building of 0.04/yr, which lies in the 

HIGH range in Table 5-3. Since the corresponding probability of spurious actuation is also 

HIGH, this zone cannot be screened using this tool. 

5.2.4.2 Battery Room 

Table 5-5 indicates a generic fire frequency for a battery room of 0.004/yr, which lies in the 

MEDIUM range. Since the cable is armored in this room, the probability of spurious actuation is 

virtually nonexistent, corresponding to the VERY LOW range. Table 5-3 indicates that 

preliminary screening is possible for this zone with > 3 points. 

Small fires can be expected in the battery room, which earns 2 points from Table 5-7 for fire size 

(G). Only manual suppression can be credited because of the portable fire extinguishers and 

automatic detection, producing 1 point for fire detection/suppression (S). No mitigation 

capability is creditable since both DC trains could be lost in a battery room fire; no point is 

assigned from Table 5-8 for CCDP (C).18 There are a total of 5 vulnerable zones, so 0.5 point is 

assigned for the number of vulnerable zones (Z). The points for the battery room total to 3.5, 

therefore permitting preliminary screening. 

5.2.4.3 Cable Spreading Room - Cables Only 

Table 5-5 indicates a generic fire frequency for a cable spreading room with cables only of 

0.002/yr, which lies in the LOW range. With no other information known, the thermoset cable 

has a probability of spurious actuation of 0.6 from Table 5-6, i.e., lying in the HIGH range in 

Table 5-3. As a result, >4.5 points are needed to screen this zone. 

18 This conservative assumption of total loss of DC power is for illustration only. 
NEI 00-01, Revision 2 

May 2009 

100 

 

Small fires can be expected in the cable spreading room, which earns 2 points from Table 5-7 for 

fire size. The automatic Halon extinguishing system results in a credit of 2 points for fire 

detection/suppression. A remote shutdown station can be credited, meriting 1 point from Table 

5-8 for CCDP.19 There are a total of 5 vulnerable zones, so 0.5 point is assigned. The points for 

the cable spreading room total to 5.5, therefore permitting preliminary screening. 

5.2.4.4 Emergency Diesel Generator Building 

Table 5-5 indicates a generic fire frequency for an emergency diesel generator room of 0.03/yr, 

which lies in the HIGH range. With no other information known, the thermoset cable has a 

probability of spurious actuation of 0.6 from Table 5-6, i.e., lying in the HIGH range in Table 5-

3. As a result, this zone cannot be screened using this tool. 

5.2.4.5 Main Control Room 

Table 5-5 indicates a generic fire frequency for a main control room of 0.008/yr, which lies in 

the MEDIUM range. With no other information known, the thermoset cable has a probability of 

spurious actuation of 0.6 from Table 5-6, i.e., lying in the HIGH range in Table 5-3. As a result, 

>5.5 points are needed to screen this zone. 

Moderate-sized fires are expected in the main control room due to the large number of cables and 

electrical equipment present. Therefore, 1 point is assigned from Table 5-7 for fire size. The 

portable fire extinguishers and automatic smoke detection merit 1 point fire detection/ 

suppression. One of two completely independent and redundant trains providing 100% of the 

specified safety function (Residual Heat Removal)20 remains fully creditable, meriting 2 points 

from Table 5-8 for CCDP. There are a total of 5 vulnerable zones so 0.5 point is assigned. The 

points for the main control room total to only 4.5, therefore preventing preliminary screening. 

5.2.4.6 Conclusions 

Only the Battery Room and Cable Spreading Room could be screened using this tool. The 

remaining zones would require more detailed analyses to assess each delta-CDF through the 

FPSDP. In this example the cables ran through fire zones with different fire initiator 

frequencies, cable types (and therefore spurious actuation probabilities), potential fire sizes, 

suppression systems, and core damage mitigation capabilities. The example illustrates that it is 

easier to screen zones with lower fire initiator frequencies and probabilities of spurious actuation 

than zones with higher values. Fire zones with lower F*P pairings require less credit from the 

“additional considerations” (G*S*C*Z) to satisfy the screening threshold of delta-CDF < 1E7/yr. 

19 A human error probability for Operator Action between 0.05 and 0.5 is assumed for operator actions at a 

remote shutdown station, which yields a credit of 1 point. As per Table 8, this credit also assumes that: (1) 

sufficient time is available; (2) environmental conditions allow access, where needed; (3) procedures 

describing the appropriate operator actions exist; (4) training is conducted on the existing procedures under 

similar conditions; and (5) any equipment needed to perform these actions is available and ready for use. 

20 Residual Heat Removal need not be the only safety function to achieve safe shutdown. This is an 

assumption for illustration only. 
NEI 00-01, Revision 2 

May 2009 

101 

5.2.5 SUMMARY 

This risk-screening tool can be applied to fire-induced, circuit spurious actuation scenarios 

identified in 5.1 above. These findings typically involve the multiple fire zones through which 

the circuits pass. To streamline the FPSDP, the tool screens zones where the "circuit issue" is 

expected to be of very low risk-significance based on (1) the fire frequency in the zone where the 

circuits are located; (2) the probability of spurious actuation; and (3) automatic or manual 

suppression, or an alternate means to achieve hot shutdown. 

The tool estimates six factors to calculate the frequency of core damage: (1) zonal fire frequency; 

(2) spurious actuation probability; (3) challenging fire factor; (4) probability of non-suppression; 

(5) CCDP; and (6) factor based on number of vulnerable zones. The tool determines if a fire 

zone, once it has been assigned to a fire frequency-spurious actuation probability pairing (i.e., the 

first two factors), can be screened at a maximum delta-CDF threshold of 1E-7/yr based on a 

point system for the remaining four factors. 
NEI 00-01, Revision 2 

May 2009 

102 

TABLE 5-1. Maxima for the 

Pairings F*P (With Round off to the 

Nearest “3" or “1" for Convenience)

Fire frequency (F)

HIGH, 

>0.03/yr but 

<1/yr 

MEDIUM, 

>0.003/yr but 

<0.03/yr 

LOW, 

<0.003/yr 

Probability 

of spurious 

actuation 

(P) 

HIGH, >0.3 but 

<1 1/yr 0.03/yr 0.003/yr 

MEDIUM, >0.03 

but <0.3 0.3/yr 0.009/yr 

(~ 0.01/yr) 

9E-4/yr 

(~0.001/yr) 

LOW, >0.003 but 

<0.03 0.03/yr 9E-4/yr 

(~ 0.001/yr) 

9E-5/yr 

(~1E-4/yr) 

VERY LOW, 

<0.003 0.003/yr 9E-5/yr 

(~1E-4/yr) 

9E-6/yr 

(~1E-5/yr) 

TABLE 5-2. Maxima That 

Result from Maximum Credits 

for G (0.01), S (0.01), C (0.01) 

and Z (0.9), i.e., a Joint Credit 

of 9E-7 

Fire frequency (F)

HIGH, >0.03/yr 

but <1/yr

MEDIUM, 

>0.003/yr but 

<0.03/yr

LOW, 

<0.003/yr

Probability of 

spurious 

actuation (P) 

HIGH, >0.3 

but <1 9E-7/yr 3E-8/yr 3E-9/yr 

MEDIUM, 

>0.03 but <0.3 3E-7/yr 9E-9/yr 9E-10/yr 

LOW, >0.003 

but <0.03 3E-8/yr 9E-10/yr 9E-11/yr 

VERY LOW, 

<0.003 3E-9/yr 9E-11/yr 9E-12/yr 
NEI 00-01, Revision 2 

May 2009 

103 

TABLE 5-3. Point 

Requirements for 

Screening (Note use of “>” vs. 

“>,” i.e., points must EXCEED 

numbers shown) 

Fire frequency (F)

HIGH, 

>0.03/yr but 

<1/yr 

MEDIUM, 

>0.003/yr but 

<0.03/yr 

LOW, 

<0.003/yr 

Probability 

of

spurious 

actuation 

(P)

HIGH, >0.3 but 

<1 Do not screen 

Screen to green 

with > 5.5 

points 

Screen to green 

with > 4.5 

points 

MEDIUM, >0.03 

but <0.3 Do not screen Screen to green 

with > 5 points 

Screen to green 

with > 4 points 

LOW, >0.003 but 

<0.03 

Screen to green 

with > 5.5 

points 

Screen to green 

with > 4 points 

Screen to green 

with > 3 points 

VERY LOW, 

<0.003 

Screen to green 

with > 4.5 

points 

Screen to green 

with > 3 points 

Screen to green 

with >2 points 
NEI 00-01, Revision 2 

May 2009 

104 

TABLE 5-4. Establishing Relative Risk Ranking When All Zones Preliminarily Screen17 

Fire 

frequency 

(F) 

Probability of 

spurious 

actuation (P) 

Points 

Preliminary 

screen total

Table 4-1 

equivalents Risk-ranking total

HIGH 

HIGH (Zone A - 4) 0 (Zone A - 4) 

MEDIUM 0.5 

LOW (Zone B - 3) 1.5 (Zone B - 4.5) 

VERY LOW 2.5 

MEDIUM 

HIGH (Zone C - 2) 1.5 (Zone C - 3.5) 

MEDIUM 2 

LOW (Zone D - 2.5) 

(Zone E - 3) 3 (Zone D - 5.5) (Zone E - 6) 

VERY LOW 4 

LOW 

HIGH 2.5 

MEDIUM (Zone F - 3.5) 3 (Zone F - 6.5) 

LOW 4 

VERY LOW (Zone G - 1.5) 5 (Zone G - 6.5) 

Table 5-4 includes an example (items in parentheses) where none of a total of seven zones satisfied the 

preliminary screening criteria of Table 5-3. When ranked relative to one another using the point equivalents from 

Table 5-1, Zone C proved to be of highest relative risk-significance (lowest total points, 3.5). At a minimum, 

Zone C would be processed through Phase 2 of the FPSDP (followed by Zone A, Zone B, etc., if the analyst chose 

to process more). 
NEI 00-01, Revision 2 

May 2009 

105 

TABLE 5-5. Generic Location Fire Frequencies

Room Identifier 

Generic Fire 

Frequency 

(Range)

Auxiliary Building (PWR) 4E-2 (HIGH) 

Battery Room 4E-3 (MEDIUM) 

Cable Spreading Room - Cables Only 2E-3 (LOW) 

Cable Spreading Room - Cables Plus Other Electrical Equipment 6E-3 (MEDIUM) 

Cable Vault or Tunnel Area - Cables Only 2E-3 (LOW) 

Cable Vault or Tunnel Area - Cables Plus Other Electrical Equipment 6E-3 (MEDIUM) 

Containment - PWR or Non-inerted Boiling Water Reactor (BWR) 1E-2 (MEDIUM) 

Emergency Diesel Generator Building 3E-2 (HIGH) 

Intake Structure 2E-2 (MEDIUM) 

Main Control Room 8E-3 (MEDIUM) 

Radwaste Area 1E-2 (MEDIUM) 

Reactor Building (BWR) 9E-2 (HIGH) 

Switchgear Room 2E-2 (MEDIUM) 

Transformer Yard 2E-2 (MEDIUM) 

Turbine Building - Main Deck (per unit) 8E-2 (HIGH) 
NEI 00-01, Revision 2 

May 2009 

106 

TABLE 5-6. Probabilities of Spurious Actuation Based on Cable Type and Failure Mode 

(Range) 

State of Cable Knowledge Thermoset Thermoplastic 

No available information about cable 

type or current limiting devices 0.6 (HIGH) 

Cable type known, no other 

information known (NOI) 0.6 (HIGH) 

Inter-cable interactions only 0.02 (LOW) 0.2 (MEDIUM) 

In conduit, cable type known, NOI 0.3 (HIGH) 0.6 (HIGH) 

In conduit, inter-cable only 0.01 (LOW) 0.2 (MEDIUM) 

In conduit, intra-cable 0.075 (MEDIUM) 0.3 (HIGH) 

TABLE 5-7

General Fire Scenario Characterization Type Bins Mapped to Fire Intensity Characteristics

Fire 

Size 

Bins

Generic Fire Type Bins with Simple Predefined Fire Characteristics (Points Assigned)

Small 

Electrical Fire 

(2 points)

Large 

Electrical 

Fire

(1 point)

Indoor OilFilled 

Transformers

(0 point)

Very Large 

Fire 

Sources 

(0 point)

Engines 

and 

Heaters

(2 points)

Solid and 

Transient 

Combustibles

(2 points)

70 kW 50th %ile fire 50th %ile 

fire 50th %ile fire 

200 

kW 95th %ile fire 50th %ile 

fire 

95th %ile 

fire 95th %ile fire 

650 

kW

95th %ile 

fire 50th %ile fire 50th %ile fire 

2 MW 95th %ile fire 

10 

MW 95th %ile fire 
NEI 00-01, Revision 2 

May 2009 

107 

TABLE 5-8. Total Unavailability Values for SSD Path-Based Screening CCDP 

Type of Remaining Mitigation Capability 

Screening 

Unavailability 

Factor (Points 

Assigned) 

1 Automatic Steam-Driven Train: A collection of associated equipment that 

includes a single turbine-driven component to provide 100% of a specified 

safety function. The probability of such a train being unavailable due to 

failure, test, or maintenance is assumed to be approximately 0.1 when 

credited as “Remaining Mitigation Capability.” 

0.1 (1 point) 

1 Train: A collection of associated equipment (e.g., pumps, valves, 

breakers, etc.) that together can provide 100% of a specified safety 

function. The probability of this equipment being unavailable due to 

failure, test, or maintenance is approximately 0.01 when credited as 

“Remaining Mitigation Capability.” 

0.01 (2 points) 

Operator Action Credit: Major actions performed by operators during 

accident scenarios (e.g., primary heat removal using bleed and feed, etc.). 

These actions are credited using three categories of human error 

probabilities: 

(1) Operator Action = 1.0, which represents no credit given; 

(2) Operator Action = 0.1, which represents a failure probability between 

0.05 and 0.5; and 

(3) Operator Action = 0.01, which represents a failure probability between 

0.005 and 0.05. 

Credit is based upon the following criteria being satisfied: 

(1) sufficient time is available; 

(2) environmental conditions allow access, where needed; 

(3) procedures describing the appropriate operator actions exist; 

(4) training is conducted on the existing procedures under similar 

conditions; and 

(5) any equipment needed to perform these actions is available and ready 

for use. 

1.0 (0 point), 

0.1 (1 point), or 

0.01 (2 points) 
NEI 00-01, Revision 2 

May 2009 

108 

5.3 PLANT SPECIFIC RISK SIGNIFICANCE SCREENING 

Based on the evaluations performed in Section 5.2 and Section 3 of this document, the licensee 

may determine that additional risk significance analysis is warranted. The NRC’s revised Fire 

Protection SDP (FPSDP) [Ref 7.4.45] is a useful tool for this purpose; it will be used by NRC 

inspectors evaluating the risk significance of circuit failure findings. It calculates the change in 

Core Damage Frequency for the finding. Other deterministic or probabilistic means may be 

employed, including plant specific PRA calculations. Plant specific PRA calculations should 

utilize the results of EPRI Report 1011989 (also NUREG/CR-6850), “EPRI/NRC-RES Fire PRA 

Methodology for Nuclear Power Facilities,” as updated by the NFPA 805 FAQ process 

(Reference 7.4-58). 

5.3.1 EPRI/NEI TEST RESULTS

EPRI TR-1006961, “Spurious Actuation of Electrical Circuits due to Cable Fires, Results of an 

Expert Elicitation” (Reference 7.4-39) is referenced in both the preliminary screening and 

detailed screening in the determination of delta-CDF. More information about these results is 

provided here. 

The expert panel report provides a general methodology for determining spurious operation 

(actuation) probabilities. PSA is given by the product: 

 PSA = PCD * PSACD

 PCD = The probability of cable damage given a specified set of time-temperature and fireseverity conditions, and 

PSACD = The probability of spurious actuation given cable damage 

PCD can be calculated using fire modeling, taking into account the factors affecting damage and 

the expected time response for suppression. Additionally, the expert panel report provides 

fragility curves for cable damage versus temperature for thermoset, Thermo-plastic and armored 

cables. This curve is provided below: 
NEI 00-01, Revision 2 

May 2009 

109 

FIGURE 5-2 

Fragility Curves for Thermoset, Thermoplastic, and Armored Cable Anchored to 

the 5%, 50%, and 95% Probability Values for PCD (Reference 6.4.39 Figure 7-1) 

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

400430460490520550580610640670700730760790820850880910940970

10001030106010901120

11501180

T t t th C bl D F

Probability of Any Cable Damage

Thermoset

Thermoplastic

Armored

There is a considerable body of test information on cable damageability tests, the results of 

which are not significantly different from these curves. Information on cable damageability is 

available from these other tests that the analyst may use in lieu of this curve. 

This figure is not used in the preliminary screening process, meaning PCD = 1 and the spurious 

operation probability is conservatively estimated as PSACD. For the detailed screening (Section 

5.2), PCD can be factored in, given analysis is performed to determine maximum cable 

temperature for the fire scenario being analyzed. The pilot reports did not use PCD for either 

screening process. 
NEI 00-01, Revision 2 

May 2009 

110 

PSACD can be estimated using Table 5-9. Some general guidance on this is as follows: 

 Values in the table, other than B-15, assume control power transformers (CPTs) or other 

current limiting devices are in the circuit. To determine the probability of a spurious 

actuation without a CPT or other current limiting device in the circuit, the listed value 

should be multiplied by a factor of 2 * [PSACD(B-15)/PSACD(B-1)] . 

 Based on the Reference 7.5-39, when two PSACD (PSA) values are used in the fire PRA, 

they should be treated as independent events, provided the phenomena occur in different 

conductors – thus, the two PRA probabilities should be multiplied together. 

Additional guidance on the use of this table is provided in the expert panel report 

(Reference 7.4-39). 

EPRI TR-1003326, Characterization of Fire-Induced Circuit Failures: Results of Cable 

Fire Testing, provides supplemental information to the expert panel report. This report 

provides detailed analysis for each of the tests and characterizes the factors affecting 

circuit failures in much more detail than the expert panel report. One area discussed by 

this report is duration of spurious operation events. The test data used for the EPRI report 

shows that a majority of the circuit failures resulting in spurious operation had a duration of 

less than 1 minute. Less than 10% of all failures lasted more than 5 minutes, with the 

longest duration recorded for the tests equal to 10 minutes. The results of the testing 

described in this report are reflected in RIS 2004-03. Similar spurious operation duration 

results were obtained during the NRC CAROLFIRE testing (reference 7.4.59). Note that all 

testing being referenced in these documents was performed on AC grounded circuits. 

Additional testing of DC circuits by the NRC is scheduled in 2009. 
NEI 00-01, Revision 2 

May 2009 

111 

TABLE 5-9 

(SEE REFERENCE 7.4-39, TABLE 7-2) 

SUMMARY OF THE PROBABILITIES (PSACD) 

Case # Case Short Description PSACD Best 

Estimate

High Confidence 

Range 

Discussion 

Reference (See 

reference 7.4-

39) 

PSACD BASE CASE

B-1 PSACD base 

case 

M/C Tset cable 

intra-cable 

0.30 0.10 – 0.50 7.2.3.1 

B-2 PSACD base 

case 

1/C cable, Tset, 

inter-cable 

0.20 0.05 – 0.30 7.2.3.2 

B-3 PSACD base 

case 

M/C with 1/C, Tset, Inter-cable 0.01 0.005 – 0.020 7.2.3.3 as 

modified by 

EPRI test report 

B-4 PSACD base 

case

M/C with M/C, Tset 

inter-cable 

0.001 - 0.005 7.2.3.4 as 

modified by 

EPRI test report 

PSACD VARIANTS 

Thermoplastic Variants

B-5 PSACD variant Same as #B-1 except 

thermoplastic 

0.30 0.10 – 0.50 7.3.1, last 

paragraph 

B-6 PSACD variant Same as #B-2 except 

thermoplastic 

0.20 0.05 – 0.30 7.3.1, last 

paragraph 

B-7 PSACD variant Same as #B-3 except 

thermoplastic 

0.10 0.05 – 0.20 7.3.1, last 

paragraph 

B-8 PSACD variant Same as #B-4 except 

thermoplastic 

0.01 - 0.05 7.3.1, last 

paragraph 

Armored Variant21

B-9 PSACD variant Same as #B-1 except armored 0.075 0.02 - 0.15 7.3.2 

bullet 5 

B-10 Deleted 

Conduit Variants

B-11 PSACD variant Same as #B-1 except 

in conduit 

0.075 0.025 – 0.125 7.3.3 

last bullet 

B-12 PSACD variant Same as #B-2 except 

in conduit 

0.05 0.0125 – 0.075 7.3.3 

last bullet 

B-13 PSACD variant Same as #B-3 except 

in conduit 

0.025 0.0125 – 0.05 7.3.3 

last bullet 

B-14 PSACD variant Same as #B-4 except 

in conduit 

0.005 - 0.01 7.3.3 

last bullet 

Control Power Transformer (CPT) Variant

B-15 PSACD variant Same as #B-1 except without 

CPT 

0.60 0.20 – 1.0 7.4.1 

 

21 Recent fire-damage testing of armored cables indicates that the recommended value above is not applicable for 

ungrounded armored circuits. 
NEI 00-01, Revision 2 

May 2009 

112 

5.3.2 LARGE EARLY RELEASE FREQUENCY EVALUATION (LERF) 

Screening of any component combination requires the consideration of LERF prior to screening. 

LERF screening can be performed quantitatively or qualitatively, depending on the availability 

of quantitative analysis. The quantitative screening criteria for LERF are an order of magnitude 

lower than CDF: 

 No LERF review is needed if the screened scenario is shown to have a CDF < 1E-08/yr 

with a sum across all fire areas of less than 1E-07/yr. For these scenarios, even if 

containment function has failed, the LERF screening criteria have been met. 

 If quantitative LERF analysis is available to meet the criteria above, then this analysis 

can be used to demonstrate LERF screening criteria have been met. 

 If no quantitative LERF analysis is available, then a qualitative evaluation (or bounding 

quantitative evaluation) can be performed. This analysis should show that containment 

function will remain intact following the fire scenario, and that a LERF event given core 

damage is unlikely. Barriers to containment release should be reviewed to ensure that 

they are free of fire damage. 

Qualitative evaluation of LERF should consider the characteristics of LERF given core damage, 

and what failures would be required. If a large early release cannot occur from the postulated 

combination of events, then that scenario may be qualitatively removed from further 

consideration. Any scenario that remains possible, no matter how unlikely, is then subjected to 

the quantitative screening, which can be facilitated by the use of bounding analyses in cases 

where the scenario would be highly unlikely. For example, a PWR large dry containment may 

have a low probability of LERF, even if all containment fans, coolers, spray and igniters have 

failed. In this case, containment isolation may be the only containment function required to be 

reviewed for a qualitative or bounding quantitative LERF review. Another example is that of ice 

condenser plants might require igniters and fans to prevent a likely LERF event. In this case, 

operation of the igniters and fans following the fire scenario would need to be reviewed. 

Factors used in screening component combinations against the LERF criteria above should also 

be considered in the uncertainty evaluation discussed below. 

5.3.3 UNCERTAINTY AND SENSITIVITY ANALYSIS

The intent of the screening process and associated analysis is to demonstrate with reasonable 

assurance that the risk from a circuit failure scenario is below the acceptance criteria described in 

Regulatory Guide 1.174 (Ref. 7.4.50). The decision must be based on the full understanding of 

the contributors to the risk and the impacts of the uncertainties, both those that are explicitly 

accounted for in the results and those that are not. The consideration of uncertainty is a 

somewhat subjective process, but the reasoning behind the decisions must be well documented. 

The types of uncertainty are discussed in Regulatory Guide 1.174. Guidance on what should be 

addressed for the screening process above is discussed below. 

Uncertainty analysis includes traditional parameter uncertainty, and/or model or completeness 

uncertainty considerations. For scenarios involving circuit failures, parameter uncertainty can 

become less important than other types of uncertainty. These scenarios typically involve a single 
NEI 00-01, Revision 2 

May 2009 

113 

accident sequence and a limited number of cutsets. Thus the calculated mean value would be 

very close to the mean value calculated using parametric distributions. Model and parameter 

uncertainty is sometimes more effectively treated with sensitivity analysis rather than statistical 

uncertainty. Sensitivity analysis for this application is discussed below. 

Generally, it should be possible to argue on the basis of an understanding of the contributors to 

the risk that the circuit failure scenario poses an “acceptable risk” (as per Regulatory Guide 

1.174. The contributors include the defense-in-depth attributes, plus additional considerations 

such as spatial information, the type of cable failures required, whether the failure needs to be 

maintained, etc. 

 The closer the scenario risk is to the acceptance criteria thresholds, the more detail is 

required for the assessment/screening and the uncertainty. In contrast, if the estimated 

risk for a scenario is small in comparison to the acceptance criteria, a simple bounding 

analysis may suffice with no need for detailed uncertainty analysis. 

Factors to be considered in the uncertainty and sensitivity analysis include: 

a) Sensitivity of the results to uncertainty of the factors in the risk equation. This includes 

factors such as initiating event frequency, suppression probabilities, severity factors, 

circuit failure probabilities, factors affecting LERF, etc. 

b) Fire modeling uncertainty 

c) Uncertainty of physical location of cables and equipment. 

Uncertainty and sensitivity discussions should include any conservative assumptions made as a 

part of the analysis. For example, if fire modeling is not performed, and conservative 

assumptions are made about fire spread and/or damage, this should be noted. 

5.4 INTEGRATED DECISION MAKING 

The results of the different elements of the analysis above must be considered in an integrated 

manner. None of the individual analysis steps is sufficient in and of itself, and the screening of a 

circuit failure scenario cannot be driven solely by the numerical results of the PRA screening. 

They are but one input into the decision-making and help build an overall picture of the 

implications of the circuit failures being considered. The PRA has an important role in putting 

the circuit failures into the proper context as it characterizes the potential impacts on the plant as 

a whole. The PRA screening is used to demonstrate the acceptance criteria have been satisfied. 

As the discussion in the previous section indicates, both qualitative and quantitative arguments 

may be brought to bear within their separate and distinct capacities. Even though the different 

pieces of the process are not combined in a formal way, they need to be formally documented. 

The integrated decision process therefore includes consideration of the following: 

 The screening PRA results 

 Safety margins (SM) and defense-in-depth (DID) 

 Uncertainty of the results. 
NEI 00-01, Revision 2 

May 2009 

114 

5.4.1 DEFENSE-IN-DEPTH AND SAFETY MARGINS CONSIDERATIONS

The information in Section 5.4.4.1 is derived from Appendix A to NFPA 805, 2001 Edition, and 

Ref. 7.4.50. These methods should be applied to issues that are screened out either after the 

application of Tables 5-1 through 5-3, or after the quantitative risk significance screen in Section 

5.3. 

5.4.1.1 Defense-In-Depth 

Defense-in-depth (DID) is defined as the principle aimed at providing a high degree of fire 

protection and nuclear safety. It is recognized that, independently, no one means is complete. 

Strengthening any means of protection can compensate for weaknesses, known or unknown, in 

the other items. 

Balance among DID elements is a cornerstone of risk-informed applications, and is described in 

Ref. 7.4.50, Section 2.2.1.1. This document provides the following guidance: 

 If a comprehensive risk analysis is done, it can be used to help determine the appropriate 

extent of defense-in-depth (e.g., balance among core damage prevention, containment 

failure, and consequence mitigation) to ensure protection of public health and safety. 

 Further, the evaluation should consider the impact of the proposed licensing basis change 

on barriers (both preventive and mitigative) to core damage, containment failure or 

bypass, and balance among defense-in-depth attributes. 

For fire protection, defense-in-depth is accomplished by achieving a balance of the following: 

 Preventing fires from starting 

 Detecting fires rapidly, controlling and extinguishing promptly those fires that do occur 

 Providing protection for SSCs important to safety so that a fire that is not promptly 

extinguished by the fire suppression activities will not prevent the shutdown of the plant 

For nuclear safety, defense-in-depth is accomplished by achieving a balance of the following: 

 Preventing core damage 

 Preventing containment failure 

 Mitigating consequence 

For fire protection and fire PRA, both traditional fire protection DID and traditional nuclear 

safety DID are represented. Fire protection DID has been treated in the past as a balance. Fire 

areas with likely or potentially large or rapid-growing fires should have automatic suppression, 

areas with less likely and/or smaller fires may not have automatic suppression and rely more on 

manual suppression; some areas may allow transient combustible storage and some may not, etc. 

The DID review in this document attempts to balance both the level of traditional fire protection 

DID and the DID for protection of public health and safety (as measured by CDF and LERF). 
NEI 00-01, Revision 2 

May 2009 

115 

Consistency with the defense-in-depth philosophy is maintained if the following acceptance 

guidelines, or their equivalent, are met: 

1. A reasonable balance is preserved among 10 CFR 50 Appendix R DID elements. 

2. Over-reliance on, and permitting increased length of time or risk when performing 

programmatic activities to compensate for weaknesses in plant design is avoided. 

3. Pre-fire nuclear safety system redundancy, independence, and diversity are preserved 

commensurate with the expected frequency and consequences of challenges to the system 

and uncertainties (e.g., no risk outliers). (This should not be construed to mean that more 

than one safe shutdown train must be maintained free of fire damage.) 

4. Independence of defense-in-depth elements is not degraded. 

5. Defenses against human errors are preserved. 

6. The intent of the General Design Criteria in Appendix A to 10 CFR Part 50 is 

maintained. 

It should be noted that all elements of fire protection DID may not exist for beyond design basis 

fire scenarios. For example, a CCDP of 1.0 is possible if enough fire barriers are breached. 

Such beyond design basis scenarios, however, should be demonstrated to be a very low risk 

significance, with certainty. A very low risk scenario with all elements of DID, and a CDF of 

9E-08/year would be treated differently than a scenario with a CCDP of 1.0, and a CDF of 9E08/year which may rely solely on a low ignition-initiating frequency for its very low risk. In the 

end, the balance results in consideration of all aspects of the component combination, including 

the risk, DID, SM, uncertainty, and other relevant issues. 

Defense-in-depth review for multiple spurious operations should consider whether the scenario 

affects more than one element of DID. The example above with a CCDP at or near 1.0 may be 

considered unacceptable if detection/suppression is ineffective. For example, if we found a 

scenario from a fire inside a cabinet, where suppression prior to damage to all target cables was 

unlikely, and the CCDP was near 1, then DID would be inadequate. In most cases, this lack of 

DID would correspond to a high calculated risk, since the DID elements for fire protection are 

integrated into the risk calculation. However, if the risk calculation relies heavily on a low fire 

frequency to screen the scenario, the risk calculation could screen such a scenario. The DID 

review would, however, not show a balance between DID and risk, and the scenario would not 

screen. 

Applying a DID review to a screening process needs to account for conservatism in the 

screening. It is common to use a screening assignment of 1.0 for CCDP or failure of manual 

suppression during screening in order to perform the analysis with minimal resources. The DID 

review needs to qualitatively assess these factors to assure DID is maintained if a quantitative 

assessment is not available. Additional analysis may be required to complete the DID 

assessment in this case, since the information available may not have been sufficient to perform a 

quantitative assessment. 

The above criteria and discussion should be used to evaluate whether defense-in-depth is 

maintained if a potential fire-induced circuit failure is screened out. 
NEI 00-01, Revision 2 

May 2009 

116 

5.4.1.2 Safety Margins 

The licensee is expected to choose the method of engineering analysis appropriate for evaluating 

whether sufficient safety margins would be maintained if the fire induced circuit failure were 

screened out. An acceptable set of guidelines for making that assessment is summarized below. 

Other equivalent acceptance guidelines may also be used. With sufficient safety margins 

(Reference 7.4.50): 

 Codes and standards or their alternatives approved for use by the NRC are met. 

 Safety analysis acceptance criteria in the licensing basis (e.g., FSAR, supporting 

analyses) are met, or provide sufficient margin to account for analysis and data 

uncertainty. 

5.4.2 CORRECTIVE ACTION

If, when all evaluation phases are completed, the ΔCDF for a component or a component pair 

remains greater than or equal to 1E-6 per reactor year for all fire areas or the ΔCDF for a fire 

area remains greater than or equal to 1E-6 per reactor year for all component pairs within the fire 

area (summing in each case only the final Screening results), further analysis using detailed plant 

fire PRA models or actions to reduce the summed ΔCDF below 1E-6/year will be performed to 

determine if the summed ΔCDF reduces below 1E-6/year (also, <1E-7/year for ΔLERF). The 

complexity of possible corrective measures can be kept to a minimum by defining the additional 

risk reduction needed to render the ΔCDF less than 1E-7 per reactor year (also, <1E-8/yr for 

ΔLERF) for any fire area. As an example, if a potential spurious actuation has been determined 

to have a ΔCDF of 1E-5 per reactor year for any fire area after completing the screening process, 

a corrective action that applies an additional reduction factor of at least 100 would result in an 

acceptable configuration (given ΔLERF results are also acceptable). 

Component combinations or fire areas that do not meet the screening criteria above should be 

placed within the plant’s Corrective Action Program (see Section 1.1 of this document). 

Evaluation of the corrective action should be performed using the existing plant procedures and 

criteria, and using the screening analysis results as part of the evaluation. If the component 

combination or fire area is within the existing licensing basis develop a compliance strategy or 

means of disposition to mitigate the effects due to fire damage for each component or its circuit. 

Any regulatory reporting should be in accordance with existing regulations. 

5.4.3 DOCUMENTATION

The accurate and comprehensive documentation of this assessment will be prepared and 

maintained as a retrievable plant record following established practices. The documentation 

should be maintained in accordance with existing plant procedures. 

As discussed in Section 4 above, the documentation is referenced or included in the Fire Safe 

Shutdown Analysis for the area or areas affected by the MSO. 
NEI 00-01, Revision 2 

May 2009 

117 

5.5 PRA QUALITY 

5.5.1 APPLICABILITY OF THE ANS/ASME FPRA SECTION OF THE COMBINED PRA

STANDARD

Part 4 of the Combined ANS/ASMEPRA Standard (references 7.4.61 and 7.4.62) (which 

incorporates the ANSI/ANS- 58.23 Fire PRA Standard – reference 7.4.60) provides high level 

and supporting requirements for all steps performed in a detailed PRA used for MSO analysis. 

The applicability and use of the Fire Standard would depend somewhat on the Fire PRA process 

used, as discussed in the following sections. 

In general, as the PRA results for an MSO approach the acceptance criteria described above, and 

as greater detail is employed and conservatism is removed from the analysis, the applicable 

capability category for the analysis can be increased. As the discussion below points out, if the 

screening method above is used, no capability category in the Fire Standard can be met. As more 

detailed Fire PRA is performed, Capability Category 1 may suffice for lower risk MSOs or 

MSOs analyzed using conservative PRA assumptions., Capability Category 2 may be needed for 

detailed Fire PRA results approaching the acceptance criteria above. This general philosophy 

may not be applicable to all SRs, and a review of SRs not meeting, in general, at least Capability 

Category 2 for this last example would have to include an assessment of the impact of a lower 

capability category on the results. 

5.5.1.1 Screening Fire PRA 

If an MSO or group of MSOs is screened using the preliminary screening 

method as described in Sections 5.2 above, the Fire Standard requirements do 

not apply. The method is generally conservative, and review against the 

standard would result in a “not met” assessment for many of the supporting 

requirements. 

5.5.1.2 Focused Scope Fire PRA 

 

If the Fire SDP or NUREG/CR-6850 is used to analyze the MSO, then the 

applicable supporting requirements of the standard are reviewed against the 

analysis. However, many of the Fire Standard SRs are not applicable to a 

Focused-Scope Fire PRA, since the focused scope analyzes the fire features 

related to the MSO alone, and not associated with the whole plant or whole 

room risk estimate. For example, if none of the MSO analysis involved 

Hydrogen Fires, Bus Duct Fires, Reactor Coolant Pump Fires, etc., then the 

various SRs related to these fires or areas containing these fires may not need 

to be reviewed for the MSO analysis. 

For a Focused-Scope Fire PRA, only the applicable SRs would need to be 

reviewed in support of the MSO analysis. Additionally, SRs that are reviewed 

may not be applied in a similar level of detail as a full Fire PRA. For 

example, non-suppression analyzed for an individual scenario would be 

reviewed against the applicable SRs. However, the SRs may be applicable to 

many other possible scenarios not associated with the MSOs. The review of 
NEI 00-01, Revision 2 

May 2009 

118 

the SR would be limited to the application, and as a result, the associated 

grade for the SR would only be assigned for the limited scope review. As a 

result, the Peer Review scope would need to be specified and documented as a 

part of the overall MSO documentation process. This includes both the scope 

of the SRs reviewed or not reviewed and the limitations or scope of each of 

the reviewed SRs. 

Caution must be exercised before dismissing any SRs as outside the analytical 

bounds of the Focused Score Fire PRA. Experience has shown that there are 

often subtle dependencies among seemingly unrelated elements of a PRA that 

could be erroneously dismissed a priori when setting the analytical bounds for 

the Focused Scope version. 

5.5.1.3 Full Fire PRA 

If a full Fire PRA is performed, and the MSO scenario analysis is included in 

the full Fire PRA, then all of the Fire PRA Standard SRs would apply. As 

with any application, SRs where a requirement is not met or Category I is 

assessed would need to be documented as a part of the MSO analysis, 

demonstrating the associated finding does not affect the analysis results. 

5.5.2 PEER REVIEW OF THE FOCUSED-SCOPE OR FULL FIRE PRA 

A peer review of the focused-scope Fire PRA is required once the initial screening of MSOs is 

complete. The peer review may differ considerably from a peer review of a complete Fire PRA 

in the following aspects: 

1) The focused-scope Fire PRA will contain screening analysis as described above, which is 

not designed to meet the Fire PRA Standard Supporting Requirements. The screening 

analysis is not reviewed against any of the Fire PRA Standard SRs. 

2) The detailed Fire PRA for MSO scenarios is an analysis of the MSO scenarios only, and 

may not provide a Fire PRA for a Fire Area or Compartment. As such, the Fire PRA 

would only apply specific Fire PRA steps needed to show the MSO risk is low. The 

corresponding Fire PRA Standard requirements for the applied steps would be applicable 

for the peer review, but other steps may not need to be reviewed. Additionally, many of 

the SRs reviewed would only be applicable to the MSOs analyzed, and not to the entire 

plant. 

Prior to the performance of a peer review against a Focused-Scope Fire PRA, the expected scope 

should be documented by a pre-review of the MSO analysis results. This scope would then be 

used to determine the number and capability of the Fire PRA Peer Review Team. Upon 

completion of the peer review, the limitations of the review for each SR should also be specified 

in the documentation. 
NEI 00-01, Revision 2 

May 2009 

119 

6 DEFINITIONS 

The following definitions are consistent with NRC-recognized definitions. 

The numbers in brackets [ ] refer to the IEEE Standards in which the definitions are used. Refer 

to Section 2 of IEEE Standard 380-1975 for full titles. 

Those definitions without a specific reference are consistent with those specified in reference 

7.4.32. 

Associated circuits of Concern

Generic Letter 81-12 – Those cables (safety related, non-safety related, Class 1E, and non-Class 

1E) that have a physical separation less than that required by Appendix R Section III.G.2 and 

have one of the following: 

Common Power Source 

A common power source with the shutdown equipment (redundant or alternative) and the 

power source is not electrically protected from the circuit of concern by coordinated 

breakers, fuses, or similar devices, or 

Spurious Operation 

A connection to circuits of equipment whose spurious operation would adversely affect 

the shutdown capability (e.g., Residual Heat Removal/Reactor Coolant System isolation 

valves, Automatic Depressurization System valves, Pressure-Operated Relief Valves, 

steam generator atmospheric valves, instrumentation, steam bypass, etc.), or 

Common Enclosure 

A common enclosure (e.g., raceway, panel, junction, etc.) with the shutdown cables 

(redundant or alternative), and are not electrically protected by circuit breakers, fuses or 

similar devices, or will allow the propagation of the fire into the common enclosure. 

Cable

IEEE Standard 100-1984 – A conductor with insulation, or a stranded conductor with or without 

insulation and other coverings (single-conductor cable) or a combination of conductors insulated 

from one another (multiple-conductor cable). 
NEI 00-01, Revision 2 

May 2009 

120 

Circuit

IEEE Standard 100-1984 – A conductor or system of conductors through which an electric 

current is intended to flow.

Circuit failure modes

The following are the circuit failure modes that are postulated in the post-fire safe shutdown 

analysis as a result of a fire: 

Hot Short 

A fire-induced insulation breakdown between conductors of the same cable, a different 

cable or from some other external source resulting in a compatible but undesired 

impressed voltage or signal on a specific conductor. 

Open Circuit 

A fire-induced break in a conductor resulting in a loss of circuit continuity. 

Short-to-Ground 

A fire-induced breakdown of a cable’s insulation system resulting in the potential on the 

conductor being applied to ground/neutral. 

Cold Shutdown Repair

Repairs made to fire damaged equipment required to support achieving or maintaining cold 

shutdown for the required safe shutdown path. 

Conductor

IEEE Standard 100-1984 – A substance or body that allows a current of electricity to pass 

continuously along it. Clarification: a single “wire” within a cable; conductors could also be 

considered a circuit or a cable. 

Design Basis Fire

A postulated event used in the post-fire safe shutdown analysis. See Exposure Fire. 

Emergency Control Station

Location outside the main control room where actions are taken by operations personnel to 

manipulate plant systems and controls to achieve safe shutdown of the reactor. [NRC RIS 2005-

30] 
NEI 00-01, Revision 2 

May 2009 

121 

Enclosure

IEEE Standard 380-1975 – An identifiable housing such as a cubicle, compartment, terminal 

box, panel, or enclosed raceway used for electrical equipment or cables. [384] 

Exposure Fire

SRP Section 9.5.1 – An exposure fire is a fire in a given area that involves either in-situ or 

transient combustibles and is external to any structures, systems, or components located in or 

adjacent to that same area. The effects of such fire (e.g., smoke, heat, or ignition) can adversely 

affect those structures, systems, or components important to safety. Thus, a fire involving one 

train of safe shutdown equipment may constitute an exposure fire for the redundant train located 

in the same area, and a fire involving combustibles other than either redundant train may 

constitute an exposure fire to both redundant trains located in the same area. 

Fire Area

Generic Letter 86-10 – The term "fire area" as used in Appendix R means an area sufficiently 

bounded to withstand the hazards associated with the fire area and, as necessary, to protect 

important equipment within the fire area from a fire outside the area. 

In order to meet the regulation, fire area boundaries need not be completely sealed with floor to 

ceiling and/or wall-to-wall boundaries. Where fire area boundaries were not approved under the 

Appendix A process, or where such boundaries are not wall-to-wall or floor-to-ceiling 

boundaries with all penetrations sealed to the fire rating required of the boundaries, licensees 

must perform an evaluation to assess the adequacy of fire area boundaries in their plants to 

determine if the boundaries will withstand the hazards associated with the area and protect 

important equipment within the area from a fire outside the area. 

Fire Barrier

SRP Section 9.5. – those components of construction (walls, floors, and their supports), including 

beams, joists, columns, penetration seals or closures, fire doors, and fire dampers that are rated 

by approving laboratories in hours of resistance to fire and are used to prevent the spread of fire. 

Fire Frequency (Ff)

The frequency of fires with a potential to damage critical equipment if left alone. 

Fire Protection Design Change Evaluation

The process replacing the 50.59 evaluation process (described in NEI 02-03) that is used by a 

licensee to document compliance with the fire protection license condition to assure that changes 

to the approved fire protection program do not adversely affect the ability to achieve and 

maintain safe shutdown in the event of a fire. 
NEI 00-01, Revision 2 

May 2009 

122 

Fire Protection Program

10 CFR 50, Appendix R, Section II.A – the fire protection policy for the protection of structures, 

systems, and components important to safety at each plant and the procedures, equipment, and 

personnel required to implement the program at the plant site. The fire protection program shall 

extend the concept of defense-in-depth to fire protection in fire areas important to safety, with 

the following objectives: 

 Prevent fires from starting. 

 Rapidly detect, control, and promptly extinguish those fires that do occur. 

 Provide protection for structures, systems, and components important to safety so that a 

fire that is not promptly extinguished by the fire suppression activities will not prevent 

the safe shutdown of the plant. 

Fire Zone

The subdivision of fire area(s) for analysis purposes that is not necessarily bound by fire-rated 

barriers. 

Free of Fire Damage

It is expected that the term “free of fire damage” will be further clarified in a forthcoming 

Regulatory Issue Summary. Until this occurs, NRC recommends using the following guidance 

in Regulatory Guide 1.189: 

“The structure, system, or component under consideration is capable of performing its intended 

function during and after the postulated fire, as needed, without repair.” 

Generic Letter 86-10 Fire Hazards Evaluation

A technical engineering evaluation used to evaluate equivalency of fire protection features to 

those required by the regulations or to evaluate fire protection features that are commensurate 

with the potential fire hazard. For plants licensed prior to 1979, these evaluations may form the 

basis for an Appendix R exemption request or support a plant change evaluation using accepted 

regulatory processes. For plants licensed after January 1, 1979, these evaluations may be used in 

conjunction with a fire protection design change evaluation to alter the current licensing basis or 

they may be submitted to the NRC for review and acceptance as a deviation request. (Note: 

Previously approved deviation requests may be altered using a fire protection design change 

evaluation without re-submittal to the NRC.) 

High Impedance Fault

Generic Letter 86-10 – electrical fault below the trip point for a breaker on an individual circuit. 

See “Multiple High Impedance Fault.” 
NEI 00-01, Revision 2 

May 2009 

123 

High/Low Pressure Interface 

Refer to Appendix C to this document. 

Hot Short

See “Circuit failure modes.” 

Important to Safe Shutdown (SSD)

10 CFR 50, Appendix R, Section III.G.1 describes Structures, Systems and Components (SSC) 

important to safe shutdown for which fire protection features apply. Components classified as 

important to SSD in accordance with Appendix H may apply different mitigation tools than 

components classified as required for hot shutdown. 

Isolation Device

IEEE Standard 380-1975 – A device in a circuit that prevents malfunctions in one section of a 

circuit from causing unacceptable influences in other sections of the circuit or other circuits. 

[384] 

Local Operation

Operation of safe shutdown equipment by an operator outside the Main Control Room when 

automatic, remote manual, or manual operation are no longer available (e.g. opening of a motor 

operated valve using the hand wheel). 

Operator Manual Action

Action performed by operators to manipulate components and equipment from outside the main 

control room to achieve and maintain post-fire hot shutdown, not including “repairs.”

Multiple High Impedance Fault(s)

A condition where multiple circuits fed from a single power distribution source each have a high 

impedance fault. See Appendix B.1. 

Open Circuit

See 'Circuit Failure Modes'. 

Probability of Spurious Actuation (PSA)

The probability of undesirable spurious operation(s) of the component, or of component being 

potentially impacted by the fire-induced circuit failure. 
NEI 00-01, Revision 2 

May 2009 

124 

Raceway

IEEE Standard 380-1975 – Any channel that is designed and used expressly for supporting 

wires, cable, or busbars. Raceways consist primarily of, but are not restricted to, cable trays and 

conduits. [384] 

Remote Control 

Plant design features that allow the operation of equipment through a combination of electrically 

powered control switches and relays. Remote control can typically be performed from the 

control room or from local control stations, including the remote shutdown panel and other 

locations with control capability outside the control room. 

Remote Manual Operation

Operation of safe shutdown equipment on the required safe shutdown path using remote controls 

(e.g., control switches) specifically designed for this purpose from a location other than the main 

control room. 

Remote Shutdown Location

A plant location outside the control room with remote control capability for shutdown. 

Remote Shutdown Panel

The panel included within the plant design for the purpose of satisfying the requirements of 10 

CFR 50 Appendix A General Design Criterion 19. If electrical isolation and redundant fusing 

are provided at this location, it may also be suitable for use in achieving and maintaining safe 

shutdown for an event such as a control room fire. [Note: Some Licensees may refer to this 

panel as the Auxiliary Control Panel or the Auxiliary Shutdown Panel.] 

Repair Activity 

Those actions required to restore operation to post-fire safe shutdown equipment that has failed 

as a result of fire-induced damage. Repairs may include installation, removal, assembly, 

disassembly, or replacement of components or jumpers using materials, tools, procedures, and 

personnel available on site (e.g., replacement of fuses, installation of temporary cables or power 

supplies, installation of air jumpers, the use of temporary ventilation). Credit for repair activities 

for post-fire safe shutdown may only be taken for equipment required to achieve and maintain 

cold shutdown. Repairs may require additional, more detailed instructions, including tools to be 

used, sketches, and step-by-step instructions for the tasks to be performed. Repair activities are 

intended to restore functions and not equipment since the equipment may be destroyed in a fire 

event. Repair activities may rely on exterior security lighting or portable lighting if independent 

8-hour battery backed lighting is unavailable. 
NEI 00-01, Revision 2 

May 2009 

125 

Required Safe Shutdown Path

The safe shutdown path selected for achieving and maintaining safe shutdown in a particular fire 

area. This safe shutdown path must be capable of performing all of the required safe shutdown 

functions described in this document. 

Required Safe Shutdown System

A system that performs one or more of the required safe shutdown functions and is, therefore, a 

part of the required safe shutdown path for a particular fire area. 

Required Hot Shutdown Component

Equipment that is required to either function or not malfunction so that the required safe 

shutdown path will be capable of achieving and maintaining hot shutdown in a particular fire 

area and meet the established regulatory criteria. 

Required Hot Shutdown Cable/Circuit

Cable/circuit required to support the operation or prevent the mal-operation of required hot 

shutdown component in a particular fire area. 

Safe Shutdown 

[Reference 7.4.38] A shutdown with (1) the reactivity of the reactor kept to a margin below 

criticality consistent with technical specifications, (2) the core decay heat being removed at a 

controlled rate sufficient to prevent core or reactor coolant system thermal design limits from 

being exceeded, (3) components and systems necessary to maintain these conditions operating 

within their design limits, and (4) components and systems necessary to keep doses within 

prescribed limits operating properly. 

[Reference 7.4.14] For fire events, those plant conditions specified in the plant Technical 

Specifications as Hot Standby, Hot Shutdown, or Cold Shutdown. 

For those plants adopting NFPA 805, the term “safe shutdown” is not explicitly defined. Please 

refer to the discussion of “Nuclear Safety Performance Criteria” in NFPA 805 for more 

information about performance criteria that, if met, provide reasonable assurance in the event of 

a fire that the plant is not placed in an unrecoverable condition. 

Safe Shutdown Capability

Redundant 

Any combination of equipment and systems with the capability to perform the shutdown 

functions of reactivity control, inventory control, decay heat removal, process monitoring 

and associated support functions when used within the capabilities of its design. 
NEI 00-01, Revision 2 

May 2009 

126 

Alternative 

For a given fire area/zone where none of the redundant safe shutdown capability are “free 

of fire damage” and dedicated equipment is not provided, the shutdown strategy used is 

classified as alternative. 

Dedicated 

A system or set of equipment specifically installed to provide one or more of the post-fire 

safe shutdown functions of inventory control, reactivity control, decay heat removal, 

process monitoring, and support as a separate train or path. 

Safe Shutdown Equipment/Component

Equipment that performs a function that is required for safe shutdown either by operating or by 

not mal-operating. 

Short-to-Ground

See “Circuit Failure Modes.” 

Spurious Operation 

The possible inadvertent operation or repositioning of a piece of equipment. 
NEI 00-01, Revision 2 

May 2009 

127 

7 REFERENCES 

7.1 NRC GENERIC LETTERS 

7.1.1 80-45: Proposed Rule Fire Protection Program for Nuclear Power Plants 

7.1.2 80-48: Proposed Rule Fire Protection Program for Nuclear Power Plants 

7.1.3 80-56: Memorandum and Order RE: Union of Concerned Scientists Petition 

7.1.4 80-100: Resolution of Fire Protection Open Items 

7.1.5 81-12: Fire Protection Rule, dated February 20, 1981 

7.1.6 81-12: Clarification of Generic Letter 81-12, Letter from the NRC to PSE&G, 

dated April 20, 1982, Fire Protection Rule - 10 CFR 50.48(c) - Alternate Safe 

Shutdown - Section III.G.3 of Appendix R to 10 CFR 50 

7.1.7 82-21: Tech Specs for Fire Protection Audits 

7.1.8 83-33: NRC Positions on Appendix R 

7.1.9 85-01: Fire Protection Policy Steering Committee Report 

7.1.10 86-10: Implementation of Fire Protection Requirements, dated April 24, 1986 

7.1.11 86-10: Supplement 1 to Generic Letter, Implementation of Fire Protection 

Requirements 

7.1.12 88-12: Removal of Fire Protection Requirements from Tech Specs 

7.1.13 88-20: Supplement 4 IPEEE 

7.1.14 89-13: Supplement 1 Biofouling of Fire Protection Systems 

7.1.15 92-08: Thermo-Lag Fire Barriers 

7.1.16 93-06: Use of Combustible Gases in Vital Areas 

7.1.17 95-01: Fire Protection for Fuel Cycle Facilities 

7.2 BULLETINS 

7.2.1 75-04: Browns Ferry Fire 

7.2.2 77-08: Assurance of Safety 

7.2.3 81-03: Flow Blockage Due to Clams and Mussels 
NEI 00-01, Revision 2 

May 2009 

128 

7.2.4 92-01: Failure of Thermo-Lag 

7.2.5 92-01: Supplement 1 Failure of Thermo-Lag 

7.3 NRC INFORMATION NOTICES 

7.3.1 80-25: Transportation of Pyrophoric Uranium 

7.3.2 83-41: Actuation of Fire Suppression System causing Inoperability of SafetyRelated Equipment, June 22, 1983 

7.3.3 83-69: Improperly Installed Fire Dampers 

7.3.4 83-83: Use of Portable Radio Transmitters Inside Nuclear Power Plants 

7.3.5 84-09: Lessons learned from NRC Inspections of Fire Protection Safe Shutdown 

Systems (10 CFR 50, Appendix R), Revision 1, March 7, 1984 

7.3.6 84-16: Failure of Automatic Sprinkler System Valves to Operate 

7.3.7 84-92: Cracking of Flywheels on Fire Pump Diesel Engines 

7.3.8 85-09: Isolation Transfer Switches and Post-fire Shutdown Capability, January 

31, 1985 

7.3.9 85-85: System Interaction Event Resulting in Reactor Safety Relief Valve 

Opening 

7.3.10 86-17: Update – Failure of Automatic Sprinkler System Valves 

7.3.11 86-35: Fire in Compressible Material 

7.3.12 86-106: Surry Feedwater Line Break 

7.3.13 86-106: Supplement 1 Surry Feedwater Line Break 

7.3.14 86-106: Supplement 2 Surry Feedwater Line Break 

7.3.15 86-106: Supplement 3 Surry Feedwater Line Break 

7.3.16 87-14: Actuation of Fire Supp. Causing Inop of Safety Related Ventilation 

7.3.17 87-49: Deficiencies in Outside Containment Flooding Protection 

7.3.18 87-50: Potential LOCA at High and Low Pressure Interfaces from Fire Damage, 

October 9, 1987 

7.3.19 88-04: Inadequate Qualification of Fire Barrier Penetration Seals 

7.3.20 88-04: Supplement 1 Inadequate Qualification of Fire Barrier Penetration Seals 
NEI 00-01, Revision 2 

May 2009 

129 

7.3.21 88-05: Fire in Annunciator Control Cabinets 

7.3.22 88-45: Problems in Protective Relay and Circuit Breaker Coordination, July 7, 

1988 

7.3.23 88-56: Silicone Fire Barrier Penetration Seals 

7.3.24 88-60: Inadequate Design & Installation of Watertight Penetration Seals 

7.3.25 88-64: Reporting Fires in Process Systems 

7.3.26 89-52: Fire Damper Operational Problems 

7.3.27 90-69: Adequacy of Emergency and Essential Lighting, October 31, 1990 

7.3.28 91-17: Fire Safety of Temporary Installations 

7.3.29 91-18: Resolution of Degraded & Nonconforming Conditions 

7.3.30 91-37: Compressed Gas Cylinder Missile Hazards 

7.3.31 91-47: Failure of Thermo-Lag 

7.3.32 91-53: Failure of Remote Shutdown Instrumentation 

7.3.33 91-77: Shift Staffing at Nuclear Power Plants 

7.3.34 91-79: Deficiencies in Installing Thermo-Lag 

7.3.35 91-79: Supplement 1 

7.3.36 92-14: Uranium Oxide Fires 

7.3.37 92-18: Loss of Remote Shutdown Capability During a Fire, February 28, 1992 

7.3.38 92-28: Inadequate Fire Suppression System Testing 

7.3.39 92-46: Thermo-Lag Fire Barrier Special Review Team Final Report 

7.3.40 92-55: Thermo-Lag Fire Endurance Test Results 

7.3.41 92-82: Thermo-Lag Combustibility Testing 

7.3.42 93-40: Thermal Ceramics Fire Endurance Tests 

7.3.43 93-41: Fire Endurance Tests - Kaowool, Interam 

7.3.44 93-71: Fire at Chernobyl Unit 2 

7.3.45 94-12: Resolution of GI 57 Effects of Fire Prot. Sys. Actuation on SR Equip. 
NEI 00-01, Revision 2 

May 2009 

130 

7.3.46 94-22: Thermo-Lag 3-Hour Fire Endurance Tests 

7.3.47 94-26: Personnel Hazards From Smoldering Material in the Drywell 

7.3.48 94-28: Problems with Fire-Barrier Penetration Seals 

7.3.49 94-31: Failure of Wilco Lexan Fire Hose Nozzles 

7.3.50 94-34: Thermo-Lag Flexi-Blanket Ampacity Derating Concerns 

7.3.51 94-58: Reactor Coolant Pump Lube Oil Fire 

7.3.52 94-86: Legal Actions Against Thermal Science Inc. 

7.3.53 94-86: Supplement 1 

7.3.54 95-27: NRC Review of NEI Thermo-Lag Combustibility Evaluation 

Methodology 

7.3.55 95-32: Thermo-Lag 330-1 Flame Spread Test Results 

7.3.56 95-33: Switchgear Fire at Waterford Unit 3 

7.3.57 95-36: Problems with Post-Fire Emergency Lighting 

7.3.58 95-36: Supplement 1 

7.3.59 95-48: Results of Shift Staffing Survey 

7.3.60 95-49: Seismic Adequacy of Thermo-Lag Panels 

7.3.61 95-49: Supplement 1 

7.3.62 95-52: Fire Test Results of 3M Interam Fire Barrier Materials 

7.3.63 95-52: Supplement 1 

7.3.64 96-23: Fire in Emergency Diesel Generator Exciter 

7.3.65 97-01: Improper Electrical Grounding Results in Simultaneous Fires 

7.3.66 97-23: Reporting of Fires at Fuel Cycle Facilities 

7.3.67 97-37: Main Transformer Fault 

7.3.68 97-48: Inadequate Fire Protection Compensatory Measures 

7.3.69 97-59: Fire Endurance Tests of Versawrap Fire Barriers 

7.3.70 97-70: Problems with Fire Barrier Penetration Seals 
NEI 00-01, Revision 2 

May 2009 

131 

7.3.71 97-72: Problems with Omega Sprinkler Heads 

7.3.72 97-73: Fire Hazard in the Use of a Leak Sealant 

7.3.73 97-82: Inadvertent Control Room Halon Actuation 

7.4 OTHER RELATED DOCUMENTS 

7.4.1 10 CFR 50.48 Fire Protection (45 FR 76602) 

7.4.2 10 CFR 50 Appendix A GDC 3 Fire Protection 

7.4.3 10 CFR 50 Appendix R Fire Protection for Operating Nuclear Power Plants 

7.4.4 Branch Technical Position APCSB 9.5-1 Guidelines for Fire Protection 

7.4.5 Appendix A to Branch Tech Position 9.5-1 Guidelines for Fire Protection 

7.4.6 NUREG-0800 9.5.1 Fire Protection Program 

7.4.7 NRC Insp. Procedure 64100 Postfire Safe Shutdown, Emergency Lighting, Oil 

Collection 

7.4.8 NRC Insp. Procedure 64150 Triennial Postfire Safe Shutdown Capability 

7.4.9 NRC Insp. Procedure 64704 Fire Protection Program 

7.4.10 NUREG/BR-0195 Enforcement Guidance 

7.4.11 NUREG-75/087 Standard Review Plan (No revision level listed) 

7.4.12 NUREG-75/087 Standard Review Plan, Rev. 1 

7.4.13 NUREG-75/087 Standard Review Plan, Rev. 2 

7.4.14 Reg Guide 1.120 Fire Protection Guidelines for Nuclear Power Plants 

7.4.15 Reg Guide 1.120 Rev. 1, Fire Protection Guidelines for Nuclear Power Plants 

7.4.16 Reg Guide 1.189 Fire Protection for Operating Nuclear Power Plants 

7.4.17 NUREG-0654 Criteria for Preparation of Emergency Response Plans 

7.4.18 Temporary Instruction 2515/XXX Fire Protection Functional Inspection 

7.4.19 SECY-82-13B (4/21/82) Fire Protection Schedules and Exemptions 

7.4.20 SECY-82-267 (6/23/82) FP Rule for Future Plants 

7.4.21 SECY-83-269 FP Rule for Future Plants 
NEI 00-01, Revision 2 

May 2009 

132 

7.4.22 SECY-85-306 Recommendations Regarding the Implementation of App R to 10 

CFR 50 

7.4.23 NRC Temp Instruction 2515/62 Inspection of Safe Shutdown Requirements of 10 

CFR 50 

7.4.24 NRC Temp Instruction 2515/61 Inspection of Emergency Lighting & Oil 

Collection Requirements 

7.4.25 NUREG-0050, 2/76; Recommendations Related to Browns Ferry Fire 

7.4.26 NRC Letter (12/82), Position Statement on Use of ADS/LPCI to meet Appendix 

R Alternate Safe Shutdown Goals, discusses need for exemption if core uncovery 

occurs. 

7.4.27 SECY-93-143 Assessment of Fire Protection Programs 

7.4.28 SECY-95-034 Re-assessment of Fire Protection Programs 

7.4.29 SECY-96-134 Fire Protection Regulation Improvement 

7.4.30 Appendix S Proposed Rulemaking 

7.4.31 NRC letter to NEI dated March 11, 1997; general subject NRC positions on fireinduced circuit failures issues 

7.4.32 NEI letter to NRC dated May 30, 1997, general subject industry positions on fireinduced circuit failures issues 

7.4.33 GE-NE-T43-00002-00-02, Revision 0, “Generic Guidance for BWR Post-Fire 

Safe Shutdown Analysis,” November 1999 

7.4.34 NFPA 805, “Performance-Based Standard for Fire Protection for Light Water 

Reactor Electric Generating Plants,” November 2000 ROP 

7.4.35 NSAC-179L, “Automatic and Manual Suppression Reliability Data for Nuclear 

Power Plant Fire Risk Analyses”, February 1994 

7.4.36 EPRI TR-100370, “Fire-Induced Vulnerability Evaluation (FIVE)”, April 1992 

7.4.37 EPRI TR-105928, “Fire PRA Implementation Guide”, December 1995 

7.4.38 ANSI/ANS-52.1-1983 “Nuclear Safety Criteria for the Design of Stationary 

Boiling Water Reactor Plants” and ANSI/ANS-51.1-1983 “Nuclear Safety 

Criteria for the Design of Stationary Pressurized Water Reactor Plants” 

7.4.39 SU-105928, “Guidance for Development of Response to Generic Request for 

Additional Information on Fire Individual Plant Examination for External Events 

(IPEEE), a Supplement to EPRI Fire PRA Implementation Guide (TR-105928)” 

EPRI, March 2000 
NEI 00-01, Revision 2 

May 2009 

133 

7.4.40 EPRI Report 1006961, “Spurious Actuation of Electrical Circuits Due to Cable 

Fires: Results of An Expert Elicitation” 

7.4.41 EPRI Report 1003326, “Characterization of Fire-Induced Circuit Faults: Results 

of Cable Fire Testing” 

7.4.42 NRC Memorandum J. Hannon to C. Carpenter, “Proposed Risk-Informed 

Inspector Guidance for Post-Fire Safe Shutdown Associated Circuit Inspections,” 

March 19, 2003, ADAMS Accession Number ML030780326 

7.4.43 NRC Paper to ANS Topical Meeting on Operating Reactor Safety, Preliminary 

Screening of Fire-Induced Circuit Failures for Risk Significance,” November, 

2004 

7.4.44 EPRI Report 1003111, Fire Events Database and Generic Ignition Frequency 

Model for U.S. Nuclear Power Plants” 

7.4.45 NRC Inspection Manual Chapter 0609, Appendix F, “Fire Protection Significance 

Determination Process,” May 2004 

7.4.46 NEI 00-01, Revision 0, “Guidance for Post-Fire Safe Shutdown Analysis,” May 

2003 

7.4.47 NRC Regulatory Guide 1.75, “Physical Independence of Electric Systems,” 

Revision 2, September 1978 

7.4.48 Raughley, W., and G. Lanik, “Operating Experience Assessment - Energetic 

Faults in 4.16 kV to 13.8 kV Switchgear and Bus Ducts That Caused Fires in 

Nuclear Power Plants, 1986-2001,” NRC Office of Nuclear Regulatory Research, 

February 2002 

7.4.49 Nowlen, S., and M. Kazarians, “Risk Methods Insights Gained from Fire 

Incidents,” NUREG/CR-6738, September 2001 

7.4.50 NRC Regulatory Guide 1.174, " An Approach for Using Probabilistic Risk 

Assessment in Risk-Informed Decisions on Plant Specific Changes to the 

Licensing Basis,” Revision 1, November 2002. 

7.4.51 NEI 04-06, Draft Revision K, “Guidance for Self-Assessment of Circuit Failure 

Issues,” October 2003 

7.4.52 NUREG/CR-6850 (EPRI TR-1011989), “EPRI/NRC-RES Fire PRA 

Methodology for Nuclear Power Facilities Volume 1 and 2” August 2005. 

7.4.53 ANSI/ANS-58.6-1983 and 1996, “Criteria for Remote Shutdown for Light Water 

Reactors” 

7.4.54 ANSI/ANS-58.11-1983 “Cooldown Criteria for Light Water Reactors” 
NEI 00-01, Revision 2 

May 2009 

134 

7.4.55 ANSI/ANS-59.4-1979 “Generic Requirements for Light Water Reactor Nuclear 

Power Plant Fire protection” 

7.4.56 NRC Letter to Licensees dated June 19, 1979 “Staff Position – Safe Shutdown 

Capability” 

7.4.57 NRC Letter to BWROG dated December 12, 2000 “BWR Owners Group 

Appendix R Fire Protection Committee Position of SRVs + Low Pressure 

Systems Used As ‘Redundant’ Shutdown Systems Under Appendix R (Topical 

Report GE-NE-T43-0002-00-03-R01) TAC No. MA8545)” [ML003776828] 

7.4.58 RIS-2007-19, “A Process for Communicating Clarifications of Staff Positions 

Provided in Regulatory Guide 1.205 Concerning Issues Identified During the Pilot 

Application of National Fire Protection Association Standard 805”, August 20, 

2007.

7.4.59 S. NOWLEN, F. WYANT, Cable Response to Live Fire (CAROLFIRE) Test 

Report Volume 1: General Test Descriptions and the Analysis of Circuit Response 

Data, NUREG/CR-6931/V1, SAND2007-600, Sandia National Laboratories, 

Albuquerque, New Mexico, March 2007. 

7.4.60 ANSI/ANS-58.23-2007, “Fire PRA Methodology, an American National 

Standard,” American Nuclear Society, La Grange Illinois, November 2007 

7.4.61 ASME/ANS RA-S-2008, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications”, Revision 

1, American Society of Mechanical Engineers, November 2008. 

7.4.62 ASME/ANS RA-A-2009, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications”, Addendum 

A to Revision 1, American Society of Mechanical Engineers, March 2009. 

7.5 ADMINISTRATIVE LETTERS 

7.5.1 95-06 Relocation of Technical Specification Administrative Controls 

7.6 REGULATORY ISSUE SUMMARIES 

7.6.1 2004-03, Risk-Informed Approach for Post-Fire Safe Shutdown Associated 

Circuit Inspection 
NEI 00-01, Revision 2 

May 2009 

135 

ATTACHMENT 1 

EXAMPLE OF TYPICAL BWR SAFE SHUTDOWN PATH DEVELOPMENT 

Safe Shutdown Path 1 Safe Shutdown Path 2 Safe Shutdown Path 3

Reactivity Control Reactivity Control Reactivity Control 

CRD (Scram Function) CRD (Scram Function) CRD (Scram Function) 

Manual Scram and/or 

Operator Manual Action to 

remove RPS Power or to vent the 

instrument air header 

Manual Scram and/or 

Operator Manual Action to 

remove RPS Power or to vent 

the instrument air header 

Manual Scram and/or 

Operator Manual Action to 

remove RPS Power or to vent the 

instrument air header 

Pressure Control Pressure Control Pressure Control 

Manual ADS/SRVs using 

available Control Room and 

Remote Switches 

SRVs using the available 

Remote Shutdown Panel and 

Remote Switches 

Manual ADS/SRVs using 

available Control Room and 

Remote Switches 

Inventory Control Inventory Control Inventory Control 

Core Spray RCIC RHR LPCI 

RHR LPCI 

Decay Heat Removal Decay Heat Removal Decay Heat Removal 

RHR Supp. Pool Cooling Mode RHR Supp. Pool Cooling Mode RHR Supp. Pool Cooling Mode 

Service Water Service Water Service Water 

Core Spray, Alt. SDC Mode RHR Shutdown Cooling Mode RHR, Alt. SDC Mode 

Process Monitoring Process Monitoring Process Monitoring

Supp. Pool Monitoring Supp. Pool Monitoring Supp. Pool Monitoring 

Nuc. Boiler Instru. Nuc. Boiler Instru. Nuc. Boiler Instru. 

Associated Support Functions Associated Support Functions Associated Support Function

Cooling Systems Cooling Systems Cooling Systems

RHR Room Coolers RHR Room Coolers RHR Room Coolers 

RCIC Room Coolers 

Service Water Pumphouse 

HVAC 

Service Water Pumphouse 

HVAC 

Service Water Pumphouse 

HVAC 

EDG HVAC EDG HVAC EDG HVAC 

Electrical Electrical Electrical

EDGs or Offsite Power EDGs or Offsite Power EDGs or Offsite Power 

Electrical Distribution 

Equipment 

Electrical Distribution 

Equipment

Electrical Distribution 

Equipment
NEI 00-01, Revision 2 

May 2009 

ATTACHMENT 2 

ANNOTATED P&ID ILLUSTRATING SSD SYSTEM PATHS [BWR EXAMPLE

136 
ATTACHMENT 3 

EXAMPLE OF SAFE SHUTDOWN EQUIPMENT LIST 

(Sorted by Equipment ID)

Equipment ID Logic 

Diagram 

System Unit Equipment 

Type 

SSD Path 

Equipment Description Equip 

FA 

Normal Mode 

Shutdown Mode(s) 

High/Low 

137 
NEI 00-01, Revision 2 

May 2009 

138 

Attachment 3 

(Continued) 

A description of the Safe Shutdown Equipment List column headings is provided as follows: Equipment ID Identifies the equipment/component ID No. from the P&ID or one line diagram. Logic Diagram Identifies a safe shutdown logic diagram reference that may illustrate the rela

equipment and other system components 

System Identifies the Appendix R Post-Fire Safe Shutdown System of which the equipmen

Unit Identifies the Unit(s) that the equipment supports. Equipment Type Identifies the type of equipment (e.g., MOV, pump, SOV). SSD Path Identifies the safe shutdown path(s) for which the equipment is necessary to rem

mal-operate. 

Equipment Description Provides a brief description of the equipment. Equip FA Identifies the fire area where the equipment is located. Normal Mode Identifies the position or mode of operation of the equipment during normal plant o

Shutdown Mode(s) Identifies the position or mode of operation of the equipment during shutdown conHigh/Low Identifies whether the equipment is considered part of a high/low pressure interfacAir Fail If applicable, identifies the position of equipment resulting from a loss of air supplyPower Fail Identifies the position of equipment resulting from a loss of electrical power. 

Reference Identifies a primary reference drawing (P&ID or electrical) on which the equipmen
139 

ATTACHMENT 4 

SAFE SHUTDOWN LOGIC DIAGRAM [BWR EXAMPLE] 
NEI 00-01, Revision 2 

May 2009 

ATTACHMENT 5 

EXAMPLE OF AFFECTED EQUIPMENT REPORT 

(Sorted by Fire Area, System, Unit & Equipment ID – [other sorts may also be useful]) 

Fire Area: Required Path(s): FA Description: Suppression: System Unit Logic 

Diagram 

Equipment ID 

Equip Type 

SSD Path 

Equip FA 

Equipment Description 

Normal Mode 

Shutdown Mode(s) 

High/Low 

Air Fail 

PoweFail 

140 
141 

Attachment 5 

(Continued) 

A description of the Affected Equipment Report column headings is provided as follows: Fire Area Identifies the fire area where the equipment or cables are located. Required Path(s) Identifies the safe shutdown path(s) relied upon to achieve safe shutdown in the fir

FA Description Provides a brief description of the fire area. Suppression Identifies the type of fire suppression (e.g. manual, auto, none) within the fire areaDetection Identifies the type of fire detection within the fire area. System Identifies the Appendix R Post-Fire Safe Shutdown System of which the equipmen

Unit Identifies the Unit(s) that the equipment supports. Logic Diagram Identifies a safe shutdown logic diagram reference that may illustrate the rela

equipment and other system components 

Equipment ID Identifies the equipment/component ID No. from the P&ID or one line diagram. Equip Type Identifies the type of equipment (e.g. MOV, pump, SOV). SSD Path Identifies the safe shutdown path(s) for which the equipment is necessary to rem

mal-operate. 

Equip FA Identifies the fire area where the equipment is located. Equipment Description Provides a brief description of the equipment. Normal Mode Identifies the position or mode of operation of the equipment during normal plant o

Shutdown Mode(s) Identifies the position or mode of operation of the equipment during shutdown conHigh/Low Identifies whether the equipment is considered part of a high/low pressure interfacAir Fail If applicable, identifies the position of equipment resulting from a loss of air supplyPower Fail Identifies the position of equipment resulting from a loss of electrical power. 

Disp Code A code that corresponds to specific compliance strategies and enables sorting and g

Compliance Strategy A brief discussion of the method by which the equipment is resolved to meet Appe
NEI 00-01, Revision 2 

May 2009 

ATTACHMENT 6 

EXAMPLE OF FIRE AREA ASSESSMENT REPORT 

(Sorted by Fire Area, System, Unit & Equipment ID – [other sorts may also be useful

Fire Area: Required Path(s): System: Unit: Equipment ID 

Logic Diagram 

Equip Type 

SSD Path 

Equip FA 

Equipment Description 

Normal Mode 

Shutdown Mode(s) 

High//Low 

Air Fail 

Power Fail 

Cable Cable 

Funct 

142 
143 

Attachment 6 

(Continued)

A description of the Fire Area Assessment Report column headings is provided as follows: Fire Area Identifies the fire area where the cables or equipment are located. 

Required Path(s) Identifies the safe shutdown path(s) relied upon to achieve safe shutdown in the fire area. System Identifies the Appendix R Post-Fire Safe Shutdown System of which the equipment is part

Unit Identifies the unit(s) that the equipment supports. Equipment ID Identifies the equipment/component ID No. from the P&ID or one line diagram. Logic Diagram Identifies a safe shutdown logic diagram reference that may illustrate the relationship b

system components 

Equip Type Identifies the type of equipment (e.g. MOV, pump, SOV). FA Description Provides a brief description of the fire area. Suppression Identifies the type of fire suppression (e.g. manual, auto, none) within the fire area. 

Detection Identifies the type of fire detection within the fire area. Equip Type Identifies the type of equipment (e.g. MOV, pump, SOV). SSD Path Identifies the safe shutdown path(s) for which the equipment is necessary to remain functi

Equip FA Identifies the fire area where the equipment is located. 

Equipment Description Provides a brief description of the equipment. Normal Mode Identifies the position or mode of operation of the equipment during normal plant operatioShutdown Mode(s) Identifies the position or mode of operation of the equipment during shutdown conditions. 

High/Low Identifies whether the equipment is considered part of a high/low pressure interface. 

Air Fail If applicable, identifies the position of equipment resulting from a loss of air supply. Power Fail Identifies the position of equipment resulting from a loss of electrical power. Cable Identifies the safe shutdown cable located in the fire area. Cable Funct Identifies the function of the cable (e.g., power, control) and whether its failure can result 

Disp Code A code that corresponds to a specific compliance strategy and enables sorting and groupinCompliance Strategy A brief discussion of the method by which the cable is resolved to meet Appendix R comp

NEI 00-01, Revision 2 

May 2009 

A-1 

APPENDIX A

SAFE SHUTDOWN ANALYSIS AS PART OF AN OVERALL FIRE PROTECTION 

PROGRAM 

A.1 PURPOSE 

This appendix discusses the significant improvements that have been made within 

nuclear industry fire protection programs since the Browns Ferry fire. The discussion 

will include what defense-in-depth features, in aggregate, constitute a complete and 

comprehensive fire protection program and what part the safe shutdown analysis plays in 

that aggregate. 

A.2 INTRODUCTION 

Each licensee’s fire protection program is based on the concept of defense-in-depth. The 

Appendix R safe shutdown assumptions related to fire intensity and damage potential 

represent a conservative design basis in that they postulate conditions significantly 

beyond those that are ever expected to occur based on the existing defense-in-depth plant 

features. Fire damage and equipment failures, to the extent postulated in an Appendix R 

safe shutdown analysis, have never been experienced in an operating U.S. nuclear power 

plant. The worst-case fire ever experienced in a U.S. nuclear power plant was in 1975 at 

the Browns Ferry Nuclear Power Plant Unit 1. Changes made in the design of U.S. 

nuclear power plants since this fire have significantly improved the fire safety of these 

units such that the sequence of events that occurred at Browns Ferry is not expected to 

recur. 

The sections that follow discuss the Browns Ferry fire, the investigation of that fire, the 

recommendations made to prevent recurrence of such a fire and the improvement made 

by the U.S. nuclear power industry relative to these recommendations. 

A.3 OVERVIEW 

A.3.1 Browns Ferry Fire: Regulatory History 

In March of 1975, a fire occurred at the Browns Ferry Nuclear Plant Unit 1. Due to 

unusual circumstances, the fire was especially severe in its outcome and resulted in 

considerable loss of systems and equipment with temporary unavailability of systems that 

would normally be utilized to safely shut down the plant for such events. 

The severity of the fire caused the NRC to establish a review group that evaluated the 

need for improving the fire protection programs at all nuclear plants. The group found 

serious design inadequacies regarding general fire protection at Browns Ferry and 

recommended improvements in its report, NUREG-0050, “Recommendations Related to 
NEI 00-01, Revision 2 

May 2009 

A-2 

Browns Ferry Fire” issued in February 1976. This report also recommended 

development of specific guidance for implementation of fire protection regulation, and 

for a comparison of that guidance with the fire protection programs at each nuclear 

facility. 

The NRC developed technical guidance from the recommendations set forth in the 

NUREG and issued those guidelines as Branch Technical Position (BTP) APCSB 9.5-1, 

“Guidelines for Fire Protection for Nuclear Power Plants,” May 1976. The NRC asked 

each licensee to compare their operating reactors or those under construction with BTP 

APCSB 9.5-1 requirements and, in September 1976, informed the licensees that the 

guidelines in Appendix A of the BTP would be used to analyze the consequences of a fire 

in each plant area. 

In September 1976, the NRC requested that licensees provide a fire hazards analysis that 

divided the plant into distinct fire areas and show that systems required to achieve and 

maintain cold shutdown are adequately protected against damage by a fire. Early in 1977 

each licensee responded with a fire protection program evaluation that included a Fire 

Hazards Analysis. These evaluations and analyses identified aspects of licensees' fire 

protection programs that did not conform to the NRC guidelines. Thereafter, the staff 

initiated discussions with all licensees aimed at achieving implementation of fire 

protection guidelines by October 1980. The NRC staff has held many meetings with 

licensees, has had extensive correspondence with them, and has visited every operating 

reactor. As a result, many fire protection open items were resolved, and agreements were 

included in fire protection Safety Evaluation Reports issued by the NRC. 

By early 1980, most operating nuclear plants had implemented most of the basic 

guidelines in Appendix A of the BTP. However, as the Commission noted in its Order of 

May 23, 1980, the fire protection programs had some significant problems with 

implementation. Several licensees had expressed continuing disagreement with the 

recommendations relating to several generic issues. These issues included the 

requirements for fire brigade size and training, water supplies for fire suppression 

systems, alternative and dedicated shutdown capability, emergency lighting, 

qualifications of seals used to enclose places where cables penetrated fire barriers, and 

the prevention of reactor coolant pump lubrication system fires. To resolve these 

contested subjects consistent with the general guidelines in Appendix A to the BTP, and 

to assure timely compliance by licensees, the NRC, in May of 1980, issued a fire 

protection rule, 10 CFR 50.48 and 10 CFR 50 Appendix R. NRC described this new rule 

as setting forth minimum fire protection requirements for the unresolved issues. The fire 

protection features addressed in the 10 CFR 50 Appendix R included requirements for 

safe shutdown capability, emergency lighting, fire barriers, fire barrier penetration seals, 

reactor coolant pump lubrication system, and alternative shutdown systems. 

Following the issuance of Appendix R, the NRC provided guidance on the 

implementation of fire protection requirements and Appendix R interpretations at nuclear 

plants through Generic Letters, regional workshops, question and answer correspondence 

and plant specific interface. This guidance provided generic, as well as specific, analysis 
NEI 00-01, Revision 2 

May 2009 

A-3 

criteria and methodology to be used in the evaluation of each individual plant’s post-fire 

safe shutdown capability. 

A.3.2 Fire Damage Overview 

The Browns Ferry fire was a moderate severity fire that had significant consequences on 

the operator’s ability to control and monitor plant conditions. Considerable damage was 

done to plant cabling and associated equipment affecting vital plant shutdown functions. 

The fire burned, uncontrolled, while fire fighting efforts, using CO2 and dry chemical 

extinguishers, continued for approximately 7 hours with little success until water was 

used to complete the final extinguishing process. 

During the 7-hour fire event period, the plant (Unit 1) experienced the loss of various 

plant components and systems. The loss of certain vital systems and equipment 

hampered the operators’ ability to control the plant using the full complement of 

shutdown systems. The operators were successful in bringing into operation other 

available means to cool the reactor. Since both Units 1 and 2 depended upon shared 

power supplies, the Unit 2 operators began to lose control of vital equipment also and 

were forced to shut down. Since only a small amount of equipment was lost in Unit 2, 

the shutdown was orderly and without incident. 

The results of the Browns Ferry fire event yielded important information concerning the 

effects of a significant fire on the ability of the plant to safely shut down. Although the 

Browns Ferry fire event was severe and the duration of the fire and the loss of equipment 

were considerable, the radiological impact to the public, plant personnel and the 

environment was no more significant than from a routine reactor shutdown. At both Unit 

1 and Unit 2, the reactor cores remained adequately cooled at all times during the event. 

Due to numerous design and plant operational changes implemented since 1975, 

including post-TMI improvements in emergency operating procedures, nuclear power 

plants in operation today are significantly less vulnerable to the effects of a fire event 

such as that experienced at Browns Ferry. Since 1975, a wide range of fire protection 

features, along with regulatory and industry guided design and procedural modifications 

and enhancements, has been implemented. The combination of these upgrades has 

resulted in a significant increase in plant safety and reliability, and, along with 

preventative measures, they help to ensure that events similar in magnitude to the Browns 

Ferry fire will not occur again. The improvements in plant design and procedural 

operations incorporated since the Browns Ferry fire are described below. The designs 

and operating procedures that existed at Browns Ferry at the time of the fire are also 

detailed.

A.3.3 Causes of the Browns Ferry Fire, its Severity and Consequences 

The following factors contributed directly to the severity and consequences of the 

Browns Ferry fire. 

 Failure to evaluate the hazards involved in the penetration sealing operation and to 

prepare and implement controlling procedures. 
NEI 00-01, Revision 2 

May 2009 

A-4 

 Failure of workers to report numerous small fires experienced previously during 

penetration sealing operations, and failure of supervisory personnel to recognize the 

significance of those fires that were reported and to take appropriate corrective 

actions. 

 Use of an open flame from a candle (used to check for air leaks) that was drawn into 

polyurethane foam seal in a cable penetration between the Reactor Building and the 

cable spreading room. 

 Inadequate training of plant personnel in fire fighting techniques and the use of fire 

fighting equipment (e.g., breathing apparatus, extinguishers and extinguishing 

nozzles). 

 Significant delay in the application of water in fighting the fire. 

 Failure to properly apply electrical separation criteria designed to prevent the failure 

of more than one division of equipment from cable tray fires. Examples are: 

• Safety-related redundant divisional raceways were surrounded by nonsafety 

related raceways that became combustible paths routed between divisions (i.e., 

even though separation between redundant division cable trays was consistent 

with the specified horizontal and vertical required distances, the intervening space 

was not free of combustibles as required by the existing electrical separation 

criteria). 

• Contrary to electrical separation criteria, one division of safety related cabling 

was not physically separated from the redundant division due to cabling of one 

division routed in conduit within the “zone of influence” of the open redundant 

division cable tray. Proper application of electrical separation criteria requires 

that a tray cover or other barrier be installed on the top and/or bottom of the open 

redundant raceway or between redundant raceways to contain the fire within the 

open tray and not affect redundant division conduits. 

• Failure to properly separate redundant equipment indicating light circuits, leading 

to the loss of redundant equipment necessary for safe plant shutdown. 

 Cabling utilized within the Browns Ferry raceway system included cable jacket and 

insulation materials that were less resistant to fire propagation (e.g., PVC, nylon, 

polyvinyl, nylon-backed rubber tape, and neoprene). 

A.3.4 Fire Protection Program Improvements Since Browns Ferry 

The Browns Ferry nuclear facility generally conformed to the applicable fire protection 

and electrical separation criteria and guidelines that existed when it was licensed to 

operate by the NRC in 1968. However, the 1975 fire identified a number of areas 
NEI 00-01, Revision 2 

May 2009 

A-5 

concerning fire protection design, plant operating criteria, electrical separation and 

defense-in-depth considerations that required improvement. As described above, the 

NRC provided the industry with guidance for improvement of fire protection programs 

through BTP APCSB 9.5-1, Appendix A, 10 CFR 50 Appendix R and other related 

regulatory correspondence. The improvements addressed in NRC guidance are as 

follows: 

1. Fire Prevention Features: 

• Fire hazards, both in-situ and transient, are identified and eliminated where 

possible, and/or protection is provided. 

• Sufficient detection systems, portable extinguishers, and standpipe and hose 

stations have been provided. These systems are designed, installed, maintained, 

and tested by qualified fire protection personnel. 

• Ignition sources controlled. 

2. Fire Protection Features: 

• Fire barriers and/or automatic suppression systems have been installed to protect 

the function of redundant systems or components necessary for safe shutdown. 

• Surveillance procedures have been established to ensure that fire barriers are in 

place and that fire suppression systems and components are operable. 

• Water supplies for fire protection features have been added, both for automatic 

and manual fire fighting capability. 

• Automatic fire detection systems have been installed with the capability of 

operating with or without offsite power availability. 

• Emergency lighting units with at least 8 hours’ battery capacity were provided in 

those areas where safe shutdown system control was necessary as well as in 

access and egress areas thereto. 

• Fire barrier qualification programs have been established to qualify and test 

prospective barrier materials and configurations to ensure that their fire endurance 

and resistivity is acceptable. 
NEI 00-01, Revision 2 

May 2009 

A-6 

3. Fire Hazards Control: 

• Administrative controls have been established to ensure that fire hazards are 

minimized. 

• The storage of combustibles in safe shutdown areas has been prohibited or 

minimized. Designated storage areas for combustibles have been established. 

• Transient fire loads such as flammable liquids, wood and plastic have been 

limited. 

• The use of ignition sources is controlled through procedures and permits. 

• Controls for the removal of combustibles from work areas, following completion 

of work activities, have been established. 

• Proposed work activities are reviewed by in-plant fire protection staff for impacts 

on fire protection. 

• Noncombustible or less flammable materials including penetration seals, cable 

jackets, fire retardant wood products, etc., are being used. 

• Self-closing fire doors have been installed. 

• Oil collection systems have been installed for reactor coolant pumps for 

containments that are not inerted. 

4. Fire Brigade/Training: 

• Site fire brigades have been established to ensure adequate manual fire fighting 

capability is available. 

• A fire brigade training program has been established to ensure that the capability 

to fight potential fires is maintained. Classroom instruction, fire fighting practice 

and fire drills are performed at regular intervals. 

• Fire brigade training includes: 

 Assignment of individual brigade member responsibilities 

 The toxic and corrosive characteristics of expected products of combustion 

 Identification and location of fire fighting equipment 

 Identification of access and egress routes 

 Proper use of fire fighting equipment to be used for electrical equipment fires, 

fires in cable trays and enclosures, hydrogen fires, flammable liquids fires, 

hazardous chemical fires, etc. 

 Proper use of communication, emergency lighting, ventilation and breathing 

equipment 

 Review of detailed fire fighting strategies and procedures. 
NEI 00-01, Revision 2 

May 2009 

A-7 

5. Post-Fire Safe Shutdown Capability 

• A comprehensive post-fire safe shutdown analysis program, using the 

methodology and criteria similar to those described in this report, has been 

established to ensure that post-fire safe shutdown capability is provided. 

• Fire damage is limited so that one train of safe shutdown equipment necessary to 

achieve and maintain hot shutdown is protected and free from fire damage. 

• Cabling for redundant trains of safe shutdown equipment is separated by 1- or 3- 

hour fire rated barriers. In areas where 1-hour rated barriers are used, additional 

protection is provided by fire detection and an automatic suppression system. 

• Twenty feet of space, containing no intervening combustibles, is provided in lieu 

of barriers, where applicable. Additional protection is provided by fire detection 

and an automatic suppression system 

• Where redundant trains of equipment, necessary for post-fire safe shutdown, are 

located in the same fire area and adequate protection for one train cannot be 

achieved, an alternative or dedicated fire safe shutdown system has been 

established as follows: 

Alternative or dedicated fire safe shutdown systems are capable of achieving and 

maintaining subcritical reactivity conditions in the reactor, maintaining reactor 

coolant inventory, and achieving and maintaining hot or cold shutdown conditions 

within 72 hours. 

• Process monitoring instrumentation is provided with the capability of directly 

monitoring those process variables necessary to perform and control post-fire safe 

shutdown functions. 

• Supporting functions (cooling, lubrication, HVAC, etc.) necessary to ensure 

continued operation of post-fire safe shutdown systems/equipment are provided.

A.4 CONCLUSION 

The changes made to the plant fire protection programs in response to the Browns Ferry 

fire as described above provide reasonable assurance that the plant design and operation 

will be safe from the effects of fire. When these changes are integrated into an approach 

similar to that outlined in the body of this document for assuring the ability to achieve 

and maintain post-fire safe shutdown, the result is a significantly enhanced plant design 

with emphasis on precluding any unacceptable consequences resulting from plant fires. 
NEI 00-01, Revision 2 

May 2009 

A-8 

A.5 REFERENCES 

A.5.1 Branch Technical Position BTP APCSB 9.5-1, “Guidelines for Fire Protection for 

Nuclear Power Plants,” May 1976 

A.5.2 NUREG-0050, “Recommendations Related to Browns Ferry Fire” issued in 

February 1976 

A.5.3 10 CFR 50.48 Fire Protection (45 FR 76602) 

A.5.4 10 CFR 50 Appendix R Fire Protection for Operating Nuclear Power Plants 
NEI 00-01, Revision 2 

May 2009 

B-1 

APPENDIX B

DETERMINISTIC CIRCUIT FAILURE CRITERIA 

B.1 PURPOSE 

The purpose of this appendix is to provide the basis for the criteria for evaluating circuit 

failures within a deterministic analysis as outlined in Section 3.5. This appendix serves 

to identify the types of circuit failures that need to be considered as part of a deterministic 

analysis of MSOs. It also identifies how these circuit failure types need to be considered 

in the various circuit types employed in a nuclear power plant. In addition, a subappendix provides information supporting the elimination of multiple high impedance 

faults from a plant's deterministic analysis criteria. Since the circuit failure criteria 

required to be considered in a deterministic analysis are not specifically defined in the 

regulations and since numerous circuit failure criteria have historically been used and, in 

a number of cases, accepted by the NRC, reference to and analysis of Industry and NRC 

sponsored fire cable test results is used to define the criteria to be used in performing an 

evaluation of fire-induced circuit failures, including MSOs. 

The fire-induced circuit failure criteria used in the post-fire safe shutdown analysis is 

only one component of the defense-in-depth provided by a Fire Protection Program in an 

operating Nuclear Power Plant. It is the combination of all aspects of the defense-indepth provided by a Fire Protection Program in an operating Nuclear Power Plant that 

minimizes the effects of fires on structures, systems and components important to safety 

as required by Criterion 3 of 10 CFR 50 Appendix A. 

Additionally, as required in Criterion 3 of 10 CFR 50 Appendix A, the minimization of 

the effects of fires on structures, systems and components important to safety is to be 

accomplished in a manner that is consistent with other safety requirements. Just as the 

design of firefighting systems under Criterion 3 of Appendix has the potential through 

inadvertent initiation or rupture to impair the capability of structures, systems and 

components important to safety, the application of circuit failure criteria in a post-fire 

safe shutdown analysis could poses similar consequences, if not properly defined and 

applied. The criteria provided herein for fire-induced circuit failures is developed to 

balance the need for addressing the effects of fires without inadvertently leading 

licensee’s to take actions that could impair structures, systems and components important 

to safety. 

B.2 INTRODUCTION 

A Fire Protection Program (FPP) licensed to the deterministic requirements of 10CFR50, 

Appendix R; Appendix A to Branch Technical Position 9.5-1; or, NUREG 0800 Section 

9.5-1 is based on the concept of fire protection defense-in-depth. The principles of fire 

protection defense-in-depth are as follows: 
NEI 00-01, Revision 2 

May 2009 

B-2 

• To prevent fires from starting. 

• To detect rapidly, control, and extinguish promptly those fires that do occur. 

• To provide protection for structures, systems, and components important to safety 

so that a fire that is not promptly extinguished by the fire suppression activities 

will not prevent the safe shutdown of the plant. 

Within this envelope of fire safety, licensees perform a Safe Shutdown Analysis (SSA) 

that demonstrates the ability to achieve and maintain safe shutdown in the event of a 

single fire in any plant fire area. The typical assumption associated with the deterministic 

SSA is that the fire damages any equipment or circuits contained within the fire area. 

This assumption, when evaluated in light of the defense-in-depth approach described 

above, is considered to be a conservative assessment of the upper bound potential for fire 

damage. This assumption is used as an alternative to specifying a design basis fire and 

assessing the impact of the design basis fire on the components and circuits in each fire 

area. Due to the level of conservatism inherent in this assumption, essentially all 

licensees assumed that not all fire failures within a given fire area occurred at the same 

time and, as a result, fire-induced impacts resulting in spurious operations could be 

evaluated and mitigated on a one-at-a-time basis. 

In the 1990’s, NRC Staff began to question the validity and level of conservatism 

associated with the assumption of being able to evaluate and mitigate fire-induced 

spurious operations on a one-at-a-time basis. This questioning was the genesis for a 

series of efforts on the part of both the NRC and the Industry to attempt to demonstrate 

and define the proper set of assumptions to be used for a post-fire SSA. Included within 

the efforts undertaken by both NRC and the Industry was a series of cable fire tests. The 

initial cable fire tests were conducted by NEI/EPRI. Subsequent to the NEI/EPRI testing, 

the NRC conducted the CAROLFIRE cable testing program. Currently the NRC is 

actively involved in cable fire testing on DC circuits. The results of this testing should be 

publicly available later in 2009. 

Each of these cable fire testing programs demonstrated that hot shorts resulting in 

spurious operations were possible. The probabilities developed to capture the likelihood 

of a hot short resulting in a spurious operation, however, were conditional and based on 

the subject cable being damaged by the fire. For thermoset cables, cable damage 

occurred when the cable temperature reached approximately 600 to 700o

F. For 

thermoplastic cables, cable damage occurred when cable temperatures reached 

approximately 400 to 500o

F. In either of these cases, cable failure was not instantaneous. 

When cable damage did result in a hot short with the potential to cause a spurious 

operation, the hot short was typically of short duration lasting much less than 11.7 

minutes in the worst case. Additionally, in the NEI/EPRI Cable Fire Tests and in the 

CAROLFIRE Intermediate Scale Fire Tests, simultaneous failure of adjacent cable 

failures, even for cables within the same cable tray, in the same fire test did not occur 

except for one instance in Test No. 9 of the NEI/EPRI testing. Each of the cable fire 

testing programs demonstrated that hot shorts resulting in spurious operations were 

possible. The probabilities developed to capture the likelihood of a hot short resulting in 
NEI 00-01, Revision 2 

May 2009 

B-3 

a spurious operation, however, were conditional and based on the subject cable being 

damaged by the fire. For thermoset cables, cable damage occurred when the cable 

temperature reached approximately 600 to 700oF. For thermoplastic cables, cable 

damage occurred when cable temperatures reached approximately 400 to 500oF. In 

either of these cases, cable failure was not instantaneous. When cable damage did result 

in a hot short with the potential to cause a spurious operation, the hot short was typically 

of short duration lasting much less than 11.7 minutes in the worst case. 

Additionally, in the NEI/EPRI Cable Fire Tests and in the CAROLFIRE Intermediate 

Scale Fire Tests, simultaneous failure of adjacent cables, even for cables within the same 

cable tray, in the same fire test did not occur except for one instance in Test No. 9 of the 

NEI/EPRI testing. In each of these testing programs, there were approximately 15 test 

conducted with each test having four cable bundles. This equates to a total of 120 cables. 

With simultaneous failures occurring in only one instance, it can be concluded that the 

probability of simultaneous cables failures in reasonable low for the type of fire 

environment in which these cables were tested. 

When the factors listed above are integrated with the actual fire hazards present in an 

operating nuclear power plant and with the defense-in-depth fire protection programs 

described above, it can be concluded that the use of a reasonably bounded circuit failure 

criteria is appropriate. 

Given the fact that circuit failures are not likely until temperature conditions in the 

vicinity of the cable reach elevated temperatures, cables that are located in areas with 

limited combustibles are very unlikely to fail. A typical nuclear power plant places strict 

controls on the introduction of in-situ and transient combustibles into plant areas where 

equipment required for hot shutdown or important to safe shutdown are located. 

Additionally, where the in-situ fire hazards are greater, a typical nuclear power plant uses 

automatic suppression and detection for early identification and suppression of any fire 

that could occur. The availability of automatic fire suppression in these plant areas will 

prevent plant temperatures in the area of the hazard from reaching the levels necessary 

for cable failure. 

For most plant equipment, a spurious operation will occur as a result of a single hot short 

in the components primary control circuit. Although unlikely, given the defense-in-depth 

aspects of plant design, this is the most likely cause of a spurious operation for that 

particular component. Other less likely combinations of fire-induced circuit failures 

could be postulated to occur and to result in a spurious operation. This appendix 

recommends that only those combined circuit failures from secondary circuits that seal-in 

or latch need to be considered in combination. The majority of the instances where 

combined circuit failures can be postulated to occur in a potential for a spurious operation 

different than the single spurious signal caused by a single hot short in the components 

primary control circuitry, occur in the elementary logic diagrams. 
NEI 00-01, Revision 2 

May 2009 

B-4 

The most likely location for the effects to be in close enough proximity to be reasonably 

considered to have the potential to be affected by the same fire is for circuits in Relay 

Panels. These Relay Panels are low voltage panels with no combustibles other than the 

cable contained within them. They are generally not located in close proximity to 

significant fire hazards with the potential for explosive or rapidly growing fires. Due to 

the low voltage present, the ignition source does not have any of the characteristic of an 

explosive or rapidly growing fire. As such, in these locations, the expected fire size 

would be significantly less than that seen in the Industry and NRC Cable Fire Testing 

Programs. As a result, for these situations, performance comparable to that seen in the 

Cable Fire testing would be expected to bound any actual fire effects. Additionally, for 

many of the later plants, particularly in the BWR Fleet, the Relay Room/Control Room 

design is based on the GE PGCC concept outlined in GE Report NEDO 10466-A. In this 

document, which tested the acceptability of the GE PGCC Design for fires, sustained fire 

conditions could not be developed without the introduction of artificial conditions. 

The likelihood of a fire of a sufficient magnitude to exist in an area that is not properly 

protected with automatic suppression and detection is remote. When this likelihood is 

combined with an assumption of having the right two, three or more cables in close 

proximity to each other in the same area, the likelihood is even smaller. To further 

postulate that the fire in this area damages each of these cables and, additionally, 

damages all other unprotected equipment in the plant with the capability to mitigate the 

effects of the fire, would be to propose a fire-induced circuit failure criteria that is beyond 

that required to demonstrate the level of reasonable assurance expected and provided in 

essentially all other aspects of nuclear power plant design. 

As such, given the results of the Industry and NRC Cable Fire Testing, the defense-indepth design features provided in a nuclear power plant and the many other conservative 

assumptions used in the deterministic post-fire safe shutdown analysis, the proposed limit 

provided in this appendix on the duration of a hot short and not combining the effects of 

non-seal-in or non-latching hot shorts in separate cables in secondary circuits is justified. 

Therefore, for plant with the following, the use of the criteria described above which 

limits consideration of simultaneous effects from secondary circuit cables may be used. 

1. A combustible control program that tracks in-situ and transient combustibles and 

limits the introduction of significant amounts of combustible materials in plant 

areas that are critical to post-fire safe shutdown, i.e. divisional separation areas, 

areas where required in support of exemption/deviation requests or fire hazards 

analysis. 

2. Automatic suppression with detection in plant areas where significant fire hazards 

are present. 

3. No fire hazards with the potential for explosive or rapidly growing fires in areas 

where Relay Panels are located. 
NEI 00-01, Revision 2 

May 2009 

B-5 

Additionally, when using these criteria, licensees’ should review their elementary logic 

diagrams to identify areas of potential spurious system operation that could pose a 

significant threat to safe shutdown. For those circuits with significant threat potential, 

assure that direction exists in either the plant abnormal or emergency operating 

procedures to take appropriate actions to mitigate the effects of these spurious system 

operations. The circuits used for the mitigating action do not need to be protected from 

the effects of fires, but they do need to be separate circuits form those with the potential 

to cause the spurious operation. Any such actions, however, are not considered to be 

operator manual actions. This review precludes, with reasonable assurance, the potential 

for these highly unlikely unanalyzed combinations to put the plant into an unrecoverable 

condition relative to plant safe shutdown. 

The initial assessment of the test results was that they had demonstrated that multiple hot 

shorts and MSOs were, in fact, highly likely and that a SSA failing to include such 

multiple hot shorts and MSOs was deficient and potentially unsafe. This led to NRC 

issuing draft Generic Letter 2006-XX that would have required licensees to address all 

potential fire-induced circuit failures and hot short induced spurious operations occurring 

simultaneously. 

This response to the cable fire test results is problematic for a number of reasons. First, 

implementing the criteria contained in Generic Letter 2006-XX would require defining 

multiple design basis fires for each fire area. The definition of a design basis fire in a 

deterministic analysis is in direct conflict with the assumption historically used by 

licensees and endorsed by the NRC of fire spread throughout the fire area. Second, using 

a conditional probability of a hot short and spurious operation predicated on the fire 

damaging the cable directly ignores all of the defense-in-depth fire protection program 

features that are highly likely to prevent cable damage from ever occurring and, 

implicitly, requires the use of fire modeling to assess cable fire damage. Third, when the 

defense-in-depth fire protection program features are combined with the results of the 

cable fire testing, the following conclusions can be derived from the results of the 

industry and NRC cable fire testing: 

• The current assumption historically used in a post-fire SSA that all circuits within 

the fire area could be damaged is conservative. The tests results showed that even 

at temperatures above 700o

F, not all cables in each test were damaged. 

• The current assumption that each conductor in each cable within the fire area 

must be evaluated for the effects of a hot short, a short-to-ground or an open 

circuit is a conservative assumption, since the testing showed that not all 

conductors in all cables in the fire test actually experienced these fire-induced 

circuit failures. Industry and CAROLFIRE cable fire testing, however, did show 

that fire induced circuit failures within the same multi-conductor cable did coexist. 

• The current assumption that hot shorts, at least on AC circuits, last until an action 

is taken to eliminate their effects is a conservative assumption, since the testing 

showed that hot shorts last only for a short duration prior to going to ground. 
NEI 00-01, Revision 2 

May 2009 

B-6 

Circuits tested to date have been AC circuits. The results of the DC circuit testing 

on hot short duration will not be publicly available until later in 2009. 

• The conclusions above, when coupled with the fact that hot shorts and spurious 

operations in the fire tests took a finite amount of time to develop, even for cables 

directly affected by the fire, and the fact that fire spread throughout the fire area 

will take a finite amount of time to occur, suggests that an assumption allowing 

the evaluation and mitigation of the effects of fire-induced circuit damage on a 

one-at-a-time basis is not that unreasonable for circuits with some degree of 

separation. Despite this, in applying a deterministic criteria for circuit failure 

analysis, it is important that a bounding criteria be used which provides 

reasonable assurance that post-fire safe shutdown can be achieved. Consideration 

of either multiple simultaneous hot shorts or multiple concurrent spurious 

operations is appropriate for the following cases: 

o The case where multiple spurious operations could result from a fireinduced circuit failure affecting a single conductor. 

o The case where multiple spurious operations could result from fireinduced circuit failures affecting multiple conductors within the same 

multi-conductor cable. 

o The case where multiple spurious operations can result from fire-induced 

failures to multiple cables within the same fire area and where the change 

of state caused for each component by the fire –induced circuit failure is 

not reversed, e.g. seal-in or latching effects, once the fire-induced circuit 

failure is terminated, e.g. goes to ground. Evaluating this condition is 

consistent with the original concept employed in the deterministic analysis 

of not defining a design basis fire, but rather assuming that any circuits 

contained within the fire area could be impacted by the effects of a fire in 

that fire area. To arbitrarily assume than that all potential spurious 

operation within a fire area will occur, however, ignores the fire mitigating 

aspects of other aspects of the defense-in-depth Fire Protection Program. 

By allowing the use of fire modeling for assessing potential impacts to 

circuits for components important to safe shutdown, credit for the other 

aspects of the defense-in-depth Fire Protection Program can be provided, 

as appropriate. 

o The set of concurrent combinations of spurious operations provided 

through the MSO Process outlined in Section 4, using the list of MSO 

contained in Appendix G. 

• Finally, given the less than predictable response of any given conductor in any 

cable to the damaging effects of the fire, it seems overly conservative and 

unnecessary to assume that, universally, all conductors within all cables will 

simultaneously experience the fire-induced effects necessary to results in an 

unlimited set of concurrent combinations of spurious operations. The results of 

the Industry and NRC cable fire testing does not support such a conclusion. 

Based on this, it is reasonable and necessary to limit the number and types of fireinduced circuit failures. Consideration of multiple simultaneous fire-induced 

circuit failures is not required for the following cases: 
NEI 00-01, Revision 2 

May 2009 

B-7 

o The case where the fire-induced circuit failure must occur in separate 

cables and where the effect of the fire-induced circuit failure on the 

component is eliminated, e.g. non-seal-in or non-latching effects, once the 

fire-induced circuit failure is eliminated, e.g. goes to ground. Attempting 

to identify all of the combinations of circuit failures with the potential to 

result in a single spurious operation is an unbounded criterion. 

Additionally, it will lead to one of the following conditions in numerous 

situations: 

 Situations where circuit designs necessary for other safety 

requirements will need to be modified to preclude extremely 

unlikely fire-induced impacts, or 

 Situations where the operator will be forced to provide an event 

based response to a postulated fire condition that is in conflict with 

the symptom based response for which the operator is trained. 

o Consideration of key aspects of MSOs should be factored in when 

evaluating the need to combine individual MSOs into larger MSOs, such 

as the overall number of spurious operations in the combined MSOs, the 

circuit attributes in Appendix B, and other physical attributes of the 

scenarios. 

 Specifically, if the combined MSOs involve more than a total of 

four components or if the MSO scenario requires consideration of 

sequentially selected cable faults of a prescribed type, at a 

prescribed time, in a prescribed sequence in order for the 

postulated MSO combination to occur, then this is considered to be 

beyond the required design basis for MSOs. 

In this appendix, the cable fire test results are examined to justify the changes 

recommended to the current deterministic criteria historically used for post-fire SSA 

circuit failures to assure that the affects of MSOs on post-fire safe shutdown are 

adequately addressed. 

B.3 CIRCUIT FAILURES CONSIDERED IN DETERMINISTIC ANALYSIS 

B.3.1 Overview of Analysis 

A typical deterministic Appendix R analysis, as described in this document, includes the 

following steps: 

• Identifying Required Safe Shutdown Systems 

• Identifying Required Safe Shutdown Equipment 

• Identifying Required Safe Shutdown Cables 

• Identifying Physical Plant Locations for each 

• Assuring “One” Safe Shutdown Path with the capability to achieve and maintain 

safe shutdown in the event of a single plant fire is available for each fire area. 
NEI 00-01, Revision 2 

May 2009 

B-8 

In assuring the availability of a single safe shutdown path in each fire area, the following 

conservatisms typically apply: 

• Fire areas represent large areas of the plant and damage throughout the fire area is 

assumed. 

• All unprotected equipment and cables within the fire area are assumed to be 

damaged by the fire. 

• All unexamined equipment and cables are not credited for mitigating the effects 

of fires. 

• Equipment damage is assumed unless the damage, were it to be postulated, 

provided a benefit to achieving or maintaining safe shutdown. 

In assessing the impact to post-fire safe shutdown in each fire area, the guidance in NEI 

00-01 does the following: 

• It provides a methodology for identifying equipment and cables of concern for 

Appendix R Safe Shutdown. 

• It provides a means of mitigating every equipment impact and any impacts to the 

selected combinations of equipment impacts, MSOs, identified in Appendix G. 

• It represents an approach that can be consistently applied by licensees throughout 

the entire industry. 

B.3.2 Description of Circuits and Circuit Failure Characteristics 

The types of circuit failures considered in the guidance provided in this document are as 

follows: 

• Open Circuit 

• Short-to-Ground 

• Hot Short 

• High Impedance Fault (NEI CFITF has recommended that consideration of 

MHIFs in the post-fire safe shutdown analysis be eliminated. Refer to Appendix 

B.1) 

The types of circuits that can be affected by the circuit failure types described above are 

as follows: 

• Power circuits that provide motive power to components once a control circuit 

properly aligns the component to its bus. 

• Primary control circuits that provide operating signals to specific components. 

• Secondary logic circuits that provide input through auxiliary contacts to primary 

control circuits based on instrumentation feedback from plant instruments. 

• Control power to primary control and secondary logic circuits that provide the 

control power necessary for the primary control power and secondary logic 

circuits to function. 
NEI 00-01, Revision 2 

May 2009 

B-9 

• Instrument circuits that provide either indication to operators or input to primary 

control or logic circuits. 

For a circuit designed to energize to function, an open circuit will result in a loss of 

function for the circuit type. For a circuit designed to de-energize to function, an open 

circuit will result in the fulfillment of the function. 

Similarly, a short-to-ground in any of the circuit types described above has the potential 

to result in a loss of function for the circuit and it has the additional potential to result in 

loss of power to components powered from electric sources upstream from the affected 

circuit. 

Hot shorts have the potential to energize circuits from a source different than the power 

source designed for that purpose or from the circuit’s power source for a failure that 

bypasses a device such as a control switch. These latter types of failures can occur even 

within the same cable. As a result, hot shorts have the potential to spuriously start/stop or 

open/close components. Depending on the affected component and its function within 

the shutdown scheme, this starting/stopping or opening/closing could pose a potential 

impact to post-fire safe shutdown. A hot short can cause a circuit to actuate that is 

designed for that purpose. For example, fire damage can cause conductors running to a 

control switch to short together replicating the action of circuit control switch. Solenoids 

valves controlling the opening or closing of valves, for example, also have the potential 

to experience an undesired change of state as a result of an open circuit or short-toground. 

Typically, any of the circuit failure types described above, should they be experienced by 

a component on the required safe shutdown path in a given fire area, will require 

mitigation. A component on the required safe shutdown path in a given fire area must be 

able to perform its required safe shutdown function. Since a hot short, a short-to-ground 

or an open circuit needs to be postulated for any conductor in any affected safe shutdown 

cable in the fire area and since a short-to-ground or an open circuit will result in a loss of 

function, little analysis is required to conclude that such a potential cable impact is a 

concern that needs to be addressed. 

Conversely, for components that are not specifically required to function in support of 

post-fire safe shutdown in a particular fire area, but whose malfunction can result in an 

impact to the systems and components that must function in support of post-fire safe 

shutdown, the hot short is the primary circuit failure of concern. This is true because hot 

shorts have the potential to cause equipment to change state to an undesired position that 

can result in conditions such as, flow diversions from reactor vessel make-up or decay 

heat removal systems being used in support of post-fire safe shutdown. 

This appendix provides criteria for addressing each of the fire-induced circuit failures 

described above in each of the circuit types described above based on the traditional 

approach used for post-fire safe shutdown circuit analysis adjusted, as appropriate, by the 

results of the NRC and Industry cable fire testing. The criteria provided in this appendix 

apply to the evaluation of MSOs and to the circuit failures for other aspects of post-fire 

safe shutdown contained in Section 3. 
NEI 00-01, Revision 2 

May 2009 

B-10 

B.4 INSIGHTS FROM CABLE FIRE TESTS 

B.4.1 NEI/EPRI Cable Testing 

The conclusions of the NEI/EPRI Cable Fire Testing are documented in Section 14.4 of 

EPRI Report 1003326, Characterization of Fire-Induced Circuit Failures. Pertinent Key 

Observations and Conclusions from the EPRI Report are provided below: 

• Given cable damage, single spurious operations are credible and multiple spurious 

operations cannot be ruled out. External cable hot shorts are also credible, but 

have a significantly lower probability of occurrence than do internal hot shorts. 

An important outcome of the tests is that no external cable hot shorts produced a 

spurious operation in thermoset cable. 

• Given that a hot short occurs in a multi-conductor cable, it is highly probable 

(over 80%) that multiple target conductor cables will be affected (i.e. multiple 

simultaneous dependent hot shorts). 

• The proximity of conductors to each other is the predominant influence factor in 

determining fault mode. “Opportunity” must exist for two conductors to short 

together. 

• No open circuit faults occurred during the Test Program. Open circuits do not 

appear to be a credible primary cable failure mode for fire-induced cable faults. 

• Statistical characterization of fire-induced cable failures is achievable. General 

trends are predictable and primary influence factors are understood. However, 

probability estimates still carry a relatively high uncertainty. 

• Definitive predictions of fire-induced circuit failure outcomes are not viable. The 

specific behavior and characteristics of any one fault cannot be predicted with full 

certainty. Failure mode is a function of localized conditions and subtle aspects of 

geometry and configuration. A full understanding of the fault dynamics and 

interdependencies is beyond the current state of knowledge. 

• The dominant influence factors for the likelihood of spurious operations are: cable 

type; power supply characteristics; tray fill; conductor connection pattern, circuit 

design (grounded versus ungrounded). 

• Cables do not fail immediately. The average time to failure exceeded 30 minutes 

for thermoset and armored cables and 15 minutes for thermoplastic cables. These 

statistics are meaningful and important in real world application of test results. 

The time frames show that early action in a fire is highly likely to be effective at 

accomplishing the desired function. Preplanned high value actions have a high 

probability of success and should reduce both likelihood and consequences of 

serious fires. Similarly, early pre-emptive action for high risk spurious operation 

components will significantly reduce the risk posed by these components. [Note: 

This result from the NEI cable fire test program is predicated upon a 350 kw fire 

source located at a specified distance from the cables. Larger fires at closer 

distances could provide significantly shorter cable failure times.] 
NEI 00-01, Revision 2 

May 2009 

B-11 

• Spurious operations are a transient and finite event; ultimately circuit conditions 

will degrade to a point that a ground fault de-energizes the source conductor. 

Postulating that spurious operations will last indefinitely in the absence of 

intervening action appears to be unrealistic. Probability calculations for 

thermoset cable indicate that over 96% of all spurious operations will terminate 

within 10 minutes. This probability estimate carries an uncertainty of 

approximately 7% at the 95% confidence level. [Note: This testing was 

performed on AC Circuits. Testing on DC Circuits could provide different 

results. Hot short termination times could be longer.] 

The following insights can be gained from a review of the key observations and 

conclusions from the NEI/EPRI cable testing relative to various aspects of the criteria in 

NEI 00-01 Revision 1 and how this criteria needs to be altered in Revision 2 for 

application in the post-fire SSA: 

1.) Addressing Cable Faults one-at-a-time vs. all together at the same time: 

The results of the Expert Opinion Elicitation conclude that the effects of hot 

shorts leading to spurious operations cannot be ignored. This conclusion is also 

echoed in the EPRI Report providing the testing results. The EPRI Report 

providing the results of the cable testing, however, also concludes that the 

predominant factor in determining cable fault mode is proximity. “Opportunity” 

must exist for two conductors to short together. 

To address the regulatory concern related to multiple spurious operations, 

however, consideration of simultaneous fire-induced impacts to selected cables 

and components is warranted. Appendix G to NEI 00-01 provides a list of the 

MSOs that should be considered in a post-fire SSA. This appendix provides the 

circuit failure criteria that should be applied to the components comprising these 

MSOs. By applying the criteria in this appendix to the MSOs in Appendix G, the 

issues of simultaneous multiple hot shorts simultaneously affecting multiple 

components in the potentially high risk scenarios developed by the BWROG and 

PWROG are addressed. 

2.) Addressing Cable Faults for all conductors in each safe shutdown cable: 

The EPRI/NEI Testing provided information suggesting that the approach to postfire safe shutdown outlined in NEI 00-01 Revision 1 is generally conservative. 

First of all, no cases involving open circuits were identified. The approach 

outlined in NEI 00-01 Revision 1 required that open circuits be postulated for 

each conductor in each safe shutdown cable on the required safe shutdown path in 

the fire area. Secondly, in the testing hot shorting in cables in conduit was 

deemed to be unlikely. The approach outlined in NEI 00-01 Revision 1 required 

the postulation of a hot short on each conductor in each safe shutdown cable 

regardless of the raceway type. Finally, in the testing inter-cable hot short were 

found to be highly unlikely. The approach outlined in NEI 00-01 Revision 1 

required the postulation of inter-cable hot shorts. 
NEI 00-01, Revision 2 

May 2009 

B-12 

The EPRI/NEI Testing has shown that the approach outlined in NEI 00-01 

Revision 1 to fire-induced circuit failures is generally conservative. Based on the 

results of the cable fire testing, however, consideration of simultaneous fireinduced impacts to selected cables and components may be warranted. Appendix 

G to NEI 00-01 provides a list of the MSOs that should be considered in a postfire SSA. 

3.) Duration and timing of the hot short causing a spurious operation: 

Based on the testing, multi-conductor cables are more likely to experience 

conductor-to-conductor shorts than conductor-to-ground shorts. By postulating a 

hot short on each conductor in each safe shutdown cable, the approach outlined in 

NEI 00-01 Revision 1 addressed this. Based on the testing, when these intracable conductor-to-conductor shorts occur, however, they take a finite amount of 

time to occur and they last for a finite amount of time. This aspect of the testing 

renders the criterion in the approach outlined in NEI 00-01 Revision 1 requiring 

the assumption of a hot short lasting until an action is taken to isolate the fault to 

be conservative. This aspect of the testing also validates the assumption made by 

some licensees that time is available to take an action to mitigate the effect of a 

potential spurious operation. 

• The EPRI/NEI Testing has shown that the approach outlined in NEI 00-01 

Revision 1 to fire-induced circuit failures is generally conservative. [Note: The 

NEI cable fire test program is predicated upon a 350 kw fire source located at a 

specified distance from the cables. Larger fires at closer distances could provide 

significantly shorter cable failure times. Additionally, this testing was performed 

on AC Circuits. Testing on DC Circuits could provide different results. Hot short 

termination times could be longer.] 

4.) Affect of Testing on Prior Beliefs about other aspects of Fire-Induced Circuits 

Failures 

The combined opinion of a number of the Expert Panel Members concluded that 

best estimate for the overall likelihood of a spurious operation for a thermoset 

cable (i.e. cable type used most predominantly in the industry) lies somewhere 

between 0.0001 [Brady Williamson] and 0.15 [Section 7.5.2, Technical 

Summary]. This is consistent with previously published information suggesting 

that the probability of a hot short/spurious operation was 0.068. 

The testing confirmed that the degradation threshold temperature for 

thermoplastic cable was approximately 400o

F and for thermoset cable was 

approximately 700o

F. This is consistent with the previous test results, particularly 

the oven aging tests conducted at SNL years ago. 

To a large extent, the EPRI/NEI Cable Testing has confirmed much of the 

collective wisdom available prior to the testing. 
NEI 00-01, Revision 2 

May 2009 

B-13 

B.4.2 CAROLFIRE Cable Testing 

The conclusions of the CAROLFIRE Cable Fire Testing are documented in Section 9 of 

Volume 1 of the CAROLFIRE Test Results. Pertinent Key Observations and 

Conclusions from the CAROLFIRE Report are provided below: 

• The following is Bin 2 Item A as quoted directly from the RIS:.

"Intercable shorting for thermoset cables, since the failure mode is 

considered to be substantially less likely than intracable shorting." 

Based on the available data with respect to Bin 2 Item A the CAROLFIRE 

project has reached the following conclusions: 

Inter-cable shorting between two TS-insulated cables that could cause hot 

shorts and the spurious operation of plant equipment was found to be a 

plausible failure mode, although the likelihood of this failure mode is low in 

comparison to intra-cable short circuits leading to spurious operation. While 

no detailed statistical analysis has been performed, it appears that the 

conditional probability (give cable failure) of spurious operations arising 

from this specific failure mode is small in comparison to that previously 

estimated for spurious operations from intra-cable shorting. 

• The following is Bin 2 Item B as quoted directly from the RIS: 

"Intercable shorting between thermoplastic and thermoset cables, since this 

failure mode is considered less likely than intracable shorting of either cable 

type or intercable shorting of thermoplastic cables." 

Based on the available data with respect to Bin 2 Item B the CAROLFIRE 

project has reached the following conclusions: 

Inter-cable shorting between two a TP-insulated cable and a TS-insulated cable 

that could cause hot shorts and the spurious operation of plant equipment was 

found to be a plausible failure mode, although the likelihood of this failure 

mode is low in comparison to intra-cable short circuits leading to spurious 

operation. While no detailed statistical analysis has been performed, it appears 

that the conditional probability (give cable failure) of spurious operations 

arising from this specific failure mode is very small in comparison to that 

previously estimated for spurious operations from intra-cable shorting. 

• The following is Bin 2 Item C as quoted directly from the RIS: 
NEI 00-01, Revision 2 

May 2009 

B-14 

"Configurations requiring failures of three or more cables, since the failure 

time and duration of three or more cables require more research to determine 

the number of failures that should be assumed to be "likely”. 

Given the available data relevant to Bin 2 Item C, the CAROLFIRE project 

has reached the following conclusions: 

The currently available data provide no basis for establishing an a -priori limit 

to the number of spurious operations that might occur during a given fire. We 

further find that the timing of spurious operation is a strong function of various 

case-specific factors including in particular the relative location of various 

cables relative to the fire source, the routing configuration (e.g., open cable 

trays or air drops versus conduits), the thermal robustness of the cables 

insulation material, and the characteristics of the fire source. 

• The following is Bin 2 Item D as quoted directly from the RIS: 

"Multiple spurious operations in control circuits with properly sized control 

power transformers (CPTs) on the source conductors, since CPTs in a circuit 

can substantially reduce the likelihood of spurious operation. Specifically, 

where multiple (i.e., two or more) concurrent spurious operations due to 

control cable damage are postulated, and it can be verified that the power to 

each impacted control circuit is supplied via a CPT with a power capacity of no 

more than 150 percent of the power required to supply the control circuit in its 

normal mode of operation (e.g., required to power one actuating device and any 

circuit monitoring or indication features)." 

Given the available data relevant to Bin 2 Item D, .the CAROLFIRE project 

has reached the following conclusions: 

The currently available data provide no basis for establishing an a -priori limit 

to the number of spurious operations that might occur during a given fire even 

given that the circuit is powered by a "properly sized" CPT. We further find 

that, as with non-CPT cases, the timing of spurious operations is dependent on 

the timing of cable electrical failure which is in turn a strong function of 

various case-specific factors including the relative location of different cables 

relative to the fire source, the routing configuration (e.g., open cable trays or 

air drops versus conduits), the thermal robustness of the cables insulation 

material, and the characteristics of the fire source. 

• The following is Bin 2 Item E as quoted directly from the RIS: 

"Fire-induced hot shorts that must last more than 20 minutes to impair the 

ability of the plant to achieve hot shutdown, since recent testing strongly 

suggests that fire-induced hot shorts will likely self-mitigate (e.g., short to 

ground) in less than 20 minutes. This is of particular importance for devices 
NEI 00-01, Revision 2 

May 2009 

B-15 

such as air-operated valves (AOVs) or power-operated relief valves (PORVs) 

which return to their de-energize position upon abatement of the fire-induced 

hot short."

Given the available data relevant to Bin 2 Item E, the CAROLFIRE project 

has reached the following conclusions: 

While the available data cannot definitively support the conclusion that no hot 

short would ever persist for greater than 20 minutes, the available data do 

provide a strong basis for concluding that hot shorts lasting greater than 20 

minutes are of at most very low probability. Hence we conclude that with 

high probability, hot short-induced spurious operation signals will clear 

within less than 20 minutes. We further conclude that on clearing of the hot 

short signal, the effects of the spurious operation on plant equipment could 

persist for a longer time depending on the nature of the impacted equipment. 

For example, a normally closed Motor Operated Valve might well remain open 

or partially open even after the hot short-induced spurious operation signal is 

mitigated whereas a Solenoid Operated Valve would return to its fail safe 

condition on mitigation of the hot short-initiated spurious operation signal.

[Note: Some of the Penlight series tests exhibited longer durations than those 

exhibited during the Intermediate scale tests. Based on this, consideration 

should be given to the potential for hot short durations in hot gas layers being 

longer.] 

The following insights can be gained from a review of the key observations and 

conclusions from the CAROLFIRE cable testing relative to various aspects of the criteria 

currently applied in a post-fire SSA: 

1.) Addressing Cable Faults one-at-a-time vs. all together at the same time: 

The results of the CAROLFIRE testing conclude that the probability of an intercable hot short, either thermoset to thermoset, thermoset to thermoplastic or 

thermoplastic to thermoplastic, is small to very small in comparison to that 

previously estimated for intra-cable hot shorts. Additionally, the CAROLFIRE 

testing provided no basis for establishing a limit on the number of spurious 

operations that might occur. The testing, however, did conclude that the one of 

the major factors in determining the potential for a hot short and/or spurious 

operation is the relative location of the cables to the fire source. This conclusion 

is almost identical with the NEI/EPRI testing that concluded that the predominant 

factor in determining cable fault mode is proximity. “Opportunity” must exist for 

two conductors to short together. 

To address the regulatory concern related to multiple spurious operations, 

consideration of simultaneous fire-induced impacts to selected cables and 

components may be warranted. Appendix G to NEI 00-01 provides a list of the 

MSOs that should be considered in a post-fire SSA. This appendix provides the 

circuit failure criteria that should be applied to the components comprising these 
NEI 00-01, Revision 2 

May 2009 

B-16 

MSOs. By applying the criteria in this appendix to the MSOs in Appendix G, the 

issues of simultaneous multiple hot shorts simultaneously affecting multiple 

components in the potentially high risk scenarios developed by the BWROG and 

PWROG are addressed. 

2.) Addressing Cable Faults for all conductors in each safe shutdown cable: 

The CAROLFIRE testing provided information suggesting that the approach 

outlined in NEI 00-01 Revision 1 to post-fire safe shutdown is conservative. In 

the testing, inter-cable hot shorting between cables was deemed to be far more 

unlikely than intra-cable hot shorting. The approach outlined in NEI 00-01 

Revision 1 required the postulation of a hot short on each conductor in each safe 

shutdown cable regardless of the cable type. The approach outlined in NEI 00-01 

Revision 1 required the postulation of inter-cable hot shorts. 

The CAROLFIRE testing has shown that the approach outlined in NEI 00-01 

Revision 1 to fire-induced circuit failures is generally conservative. Based on the 

results of the cable fire testing, however, consideration of simultaneous fireinduced impacts to selected cables and components may be warranted. Appendix 

G to NEI 00-01 provides a list of the MSOs that should be considered in a postfire SSA. 

3.) Duration of the hot short causing a spurious operation: 

The CAROLFIRE Intermediate scale testing supported the conclusion that hot 

shorts will not last longer than 20 minutes. Therefore, the criterion in the 

approach outlined in NEI 00-01 Revision 1 requiring the assumption of a hot 

short lasting until an action is taken to isolate the fault is conservative. 

The CAROLFIRE testing has shown that the approach outlined in NEI 00-01 

Revision 1 to fire-induced circuit failures is generally conservative relative to the 

duration of spurious operations. [Note: This testing was performed on AC 

Circuits. Testing on DC Circuits could provide different results. Hot short 

termination times could be longer.] 

4.) Affect of Testing on Prior Beliefs about other aspects of Fire-Induced Circuits 

Failures 

The CAROLFIRE testing provided a qualitative conclusion that the probability of 

an inter-cable hot short is “small to very small” in comparison to probabilities 

previously determined for intra-cable hot shorts. The authors of the CAROLFIRE 

testing provided no quantitative explanation of the term “small to very small”. 

The CAROLFIRE Testing also provided no indication that all cables in a given 

temperature environment will behave similarly. The potential for cable damage 

and conductor to conductor hot shorting to occur is a function on many variables. 

Although elevated temperatures are a prerequisite to having cable failures and hot 
NEI 00-01, Revision 2 

May 2009 

B-17 

shorts, cable failures and hot short are random occurrences that cannot be 

explicitly predicted solely by the analysis of a single variable such as temperature 

in the vicinity of the cable. 

To a large extent, the CAROLFIRE testing has confirmed the collective wisdom 

available prior to the testing related to inter-cable hot shorts. 

B.4.3 Overall Implications from the Cable Fire Testing 

Industry & NRC Cable Fire Testing conducted to date has: 

• Demonstrated that many aspects of the criteria provided in NEI 00-01 Revision 1 

are generally conservative. The exception to this is the treatment of multiconductor cables with the potential to cause multiple simultaneous spurious 

operations. 

Based on the results of the cable fire testing, however, consideration of 

simultaneous fire-induced impacts to selected cables and components may be 

warranted. Appendix G to NEI 00-01 provides a list of the MSOs that should be 

considered in a post-fire SSA. 

• Provided clear evidence that not all cables in the same fire will fail and that not all 

cables that do fail will fail in a predictable manner. This provides evidence for 

not requiring the types of changes to the post-fire safe shutdown fire-induced 

circuit failure criteria proposed by the NRC in draft Generic letter 2006-XX. 

• Provided clear information that hot shorts resulting in spurious component 

operations can occur. MSOs are also possible, but the concern should be limited 

to multi-conductor cables with the potential to cause MSOs or individual cables 

for separate components in an MSO where the effects of the fire-induced circuit 

failure are seal-in or latched. 

Based on the results of the cable fire testing, however, consideration of 

simultaneous fire-induced impacts to selected cables and components may be 

warranted. Appendix G to NEI 00-01 provides a list of the MSOs that should be 

considered in a post-fire SSA. 

• Provided valuable information suggesting that the occurrence of fire-induced hot 

shorts are affected by many variables. 

• Provided valuable information that the occurrence of fire-induced hot shorts are 

real and they can occur given the right combination of factors, the most important 

of which is elevated temperatures in the vicinity of the cable. The occurrence of a 

specific hot short for a specific cable in a specific location, however, is a random 

event, not predictable by studying a single variable such as air temperature in the 

vicinity of a cable. 
NEI 00-01, Revision 2 

May 2009 

B-18 

• Provided valuable information that the occurrence of fire-induced hot shorts that 

are not in close proximity to each other are unlikely to occur in a manner that 

supports the conditions required for MSOs without the prior intervention by other 

aspects of the Fire Protection Defense-in-Depth Program. 

Based on the results of the cable fire testing, however, consideration of MSOs for 

selected cables and components may be warranted. Appendix G to NEI 00-01 

provides a list of the MSOs that should be considered in a post-fire SSA. 

• Provided valuable information regarding the types of fire-induced circuit failures 

that are most likely to occur given damage to the cable. 

• Provided valuable information regarding the failure temperature of cables, the 

time to failure at that temperature, the length of time that a fire-induced hot short 

will be sustained and the fact that the hot shorts are, generally, followed by a 

short-to-ground. [Note: This testing was performed on AC Circuits. Testing on 

DC Circuits could provide different results. Hot short termination times could be 

longer.] 

• Provided valuable information suggesting that a number of aspects of the fireinduced circuit failure approach outlined NEI 00-01 Revision 1 in the 

deterministic post-fire SSA are conservative. With some adjustments to the 

criteria from NEI 00-01 Revision 1 reasonable assurance of the ability to achieve 

and maintain post-fire safe shutdown in the event of a plant fire will be attained. 

B.5 CONCLUSIONS RELATIVE TO CIRCUIT FAIULRES & MSOs 

The results of the NEI/EPRI and CAROLFIRE Testing did demonstrate that the previous 

approach to addressing fire-induced circuit failures on an “any-and-all taken one-at-atime” basis is not likely to capture all of the fire-induced effects on post-fire safe 

shutdown systems. Multiple hot shorts can occur as a result of the same single fire. 

Additionally, multiple components can be impacted by the effects of fire-induced circuit 

failures resulting from the same single fire. This conclusion requires that changes from 

the previously applied approach to addressing circuit failures on an “any-and-all taken 

one-at-a-time” basis needs to be adjusted. 

When adjusting the criteria, however, it is important to recognize that any criteria applied 

to the evaluation of fire-induced circuit failures must be understandable so that it can be 

applied and inspected. Additionally, it must balance consideration for plant design 

features necessary for plant operations and accident mitigation with fire safe designs. 

The information in Table B.1-0 describes the types of fire-induced circuit failures that 

need to be considered in evaluating fire-induced impacts to safe shutdown components, 

regardless of whether they are classified as required for hot shutdown or important to safe 

shutdown. The information in Table B.2-0 provides information on how each of the fire-
NEI 00-01, Revision 2 

May 2009 

B-19 

induced circuit failures described in Table B.1-0 needs to be considered in evaluating the 

impact of fire-induced circuit failures on a component’s control and power circuitry. The 

information in Table B.1-0, when combined with the information in Table B.2-0, 

provides an acceptable method for assessing the response of an individual component to 

any fire-induced circuit failure. The information in Appendix G, MSOs, provides the 

criteria for combining the fire-induced impacts to individual components into potential 

system and safe shutdown path impacts. The component level fire-induced circuit failure 

criteria from this appendix, when combined with the information from Appendix G, 

MSOs, provides the criteria to assess the overall impact of the affect of a fire on an MSO 

in a given fire area. 

The following changes are recommended based on a review of these recent cable fire 

testing results. The recommended changes listed below represent the changes that are 

considered to be appropriate to provide reasonable assurance that the circuit failure 

analysis performed will provide a design that is safe and that assures the ability to 

achieve and maintain post-fire safe shutdown. These changes are to be applied to 

Spurious Operations, single or multiple. For completeness, the pertinent criteria from 

Section 3 of this document are summarized below. 

Circuit Failure Criteria: The criteria provided below addresses the effects of multiple 

fire-induced circuit failures impacting circuits for components classified as either 

“required for hot shutdown” or “important to safe shutdown”. Consider the following 

circuit failure types on each conductor of each unprotected cable. Criteria differences, 

however, do apply depending on whether the component is classified as required for hot 

shutdown or important to safe shutdown. 

• A hot short may result from a fire-induced insulation breakdown between 

conductors of the same cable, a different cable or from some other 

external source resulting in a compatible but undesired impressed voltage 

or signal on a specific conductor. A hot short may cause a spurious 

operation of safe shutdown equipment. 

o A hot short in the control circuitry for an MOV can bypass the 

MOV protective devices, i.e. torque and limit switches. This is the 

condition described in NRC Information Notice 92-18. In this 

condition, the potential exists to damage the MOV motor and/or 

valve. Damage to the MOV could result in an inability to operate 

the MOV either remotely, using separate controls with separate 

control power, or manually using the MOV hand wheel. This 

condition could be a concern in two instances: (1) For fires 

requiring Control Room evacuation and remote operation from the 

Remote Shutdown Panel, the Auxiliary Control Panel or Auxiliary 

Shutdown Panel; (2) For fires where the selected means of 

addressing the effects of fire induced damage is the use of an 

operator manual action. In each case, analysis must be performed 

to demonstrate that the MOV can be subsequently operated 

electrically or manually, as required by the safe shutdown analysis. 
NEI 00-01, Revision 2 

May 2009 

B-20 

• An open circuit may result from a fire-induced break in a conductor 

resulting in the loss of circuit continuity. An open circuit may prevent the 

ability to control or power the affected equipment. An open circuit may 

also result in a change of state for normally energized equipment. (e.g. 

[for BWRs] loss of power to the Main Steam Isolation Valve (MSIV) 

solenoid valves due to an open circuit will result in the closure of the 

MSIVs). [Note: Open circuits as a result of conductor melting have not 

occurred in any of the recent cable fire testing and they are not considered 

to be a viable form of cable failure.] 

• A short-to-ground may result from a fire-induced breakdown of a cable 

insulation system, resulting in the potential on the conductor being applied 

to ground potential. A short-to-ground may have all of the same effects as 

an open circuit and, in addition, a short-to-ground may also cause an 

impact to the control circuit or power train of which it is a part. A shortto-ground may also result in a change of state for normally energized 

equipment. 

Circuits for “required for hot shutdown” components: Because Appendix 

R Section III.G.1 requires that the hot shutdown capability remain "free of fire 

damage", there is no limit on the number of concurrent/simultaneous fireinduced circuit failures that must be considered for circuits for components 

“required for hot shutdown: located within the same fire area. For 

components classified as “required for hot shutdown”, there is no limit on the 

duration of the hot short. It must be assumed to exist until an action is taken 

to mitigate its effects. Circuits required for the operation of or that can cause 

the mal-operation of “required for hot shutdown” components that are 

impacted by a fire are considered to render the component unavailable for 

performing its hot shutdown function unless these circuits are properly 

protected as described in the next sentence. The required circuits for any 

“required for hot shutdown” component, if located within the same fire area 

where they are credited for achieving hot shutdown, must be protected in 

accordance with one of the requirements of Appendix R Section III.G.2 or 

plant specific license conditions. 

Circuits for “important to safe shutdown” components: Circuits for 

components classified as “important to safe shutdown” are not specifically 

governed by the requirements of Appendix R Section III.G.1, III.G.2 or 

III.G.3. To address fire-induced impacts on these circuits, consider the three 

types of circuit failures identified above to occur individually on each 

conductor with the potential to impact any “important to safe shutdown” 

component with the potential to impact components “required for hot 

shutdown”. In addition, consider the following additional circuit failure 

criteria for circuits for “important to safe shutdown” components located 

within the same fire area with the potential to impact components “required 

for hot shutdown”: 
NEI 00-01, Revision 2 

May 2009 

B-21 

• As explained in Figure 3.5.2-3, multiple shorts-to-ground are to be 

evaluated for their impact on ungrounded circuits. 

• As explained in Figure 3.5.2-5, for ungrounded DC circuits, a single hot 

short from the same source is assumed to occur unless it can be 

demonstrated that the occurrence of a same source short is not possible in 

the affected fire area. If this approach is used, a means to configuration 

control this condition must be developed and maintained. 

• For the double DC break solenoid circuit design discussed in the NRC 

Memo from Gary Holahan, Deputy Director Division of Systems 

Technology, dated December 4, 1990 and filed under ML062300013, the 

effect of two hot shorts of the proper polarity in the same multi-conductor 

cable should be analyzed for non-high low pressure interface components. 

[Reference Figure B.3.3 (f) of NFPA 805-2001.] 

• Multiple spurious operations resulting from a fire-induced circuit failure 

affecting a single conductor must be included in the post-fire safe 

shutdown analysis. 

• Multiple fire-induced circuit failures affecting multiple conductors within 

the same multi-conductor cable with the potential to cause a spurious 

operation of an “important to safe shutdown” component must be assumed 

to exist concurrently. 

• Multiple fire-induced circuit failures affecting separate conductors in 

separate cables with the potential to cause a spurious operation of an 

“important to safe shutdown” component must be assumed to exist 

concurrently when the effect of the fire-induced circuit failure is sealed-in 

or latched. 

• Conversely, multiple fire-induced circuit failures affecting separate 

conductors in separate cables with the potential to cause a spurious 

operation of an “important to safe shutdown” component need not be 

assumed to exist concurrently when the effect of the fire-induced circuit 

failure is not sealed-in or latched. This criterion applies to consideration 

of concurrent hot shorts in secondary circuits and to their effect on a 

components primary control circuit. It is not to be applied to concurrent 

single hot shorts in primary control circuit for separate components in an 

MSO combination. 

 For components classified as “important to safe shutdown”, the duration 

of a hot short may be limited to 20 minutes. (If the effect of the spurious 

actuation involves a "sealing in" or "latching" mechanism, that is 

addressed separately from the duration of the spurious actuation, as 

discussed above.) 
NEI 00-01, Revision 2 

May 2009 

B-22 

• For any impacted circuits for “important to safe shutdown” components 

that are located within the same fire area, protection in accordance with 

the requirements of Appendix R Section III.G.2 or plant specific license 

conditions may be used. In addition, consideration may be given to the 

use of fire modeling or operator manual actions, as an alternative to the 

requirements of Appendix R Section III.G.2. (Other resolution options 

may also be acceptable, if accepted by the Authority Having Jurisdiction.) 

Spurious Operation Criteria: The following criteria address the effect of multiple 

spurious operations of components classified as either “required for hot shutdown” or 

“important to safe shutdown” on post-fire safe shutdown. These criteria are to be applied 

to the population of components whose spurious operation has been determined to be 

possible based on an application of the circuit failure criteria described above when 

assessing impacts to post-fire safe shutdown capability in any fire area. 

• The set of concurrent combinations of spurious operations provided 

through the MSO Process outlined in Section 4 and the list of MSO 

contained in Appendix G must be included in the analysis of MSOs. 

• MSOs do not need to be combined, except as explained in Section 4.4.3.4 

of this document. 

• Section 4.4.3.4 states that the expert panel should review the plant 

specific list of MSOs to determine whether any of the individual 

MSOs should be combined due to the combined MSO resulting in a 

condition significantly worse than either MSO individually. 

• In this review, consideration of key aspects of the MSOs should be 

factored in, such as the overall number of spurious operations in the 

combined MSOs, the circuit attributes in Appendix B, and other 

physical attributes of the scenarios. 

• Specifically, if the combined MSOs involve more than a total of 

four components or if the MSO scenario requires consideration of 

sequentially selected cable faults of a prescribed type, at a 

prescribed time, in a prescribed sequence in order for the 

postulated MSO combination to occur, then this is considered to be 

beyond the required design basis for MSOs. 
Table B.1-0

Types of Fire-induced Circuit Failures Required to be Cons

B-23 

DiscussionThe criteria provided below describes the types of fire-induced circuit failures that need to be considered in an evaluation of the impact of the componcriteria on how each of the fire-induced circuit failures described below needs to be considered in evaluating the impact of fire-induced circuit failures o

criteria provided below, when combined with the information in Table B.2-0, provides a comprehensive method for assessing the response of an individuin Appendix G, MSOs, provides the criteria for combining the impacts to individual components in an MSO into potential system and safe shutdown pcombined with the information from Appendix G, MSOs, provides the criteria to assess the overall fire-induced impact of an MSO on post-fire safe shutd

The evaluation provided below begins with NEI 00-01 Revision 1. Using the insights gained from the NRC and Industry Cable Fire Testing, the table 

adjusted for inclusion into Revision 2 of NEI 00-01. The adjustments made to the fire-induced circuit failure criteria and the assumptions regarding the 

of the NRC and Industry Cable Fire Testing and are summarized in this appendix and in Section 3.5.1. 

Cable Failure Type NEI 00-01 Revision 1 NRC & Industry Test Results NEI 00-01 Revision 2 

Power Cables MHIF Recommended elimination of need to 

address 

No indication that these can occur in the combinations required to present a concern 

Not Required to be included in a postfire SSA. 

3 phase hot shorts Need to assess for Hi/Lo Pressure 

Interfaces 

No indication that these can occur in the combinations required to present a concern 

Need to assess for Hi/Lo Pressure Interface Valves only, due to the regulatory precedent for this issue. 

Proper polarity DC motor hot shorts 

Need to assess for Hi/Lo Pressure Interfaces 

No indication that these can occur in the combinations required to present a concern 

Need to assess for Hi/Lo Pressure Interface Valves only, due to the regulatory precedent for this issue. 

Open Circuit Need to assess for all safe shutdown 

components 

No indication that these can occur, as a primary circuit failure 

Need to assess for all safe shutdown components, due to the regulatory precedent for this issue. 

Short-to-ground Need to assess for all safe shutdown 

components. Need to assess for Associated Circuits – Common Power Supply. 

Will occur as a primary circuit failure or as a sequel to a hot short of limited duration 

Need to assess for all safe shutdown components. Need to assess for Associated Circuits – Common PoweSupply. 

Control Cables Open Circuit Need to assess for all safe shutdown 

components 

No indication that these can occur, as a primary circuit failure 

Need to assess for all safe shutdown components 

Short-to-ground Need to assess for all safe shutdown 

components 

Will occur as a primary circuit failure or as a sequel to a hot short of limited 

Need to assess for all safe shutdown components. 
NEI 00-01, Revision 

May 2009 

B-24 

Cable Failure Type NEI 00-01 Revision 1 NRC & Industry Test Results NEI 00-01 Revision 2 

duration 

Hot short22 - generic 

without consideration of cable and/or raceway characteristics 

Need to assess for all safe shutdown components. In all cases, assumes the hot short potential exists unless proven otherwise. 

The potential for a hot short is determined not only by presence in the fire area of concern, but also based on a time/temperature and duration thresholds for each occurrence. 

Need to assess for all safe shutdown components. Additionally, for importo safe shutdown components, the duration of the hot short may be limitto 20 minutes. After 20 minutes the hshort may be assumed to go to groundAt this point, the effects of a short-toground must be evaluated and address

Inter-cable hot short - thermoset 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Very limited potential of occurrence. Probability is very low compared to intracable hot shorts. 

Need to assess for all safe shutdown components 

Inter-cable hot short – thermoplastic 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Very limited potential of occurrence. Probability is very low compared to intracable hot shorts. 

Need to assess for all safe shutdown components. 

Intra-cable hot short - thermoset 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Potential to occur, if cable is damaged, but actual likelihood of occurrence is a function of many variables such that a given time/temperature environment does not necessarily guarantee occurrence. 

Need to assess for all safe shutdown components. 

Intra-cable hot short – thermoplastic 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Potential to occur, if cable is damaged, but actual likelihood of occurrence is a function of many variables such that a given time/temperature environment does not necessarily guarantee occurrence. 

Need to assess for all safe shutdown components. 

Inter-cable hot short – armored cable 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

No occurrences identified. Not required to be addressed. 

Intra-cable hot short – armored cable 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Potential to occur, if cable is damaged. An AC grounded circuit will not likely experience a spurious operation, but an AC ungrounded circuit has the same potential for spurious operation as any thermoset cable. 

Need to assess for all safe shutdown components. 

22 Hot shorts need to be addressed either generically or they can be addressed based on the characteristics of the cable type or cable/raceway type using th

a way that it takes credit for the cable and/or raceway type associated with the cable, then the important characteristics of the assessment must be includso that as future plant changes are made with the potential to affect these important characteristics of the cable and/or raceway, the important characterithey be changed. 
Table B.1-0

Types of Fire-induced Circuit Failures Required to be Cons

B-25 

Cable Failure Type NEI 00-01 Revision 1 NRC & Industry Test Results NEI 00-01 Revision 2 

Inter-cable hot short – raceway to raceway 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Not required Not required 

Intra-cable hot short - conduit 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Potential to occur, if cable is damaged, but actual likelihood of occurrence is a function of many variables such that a given time/temperature environment does not necessarily guarantee occurrence. 

Need to assess for all safe shutdown components. 

Inter-cable hot short 

– thermoset to thermoplastic 

Need to assess for all safe shutdown components. Not specifically addressed, but included under the overall criteria for addressing a hot short. 

Very limited potential of occurrence. Probability is very low compared to intracable hot shorts. 

Need to assess for all safe shutdown components. 

Instrument Cables Open Circuit Need to assess for all safe shutdown 

components. 

Not specifically tested. Need to assess for all safe shutdown 

components. 

Short-to-ground Need to assess for all safe shutdown 

components. 

Not specifically tested. Need to assess for all safe shutdown 

components. 

Hot short Need to assess for all safe shutdown 

components. 

Not specifically tested. Need to assess for all safe shutdown 

components. 
NEI 00-01, Revision 2 

May 2009 

Cable Type Impact of a Single Fire-induced Circuit 

Failure of this type 

Effect of Multiple/Simultaneous 

Circuit Failures 

Required Number for this Typ

Circuit23

Power Circuits [either ac or dc – discussions below are for ac power circuits. Similar discussions apply to dc, except that only two hot shorts Hot Short No impact from a single hot short on a 3 

phase cables 

Spurious Operation of a single component with 3 hot shorts of the proper polarity on a 3 phase cable 

There is no need to consider a hot shpower circuits, except for hi/lo pressinterface valves where 3 hot shorts oproper polarity must be assumed. 

Short-to-ground Loss of power and potential for tripping of 

upstream loads 

No additional impacts from multiple/simultaneous shorts-toground 

Consider a single short-to-ground on conductor in each affected cable. Neaddress Associated Circuits – CommPower Supply. 

Open Circuit Loss of power No additional impacts from 

multiple/simultaneous open circuits 

Consider a single open circuit on eacconductor in each affected cable. 

Primary Control Circuit [either ac or dc – discussions below are for ac power circuits. Similar discussions apply to dc] Hot Short Spurious operation of the component Spurious operation of the component 

from different conductors and/or cables in the primary or a secondary circuit. In almost all cases, however, for this to occur input from a hot short in a secondary control circuit is required. (See comment to the right.) 

Consider an individual, single hot sheach conductor in each affected cablcircuit. Consider the combined effechot shorts if conductors are located in same multi-conductor cable in the prcircuit. For cases involving direct current (Dcontrol circuits, consider the potentiaspurious operation due to failures of control cables (even if the spurious operation requires two concurrent hoof the proper polarity, e.g., plus-to-pminus-to-minus), when the source antarget conductors are each located in same multi-conductor cable.” [Ref. R2004-03 Rev. 1] 

Short-to-ground Loss of control power/function in 

grounded circuits 

For ungrounded circuits an additional concurrent shorts-to-ground may be required in order to cause a loss of control power. 

Consider an individual, single short-ground on each conductor in each afcable in a grounded circuit. Considecombined effects of shorts-to-ground conductors are located in the same mconductor cable in the primary circuiAdditionally, either assume a second to-ground exists in an ungrounded ciresulting in a loss of control power oevaluate for an actual fire-induced caimpact with the potential to cause the 

23 The criteria for hot shorts in this column may be adjusted using the information from Table B.1-0 for the hot short sub-types. If the information on 

must be included in the design configuration control program. This is required to be done so that as future plant changes are made with the potential 

important characteristics are either maintained or a re-review of the condition is performed should they be changed.

B-26 
Cable Type Impact of a Single Fire-induced Circuit 

Failure of this type 

Effect of Multiple/Simultaneous 

Circuit Failures 

Required Number for this Typ

Circuit23

second short-to-ground in the fire are

Open Circuit Loss of a single control function, e.g. loss 

of manual start/stop, loss of autostart/stop, loss of indication 

Loss of multiple functions within the control circuit, e.g. loss of manual 

start/stop, loss of auto-start/stop, loss of indication 

Consider an individual, single open con each conductor in each affected cthe circuit. Consider the combined eof open circuits if conductors are locthe same multi-conductor cable in thprimary circuit. 

Secondary Control Circuits, including instrument signals to primary and secondary control circuits [either ac or dc – discussions below are foHot Short Spurious operation of a primary 

component provided the contact that is closed has this direct effect on the primary circuit. 

Spurious operation of a primary component provided the contacts that are closed have this direct effect on the primary circuit. 

Consider an individual, single hot sheach conductor in each affected cablcircuit. Consider the combined effechot shorts if conductors are located in same multi-conductor cable in the secondary circuit. (Refer to Exampleand 2 attached to this appendix. In Example 1 only a hot short on Cable needs to be considered. In Example addition to the hot short on Cable 6, shorts on the two conductors in Cablneed to be considered. All other cabfailure combinations need not be consince these other combinations requimultiple hot shorts to co-exist in sepcables in the primary and/or secondacircuits.) This example holds true foconditions where the relaying in the secondary circuit, once energized, doseal-in in the primary circuit. If the aof the hot short is not removed once short goes to ground, then the affect hot shorts must be considered to exisconcurrently, if cables for both are in same fire area. . 

Short-to-ground Loss of control power/function in 

grounded circuits 

For ungrounded circuits an additional concurrent shorts-to-ground may be required in order to cause a loss of control power. 

Consider an individual, single short-ground on each conductor in each afcable in a grounded circuit. Considecombined effects of shorts-to-ground conductors are located in the same mconductor cable in the secondary circAdditionally, either assume a second to-ground exists in an ungrounded ci

B-27 
NEI 00-01, Revision 2 

May 2009 

B-28 

Cable Type Impact of a Single Fire-induced Circuit 

Failure of this type 

Effect of Multiple/Simultaneous 

Circuit Failures 

Required Number for this Typ

Circuit23

resulting in a loss of control power oevaluate for an actual fire-induced caimpact with the potential to cause the second short-to-ground in the fire are

Open Circuit Loss of control function No additional impacts from 

multiple/simultaneous open circuits. 

Consider an individual, single open con each conductor in each affected cthe circuit. 

Control Power to Primary and Secondary Control Circuits [either ac or dc – discussions below are for ac power circuits. Similar discussions Hot Short No impact on the circuit No impact on the circuit There is no need to consider hot shor

control power to primary or secondarcontrol circuits. 

Short-to-ground Loss of control power/function with the 

potential for tripping of upstream loads 

No additional impacts from multiple/simultaneous shorts-toground 

Consider a single short-to-ground on conductor in each affected cable. Assingle short-to-ground in an ungrouncircuit results in a loss of control pow

Open Circuit Loss of control function No additional impacts from 

multiple/simultaneous open circuits. 

Consider a single open circuit on eacconductor in each affected cable. 

Instrument Circuits Hot Short Erroneous reading No additional impact due to multiple 

hot shorts. 

Consider an individual, single hot sheach conductor in each affected cablcircuit. For instruments performing a control function, assume the signal affects threspective contact in the control circuworst case manner for safe shutdown

Short-to-ground Loss of reading or control function No additional impacts from 

multiple/simultaneous shorts-toground 

Consider an individual, single short-ground on each conductor in each afcable in a grounded circuit. 

Open Circuit Loss of reading or control function No additional impacts from 

multiple/simultaneous open circuits. 

Consider an individual, single open con each conductor in each affected cthe circuit. 
NEI 00-01, Revision 2 

May 2009 

B-29 

Hot Short location

Rx Pressure - Cable 1

Low Reactor Level - Cable 2

Hi Drywell Pressure

- Cable 7

Cable 3

Cable 4

Cable 5

Cable 6

Cable 8

Contact A

Contact B

Contact E

Contact D

Contact C

Relay K1 Relay K2 Relay K3

Example 1 - Multiple Hot Shorts

Secondary Circuit Primary Circuit Secondary Circuit
NEI 00-01, Revision 2 

May 2009 

B-30 

1. A hot short on Cable 6. 

2. A hot short on Cable 4 in combination with a hot short on Cable 3. 

3. A hot short on Cable 4 in combination with a hot short on Cables 1 & 2. 

4. A hot short on Cable 5 in combination with a hot short on Cable 3. 

5. A hot short on Cable 5 in combination with a hot short on Cables 1 & 2. 

6. A hot short on Cable 7 in combination with a hot short on Cable 3. 

7. A hot short on Cable 7 in combination with a hot short on Cables 1 & 2. 

8. A hot short on Cable 8 in combination with a hot short on Cable 3. 

9. A hot short on Cable 8 in combination with a hot short on Cables 1 & 2. 

Example 1 - Spurious Operation - Hot

Short Combinations

1.) Required for hot shutdown components - need to consider all combinations with thge potential to affect the ability of the

component to perform its safe shutdown function

2.) Important to safe shutdown components - must consider any combination that involves an input from the secondar y circuit

that either seals-in or latches a relay in the primary circuit.
NEI 00-01, Revision 2 

May 2009 

B-31 

Hot Short location

Rx Pressure - Cable 1

Low Reactor Level - Cable 2

Hi Drywell Pressure

- Cable 7

Cable 3

Conductor 1 Cable 4

Cable 5

Cable 6

Cable 3

Conductor 2

Contact A

Contact B

Contact E

Contact D

Contact C

Relay K1 Relay K2 Relay K3

Example 2 - Multiple Hot Shorts

Secondary Circuit Primary Circuit Secondary Circuit
NEI 00-01, Revision 2 

May 2009 

B-32 

1. A hot short on Cable 6. 

8. A hot short on Cable 3 – Conductor 1 in combination with a hot short 

on Cable 3 – Conductor 2. 

2. A hot short on Cable 4 in combination with a hot short on Cable 3 – 

Conductor 1. 

3. A hot short on Cable 4 in combination with a hot short on Cables 1 & 2. 

4. A hot short on Cable 5 in combination with a hot short on Cable 3 – 

Conductor 1. 

5. A hot short on Cable 5 in combination with a hot short on Cables 1 & 2. 

6. A hot short on Cable 7 in combination with a hot short on Cable 3 – 

Conductor 1. 

7. A hot short on Cable 7 in combination with a hot short on Cables 1 & 2. 

9. A hot short on Cable 3 – Conductor 2 in combination with a hot short on 

Cables 1 & 2. 

Example 2 - Spurious Operation - Hot

Short Combinations

1.) Required for hot shutdown components - need to consider all combinations with thge potential to affect the ability of the

component to perform its safe shutdown function

2.) Important to safe shutdown components - must consider any combination that involves an input from the secondar y circuit

that either seals-in or latches a relay in the primary circuit.
NEI 00-01, Revision 2 

May 2009 

B.1-1 

APPENDIX B.1

JUSTIFICATION FOR THE ELIMINATION OF MULTIPLE HIGH IMPEDANCE 

FAULTS 

B.1-1 PURPOSE 

This appendix is provided to demonstrate that the probability of Multiple High 

Impedance Faults (MHIFs) is sufficiently low such that they do not pose a credible risk to 

post-fire safe shutdown when certain criteria are met. 

This appendix analyzes and characterizes cable fault behavior with respect to the MHIF 

concern to determine if and under what conditions this circuit failure mode poses a 

credible risk to post-fire safe shutdown. In this capacity, the MHIF analysis is intended 

to serve as a generic analysis for a Base Case set of conditions. The base case approach 

is recognized as a viable means of establishing specific boundary conditions for 

applicability, thereby preserving the integrity of the analysis. 

B.1-2 INTRODUCTION 

B.1-2.1 Overview 

In 1986 the NRC issued Generic Letter 86-10 [1] to provide further guidance and 

clarification for a broad range of 10 CFR 50 Appendix R issues. Included in the generic 

letter was confirmation that the NRC expected utilities to address MHIFs as part of the 

Appendix R associated circuits analysis.24 MHIFs are a unique type of common power 

supply associated circuit issue, as discussed in Section B.1-2.2 below. 

Regulatory Guide 1.189 (Section 5.5.2) [2] reiterates the NRC’s position that MHIFs 

should be considered in the evaluation of common power supply associated circuits. Of 

importance is the regulatory guide’s endorsement of IEEE Standard 242, IEEE 

Recommended Practices for Protection and Coordination of Industrial and Commercial 

Power Systems, [7] as an acceptable means of achieving electrical coordination of circuit 

protective devices. Confirmation of adequate electrical coordination for safe shutdown 

power supplies is the primary means of addressing common power supply associated 

circuits. 

B.1-2.2 Defining the MHIF Concern 

The MHIF circuit failure mode is an offshoot of the common power supply associated 

circuit concern. A common power supply associated circuit is considered to pose a risk 

 24 A general discussion of associated circuits is contained in Section 2.2 and 3.3.2 of this guidance 

document. NRC intends that a future generic communication will clarify associated circuits. 
NEI 00-01, Revision 2 

May 2009 

B.1-2 

 

to safe shutdown if a fire-induced fault on a non-safe shutdown circuit can cause the loss 

of a safe shutdown power supply due to inadequate electrical coordination between 

upstream and downstream overcurrent protective devices (e.g., relays, circuit breakers, 

fuses). 

The accepted method for evaluating the potential impact of common power supply 

associated circuits is a Coordination Study. A coordination study involves a review of 

the tripping characteristics for the protective devices associated with the electrical power 

distribution equipment of concern – post-fire safe shutdown power supplies in this case. 

The devices are considered to “coordinate” if the downstream (feeder or branch circuit) 

device trips before the upstream (supply circuit) device over the range of credible fault 

current.25 In conducting a traditional coordination study, each circuit fault is evaluated as 

a single event. 

The concept of MHIFs deviates from baseline assumptions associated with conventional 

electrical coordination. The MHIF failure mode is based on the presumption that a fire 

can cause short circuits that produce abnormally high currents that are below the trip 

point of the individual overcurrent interrupting devices for the affected circuits. Faults of 

this type are defined by Generic Letter 86-10 as high impedance faults (HIFs). Under the 

assumed conditions, circuit overcurrent protective devices will not detect and interrupt 

the abnormal current flow. Consequently, the fault current is assumed to persist for an 

indefinite period of time. Since HIFs are not rapidly cleared by protective devices, the 

NRC position is that simultaneous HIFs should be considered in the analysis of 

associated circuits. The specific concern is that the cumulative fault current resulting 

from multiple simultaneous HIFs can exceed the trip point of a safe shutdown power 

supply incoming protective device, causing it to actuate and de-energize the safe 

shutdown power supply before the downstream (load-side) protective devices clear 

individual circuit faults. 

Figure B.1-1 illustrates the MHIF failure mode. Note that the description of MHIFs 

assumes that redundant safe shutdown equipment is affected by the postulated fire. 

Detailed reviews can be conducted to determine exactly which cables and scenarios are 

potentially susceptible to MHIFs. However, this type of “spatial” analysis typically 

involves a highly labor-intensive effort to trace the routing of hundreds of non-safe 

shutdown cables. Furthermore, ongoing configuration control of such analyses is overly 

burdensome. For this reason, the preferred means of addressing the issue is at a system 

performance level, independent of cable routing. The systems approach offers a great 

deal of conservatism because, in actuality, not all circuits will be routed through every 

fire area and not all circuits are non-safe shutdown circuits. 

25 The range of credible fault current includes short circuit current levels up to the maximum possible fault current 

for the configuration. For simplicity, the maximum credible fault current is usually based on a bolted fault at the 

downstream device. However, in some cases the maximum credible fault current is refined further by accounting 

for additional resistance of the cable between the downstream device and the fault location of concern. 
NEI 00-01, Revision 2 

May 2009 

B.1-3 

Figure B.1-1 

Example MHIF Sequence

Non-Safe Shutdown Equipment

Safe Shutdown

Equipment

A-1 A-2

Safe Shutdown

Power Supply

Safe Shutdown

Equipment

B-1 B-2

Safe Shutdown

Power Supply

Fire Area A Fire Area B 3-Hour Barrier

1

2 3 4567

Safe shutdown components A-1 and B-1 are redundant, as are A-2 and B-2. A fire in Fire Area B is 

assumed to render B-1 and B-2 inoperable, and thus A-1 and A-2 are credited as available for safe 

shutdown. Circuit Breakers 4 – 7 supply non-safe shutdown equipment via circuits that traverse Fire 

Area B. The fire is assumed to create high impedance faults on several of these circuits 

simultaneously. The nature of the faults is such that an abnormal current is produced in each circuit, 

but in each case the current is not sufficient to cause the affected branch feeder breaker to trip. The 

cumulative effect of the fault current flowing in each branch causes the incoming supply breaker 

(Circuit Breaker 1) to trip before the downstream breakers are able to isolate the individual faults. The 

safe shutdown power supply is de-energized, causing a loss of power to the credited safe shutdown 

equipment, A-1 and A-2. 

B.1-2.3 Framework for Resolution 

From inception, debate has persisted regarding the technical validity of MHIFs. The 

NRC’s concern with MHIFs can be traced to a November 30, 1984, NRC internal 

correspondence [3]. The stated purpose of the correspondence was to “...present one 

paper which can be used in the evaluation of safe shutdown submittals.” The paper 

describes the MHIF issue as an “...expansion on associated circuits” and describes the 

concern in much the same manner as covered in Section B.1-2.2 above. Noteworthy is 
NEI 00-01, Revision 2 

May 2009 

B.1-4 

 

that the document limits the issue to AC power circuits. The NRC’s concern with MHIFs 

on AC power circuits does not appear to stem from any specific test data or operating 

experience. Rather, the concern is voiced as one of conservative judgment for a 

postulated failure mode in the absence of definitive information to the contrary. 

With this understanding as a starting point, the framework for addressing the MHIF issue 

is based on the following tenets: 

 A Base Case set of conditions must be defined to ensure the limits of 

applicability are bounded. Within the defined limits, the MHIF analysis serves as 

a generic evaluation and is considered to satisfy the regulatory requirement that 

high impedance faults be considered in the analysis of associated circuits. 

 To ensure consistency and agreement in the fundamental bases for analysis, 

technical positions should be based on and referenced to test results, industry 

consensus standards, and NRC generated or approved documents. Test data and 

technical references must be representative of the Base Case. 

 Elements of the analysis may be probabilistically-based and employ riskinformed arguments. This approach is deemed acceptable within the framework 

of a deterministic analysis and is not without precedent.26 However, consistent 

with risk-informed decision making, consequence of failure shall be addressed by 

the analysis. 

 Analysis uncertainty must be included in the evaluation to ensure conservative 

application of results. 

B.1-3 ANALYSIS METHOD AND APPROACH 

The approach for conducting this analysis is depicted by the flow chart of Figure B.1-2. 

A brief description of each step is provided. The most important aspect of this analysis is 

the ability to characterize fire-induced cable faults. Research and test data to accomplish 

this characterization for all voltage levels of interest has until recently been scant, forcing 

past assessments of MHIFs (both industry and NRC assessments) to make assumptions 

and extrapolate theories beyond a point that achieved general agreement. Test data from 

recent industry and NRC fire testing [3, 12] allows fault behavior to be characterized at a 

level not previously possible. Interpretation of test data and application of analysis 

results will follow accepted and prudent engineering principles, as set forth by consensus 

standards and other acknowledged industry references. 

26 Generic Letter 86-10, Question 5.3.1 excludes on the basis of low probability the need to consider 

three-phase hot shorts and proper polarity hot shorts for ungrounded DC circuits in the analysis of 

spurious actuations (except for high/low pressure interfaces). 
NEI 00-01, Revision 2 

May 2009 

B.1-5 

Figure B.1-2 

MHIF Analysis Flow Chart 

Establish Analysis 

Criteria and Principles

Define Base Case

Characterize

Fire-Induced Cable Faults

Analyze

MHIF Concern

Step 1 – Establish Analysis Criteria and Principles: Analysis criteria and relevant 

engineering principles are identified. The rationale behind the analysis criteria is 

explained and the engineering principles relied upon to evaluate results are documented. 

Step 2 – Define Base Case: A base case set of conditions is defined. These conditions 

establish the limits of applicability for the analysis. 

Step 3 – Characterize Fire-Induced Cable Faults: Relevant fire test data and 

engineering research are analyzed to characterize fire-induced cable faults. Recent 

industry and NRC fire tests, as well as other credible industry tests and research studies, 

are considered in the evaluation. 

Step 4 – Analyze MHIF Concern: The characteristic behavior of fire-induced faults is 

considered within the context of the MHIF concern to determine if and under what 

conditions MHIFs pose a credible risk to post-fire safe shutdown for the defined Base

Case conditions. Analysis uncertainty is included in the evaluation. 
NEI 00-01, Revision 2 

May 2009 

B.1-6 

B.1-4 ANALYSIS CRITERIA AND PRINCIPLES 

The criteria and engineering principles that form the basis of this analysis are discussed 

below. 

1. The legitimacy of the MHIF concern is centered on the premise that a fire can create 

HIFs that are not readily detected and cleared by the intended overcurrent protective 

device [1, 4]. Thus, characterizing the expected behavior of fire-induced faults is 

paramount in determining the potential risk posed by this failure mode. If fires are 

able to initiate faults that “hang up” and produce low-level fault currents (near or just 

below the trip device setting) for extended periods, MHIFs should be considered a 

viable failure mode. If, however, the faults do not exhibit this behavior, but instead 

reliably produce detectable fault current flow, a properly designed electrical 

protection scheme can be relied upon to clear the fault in a timely manner in 

accordance with its design intent. Based on this principle, the primary line of inquiry 

for this analysis is to quantitatively characterize fault behavior for the voltage classes 

of interest. Analysis uncertainty will be included in the assessment to further quantify 

the results. 

2. MHIFs are not usually considered in the design and analysis of electrical protection 

systems, primarily because operating experience has not shown them to be a practical 

concern [6, 7, 10]. For this reason, industry has not established nor endorsed any 

particular analytical approach for MHIFs. Acknowledging the lack of consensus 

industry standards and conventions, this analysis relies on objective evidence and the 

application of recognized engineering principles; however, some element of 

engineering judgment is inevitable because of the unconventional nature of the 

analysis. 

3. As constrained by the Base Case requirements, this analysis is considered sufficiently 

representative of nuclear plant electrical power system and protective device design, 

construction, and operation: 

 Regardless of make, model, or vintage, electrical protective devices conforming 

to the Approval, application, and test/maintenance requirements specified for the 

Base Case can be expected to function in the manner credited by this analysis [5, 

7, 9]. 

 Electrical power systems satisfying the design and performance 

requirements specified for the Base Case will respond to electrical faults 

in the manner assumed by this analysis [6, 7, 10]. 

4. This analysis assumes that electrical protection and coordination have been achieved 

following the guidance of ANSI/IEEE 242, or other acceptable criteria. Regulatory 

Guide 1.189 recognizes this ANSI standard as the primary reference for this subject. 

A more detailed investigation into supporting references listed by the standard reveals 

a substantial number of tests and research studies that have applicability to this MHIF 

analysis [13 – 22]. These documents provide additional insight into the expected 

behavior of high resistance electrical faults and accordingly are considered by this 
NEI 00-01, Revision 2 

May 2009 

B.1-7 

analysis. As these documents have essentially shaped the engineering basis for the 

ANSI/IEEE 242 recommended practices, they are considered viable and credible 

source references for this analysis. 

5. The test data obtained from the recent industry and NRC tests [3, 7] is considered 

directly applicable to nuclear plant installations. The test parameters (including test 

specimens, circuit configuration, and physical arrangement) were specifically tailored 

to mimic a typical nuclear plant installation. The overall test plan was scrutinized by 

utility and NRC experts before implementation. 

6. The actual impedance of a fault can vary widely and depends on many factors. These 

factors include such things as fault geometry, system characteristics, environmental 

conditions, and the circumstances causing the fault. Different fault impedances 

produce different levels of fault current; hence, electrical coordination studies 

generally consider a range of credible fault currents [7]. Circuit faults resulting from 

fire damage are highly dynamic, but do exhibit a predictable and repeatable pattern 

that can be characterized and explained by engineering principles and an 

understanding of material properties. The same general characteristics have been 

observed by several different tests and studies [3, 12, 13 – 22]. 

7. The primary test data relied upon for this MHIF analysis is the recent nuclear industry 

and NRC fire tests [3, 12]. The electrical circuits for these tests were 120 V, singlephase, limited-energy systems. The analytical results for the 120 V data indicate 

these low energy circuits behave differently than high-energy circuits operating at 

distribution level voltages. The bases for this position are: 

 The ability of electrical system hardware to sustain and withstand local 

fault conditions decreases as the fault energy increases. Highly energetic 

faults on systems operating above 208 V release tremendous amounts of 

energy at the fault location. These faults are explosive in nature and will 

destroy equipment in a matter of seconds, as confirmed by recent industry 

experience. Conversely, fault energy associated with 120 V, single-phase 

systems is considerably less punishing to the equipment and will not 

necessarily cause immediate wide-spread damage. 

 Test results from the recent industry and NRC fire tests confirm a correlation 

between the rate of localized insulation breakdown and the available energy 

(applied voltage gradient and available fault current). For example, once 

insulation degradation began, the rate of breakdown for instrument cable was 

notably slower than the rate observed for cables powered by 120 V laboratory 

power supplies. The lower energy circuits are less able to precipitate the 

cascading failure of insulation that characteristically occurs during the final 

stages of insulation breakdown because the rate of energy transfer to the fault is 

lower. The final cascading failure of a 480 V power circuit can be expected to 

occur within milliseconds, where the final stage of insulation failure for a 120 V 

circuit might last several seconds, as demonstrated by the test results. Note that 

the final cascading failure is typically preceded by a period of much slower 

insulation degradation. During this phase of degradation, the cable can be 
NEI 00-01, Revision 2 

May 2009 

B.1-8 

 

expected to exhibit higher levels of leakage current; however, the leakage 

current levels are not sufficiently high to affect proper operation of power and 

control circuits. The point at which the slow, low-level degradation transitions 

to rapid breakdown and failure is termed the transition phase. (Cable failure 

characteristics are discussed in detail in Section B.1-6.1.) 

 Arcing faults become increasingly more likely as system voltage increases 

because of the higher voltage gradient and longer creepage distances.27 The 

“effective” current for arcing faults increases as a function of the applied 

voltage. A higher fault current will hasten the time for protective action. (The 

arcing fault phenomena are discussed in detail in Section B.1-6.2.) 

8. High impedance faults on conductors of power systems operating at 480 V and above 

manifest themselves as arcing faults [13 – 22]. Thus, the analysis of postulated HIFs 

for these systems assumes an arcing fault (detailed discussion contained in Section 

B.1-6.1). The bases for this position are: 

 With respect to cables, distances between energized conductors and between 

energized conductors and grounded surfaces are not appreciably different from 120 V 

systems. Thus, as insulation integrity is lost, the high voltage gradient associated 

with these systems more readily strikes an arc in the absence of a sufficient air gap. 

 As discussed in Item 7 above, the highly energetic nature of faults on higher voltage 

power systems results in a significant release of energy at the fault location, which 

rapidly elevates localized temperatures to vaporization levels. This large release of 

energy at the fault manifests itself in one of three ways: 

• Metal components are fused, thereby creating a bolted fault. 

• Material is vaporized and forcibly ejected, blowing the fault open 

• Material is vaporized and ejected, but the conductive vapor cloud allows 

an arcing fault to develop, which may or may not be sustained 

 The electrical power industry conducted numerous studies and tests pertaining to 

faults on high energy electrical power systems in the 1960s and 1970s. These efforts 

were sparked by a rash of significant property losses and extensive outages resulting 

from highly damaging electrical faults. These studies significantly increased our 

understanding of high energy faults and resulted in numerous changes to 

recommended electrical protection practices (primarily IEEE 242). High impedance, 

non-arcing faults were not observed by these studies. 

B.1-5 BASE CASE AND APPLICABILITY 

The intent of defining a Base Case is to establish set limits for application of the analysis 

results. This approach places measurable bounds on the analysis and ensures results are 

not inadvertently applied to conditions not considered in the study. 

27 Creepage distance is defined as the shortest distance between two conducting parts measured along 

the surface of the insulating material. 
NEI 00-01, Revision 2 

May 2009 

B.1-9 

 

The following requirements constitute the Base Case conditions inherent in this analysis: 

 The power supply in question must operate at a nominal AC or DC voltage greater 

than 110 V. Specifically, this analysis does not apply to AC and DC control power 

systems operating at 12 V, 24 V, or 48 V. Nor is the analysis applicable to instrument 

loops regardless of operating voltage. 

 For the power supply in question, electrical coordination must exist between the 

supply-side overcurrent protective device(s) and load-side overcurrent protective 

devices of concern28. Achievement of proper selective tripping shall be based on the 

guidance of IEEE 242, or other acceptable criteria. 

 For 120 V AC and 125 V DC power supplies, in addition to adequate electrical 

coordination, a minimum size ratio of 2:1 shall exist between the supply-side 

protective device(s) and load-side devices of concern (for example, a distribution 

panel with a 50 A main circuit breaker cannot have any load-side breakers larger than 

25 A). This stipulation adds additional margin to account for slower protective 

device clearing times of low-energy circuits. 

 The electrical system must be capable of supplying the necessary fault current for 

sufficient time to ensure predictable operation of the overcurrent protective devices in 

accordance with their time-current characteristics. 

 Each overcurrent protective device credited for interrupting fault current shall: 

• Be applied within its ratings, including voltage, continuous current, and 

interrupting capacity 

• Be Listed or Approved by a nationally recognized test laboratory (e.g., UL, 

ETL, CSA, etc.) to the applicable product safety standard (fuses, molded 

case circuit breakers, circuit protectors, GFI devices) or be designed and 

constructed in accordance with applicable ANSI and NEMA standards 

(protective relays, low and medium voltage switchgear) 

 Proper operation of the overcurrent devices shall be ensured by appropriate testing, 

inspection, maintenance, and configuration control. 

The electrical system associated with the power supply in question shall conform to a 

recognized grounding scheme. Recognized schemes include solidly grounded, high 

impedance or resistance grounded, or ungrounded. 

28 Coordination is not required for circuits that are inherently not a common power supply associated 

circuit of concern – for example, a circuit that is entirely contained within the same fire area as the 

power supply itself. Similarly, coordination is only required up to the maximum credible fault 

current for the configuration, which might include an accounting of cable resistance between the loadside protective device and the fault location of concern. 
NEI 00-01, Revision 2 

May 2009 

B.1-10 

B.1-6 CHARACTERIZATION OF FAULTS 

B.1-6.1 Characterization of Fire-Induced Cable Faults for 120V Systems 

This section contains an analysis of fault behavior for fire-induced faults on single-phase, 

120 V systems. The primary source data for the analysis is recent industry and NRC fires 

tests conducted specifically to characterize fire-induced cable faults. 

B.1-6.1.1 EPRI/NEI Fire Test Results 

The EPRI/NEI fire tests are documented in EPRI Report 1003326, Characterization of 

Fire-Induced Circuit Failures: Results of Cable Fire Testing [12]. The functional 

circuits developed for this testing were heavily monitored, allowing significant insights 

into the nature and behavior of fire-induced cable faults. 

B.1-6.1.1.1 Cable Failure Sequence 

When driven to failure, cables followed a predictable and repeatable sequence. Initial 

degradation was first observed as a relatively slow reduction in insulation resistance 

down to approximately 10 kΩ – 1,000 Ω. At these levels the circuits remained fully 

functional and produced leakage current in the milliamp range. The next phase of 

degradation has been termed the transition phase. In the transition phase, the fault 

undergoes a cascade effect and the rate of insulation resistance (IR) degradation increases 

significantly, causing fault resistance to drop rapidly. The circuit remains functional, but 

leakage current ramps upward quickly. The fault resistance associated with this phase is 

approximately 5 kΩ down to 600 Ω. Note that at 600 Ω the leakage current is only about 

0.2 A, and the circuit is still functioning. The transition phase lasts from seconds to 

minutes. The final phase involves full failure of the cable. Insulation resistance drops to 

a very low level and leakage current now becomes fault current. The fault current 

escalates above the fuse rating, causing the fuse to open and de-energize the circuit. This 

final phase typically occurs within seconds or 10s of seconds for low-energy 120 V 

circuits. Figures B.1-3 and B.1-4 show current and fault resistance for a typical set of 

cables driven to failure. 
NEI 00-01, Revision 2 

May 2009 

B.1-11 

Cable Failure Characteristics (Test #8)

0.000

0.001

0.010

0.100

1.000

10.000

100.000

0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0

Time (Minutes)

Fault Current (Amps)

DA #1 M

DA #1 S2

DA #1 S1

DA #2 M

DA #2 S1

DA #3 M

Fuse did not clear

Figure B.1-3 

Fault Current for Fire-Induced Cable Failure 
NEI 00-01, Revision 2 

May 2009 

B.1-12 

Figure B.1-4 

Fault Resistance for Fire-Induced Cable Failure 

Cable Failure Characterisitcs (Test #8)

1

10

100

1000

10000

100000

1000000

0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0

Time (Minutes)

Fault Resistance (Ohms)

DA #1 M

DA #1 S2

DA #1 S1

DA #2 M

DA #2 S1

DA #3 M

The observed results can be explained by an understanding of the localized phenomena at 

the fault location. As the insulation degrades leakage current increases. At some point, 

the leakage current measurably contributes to localized heating, accelerating the rate of 

insulation degradation. As current increases, the rate of degradation increases until it 

finally cascades to a full fault. Important in this observation is that the power source 

must be able to supply sufficient energy to drive the cascading effect to completion. Test 

circuits with limited current capacity demonstrated the same basic failure sequence; 

however, the final phase typically took longer and did not produce predicable final fault 

resistances. This behavior can be seen in the NRC/SNL data in which the test circuit was 

limited to 1.0 A. This observation leads to the Base Case condition that the power supply 

must be able to produce sufficient fault current to ensure the protective devices operate 

predictable. 

A key observation of the failure characteristics is that once the insulation resistance 

enters the transition phase it does not “hang up” at an intermediate point; it cascades to 

full failure within seconds or 10s of seconds. From the data it appears that once leakage 

current exceeds about 0.2 A, the fault can be expected to cascade to levels that trigger 

protective action. 
NEI 00-01, Revision 2 

May 2009 

B.1-13 

In a few cases this process was dynamic. The fault cascaded and produced a high fault 

current momentarily (a few seconds), but quickly subsided back to low levels. This cycle 

generally repeated itself two or three times before fault current ramped and remained 

high. Importantly, in no cases did fault current stabilize for an extended period at an 

intermediate level such that it was not detected and cleared by the fuse. 

B.1-6.1.1.2 Fault Clearing Times 

The fire test data was analyzed to establish a correlation between fault current level and 

the time required to clear the circuit fuse. The results of this tabulation are presented in 

Table B.1-1. The data here deals only with cases in which a fault caused the fuse to 

clear. Data for thermoset and thermoplastic cable are shown separately because the 

different insulation material exhibited slightly different characteristics. 

The table provides statistics for the amount of time it took to clear the fuse once current 

had reached a certain threshold level. The clearing times are shown for three thresholds: 

0.25 A, 1.0 A, and 2.0 A. The 0.25 A level was selected because it represents the 

approximate lower bound of the transition phase. 2.0 A was selected because it 

represents a current flow well below a value considered to pose a HIF concern for the 

established circuit. 1.0 A is an intermediate point that provides additional understanding. 

The table is interpreted as follows: For thermoset cable, once fault current reached a 

level of 0.25 A, it took on average 0.46 minutes for the fuse to clear; once fault current 

reached 1.0 A it took on average 0.23 minutes to clear the fuse; and so on. 

Table B.1-1 

Fault Clearing Time 

Time to Clear Fault (min) 

Current Threshold 0.25 A 1.0 A 2.0 A 

Thermoset Cable 

Population 75 75 75 

Average 0.46 0.23 0.14 

Range 0.1 to 4.8 0.1 to 2.1 0.1 to 0.7 

Std Dev 0.67 0.29 0.13 

2 Std Dev 1.33 0.59 0.26 

Thermoplastic Cable 

Population 39 39 39 

Average 0.12 0.10 0.10 

Range 0.1 to 0.3 0.1 0.1 

Std Dev 0.07 0.00 0.00 

2 Std Dev 0.14 0.00 0.00 
NEI 00-01, Revision 2 

May 2009 

B.1-14 

The statistics presented in the table lend themselves to the following observations: 

 The values contained in the table are highly conservative. The sample rate for the test 

monitoring system was limited to 0.1 min (6 sec). In many cases the fuse cleared between 

sample times. For these cases, the clearing time has been conservatively assigned a value of 

0.1 min. This approach holds true for all values. Inherent in this approach is that the 

analysis uncertainty associated with determining the statistical values is completely 

incorporated into the values. 

 All cables that reached a minimum leakage current of 0.25 A ultimately cleared the fuse. 

This is evident in that the population for all three threshold currents is the same. This is an 

important observation because it demonstrates that once fault resistance has degraded to the 

transition point, the cascade effect dominates the ultimate outcome and the fault does not 

then “hang up” at an intermediate resistance value that results in a prolonged abnormal lowlevel current flow. 

 Once fault current surpassed 1.0 A, the cascade effect accelerated, as evidenced by the 

smaller delta between the 1.0 A to 2.0 A average and the 0.25 A to 1.0 A average. 

 Once fault current for thermoset cable exceeded 2.0 A, the average clearing time was 0.14 

min, with a 95% (2 standard deviations) upper bound of 0.4 min. From this it can be stated 

that 95% of the faults cleared within 24 sec. 

 Thermoset cable fails much more quickly than thermoplastic cable. 

B.1-6.1.1.3 Assessment of Probability 

A different – and arguably better – way to tabulate the data is to determine the fraction of 

faults that were cleared by the fuse within a specified time. This tabulation is shown in 

Table B.1-2. 

Viewed from this perspective, the data represents a go – no go or success – failure data 

set. In this format the data is readily analyzed in a manner useful in addressing the MHIF 

concern. The table is interpreted as follows: For thermoset cable, once fault current 

reached a level of 0.25 A, 62.7% of the faults were cleared within 0.2 min; 78.7% of the 

faults were cleared within 0.5 min; and so on. 
NEI 00-01, Revision 2 

May 2009 

B.1-15 

Percentage of Faults Cleared 

Table B.1-2 

Probability of Clearing Faults Within a Specified Time 

Time (min) 0.25 A 1.0 A 2.0 A 

Thermoset Cable

0 0.0% 0.0% 0.0% 

0.1 46.7% 77.3% 89.3% 

0.2 62.7% 86.7% 90.7% 

0.3 70.7% 88.0% 92.0% 

0.4 74.7% 90.7% 93.3% 

0.5 78.7% 90.7% 94.7% 

0.6 84.0% 92.0% 96.0% 

0.7 85.3% 92.0% 96.0% 

0.8 89.3% 93.3% 100.0% 

1.0 90.7% 94.7% 100.0% 

1.5 96.0% 97.3% 100.0% 

2.0 96.0% 98.7% 100.0% 

Thermoplastic Cable

0 0.0% 0.0% 0.0% 

0.1 87.2% 100.0% 100.0% 

0.2 94.9% 100.0% 100.0% 

0.3 100.0% 100.0% 100.0% 

Figures B.1-5 and B.1-6 graphically illustrate the data contained in Table B.1-2. 
NEI 00-01, Revision 2 

May 2009 

B.1-16 

Figure B.1-5 

Percent Faults Cleared for Specified Time – Thermoset Cable 

0.0%

10.0%

20.0%

30.0%

40.0%

50.0%

60.0%

70.0%

80.0%

90.0%

100.0%

0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0

Time to Clear Fuse (min)

Faults Cleared (%)

0.25 A

1.0 A

2.0 A
NEI 00-01, Revision 2 

May 2009 

B.1-17 

Figure B.1-6 

Percent Faults Cleared for Specified Time – Thermoplastic Cable 

0.0%

10.0%

20.0%

30.0%

40.0%

50.0%

60.0%

70.0%

80.0%

90.0%

100.0%

0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0

Time to Clear Fuse (min)

Faults Not Cleared (%)

0.25 A

1.0 A

The following observations can be made about the probability data: 

 Faults for thermoplastic cable essentially degrade to full failure immediately. Given 

the limitations of the monitoring system sample rate (6 sec) and the conservative 

treatment of the data, it is suspected that the actual failure times are in the millisecond 

range and not seconds. On this basis the observations for thermoset cable are 

considered to bound the thermoplastic cable. 

 Figure B.1-5 shows that the 1.0A curve is approaching the 2.0 A curve. This 

graphically illustrates that once current has surpassed the 1.0 A threshold, the cascade 

effect drives the outcome and full failure is inevitable. Again, with respect to the 

MHIF concern, this confirms that the inherent fault behavior does not support the 

concept that fault current can stabilize at some intermediate value. Once cascading 

begins, the fault will progress to full failure, provided the system is capable of 

delivering sufficient energy to the fault. 

 Once fault current reaches 2.0 A, 89% of the faults are cleared within 0.1 min and 

100% of the faults are cleared within 0.8 min. Again, considering the limitations of 

the monitoring circuit, the actual times are less than indicated. 

 From the 1A current threshold only one fault took longer than 2 min to clear – it 

cleared in 2.1 min. 
NEI 00-01, Revision 2 

May 2009 

B.1-18 

B.1-6.1.1.4 Uncertainty Analysis 

An uncertainty analysis of the data contained in Section B.1-6.1.1.3 is needed to establish 

a confidence level in the results. The dataset conforms to the requirements for a binomial 

distribution [23, 24], and thus a binomial confidence interval will be used to assess 

uncertainty. The confidence interval will be calculated at the 95% level. Only thermoset 

cable data is included in the calculation since it bounds the thermoplastic cable data. 

The binomial confidence interval calculation is particularly punishing in this case 

because of the relatively small sample population and low number of failures. This factor 

adds additional margin to the calculated values of uncertainty. 

The binomial confidence limits are calculated as follows: 

⎟

⎠

⎞ ⎜

⎝

⎛ ⎟ − ⎠⎞ ⎜

⎝

⎛ ⎟

⎠

⎞ ⎜

⎝

⎛ ±−=

n

x

x

n

x

x

n

z

n

x

Pl 1 1 1 

where: Pl = Probability confidence limits 

 n = Sample population 

 x = Number of observations failing criteria 

 z = Desired confidence level factor (1.96 for 95%) 

Table B.1-3 shows the calculated 95% confidence factors and Table B.1-4 shows the 

95% lower confidence limit values for the dataset. 
NEI 00-01, Revision 2 

May 2009 

B.1-19 

Table B.1-3 

Binomial Distribution 95% Confidence Factors 

Binomial Distribution 95% Confidence Factors 

Time (min) 0.25 A 1.0 A 2.0 A 

0 0.0% 0.0% 0.0% 

0.1 11.3% 9.5% 7.0% 

0.2 10.9% 7.7% 6.6% 

0.3 10.3% 7.4% 6.1% 

0.4 9.8% 6.6% 5.6% 

0.5 9.3% 6.6% 5.1% 

0.6 8.3% 6.1% 4.4% 

0.7 8.0% 6.1% 4.4% 

0.8 7.0% 5.6% 0.0% 

1.0 6.6% 5.1% 0.0% 

1.5 4.4% 3.6% 0.0% 

2.0 4.4% 2.6% 0.0% 

Table B.1-4 

Fault Clearing Time 95% Lower Confidence Limit 

95% Lower Confidence Limit 

Time (min) 0.25 A 1.0 A 2.0 A 

0 0.0% 0.0% 0.0% 

0.1 35.4% 67.9% 82.3% 

0.2 51.7% 79.0% 84.1% 

0.3 60.4% 80.6% 85.9% 

0.4 64.8% 84.1% 87.7% 

0.5 69.4% 84.1% 89.6% 

0.6 75.7% 85.9% 91.6% 

0.7 77.3% 85.9% 91.6% 

0.8 82.3% 87.7% 100.0% 

1.0 84.1% 89.6% 100.0% 

1.5 91.6% 93.7% 100.0% 

2.0 91.6% 96.1% 100.0% 
NEI 00-01, Revision 2 

May 2009 

B.1-20 

Figure B.1-7 shows the 1.0 A and 2.0 A fuse clearing probabilities with the 95% 

confidence limits applied. Note that the t = 0 confidence limits have no real meaning 

since no fails have occurred at this point. 

Figure B.1-7 

Probability of Clearing Fault Within Specified Time 

With 95% Uncertainty Bound Applied 

0.0%

10.0%

20.0%

30.0%

40.0%

50.0%

60.0%

70.0%

80.0%

90.0%

100.0%

0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0

Time to Clear Fuse (min)

Faults Cleared (%)

1.0 A

2.0 A

1.0 A 95%

2.0 A 95%

B.1-6.1.1.5 Leakage Current for Non-Failures 

The data presented in Sections B.1-6.1.1.2 and B.1-6.1.1.3 demonstrates the behavior of 

faults for those cases in which the fuse did not clear. Just as important in addressing the 

MHIF concern is: What was the behavior for cases in which the fuse did not clear? The 

key issue, of course, is whether any cases occurred in which fault current increased to a 

level of concern without triggering the fuse. 

A review of the data for all cases in which the fuse did not clear indicates that the highest 

fault current observed without the fault ultimately cascading to full failure and clearing 

the fuse was 0.17 A, which correlates to a fault resistance of 700 Ω. No cases existed in 

which the failure progresses to the cascade point and did not ultimately fully fail. 
NEI 00-01, Revision 2 

May 2009 

B.1-21 

B.1-6.1.2 NRC /SNL Fire Test Results 

The NRC/SNL fire tests are documented in NUREG/CR-6776, Cable Insulation 

Resistance Measurements Made During Cable Fire Tests [3]. It is not intended that this 

analysis conduct a comprehensive review of the data associated with the NRC/SNL 

report. Rather, the test results are reviewed to ascertain any trends or insights different 

than observed in the EPRI/NEI test results. 

The NRC/SNL test results show the same basic progression for cable failure. Insulation 

resistance drops predictably down to the 10 kΩ to 1,000 Ω range, at which points the 

failure cascades rapidly to full failure. The monitoring equipment sample rate was 

approximately 75 sec, and thus the measurements do not fully capture the dynamics of 

the cascade effect. Like the EPRI/NEI data, in many cases the IR is high one 

measurement then low for the subsequent measurement. The final IR values are more 

erratic than observed in the EPRI/NEI test data. This is attributed to the limited-energy 

circuit used for the testing. The circuit was designed to limit current to 1.0 A, which 

prevented the system from consistently driving faults to their conclusion. This 

observation further supports the Base Case requirement that the system be capable of 

supplying sufficient energy to the fault. A typical plot of insulation resistance from the 

NRC/SNL fire tests is shown in Figure B.1-8. 
NEI 00-01, Revision 2 

May 2009 

B.1-22 

Figure B.1-8 

Insulation Resistance Values for Typical Test Series 

(Courtesy of USNRC and Sandia National Laboratories) 

1.E+00

1.E+01

1.E+02

1.E+03

1.E+04

1.E+05

1.E+06

0 1000 2000 3000 4000 5000

Time (seconds)

IR (ohms)

R12 R13

R14 R15

R16 R17

R18 R19

R10

B.1-6.2 Characterization of Arcing Faults 

As discussed in Section B.1-4.0, high impedance faults on systems operating at 480 V 

and above are manifested as arcing faults. Arcing-type faults are unique in their behavior 

and must be treated differently than conventional bolted faults [7, 13 – 22]. 

Arcing faults are characterized by relatively high fault impedance and low, erratic fault 

current. The rms current for an arcing fault can be substantially lower than the maximum 

available fault current (bolted fault). Arcing faults on high energy systems are extremely 

damaging and must be cleared rapidly to avoid extensive damage. 

B.1-6.2.1 Fire as an Initiator of Arcing Faults 

Operating history for electrical power systems shows the most common cause of arcing 

faults to be: 

 Loose connections that overheat, causing minor arcing that escalates into an arcing 

fault 
NEI 00-01, Revision 2 

May 2009 

B.1-23 

 Surface conduction due to dust, moisture, or other contaminates on insulating 

surfaces 

 Electrical mishaps involving conducting materials (e.g., dropping a metal wrench into 

energized switchgear) or foreign objects in enclosures 

 Insulation damage. 

From a circuit failure perspective, fire is an external event with the propensity to damage 

any circuits in the vicinity of the fire; however, industry experience does not identify fire 

as a major initiator of faults on high energy systems. It is surmised that in many cases, 

operators take action to de-energize high voltage equipment before it is engulfed by an 

escalating exposure fires. Nonetheless, fire-induced arcing faults can occur on high 

energy systems and must be addressed. 

B.1-6.2.2 Classification of Faults 

Arcing faults may take the form of a line-to-line fault or a line-to-ground fault. Arcing 

faults include: 

Three Phase (3-Ø) Systems: 3-Ø line-to-line 

3-Ø line-to-ground 

1-Ø line-to-line 

1-Ø line-to-ground. 

Single Phase (1-Ø) Systems: 1-Ø line-to-line 

1-Ø line-to-ground. 

Line-to-ground arcing faults pose less of a concern than line-to-line arcing faults for 

electrical distribution systems equipped with ground fault protection. Ground fault 

sensors may be set with high sensitivity to low magnitude currents because ground 

current is not expected under normal conditions. In contrast, line-to-line arcing faults can 

take longer to detect since the phase overcurrent devices are less capable of 

discriminating between a relatively harmless overload and a highly damaging, lowmagnitude arcing fault. 

Line-to-ground faults on solidly grounded electrical systems that are not equipped with 

ground fault sensors can produce faults that are not instantaneously cleared. Systems of 

this design rely on the phase overcurrent devices for protection, which do not offer the 

same degree of sensitivity to ground faults as do ground fault sensors. It is important to 

maintain perspective on this point. A highly energetic ground fault that is allowed to 

persist for even several seconds will generally cause widespread damage. Concern over 

this type of fault has initiated changes to recommended practices for protection against 

arcing ground faults. High-resistance grounded systems are generally not susceptible to 
NEI 00-01, Revision 2 

May 2009 

B.1-24 

damaging ground current flow because a grounding resistor or reactor limits the current 

to a very low level. Ungrounded systems require a fault on at least two phases to produce 

fault current flow. This type of fault is essentially a line-to-line fault. 

Operating experience shows that arcing faults are most prevalent in metal-enclosed 

switchgear and open busways containing an uninsulated bus bar. Insulated cables in 

conduit or tray more frequently suffer bolted faults. These characteristics are attributable 

to the nature of the arc. Arcing faults on uninsulated conductors tend to travel away from 

the source because of magnetic force interactions with the ionized arc. Movement of the 

arc minimizes the concentration of fault energy. In contrast, insulated cable does not 

allow rapid movement of the arc. Consequently, the arc energy and the damage it inflicts 

remain concentrated at the initial arc location, causing a more rapid degradation of the 

fault to a bolted fault. 

B.1-6.2.3 Arc Voltage Drop and Waveshape 

The arc voltage drop ranges from 100 – 150 volts for fault currents between 500 and 

20,000 amps. The voltage is effectively constant over a wide range of current. The 

length of the arc for distribution level voltages varies but usually ranges between 1 and 2 

inches. 

Test data shows that the arc voltage waveshape is significantly distorted. The waveshape 

is initially sinusoidal and then quickly flattens at a magnitude of 100 – 150 volts, 

depending on the exact arc length and local conditions. The arc voltage waveshape does 

not increase in a linear fashion as a function of the system voltage. The voltage contains 

a significant third harmonic component, which is on the order of five times the normal 

value. 

Once an arc is initiated, it extinguishes at current-zero and then reignites when 

instantaneous voltage reaches some threshold value. A key relationship exists between 

the reignition, or re-strike voltage, and the level of fault current. The lower the reignition voltage the higher the fault current. As reignition voltage approaches zero, fault 

current approaches its maximum value (bolted fault). And, as reignition voltage 

approaches system voltage, fault current approaches zero (open circuit). As a result of 

this inverse relationship, it is evident that higher reignition voltages represent more of a 

concern than lower voltages with respect to the MHIF concern. Analyses of distributionlevel arcing faults generally assume a reignition voltage of 375 V (peak instantaneous). 

This voltage is considered a conservative practical upper limit for reignition based on 

typical system designs. 

Arcing fault reignition has several important implications: 

 Arcing faults with a reignition voltage above the system voltage are selfextinguishing. Thus, a lower threshold of fault current exists for which a fault can 

sustain itself beyond one cycle. 
NEI 00-01, Revision 2 

May 2009 

B.1-25 

 An arc is not self-extinguishing at or above voltage levels with a peak 

instantaneous voltage greater than approximately 375 volts. 375 volts 

instantaneous corresponds to 265 volts rms. 

 Sustained arcing faults on single phase 120/208 V AC systems are exceedingly 

rare. Two factors are involved: (1) the low system voltage reduces the likelihood 

of exceeding the reignition voltage, and (2) unlike three phase faults, periods of 

no current flow exist for single phase configurations, affording the ionized hot 

gasses a better chance of dissipating. This is not to say that arcing faults cannot 

occur at these voltage levels and cause equipment damage. It does, however, 

support a position that “sustained” arcing faults at this level very seldom occur. 

 The fault current associated with arcing faults increases as a percentage of the 

bolted fault current as system voltage increases. This characteristic is due the 

nature of the arc voltage, which remains relatively constant regardless of system 

voltage. Thus, the higher the system voltage, the longer will be the conduction 

portion of the arc ignition-extinguishment cycle. 

 High impedance arcing faults are primarily an AC system phenomenon. The 

low-magnitude current associated with an arcing fault is largely due to the 

ignition – extinguishment cycle of the fault, which serves to lower the rms fault 

current. In a DC system, a periodic ignition – extinguishment cycle does not 

exist. Voltage is constant and thus current flows continuously once an arc is 

established. 

B.1-6.2.4 Arc Fault Current 

The current waveshape consists of non-continuous alternating pulses, with each pulse 

lasting about 1⁄4 – 3⁄4 of a cycle. The arc is extinguished each half cycle and reignited in 

the succeeding half cycle as discussed in Section B.1-6.2.3 above. 

The generally accepted multipliers (expressed in % of bolted fault current) for estimating 

rms arcing fault current for 480/277 V systems are listed below. The multipliers are 

based on establishing the lower values of probable fault current for realistic values of arc 

voltage. Arc length is assumed to be 2 inches and arc voltage 140 V (line-to-neutral) / 

275 V (line-to-line), independent of current. Neither of these assumptions is strictly true 

because of the dynamic movement of the arc and other configuration variables at the fault 

location. Thus, actual fault current may also vary. The estimated current values are, 

however, representative of the values produced during testing. 

3-Ø Arcing Fault: 89% 

Line-to-Line Arcing Fault: 74% 

Line-to-Ground Arcing Fault: 38% 
NEI 00-01, Revision 2 

May 2009 

B.1-26 

Note: Some industry papers addressing arcing fault protection suggest a multiplier of 

19% for line-to-ground arcing faults. However, documented occurrences of cases below 

38% appear exceedingly rare and appear to be associated with switchgear faults, which 

tend to have longer arc lengths. The 38% value is considered reasonable for this 

assessment since the concern is with cables and not switchgear. 

Minimum values of arcing fault current have not been established for medium voltage 

systems. However, as noted in Section B.1-6.2.3 above, the values will increase with 

system voltage, and as a minimum will be higher than the 480 V values listed above. 

Practical experience indicates that arcing fault currents for medium voltage systems 

actually approach bolted fault levels. 

B.1-6.2.5 Arc Energy 

Even though the rms current for an arcing fault is less than that of a bolted fault, arcing 

faults can cause a great amount of damage. Most of the energy in the arc is released as 

heat at the arcing points; very little heat is conducted away from the arc by the 

conductors. In contrast, a bolted fault dissipates energy throughout all resistive elements 

in the distribution system and does not cause the concentrated energy release seen in 

arcing faults. 

Fire can cause unspecified damage to cable and equipment insulation, which in turn can 

initiate an arcing fault in energized conductors. The failure sequence starts with a 

progressively decreasing insulation resistance. At some point under the applied voltage 

stress, the insulation allows sufficient leakage current to cause excessive localized 

heating in the insulation (usually at some minor imperfection in the cable). The localized 

heating escalates rapidly due to the high energy capacity of the system, and within 

moments conductor and insulation temperature reach their vaporization point. 

Conductive material is expelled, forming a vapor cloud in the vicinity of the fault. The 

vapor cloud readily conducts electricity and an arc is formed. The cloud of vaporized 

metal tends to quickly condense on surrounding surfaces, which creates a cascading 

effect for the arcing fault as additional arc paths are created. The loss of material due to 

vaporization contributes to the dynamic nature of arcing faults. Depending on the fault 

geometry and conditions, the arc might persist, blow open, or degrade to a bolted fault. 

The amount of conductor vaporized during an arcing fault is directly related to the energy 

released at the fault. The industry-accepted correlation (supported by test results) is that 

50 kW/sec of energy will vaporize approximately 1/20 in3 of copper. The significance of 

this characteristic is that arcing faults at medium voltage levels (above 1,000 V) cannot 

sustain themselves beyond a few seconds. The tremendous energy release at these higher 

voltages vaporizes conductor material so fast that the fault degrades almost immediately 

or blows open. This category of fault can completely demolish equipment in a matter of 

seconds if not cleared. 
NEI 00-01, Revision 2 

May 2009 

B.1-27 

B.1-7 ANALYSIS OF MHIFS 

This section analyzes the MHIF concern within the framework of knowledge about fireinduced fault behavior developed in Section B.1-6. This characterization of fault 

behavior shows that faults manifest themselves differently at different voltage levels. 

Accordingly, the analysis conducted here is broken down by voltage classification. 

B.1-7.1 Medium Voltage Systems (2.3 kV and Above) 

Medium voltage systems at nuclear plants typically operate within the 2.3 kV to 13.8 kV 

range. Overcurrent protection for this class of equipment usually includes electromechanical or solid state overcurrent relays that actuate power circuit breakers. High 

voltage fuses may be used for some installations. Most systems also include sensitive 

ground fault detection designed to rapidly clear ground faults, which can be highly 

volatile and damaging. 

HIFs for this class of power manifest themselves as arcing faults. The electrical 

properties and characteristics for arcing faults are discussed in Section B.1-6.2. The 

expected impact of arcing faults at the medium voltage level is addressed by the items 

below: 

 The typical arc voltage drop of 100 – 150 volts is small in relation to the overall 

system voltage. Thus, an arcing fault at medium voltage levels will not appreciably 

reduce fault current in the same manner as it does for low-voltage systems. Based 

on the 480 V multipliers presented in Section B.1-6.2.4, very conservative assumed 

lower arcing fault currents of 40% (line-ground) and 80% (line-to-line) of the 

symmetrical rms bolted fault current produce highly damaging levels of current 

flow. An adequately designed protective system can be expected to clear faults at 

these levels very rapidly (within a few seconds). Systems coordinated in 

accordance with the guidance of ANSI/IEEE 242 (or other acceptable criteria) are 

considered to be adequately designed. 

 Most all medium voltage power systems include sensitive ground fault protection 

devices. These devices are set to clear ground faults at very low levels (20 A – 100 

A) – well below the assumed 40% lower fault current limit. Systems that are high 

resistance grounded inherently limit fault current to a low value. Accordingly, 

these systems are designed to be extremely sensitive to ground fault current, and are 

expected to rapidly clear any type of ground fault. 

 Certain cable runs may not be protected by overcurrent relays, but instead may use 

differential protection schemes. Differential protection is very sensitive and any 

cable protected this type of circuit will clear in-zone faults within milliseconds. 

Sensitivity varies, but is in the 10s to hundreds of amps and not thousands of amps. 

 Arcing faults on medium voltage systems produce explosive energies. An arcing 

fault with an arc voltage of 140 volts (very conservative for this voltage level) and 
NEI 00-01, Revision 2 

May 2009 

B.1-28 

fault current of 2,000 A (also a conservative value) will vaporize copper conductor 

at a rate of: 

Volume Vaporized = (140 x 2.00 x 1/20) / 50 = 0.4515 in3 copper / sec 

At this vaporization rate for busbar or cable, the fault conditions cannot be 

sustained for more than a few moments before the dynamic nature of the fault 

produces near bolted conditions or blows open. 

 Operating experience shows that even with highly sensitive protection that clears 

arcing faults within a fraction of a second (or in the worst case seconds) severe 

localized damage is likely. Given the energies involved, from a hardware integrity 

perspective it is not plausible that arcing faults can be sustained for a prolonged 

period of time at medium voltage levels. 

Conclusion

HIFs at medium voltage levels will manifest themselves as arcing faults. The minimum 

credible fault current produced by these faults will be rapidly detected by an adequately 

designed protective scheme and the fault will be cleared immediately, typically within 

milliseconds. The energies produced by arcing faults for this class of power system 

cannot be sustained by the hardware for more than a few seconds due to physical 

destruction of the conductor, insulating materials, and surrounding equipment. The 

analysis supports a conclusion that, for medium voltage power supplies conforming to the 

Base Case, the probability of MHIFs is sufficiently low to classify the failure mode as an 

incredible event that does not pose a credible risk to post-fire safe shutdown. 

B.1-7.2 480 V – 600 V Low Voltage Systems 

480 V systems are most common at nuclear plants; however, some 600 V systems exist. 

A variety of overcurrent protective devices are used for this class of equipment. Load 

centers are generally protected by low voltage power circuit breakers configured with an 

internal electro-mechanical or solid-state trip unit. Motor control centers and distribution 

panels typically contain molded case circuit breakers or fuses. Some 480 V systems are 

configured with separate ground fault detectors and some are not. 

HIFs for this class of power manifest themselves as arcing faults. The electrical 

properties and characteristics for arcing faults are discussed in Section B.1-6.2. The 

expected impact of arcing faults at this voltage level is addressed by the items below: 

 Credible lower limits for sustained arcing faults on 480 V systems are presented in 

Section B.1-6.2.4. Arcing fault currents of 38% (line-ground) and 74% (line-toline) of the symmetrical rms bolted fault current produce damaging levels of current 

flow. An adequately designed protective system can be expected to clear faults at 

these levels rapidly (although maybe not instantaneously). Systems coordinated in 

accordance with the guidance of ANSI/IEEE 242 (or other acceptable criteria) are 
NEI 00-01, Revision 2 

May 2009 

B.1-29 

considered to be adequately designed. A worst-case example is developed below to 

substantiate this position. 

 A worst-case scenario might involve an arcing ground fault on a solidly grounded 

system that is not configured with individual ground fault detection. Assume an 

end-of-line fault has a symmetrical rms bolted fault current of 5,000 A (highly 

conservative as most 480 V systems produce fault current in the range of 10 kA to 

25 kA). This case would result in an arcing fault current of 1,900 A (.38 x 5,000). 

It is conceivable that this level of fault current might not trigger the instantaneous 

trip element of the affected overcurrent device; however, the inverse time element 

will assuredly detect and clear the fault as no realistic system contains feeders 

operating at 1,900 A continuous. In this case it is plausible that the fault might take 

10 – 15 sec to clear. However, due to the destructive power this fault would 

unleash, it is doubtful that the hardware would survive these conditions. 

 If the above scenario is postulated to occur at the switchgear, it is distinctly possible 

that the switchgear main breaker might not readily detect the fault, as these breakers 

can be rated at 800 A – 4,000 A. Literature documents such cases, and complete 

destruction of the switchgear was the outcome. However, switchgear and bus faults 

requiring main breaker protective action are not of concern for the MHIF issue. 

 480 V systems configured with properly coordinated ground fault detection can be 

expected to clear low-level arcing ground faults immediately. 

 As with medium voltage systems, arcing faults on 480 V systems produce 

tremendous energies at the fault location. An arcing fault with an arc voltage of 

100 volts (conservative) and fault current of 1,900 A will vaporize copper 

conductor at a rate of: 

Volume Vaporized = (100 x 1.90 x 1/20) / 50 = 0.190 in3 copper / sec 

Although not as severe as that seen on medium voltage systems, this vaporization 

rate for busbar or cable cannot be sustained, and the fault will progress rapidly to a 

bolted condition or will blow open as localized destruction escalates. 

Conclusion

HIFs on 480 V – 600 V power systems manifest themselves as arcing faults. The 

minimum credible fault current produced by these faults will be detected by an 

adequately designed protective scheme and the fault will be cleared (although maybe not 

instantaneously). The energies produced by arcing faults for this class of power system 

cannot be sustained by the hardware for extended periods of time before physical 

destruction of the conductor, insulating materials, and surrounding equipment result in 

widespread and catastrophic damage. The analysis supports a conclusion that, for 480 V 

– 600 V power supplies conforming to the Base Case, the probability of MHIFs is 

sufficiently low to classify the failure mode as an incredible event that does not pose a 

credible risk to post-fire safe shutdown. 
NEI 00-01, Revision 2 

May 2009 

B.1-30 

B.1-7.3 120 V and 208 V Systems 

120 V systems are most often used for control and control power circuits; 208 V systems 

are typically associated with lighting, small motors, heaters, etc. 120 V single-phase 

circuits are of greatest interest for this study. For nuclear plant applications, overcurrent 

protective devices are generally molded case circuit breakers or fuses located within 

power distribution panels. The systems are most often powered by battery-backed 

inverters or relatively small transformers. 

The recent industry and NRC fire tests confirm that the behavior of cable faults on 120 V 

systems is fundamentally different than that for faults on 480 V and higher systems. 

Theory predicts that sustained arcing faults at the 120 V level are not credible because the 

system is not able to repeatedly overcome the reignition voltage of 375 V. Indeed testing 

appears to confirm this point. This is not to say that arcing faults cannot occur at the 120 

V level, but rather that they cannot be sustained. Arcing faults on 120 V systems have 

been said to be “sputtering” faults. They arc, extinguish, and then re-arc and extinguish 

in a random manner based on the local conditions and geometry at the fault. The test data 

identified two cases that may have fallen into this category. These cases are included in 

the data set analyzed in Section B.1-6.1. It is noteworthy that the current profiles for 

these cases show current to be erratic and unpredictable, but at no time did current rise to 

HIF levels and remain there for more than a few seconds. Ultimately, the fault in each 

case degraded to a low level and was cleared by the fuse. These faults may also have 

simply been a case in which the localized insulation breakdown effect shifted as a result 

of the fire dynamics. Regardless of the specific phenomena at work, these cases are 

included in the analysis. 

The test data clearly shows that faults at these levels on average do not clear as rapidly as 

faults at higher voltages. With our understanding of fault behavior, the reason for this is 

somewhat intuitive. The applied voltage stress and available fault current are orders of 

magnitude lower than for higher voltage power systems. Hence, the local conditions are 

not nearly as violent and the cable failure sequence simply progresses at a slower rate. 

That is, the energy released at the fault is much lower, and thus the insulation is not 

driven to full failure as rapidly. Additionally, the magnetic forces at this level do not 

cause the dynamic effects (movement of conductors) observed for high energy system 

faults. 

The electrical properties and characteristics for faults on 120 V systems are discussed in 

Section B.1-6.1. The expected impact of these faults is addressed by the items below: 

 The test data indicates that 120 V faults do not manifest themselves in a 

manner conducive to sustained HIF conditions. Once the fault has 

progressed to a certain level, it cascades rapidly to full failure within 

seconds or 10s of seconds, as shown by the test data (summarized below). 

This phenomenon was observed consistently in all the EPRI/NEI test data 
NEI 00-01, Revision 2 

May 2009 

B.1-31 

and NRC/SNL data, with the exception of instrument circuits,29 which are 

not within the scope of this analysis. The transition region at which the 

cascading effect begins appears to range from approximately 10 kΩ to 1,000 

Ω. But in all instances, when leakage current exceeded 0.25 A the fault was 

driven to failure and the fuse cleared. The 0.25 A (480 Ω fault resistance) 

threshold is important because this level of fault current (more appropriately 

classified as leakage current at this level) poses no conceivable risk for any 

realistic circuit with respect to the MHIF concern. 

 This analysis uses 2 A as the benchmark value for fault current flow that 

represents a lower limit of current potentially of concern from a MHIF 

perspective. This value represents 67% of the test circuit continuous current 

capability (i.e., 3 A fuses). Analysis of the test data provides us with the 

following probabilities associated with the time frames for clearing faults 

once fault current has risen to 2 A. The 95% confidence level is also shown 

to quantify uncertainty in the data set. 

Time (min) 

Probability of 

Clearing Fault 

95% Lower 

Confidence Limit 

0.1 89.3% 82.3% 

0.2 90.7% 84.1% 

0.3 92.0% 85.9% 

0.4 93.3% 87.7% 

0.5 94.7% 89.6% 

0.6 96.0% 91.6% 

0.7 96.0% 91.6% 

0.8 100.0% 100.0% 

1.0 100.0% 100.0% 

 The two key observations gleaned from the probability values are: 

• Over 80% of the faults are cleared in less than 0.1 min at a 95% 

confidence level 

• 100% of the faults (or nearly 100% if some margin is added for 

general uncertainty) clear within 0.8 min at a 95% confidence level 

 The EPRI/NEI test data revealed NO cases in which the test circuit fuse 

failed to clear once current exceed 0.17 A (700 Ω fault resistance) – an 

important observation supporting the premise that faults do not “hang up” 

once cascade failure begins. 

 29 The inability of instrument power supplies to transfer appreciable energy to the fault appears to 

preclude rapid failure in some cases. The impact of this effect on instrument circuits is discussed in 

the NRC/SNL report [3]. 
NEI 00-01, Revision 2 

May 2009 

B.1-32 

 The test circuits upon which the probability values are based contained 3 A 

fuses. A fair question to ask is whether the probability values are applicable 

to circuits with larger protective devices, for instance a 5 A or 10 A branch 

circuit fuse. Based on the fault characteristics, applying the results to high 

rated devices appears justified. Once current has passed 2 A, the fault 

resistance has degraded to a low level and the system, rather than the fault, 

becomes the primary determinant of the fault current magnitude. Provided 

the protective devices are adequately coordinated and the system provides 

sufficient fault current, the relative timing of the devices will be maintained 

over the entire fault current range. The important behavior here is that the 

faults do not “hang up” and thereby jeopardize the coordination scheme by 

producing fault currents below detectable levels. 

Conclusion

A detailed analysis of fault behavior for 120 V systems indicates that these faults do not 

exhibit characteristics that are conducive to sustained HIF conditions. The analysis 

demonstrates that once fault current surpasses a certain threshold level, the fault 

repeatedly and reliably degrades to a low level that will trigger overcurrent protective 

action for an adequately designed system. This threshold level varies but appears to be 

near 0.2 A at the lower limit. This level of “abnormal current flow” does not pose a risk 

with respect to the MHIF failure mode and in fact does not even render the affected 

circuit inoperable. The fundamental fault characteristics upon which this conclusion is 

based were readily apparent in the EPRI/NEI tests and the NRC/SNL tests. Additionally, 

a similar utility-sponsored test conducted in 1987 revealed the same basic behavior [27]. 

The analysis supports a conclusion that, for 120 V power supplies conforming to the Base

Case, the probability of MHIFs is sufficiently low to classify the failure mode as an 

incredible event that does not pose a credible risk to post-fire safe shutdown. 

B.1-7.4 125 V and 250 V DC Systems 

125 V and 250 V DC systems provide control power and motive power to essential 

equipment, including switchgear and motor control circuits, motor-operated and solenoid 

operated valves, instruments, and emergency lighting. Overcurrent protective devices are 

generally molded case circuit breakers or fuses located within power distribution panels. 

Low voltage power circuit breakers are sometimes used at the DC control centers. 

The test data and industry information presented in Section B.1-6.0 apply to AC power 

systems and thus cannot be directly applied to DC systems. However, the wellunderstood differences between AC and DC power allow the results to be reasonably 

applied to DC systems as explained below: 
NEI 00-01, Revision 2 

May 2009 

B.1-33 

 Arcing type faults on low voltage DC systems cannot be ruled out using the 

same logic applied to low voltage AC systems. Once an arc is struck on a 

DC system, it has no sinusoidal waveform to initiate the ignitionextinguishment cycle, and thus the concept of a minimum re-ignition 

voltage does not apply. However, high impedance arcing faults are 

primarily an AC system phenomenon. The low-magnitude current 

associated with an arcing fault is largely due to the ignition - extinguishment 

cycle of the fault, which serves to lower the rms fault current. In a DC 

system, fault current more readily flows without interruption once a short 

circuit begins. This continuous current flow is not conducive to prolonged, 

sporadic arcing conditions. Once the fault begins, theory predicts that it will 

quickly escalate in magnitude and will be rapidly cleared by a properly 

designed protective system. Operating experience supports this theory in 

that high impedance arcing faults are not identified as a concern by industry 

standards and literature. 

 For non-arcing faults on 125 V DC systems, the analytical results for 120 V 

AC systems can be conservatively applied. The key failure phenomenon 

observed in the test data is the cascading effect once leakage current exceeds 

the threshold level. Here again the continuous nature of DC power supports 

a position that energy will be transferred to the fault faster in a DC system 

because the voltage stress applied at the fault is constant and will precipitate 

a quicker breakdown of the insulation. 

 As a second factor affecting the rate of cascade failure, the test data shows a 

correlation between available fault current and the expected clearing time. 

DC systems at nuclear power plants are battery-backed, and thus are capable 

of delivering high fault currents almost instantaneously. These fault 

currents are often an order of magnitude larger than exists on 120 V AC 

systems. 

 Virtually all DC power distribution systems at nuclear plants operate 

ungrounded. Thus, ground faults are not of concern in a manner similar to 

AC power systems. 

 Operating experience with faults on battery-backed DC power systems is 

that the fault will likely blow open but it can also quickly weld itself. In 

either case, whatever is going to happen happens almost instantaneously. 
NEI 00-01, Revision 2 

May 2009 

B.1-34 

Conclusion

Test data and industry literature pertaining to fault characteristics for representative DC 

power systems are not readily available. However, a reasonable extrapolation of the 

analysis results for AC systems is accomplished using engineering rationale based on the 

differences between AC and DC power. The inherent characteristics of DC power do not 

introduce any known factors that preclude application of the analysis results to DC 

systems. To the contrary, DC power characteristics lend credence to a position that the 

AC results are conservative with respect to DC power system performance. Although not 

a technical basis, it is noteworthy that the NRC limits its stated concern with MHIF to 

AC power systems [4]. It would appear that NRC technical experts investigating the 

issue concur that the postulated phenomena are limited to AC power systems. 

B.1-7.5 Failure Consequence Analysis 

Elements of this MHIF evaluation contain risk-informed arguments. As such, it is 

prudent to assess not only likelihood of the postulated failure mode, but also the potential 

consequences of failure. 

B.1-7.5.1 Loss of Safe Shutdown Power Supply 

The MHIF failure mode can result in a safe shutdown power supply becoming deenergized, which in turn could potentially lead to de-energization of safe shutdown 

equipment. This failure mode is fundamentally different than electrical failures resulting 

from the direct effects of fire. The direct effect failure modes (i.e., shorts-to-ground, hot 

shorts, open circuits) cause circuit damage that can only be rectified through repairs. The 

MHIF failure mode is not unrecoverable in the sense that restoration involves resetting an 

overcurrent relay, closing a circuit breaker, or replacing a fuse. (It is acknowledged that 

fuse replacement is generally classified as a “repair activity” within the compliance 

guidelines for Appendix R. Nonetheless, from a “consequence” point of view, replacing 

a fuse – which typically requires no tool or a simple tool – is fundamentally different than 

a repair involving the replacement of cables and components.) It is understood that 

operators are credited with identifying the problem and taking steps to restore the 

affected power supply to service. Given that almost all safe shutdown power supplies 

require some local action for alternative shutdown or spurious operation mitigation, it is 

also probable that critical power supplies are covered by emergency lights and that 

access/egress paths have been considered. On this basis, the MHIF failure mode is 

considered to have a low consequence and is not a significant contributor to fire risk. 
NEI 00-01, Revision 2 

May 2009 

B.1-35 

B.1-8 CONCLUSIONS 

This analysis investigates fire-induced circuit failure characteristics to determine if and 

under what conditions the MHIF failure mode poses a credible risk to post-fire safe 

shutdown. The analysis is based on objective test data and recognized engineering 

principles as documented in test reports, consensus standards, and other credible industry 

references. The analysis considers both likelihood and consequence, and also addresses 

analysis uncertainty for critical results. 

A Base Case set of conditions has been established to define the limits of applicability for 

the analysis. Within the defined limits, this MHIF analysis is intended to serve as a 

generic evaluation and is considered to satisfy the regulatory requirement that high 

impedance faults be considered in the analysis of associated circuits. Circumstances that 

fall outside the defined Base Case will require a plant specific analysis. 

A detailed analysis of fault characteristics for the voltage levels of interest indicates that 

these faults do not exhibit characteristics that coincide with that of concern for MHIFs. 

The analysis supports a conclusion that the probability of MHIFs for power supplies 

conforming to the Base Case is sufficiently low to classify the failure mode as an 

incredible event that does not pose a credible risk to post-fire safe shutdown. 

The results and conclusions of this analysis may be used to support a licensing basis 

change (using an approved regulatory process) under the following condition: 

 The power supply conforms to the Base Case requirements. 
NEI 00-01, Revision 2 

May 2009 

B.1-36 

B.1-9 REFERENCES 

NRC Documents 

1. Regulatory Guide 1.189, Fire Protection for Operating Nuclear Power Plants, 

U.S. Nuclear Regulatory Commission: April 2001. 

2. Generic Letter 86-10, Implementation of Fire Protection Requirements, U.S. 

Nuclear Regulatory Commission: April 24, 1986. 

3. F.J. Wyant and S.P. Nowlen, Cable Insulation Resistance Measurements Made 

During Cable Fire Tests, Sandia National Laboratories, Albuquerque, NM: June 

2002. USNRC NUREG/CR-6776, SAND2002-0447P. 

4. Olan D. Parr to ASB Members Note, dated November 30, 1984. Subject: Fire 

Protection Review Guidance. 

Consensus Codes & Standards 

5. ANSI/IEEE C37 Series Standards, Power Energy: Switchgear Collection, 1998 

Edition. 

6. IEEE 141-1993 (R1999), IEEE Recommended Practice for Electric Power 

Distribution for Industrial Plant. (Red Book) 

7. ANSI/IEEE 242-1986 (2001), IEEE Recommended Practice for Protection and 

Coordination of Industrial and Commercial Power Systems. (Buff Book) 

8. ANSI/IEEE 1015-1997, IEEE Recommended Practice for Applying Low-Voltage 

Circuit Breakers Used in Industrial and Commercial Power Systems. (Blue 

Book). 

9. ANSI IEEE 383-1974 (R1980), IEEE Standard for Type Test of Class 1E Electric 

Cables, Field Splices and Connections for Nuclear Generating Stations. 

10. ANSI/NFPA 70, National Electrical Code, 2002 Edition. 

11. NEMA ICS-1-1993, Table 7-2, “Clearance and Creepage Distance for Use Where 

Transient Voltage are Controlled and Known.” 
NEI 00-01, Revision 2 

May 2009 

B.1-37 

Industry Documents 

12. Characterization of Fire-Induced Circuit Failures: Results of Cable Fire Testing, 

EPRI, Palo Alto, CA: 2002. 1003326. 

13. J.R. Dunki-Jacobs, “The Effects of Arcing Ground Faults on Low-Voltage 

System Design,” IEEE Transactions on Industrial Applications, Vol. IA-8 No. 3:

May/June 1972, pp 223-230. 

14. J.R. Dunki-Jacobs, “The Escalating Arcing Ground-Fault Phenomenon,” IEEE 

Transactions on Industrial Applications, Vol. IA-22 No. 6: November/December 

1986, pp 1156-1161. 

15. L.E. Fisher, “Resistance of Low-Voltage Alternating Current Arc,” Conference 

Record of the 1970 Annual Meeting of the IEEE Industry and General 

Applications Group: October 1970, pp 237-254. 

16. J.A. Gienger, O.C. Davidson, and R.W. Brendel, “Determination of Ground-Fault 

Current on Common A-C Grounded-Neutral Systems in Standard Steel or 

Aluminum Conduit,” AIEE Transactions on Applications and Industry, Part II, 

Vol. 79: 1960, pp84-90. 

17. R.H. Kaufmann, “Some Fundamentals of Equipment Grounding Circuit Design,” 

AIEE Transactions on Applications and Industry, Part II, Vol. 73: 1954, pp 227-

231. 

18. R.H. Kaufmann and J.C. Page, “Arcing Fault Protection for Low-Voltage Power 

Distribution Systems - Nature of Problem,” AIEE Transactions Part III, Power 

Apparatus and Systems, Vol. 79 (Paper 60-83): June 1960, pp 160-167. 

19. R.H. Kaufmann, “Ignition and Spread of Arcing Faults,” 1969 Industrial and 

Commercial Power Systems and Electric Space Heating and Air Conditioning 

Joint Technical Conference: May 1969, pp 70-72. 

20. Kusko and S.M. Peeran, “Arcing Fault Protection of Low-Voltage Distribution 

Systems in Buildings,” Conference Record of the 1987 IEEE Industry 

Applications Society Annual Meeting, Part I: October 1987, pp 1385-1389. 

21. F.J. Shields, “The Problem of Arcing Faults in Low-Voltage Power Distribution 

Systems,” IEEE Transactions on Industrial and General Applications, Vol. IGA-3 

No. 1: January/February 1967, pp 15-25. 

22. C.F. Wagner and L.L. Fountain, “Arcing Fault Currents in Low-Voltage A-C 

Circuits,” AIEE Transactions, Part I, Vol. 67: 1948, pp166-174. 
NEI 00-01, Revision 2 

May 2009 

B.1-38 

Miscellaneous 

23. William, J. Statistics for Nuclear engineers and Scientists, Part 1: Basic 

Statistical Inference, Department of Energy, Washington DC: February 1981. 

WAPD-TM-1292. 

24. Hahn, Gerald J. and Meeker, William O. Statistical Intervals, A Guide for 

Practitioners, John Wiley & Sons, Inc., Canada: 1991. 

25. Stevenson, William D. Elements of Power System Analysis, McGraw-Hill: 1992. 

26. Power Plant Practices to Ensure Cable Operability, EPRI, Palo Alto, CA: July 

1992. NP-7485. 

27. Appendix R Multiple High Impedance Cable Fault Flame Test Report, 

Philadelphia Electric Company, Philadelphia, PA: May 27, 1988. 
NEI 00-01, Revision 2 

May 2009 

C-1 

APPENDIX C

HIGH / LOW PRESSURE INTERFACES 

C.1 PURPOSE 

The purpose of this appendix is to identify considerations necessary to address the issue 

of circuit analysis of high/low pressure interface components. 

C.2 INTRODUCTION 

10 CFR 50 Appendix R analyses must evaluate the potential for spurious operations that 

may adversely affect the ability to achieve and maintain safe shutdown. A subset of 

components considered for spurious operation involves reactor coolant pressure boundary 

(RCPB) components whose spurious operation can lead to an unacceptable loss of reactor 

pressure vessel/Reactor Coolant System (RPV/RCS) inventory via an interfacing system 

loss of coolant accident (ISLOCA). Because an ISLOCA is a significant transient, it may 

be beyond the capability of a given safe shutdown path to mitigate. As a result of this 

concern, selected RCPB valves are defined as high/low pressure interface valve 

components requiring special consideration and criteria. 

Note: As part of industry efforts to support transition of fire protection programs to 10 

CFR 50.48(c) (NFPA 805), a Frequently Asked Question (FAQ) 06-0006 was written to 

clarify the definition of high/low pressure interface components. In the closure memo for 

FAQ 06-0006 dated March 12, 2007, the NRC stated: 

“...the staff concluded that the definition provided in NEI-00-01 for the term 

“high-low pressure interface” is acceptable.” 

C.3 IDENTIFYING HIGH/LOW PRESSURE INTERFACE COMPONENTS

Regulatory Guidance

The criteria for defining high/low interface valve components are described in the 

following NRC documents. 

Generic Letter 81-12 states, in part: 

The residual heat removal system is generally a low pressure system that 

interfaces with the high pressure primary coolant system. To preclude a LOCA 

through this interface, we require compliance with the recommendations of 

Branch Technical Position RSB 5-1. It is our concern that this single fire could 

cause the two valves to open resulting in a fire initiated LOCA. 
NEI 00-01, Revision 2 

May 2009 

C-2 

BTP RSB 5-1, Rev. 2 Dated July 1981 states in part: 

B. RHR System Isolation Requirements 

The RHR system shall satisfy the isolation requirements listed below. 

1. The following shall be provided in the suction side of the RHR system to 

isolate it from the RCS. 

a. Isolation shall be provided by at least two power-operated valves in 

series. The valve positions shall be indicated in the control room. 

b. The valves shall have independent diverse interlocks to prevent the 

valves from being opened unless the RCS pressure is below the RHR 

system design pressure. Failure of a power supply shall not cause any 

valve to change position. 

c. The valves shall have independent diverse interlocks to protect against 

one or both valves being open during an RCS increase above the 

design pressure of the RHR system. 

2. One of the following shall be provided on the discharge side of the RHR 

system to isolate it from the RCS: 

a. The valves, position indicators, and interlocks described in item 1(a) 

thru 1(c) above, 

b. One or more check valves in series with a normally closed poweroperated valve. The power-operated valve position shall be indicated 

in the control room. If the RHR system discharge line is used for an 

ECCS function, the power-operated valve is to be opened upon receipt 

of a safety injection signal once the reactor coolant pressure has 

decreased below the ECCS design pressure. 

c. Three check valves in series, or 

d. Two check valves in series, provided that there are design provisions 

to permit periodic testing of the check valves for leak tightness and the 

testing is performed at least annually. 

NRC Information Notice 87-50 reiterates: 

Appendix R also states that for these areas, the fission product boundary integrity 

shall not be affected, i.e., there shall be no rupture of any primary coolant 

boundary. Thus, for those low pressure systems that connect to the reactor 

coolant system (a high pressure system), at least one isolation valve must remain 

closed despite any damage that may be caused by fire. Since the low pressure 
NEI 00-01, Revision 2 

May 2009 

C-3 

system could be designed for pressures as low as 200 to 400 psi, the high pressure 

from the reactor coolant system (approximately 1000 to 1200 psi for BWRs and 

2000 to 2200 psi for PWRs) could result in failure of the low pressure piping. In 

many instances, the valves at the high pressure to low pressure interface are not 

designed to close against full reactor coolant system pressure and flow 

conditions. Thus, spurious valve opening could result in a LOCA that cannot be 

isolated, even if control of the valve can be reestablished. 

The NRC has taken the position that high/low pressure interface equipment must be 

evaluated to more stringent requirements than non-high/low pressure interfaces when 

considering spurious operations. The purpose of the requirements is to ensure that a fireinduced LOCA does not occur. 

The NRC concern is one of a breach of the RCS boundary, by failure of the downstream 

piping due to a pipe rupture outside of Primary Containment. However, if the spurious 

opening of RCS boundary valves cannot result in a pipe rupture (i.e., downstream piping 

is rated for the range of RCS pressures), then the subject boundary valves do not 

constitute high/low pressure interfaces. The following combinations of valves are 

typically evaluated for inclusion as high/low pressure interface concerns: 

a. RCS to shutdown cooling system (e.g., Residual Heat Removal/Decay Heat 

Removal, etc.) suction valves. 

b. RCS letdown isolation valves (e.g., letdown to radwaste, condensate (BWRs), 

main condenser (BWRs) or volume control system (PWRs). 

c. RCS high point vent isolation valves 

Although, the use of this list of valves would represent a bounding list of high low 

pressure interface valves of concerns, not all of these valves meet the original criteria 

identified in GL 81-12, nor is RSB 5-1 applicable to each example. This expansion in 

scope is the result of conservative interpretations by licensees and the NRC as safe 

shutdown compliance strategies at individual plants have evolved. 

Based on the above guidance, the following criterion is established to determine if a 

RCPB valve is considered a high/low pressure interface valve component: A valve whose 

spurious opening could result in a loss of RPV/RCS inventory and, due to the lower 

pressure rating on the downstream piping, an interfacing LOCA outside of Primary 

Containment (i.e., pipe rupture in the low pressure piping).

Although spurious relief valve operations do result in a loss of RPV/RCS inventory, the 

down stream piping is designed for the discharge pressures. As a result, spurious relief 

valve operation will not result in an interfacing system LOCA and spurious relief valve 

operation is not considered to be a high low pressure interface condition. Similarly, A 

PORV/PORV Block Valve pathway that could result in a similar fluid path loss concern 

is not considered to be a high/low pressure interface condition.. Even though this 

PORV/PORV Block Valve pathway could result in the eventual rupture of the pressurizer 

relief tank rupture disk, this is not a piping system failure and, as such, does not require 

the PORV/PORV Block Valve pathway to be treated as a high/low pressure interface. 
NEI 00-01, Revision 2 

May 2009 

C-4 

C.4 CIRCUIT ANALYSIS CONSIDERATIONS 

The specific differences made in addressing circuit analysis of high/low pressure 

interface components are described in NRC Generic Letter 86-10, Question 5.3.1, which 

requests a clarification on the classification of circuit failure modes. The question and 

the response are provided below. 

5.3.1 Circuit failure modes 

Question

What circuit failure modes must be considered in identifying circuits associated by 

spurious actuation? 

Response

Sections III.G.2 and III.L.7 of Appendix R define the circuit failure modes as hot shorts, 

open circuits, and shorts to ground. For consideration of spurious actuations, all 

possible functional failure states must be evaluated, that is, the component could be 

energized or de-energized by one or more of the above failure modes. Therefore, valves 

could fail open or closed; pumps could fail running or not running, electrical distribution 

breakers could fail open or closed. For three-phase AC circuits, the probability of 

getting a hot short on all three phases in the proper sequence to cause spurious operation 

of a motor is considered sufficiently low as to not require evaluation except for any cases 

involving Hi/Lo pressure interfaces. For ungrounded DC circuits, if it can be shown that 

only two hot shorts of the proper polarity without grounding could cause spurious 

operation, no further evaluation is necessary except for any cases involving Hi/Lo 

pressure interfaces. 

The response to Question 5.3.1 establishes a basis for limiting the number of credible 

circuit failure modes that need to be postulated for non-high/low pressure interface 

components. At the same time it implies that further evaluation is required when 

considering circuit failures of high/low pressure interface components. Further 

evaluation is required for cases involving high/low pressure interfaces, specifically, the 

case of two hot shorts on an ungrounded DC circuit. The discussion involving the DC 

circuit implies that two hot shorts need not be postulated except for high/low pressure 

interface components. 

High/low pressure interface valves are identified separately from other safe shutdown 

components because the cable fault analysis and the effects on safe shutdown due to 

spurious operation of the high/low interface valves are evaluated more stringently than 

the safe shutdown components. The potential for spuriously actuating redundant valves 

in any one high/low pressure interface as a result of a fire in a given fire area must also be 

postulated. This includes considering the potential for a fire to spuriously actuate both 

valves from a selective hot short on different cables for each valve. 
NEI 00-01, Revision 2 

May 2009 

C-5 

C.5 FIRE AREA ASSESSMENT OF HIGH/LOW PRESSURE INTERFACES 

Figure C-1 

High/Low Pressure Interface Example 

RPV

High/Low Pressure

Interface Valves

RHR Shutdown

Cooling Suction Line

High

Pressure

Piping

Low

Pressure

Piping

Prim ary

Containm ent

N.C./ Req'd Closed N.C./ Req'd Closed

In this example, the postulated fire damage is evaluated for two cases. In the first case, 

Case (a), the fire is assumed to have the potential to cause the spurious opening of one of 

the two series normally closed high/low pressure interface valves. In the second case, 

Case (b), the fire is assumed to have the potential to cause the spurious opening of both 

series high/low pressure interface valves. 

Case (a):

For this case, the spurious opening of either one of the two series high/low pressure 

interface valves can be justified on the basis that the other valve will remain closed and 

prevent an interfacing system LOCA. 

Case (b):

For this case, the argument applied above would be unacceptable. Examples of 

acceptable alternatives would be to protect the control circuits for either valve in the fire 
NEI 00-01, Revision 2 

May 2009 

C-6 

area, to reroute the spurious circuits or to de-power one of the valves to prevent spurious 

opening. When using this latter option, it must be assured that a three-phase hot short 

cannot cause the spurious opening of the valve. This can be done by assuring that no 

three phase cables of the same or higher voltage are routed in the same raceway between 

the MCC and the valve. 

A mitigating action may be taken prior to the start of the fire event that precludes the 

condition from occurring, or a post-fire action may be taken that mitigates the effects of 

the condition prior to it reaching an unrecoverable condition relative to safe shutdown, if 

this can be shown to be feasible. When mitigating actions are taken, they must comply 

with the applicable regulations and licensing bases. 

C.6 REFERENCES 

C.6.1 Branch Technical Position BTP RSB 5-1 Rev. 2, July 1981. 

C.6.2 Generic Letter 81-12, “Fire Protection Rule,” February 20, 1981. 

C.6.3 Generic Letter 86-10 “Implementation of Fire Protection Requirements,” April 

24, 1986. 

C.6.4 IN 87-50 – Potential LOCA at High and Low Pressure Interfaces from Fire 

Damage, October 9, 1987. 
NEI 00-01, Revision 2 

May 2009 

D-1 

APPENDIX D

ALTERNATIVE/DEDICATED SHUTDOWN REQUIREMENTS 

D.1 PURPOSE 

The purpose of this appendix is to provide the requirements for alternative and dedicated 

shutdown that are distinct and different from the requirements for redundant shutdown. 

Refer to the introduction to Appendix G for information on the treatment of MSOs for 

III.G.3 areas. 

D.2 INTRODUCTION 

The use of alternative/dedicated shutdown capability is required in those specific fire 

areas where protection of a redundant safe shutdown path from the effects of fire was not 

possible. Alternative/dedicated shutdown capability is generally specified for the control 

room. Other plant areas where alternative/dedicated shutdown capability may be 

required include the cable spreading room, electrical distribution room, relay room(s), or 

other plant areas where significant quantities of control cables are routed and redundant 

trains of safe shutdown equipment have not been separated in accordance with the 

requirements specified in Section III.G.2 of Appendix R. The areas where alternative or 

dedicated shutdown is credited are defined in the licensing basis documents for each 

plant. Use of the term alternative or dedicated shutdown is applied to the specific plant 

area(s) and not to the equipment or methodology (capability) employed to achieve safe 

shutdown. The alternative/dedicated shutdown capability may be different for each of 

the defined areas. Manual actions may be utilized for alternative/dedicated shutdown 

capability in accordance with NRC requirements and guidance. 

Alternative/dedicated shutdown capability requires physical and electrical independence 

from the area of concern. This is usually accomplished with isolation/transfer switches, 

specific cable routing and protection, and remote/auxiliary shutdown panel(s). The 

alternative/dedicated safe shutdown system(s) must be able to be powered from the onsite 

power supplies, which must be physically and electrically independent from the area 

under consideration. The availability or loss of offsite power and loss of automatic 

initiation logic signals must be accounted for in the equipment and systems selected or 

specified. All activities comprising the alternative/dedicated shutdown capability are 

considered mitigating actions and need to be evaluated against regulatory acceptance 

criteria to ensure that the goals and criteria in Section III.L are met. 

Appendix R Section III.G.3 requires that the equipment, cabling, and associated circuits 

required for alternative shutdown must be independent of the fire area being evaluated. 

Therefore, in the case of a control room fire, the safe shutdown systems and components 

may be similar to those used in other areas for redundant shutdown; however, they must 

be physically located outside the fire area and, if required, the control of the components 

must be electrically isolated by transferring control to a remote/auxiliary shutdown 
NEI 00-01, Revision 2 

May 2009 

D-2 

panel(s). Examples of components and cables that must be physically and electrically 

independent of the control room for alternative or dedicated shutdown use include the 

components that can be controlled from a remote/auxiliary shutdown panel and the cables 

that provide control from that panel once they are isolated from the control room circuit. 

GL 81-12 requested, in support of the regulatory requirement in 10CFR50.48 Paragraph 

(c), that each Appendix R plant submit its modification plans for their alternative 

shutdown capability for prior staff review and approval. These submittals typically 

included details of the proposed isolation/transfer design. 

This appendix describes those aspects of the methodology and guidance for 

alternative/dedicated shutdown that are different from the methodology and guidance 

applied for redundant post-fire safe shutdown in the body of this document. Section D.3 

overviews the methodology as it relates to control room fires, since the control room is 

the fire area where alternative shutdown is predominantly used. Section D.4 describes 

the regulatory requirements for alternative and dedicated shutdown. Section D.5 itemizes 

the differences in shutdown methodology between alternative/dedicated shutdown and 

those supplied in the body of this document for redundant shutdown. Section D.6 

recommends additional operator actions that should be considered for use on a plantunique basis for fires requiring control room evacuation. 

D.3 OVERVIEW 

Since many nuclear plants use the alternative/dedicated shutdown scheme exclusively for 

a control room fire, this overview addresses this fire location only. An exposure fire in 

the Control Room of an operating nuclear power plant would be a potentially serious 

event. The likelihood of a control room fire, however, is considered to be small. The 

worst-case expected fire for a control room would be one that is contained within a single 

section of a control panel. This is true because the control room is continuously manned, 

the introduction of combustible materials and ignition sources is strictly controlled, and 

the fire protection and separation features designed into the control room are focused on 

the prevention of such an event. The expected plant response to this type of event would 

be to immediately extinguish the fire and to determine the need to initiate 

alternative/dedicated shutdown. While the fire is being extinguished, assuming that the 

Control Room remains habitable, the remaining Control Room operators would continue 

to perform their duties as trained, responding to alarms and monitoring important plant 

parameters. 

Despite this, the post-fire safe shutdown analysis for a control room fire must assume fire 

damage to all of the systems and equipment located within the Control Room fire area. 

Additionally, the analysis assumes that all automatic functions will be lost and a loss of 

offsite power either has occurred or has not occurred (both cases must be considered). 
NEI 00-01, Revision 2 

May 2009 

D-3 

Consequently, the operators will be forced to evacuate the control room and to safely shut 

down the unit from an emergency control station(s). The size and intensity of the 

exposure fire necessary to cause this damage are not determined, but are assumed to be 

capable of occurring regardless of the level of combustibles in the area, the ignition 

temperatures of these combustible materials, the lack of an ignition source, the presence 

of automatic or manual suppression and detection capability, and the continuous manning 

in the control room. 

Generic Letter 86-10, Response to Question 5.3.10, states, “Per the criteria of Section 

III.L of Appendix R a loss of offsite power shall be assumed for a fire in any fire area 

concurrent with the following assumptions: 

a. The safe shutdown capability should not be adversely affected by any one spurious 

actuation or signal resulting from a fire in any plant area; and 

b. The safe shutdown capability should not be adversely affected by a fire in any plant 

area which results in the loss of all automatic function (signals, logic) from the 

circuits located in the area in conjunction with one worst case spurious actuation 

or signal resulting from the fire; and 

c. The safe shutdown capability should not be adversely affected by a fire in any plant 

area which results in spurious actuation of the redundant valves in any one highlow pressure interface line. 

The analysis must consider the effects of each potential spurious operation and the 

mitigating action(s) that may be necessary for each. These conservative assumptions 

form the design basis for control room fire mitigation. 

As with the post-fire safe shutdown analysis performed in areas where redundant safe 

shutdown paths are used, the analyst must be cautious not to improperly apply the 

conservative assumptions described above, for example, the assumption that unprotected 

circuits in a given fire area are damaged by the fire. This assumption is conservative only 

in terms of not being able to credit the systems and equipment associated with these 

circuits in support of post-fire safe shutdown. If the analyst, however, were to assume 

that these circuits were to be damaged by the fire when this provided an analytical 

advantage, this would be non-conservative. For example, assuming that fire damage 

results in a loss of offsite power may be non-conservative in terms of heat load 

assumptions used in an analysis to determine the need for HVAC systems. 

D.4 APPENDIX R REGULATORY REQUIREMENTS AND GUIDANCE 

Appendix R Section III.G.3 provides the requirements for alternative or dedicated 

shutdown capability used to provide post-fire safe shutdown. Section III.G.3 states: 

3. Alternative or dedicated shutdown capability and its associated circuits,

1

independent of cables, systems or components in the areas, room or zone 

under consideration, shall be provided: 
NEI 00-01, Revision 2 

May 2009 

D-4 

a. Where the protection of systems whose function is required for hot 

shutdown does not satisfy the requirement of paragraph G.2 of this 

section; or 

b. Where redundant trains of systems required for hot shutdown located in 

the same fire area may be subject to damage from fire suppression 

activities or from the rupture or inadvertent operation of fire suppression 

systems. 

 In addition, fire detection and a fixed fire suppression system shall be 

installed in the area, room, or zone under consideration. 

 III.G.3 Footnote 1 - Alternative shutdown capability is provided by rerouting, 

relocating or modification of existing systems; dedicated shutdown capability 

is provided by installing new structures and systems for the function of postfire shutdown. 

To satisfy the requirements of Section III.G.3 and use alternative or dedicated shutdown 

capability, the cables, systems or components comprising the alternative or dedicated 

shutdown capability must be independent of the area under consideration. 

Alternative/dedicated shutdown capability meeting the requirements of Section III.G.3 

must satisfy the requirements of Section III.L. Section III.L.1 provides requirements on 

the shutdown functions required for the systems selected for alternative/dedicated 

shutdown. It also provides the minimum design criterion for the systems performing 

these functions. 

L. Alternative and dedicated shutdown capability. 

1. Alternative or dedicated shutdown capability provided for a specific fire area 

shall be able to (a) achieve and maintain subcritical reactivity conditions in 

the reactor; (b) maintain reactor coolant inventory; (c) achieve and maintain 

hot standby2

 conditions for a PWR (hot shutdown2 for a BWR), (d) achieve 

cold shutdown conditions within 72 hours; and (e) maintain cold shutdown 

conditions thereafter. During the postfire shutdown, the reactor coolant 

system process variables shall be maintained within those predicted for a loss 

of normal a.c. power, and the fission product boundary integrity shall not be 

affected; i.e., there shall be no fuel clad damage, rupture of any primary 

coolant boundary, or rupture of the containment boundary. 

III.L.1 Footnote 2 – As defined in the Standard Technical Specifications. 

III.G.3 Footnote 1 – Alternative shutdown capability is provided by rerouting, 

relocating or modification of existing systems; dedicated shutdown capability 

is provided by installing new structures and systems for the function of postfire shutdown. 
NEI 00-01, Revision 2 

May 2009 

D-5 

 

When utilizing the alternative or dedicated shutdown capability, transients, e.g. fireinduced spurious operations that cause deviations in system process variables from those 

expected conditions for a normal shutdown resulting from a loss of normal a.c. have been 

previously evaluated. A short-duration partial core uncovery (approved for BWRs when 

using alternative or dedicated shutdown capability) and a short duration of RCS level 

below that of the level indication in the pressurizer for PWRs are two such transients. 

These transients do not lead to unrestorable conditions and thus have been deemed to be 

acceptable deviations from the performance goals30. For Appendix R plants, these 

conditions may not meet the requirements of III.L and an exemption request may be 

needed. 

Section III.L.2 identifies the performance goals for the shutdown functions of 

alternative/dedicated shutdown systems as follows:

2. The performance goals for the shutdown functions shall be: 

a. The reactivity control function shall be capable of achieving and 

maintaining cold shutdown reactivity conditions. 

b. The reactor coolant makeup function shall be capable of maintaining the 

reactor coolant level above the top of the core for BWRs and be within 

the level indication in the pressurizer for PWRs. 

c. The reactor heat removal function shall be capable of achieving and 

maintaining decay heat removal. 

d. The process monitoring function shall be capable of providing direct 

readings of the process variables necessary to perform and control the 

above functions. 

e. The supporting functions shall be capable of providing the process 

cooling, lubrication, etc., necessary to permit the operation of the 

equipment used for safe shutdown functions. 

When utilizing the alternative or dedicated shutdown capability, transients that cause 

deviations from the makeup function criteria (i.e., 2.b above) have been previously 

evaluated. A short-duration partial core uncovery (approved for BWRs when using 

alternative or dedicated shutdown capability) and a short duration of RCS level below 

that of the level indication in the pressurizer for PWRs are two such transients. These 

transients do not lead to unrestorable conditions and thus have been deemed to be 

30 NRC Letter December 12, 2000 (ML003776828) states, with respect to BWRs, “The staff reiterates its 

longstanding position that SRV/LPS is an appropriate means of satisfying Section III.G.3 of Appendix R (regardless 

of whether SRV/LPS can be considered to be a means of redundant hot shutdown capability). Later the staff also 

concludes that “SRV/LPS meets the requirements of a redundant means of post-fire safe shutdown under Section 

III.G.2 of 10 CFR Part 50, Appendix R.” NRC Memorandum from Sunil Weerakkody, Chief Fire Protection and 

Special Projects Section, to John Hannon, Chief Plant Systems Branch, Resolution of Questions Concerning 

Compliance with Section III.L.2 of Appendix R, dated February 10, 2005 (ML050330417) 
NEI 00-01, Revision 2 

May 2009 

D-6 

 

acceptable deviations from the performance goals31. For Appendix R plants, these 

conditions may not meet the requirements of III.L and an exemption request may be 

needed. 

Section III.L.7 also highlights the importance of considering associated non-safety 

circuits for alternative shutdown capability by stating the following: 

“The safe shutdown equipment and systems for each fire area shall be known to 

be isolated from associated non-safety circuits in the fire area so that hot shorts, 

open circuits, or shorts to ground in the associated circuits will not prevent 

operation of the safe shutdown equipment.” 

Additional guidance on the topic of alternative/dedicated shutdown has been provided in 

the following documents: 

 NRC Generic Letter 81-12 

 NRC Information Notice 84-09 

 NRC Generic Letter 86-10. 

Furthermore, based on the guidance information in IN 85-09 as indicated below, the 

availability of redundant fusing should be considered when relying on transfer switches. 

During a recent NRC fire protection inspection at the Wolf Creek facility, it was 

discovered that a fire in the control room could disable the operation of the plant's 

alternate shutdown system. Isolation transfer switches of certain hot shutdown systems 

would have to be transferred to the alternate or isolated position before fire damage 

occurred to the control power circuits of several essential pumps and motor-operated 

valves at this facility. If the fire damage occurred before the switchover, fuses might blow 

at the motor control centers or local panels and require replacements to make the 

affected systems/components operable. This situation existed because the transfer scheme 

depended on the existing set of fuses in the affected circuit and did not include redundant 

fuses in all of the alternate shutdown system circuits. For most of the transfer switches, 

the situation would not cause a problem because the desired effect after isolation is the 

deenergization of power. In instances where the system/component has to be operable or 

where operation might be required to override a spurious actuation of a component (such 

as a motor-operated valve), replacement of fuses may have become necessary. In such 

cases, troubleshooting/repair would be required to achieve or maintain hot shutdown. 

31 NRC Letter December 12, 2000 (ML003776828) states, with respect to BWRs, “The staff reiterates its 

longstanding position that SRV/LPS is an appropriate means of satisfying Section III.G.3 of Appendix R (regardless 

of whether SRV/LPS can be considered to be a means of redundant hot shutdown capability).” Later the staff also 

concludes that “SRV/LPS meets the requirements of a redundant means of post-fire safe shutdown under Section 

III.G.2 of 10 CFR Part 50, Appendix R.” NRC Memorandum from Sunil Weerakkody, Chief Fire Protection and 

Special Projects Section, to John Hannon, Chief Plant Systems Branch, Resolution of Questions Concerning 

Compliance with Section III.L.2 of Appendix R, dated February 10, 2005 (ML050330417) 
NEI 00-01, Revision 2 

May 2009 

D-7 

Additional guidance for selecting the process monitoring functions for alternative 

shutdown is provided in IN 84-09 as indicated in the following excerpt from GL 86-10. 

1. Process Monitoring Instrumentation 

Section III.L.2.d of Appendix R to 10 CFR Part 50 states that “the process 

monitoring function shall be capable of providing direct readings of the process 

variables necessary to perform and control” the reactivity control function. In 

I&E Information Notice 84-09, the staff provides a listing of instrumentation 

acceptable to and preferred by the staff to demonstrate compliance with this 

provision. While this guidance provides an acceptable method for compliance 

with the regulation, it does not exclude other alternative methods of compliance. 

Accordingly, a licensee may propose to the staff alternative instrumentation to 

comply with the regulation (e.g., boron concentration indication). While such a 

submittal is not an exemption request, it must be justified based on a technical 

evaluation. 

For Appendix R Section III.G.3, the area/room/zone under consideration should be 

provided with a fixed suppression system and fire detection. 

Additional guidance regarding the requirements for suppression and detection in rooms 

or fire zones relying on alternative/dedicated shutdown is provided in GL 86-10 Question 

3.1.5. 

3.1.5 Fire Zones 

QUESTION 

Appendix R, Section III.G.3 states “alternative or dedicated shutdown capability 

and its associated circuits, independent of cables, systems or components in the 

area room or zone under consideration....” What is the implied utilization of a 

room or zone concept under Section III.G of Appendix R? The use of the 

phraseology “area, room or zone under consideration” is used again at the end 

of the Section III.G.3. Does the requirement for detection and fixed suppression 

indicate that the requirement can be limited to a fire zone rather than throughout 

a fire area? Under what conditions and with what caveats can the fire zone 

concept be utilized in demonstrating conformance to Appendix R? 

RESPONSE 

Section III.G was written after NRC's multi-discipline review teams had visited all 

operating power plants. From these audits, the NRC recognized that it is not 

practical and may be impossible to subdivide some portions of an operating plant 

into fire areas. In addition, the NRC recognized that in some cases where fire 

areas are designated, it may not be possible to provide alternate shutdown 

capability independent of the fire area and, therefore, would have to be evaluated 
NEI 00-01, Revision 2 

May 2009 

D-8 

on the basis of fire zones within the fire area. The NRC also recognized that 

because some licensees had not yet performed a safe shutdown analysis, these 

analyses may identify new unique configurations. 

To cover the large variation of possible configurations, the requirements of 

Section III.G were presented in three Parts: 

Section III.G.l requires one train of hot shutdown systems be free of fire damage 

and damage to cold shutdown systems be limited. [NRC has stated that 1) Section 

III.G.2 does not allow the use of operator manual actions without prior approval 

to demonstrate compliance with Section III.G.2 when redundant trains are located 

in the same fire area, and 2) despite Section III.G.1, compliance with Section 

III.G.2 needs to be demonstrated when redundant trains are located in the same 

fire area. Rulemaking currently in progress will impact this position. Repairs to, 

or manual operation of, equipment required for cold shutdown are allowed in 

accordance with current regulations and regulatory guidance.] 

Section III.G.2 provides certain separation, suppression and detection 

requirements within fire areas; where such requirements are met, analysis is not 

necessary. [As clarified in Section 3.4.1.6 of this document (excepting 

emergency control stations), depending on a plant’s licensing basis, exemption 

requests, deviation requests and GL 86-10, Fire Hazards Evaluations or Fire 

Protection Design Change Evaluations may be used to demonstrate equivalency to 

the separation requirements of Section III.G.2 as long as the ability to achieve and 

maintain safe shutdown is not adversely affected.] [Note the current NRC 

position above on the use of unapproved operator manual actions] 

Section III.G.3 requires alternative dedicated shutdown capability for 

configurations that do not satisfy the requirements of III.G.2 or where fire 

suppressants released as a result of fire fighting, rupture of the system or 

inadvertent operation of the system may damage redundant equipment. If 

alternate shutdown is provided on the basis of rooms or zones, the provision of 

fire detection and fixed suppression is only required in the room or zone under 

consideration. 

Section III.G recognizes that the need for alternate or dedicated shutdown 

capability may have to be considered on the basis of a fire area, a room or a fire 

zone. The alternative or dedicated capability should be independent of the fire 

area where it is possible to do so (See Supplementary Information for the final 

rule Section III.G). When fire areas are not designated or where it is not possible 

to have the alternative or dedicated capability independent of the fire area, 

careful consideration must be given to the selection and location of the alternative 

or dedicated shutdown capability to assure that the performance requirement set 

forth in Section III.G.l is met. Where alternate or dedicated shutdown is provided 

for a room or zone, the capability must be physically and electrically independent 

of that room or zone. The vulnerability of the equipment and personnel required 

at the location of the alternative or dedicated shutdown capability to the 
NEI 00-01, Revision 2 

May 2009 

D-9 

environments produced at that location as a result of the fire or fire suppressant's 

must be evaluated. 

These environments may be due to the hot layer, smoke, drifting suppressants, 

common ventilation systems, common drain systems or flooding. In addition, 

other interactions between the locations may be possible in unique 

configurations. 

If alternate shutdown is provided on the basis of rooms or zones, the provision of 

fire detection and fixed suppression is only required in the room or zone under 

consideration. Compliance with Section III.G.2 cannot be based on rooms or 

zones. 

See also Sections #5 and #6 of the “Interpretations of Appendix R.” 

Additional guidance regarding alternative shutdown is found in GL 86-10 Enclosure 1 

“Interpretations of Appendix R” and Enclosure 2 “Appendix R Questions and Answers” 

Section 5. Question 5.3.10 of GL 86-10 addresses the plant transients to be considered 

when designing the alternative or dedicated shutdown system: 

5.3.10 Design Basis Plant Transients 

QUESTION 

What plant transients should be considered in the design of the alternative or 

dedicated shutdown systems? 

RESPONSE 

Per the criteria of Section III.L of Appendix R a loss of offsite power shall be 

assumed for a fire in any fire area concurrent with the following assumptions: 

a. The safe shutdown capability should not be adversely affected by any one 

spurious actuation or signal resulting from a fire in any plant area; and 

b. The safe shutdown capability should not be adversely affected by a fire in any 

plant area which results in the loss of all automatic function (signals, logic) from 

the circuits located in the area in conjunction with one worst case spurious 

actuation or signal resulting from the fire; and 

c. The safe shutdown capability should not be adversely affected by a fire in any 

plant area which results in spurious actuation of the redundant valves in any one 

high-low pressure interface line. 

The response to question 5.3.10 provides a bounding plant transient which describes the 

expected worse case conditions for such an event. 
NEI 00-01, Revision 2 

May 2009 

D-10 

 The first condition that must be met is to be able to achieve and maintain safe 

shutdown in the event that offsite power is lost. This condition was specified as a 

part of the design basis because including a loss of offsite power during a fire where 

the protection of neither of the redundant trains can be protected provides a worstcase scenario. 

 The second condition that must be satisfied is that a single spurious operation 

resulting from a single spurious signal may occur as a result of the fire and this 

spurious operation cannot adversely impact the safe shutdown capability. This 

condition was specified because there is some potential for a spurious operation to 

occur due to the high concentration of equipment controls within areas like the 

Control Room where Alternative/Dedicated Shutdown may be required. The specific 

worst-case single spurious operation, however, was not defined. The requirement for 

addressing a worst-case spurious signal causing a worst-case single spurious 

operation is met by identifying any spurious operation that has the potential to 

adversely affect the safe shutdown capability and to evaluate the effects on the safe 

shutdown capability on a one-at-a-time basis. 

 The third condition is that it should be assumed that circuits for any automatic 

functions capable of mitigating the effects of the postulated spurious actuation that 

are located within the fire area are also defeated by the fire. This condition was 

prescribed in order to prevent crediting automatic functions for mitigating the effects 

of a worst-case single spurious signal when the controls for these automatic functions 

are also contained in an area such as the Control Room. 

 The fourth condition is that protection must be provided to assure that the safe 

shutdown capability is not adversely affected by a fire that causes the spurious 

actuation of two redundant valves in any high-low pressure interface line. Preventing 

the spurious actuation of two redundant valves in a high-low pressure interface during 

Alternative/Dedicated Shutdown is important because the systems available at the 

emergency control station may not be specifically designed to mitigate the effects of a 

LOCA. By imposing this condition, it eliminates the need to require additional 

systems to be installed on the emergency control station(s) with the capability to 

mitigate the effects of an interfacing-system LOCA. 

If the required safe shutdown path for Alternative/Dedicated Shutdown has the capability 

to perform all of the required safe shutdown functions and meet the requirements of the 

response to question 5.3.10, then an adequate level of safety is demonstrated for this 

unlikely event. 

Although GL 86-10 was issued after most Alternative Shutdown GL 81-12 submittals 

and NRC approvals were issued, the assumptions and criteria in GL 86-10 are generally 

consistent with what was used by licensees to design their Alternative Shutdown 

capability and by the NRC to perform their review of this capability. 
NEI 00-01, Revision 2 

May 2009 

D-11 

Because of its specialized nature, the alternative/dedicated shutdown capability needs to 

be specifically directed by plant procedure(s). The EOP in combination with off-normal 

procedures identifying specific potential fire impacts is an acceptable approach to 

meeting the requirement for plant procedures. Other regulatory acceptance criteria must 

also be met. 

D.5 METHODOLOGY DIFFERENCES APPLICABLE TO ALTERNATIVE /

DEDICATED SHUTDOWN

The following are the differences between the “baseline” methodology provided in the 

body of this document and the requirements that must be applied to alternative/dedicated 

shutdown. 

(1) The Alternative/Dedicated Shutdown capability must be physically and 

electrically independent of the area where the fire has occurred. Independence 

may be achieved via a combination of physical separation, manual manipulations, 

isolation devices, or isolation transfer switches. Where circuits are vulnerable to 

fire-induced faults prior to isolation being achieved, the design must address the 

potential for failure to occur prior to isolation, and restore functionality after the 

transfer (e.g., redundant fusing if credit is taken for functionality of the circuitry 

after transfer). In addition, repairs may be credited for equipment not required to 

achieve hot shutdown/hot-standby. (i.e., required to achieve and maintain cold 

shutdown). 

(2) The ability to achieve and maintain safe shutdown must be demonstrated with and 

without the availability of offsite power. 

(3) The design criteria described below applies wherein hot standby/hot shutdown 

can be achieved and maintained even considering the effects of one worst-case 

spurious signal/operation in conjunction with a loss of all automatic functions 

whose cables or equipment are located in the fire area. 

(4) Actuation of an isolation transfer switch is an acceptable technique for mitigating 

the effects of a potential spurious operation of the equipment controlled by the 

transfer switch. 

The isolation transfer switch must isolate the potential fault and restore the 

capability to operate the equipment at the remote or auxiliary shutdown panel, i.e. 

provide redundant fusing. 

Spurious operation prior to transfer must be assumed and the postulated spurious 

operation must not result in an unrecoverable condition, e.g. NRC IN 92-18. 
NEI 00-01, Revision 2 

May 2009 

D-12 

(5) Specific Shutdown Procedures must be developed for Alternative/Dedicated 

Shutdown. These procedures should address isolation transfer switch operation 

and should include provisions for actions required to address potential spurious 

operations prior to transfer, recovery from any postulated spurious operations and 

any actions necessary to establish required alignments altered by potential 

spurious operations. 

(6) Cold shutdown (as defined in Plant's Current Licensing Basis) must be capable of 

being achieved within 72 hours and maintained thereafter. 

(7) Areas where Alternative/Dedicated Shutdown is credited must have fixed 

suppression and detection. 

D.6 ADDITIONAL OPERATOR ACTIONS RECOMMENDED FOR CONTROL

ROOM EVACUATION 

The primary goal for Control Room fires is to achieve safe shutdown. Guidance on actions to be 

taken is found in Generic Letter 86-10 Question 3.8.4. The following additional operator 

actions, however, could be useful, if included in a plant’s Alternative/Dedicated Safe Shutdown 

Analysis and the procedures used for Alternative/Dedicated Shutdown, in helping to minimize 

the impact of the effects of a fire on the ability to safely shutdown the unit. 

The following actions should be considered for inclusion in the control room evacuation 

procedures as immediate operator actions to be performed prior to leaving the control room. 

These actions are in addition to performing the reactor scram/trip that is already endorsed for this 

event. 

• [BWR] A tie between the emergency operating procedure actions to affect the scram by 

either removing RPS Power or venting the scram instrument air header in the event that a 

control room scram is not achieved. [Reference NRC IN 2007-07] 

• Closing the Main Steam Isolation Valves. 

• [BWR] Closing the Main Steam drain lines. 

• [BWR] Tripping the feed pumps and closing the feed pump discharge valves. 

• [PWR] Isolation of letdown. [This is done at the Auxiliary Shutdown Panel for some 

PWRs.] 

The latter four (4) actions could be a benefit in minimizing the potential for flooding of the main 

steam lines outside of primary containment (BWRs), minimizing the potential of an overcooling 

event (PWRs), and conserving RCS inventory (PWRs). 
NEI 00-01, Revision 2 

May 2009 

D-13 

To prevent damage to equipment important to alternative post-fire safe shutdown at the remote 

or auxiliary shutdown panel, the following actions should be considered for immediate operator 

actions in the procedures governing shutdown at the remote or auxiliary shutdown panel (some 

of these actions are performed by operators not at the remote or auxiliary shutdown panel): 

• Upon arrival at the emergency control station, assure that the pumps (Service Water, 

Component Cooling Water, etc.) that provide cooling to the Emergency Diesel 

Generators are running. If the pumps are not running, start them immediately. [In the 

event of a loss of offsite power, the Emergency Diesel Generators may receive a start 

signal. If the pumps providing cooling to the Emergency Diesel Generators are not 

running, then the Diesel Generators could be damaged. Performing this action as an 

immediate operator action upon arrival at the emergency control station will provide 

added assurance that the Diesel Generators will not be damaged.] 

• Upon arrival at the emergency control station, assure that an open flow path exists for any 

pumps that are running. If the pump is running, but not injecting, then assure that the 

pump minimum flow valve is open. If the pump minimum flow valve cannot be opened, 

trip the pump. Performing this as an immediate operator action upon arrival at the 

emergency control station will provide added assurance that these pumps will not be 

damaged. 

• [PWR] Upon arrival at the emergency control station, trip the Reactor Coolant Pump 

(RCP) to protect the RCP seals. 

The addition of these latter actions provides reasonable measures to prevent damage to 

equipment required for Alternative/Dedicated Shutdown. 

Consideration should be given to including each of the actions described above in each licensee’s 

Alternative/Dedicated Shutdown Procedures, as appropriate. With the addition of these 

additional actions, as appropriate, there is no need to justify the performance of these actions 

relative to an assumed fire impact time line. All of these actions are reasonable actions to take 

and can be accomplished in a short time frame prior to Control Room Evacuation and upon 

arrival at the emergency control station. 

Additionally, it is recommended that licensee’s confirm, as appropriate, that provisions have 

been included in the Alternative/Dedicate Safe Shutdown Analysis to preclude the following: 

• Spurious opening of both Containment Sump Valves resulting in a drain down of the 

RWST. [PWR] 

• Spurious Flow Diversion of suppression pool inventory to the CST via HPCI/RCIC. 

[BWR] 

• Spurious reactor vessel overfill and flooding of the main steam lines by HPCI when 

RCIC is being credited for Alternative Safe Shutdown. [BWR] 

• Spurious initiation of the Containment Spray System by including the capability to stop 

the pump or close the injection valve. [BWR] 
NEI 00-01, Revision 2 

May 2009 

D-14 

D.7 REFERENCES 

D.7.1 Generic Letter 81-12, “Fire Protection Rule,” February 20, 1981. 

D.7.2 Generic Letter 86-10, “Implementation of Fire Protection Requirements,” dated 

April 24, 1986. 

D.7.3 10 CFR 50 Appendix R, Fire Protection for Operating Nuclear Plants. 

D.7.4 IN 84-09 – Lessons Learned from NRC Inspections of Fire Protection Safe 

Shutdown Systems (10 CFR 50 Appendix R), Revision 1, March 7, 1984. 

D.7.5 IN 85-09 - Isolation Transfer Switches and Post-Fire Safe Shutdown Capability, 

January 31, 1985, 
NEI 00-01, Revision 2 

May 2009 

E-1 

APPENDIX E

ACCEPTANCE CRITERIA OPERATOR MANUAL ACTIONS AND REPAIRS 

E.1 PURPOSE 

This appendix provides guidance regarding the use of operator manual actions and repairs 

to equipment required for post-fire safe shutdown. 

E.2 INTRODUCTION

Operator manual actions may involve manual control, local control or manual operation of 

equipment. Operator manual actions on equipment in support of achieving safe shutdown 

are allowed as follows: 

 For components classified as either required for hot shutdown or important to safe 

shutdown where: 

• The operator manual action is taken inside of the Control Room or at the 

Emergency Control Station. [Note: The Emergency Control Station includes 

specific plant locations where remote controls have been provided for operating 

plant equipment and where such controls are included as a part of the safe 

shutdown component list for a particular safe shutdown path and their circuits 

are protected from the effects of fires as outlined in Section 3 of this document, 

e.g. keylock switches in a Relay Room for operation of SRVs on a BWR where 

the keylock switch is designed to function as the manual operation capability in 

the event that the automatic functioning of the system is lost.] "Any actions 

taken by the operator in the Control Room are not considered to be operator 

manual actions and are considered to be an acceptable means of effecting safe 

shutdown for the selected success path. Similarly, an action taken by an 

operator at a location outside of the Control Room, e.g. Remote Shutdown 

Panel, Local Control Station, that is specifically designed with local controls, 

e.g. hand switches, for the purpose operating plant equipment is not considered 

to be an operator manual action. The use of this latter set of equipment, 

however, must be assured to be free of fire damage and capable of being 

operated in the time required given the potential environmental conditions 

caused by the fire at the location of the equipment and along the travel path to 

the equipment." 

• The operator manual action or repair is taken to achieve and maintain cold 

shutdown. [Note: By definition this category applies to important to safe 

shutdown components only.] 

• The operator manual action manually operates a valve specifically designed for 

accomplishing the function, e.g. operation of a manual valve designed into the 

system specifically for system isolation. 
NEI 00-01, Revision 2 

May 2009 

E-2 

• The operator manual action is taken for Appendix R Section III.G.3/III.L. 

• The operator manual action is approved by the NRC. 

Repairs may be performed to equipment required for cold shutdown. This appendix 

provides the criteria to assure that the reliance on operator manual actions or repairs is 

appropriate. These criteria are intended to assure that the actions specified are capable of 

being performed, and that reliance on them is balanced within the overall safe shutdown 

strategy for a given fire area. 

E.3 RELIANCE ON OPERATOR MANUAL ACTIONS

Automatic control functions are a design feature provided to mitigate or limit the 

consequences of one or more design basis accidents. NRC Generic letter 86-10 Section 

5.3.10 suggests that post-fire safe shutdown be able to be accomplished without reliance on 

these automatic functions. Therefore, automatic control functions are not required for postfire safe shutdown. As a result, manual operation of the systems available for mitigating 

the effects of plant fires is required. This Appendix provides the criteria for determining 

when an operator manual action is allowed by NRC and when NRC approval for the use of 

an operator manual action in support of post-fire safe shutdown is required.

Specific plant protective functions, due to the nature of their design in assuring safe and 

reliable plant operation, require special consideration for a fire event. The Reactor 

Protection System (RPS) Scram function is one such system for a BWR. The Reactor Trip 

System (RTS) is one such system for a PWR. Due to the required design features of the 

RPS/RTS Scram System, automatic or manual Reactor Scram circuitry is impractical to 

fully protect from the effects of fire-induced circuit failures. Due to the importance of this 

system to reactor safe shutdown for multiple design conditions, re-design of the RPS Scram 

circuitry is not feasible. To assure the Reactor is scrammed for all fire conditions, it is 

recommended that each licensee assure that the Emergency Operating Procedure (EOP) 

action to implement the requirements of EO-113 to either de-power RPS/RTS or to vent the 

scram air header is linked to their post-fire safe shutdown procedures. This action is 

considered to be acceptable, feasible and reliable for all fire conditions, i.e. III.G.1/III.G.2 

and/or III.G3./III.L. [Reference BWROG Paper on NRC IN 2007-07.] 

E.4 DIFFERENTIATING BETWEEN OPERATOR MANUAL ACTIONS AND

REPAIRS 

The fundamental difference between operator manual actions and repairs is definitional. 

Both are subject to timing limitations, feasibility, and resource constraints. The NRC has 

placed additional limitations on the use of repairs, such that they may only be used to 

achieve and maintain cold shutdown conditions. This distinction provides the opportunity 

for licensees to maintain hot shutdown for an extended period of time, if necessary, while 

repairs are performed to equipment that is required to either transition to, or maintain cold 

shutdown. 
NEI 00-01, Revision 2 

May 2009 

E-3 

From an operational perspective, there is no meaningful distinction whether an action is 

defined as an operator manual action or a repair, since the same considerations apply. 

E.5 DEFINITIONS 

This appendix on operator manual actions relies upon definitions contained in Section 6. 

For the definition of terms used in this appendix, refer to Section 6, Definitions.

E.6 CRITERIA 

To credit the use of operator manual actions or repairs to achieve post-fire safe shutdown, 

certain criteria must be met. The first criterion for operator manual actions is that the 

operator manual action must be allowed under the current regulations either through 

compliance with the criteria outlined in this document or based on an approved exemption, 

deviation request or license amendment. For those actions that are allowed, the remaining 

sections of this Appendix apply in determining whether the specific allowed action is 

feasible and reliable. To credit an operator manual action not allowed based on the criteria 

in this appendix, NRC approval through an exemption request or a license amendment is 

required. In processing an exemption request and/or license amendment, the licensee 

submitting the exemption request or amendment should consider the requirements of 

NUREG 1852. NRC has stated that exemption requests and license amendments for 

operator manual actions will be evaluated for feasibility and reliability against the criteria 

contained in NUREG 1852. 

In assessing the acceptability of an operator manual action, timing is a consideration. To 

define the time available to perform an operator manual action, the time when fire damage 

to safe shutdown components and circuits occurs needs to be defined. This time is referred 

to as time zero. With time zero and a defined time line for the post-fire safe shutdown 

scenario defined, the time when specific fire-induced failures to specific systems 

performing specific safe shutdown functions result in adverse impacts to safe shutdown can 

be determined. The time line for post-fire safe shutdown is determined based on the 

capabilities of the systems and components being used to achieve and maintain post-fire 

safe shutdown in each particular fire area. This requires a plant unique analysis. Time 

zero, however, is an analytically assumed initial condition that must be specified and, when 

specified, justified as to its reasonableness. 

Based on this, time zero is specified to 10 minutes after the confirmation by plant personnel 

that the unit is experiencing a challenging fire. Indication of the fact that the fire being 

experienced is challenging is based on observations by plant operations personnel that 

results in the need to scram the unit and to close the MSIVs. Based on this definition, unit 

scram and MSIV closure may also be used as initial conditions applicable to any analysis 

assessing plant impacts as a result of fire-induced damage. 

Linking confirmation of a challenging active fire to the beginning of the 10 minute time 

frame before any fire-induced failures, including spurious equipment operations, occur is 

not only consistent with the current licensing basis, it is also consistent with the practical 

implementation of any safe shutdown strategy requiring operator initiation of plant safety 
NEI 00-01, Revision 2 

May 2009 

E-4 

systems. Additionally, Industry test data as discussed in a recent draft revision to NEI 00-

01 (ML080310056), while not conclusive, supports the assumption that fire-induced circuit 

failures, including spurious operations, will not occur immediately upon exposing cables to 

fire affects. According to the draft revision to NEI 00-01, the average time to failure 

exceeded 30 minutes for thermoset and armored cables and 15 minutes for thermoplastic 

cables. Finally, initiation of a unit scram and MSIV closure are actions that clearly state 

that the operation of the unit is being challenged. 

Due to the similarity between operator manual actions and repairs from the operational 

perspective, most of these criteria in this appendix apply to both. There are, however, a 

small number of additional criteria applied only to repairs. These additional criteria for 

repairs only are identified as such below. 

Criteria Applicable to Both Operator Manual Actions and Repairs

NOTE: The generic term "actions" is used below, in order to refer to operator manual actions and 

repairs collectively, without creating cumbersome language. If the specific term Operator 

Manual Action or Repair is used below, it is used intentionally to show some specific distinction. 

 There shall be sufficient time to travel to each action location and perform the action. 

Actions should be verified and validated by plant walkdowns using the current procedure. 

The action must be capable of being identified and performed in the time required to 

support the associated shutdown function(s) such that an unrecoverable condition does 

not occur. Previous action locations should be considered when sequential actions are 

required. 

 There shall be a sufficient number of plant staff available to perform all of the required 

actions in the times required, based on the minimum shift staffing. The use of personnel 

to perform actions should not interfere with any collateral fire brigade or control room 

duties they may need to perform as a result of the fire. Administrative controls shall exist 

to ensure that the personnel necessary to perform actions are available when required, and 

that unexpected absences are promptly corrected. If staff augmentation consistent with 

the licensee’s Emergency Plan Implementing Procedures is credited, then the licensee 

must demonstrate that un-recoverable conditions would not occur in the time period 

before staff augmentation is achieved. 

 The action location shall be accessible. In evaluating actions and the route through the 

plant for performing any actions, consideration should be given to the potential effects of 

temperature, humidity, radiation levels, smoke, and toxic gases. Actions required in a 

fire area experiencing a fire, or that require travel through a fire area experiencing a fire, 

may be credited if it is demonstrated that these actions are not required until the fire has 

been sufficiently extinguished to allow completion of necessary actions in the fire area. 

Generally, one-hour post-fire start is a reasonable time frame for meeting this criterion. 

In addition, if the action required is to be performed in the fire area experiencing the fire, 

it must be assured that fire damage within the fire area does not prevent completion of the 

action. 
NEI 00-01, Revision 2 

May 2009 

E-5 

 The action locations and the access and egress path for the actions shall be lit with 8-hour 

battery-backed emergency lighting. Tasks that are not required until after 8 hours do not 

require emergency lights as there is time to establish temporary lighting. The path to and 

from actions required at remote buildings (such as pump house structures) does not 

require outdoor battery backed lights, if other lighting provisions are available (portable 

lights, security lighting, etc.). 

 There should be indication, which is unaffected by the postulated fire, that confirms that 

an action is necessary and that the action, once completed, has achieved its objective. 

This indication is not required to be a direct reading instrument and may be a system 

change (level, pressure, flow, amps, temperature, etc.). Additional instrumentation may 

be needed to properly assess spurious operation, however it may not be necessary to 

make a diagnosis of the specific spurious operation that occurred, if symptom-based plant 

procedures provide the appropriate guidance to respond to the situation. If pre-emptive 

actions will be taken to preclude spurious actuations, then event-based procedures should 

be provided for the situation. 

 Administrative controls shall be provided to ensure that any tools, equipment or keys 

required for the action shall be functional, available, and accessible. This includes 

consideration of self-contained breathing apparatus (SCBA) and personnel protective 

equipment, if required. This also includes the availability of ladders or special 

equipment, if these items are required for access. 

 There shall be provisions for communications to allow coordination of actions with the 

main control room or the alternative shutdown facility, if required. The nature of the 

action, and the need for coordination with other related actions or the control room 

should be considered when determining what type of communication is required. 

 Guidance (e.g., procedures, pre-fire plan, etc.) should be provided to alert the operator as 

to when actions may be required in response to potential fire damage. This guidance 

shall be provided in locations that will be accessible during and after the fire. The 

guidance may be prescriptive or symptomatic. Specific event-based procedures are 

required for activities not addressed in existing operating procedures (normal, abnormal, 

emergency) for actions and repairs as a result of fire-induced failures that are preemptive. Pre-emptive specific event based procedures should be used for those situations 

where the fire-induced failure cannot be readily diagnosed using fire protected 

information, i.e. implicit or explicit indication, available to the operator. Use of 

Emergency Operating procedures is an acceptable approach for all other conditions, since 

EOPs direct the operator to use all available systems to achieve safe shutdown and, in all 

likelihood, fire damage to plant systems will be limited. The "skill of the craft" should be 

considered when determining the level of procedural guidance to provide. Typically, 

plant operators should be capable of performing actions without detailed instructions. 

Detailed instructions may be required for non-routine evolutions and, in these cases, 

should be readily available. Guidance should likewise be provided to the operator as to 

when to perform repairs in response to potential fire damage. The guidance shall provide 

the level of detail required to enable plant personnel to perform the task. 
NEI 00-01, Revision 2 

May 2009 

E-6 

 Personnel shall be trained and qualified, as appropriate, to perform the specified actions, 

in accordance with INPO's Systematic Approach to Training. 

 The complexity and number of operator manual actions required for safe shutdown shall 

be limited, such that their successful accomplishment under realistically severe 

conditions is ensured for a given fire scenario. 

Additional Criteria Specific to Repairs

 Repairs may only be used to achieve and maintain cold shutdown (not hot shutdown). 

 Hot shutdown must be capable of being maintained for the time required to perform any 

necessary repairs to equipment or systems needed to transition to and/or maintain cold 

shutdown. 

 Additional non-operating personnel (e.g. maintenance, instrument and control 

technicians, electricians) may be relied upon to perform repairs, provided their 

availability is consistent with plant’s Emergency Plan Implementing Procedures and/or 

the plant’s licensing commitments. 

Other Types of Actions

When performing the post-fire safe shutdown analysis, additional actions that are not credited in 

the post-fire safe shutdown analysis may be identified that have a positive benefit to the safe 

shutdown scenario such as minimizing the shutdown transient or reducing commercial property 

damage. Since these actions are not specifically required by the regulations or the safe shutdown 

analysis, it is not necessary to provide 8-hour emergency lighting or communication for these 

actions. It is also not required to specifically address the required timing for these actions. 

Similarly, operator manual actions specified as precautionary or confirmatory backup actions 

(prudent, but unnecessary or redundant) for a primary mitigating technique that are not credited 

in the post-fire safe shutdown analysis do not require 8-hour emergency lights, communications 

or timing considerations. 

When these types of actions are included in the post-fire safe shutdown procedures, provisions 

should be made to identify which actions are “required” and/or which are “prudent” so that the 

operator is aware of which actions must be addressed on a priority basis and which are more 

discretionary. This will help assure that the operator is properly focused on those actions that are 

of most importance. 

E.7 REFERENCES 

10 CFR 50 Appendix R Fire Protection for Operating Nuclear Power Plants 

Draft NRC Response to 03-29-06 EPM letter, May 25, 2006 (ML061440237) 

Draft NRC Response to 05-03-06 NEI letter, May 25, 2006 (ML061440251) 
NEI 00-01, Revision 2 

May 2009 

E-7 

NRC Inspection Procedure 71111.05, March 18, 2005 

NRC letter to NEI, Use of Manual Actions to Achieve Safe Shutdown for Fire Events, 

dated May 16, 2002 (ML021410026) 

NRC Meeting Summary of 06-09-06 OMA Meeting, July 19, 2006 (ML061950327) 

NRC Revision to Draft Response to EPM March 2006 letter, July 19, 2006 

(ML061980016) 

NRC Revision to Draft Response to NEI May 2006 letter, July 19, 2006 (ML061980035) 

NUREG-1778, Knowledge Base for Post-Fire Safe Shutdown Analysis, January 2004 

Public Meeting Notice 20060609 on Manual Action Clarifications, May 26, 2006 

(ML061390156) 

RIS 2006-10 Regulatory Expectations with Appendix R Paragraph III.G.2 Operator 

Manual Actions, June 30, 2006 (ML061650389) 

SECY-03-0100, Rulemaking Plan on Post-Fire Operator Manual Actions, June 17, 2003 

NEI 00-01, Revision 2 

May 2009 

F-1 

APPENDIX F

SUPPLEMENTAL SELECTION GUIDANCE (DISCRETIONARY) 

F.1 INTRODUCTION 

This appendix is be used to supplement the information in Section 4 in support of the 

plant specific review of the Generic List of MSO in Appendix G to supplement the list of 

MSOs to be reviewed on a Plant Unique basis. 

F.2 P&ID OR LOGIC DIAGRAM REVIEW 

The first step is to select target components/combinations that could impact safe 

shutdown. This first step limits consideration to combinations of multiple spurious 

actuation evaluations whose mal-operation could result in loss of a key safety function, or 

immediate, direct, and unrecoverable consequences comparable to high/low pressure 

interface failures. These consequences are noted hereafter as “unacceptable 

consequences.” Potential circuit failures affecting these safe shutdown target 

components may have been considered in previous circuit analyses, but perhaps not for 

IN 92-18 or multiple spurious actuation concerns. 

A system engineer can identify component combinations that can result in a loss of 

system safety function or immediate and unrecoverable consequences. Then, an 

electrical or safe shutdown engineer can identify areas where these component 

combinations have power, control, or instrument cables routed in the same fire area. 

The review for component combinations can be performed with P&IDs or safe shutdown 

logic diagrams (if available) or both. The review should focus in on “pinch points” 

where the system function or safe shutdown (SSD) function would be failed. Failure of 

the entire SSD function is not necessary for identification of component combinations but 

would be a limiting case assuming all identified components can fail with the same fire. 

Component combinations that do not fail the entire SSD function can be as important as 

combinations failing the entire function, especially if there is only a single component or 

manual/operator action remaining for the SSD function, or if the remaining SSD 

equipment is potentially unreliable. Some internal events PRA input may be helpful for 

determining potentially unreliable equipment or manual/operator actions. 

The results of the P&ID or logic diagram review would be a list of potentially important 

component combinations to be treated with the NEI 00-01 methodology. Since the 

internal events PRA scope and fire protection SSD scope are different, the SSD review 

may provide potential combinations that have not been included in the internal events 

PRA. Also, it is possible for this review of the P&ID to identify component 

combinations not identified by SSD analysis (because it requires multiple spurious 

operations) or internal events PRA (because of a high level of redundancy). The final list 
NEI 00-01, Revision 2 

May 2009 

F-2 

 

of identified component combinations should be combined with any internal events PRA 

combinations (from the PRA review below) for a final list for analysis. 

F.3 PRA REVIEW 

The internal events PRA can be used to determine potentially important component 

combinations through either cutset review or through model reanalysis. These are both 

described below. Note that a PRA review may identify combinations which include 

equipment not included in the Fire Protection Safe Shutdown list. The important 

components identified in the pilot applications were already in the Safe Shutdown 

Equipment List, but the internal events PRA scope includes additional equipment that is 

not in this list. 

F.3.1 Cutset or Sequence Review 

The plant analyst may review cutsets or sequence results (in this discussion, this is 

simplified to “cutsets”) with high contributions to core damage frequency, including 

common cause failures that include combinations with unacceptable consequences as 

noted above. These cutsets will generally contain few terms, have a significant 

contribution to core damage frequency, and include one or more basic events that can be 

affected by fire, either through direct damage or through spurious operation. Cutsets 

reviewed should include cutsets sorted by probability, and cutsets sorted by order (from 

least number of events in the cutset to most). Review of the cutsets would identify 

combinations where one or more components may spuriously operate, and whose 

spurious operation may be significant. The pilot project showed the spurious operation 

components are typically not in the top cutsets, since random (non fire-induced) spurious 

operation is typically a low probability event. It may be helpful to manipulate the cutsets 

using a cutset editor by setting the basic event probabilities associated with spurious 

operation events to 1.0, and re-sorting the cutsets32. For example, by setting all of the 

motor-operated valve (MOV) spurious operation events to 1.0 and re-sorting, the top 

cutsets may now include potentially important component combinations for MOV cables. 

Generally, the significance of each combination cannot be determined from a cutset 

review. However, the relative significance of one combination versus another can be 

performed when the cutsets include similar equipment. For example, when two similar 

cutsets, one with two spurious operations required and one with the same two and one 

additional spurious operation required are compared, the latter combination is probably 

less important. This type of comparison would require review of the other events in the 

cutsets, and the fire characteristics for the event causing equipment damage. 

32 If the licensee has a full internal events PRA model, re-running with spurious failures set to a high screening value 

(>0.1) could recover cutsets truncated in the internal events PRA that could contribute non-negligibly to the core 

damage frequency due to fire. 
NEI 00-01, Revision 2 

May 2009 

F-3 

One additional consideration is that the cutset a review does not need to include review of 

cutsets for initiating events that cannot be fire induced. For example, cutsets for steam 

generator tube rupture or large LOCA need not be reviewed. Typically, the review can 

be performed on turbine/reactor trip cutsets, loss of offsite power cutsets, and induced 

small LOCA cutsets. Similarly, cutsets requiring failure of components in both 

redundant trains can be dismissed as long as it can be assured that one redundant train’s 

component is protected in each fire area, and that the protected train is not failed by the 

failures in the redundant train. A review of the plant’s fire Individual plant Examination 

of External Events (IPEEE) can determine what initiating events can result from a fire. 

F.3.2 PRA Model Manipulation 

If a logic model of the plant core damage sequences including all possible fire events is 

available, this model can be exercised/manipulated to identify component combinations 

of interest to risk significance evaluation described in Section 5 of this document. 

The level and amount of model manipulation can range from a single re-solution of the 

model, to many re-solutions following modeling changes. The analysis discussed below 

is based on the limited analysis used in support of the pilot application of NEI-00-01, 

with discussion of additional runs considered during the pilot. 

A basic analysis that can provide significant results is solution of the internal events PRA 

model with all basic events set to 1.0 (True) that can potentially spuriously operate 

following a major fire. The McGuire pilot performed this analysis by also setting the 

transient and loss of offsite power initiating events to 1.0. The types of components and 

PRA basic events that should be set to 1.0 in the model include: 

 MOV spuriously open or close 

 AOV spuriously open or close 

 PORV spuriously open or close 

 Spurious actuation of automatic actuation signals 

The cutsets or sequence results can be reviewed to identify component combinations that 

are potentially significant. Review of the results will show patterns of cutsets that can be 

grouped or combined. For example, a cutset with a PORV spuriously operating and 

charging injection failures could repeat hundreds of times with both PORVs combined 

with the multiple combinations failing injection and the random failures not set to 1.0 in 

the model. These hundreds of cutsets can be grouped into limiting combinations based 

on order (less spurious operations leading to core damage) and/or likelihood (less random 

failures leading to core damage). Initial review of the cutsets should also look for other 

component basic events that could occur due to spurious operation following a fire. If 

additional basic events are identified, additional model solutions may be necessary prior 

to selection of the component combinations to be analyzed. 
NEI 00-01, Revision 2 

May 2009 

F-4 

If the PRA model includes some fire PRA sequences, additional runs with the fire PRA 

initiating events set to 1.0 should be performed. In this case, the PRA results would 

identify component combinations important for particular fire areas (or fire areas with 

similar characteristics). 

If the PRA model does not include any fire PRA sequences, model manipulation can be 

performed to simulate fire PRA results. For example, in the McGuire pilot analysis, 

additional internal events PRA runs were performed where the 4160 VAC switchgear 

was failed. This included two PRA runs, one with A train 4160 VAC failed, and one 

with B train failed. These runs simulated a switchgear fire, but also provided 

representative runs important if opposite train components were located in the same area. 

For example, cutset were identified where A train cooling water failed due to the A train 

4160 VAC failure, and B train cooling water failed due to spurious operation. This 

sequence could be potentially important if the cables causing the B train failure were 

located in an A train fire area. The B train failure (in this example) could be as a result of 

a diversion due to an A train valve spuriously opening. 

Additional PRA runs can be performed based on the IPEEE results. The IPEEE can 

provide a list of important fire areas, and the equipment that potentially fails due to a fire 

in these areas. By setting the component basic events to 1.0 for a selected fire area, and 

also setting our list of spurious operation components to 1.0, a list of potentially 

important component combinations can be developed for the selected fire areas. This 

type of analysis was not performed for the pilots, other than the fire sequences already 

included in the PRA models. 

F.3.3 Analysis of the New PRA Sequences 

Some important fire-induced accident sequences of interest involving spurious operation 

may have been screened from the internal events and Fire PRAs. New scenarios or 

accident sequences not previously considered may result from Fire-Induced damage or as 

a result of operator actions taken in response of a fire. For example, manual action to 

close a PORV or PORV block valve in response to spurious operation concerns would 

result in the Pressurizer Safety Valve (PSV) being challenged following a pressure 

increase. Spurious injection could also challenge the PSV, and if water relief were to 

occur, it is likely the PSV would stick open. A stuck open PSV is generally considered a 

low probability event in an internal events PRA, but may show up as significant in a Fire 

PRA. Scenarios involving Steam Generator overfeed may not be considered important 

for an internal events PRA, but may be important for sequences involving control room 

evacuation where a turbine driven pump is the credited safe shutdown equipment. 

Performing a Fire PRA update in order to develop possible multiple spurious 

combinations would not be an efficient method for developing a complete list of 

combinations. However, if a Fire PRA were being updated, either the scenario 

development process or PSA cutset results could provide insight to developing a 

complete list. The scenario development, including the development of new event trees 

or accident sequences, could provide a useful input to the SSA analyst. 
NEI 00-01, Revision 2 

May 2009 

F-5 

NUREG/CR-6850 (EPRI TR-1011989) methods for consideration for MSOs includes the 

following additions to the PRA in step 2.5.1: 

• Sequence Considerations that were screened out of the Internal Events PRA may 

become relevant to the Fire PRA and need to be implemented in the Fire PRA model. 

For example, spurious safety injection is often screened out from the Internal Events 

PRA and yet may be important for fires that could cause both the spurious injection 

and damage to one or more pressurizer PRA such that the pressurizer SRVs are 

challenged. These SRVs could subsequently stick-open causing a complicating LOCA 

accident sequence. A review should be conducted for such scenarios originally 

eliminated from the Internal Events PRA to determine if the analysis needs to add 

components to the Fire PRA Component List as well as model those components (and 

failure modes) in new sequences in the Fire PRA Model. 

• Particularly when considering the possible effects of spurious operation, new 

accident sequences and associated components of interest may be identified that 

should be addressed in the Fire PRA and go beyond considerations in the Internal 

Events PRA. Typically, these new sequences arise as a result of spurious events that: 

o Cause a LOCA: e.g., PORV opening, reactor cooling pump seal failure, 

o Adversely affect plant pressure control: e.g., vessel or steam generator 

overfill that if unmitigated could subsequently fail credited safe shutdown 

equipment such as a turbine-driven feedwater or auxiliary feedwater 

pumps, or 

o Introduce other “new” scenarios that may not be addressed in the 

Internal Events PRA. 

These fundamental steps for performing a baseline PRA review (for possible scope 

increases) can also be performed in support of a review for new MSO scenarios. 

Additional guidance is given in NUREG/CR-6850 in the following sections: 

• Fire-induced initiating events, including those not modeled in the Level 1 PRA 

(2.5.3) 

• Equipment with the potential for spurious actuation for failing Safe Shutdown 

Equipment (2.5.4), including new accident sequences not previously modeled. 

• Additional Mitigating, Instrumentation and Diagnostic equipment important to 

Human Response (2.5.5).

One of the key areas of screened sequences from the internal events PRA is the modeling 

of Interfacing Systems LOCA (ISLOCA) accident sequences. The internal events 

screening criteria for ISLOCA pathways would screen flow paths with 3 normally closed 

MOVs due to the low random failure rate of an MOV to remain closed. However, the 

fire-induced failure rate of an MOV spurious operation is significantly higher, and the 
NEI 00-01, Revision 2 

May 2009 

F-6 

screened scenario may need to be considered in the plant specific MSO list, given the 

scenario is possible (if one or more of the MOVs have power removed, then the cable 

criteria considerations in Appendix H would indicate the MSO is not likely). 

In reviewing the Internal Events PRA for screened (or even combined) initiating events, 

the following should be considered: 

1) The Initiating Event is more likely than the internal events PRA estimate (i.e., 

pressurizer heaters fail on). 

2) The resulting Consequences can be worse (i.e., loss of HVAC coincident with a fire). 

3) The Fire introduces new accident sequences not considered in the Internal Events 

PRA (i.e., spurious injection with PORVs closed, result in water relieve from the 

SRVs). 

During the review of the PRA scope for possible new MSOs, the plant and operator 

response to a fire should be understood. In particular, if the plant procedures direct the 

operator to turn off power to a train of SSE, isolate a train or function, or otherwise 

disable equipment, then this should be accounted for in the review. In this regard: 

• Credit for plant procedures to mitigate an MSO should not be used during the MSO 

scenario identification step, but should be used in the disposition of the MSO in the 

SSA. 

• Negative effects of plant procedures (operator actions) should be considered when 

determining if a new MSO scenario should be considered. 

These assumptions for the PRA input to the MSO list are conservative, but will result in a 

more complete list of MSOs for consideration. 

The output of the above review can be used as either an input to a Fire PRA, or as 

consideration for additional MSOs to be identified by the Expert Panel. See the 

information below for additional information on this topic. 

F.3.4 Event Tree Linking Models 

For Event tree linking models, Fussel-Vesely and Risk Achievement Worth of individual basic 

events representing spurious actuations can be calculated in a similar manner to that performed 

for fault tree linking models. However the process of identifying potentially risk significant 

multiple spurious actuations is slightly more involved with a linked event tree model due to the 

lack of sequence cutsets. In this case the spurious actuation basic events are set to 1.0 and the 

sequences (combinations of split fractions leading to core damage) are resolved. The new set of 

dominant sequences should then be compared with those derived from the base case 

quantification to identify those sequences that have risen significantly in value. This is followed 

by an investigation of the cutsets associated with those split fractions which contribute to the 

inflated sequence values to identify spurious and multiple spurious actuation combinations. 
NEI 00-01, Revision 2 

May 2009 

F-7 

F.3.5 Additional Considerations 

The above PRA reviews do not include a complete list of sensitivity studies or analysis that can 

be performed using an existing PRA. In addition, a simple review of risk importance measures, 

especially Risk Achievement Worth (RAW) of spurious operations, would be useful. 

F.4 EXPERT PANEL REVIEW 

F.4.1 Expert Panel Review 

The expert panel process described herein supplements the information provided in Section 4. 

An MSO identification Checklist is provided in Table F-1 below. This table provides a step-bystep process to ensure each of the critical steps are performed for the plant specific MSO 

identification process using an expert panel. 

F.5 SELECTION OF POTENTIALLY IMPORTANT COMPONENT 

COMBINATIONS 

Based on the results, performance of some or all of the types of analysis discussed above will 

provide hundreds of thousands of possible component combinations for review. Analysis of all 

these combinations is not possible. The PRA output provides the largest number of possible 

combinations. These combinations can be screened in the expert panel or self assessment 

process to reduce the scenarios to those that can actually occur and those of potential 

significance. The final selection of component combinations for analysis needs to account for 

various factors affecting the final expected risk for the combinations, including: 

 Expected spurious operation probability, including the combined frequency for 

multiple components. For example, it could be shown that for an MSO involving a 

large number of spurious operation components that component locations would most 

likely be unimportant, since the probability of spurious operation alone is on the order 

of 1E-06. 

 Conditional core damage probability listed in the cutsets 

 Additional factors not in the cutsets affecting the core damage probability, including 

both positive factors where additional equipment may be available and negative 

factors such as human actions that may be less reliable following a fire 

 Expected fire frequencies (i.e., combinations in high fire frequency areas may be 

more important than those in low fire frequency areas). 

These and other factors should be used by the analysts in determining the potentially 

important component combinations for review, and the number of combinations that need 

to be evaluated for risk significance. Combining the PRA-identified combinations with 

the P&ID or logic diagram review should provide a comprehensive list of potentially 
NEI 00-01, Revision 2 

May 2009 

F-8 

important component combinations that should be added to the Generic List of MSOs 

from Appendix G. 

F.6 DETERMINATION OF MSO COMPONENT CATEGORY 

MSO scenarios identified above are categorized as involving either required for hot shutdown 

components or important to SSD components. Guidance on categorization of components and 

the related MSOs is provided in Appendix H. 
NEI 00-01, Revision 2 

May 2009 

F-9 

Table F-1 

NEI 00-01 MSO Identification Checklist 

Phase Step Outcome Complete? 

Phase I: Prereview of 

MSOs 

Review Generic MSO List for 

Applicability 

Identification of each MSO on the generic list as either 

applicable or not applicable to the plant 

Perform PRA runs per NEI 

00-01, Appendix F 

Identification of potential MSO scenarios. These scenarios are 

reviewed by the expert panel for applicability 

Review Existing SSA for 

Spurious operations and 

MSOs already addressed 

Development of “Table 1”as input to the expert panel. Table 

should identify: a) new scenarios not on the generic list, b) 

Scenarios already addressed by the SSA, and c) Scenarios 

dispositioned as requiring multiple spurious operations (and not 

addressed). 

Phase II: 

Prepare for 

Expert Panel 

Select the expert panel Diverse Review Group, including Operations, Electrical, Fire 

Safe Shutdown, PRA, Fire Protection and Systems Engineers. 

Schedule MSO expert panel Experts are scheduled for 2-3 days of expert panel review, 

provided preparatory work (Phase I) is performed satisfactorily. 

Develop Training Package for 

expert panel 

Training Material as required by NEI 00-01. Example package 

is provided in NEI 00-01, Appendix F. 

Perform Training All experts are trained prior to starting the expert panel meeting. 

Phase III: 

Perform the 

Expert Panel 

Review MSOs on generic 

MSO list for applicability 

Expert panel documentation of agreement or disagreement with 

pre-screening 

Expert panel agreement on MSOs that are applicable to the 

plant, with additional discussion. 

Review MSOs on generic 

MSO list for additional 

scenarios. 

Identification of similar scenarios not on the MSO list. 

Review applicable P&IDs, 

Electrical Diagrams or Logic 

Diagrams for new scenarios. 

Identification of new scenarios not on the MSO list. 

Review MSO Combinations Determine whether any of the individual MSOs should be 

combined with other spurious operations or MSOs. 

Review PRA Results Determine if any PRA recommended scenarios affect the SSA 

and are not previously identified. 

Phase IV: 

Post-Review 

Develop comprehensive plant 

specific MSO list 

Single location for all MSOs that will need to be addressed in 

the SSA. 

Perform MSO categorization All MSOs are categorized as Required or Important to the SSA 

(green or orange) per Appendix H. 

Document Expert Panel 

Review and post-review. 

Documentation supporting SSA implementation of NEI 00-01. 

Add MSOs to the SSA, and 

address supplemented with 

NEI 00-01 performance-based 

tools (Fire Modeling). 

SSA is updated to include MSOs. Implementation of this step 

may need to be performed on a phased-approach. 

Expert Panel Review of Fire 

Modeling Disposition 

If Fire Modeling is used in the disposition of the MSO, the 

expert panel reviews the disposition prior to incorporating into 

the SSA. expert panel Training on Fire Modeling would be 

required for this step. 
NEI 00-01, Revision 2 

May 2009

F-10 
F-11 
NEI 00-01, Revision 2 

May 2009

F-12 
F-13 
NEI 00-01, Revision 2 

May 2009

F-14 
F-15 
NEI 00-01, Revision 2 

May 2009

F-16 
F-17 
NEI 00-01, Revision 2 

May 2009

F-18 
F-19 
NEI 00-01, Revision 2 

May 2009

F-20 
F-21 
NEI 00-01, Revision 2 

May 2009

F-22 
F-23 
NEI 00-01, Revision 2 

May 2009

F-24 
F-25 
NEI 00-01, Revision 2 

May 2009

F-26 
F-27 
NEI 00-01, Revision 2 

May 2009

F-28 
NEI 00-01, Revision 2 

May 2009 

G-1 

APPENDIX G

GENERIC LIST OF MSOS

The attached tables provide BWR and PWR MSO scenarios to be included in the generic MSO 

lists for evaluating fire-induced impacts to III.G.2 areas. 

The generic MSO lists provided below, however, may include scenarios that may also be 

applicable to III.G.3 areas. As outlined in Appendix D, the criteria for addressing spurious 

operations for III.G.3 areas is different than for III.G.2 areas. MSOs listed in this appendix that 

apply to III.G.3 areas only, with the exception listed below, need not be included in the analysis 

of impacts to the III.G.3, since the spurious operation analysis of impacts to III.G.3 areas is 

addressed by the criteria in Appendix D. Although MSOs with applicability to III.G.3 areas are 

not intended to alter a licensee’s current licensing basis related to III.G.3 where the III.G.3 areas 

has been approved by NRC, some evaluation of the risk implications of the scenario may be 

warranted. The licensing basis for NRC approved III.G.3 areas is as outlined in Appendix D or 

in a licensee’s current licensing basis. The MSOs with applicability to III.G.3 areas for these 

licensees are intended, at most, for use in a voluntary effort performed by a licensee to assess fire 

risk in III.G.3 areas. Since this type of a review is a voluntary review, any Licensee’s electing to 

assess risk in these previously approved III.G.3 areas may use any of the available tools to 

disposition the MSO, including Focused-scope Fire PRA or qualitative assessments of risk 

without prior NRC approval. III.G.3 areas not previously approved by the NRC in an SER, 

however, but re-classified from III.G.2 to III.G.3 by an individual licensee using the standard 

license condition should evaluate the MSOs as though the area were a III.G.2 area. 
NEI 00-01, Revision 2 

May 2009 

G-2 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

Reactivity Control 

C71 

1a 

RPS SCRAM Circuits: Refer to the BWROG "White Paper" on IN 2007-07. The "White Paper" explains that a single hot, should it occur in the right location in the right circuit, could 

prevent 1/4 of the rods from inserting. 

Similarly, two (2) hot shorts in the right location in the right circuit could prevent a full scram. Note: Single 

hot short can not also fail backup scram system

May be addressed by actions already included in plant EOPs. This is an issue inside and outside of the Control Room. Reactivity Control is addressby having as link between the Fire Safe ShutdowProcedures and the Procedure to either vent the 

scram air header or depower RPS (or reactor trip bus) to accomplish the SCRAM should manual scram from the Control Room not be effective. 

C71 

1b 

Multiple pilot valve fail to de-energize SV 1-17 & SV 1-18 

Scram pilot solenoids failure to de-energize so scram valve pilot air header stays pressurized (mbe redundant with 1a, check white paper) 

Reactor Coolant Makeup Control 
G-3 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

B21 

2a 

(Main Steam) Head vent valves (2) Spuriously Open. 

Valve Numbers MS-V-1, MS-V-2 or similar. Scenario may be screened, depending on line size and criteria for required versus available RCS Injection rate. Refer to PRA criteria about how bof a steam line break is of concern, and use that tdetermine if the Scenario is of interest. 

B21 

2b 

(Main Steam) MSIV's hot short results in MSIVs failing to close or reopening. 

Valve numbers MS-V-22A-D, MS-V-28A-D or similar. The postulated scenario involves failure redundant, normally open, Main Steam Isolation Valves (MSIV) in one of the four Main Steam Li(MSL) to close on demand. Each MSIV has an Aand a DC solenoid valve (Note: Some BWRs use DC solenoids). Both valves de-energize to close MSIV. May need to look at MSIV reopening, if closed on a fire. 

B21 

2c 

(Main Steam), Main Steam Line Drain Shutoffs spuriously open. Valve numbers MS-V-16, MS-V-19 (F016 and F019) or similar. May be an additional downstrea

manual valve MS-V-21 (F021) with an orificed bypass. Valve Motor may be removed or have power disconnected. May be able to analyze flow rate as an acceptable inventory loss. 

B31 

2d 

Failure to trip the Recirc pump on loss of cooling. Recirc pump seal failure LOCA 

Reactor seal leakage. Spurious closure of IV-70-loss of RBCLC pumps and loss of service water, results in loss of RBCLC and consequential seal LOCA. 

C11 

2e 

RPV coolant drain through the SDV vent and drain This scenario is a MSO initiated drain of reactor 

coolant from the SCRAM Discharge Volume to tReactor Building sump. The scenario is triggered MSO opening of the solenoid valves which suppcontrol air to the air operated isolation valves. 
NEI 00-01, Revision 2 

May 2009

G-4 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E12 

2f 

Inventory control Hi/Lo pressure interface valve spurious operation - (Residual Heat Removal) SDC Suction Isolation Valves 

RHR-V-8, RHR-V-9 (F008, F009) or similar. Removal of DC Control Power Fuses may resolv(may not resolve 3-phase proper rotation hot shorThis is the traditional Hi/Lo pressure interface. 

E12 

2g 

Inventory control valve spurious operation - (Residual Heat Removal) Discharge to Recirc Loop Isolation Valves 

Possible path includes the Warm-up line. Valves RHR-V-53A & B, RHR-V-50A & B (F015A&BF017A&B) or similar. Testable check valve will closed on DP. Need to consider whether RHR crosstie is open. T-H analysis of piping pressure/temperature may resolve. Power may be removed on Bypass. 

E12 

2h 

Inventory control valve spurious operation - (Residual Heat Removal) RHR Head Spray Valves 

MOV -F022, MOV-F023 or similar. May be cut Capped for some plants, or have a check valve to prevent back flow. 

E12 

2i 

Spurious Operations that creates RHR Pump Flow Diversion from RHR/LPCI. 

RHR flow can be diverted to the containment through the Containment Spray isolation valves (E11-F016A, B and E11-F021A, B or similar), Consider the possibility of failing either the primcontainment boundary (drywell/torus junction) ointernal structural elements of the pressure suppression design as a result of spraying the drywell under conditions where drywell sprays anot allowed by EOPs. Spraying into a hot dry environment in the drywell could result in a presreduction beyond what can be addressed by the containment vacuum breakers. 

E12 

2j 

Spurious Operations that creates RHR Pump Flow Diversion from RHR/LPCI, including diversion to the Torus or Suppression Pool. 

RHR flow can be diverted to the containment through the RHR Torus or Suppression Pool retuline isolation valves (E11-F024A, B and E11-F028A, B). 
G-5 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E12 

2k 

Spurious Operations that creates RHR Pump Flow Diversion from RHR/LPCI, including diversion to the Torus or Suppression Pool Spray Header. 

RHR flow can be diverted to the containment through the Torus or Suppression Pool Spray Header isolation valve (E11-F027A, B and F028 similar) or RHR Warm-up Line (E11-F026B). Ftypically has power removed, and 53 is in line, typically normally closed. 

E12 

2l 

Spurious RHR min flow failure to open with failure to establish a discharge path. RHR min flow failure to open (with spurious pum

start at high pressure or RPV injection line valvespuriously fail close). may lead to pump overheating/failure likely III.G.3 scenario. 

E12 

2m 

Spurious operation (open) of valve RHR A DISCH TO RADWASTE INBOARD ISOLATION and RHR radwaste isolation valve 

Valves F049, F040 (Radwaste letdown) or similaF010 (Crosstie) spurious operation or if F010 is open may divert flow from opposite train. F010 mhave power removed. 

E12 

2n Spurious opening of two series RHR 

unit cross tie valves BFN Only 

E12 

2o Spurious opening of two series RHR 

loop cross tie valves 

F010 (Crosstie)valve or similar. Breaker power mbe removed. 

E12 

2p 

Spurious opening of F073 and F074 RHR service water to RHR injection flood up ESW emergency containment (core) flooder valv

E21 

2q 

Spurious Operation of normally closed Core Spray Discharge Check bypass valve (equalizing valve) or testable check valves, and core spray discharge valve F005. 

Bypass Valve is normally down powered, DC MOV. 2 DC hot shorts can open the valve, resultin an alignment of High Pressure RCS pressure to the Low Pressure Core Spray Piping. Testable Check valve should go closed upon DP across valve. 
NEI 00-01, Revision 2 

May 2009

G-6 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E21 

2r 

Spurious Operations that Create Core Spray Pump Flow Diversion for injection to the RPV 

CS flow can be diverted to the Torus or SuppressPool through the CS test line MOVs (E21-F015Aor similar). Test Line is typically a 10" line with Orifice. This is a single spurious operation, so should already be addressed in SSA (unless the liincludes 2 series valves). Should review for MSOnot addressed in SSA, such as combinations of Ctest Line MOV opening and CS Discharge Valve Opening (Scenario 2O). 

E21 

2s 

Address Core Spray flow diversion to the equipment drains IV-40-30, 31, 32, 33 and to the containment spray raw water system. 

The reference to IV-40-30, -31, -32 and -33(high point vents, low point drains to Reactor Building Equipment Drain Tank{RBEDT]) MOV's should pulled out as a separate specific item. 

E21 

2t 

Path from Core Spray injection discharge valve to reactor building equipment drain tank vent isolation valves, scenario is plant specific 

Spurious actuation of vents (IV-40-30, 32) and CInjection (10 or 11) or loop 2 (IV-40-31, 33 and or 08) requires 3-phase proper polarity hot shorts IV-40-30 and 31 because power is removed. 

E22 

2u 

Spurious HPCS/HPCI operation (Note: for plants where HPCI is a subset of Feedwater, scenario may involve continued operation of HPCI) 

Vessel Overfill into steam lines. Could Impair RCoperation (if credited) due to vessel overfill and water in the steam line. Can occur as a result of: Spurious valve Operation: Turbine Stop Valve anHPCI Discharge Shutoff Valve Spurious Operati(HPCI-F067, F006 or similar), b) Damage to Cabling for transmitters (two required to start HPCI), c) Damage to High Level Trip Circuitry, d) HPCI pump controls hot short (for either motoor TD HPCI). 
G-7 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E41 

2v 

HPCI inject to Core Spray (F037 & F048 valves opening) over pressurizing CS. 

Potential Hi/Lo pressure interface scenario. 

E41 

2w 

HPCI drain to the sump failing open on loss of air pressure. AOV F004/F005 (F028, F029, and bypass is F05

or similar. Open drain flow path may not be sufficient to fail HPCI function. 

E41/E22 

2x 

Spurious operation (open) of both of HPCI/HPCS CST Test Return/Bypass valves. 

 MSOs to the HPCI/HPCS discharge test line valcan divert flow to the Condensate Storage Tank. suction is from the Suppression Pool, the Suppression Pool inventory is diverted to the CSValves E41-F011, E41-F008 [E22*MOVF010 anE22*MOVF011] (MO2316, CV2315), E41-F04E41-F041(MO2321, MO2322), or similar." 

E51 

2y 

RCIC Test flow to CST Stop and throttle valves flow diversion 

Valve numbers F022 and F011 or similar. The throttle valve and isolation valve in the return linthe Condensate Storage Tank are normally closed and at least one of the valves must remain closed prevent flow diversion from the RCIC pump to support the reactor inventory control function, especially during suppression pool cooling. 

E51 

2z 

RCIC Drain Pot Drains failing open on loss of air pressure AOV F025/F026 (RCIC) on the drain to the sum

failing open on loss of air pressure. Does not appto be a concern. 1inch steam line leak, assuming drain POT fails open. Trap would limit the flow. Diversion would also require F0054 bypass to opDiversion may be too small to be a concern. 
NEI 00-01, Revision 2 

May 2009

G-8 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E51 

2aa 

RCIC Pump Diversion through Mini Flow Line to the Suppression Pool or test return Line. 

The RCIC pump discharge can be diverted throuthe test return line to the CST through a MOV isolation valve and the common HPCI AOV throvalve. RCIC min flow line MOV E51-F019 is another path and a path from the pump suction to the suppression pool through MOVs E51-F029 aE51-F031. 

E51 

2ab 

Spurious operation (open) of both of RCIC TEST RETURN TO CONDENSATE STORAGE TANK valves with suction on the Suppression Pool may route the RCIC inventory to the CST. 

Valves 1E51*MOVF022 and 1E51*MOVF059 aa Spurious startup signal or valves RCIC PUMP DISCHARGE TEST LINE ISOLATION E51-F0RCIC PUMP TORUS SUCTION INBOARD ISOLATION E51-F03, RCIC PUMP TORUS SUCTION OUTBOARD ISOLATION E51-F02and HPCI/RCIC TEST RETURN REDUNDANT SHUTOFF VALVE E41-F011 or similar. 

E51 

2ac 

RCIC Suction Valves 

(F010, F031 or similar) CST and Suppression PoSuction Valves - There is a potential to isolate thinjection paths from the CST and Suppression poto the RCIC pump. 

G31 

2ad 

RPV bottom drain isolations to reactor building equipment drain tank spuriously opening 

Spurious operation of valves BV-37-08 and BV-309 (Dwg. C-18009). Thermal overload removed prevent spurious operation. as Hi/Lo pressure interface. This is a 3-phase hot short of proper 

polarity (May be only a two phase hot short beca

there are only two phases with thermal overload heaters. The third phase remains connected to thcircuit). 

G33 

2ae 

Spurious operation (open) of BOTH REACTOR WATER CLEAN-UP ISOLATION Valves may route RPV inventory into the RWCU system. 

1G33*MOVF001, 1G33*MOVF004 or similar. Closed loop system, but may be a concern due to high temperature in the piping for plants with low pressure RWCU piping (e.g., older BWRs). 
G-9 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

G33 

2af 

Spurious operation of RX Water Clean Up valves(RWCU drain to condenser and/or radwaste collection tanks.) 

Valves RWCU-FCV-33, and RWCU-V-34 or RWCU-V-35, or similar. Would require additionMOVs open to RWC; MOV 1 or 4 (or similar). 

G38 

2ag 

Suppression Pool Drain down: One example: Suppression Pool Water Management system suction flow is diverted or that the return flow is diverted for some there may also have the safeguards keep fill pumps with lines to the ECCS injection lines. 

May be unique flow paths for each BWR, involvany drain down path from the suppression pool. Oexample: If the one of two Torus Water Management System pumps are either running or spuriously starts, and one of two normally closed suction isolation MOVs open, and the normally closed condenser isolation valve opens, then Suppression Pool water is pumped to the condenTorus Cleanup may be locked closed for many plants. Drain to the Condenser typically a 3" lineAnother example – Containment Spray at a plant that has a connection to RADWASTE that would divert torus water if failed open.

N21 

2ah 

Spurious Operations that Create Standby Feedwater System(SBFW) (AC Driven FW Pump) Flow Diversion from RPV 

Applicable to BWRs with SBFW system or other motor driven FW pump. 

N21 

2ai 

Spurious operation of a feedwater or 

booster pump and a level control valve 

may cause uncontrolled feedwater injection into the RPV. This could also include continued operation of the Feedwater Pump (driven off the main turbine shaft). Fire damage to the feedwater pump clutch and/or associated controls could prevent tripping the pump, resulting in a serious overfeed situation. 

Valves 1FWS-P1A(B, C), 1FWS-MOV26A(B, C1C33-LVF001A(B, C, D) 1C33-LVF002 or simiBooster Pump operation would require decreased vessel pressure. Feedwater pumps may not be a concern if steam driven, and not driven of the maturbine shaft.. 
NEI 00-01, Revision 2 

May 2009

G-10 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

P11 

2aj 

Loss of CST Inventory to Hot Well Several paths exist that can cause a gravity drain 

the CST to the Hotwell. The condition can happedue to spurious operation of MOVs alone, and if normal hotwell pump or emergency hotwell pumspuriously start, the condition is worsened. Standpipes for drain paths may limit the minimum level in the CST. Should review Fire SSA assumptions for minimum level and effect of dradown. 

P11 

2ak 

CST supply to Condensate Return Tank (CRT) supply shutoff MOV spurious operation 

This MSO involves spurious operation of MOVs the piping connecting the CST and CRT. If either two valves spuriously open, a gravity transfer can 

occur which can lower the water level significantin the CST. See discussion above on Standpipes. Scenario not applicable to plants without a CRT equivalent. 

P11 

2al 

CST discharge to Radwaste system shutoff MOV spurious operation 

Spurious operation of two MOVs in the Condenssystem can set up a gravity drain path from the Cto the radwaste system. The water loss may need 

be evaluated to support the time line to reach sucstep in a manual action feasibility study. See discussion above on Standpipes. 

Reactor Coolant System Pressure 

Control 

B21 

3a 

Potential opening of all SRVs Multiple spurious can open a portion or all of the 

SRVs from conductor to conductor (cable) failuror pressure switch instrumentation racks containiall switches for the SRVs. GE Calc. available on SRV openings. 
G-11 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

B21 

3b 

Multiple ERV (SRV) opening Safety Relief Valve-Two or More Spuriously Op

"this failure requires two or more sustained fire 

induced failures in cables or within a control room panel to open more than one SRV." 

B21 

3c 

Spurious ADS: Safety Relief ValveFailure of ADS Initiation Logic, opening SRVs simultaneously due to energization of relays 

This postulated scenario features a failure that wiopen multiple SRVs simultaneously and requires energization of relays K6Aand K7A or K6B and K7B in a two out or two taken twice logic schem(ref. APED-B21-018<2>). As such this failure requires two sustained fire induced failures withithe control room panel with no damage to the individual SRV control circuits to initiate ADS. Ishould be noted that the individual SRV control circuits are powered from and contain control logwithin the panel. May not be applicable to plants that have installed confirmatory logic in ADS to prevent ADS for control room fires. 

Decay Heat Removal 

E12 

4a 

Loss of RHR suppression pool cooling due to suction valve interlock interactions 

Fire causes the loss of both loops of RHR suppression pool cooling (flow control valve for RHR A unavailable due to fire damage to cables; hot short causes shutdown cooling suction MOV RHR-V-6B to fail open, which fails RHR B suppression pool cooling due to interlocks). 

E12 

4b 

Failure due to diversion of suppression pool decay heat removal through 16B & 17B. 

Loss of both loops of RHR suppression pool cooling. Loss of suppression pool leads to Containment Failure the containment failure location fails HPCS. 
NEI 00-01, Revision 2 

May 2009

G-12 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E14 

4c 

Dedicated Shut Down Cooling System - "Spurious opening of SDC heat exchanger bypass valves(FCV-38- 128, 131, and 134)" 

Spurious opening of normally closed heat exchanbypass air operated valves FCV-38- 128, 131, an134. These valves fail open on loss of instrumenair and control power.SDC is a manually operatesystem and is used several hours after the event. needed, these valves can be operated manually. Mbe a cold shutdown issue, if cooling is not needed for Hot standby. 

E15 4d Dedicated Shut Down Cooling System 

- "Spurious closure of Pump suction valves from torus (IV-80-01, 02, 21 and 22)" 

IV-80-01, 02, 21 and 22. Spurious closure {DW18012, sh. 2} 

E15 

4e 

Dedicated Shut Down Cooling System - "Spurious closure of Pump discharge to drywell valves (IV-80-15, 16, 35 and 36)" 

IV-80-15, 16, 35 and 36. Spurious closure {DW18012, sh. 1} Note: All four IV-80-15, 16, 35 an36 valves go open and they can not be re-positionon loss of instrument air. 

E15 

4f 

Dedicated Containment Spray System - "Spurious closure of the normally open Containment spray raw water discharge valves (MOVs BV-93-25, 26, 27 and 28.)" 

Spurious closure of the normally open MOVs BV93-25, 26, 27 and 28. {DWG 18012, sh. 1} 

E15 

4g 

Dedicated Containment Spray System - Spurious opening of normally closed Containment spray raw water to containment spray supply valves (MOVs FCV-93-72 and 73) 

Spurious opening of normally closed MOVs FCV93-72 and 73. {DWG 18012, sh. 1}FCV-93-72 a73 are interlocked with BV-93-28 and 26 respectively (per system description SDBD 203). raw water intertie occurs when conditions are wrong, spraying the drywell with cold raw water could cause a failure of the pressure suppression function of containment. 
G-13 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E15 

4h 

Dedicated Containment Spray System - Spurious opening of normally closed Containment spray raw water to core spray supply valves (MOVs FCV-93-71 and 74) 

Spurious opening of normally closed MOVs FCV93-71 and 74. FCV-93-71 and 74 are interlocked with BV-93-25 and 27 respectively (per system description SDBD 203). 

E15 

4i 

Dedicated Containment Spray System - Spurious opening of normally closed Containment spray venting valves( MOVs IV-80-114 and 115) 

Spurious opening of normally closed MOVs IV-8114 and 115 causing flow diversion in containmespray. {DWG 18012, sh. 2} 

E21 

4j 

Dedicated Core Spray System - "Spurious closure of normally open torus suction valves (MOVs IV-81-01, 02, 21 and 22)" 

Spurious closure of normally open MOVs IV-81-02, 21 and 22. {DWG 18007, sh. 1} 

E21 

4k 

Dedicated Core Spray System - Spurious closure of normally open RPV injection valve (MOVs IV-40-02 and 12) 

Spurious closure of normally open MOVs IV-40-and 12. {DWG 18007, sh. 1} 

E52 

4l 

Isolation Condenser - "Spurious closure of Steam line isolation valves (IV-39-07, 08, 09 or 10) results in failure of decay heat removal. Failure to isolate for pipe breaks. " 

Spurious closure of IV-39-07, 08, 09 or 10 resultfailure of decay heat removal. Failure to isolate fpipe breaks. Based on the RIS evaluation, it was shown that credible circuit failure modes may exto spuriously close the DC motor operated valves IV-39-07 and IV-39-08. This spurious closure is based on conductor to conductor hot short failureof two cables. 

E52 

4m 

Isolation Condenser - Condensate return isolation valve failure to move/remain in correct position 

AOVs IV-39-05, 06 fail to open resulting in failuof EC system. Failure to stay closed for pipe breaks. Dwg. 18017-1 
NEI 00-01, Revision 2 

May 2009

G-14 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

E52 

4n 

Isolation Condenser - Failure of Vent to main steam line valve (IV-05-02 and 03) to close or hot short(s) that keeps both valves open results in loss of inventory. 

Failure of IV-05-02 and 03 to close or hot short(sthat keeps both valves open results in loss of inventory. These valves receive a signal to close vessel Lo-Lo level. IV-05-01, 04, 11, 12 do not receive a signal to close on EC actuation. {DWG 18017, sh. 1} 

E52 4o Isolation Condenser - "Failure of Vent 

to main steam line valves (IV-05-01, 11, 12, 04) to close results in loss of inventory." 

Failure of IV-05-01, 11, 12, 04 to close results in loss of inventory. These valves do not receive a signal to close on EC actuation. {DWG 18017, s1} 

E52 4p Isolation Condenser - Spurious 

opening of normally-closed Vent to torus valves (BV-05-05 and 07) results in loss of inventory. 

Spurious opening of normally-closed BV-05-05 a07 results in loss of inventory. {DWG 18017, sh

E52 4q Isolation Condenser - Spurious closure 

of Cross-connect valve(BV-60-13) on makeup line results in loss of crossconnect capability of makeup source. 

Spurious closure of BV-60-13 results in loss of cross-connect capability of makeup source. {DW18017, sh. 1} 

T23 4r Containment Over Pressure (COP), 

NPSH loss due to spurious initiation of

containment sprays. 

A General Review of NPSH and Containment OvPressure should be performed to look for other pathways such as containment inerting system or other containment isolations, other than the 3 listhere. COP is only an issue for plants that credit Cfor NPSH concerns. Sprays initiated with hot, dry drywell could result in a rapid depressurization othe drywell, that is so rapid the vacuum breakers not mitigate, resulting in collapse of the torus rinheader and possible loss of pressure suppression design function. 
G-15 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

T23 

4s 

Containment Over Pressure (COP), NPSH loss, Spurious opening of Containment Vent. 

Spurious opening of Containment Vent, resulting Containment depressurization, following a loss oSuppression pool cooling. Containment vent through pathways not including the rupture disc. COP is only an issue for plants that credit COP foNPSH concerns. 

T23 

4t 

Containment Over Pressure (COP), NPSH loss, Spurious opening of the drywell floor drain sump valves. 

Spurious opening of the drywell floor drain sumpsince it isn't directly connected to the airspace. Cis only an issue for plants that credit COP for NPconcerns. 

T23 

4u 

Spurious opening of torus vent and purge valves. 

Spurious opening of torus vent and purge valves 201-07, 08, 16, and 17 or BV-201-21 and 22 will lead to loss of containment isolation. 

T23 4w Mark I containment with Torus Ring 

Header: too much flow through the ring header due to spurious operation of multiple pumps (more than allowed by design) from the ring header. 

NPSH Issue for the operating/credited pump. Mabe caused by a false LOCA signal. 

Support Systems 

E12 

5a 

Additional components load onto credited diesel generator Scenario causes diesel generator overloading and 

inoperability. Note: Scenario very site specific. Interlocks may prevent this from occurring. In addition, overloading may also occur if proper losequencing is bypassed via hot shorts, causing simultaneous loading of multiple components onthe EDG. 

G38 

5b 

Spurious operation (open) of both SUPPRESSION POOL CLEAN-UP ISOLATION Valves. 

Drain down of suppression pool below minimal level. 1RHS*AOV62, 1RHS*AOV63 or similar 
NEI 00-01, Revision 2 

May 2009

G-16 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

P41 

5c 

Emergency Service Water pump operation at shutoff head 

Prior to isolation of the circuits and component control at the remote shutdown panel, the Auto stor spurious Control Room fire induced start of thEmergency Service Water (ESW) Pump followed by a spurious closure of the ESW Pump DischargValve. The ESW Pump would be operating with flow until isolation and control from remote statiis achieved. III.G.3 only because for non-III.G.3 areas not employing isolation transfer switches sufire damage would also disable the ability of the pump to operate. 

5d 

Spurious RHR Service Water pump operation at shutoff head 

Prior to isolation of the circuits and component control at the remote shutdown panel, the ControRoom fire causes a start of the Residual Heat Removal Service Water (RHRSW) Pump followby a spurious closure of the RHRSW Pump Discharge Valve. The RHRSW Pump would be operating with no flow until isolation and control from remote station is achieved. III.G.3 only because for non-III.G.3 areas not employing isolation transfer switches such fire damage woualso disable the ability of the pump to operate. 
G-17 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

P41 

5e 

Spurious operation (open) of both RHR SERVICE WATER ISOLATION (Crosstie) valves in a loop may result in diversion of service water flow from the RHR heat exchangers. 

1E12*MOVF094 AND 1E12*MOVF096 or simiDiversion of Service Water could also cause failuof the credited Service Water Pump due to runou

R43 

5f Non-synchronous paralleling of EDG 

with on-site and off-site sources through spurious breaker operations 

Scenario causes damage to diesel generator by closing into a live bus out-of-phase. Note: Scenar

are very site specific. Interlocks may prevent this from occurring. 

R43 

5g 

Non-Synchronous Paralleling - inadvertent cross tie breaker operation between opposite divisions (e.g., 4160V, 480V) of Div 1(2) EDGs through Spurious Operation of 480 V Breakers or the Divisional Cross-Tie through 4160 V Maintenance Tie Breakers 

Scenario causes damage to diesel generator by closing into a live bus out-of-phase. Note: Scen

very site specific. Interlocks may prevent this frooccurring. 

R43 

5h 

Non-Synchronous Paralleling - inadvertent cross tying the off site power sources through the on-site busses & breakers. 

Spurious breaker closings between separate divisions of off-site power. 
NEI 00-01, Revision 2 

May 2009

G-18 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

R43 

5i 

Spurious Diesel generator operation without cooling water The fire causes the startup of the Emergency Die

Generator, Spurious closure of the ESW Pump Discharge Valve or trip of the ESW Pump would stop the cooling water supply to the Emergency Diesel Generator. Running the Emergency DieseGenerator with a loss of cooling water could trip diesel on high temperature. If the fire has resultein the actuation of a LOOP or LOCA bypass of thhigh temperature trip, the diesel could continue to run until damage from over-temperature conditiostop it. 

R43 

5j 

Service Water System - Spurious operation (open) of both crossconnection valves would cause an uncontrolled loss of service water to the opposite division. 

1SWP*MOV505A, 1SWP*MOV505B or similarfor RHR Service Water, F119A/B or similar wouhave to open. 
G-19 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

R24N/A 

5k 

Spurious motor-operated valve operation, AND Wire-to-wire short(s) bypass torque and limit switches 

General scenario is that fire damage to motoroperated valve circuitry causes spurious operatioIf the same fire causes wire-to-wire short(s) such that the valve torque and limit switches are bypassed, then the valve motor may stall at the enof the valve cycle. This can cause excess current the valve motor windings as well as valve mechanical damage. This mechanical damage mbe sufficient to prevent manual operation of the valve. Scenario only applies to motor-operated valves. Note this generic issue may have already been addressed during disposition of NRC Information Notice 92-18. This disposition shoube reviewed in the context of multiple spurious operations and multiple hot shorts. 

T41 

5l 

Loss of HVAC: Spurious isolation of HVAC to credited loads 

Perform review to identify spurious failures that could cause isolation of Heating Ventilation and Conditioning (HVAC) to credited loads. Crediteloads may include pump rooms, switchgear roomand rooms containing solid state control systemsExamples of spurious failures include spurious damper isolation and spurious isolation of coolinflow to chillers. Also look at Fire-induced damagcauses loss of both cooling fans and cooling pumon startup transformer when offsite power is credited. 

W25/W24 

5m 

Cooling pond (UHS) inventory loss - Cooling pond to tower cross tie. HV12-111, HV12-113 fail open, Can pump spray pond to the cooling tower (non-UHS). 

Drain down of dedicated ultimate heat sink (coolpond) to non- safety systems 
NEI 00-01, Revision 2 

May 2009

G-20 

Table G-1 

BWR Generic MSO List 

MPL # Scenario Description Notes 

Process Monitoring 

6a No generic Scenarios identified 
G-21 

PWR Generic MSO List 

Revision 1 

May 2009 

Record of Revisions 

Rev Description 

0 

Original Issue. 

1 

Scenarios 1, 2, 3, 9, 55b (old 54b). Clarified that CE plants generally do not have RCP seal inject

Scenario 7. Removed applicability to B&W plants, in which letdown relieves to the pressurizer anAdded new Scenario 14 "Charging Pump Runout when RCS is Depressurized". Note new numbesubsequent scenarios. Scenario 15 (Old Scenario 14). Noted that some plants have check valve(s) in sump line that woufrom occurring. Scenario 24 (Old Scenario 23). Clarified that spurious opening of a closed MSIV may be very diffipressure across valve. Scenario 26 - (Old Scenario 25). Expanded scenario to include search for other steam loads and header drain valves. Scenario 32 (Old Scenario 31). Added note that scenario could be caused by non-spurious failure instrument air, loss of valve air or power, etc.). Scenario 34 (Old Scenario 33). Added potential applicability to B&W plants with replacement steaScenario 35 (Old Scenario 34). Added note that scenario may screen if AFW makeup flowrate exthrough sample system. Scenario 36. Added note that spurious opening of pressurizer auxiliary spray would have similar Added new Scenario 53 "Spurious Operation of various valves causing flow diversion" Added new Scenario 56f "RCS Makeup Pump Failure" due to spurious Recirculation Actuation Sigalignment to dry containment sump. Generically replaced term "inoperability", which has a specific Tech Spec meaning, with the term Made minor clarifications throughout document. 
NEI 00-01, Revision 2 

May 2009

G-22 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 1 

Loss of all RCP Seal Cooling 

Spurious isolation of seal injection header flow, AND Spurious isolation of CCW flow to Thermal Barrier Heat Exchanger (TBHX) 

Scenario causes loss of all RCP seal cooling and suincrease in RCP seal leakage, challenging the RCS Control Function. Westinghouse Tech Bulletin 04-22 Rev. 1 provides summary of the issue. Tech Bulletin references provadditional detail. B&W plants with Westinghouse deseals may have similar concerns. Seal injection flow isolation can occur at main headesupply to each individual pump. In addition, scenariocause loss of all charging (i.e., multiple pump failure loss of suction, non-spurious pump failures such as power, etc.) can also cause loss of seal injection. Loss of all seal cooling to any individual RCP is a pro(i.e., does not have to occur on all RCPs to be a proWestinghouse plants refer to Letter #OG-09-156 RevWhite Paper on Westinghouse Reactor Coolant PumBehavior for Fire Scenarios. * CE plants generally do not have seal injection and seal cooling for an extended period of time without inseal leakage. These plants can lose all seal cooling spurious isolation of CCW. Refer to WCAP-16175. 
G-23 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 2 

Loss of all RCP Seal Cooling 

Spurious opening of valves causing flow diversion away from seals, ANDSpurious isolation of CCW flow to thermal barrier heat exchanger 

Flow diversion away from seal injection could be causpurious opening of charging injection valves. Note, opening of #1 seal bypass valve is judged to not fail injection function due to orifice restricting bypass flow ~1gpm (Reference Letter #OG-09-156) See notes for Scenario #1, Loss of all RCP Seal CooWestinghouse plants, refer to Letter #OG-09-156 Reof White Paper on Westinghouse Reactor Coolant PBehavior for Fire Scenarios. 

3 

Thermally Shocking RCP Seals 

Loss of all seal cooling to any RCP(s). See Scenarios 1 & 2, AND

Spurious re-initiation of seal cooling (i.e., seal injection or CCW to TBHX) 

Scenario is assumed to cause RCP seal failure and subsequent RCP seal LOCA, challenging the RCS InControl Function. Westinghouse Tech Bulletin 04-22 Rev. 1 (Referencprovides summary of issue. Tech Bulletin referenceadditional detail. Westinghouse plant please refer to Letter #OG-09-1Revision 1 of White Paper on Westinghouse ReactoPump Seal Behavior for Fire Scenarios. * CE plants generally do not have seal injection and seal cooling for an extended period of time without inseal leakage. These plants can lose all seal cooling spurious isolation of CCW. Refer to WCAP-16175. 
NEI 00-01, Revision 2 

May 2009 

G-24 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 4 

Catastrophic RCP Seal Failure 

Loss of all seal cooling to any RCP(s). See Scenarios 1 & 2, AND

Fire prevents tripping, or spuriously starts, RCP(s) 

Scenario causes catastrophic RCP seal failure and subsequent RCP seal LOCA, challenging the RCS InControl Function. Westinghouse Tech Bulletin 04-22 Rev. 1 provides sof issue. Tech Bulletin references provide additionaAdditionally refer to Letter #OG-09-156 Revision 1 oPaper on Westinghouse Reactor Coolant Pump Seafor Fire Scenarios. Refer to WCAP-16175 for RCP seal behavior on loss cooling at CE plants. 

5 

RCP Seal No. 2 Failure 

Loss of all seal cooling to any RCP(s). See Scenarios 1 & 2, AND

Spurious isolation of No. 1 seal leakoff valve(s) 

Isolation of the No. 1 seal leakoff line during a loss ocooling event would force the No. 2 RCP seal into a pressure mode of operation at high temperature, whbeyond the design bases of the No. 2 seal. This coufailure of the No. 2 seal and increase RCP seal leakaWestinghouse Tech Bulletin 04-22 Rev. 1 provides sof issue. Tech Bulletin references provide additionaAlso reference Letter WOG-05-163 DW-04-004 "IsolRCP#1 Seal Leakoff" and Letter #OG-09-156 RevisWhite Paper on Westinghouse Reactor Coolant PumBehavior for Fire Scenarios. This scenario would apply to B&W plants with Westidesigned RCP seals. 
G-25 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 6 

Letdown Fails to Isolate and Inventory Lost to CVCS 

Spurious opening of (or failure to close) letdown isolation valve(s), AND Spurious opening of (or failure to close) letdown orifice valve(s) 

Scenario causes loss of RCS inventory, challenging Inventory Control Function. In a typical Post-Fire Safe Shutdown (PFSS) AnalysChemical and Volume Control System (CVCS) downthe letdown isolation valve(s) and upstream of the VoControl Tank (VCT) isolation valve(s) is not evaluateRCS inventory (letdown) is conservatively assumed unavailable for makeup. In reality, additional failures downstream of the letdown isolation valves would haoccur for this RCS inventory to be unavailable for maAlso note that the letdown isolation valves and letdowvalves are often interlocked such that the isolation vanot open without the orifice valves being open. Letdfailure to isolate can be a single spurious operation winterlocked valves. Note B&W plants do not have letdown orifice valvesScenario applicable to B&W is spurious operation of letdown isolation valves. 

7 

Letdown Fails to Isolate and Inventory Lost to PRT 

Letdown fails to isolate (see Scenario 6), ANDSpurious closure of downstream containment isolation valve 

Scenario causes letdown flow to Pressurizer Relief T(PRT) through relief valve. This letdown flow is assuunavailable for RCS makeup. 
NEI 00-01, Revision 2 

May 2009

G-26 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 8 

Excess Letdown Fails to Isolate 

Spurious opening of (or failure to close) multiple series excess letdown isolation valves 

Scenario causes loss of RCS inventory to the CVCS challenging the RCS Inventory Control Function. Thinventory (letdown) is conservatively assumed lost aunavailable for makeup. In reality, additional failures downstream of the excess letdown isolation valves whave to occur for this RCS inventory to be unavailabmakeup. This scenario often requires three spurious operation

9 

RCS Makeup Isolation 

Spurious isolation of seal injection flow path, AND/OR Spurious isolation of normal charging flow path, AND/OR Spurious isolation of charging / safety injection flow path 

Scenario isolates all high head RCS makeup flow pachallenging the RCS Inventory Control Function. Each flow path contains a number of series and/or pvalves. P&ID review is required to identify each relecombination of valves. Note that isolation of all RCS makeup may also invospurious failures. For example, the charging injectioare normally closed, and a fire-induced loss of valve (not a spurious operation) would cause these valves closed. On the other hand, these valves could spuriclose after they have been opened. *Note CE plants generally do not have seal injection
G-27 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 10 

Charging Pump Failure 

Initial condition is charging pump running with normal lineup taking suction from VCT. Spurious isolation of suction from VCT to running charging pump, AND Spurious isolation of (or failure to open) suction from RWST to running charging pump 

Scenario causes charging pump failure, challenging Inventory Control Function. This is especially challethe credited charging pump is running at the time of Can be a single spurious scenario if the RWST valvenormally closed MOVs and they are not interlocked wVCT outlet valves. Note that spurious starting of idle charging pump(s) cause failure of additional pumps. Spurious pump stcan occur for several reasons, including fire damage circuitry or an inadvertent Engineered Safety FeatureActuation System (ESFAS) signal. Note that valve interlocks may prevent scenario if thprevent VCT and RWST outlets from both being in cposition simultaneously. 

11 

Charging Pump Failure 

Initial condition is charging pump running and drawing suction from RWST. Spurious isolation of two parallel RWST outlet valves. 

Scenario causes loss of charging pump suction, causubsequent pump cavitation and failure. This challeRCS Inventory Control Function. Note that spurious starting of idle charging pump(s) cause failure of additional pumps. Spurious pump stcan occur for several reasons, including fire damage circuitry or an inadvertent ESFAS signal. 
NEI 00-01, Revision 2 

May 2009

G-28 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 12 

Charging Pump Failure 

Spurious opening (or failure to close) of multiple series VCT outlet valves 

Scenario causes VCT drain down and hydrogen coventrainment into charging pump suction, ultimately ccharging pump failure and challenging the RCS InveControl Function. This is especially challenging if the charging pump is running at the time of the fire. Notscenario assumes that VCT makeup has been isolatletdown isolated). Note that spurious starting of idle charging pump(s) cause failure of additional pumps. Spurious pump stcan occur for several reasons, including fire damage circuitry or an inadvertent ESFAS signal. Potential resolution is comparison of charging pump header pressure provided by the RWST versus the VSpecifically, the RWST may provide sufficient pressuthat the check valve to the VCT remains seated and is not entrained into the pump suction. 

13 

Charging Pump Failure 

Letdown fails to isolate (see Scenario 6), AND

Spurious isolation of CCW cooling to the letdown heat exchanger 

Scenario causes elevated charging pump suction temand subsequent pump failure. Charging pump failurchallenges the RCS Inventory Control Function. Thiespecially challenging if the credited charging pump at the time of the fire. Starting of additional charging pumps can cause failuadditional pumps. Spurious pump starting can occuseveral reasons, including fire damage to control circan inadvertent ESFAS signal. 
G-29 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 14 

Charging Pump Failure 

Charging pump runout when RCS is depressurized 

Scenario causes charging pump runout and failure. must be running when RCS is at a depressurized coUnintentional RCS depressurization could occur due spurious opening of pressurizer PORV(s), for exampCharging pump(s) can spuriously start if they are not running. Scenario may also require failure of other components (e.g., charging flow control valve, etc.). 

15 

RWST Drain Down via Containment Sump 

Spurious opening of multiple series containment sump valves 

Scenario causes RWST drain down to the containmeSince typical PFSS analyses do not credit alignment containment sump, the RWST inventory becomes unfor RCS makeup, challenging the RCS Inventory CoFunction. Scenario may be applicable to containment sump vaproviding suction to the RHR pumps and/or containmpumps. Number of valves required to spuriously operate varplant. Note that some plants may have check valves in the line that would prevent this scenario. 
NEI 00-01, Revision 2 

May 2009

G-30 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 16 

RWST Drain Down via Containment Spray 

Spurious opening of containment spray header valve(s), AND

Spurious starting of containment spray pump(s) and/or RHR pump(s) 

Scenario causes a pumped RWST drain down via thcontainment spray ring. The RWST inventory ultimasettles to the containment sump. Since typical PFSS analyses do not credit alignment of the containment RWST inventory is assumed unavailable for RCS machallenging the RCS Inventory Control Function. Note that either the RHR pumps or the containment pumps could cause this RWST pumped diversion to ring. Note that the spurious pump starting can occur for sreasons, including fire damage to control circuitry or inadvertent ESFAS signal. 
G-31 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 17 

Interfacing System LOCA 

Spurious opening of multiple series RHR suction valve from RCS 

Scenario causes interfacing system LOCA, challengRCS Inventory Control Function. The valve operators are typically maintained de-eneduring normal plant operation. If so, spurious operateach valve would generally require three proper phashorts. Note B&W plants have three series valves. From a Fire PRA perspective, this interfacing system scenario generally screens out if at least two series vnormally de-energized. From a PFSS analysis perspective, this is classified high/low pressure interface and maintaining the valvenergized generally complies with fire protection regrequirements. 

18 

Multiple Pressurizer PORVs 

Spurious opening of multiple (two or three) Pressurizer PORVs with corresponding block valves in normal, open position 

Scenario causes loss of RCS inventory through the pressurizer PORVs, challenging the RCS Inventory CFunction. Scenario also causes pressurizer depresschallenging the RCS Pressure Control Function. Note some CE plants do not have any PORVs. Scewould not be applicable to these plants. Note B&W plants only have one PORV. Scenario wbe applicable to these plants. 
NEI 00-01, Revision 2 

May 2009

G-32 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 19 

Pressurizer PORV and Block Valve 

Spurious opening of Pressurizer PORV(s), AND Spurious opening of block valve(s) after it has been closed. 

Scenario causes loss of RCS inventory through the pressurizer PORV(s), challenging the RCS Inventory Function. Scenario also causes pressurizer depresschallenging the RCS Pressure Control Function. In this scenario, operators may have closed the bloceither to 1) mitigate a fire-induced PORV LOCA or aemptive action to prevent PORV LOCA from occurrinfirst spurious operation is the PORV and the second block valve that has been closed. Note that the initial PORV LOCA, caused by spuriouoperation of PORV alone, is a single spurious since valve is normally open. 
G-33 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 20 

Reactor Head Vent Valves 

Spurious opening of multiple series reactor head vent valves 

Scenario causes loss of RCS inventory through open head vent flowpath(s), challenging the RCS InventorFunction. Spurious operation of one head vent flowpath generarequires two spurious operations. Likewise, spurious operation of two head vent flowpaths generally requispurious operations. Note B&W plants only have one head vent flowpath. vents should be also be evaluated for B&W plants. From a PRA perspective, note that this scenario may out due to the low RCS inventory loss rate through thflowpaths. The scenario may also screen if the head valves are normally de-energized. From a PFSS analysis perspective, a head vent LOCbe acceptable if the available makeup mass flow rate the LOCA mass flow rate. 
NEI 00-01, Revision 2 

May 2009 

G-34 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS INVENTORY CONTROL / RCS INTEGRITY 21 Excess RCS Makeup 

Spurious starting of additional high head charging pump(s), AND Spurious opening of additional RCS makeup flow paths (i.e., charging injection) 

Scenario causes increasing RCS inventory, leading solid pressurizer and PORV or safety valve opening. scenario challenges both RCS Inventory and RCS PControl Functions. Similar to inadvertent SI. Note that the spurious pump starting can occur for sreasons, including fire damage to control circuitry or inadvertent ESFAS signal. Also note that other failures (spurious or non-spurioumakeup control system could contribute to this scen

22 

Primary Sample System 

Spurious opening of RCS sample valve(s) (i.e., hot leg, pressurizer liquid space, pressurizer steam space, etc.), AND Spurious opening of inside containment isolation valve, AND Spurious opening of outside containment isolation valve, AND Spurious opening of downstream sample valve(s) 

Scenario causes loss of reactor coolant through the sample system, challenging the RCS Inventory ContFunction. From a PRA perspective, scenario will generally screrequirement of 3+ spurious operations and the small magnitude of the leak. Also note that existing thermhydraulic evaluation of loss of coolant through head may bound loss of coolant via the primary sample syScenario can be screened from consideration if a maisolation valve prevents the flow. Scenario may also it is within a closed loop capable of withstanding exppressure. 
G-35 

ID 

# SCENARIO DESCRIPTION NOTES 

DECAY HEAT REMOVAL 23 

Inadvertent Steam Dumping 

Spurious opening of multiple atmospheric steam dump valves upstream of MSIV 

Scenario causes RCS over-cooling. Also, the overcoocan cause RCS shrinkage, causing low pressurizer levand challenging the RCS Inventory Control Function. Note that spurious operation of each individual steam dump valve may require multiple hot shorts. Note some B&W designs do not have MSIVs. 

24 

Inadvertent Steam Dumping 

MSIV(s) spurious opening, or failure to close, AND Spurious opening, or failure to close, of downstream steam loads (e.g., condenser steam dumps, turbine inlet valves, etc.) 

Scenario causes RCS over-cooling. Also, the overcoocan cause RCS shrinkage, causing low pressurizer levand challenging the RCS Inventory Control Function. Note that spurious opening, or failure to close, each individual MSIV may require multiple hot shorts. In addition, re-opening an MSIV once it has been closed be very difficult due to differential pressure across valvNote some B&W designs do not have MSIVs. 
NEI 00-01, Revision 2 

May 2009 

SCENARIO DESCRIPTION NOTES 

ID # 

DECAY HEAT REMOVAL 

Inadvertent Steam Dumping 

MSIV bypass valve(s) spurious opening, or failure to close, AND Spurious opening, or failure to close, of downstream steam loads (e.g., condenser steam dumps, turbine inlet valves, etc.) 

Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function. Note, depending on size and number of bypass lines fopen, scenario may not cause overcooling. Note some B&W designs do not have MSIVs. 

25 

Inadvertent Steam Dumping 

Spurious operation of other steam loads (e.g., main steam header drain valve(s), steam supply to turbine driven AFW pump, etc.) 

Scenario may cause RCS over-cooling. Also, the overcooling can cause RCS shrinkage, causing low pressurizer level, and challenging the RCS Inventory Control Function. Thermal hydraulic analysis may show that the drain va

flowpath is not large enough to be a problem. 

26 

27 

Turbine Driven AFW Pump Steam Supply 

Spurious isolation of redundant steam supply valves to turbine driven AFW pump 

Scenario causes turbine driven AFW pump loss of function, which challenges the Decay Heat Removal Function. 

G-36 
G-37 

ID 

# SCENARIO DESCRIPTION NOTES 

DECAY HEAT REMOVAL 28 AFW Flow Isolation Spurious closure of multiple valves in AFW pump discharge flow path(s) 

Scenario isolates AFW flow to the steam generator(s)challenging the Decay Heat Removal Function. AFW flow isolation can occur due to several combinatof valve closures in the pump discharge and/or dischacross-connect flow paths. Review P&IDs to identify specific valves. 

29 AFW Flow Isolation 

Spurious closure of steam supply valve(s) to turbine driven AFW pump, AND 

Spurious isolation of AFW pump discharge flow path(s) 

Scenario isolates AFW flow to the steam generator(s) causes turbine driven AFW pump loss of function, challenging the Decay Heat Removal Function. 

30 AFW Flow Diversion Combination of spurious valve operations in the AFW pump discharge flowpaths to the steam generators 

Scenario causes AFW flow diversion to a non-credited steam generator(s), challenging the Decay Heat RemFunction. A steam generator may be "non-credited" bSSA for a number of reasons including unavailability oinstrumentation, failure of steam dumps on that loop, eScenario may be a single spurious event in some casAlso note that plants with unit-crossties may be subjecflow diversion to steam generators for another unit. 
NEI 00-01, Revision 2 

May 2009 

SCENARIO DESCRIPTION NOTES 

ID # 

DECAY HEAT REMOVAL 

AFW Pump Runout 

Spurious full opening of multiple AFW flow control and/or isolation valves 

Scenario may cause AFW pump runout and failure, challenging the Decay Heat Removal Function. Note that this scenario may occur even without spuriooperations if the fail-safe position of relevant valves is open. 

31 

32 

CST Diversion to Condenser 

Spurious opening of valves between the CST and condenser hotwell 

Scenario causes inadvertent draining of CST inventorthe condenser. This CST inventory becomes unavailaas an AFW source, challenging the Decay Heat RemoFunction. In some plants, this requires spurious operation of mu

valves. In other plants, this only requires spurious 

operation of one valve. And in other plants, this may odue to loss of instrument air or a non-spurious valve fa(e.g., loss of air / power). Other CST draindown paths may exist. P&ID review required. Some plants may have a standpipe that prevents the from draining below a certain level. 

G-38 
G-39 

ID 

# SCENARIO DESCRIPTION NOTES 

DECAY HEAT REMOVAL 33 

Excess Feed Flow to Steam Generator 

Scenario can occur due to various combinations of spurious AFW pump starts, spurious opening (or failure to close) of valves in AFW pump discharge flowpaths, and spurious opening of MFW isolation valves with MFW pump(s) running. 

Scenario causes RCS over-cooling and/or steam geneoverfill, both challenging the Decay Heat Removal Function. RCS over-cooling can cause RCS shrinkagand low pressurizer level. Steam generator overfill caaffect operability of turbine-driven AFW pump. Note that the spurious pump starting can occur for sevreasons, including fire damage to control circuitry or ainadvertent ESFAS signal. 

34 

Steam Generator Blowdown 

Spurious opening of, or failure to close, multiple series steam generator blowdown valves 

Scenario causes drain down of steam generator inventhrough the blowdown system, challenging the Decay Removal Function. The number of valves required to spuriously open varby plant design. B&W plants generally do not have a steam generator blowdown system. However, some B&W plants with replacement steam generators may have this system. Potential Resolution: Scenario may screen if available AFW mass flow rate exceeds steam generator inventomass loss rate through blowdown. 
NEI 00-01, Revision 2 

May 2009 

G-40 

ID 

# SCENARIO DESCRIPTION NOTES 

DECAY HEAT REMOVAL 35 

Secondary Sample System 

Spurious opening of steam generator sample valve(s) inside containment, AND Spurious opening of isolation valve(s) outside containment, AND Spurious opening of downstream sample valve(s) 

Scenario causes drain down of steam generator inventhrough the sample system, challenging the Decay HeRemoval Function. From a PRA perspective, scenario will generally screedue to requirement of 3+ spurious operations and the magnitude of leak. Scenario can be screened from consideration if a manisolation valve prevents the flow or if the system is clo

loop capable of withstanding expected pressure. Scenario may also screen if available AFW mass flow exceeds steam generator inventory mass loss rate thrthe sample system. B&W plants sample directly from the steam generator not through blowdown system). 
G-41 

ID 

# SCENARIO DESCRIPTION NOTES 

RCS PRESSURE CONTROL 36 

RCS Pressure Decrease 

Spurious opening of pressurizer spray valve(s), AND Inability to trip, or spurious operation of, RCP, AND Failure of pressurizer heater(s) 

Scenario causes a RCS pressure transient, challengiRCS Pressure Control Function. Typical PFSS analyaddress this issue; PRAs often consider scenario negsince there is no real threat of core uncovery. Potential candidate for generic analysis to evaluate vaspray / heater combinations and show no adverse imsafe shutdown capability. Note that spurious opening of failure to isolate pressuauxiliary spray would have similar consequence; howthis is typically a single spurious scenario. 

37 

RCS Pressure Increase 

Spurious operation of multiple pressurizer heaters, ANDFailure of pressurizer spray or auxiliary spray 

Scenario causes a RCS pressure transient, challengiRCS Pressure Control Function. RCS pressure increcould cause PORV(s) and/or safety valve(s) to open. 
NEI 00-01, Revision 2 

May 2009

G-42 

ID 

# SCENARIO DESCRIPTION NOTES 

REACTIVITY CONTROL 38 

Inadvertent Boron Dilution 

Unborated water supply to the RCS can occur due to combinations of the following:  -Spurious start of reactor makeup pump(s)  (supplies unborated water to the VCT),  -Spurious opening of valves between reactor  makeup pump(s) and VCT,  -Spurious full opening of the reactor makeup  flow control valve,  -Spurious closure of the boric acid flow control  valve 

Scenario decreases RCS boron concentration, potencausing reactivity increase, and challenging the ReacControl Function. The reactor makeup flow control valve would normally provide the setpoint flowrate instead of being fully opePotential Solution: The maximum flow from the reactomakeup pump may be limited due to the plant specifdesign (e.g., installation of a flow orifice to limit the pumaximum flow, boron dilution protection system, etc.)Potential Solution: The reactivity increase may occur very slow rate, allowing operators sufficient time to m

39 

Fire Prevents Reactor Trip 

Fire damage to RPS may prevent reactor trip. 

BWRs have identified scenarios where fire-induced hshorts could prevent all control rod groups from insertwhen required. Reference NRC Information Notice 207. No cases at PWRs were identified by the survey resusupported this MSO list. However, each plant should consider performing a review to determine if scenario plausible at their plant. Note that this review may havalready been performed for the disposition of InformaNotice 2007-07. 
G-43 

ID 

# SCENARIO DESCRIPTION NOTES 

SUPPORT FUNCTIONS 40 

CCW Header Isolation 

CCW flow can be isolated via several combinations of spurious valve closures. Pertinent valves include:  -Pump discharge valves,  -Pump crosstie valves,  -CCW heat exchanger inlet valves,  -CCW heat exchanger outlet valves,  -CCW heat exchanger crosstie valves,  -Etc. 

Scenarios cause failure of CCW function to provide coto safe shutdown loads. Review P&IDs to identify relevant valve combinations

41 

CCW to Redundant Loads 

Spurious isolation of CCW cooling to redundant loads (including lube oil coolers, RHR heat exchangers, etc.) 

Scenario isolates CCW cooling to redundant loads casafe shutdown equipment inoperability of redundant trFor example, a plant may have two redundant charginpumps. Each charging pump may have a lube oil systhat is cooled by the corresponding train of CCW. If Cflow to both lube oil coolers spuriously isolates, then bcharging pumps would become inoperable. All credited CCW loads should be reviewed. 

42 

CCW Flow Diversion to NonCredited Loop 

Flow diversion can occur via several combinations of spurious valve operations in the CCW pump discharge and CCW loop crosstie flowpaths. 

Scenario causes CCW flow to be diverted to the noncredited loop. This ultimately prevents CCW cooling ocredited safe shutdown loads. Review P&IDs to identify relevant valve combinations
NEI 00-01, Revision 2 

May 2009 

SCENARIO DESCRIPTION NOTES 

ID # 

SUPPORT FUNCTIONS 

ESW Header Isolation 

ESW flow to credited loads can be isolated via several combinations of spurious valve closures. Pertinent valves include:  -pump discharge valves,  -pump crosstie valves,  -ESW heat exchanger inlet valves,  -ESW heat exchanger outlet valves,  -ESW heat exchanger crosstie valves,  -Etc. Review P&IDs to identify relevant combinations. 

Scenario causes isolation of ESW, which can fail coolthe CCW system and other safe shutdown componendirectly cooled by ESW (e.g., EDG cooling). All credited ESW loads should be reviewed for spuriouisolation. 

43 

ESW to Redundant Loads 

Spurious isolation of ESW cooling to redundant loads (including CCW heat exchangers, EDG cooling, etc.) 

Scenario isolates ESW cooling to redundant loads causafe shutdown equipment failure on redundant trains. For example, redundant EDGs may be cooled by ESWESW flow to both EDGs spuriously isolates, then both EDGs could fail. All credited ESW loads should be reviewed. 

44 

45 

ESW Flow Diversion to NonCredited Loops / Systems 

Flow diversion can occur via several combinations of spurious valve operations in the ESW pump discharge and loop crosstie flowpaths. Review P&IDs to identify relevant combinations. 

Scenario causes ESW flow to be diverted to a non-creloop or system. This ultimately prevents ESW cooling credited loads. Review P&IDs to identify relevant valve combinations

G-44 
G-45 

ID 

# SCENARIO DESCRIPTION NOTES 

SUPPORT FUNCTIONS 46 Emergency Power Additional components load onto credited diesel generator Scenario causes diesel generator overloading and fai

Note: Scenario very site specific. Interlocks may prevethis from occurring. 

47 Emergency Power Diesel generator overloading 

Scenarios cause diesel generator overloading and failNote: Scenarios very site specific. Interlocks may prevthese from occurring. In addition to Scenario 45, overloading may also occuproper load sequencing is bypassed via hot shorts, casimultaneous loading of multiple components onto the EDG. 

48 Emergency Power Diesel generator spuriously starts without service water cooling 

The fire causes startup of the Emergency Diesel Geneand spurious isolation of ESW cooling (See Scenarios 45). Running the Emergency Diesel Generator with a of cooling water could trip and/or damage the diesel ohigh temperature. 

49 Emergency Power Non-synchronous paralleling of EDG with on- site and off-site sources through spurious breaker operations Scenario causes damage to diesel generator by closin

into a live bus out-of-phase. Note: Scenario very site specific. Interlocks may prevent this from occurring. 
NEI 00-01, Revision 2 

May 2009

G-46 

ID 

# SCENARIO DESCRIPTION NOTES 

OTHER SCENARIOS 50 Generic - Loss of Pump Suction Spurious isolation of various combinations of pump suction valves 

Suction flow paths for all crediteshould be reviewed for MSO sccausing loss of suction and pumexample of a pump suction MSO previously identified in which booutlet valve(s) and RWST outlet spuriously close. Another example involves pump cross-connect valves. Three pusupplied from a common suctioincludes several cross connect valves spuriously isolate, the pusuction from the common headethe two isolated valves can lose fail. The spurious operation of idle psuction has been spuriously isoalso be considered. Spurious pcan occur for several reasons, idamage to control circuitry or an ESFAS signal. 
G-47 

ID 

# SCENARIO DESCRIPTION NOTES 

OTHER SCENARIOS 51 Generic - Pump Shutoff Head 

Spurious isolation of pump discharge flow, ANDSpurious isolation of recirculation valve(s) 

Scenario causes pump operation at shutoff head and subsequent inoperability. All credited pumps should be reviewed for this scenario. Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause inoperability of additional pumps. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESFAS signal. 

B&W CE W 
NEI 00-01, Revision 2 

May 2009 

G-48 

ID 

# SCENARIO DESCRIPTION NOTES 

OTHER SCENARIOS 52 Generic - Pump Outside Design Flow Pump damage from operation outside design flow either at shutoff head or pump run-out conditions. 

Scenario causes pump failure. All credited pushould be reviewed for this scenario. Operation at shutoff head can occur, for exampump discharge flow spuriously isolates with trecirculation valves closed. Run-out can occuexample, if the discharge header is at reduced pressure conditions. Note that spurious starting of idle pump(s), in combination with isolation of discharge flow anrecirculation, may cause failure of additional pSpurious pump starting can occur for several rincluding fire damage to control circuitry or an inadvertent ESFAS signal. 

53 Generic Flow Diversion Spurious operation of various valves causing flow diversion 

All credited flow paths should be reviewed for scenarios that can divert flow away from desirelocation. An example is AFW pump flow diverthrough the recirculation flow path back to the Emergency Feed water Storage Tank failing thmakeup to steam generator function. 

54 Loss of HVAC Spurious isolation of HVAC to credited loads 

Perform review to identify spurious failures thacause isolation of Heating Ventilation and Air Conditioning (HVAC) to credited loads. Creditmay include pump rooms, switchgear rooms, arooms containing solid state control systems. Examples of spurious failures include spurious isolation and spurious isolation of cooling flow chillers. 
G-49 

ID 

# SCENARIO DESCRIPTION NOTES 

OTHER SCENARIOS 55 Valve Failure 

Spurious motor-operated valve operation, ANDWire-to-wire short(s) bypass torque and limit switches 

General scenario is that fire damage to motor-valve circuitry causes spurious operation. If thfire causes wire-to-wire short(s) such that the vtorque and limit switches are bypassed, then tmotor may stall at the end of the valve cycle. cause excess current in the valve motor windwell as valve mechanical damage. This mechdamage may be sufficient to prevent manual oof the valve. Scenario only applies to motor-operated valveNote this generic issue may have already beeaddressed during disposition of NRC Informat92-18. This disposition should be reviewed in context of multiple spurious operations and mushorts. 

56 Fire-Induced Inadvertent ESFAS 

Fire-induced inadvertent ESFAS signals (e.g., safety injection, containment isolation, etc), c

with other fire-induced failures, can adversely affect safe shutdown capability. An example induced ESFAS signal is a fire causing open circuits on 2/3 main steam pressure instrumenloop resulting in a spurious safety injection signal. ESFAS signals can result from open circshorts to ground, and/or hot shorts. Fire-induced failure of instrument inverters may also cainadvertent ESFAS signals. The plant should perform a systematic review to asses the pote

fire-induced inadvertent ESFAS to adversely affect safe shutdown capability. Below are soexamples. 

56a RCS Makeup Pump Failure 

Spurious safety injection signal, AND Spurious isolation of makeup pump suction 

Safety injection signal starts multiple RCS makpumps. Fire causes makeup pump suction vafail closed. Scenario results in cavitation / failumultiple RCS makeup pumps. 
NEI 00-01, Revision 2 

May 2009 

G-50 

ID 

# SCENARIO DESCRIPTION NOTES 

OTHER SCENARIOS 56c 

Loss of all Seal Cooling 

Spurious containment isolation signal isolates CCW to the thermal barrier heat exchangers for all RCPs, AND Spurious opening of charging injection valve(s) causing insufficient flow to seals 

Scenario causes loss of all RCP seal cooling asubsequent RCP Seal LOCA. *This scenario is not applicable to CE plants wpressurizer PORVs 

56d RWST Drain Down Spurious high containment pressure on multiple channels causing spurious containment spray signal Scenario causes a pumped RWST drain down 

containment spray pumps and containment sp

56e PORV(s) Open Spurious high pressurizer pressure on multiple channels causes high pressurizer pressure signal Spurious high pressurizer pressure signal cau

PORV(s) to open and challenges the RCS Invand Pressure Control Functions 

56f 

RCS Makeup Pump Failure 

Spurious Recirculation Actuation Signal (RAS) starting and aligning pumps to a dry containment sump. 

Scenario causes failure of RCS makeup pumpto cavitation. 
G-51 

TERMINOLOGY LEGEND 

AFW 

Auxiliary Feedwater System. Provides feedwater for removing decay heat via the steam generators. B&W plants generally refer to this as Emergency Feedwater (EFW). 

Charging 

This is the RCS high head makeup system. B&W plants refer to this simply as the Makeup System 

CVCS 

Chemical and Volume Control System. System allows for RCS letdown, cleanup, chemical addition, and makeup. B&W plants refer to this as the Makeup and Purification (MU&P) System 

EFWST 

Some plants have an "Emergency Feedwater Storage Tank" (EFWST) that provide a dedicated source of Auxiliary Feedwater. 

RWST 

Refueling Water Storage Tank. Provides borated water source for RCS makeup. Also referred to as Safety Injection Refueling Water Tank (SIRWT) or Refueling Water Tank (RWT). B&W plants refer to this as the Borated Water Storage Tank (BWST) 

VCT 

Volume Control Tank. Provides NPSH to high head charging pumps during normal operation. B&W plants refer to this as the Makeup Tank. 

NEI 00-01, Revision 2 

May 2009 

H-1 

APPENDIX H

REQUIRED FOR HOT SHUTDOWN VERSUS IMPORTANT TO SSD 

COMPONENTS 

H.1 INTRODUCTION 

The purpose of this appendix is to define required for hot shutdown components versus 

important to safe shutdown components. The reason for the distinction between these 

two (2) groups of components is that a required for hot shutdown component’s fire 

protection features are governed specifically by the requirements of Appendix R Sections 

III.G.1.a and III.G.2, whereas, an important to safe shutdown component’s fire protection 

features are not directly addressed in terms of specific fire protection features under 

Appendix R III.G.1. For plants required by 10CFR50.48 to meet the requirements of 

Appendix R Section III.G, the only available mitigating actions for addressing fireinduced impacts to the circuits for the required for hot shutdown components governed 

by Appendix R Section III.G.1, other than re-design, re-routing, exemptions or 

deviations, is protection of these circuits using the specific fire protection features 

required by Appendix R Section III.G.2. Although the use of the Standard License 

Condition is available for Plants licensed post-1979, the use of measures other than those 

described above for required for hot shutdown components will be heavily scrutinized by 

NRC relative to the justification for no adverse impact. For fire-induced impacts to 

circuits for components classified as important to safe shutdown components, additional 

mitigating strategies are available as defined in this appendix and within the body of NEI 

00-01. 

H.2 DEFINITIONS

This appendix provides a definition of the required for hot shutdown components and 

important to safe shutdown components. 

3⁄4 The required for hot shutdown components are those components on the required 

safe shutdown path for a particular fire area that are designated to perform the 

following safe shutdown functions: reactivity control, pressure control, inventory 

control, decay heat removal, process monitoring, as defined in NRC information 

Notice 84-09 and support systems, including electrical power, component cooling 

and lube oil cooling. 

3⁄4 Based on the BWROG White Paper on NRC IN 2007-07, due to the 

impracticality of protecting circuits required for the RPS/RTS scram function, 

post-fire safe shutdown procedures rather than circuit analysis are required to 

assure the reactivity control function. Refer to Appendix E for a discussion of 

this operator manual action in support of post-fire safe shutdown. 
NEI 00-01, Revision 2 

May 2009 

H-2 

 

3⁄4 For the remaining required for hot shutdown functions, fire-induced impacts to 

circuits for any required for hot shutdown components must be protected by a 

means meeting the requirements of the appropriate section of Appendix R or 

approved licensing basis for post-1979 Plants.. The use of operator manual 

actions is not allowed to mitigate the effect of fire-induced circuit damage 

resulting from a hot short, a short-to-ground or an open circuit. Re-routing or redesign of components and/or circuits may be used to eliminate safe shutdown 

impacts. Deviation or exemption requests may also be used. 

3⁄4 Those HVAC Components for which an analysis cannot demonstrate the 

feasibility of longer term manual actions such as opening a door to provide room 

cooling are classified are required for hot shutdown components. Refer to Section 

3.1.2.6.3 of this document for a more detailed discussion of this issue. 

3⁄4 Fire-induced circuit damage to valves resulting in a flow diversion from the main 

flow path for a required for hot shutdown systems are classified as required for 

hot shutdown components. Only when an engineering evaluation concludes that a 

flow diversion will not impact the required safe shutdown function can these 

components be re-classified as important to safe shutdown. Each flow path is to 

be evaluated individually. To be re-classified as an important to safe shutdown 

component, the flow diversion must meet the following criteria: 

o If as a result of the flow diversion, assuming the valve in the flow 

diversion path opens at the start of the fire, i.e. time zero, it must take 

longer than 1 hour33 for any of the following threshold conditions to be 

met, then the valve would be classified as important to safe shutdown. For 

multiple series valves in a flow diversion path, in the absence of technical 

justification to the contrary, all valves in the series are assumed to be 

opened at the start of the fire, i.e. time zero. Fire modeling, however, may 

be used to determine the amount of time required to open any subsequent 

valves for cases involving the need to open series valves to cause the flow 

diversion. Since the threshold criteria listed below will not be exceeded 

until all series valves in a given flow diversion path are opened, the time 

determined through fire modeling to open subsequent valves may be 

credited as part of the required time to exceed the threshold criteria. 

[Note: Information on the definition of time zero for the fire is contained 

in Appendix E.] 

 Core Damage (PCT ≥ 1800o

F) – Reference NUREG 0562 

 Rupture of the Primary Coolant Boundary 

 Rupture of the Primary Containment 

33 The 1 hour criterion is based on NUREG 1852. 
NEI 00-01, Revision 2 

May 2009 

H-3 

When performing thermal-hydraulic analysis in support of post-fire safe 

shutdown scenarios, best estimate values along with the core damage 

measurement of PCT ≥ 1800o

F may be used. These criteria are similar to 

those used for the Internal Events PRA thermal hydraulic analysis. The 

use of these same criteria for post-fire safe shutdown provides for a 

consistent approach and a cost effective use of the information developed 

on plant response to various transient conditions. 

o If the evaluation indicates that there is no impact, for an unlimited amount 

of time, to the required hot shutdown system to perform its required safe 

shutdown function, then it the flow diversion is classified as “nonimpacting”. The lack of impact can be as a result of a quantitative 

evaluation addressing the parameters described above or as a results of a 

qualitative evaluation related to the small size of the flow diversion path, 

e.g. flow diversion paths ≤ 1", or the flow diversion path having no 

adverse consequence, e.g. flow diversion through the Suppression Pool 

Spray line in a Mark II BWR when RHR is being used in the Suppression 

Pool Cooling mode. The flow diversion through a 1" line is considered to 

provide and insignificant loss of inventory when compared to the 

capacities of any of the systems with the capability to provide adequate 

make-up to the reactor during shutdown conditions. For the flow 

diversion through the Suppression Pool Spray line with the RHR System 

operating in the Suppression Pool Cooling mode of operation, the is no 

impact to the function of the system since water is still being taken from 

the Suppression Pool, run through the RHR Heat Exchanger and returned 

to the Suppression Pool. 

o The threshold criteria described above should be viewed as a measure of 

risk of the flow diversion to post-fire safe shutdown as opposed to an 

acceptable time frame for performing an alternate mitigating strategy. 

Even though the threshold criteria described above may not be exceeded 

for a period in excess of 1 hour, the use of an operator manual action as a 

mitigating measure for a particular flow diversion must still justify that 

there is sufficient time to diagnose and perform the operator manual 

action. For example, if the threshold criteria are not exceeded for 2 hours, 

but the only available operator manual action would take 2.5 hours to 

accomplish, the use of the operator manual action would not be justified in 

this case. 

o Any impacts associated with simultaneous flow loss through multiple flow 

diversion paths on the same required safe shutdown system should be 

captured as a part of the MSO review. 
NEI 00-01, Revision 2 

May 2009 

H-4 

o In evaluating flow diversions, consideration should also be given to the 

effect of the flow diversion on voiding in the discharge piping and the 

potential for a subsequent waterhammer. 

o In evaluating flow diversions, consideration should also be given to the 

effect of the flow diversion on the suction path for a pump required for hot 

shutdown resulting in pump damage due to cavitation. 

3⁄4 Fire-induced damage to associated circuits of concern for a breaker off of a bus 

for a required component requires that the breaker feeding the associated circuit 

of concern be classified as a required for hot shutdown component. Coordination 

is required for these breakers. 

3⁄4 Circuits for required for hot shutdown components are classified as required for 

hot shutdown circuits. 

3⁄4 Important to safe shutdown components are all components not classified as 

required for hot shutdown components. Important to safe shutdown components 

can impact post-fire safe shutdown in other ways, e.g. flow diversions off of tanks 

providing a suction source for a required for hot shutdown pump. 

3⁄4 Circuits for important to SSD components are classified as important to SSD 

circuits. 

Refer to Figure H-1 for a pictorial presentation of this information. 

H.3 REGULATORY BASIS 

H.3.1 Required for Hot Shutdown Components 

The origin for the requirements associated with required for hot shutdown components is 

Appendix R Section III.G.1.a. Appendix R Section III.G.1.a requires that one train of 

systems necessary to achieve and maintain hot shutdown be “free of fire damage”. 

The information in italics is intended to be wording taken verbatim from the Code of 

Federal Regulations. 

III. G. Fire protection of safe shutdown capability. 

1. Fire protection features shall be provided for structures, systems, and components 

important to safe shutdown. These features shall be capable of limiting fire 

damage so that: 

a. One train of systems necessary to achieve and maintain hot shutdown conditions 

from either the control room or emergency control station(s) is free of fire 

damage; and 
NEI 00-01, Revision 2 

May 2009 

H-5 

b. Systems necessary to achieve and maintain cold shutdown from either the control 

room or emergency control station(s) can be repaired within 72 hours.

If circuits for the components required to perform the hot shutdown functions on the 

systems selected for safe shutdown in any fire area could be damaged by the fire, then 

protection of these circuits in accordance with the requirements of Appendix R Section 

III.G.2 is required. 

H.3.2 Important to Safe Shutdown Components 

Important to Safe Shutdown components are described in Paragraph III.G.1 of Appendix 

R not specifically addressed in Appendix R. Paragraph III.G.1 reads as follows: 

Fire protection features shall be provided for structures, systems, and components 

important to safe shutdown.

Paragraph III.G.1, however, does not specifically describe the requirements for the fire 

protection features to be provided for important to safe shutdown components. Because 

of this, there is some latitude in selecting the fire protection features that can be used to 

mitigate the affects of fire-induced damage with the potential to impact the required 

components. 

H.4. REQUIRED FOR HOT AND IMPORTANT TO SAFE SHUTDOWN

COMPONENTS 

H.4.1 Criteria for Segregating 

Required Safe Shutdown Components

 Review the safe shutdown methodology for each fire area. 

 Identify those systems being used to support each of the required hot shutdown 

functions. Refer to the guidance in Section 3.1.2 for a more detailed discussion on 

the definition of components required for post-fire safe shutdown. 

 Identify the components required for those systems to be able to perform the required 

safe shutdown function for the system. 

 Identify the potential flow diversion off of the systems being used to perform the 

required safe shutdown functions. 

 Evaluate whether or not the size of the flow diversion can impact the ability to 

achieve and maintain safe shutdown based on the threshold criteria provided above. 

 For flow diversions where the flow diversion size exceeds the threshold criteria in 

less than or equal to 1 hour, classify the flow diversion component as a required for 

hot shutdown component. Classify the remaining flow diversion components as 

important to safe shutdown or non-impacting depending on whether the flow 

diversion needs to be isolated using an operator manual action or its affect can be 

tolerated. 

 Identify the power supplies for each of required safe shutdown components. 
NEI 00-01, Revision 2 

May 2009 

H-6 

 Identify the circuits for all breakers coming off of a bus powering a required safe 

shutdown component. 

 Determine if these circuits represent associated circuits of concern. 

 Provide breaker coordination for all breakers associated with associated circuits of 

concern. 

For any component classified as a required component, classify its power supplies for 

both motive and control power as required safe shutdown components for the particular 

fire area under review. Any cable required for the operation of this set of components is 

a required safe shutdown cable. 

Important to Safe Shutdown Components

 Component, other than those described above, whose fire-induced spurious operation 

can cause a flow diversion with the potential to impact a system performing one of 

the required safe shutdown functions is an important to safe shutdown component. 

 Any component whose fire-induced spurious operation can cause a flow loss from the 

RPV or from a tank providing a suction source for a system performing a required 

safe shutdown function is an important to safe shutdown component. 

 Any component with the potential to impact a system performing a required safe 

shutdown function that is not classified as a required component is classified as an 

important to safe shutdown component. 

Cables associated with the important to safe shutdown components described above are 

classified as important to safe shutdown circuits. 

H.4.2 Acceptable Mitigating Tools 

Required Safe Shutdown Components

 Assure they are free of fire damage by re-routing or re-designing the component or 

circuit. 

 Protect the circuits in accordance with Appendix R Section III.G.2.a, b or c. 

 Process a licensing change in accordance with the licensee’s current licensing basis 

(CLB) to demonstrate the acceptability of the condition. Depending on change and 

the licensee’s CLB, NRC approval of the change may be required. Plants licensed to 

operate after January 1, 1979 with standard license condition for their Fire Protection 

Program may make changes to their approved Fire protection Program as long as the 

change does not adversely impact the ability to achieve and maintain safe shutdown 

in the event of a plant fire. Plants licensed to the requirements of 10CFR50.48 must 

obtain NRC approval prior to making changes governed by the requirements of 

Appendix R Section III.G.1 and II.G.2. 

 Perform a risk informed analysis using the tools available for important to safe 

shutdown components in accordance with Regulatory Guide 1.174 and 1.200. This 

approach requires a license amendment. 
NEI 00-01, Revision 2 

May 2009 

H-7 

Important to Safe Shutdown Components

 Either protect as outlined for required safe shutdown components above, or 

 Use a feasible and reliable operator manual action with defense-in-depth. 

 Use fire modeling analysis with defense-in-depth, or 

 Use a focused-scope fire PRA to justify the acceptability of the condition using 

the criteria in Section 5. A licensing basis change or license amendment may be 

required to use a focused-scope fire PRA. 

Non-Impacting Components

 No mitigating action beyond the analysis demonstrating that there is no impact to 

post-fire safe shutdown is required. 
NEI 00-01, Revision 2 

May 2009 

Power Source: Diesel Generators or 

4.16 KV Bus

Power Feed to Required Safe Shutdown Pump 480 VAC MCC

Power Feed to

Required SSD Valves

(Typ. of 3)

480 VAC MCC

480

VAC

Feed

ot

Battery

Charger

Battery

Charger

125 VDC Battery

125 VDC

Distribution Panel

Offsite Power

AC Control Power

(from CPT)

Valve AC Control Circuit (T

Pump DC Control Circuit

Min. Flow 

that res

pump cav

[100% R

Dischar

Suction Li

N.O./

N.O./

N.C./R.C. N.C./R.C.

[refer to Note 1]

Associated Circuit

of Concern - CPS

Associated Circuit of

Concern - CPS

Associated Circuit of

Concern - CPS

Associated Circuit of

Concern - CPS

Associated Circuit of

Concern - CPS

Non-impacting

Non-impacting

Non-impacting

Non-impacting

Non-impacting

H-8