NFPA 72
Changes include guidance on cybersecurity, remote access, survivability, and more
nfpa.org/72next

You’ll never build a garden fence that’s completely impenetrable—but as long as yours is better than your neighbors’, the rabbits are likely to go elsewhere for a meal. It’s a good rule of thumb for gardeners, and also for cybersecurity, an area where the proverbial rabbits are getting more creative and more aggressive all the time.

RELATED: Read more about the 2021 NFPA Technical Meeting, which will be held in June in a virtual format.

In recognition of the increasingly frequent malicious attacks on buildings and systems, NFPA 72®, National Fire Alarm and Signaling Code®, will include cybersecurity guidance for fire alarms in its next edition, which will be released in the fall. It’s the first time in its long history that the code has addressed the issue.

While the concept of an alarm needing cybersecurity might have been a head-scratcher just a decade ago, as detailed in the Spring 2021 NFPA Journal cover story, “Weak Spots,” alarms and other connected building systems have become popular targets for cybercriminals in recent years. Hackers are increasingly breaching security and other systems to gain access to servers and other sensitive targets, where they can install ransomware or simply steal data and sell it. Global losses from such attacks are in the billions of dollars annually.

Instead of including a comprehensive list of cybersecurity requirements in the main code, the NFPA 72 committee opted to take a more flexible approach and put the information in new annex material. That means that rather than being required to follow a minimum standard, users can select the level of security they think they need and use the annex to learn how to get there. “It’s like a risk assessment and roadmap of what needs to be done if somebody wants to pursue a certain reasonable level of cybersecurity,” said Richard Roux, principal specialist at NFPA and the NFPA 72 staff liaison.

This approach was necessary because there are so many unique factors that make cybersecurity nuanced and situational, Roux said. Like a vegetable garden fence, how high or how robust to build your defenses can depend on many factors, including what you’re protecting, how big a target you are, and what industry you’re in. All of that “makes it hard to know where to draw the line” when crafting a standard, Roux said. “It’s very difficult to say, ‘This requirement will make the system impervious to cyberattack or make the system less likely to be attacked.’”

In addition to the annex, the committee also included a brief new chapter on cybersecurity. It consists of a single sentence, one that informs users that cybersecurity “shall be provided for equipment, software, firmware, tools,” etc., where required by governing laws, codes, or standards.

The effort to provide cybersecurity guidance grew out of public feedback that the NFPA 72 committee received last cycle. When the committee convened this cycle, it formed a task group to look at the issue, and the topic quickly grew legs. “Users of the code and some of our committee members work for companies that have been hacked, so this topic was on the tips of their tongues,” Roux said of the interest. “It’s become important to people, particularly to those who’ve experienced a hack. They know it can happen and can have significant consequences.”

Remote Access

Related to but separate from the cybersecurity issue, the committee added language that specifically allows fire alarm and signaling systems to be accessed remotely in order to perform tasks, including resetting, silencing, performing diagnostics, and updating software. Previously, the code was silent on the issue.

The expressed allowance was included in acknowledgement that remote access to alarms is already widely happening, Roux said. In fact, he believes that a majority of alarms are now connected in some way to either the Internet, a communication infrastructure, or some other central hub, allowing manufacturers to install updates and technicians to monitor and maintain the equipment. “The fact is, if manufacturers have a bug to fix, they don’t want hundreds of technicians to go out and perform updates on 2,000 alarms. They want to do it all by pressing a button in their office,” Roux said.

While this connectivity is convenient, connections to the outside do create pathways for hackers to get in, making cybersecurity measures and the new guidance in NFPA 72 even more timely, Roux said. “We see the two things kind of bucking one another. In some ways they’re conflicting, but they’re both important,” he said.

Color tagging 

In some jurisdictions, technicians use a color-coded tagging system on the alarm control unit to let users and the public know if the alarm is functioning properly. Green means everything is good, yellow means it works but is compromised, and red means it is not functioning properly. In the new edition, the committee decided to add annex material offering guidance on how to adopt this system of transparency if jurisdictions are interested in doing so.

“Adoption of this is purely state by state or jurisdiction by jurisdiction,” Roux said. “The code has never touched this before, but people ask about this all the time, and so the committee decided to include some new guidance.”

Survivability

In many buildings, NFPA 72 requires the wiring and components of an alarm and signaling system to survive a fire for two hours (or more) so that it will keep doing its job. In specific cases, however, the committee decided to reduce that rating to an hour in the next edition. The change applies mostly to situations where the building itself has a lower construction rating and doesn’t necessarily merit a two-hour survivability requirement. “Although NFPA 72 is a minimum code, it isn’t necessarily the right answer,” Roux said of the two-hour requirement. “The committee was proactive, and the provision is very limited as to what it will apply to, but it’s significant. This can be a cost savings in those situations.”

Multi-criteria detectors

Signaling an impending major shift in smoke detector technology, the committee scrubbed many of the references in the code to ionization and photoelectric detection, the technologies that have dominated the market for years. That’s because UL announced two years ago that it was changing its alarm listing standards to include only alarms that can pass a series of tests to prove that they won’t sound from cooking smoke or other causes of nuisance alarms. As a result, at the end of June 2022, when the UL standard goes into effect, the only detectors on the market will likely be detectors that can pass this test—detectors that NFPA 72 now calls “multi-criteria” detectors.

“Ten years from now, ‘ionization’ and ‘photoelectric’ are terms that will no longer be used,” Roux said. “In this revision of the code, the committee changed a lot of places where the terms were used and removed much of the discussion relative to photoelectric and ionization.”

NFPA 13
Sprinkler density, rack storage, and elevator shaft protection highlight upcoming changes
nfpa.org/13next

For decades, NFPA 13, Standard for the Installation of Sprinkler Systems, has instructed sprinkler designers and installers to use what’s known as a density/area curve to calculate sprinkler density—the measurement of the volume of water released in a certain amount of time over a specific area. Given hazard group classifications, users could pick any density along a curve. But a change slated for the 2022 edition of NFPA 13 would eliminate the curve method of density calculation for new sprinkler systems and replace it with a single-point method of density calculation.

That’s just one of the changes proposed for the upcoming edition of NFPA 13. Another anticipated change would put a cap on rack depth for storage facilities, while a familiar debate over sprinklers in elevator shafts is set to unfold at the 2021 Association Technical Meeting.

One proposed change to NFPA 13 would limit multi-row rack depth to 20 feet. 

The shift from density/area curves to a single-point method would be the most significant change to the standard, according to Chad Duffy, the NFPA staff liaison to NFPA 13.

“We’re moving away from those curves and toward very specific density/area points,” Duffy said, adding that the curves were created based on data that was as much as 50 years old. “So you will no longer be able to pick any point along the curve. Most technical committee members think this is probably the best direction to go, especially when it comes to authorities having jurisdiction. A lot of folks didn’t really understand how you could use different points on the curve. This will clean that up and make it easier for AHJs.”

In addition to simplifying the standard, Duffy said the change would eliminate any doubt that every single point on a curve would in fact translate to a sprinkler system performing as it should. “Not every point on these curves was proven,” he said. “A lot of the curve may have been interpolated from a few data points. I don’t think we have any type of historical data of fire incidents where we could say we used a density curve and the sprinkler system didn’t control the fire like it was designed to. But by moving to a single-point density method, it removes any uncertainty that might exist with the interpolation of the curves.”

Not everyone agrees with the change. “The curves have been working for us since the 1970s,” Larry Keeping, a fire protection engineer and member of NFPA 13’s Sprinkler System Discharge Criteria committee, wrote in a public comment submitted in April 2020. “The old adage ‘If it ain’t broke, don’t fix it’ comes to mind.”

The committee responded, saying that “the intent of the single-point density approach has been to improve sprinkler performance by selecting the highest possible discharge density.”

Beyond single-point density

A second change Duffy said is expected for the 2022 edition of NFPA 13 is a limit on the depth of multi-row storage racks to 20 feet—an attempt at preventing fire spread in warehouses. Currently, the standard doesn’t have a limit on multi-row rack depth.

“Without limitation, the concern is horizontal fire spread through these multi-row racks,” Duffy said. “If you have overhead sprinklers protecting multi-row racks and they’re extremely deep and you have all that product on various levels, the sprinklers could be shielded.”

Representatives from the rack industry oppose the proposed change. “This change as currently written will classify just about every multiple-row rack in every warehouse as having solid shelves. Thus … there would be an in-rack sprinkler requirement under every pallet storage level,” Gary Smith, a member of the NFPA 13 Sprinkler System Discharge Criteria committee, who is also senior vice present of sales and marketing for rack manufacturer DACS, Inc., wrote in a public comment in April 2020. The change would be costly and inevitably lead to more collisions between forklifts and sprinklers, Smith added.

Despite that industry opposition, Duffy said no notices of intent to make a motion (NITMAMs) were filed by the rack industry.

There are several NITMAMS, however, pertaining to an issue that has come up many times before during NFPA 13 cycles, Duffy said, and that’s the debate over whether sprinklers should be required in elevator pits, the lowest area of an elevator shaft. The current edition of the standard requires spinklers in elevator pits.

The argument in favor of sprinklers rests on the idea that a lot of debris, and sometimes even hydraulic fluid, can accumulate in elevator pits, creating a fire hazard. The argument against sprinklers, which is the argument largely supported by the elevator industry, is that installers and inspectors are unnecessarily put in harm’s way when they need to enter elevator pits. “They want to reduce the number of people that need to go into those pits and work based on accident data,” Duffy said. “They don’t see a history of fires in elevator pits.”

Duffy said he wasn’t sure what will come of the debate during the technical meeting, but it’s something committee members are used to engaging in. “We have this elevator argument cycle after cycle after cycle,” he said.

CODE CONSOLIDATION PLAN
NFPA’s ambitious consolidation of its emergency responder standards begins with five new documents for 2022
nfpa.org/errs

Does a fire and rescue vehicle at an airport require a different type of emergency lighting than a ladder truck at a local fire department, or a wildland firefighting truck, or even an ambulance? Or will an emergency light that works on one type of vehicle work on them all?

These are the kinds of questions that surface when you attempt to combine multiple standards that “were once all living in their own universe” into a single document, says Ken Holland, the staff liaison to the proposed NFPA 1900, Standard for Aircraft Rescue and Firefighting Vehicles, Automotive Fire Apparatus, Wildland Fire Apparatus, and Automotive Ambulances. “You quickly realize, ‘OK, do we need to have different requirements for emergency lighting on all of these vehicles?’”

 

That kind of thinking was a major impetus behind the Emergency Response and Responder Safety Document Consolidation Plan at NFPA, which Holland is overseeing. Over the next five years, the project aims to significantly streamline the organization’s extensive suite of responder standards, consolidating roughly 90 separate standards into 29 new documents. NFPA 1900, for example—a 2024 edition slated for release in 2023—will combine what was formerly four separate standards, one for each emergency vehicle type, into a single standard.

Under the consolidation plan, the first five of these new combined documents, all of them 2022 editions, will be issued by the NFPA Standards Council as early as August, and could go before voting members at NFPA’s Technical Meeting in June if qualifying motions are made to amend them. They include documents on hazardous materials, wildland firefighting, emergency services communications, protective ensembles, and technical search and rescue. Collectively, these five new documents contain information that until recently had been spread across 15 different standards. The webpage nfpa.org/errs lays out the full timeline and process for the consolidation and provides links to where you can read full drafts of each document.

There are a number of issues that the consolidation project aims to resolve and improve, said Barry Chase, the standards lead for emergency response and responder safety at NFPA. By grouping and combining related responder documents, he said, users will have all the information they need at their fingertips in just one book. Further, the committees that create and revise these documents will have a streamlined and more efficient process and can potentially eliminate redundancies or incongruent information that has crept into the documents over the years.

“As time has gone on, important new standards projects have come up that demand our attention, but every time we added something new, we weren’t taking anything away and the number of standards just kept growing,” Chase said. “This consolidation project will balance that by bringing together some of these standards into a larger book, making it a little more manageable and allowing NFPA to do more.”

In addition to the five new consolidated standards that will be issued in August, another six combined standards will be issued in 2022 and 2023. That will be followed by four more standards in 2023, six in 2024, and eight final combined standards in 2025 and 2026.

A learning process

While there are significant long-term benefits to consolidation, the process of combining multiple related standards, each with its own group of technical experts, has presented some logistical questions. Should the content of the separate documents be fully merged and reimagined? Should the technical committees also merge? If not, how would conflicting opinions be handled?

In the end, NFPA opted to keep things simple. Each former standard subject to consolidation will start as a standalone section of the new combined document, with individual technical committees remaining separate and in charge of their own material. Each committee is then free to streamline, combine, and reorganized their material as they see fit. The approach works because “nine times out of 10, one section doesn’t cross over into the other material in the document,” Holland said. “The committees understand where their guardrails are, and where the material they’re responsible for starts and ends.”

There have been a few tricky spots, however. For one, each standard has three introductory chapters: Administration, Reference Documents, and Definitions. One of the technical committees is responsible for merging these chapters from the separate documents into one. In some instances, the same term is defined with slight variations across documents. In other places, there may be minor contradictions or redundancies between sections, as with the emergency lighting issue in NFPA 1900. In that case, the committees involved formed a task group to work on the issue, and over the course of many hours hashed out a common standard for emergency lighting that can apply to each of the vehicles covered in the standard. The end result is a cleaner document that is also more user-friendly.

“Overall, the committee members have been amicable and open to this whole process. When things do come up, it’s just working and trying to find a solution,” Holland said. “In instances where we have multiple definitions for the same thing, it’s just, ‘OK, what’s the best one?’ We can’t have three definitions for a tire. It’s about talking it out and landing on one solution.”

Chase and Holland admit that, at first, there was some apprehension from committee members about what the consolidation changes might mean and how the process might work. But as the draft meetings of this first group of standards has played out, many of those fears have lifted and the benefits of this new approach have become clear.

“Once they start seeing the documents come together, they start to believe in some of the synergy,” Chase said. He cited a new proposed consolidated document, NFPA 470, Hazardous Materials/Weapons of Mass Destruction (WMD) Standard for Responders, which brought three standards into one document. The committee, he said, combined and consolidated the professional qualification requirements and competencies, which were previously in different standards, and reordered the chapters in a way that made more sense. “Committee members quickly became believers, but it took them actually going through this process to see those benefits,” Chase said. “Now we’re also starting to see some of that with the documents in group two, which have finished their first-draft meetings. They’re starting to see how bringing together these different standards can make for a more comprehensive approach rather than having a different book for each portion of the same topic.”

Ultimately, the biggest promise of the consolidation is when users of the standards see that same synergy, Holland said. Currently, a single topic like wildland firefighting is spread across four documents to cover different aspects of fire management, land development, and professional qualifications. Within months, though, jurisdictions in wildfire-prone areas will only need one book: NFPA 1140, Standards for Wildland Fire Protection. The same will soon be the case for topics including personal protective equipment, technical search and rescue, mass evacuation, and many more.

“That was the really the main driving force to consolidate the documents,” Holland said. “What can we do that is going to provide the biggest benefit to the end user? I think having one book for each topic instead of several is going to make things a lot easier.”

JESSE ROMAN is associate editor of NFPA Journal. ANGELO VERZONI is a staff writer for NFPA Journal.