Brown’s Ferry: Accident & Implications

1. Brown’s Ferry:Accident & Implications Matthew Denman Nelson Royall

2. Background • Located in Athens, AL • Owned by Tennessee Valley Authority • Three units, two currently operating • Unit 1 began operation Aug. 1, 1974 • Shut down since 1985 • Plans to begin operation again in 2007 An external view of the Brown’s Ferry nuclear power plant began construction in 1967 and currently operates two of three units.

3. Background • All three units are 1065 MWe General Electric BWRs

5. Accident Sequence • March 22nd, 1975 at 12PM Units 1 & 2 operating at full power • An electrical inspector and an electrician were sealing air leaks in cable spreading room using 2” thick, resilient polyurethane foam • Used a candle to determine if there was a leak, a change in the flame indicated a leak • A 2” x 4” hole in a penetration window carrying four wires significantly sucked in the flame • The electrical engineer filled the hole with two strips of the foam and rechecked the hole for a leak Resilient polyurethane foam such as this was used to fill holes in the Brown’s Ferry power plant, it is highly flammable.

6. Accident Sequence • The electrical inspector put the candle too close to the hole and the flame was sucked into the hole igniting the foam • The inspector first tried to use a flashlight to stop the fire, then rags stuffed into the hole • Finally, the inspector used a CO2 extinguisher which blew the fire behind the hole to the other side and ignited the reactor building side of the hole • A blowtorch effect from the fire began following the second application of the extinguisher due to the airflow through the hole The CO2 fire extinguisher used by the electrical inspector trying to put out the flame ignited the other side of the hole leading to a more serious situation.

7. Accident Response • At 12:15 PM the electrical inspector informed a guard in the turbine room of the fire • The code to sound the alarm via telephone was not called immediately, instead the guard alerted the shift engineer who then called the reactor operator to sound the alarm • Had the shift engineer been in a construction department he would not have been able to sound the alarm • Only plant phones can dial plant numbers and only construction phones can dial construction numbers, therefore preventing construction personnel from sounding a fire alarm • This violated BFNP Standard Practice BFS3, which stated that all personnel must be able to sound an alarm in case of fire

8. Operator Response • At 12:40 PM, five minutes after the alarm began, the operators continued to run the Unit 1 reactor • All the ECCS pumps and many other pumps were on while alarms were also sounding • Indicating lights were turning bright, dimming and turning off in the control room • Also, smoke was emitted from beneath the 9-3 control board • After ten minutes of these events, the power began to drop in the reactor prompting the operator to decrease the pump flow • At 12:51 PM, the pumps failed causing the operator to insert the control rods to shut down the reactor

9. Accident Complications • At 12:55 PM, power to control, reactor shutdown equipment and the ECCS was lost in Unit 1 • At 1:15 PM, the operator lost all nuclear instrumentation and other equipment except for four pressure relief valves • At 1:30 PM, the operator opened the relief valves to drop the pressure so that low-pressure pumps would increase water flow to the core • However, all low-pressure pumps had failed so a condensate booster pump was used to increase water flow • The water level dropped from 200 inches to only 45 inches, but allowed the operator to regain control temporarily

10. Unit 2 Effects • At 1:00 PM, Unit 2 began undergoing the same problems that had occurred in Unit 1 prior to shutdown, prompting the operator to begin Unit 2 shutdown • At 1:20 PM, Unit 2 lost control to the reactor relief valves and at 1:45 PM the high-pressure ECCS system and other shutdown equipment failed • Finally, at 2:15 PM, Unit 2 regained control of the reactor relief valves and depressurized the reactor to initiate the low-pressure pumps • The A and C subsystems of the low-pressure ECCS and the spray systems had failed earlier, leaving only the B subsystem which failed sporadically from 1:35 PM – 4:35 PM • Using the same technique as the Unit 1 operator, the condensate booster pump was used to increase core flow

11. Extinguishing the Fire • After the electrician and the electrical inspector left the cable spreader room, the shift engineer turned on the Cardox system (Fills the room with CO2) • Because the control room was directly above, the Cardox system pushed the smoke into the control room through small gaps • The Cardox system had only slowed the spread of the fire • Many of the breathing masks were not functioning and others were partially functional, preventing firefighting efforts • BFNP personnel managed firefighting efforts with the assistance of the local fire department for 6 hours • The fire chief’s recommendation to use water at 1:30 PM was finally attempted at 6:00 PM and ended the fire within 20 minutes

12. Post-Fire Concerns • Aircraft warning lights on the 600 ft. cooling tower failed at nightfall, no call to the FAA was made • Time and sequence recording devices for the control circuits had no paper from 4:30 PM until 2:00 PM the following day • Phone conversations were recorded as of 3:40 PM, however the phone recorders malfunctioned leaving partial records of the calls • After 6:00 PM the workers returned to the control room and control was lost to the final four relief valves in Unit 1 • The pressure increase prevented the condensate booster pump to flow water to the core • Unaware that the Unit 2 control rod drive pump could be diverted, the operators tried to bring back the relief valves since the Unit 1 spare control rod drive pump had failed • At 9:00 PM control of the relief valves was regained and core melt due to boiloff was prevented

13. Radiation Response • No radiation leaks occurred according to the NRC and TVA • Unit 1 lost all radiation monitors almost immediately • Unit 2 lost radiation monitors from 2:00 PM until 9:00 PM • Air sampling occurred at 4:45 PM at: • Athens, AL (10 mi NE of BFNP) • Hillsboro, AL (10 mi SW of BFNP) • Rogersville, AL (35 mi NW of BFNP) • Wind direction was from NW to SE at time of accident • Air sampling from Decatur, AL (20 mi SE of BFNP) did not begin until 9:00 PM

14. Regulations and Reports • NUREG-0050 • BTP APCSB 9.5-1 • 10 CFR 50.48 and Appendix R • NUREG/CR 2258 • IAEA Safety Guidelines No. 98 The Brown’s Ferry accident on March 22, 1975 prompted the NRC to enact strong fire safety regulations previously almost entirely ignored.

15. NUREG-0050 • “Recommendations Related to Brown’s Ferry Fire” (Feb. 1976) • Seal that caught on fire was not the seal designed and tested in the plant design • Flexible polyurethane foam was used instead of spray polyurethane foam, increasing the risk of fire • Seal did not have the fire retardant coating that was specified in the plant design

16. BTP APCSB 9.5-1 • NRC issued in May 1976 • Applied only to licensees filing for construction permits after July 1, 1976 • Incorporated recommendations from Brown’s Ferry fire special review team and NUREG-0500 • Added Defense in Depth methodology to current fire safety procedures. • Divided plants into multiple distinct and independent fire containment areas • Equipment redundancy must be demonstrated between each fire area to maintain shutdown margin and ensure safety • Vital equipment must be adequately protected from fire

17. 10 CFR 50.48 – “Fire Protection” • Applies to all nuclear plants licensed after January 1, 1979 • Requires: • Automatic and manually operated fire detection and suppression systems in fire-sensitive areas • Limit fire damage to structures, systems and components important to shutdown margin and safety • All cables covered in flame retardant coverings

18. 10 CFR 50 Appendix R • Fire protection for nuclear facilities operating before January 1, 1979 • Hot Shutdown Criteria • “One train of equipment necessary to achieve hot shutdown from either the control room or emergency control station(s) must be maintained free of fire damage by a single fire, including an exposure fire.” 10 CFR 50 Appendix R requires that a single fire not prevent the shutdown of the reactor from either the control room or emergency control stations as a result of the near meltdown at Brown’s Ferry.

19. 10 CFR 50 Appendix R (Cont.) • Each nuclear power plant must establish a fire protection program to create and implement a fire protection policy • Must conduct Fire Hazards Analysis (FHA) • Considers both in situ and transient fire hazards • Transient fire analysis must be conducted for • Normal operation • Maintenance • Repair • Modification • Requires compliance with BTP APCSB 9.5-1

20. NUREG/CR 2258 • Provides conditional probabilities, used in most PRAs, for hot shorts caused by fire damage • Empirical data taken from Brown’s Ferry fire was used to determine the probability and duration of a “hot short” during a fire • Hot shorts are conductor to conductor shorts that induce spurious actuation • Brown’s Ferry is one of the only majors fires whose report focused on the details of cable failures and resulting circuit faults

21. IAEA Safety Guidelines No. 98 • “On-Site Habitability in the Event of an Accident at a Nuclear Facility” • Recommendations from Brown’s Ferry Fire: • Open penetrations between cable spreading room and control room should be avoided and if found should not be filled with flammable foam • Firefighting equipment (CO2, Halides) should be considered a potential hazard for personal The IAEA recommended changes be made in safety and risk analysis including considering firefighting equipment failures.

22. Defense in Depth • Objectives: • Prevent fires from starting • Promptly detect control and extinguish fires that occur • Protect structures, systems, and components important to safety so that a fire that is not promptly extinguished will not prevent the safe shutdown of the plant

23. Seal Inspections • BFNP Units 2 and 3 underwent 100% penetration seal inspection in 1975 and 1977 respectively following the accident • Penetration seals are one element of fire protection defense in depth • Confines the fire to the area of origin • Protects plant systems and components within an area from fire outside the area • NRC does not consider penetration seal deficiencies to be a lack of adequate fire protection

24. Fire Protection Programs • Consider Potential Fire Hazards (PFH) • Determine the effects of fires in the plant on the ability to safely shutdown the reactor or on the ability to minimize and control the release of radioactivity to the environment • Specified measures for: • Fire prevention • Fire detection • Fire containment • Automatic and manual fire suppression • Post-fire safe-shutdown capability