Browns Ferry: Accident

1
Browns FerryAccident Implications

• Matthew Denman
• Nelson Royall

2
Background

• Located in Athens, AL
• Owned by Tennessee Valley Authority
• Three units, two currently operating
• Unit 1 began operation Aug. 1, 1974
• Shut down since 1985
• Plans to begin operation again in 2007

An external view of the Browns Ferry nuclear
power plant began construction in 1967 and
currently operates two of three units.
3
Background

• All three units are 1065 MWe General Electric
  BWRs

4
(No Transcript)
5
Accident Sequence

• March 22nd, 1975 at 12PM Units 1 2 operating at
  full power
• An electrical inspector and an electrician were
  sealing air leaks in cable spreading room using
  2 thick, resilient polyurethane foam
• Used a candle to determine if there was a leak, a
  change in the flame indicated a leak
• A 2 x 4 hole in a penetration window carrying
  four wires significantly sucked in the flame
• The electrical engineer filled the hole with two
  strips of the foam and rechecked the hole for a
  leak

Resilient polyurethane foam such as this was used
to fill holes in the Browns Ferry power plant,
it is highly flammable.
6
Accident Sequence

• The electrical inspector put the candle too close
  to the hole and the flame was sucked into the
  hole igniting the foam
• The inspector first tried to use a flashlight to
  stop the fire, then rags stuffed into the hole
• Finally, the inspector used a CO2 extinguisher
  which blew the fire behind the hole to the other
  side and ignited the reactor building side of the
  hole
• A blowtorch effect from the fire began following
  the second application of the extinguisher due to
  the airflow through the hole

The CO2 fire extinguisher used by the electrical
inspector trying to put out the flame ignited the
other side of the hole leading to a more serious
situation.
7
Accident Response

• At 1215 PM the electrical inspector informed a
  guard in the turbine room of the fire
• The code to sound the alarm via telephone was not
  called immediately, instead the guard alerted the
  shift engineer who then called the reactor
  operator to sound the alarm
• Had the shift engineer been in a construction
  department he would not have been able to sound
  the alarm
• Only plant phones can dial plant numbers and only
  construction phones can dial construction
  numbers, therefore preventing construction
  personnel from sounding a fire alarm
• This violated BFNP Standard Practice BFS3, which
  stated that all personnel must be able to sound
  an alarm in case of fire

8
Operator Response

• At 1240 PM, five minutes after the alarm began,
  the operators continued to run the Unit 1 reactor
• All the ECCS pumps and many other pumps were on
  while alarms were also sounding
• Indicating lights were turning bright, dimming
  and turning off in the control room
• Also, smoke was emitted from beneath the 9-3
  control board
• After ten minutes of these events, the power
  began to drop in the reactor prompting the
  operator to decrease the pump flow
• At 1251 PM, the pumps failed causing the
  operator to insert the control rods to shut down
  the reactor

9
Accident Complications

• At 1255 PM, power to control, reactor shutdown
  equipment and the ECCS was lost in Unit 1
• At 115 PM, the operator lost all nuclear
  instrumentation and other equipment except for
  four pressure relief valves
• At 130 PM, the operator opened the relief valves
  to drop the pressure so that low-pressure pumps
  would increase water flow to the core
• However, all low-pressure pumps had failed so a
  condensate booster pump was used to increase
  water flow
• The water level dropped from 200 inches to only
  45 inches, but allowed the operator to regain
  control temporarily

10
Unit 2 Effects

• At 100 PM, Unit 2 began undergoing the same
  problems that had occurred in Unit 1 prior to
  shutdown, prompting the operator to begin Unit 2
  shutdown
• At 120 PM, Unit 2 lost control to the reactor
  relief valves and at 145 PM the high-pressure
  ECCS system and other shutdown equipment failed
• Finally, at 215 PM, Unit 2 regained control of
  the reactor relief valves and depressurized the
  reactor to initiate the low-pressure pumps
• The A and C subsystems of the low-pressure ECCS
  and the spray systems had failed earlier, leaving
  only the B subsystem which failed sporadically
  from 135 PM 435 PM
• Using the same technique as the Unit 1 operator,
  the condensate booster pump was used to increase
  core flow

11
Extinguishing the Fire

• After the electrician and the electrical
  inspector left the cable spreader room, the shift
  engineer turned on the Cardox system (Fills the
  room with CO2)
• Because the control room was directly above, the
  Cardox system pushed the smoke into the control
  room through small gaps
• The Cardox system had only slowed the spread of
  the fire
• Many of the breathing masks were not functioning
  and others were partially functional, preventing
  firefighting efforts
• BFNP personnel managed firefighting efforts with
  the assistance of the local fire department for 6
  hours
• The fire chiefs recommendation to use water at
  130 PM was finally attempted at 600 PM and
  ended the fire within 20 minutes

12
Post-Fire Concerns

• Aircraft warning lights on the 600 ft. cooling
  tower failed at nightfall, no call to the FAA was
  made
• Time and sequence recording devices for the
  control circuits had no paper from 430 PM until
  200 PM the following day
• Phone conversations were recorded as of 340 PM,
  however the phone recorders malfunctioned leaving
  partial records of the calls

• After 600 PM the workers returned to the control
  room and control was lost to the final four
  relief valves in Unit 1
• The pressure increase prevented the condensate
  booster pump to flow water to the core
• Unaware that the Unit 2 control rod drive pump
  could be diverted, the operators tried to bring
  back the relief valves since the Unit 1 spare
  control rod drive pump had failed
• At 900 PM control of the relief valves was
  regained and core melt due to boiloff was
  prevented

13
Radiation Response

• No radiation leaks occurred according to the NRC
  and TVA
• Unit 1 lost all radiation monitors almost
  immediately
• Unit 2 lost radiation monitors from 200 PM until
  900 PM
• Air sampling occurred at 445 PM at
• Athens, AL (10 mi NE of BFNP)
• Hillsboro, AL (10 mi SW of BFNP)
• Rogersville, AL (35 mi NW of BFNP)
• Wind direction was from NW to SE at time of
  accident
• Air sampling from Decatur, AL (20 mi SE of BFNP)
  did not begin until 900 PM

14
Regulations and Reports

• NUREG-0050
• BTP APCSB 9.5-1
• 10 CFR 50.48 and Appendix R
• NUREG/CR 2258
• IAEA Safety Guidelines No. 98

The Browns Ferry accident on March 22, 1975
prompted the NRC to enact strong fire safety
regulations previously almost entirely ignored.
15
NUREG-0050

• Recommendations Related to Browns Ferry Fire
  (Feb. 1976)
• Seal that caught on fire was not the seal
  designed and tested in the plant design
• Flexible polyurethane foam was used instead of
  spray polyurethane foam, increasing the risk of
  fire
• Seal did not have the fire retardant coating that
  was specified in the plant design

16
BTP APCSB 9.5-1

• NRC issued in May 1976
• Applied only to licensees filing for construction
  permits after July 1, 1976
• Incorporated recommendations from Browns Ferry
  fire special review team and NUREG-0500
• Added Defense in Depth methodology to current
  fire safety procedures.
• Divided plants into multiple distinct and
  independent fire containment areas
• Equipment redundancy must be demonstrated between
  each fire area to maintain shutdown margin and
  ensure safety
• Vital equipment must be adequately protected from
  fire

17
10 CFR 50.48 Fire Protection

• Applies to all nuclear plants licensed after
  January 1, 1979
• Requires
• Automatic and manually operated fire detection
  and suppression systems in fire-sensitive areas
• Limit fire damage to structures, systems and
  components important to shutdown margin and
  safety
• All cables covered in flame retardant coverings

18
10 CFR 50 Appendix R

• Fire protection for nuclear facilities operating
  before January 1, 1979
• Hot Shutdown Criteria
• One train of equipment necessary to achieve hot
  shutdown from either the control room or
  emergency control station(s) must be maintained
  free of fire damage by a single fire, including
  an exposure fire.

10 CFR 50 Appendix R requires that a single fire
not prevent the shutdown of the reactor from
either the control room or emergency control
stations as a result of the near meltdown at
Browns Ferry.
19
10 CFR 50 Appendix R (Cont.)

• Each nuclear power plant must establish a fire
  protection program to create and implement a fire
  protection policy
• Must conduct Fire Hazards Analysis (FHA)
• Considers both in situ and transient fire hazards
• Transient fire analysis must be conducted for
• Normal operation
• Maintenance
• Repair
• Modification
• Requires compliance with BTP APCSB 9.5-1

20
NUREG/CR 2258

• Provides conditional probabilities, used in most
  PRAs, for hot shorts caused by fire damage
• Empirical data taken from Browns Ferry fire was
  used to determine the probability and duration of
  a hot short during a fire
• Hot shorts are conductor to conductor shorts that
  induce spurious actuation
• Browns Ferry is one of the only majors fires
  whose report focused on the details of cable
  failures and resulting circuit faults

21
IAEA Safety Guidelines No. 98

• On-Site Habitability in the Event of an Accident
  at a Nuclear Facility
• Recommendations from Browns Ferry Fire
• Open penetrations between cable spreading room
  and control room should be avoided and if found
  should not be filled with flammable foam
• Firefighting equipment (CO2, Halides) should be
  considered a potential hazard for personal

The IAEA recommended changes be made in safety
and risk analysis including considering
firefighting equipment failures.
22
Defense in Depth

• Objectives
• Prevent fires from starting
• Promptly detect control and extinguish fires that
  occur
• Protect structures, systems, and components
  important to safety so that a fire that is not
  promptly extinguished will not prevent the safe
  shutdown of the plant

23
Seal Inspections

• BFNP Units 2 and 3 underwent 100 penetration
  seal inspection in 1975 and 1977 respectively
  following the accident
• Penetration seals are one element of fire
  protection defense in depth
• Confines the fire to the area of origin
• Protects plant systems and components within an
  area from fire outside the area
• NRC does not consider penetration seal
  deficiencies to be a lack of adequate fire
  protection

24
Fire Protection Programs

• Consider Potential Fire Hazards (PFH)
• Determine the effects of fires in the plant on
  the ability to safely shutdown the reactor or on
  the ability to minimize and control the release
  of radioactivity to the environment
• Specified measures for
• Fire prevention
• Fire detection
• Fire containment
• Automatic and manual fire suppression
• Post-fire safe-shutdown capability