Brown’s Ferry:Brown’s Ferry:Accident & Accident &

ImplicationsImplicationsMatthew Denman

Nelson Royall

BackgroundBackground

• Located in Athens, AL• Owned by Tennessee

Valley Authority• Three units, two

currently operating• Unit 1 began

operation Aug. 1, 1974• Shut down since 1985• Plans to begin

operation again in 2007

An external view of the Brown’s Ferry nuclear power plant began construction in 1967 and currently operates two of three units.

BackgroundBackground

• All three units are 1065 MWe General Electric BWRs

Accident SequenceAccident Sequence• March 22nd, 1975 at 12PM Units

1 & 2 operating at full power• An electrical inspector and an

electrician were sealing air leaks in cable spreading room using 2” thick, resilient polyurethane foam

• Used a candle to determine if there was a leak, a change in the flame indicated a leak

• A 2” x 4” hole in a penetration window carrying four wires significantly sucked in the flame

• The electrical engineer filled the hole with two strips of the foam and rechecked the hole for a leak

Resilient polyurethane foam such as this was used to fill holes in the Brown’s Ferry power plant, it is highly flammable.

Accident SequenceAccident Sequence• The electrical inspector put the

candle too close to the hole and the flame was sucked into the hole igniting the foam

• The inspector first tried to use a flashlight to stop the fire, then rags stuffed into the hole

• Finally, the inspector used a CO2 extinguisher which blew the fire behind the hole to the other side and ignited the reactor building side of the hole

• A blowtorch effect from the fire began following the second application of the extinguisher due to the airflow through the hole

The CO2 fire extinguisher used by the electrical inspector trying to put out the flame ignited the other side of the hole leading to a more serious situation.

Accident ResponseAccident Response

• At 12:15 PM the electrical inspector informed a guard in the turbine room of the fire

• The code to sound the alarm via telephone was not called immediately, instead the guard alerted the shift engineer who then called the reactor operator to sound the alarm

• Had the shift engineer been in a construction department he would not have been able to sound the alarm

• Only plant phones can dial plant numbers and only construction phones can dial construction numbers, therefore preventing construction personnel from sounding a fire alarm

• This violated BFNP Standard Practice BFS3, which stated that all personnel must be able to sound an alarm in case of fire

Operator ResponseOperator Response• At 12:40 PM, five minutes after the alarm began,

the operators continued to run the Unit 1 reactor• All the ECCS pumps and many other pumps were

on while alarms were also sounding• Indicating lights were turning bright, dimming

and turning off in the control room• Also, smoke was emitted from beneath the 9-3

control board• After ten minutes of these events, the power

began to drop in the reactor prompting the operator to decrease the pump flow

• At 12:51 PM, the pumps failed causing the operator to insert the control rods to shut down the reactor

Accident ComplicationsAccident Complications

• At 12:55 PM, power to control, reactor shutdown equipment and the ECCS was lost in Unit 1

• At 1:15 PM, the operator lost all nuclear instrumentation and other equipment except for four pressure relief valves

• At 1:30 PM, the operator opened the relief valves to drop the pressure so that low-pressure pumps would increase water flow to the core

• However, all low-pressure pumps had failed so a condensate booster pump was used to increase water flow

• The water level dropped from 200 inches to only 45 inches, but allowed the operator to regain control temporarily

Unit 2 EffectsUnit 2 Effects

• At 1:00 PM, Unit 2 began undergoing the same problems that had occurred in Unit 1 prior to shutdown, prompting the operator to begin Unit 2 shutdown

• At 1:20 PM, Unit 2 lost control to the reactor relief valves and at 1:45 PM the high-pressure ECCS system and other shutdown equipment failed

• Finally, at 2:15 PM, Unit 2 regained control of the reactor relief valves and depressurized the reactor to initiate the low-pressure pumps

• The A and C subsystems of the low-pressure ECCS and the spray systems had failed earlier, leaving only the B subsystem which failed sporadically from 1:35 PM – 4:35 PM

• Using the same technique as the Unit 1 operator, the condensate booster pump was used to increase core flow

Extinguishing the FireExtinguishing the Fire• After the electrician and the electrical inspector left

the cable spreader room, the shift engineer turned on the Cardox system (Fills the room with CO2)

• Because the control room was directly above, the Cardox system pushed the smoke into the control room through small gaps• The Cardox system had only slowed the spread of

the fire• Many of the breathing masks were not functioning and

others were partially functional, preventing firefighting efforts

• BFNP personnel managed firefighting efforts with the assistance of the local fire department for 6 hours

• The fire chief’s recommendation to use water at 1:30 PM was finally attempted at 6:00 PM and ended the fire within 20 minutes

Post-Fire ConcernsPost-Fire Concerns• After 6:00 PM the workers

returned to the control room and control was lost to the final four relief valves in Unit 1

• The pressure increase prevented the condensate booster pump to flow water to the core

• Unaware that the Unit 2 control rod drive pump could be diverted, the operators tried to bring back the relief valves since the Unit 1 spare control rod drive pump had failed

• At 9:00 PM control of the relief valves was regained and core melt due to boiloff was prevented

•Aircraft warning lights on the 600 ft. cooling tower failed at nightfall, no call to the FAA was made•Time and sequence recording devices for the control circuits had no paper from 4:30 PM until 2:00 PM the following day•Phone conversations were recorded as of 3:40 PM, however the phone recorders malfunctioned leaving partial records of the calls

Radiation ResponseRadiation Response

• No radiation leaks occurred according to the NRC and No radiation leaks occurred according to the NRC and TVATVA

• Unit 1 lost all radiation monitors almost immediatelyUnit 1 lost all radiation monitors almost immediately• Unit 2 lost radiation monitors from 2:00 PM until 9:00 Unit 2 lost radiation monitors from 2:00 PM until 9:00

PMPM• Air sampling occurred at 4:45 PM at:Air sampling occurred at 4:45 PM at:

• Athens, AL (10 mi NE of BFNP)Athens, AL (10 mi NE of BFNP)• Hillsboro, AL (10 mi SW of BFNP)Hillsboro, AL (10 mi SW of BFNP)• Rogersville, AL (35 mi NW of BFNP)Rogersville, AL (35 mi NW of BFNP)

• Wind direction was from NW to SE at time of accidentWind direction was from NW to SE at time of accident• Air sampling from Decatur, AL (20 mi SE of BFNP) did Air sampling from Decatur, AL (20 mi SE of BFNP) did

not begin until 9:00 PMnot begin until 9:00 PM

Regulations and ReportsRegulations and Reports

• NUREG-0050• BTP APCSB 9.5-1• 10 CFR 50.48 and

Appendix R• NUREG/CR 2258• IAEA Safety

Guidelines No. 98The Brown’s Ferry accident on March 22, 1975 prompted the NRC to enact strong fire safety regulations previously almost entirely ignored.

NUREG-0050NUREG-0050

• “Recommendations Related to Brown’s Ferry Fire” (Feb. 1976)

• Seal that caught on fire was not the seal designed and tested in the plant design• Flexible polyurethane foam was used

instead of spray polyurethane foam, increasing the risk of fire

• Seal did not have the fire retardant coating that was specified in the plant design

BTP APCSB 9.5-1BTP APCSB 9.5-1• NRC issued in May 1976• Applied only to licensees filing for construction

permits after July 1, 1976• Incorporated recommendations from Brown’s

Ferry fire special review team and NUREG-0500• Added Defense in Depth methodology to current

fire safety procedures.• Divided plants into multiple distinct and

independent fire containment areas• Equipment redundancy must be demonstrated

between each fire area to maintain shutdown margin and ensure safety

• Vital equipment must be adequately protected from fire

10 CFR 50.48 – “Fire 10 CFR 50.48 – “Fire Protection”Protection”

• Applies to all nuclear plants licensed after January 1, 1979

• Requires:• Automatic and manually operated fire

detection and suppression systems in fire-sensitive areas

• Limit fire damage to structures, systems and components important to shutdown margin and safety

• All cables covered in flame retardant coverings

10 CFR 50 Appendix R10 CFR 50 Appendix R

• Fire protection for nuclear facilities operating before January 1, 1979

• Hot Shutdown Criteria• “One train of equipment

necessary to achieve hot shutdown from either the control room or emergency control station(s) must be maintained free of fire damage by a single fire, including an exposure fire.”

10 CFR 50 Appendix R requires that a single fire not prevent the shutdown of the reactor from either the control room or emergency control stations as a result of the near meltdown at Brown’s Ferry.

10 CFR 50 Appendix R 10 CFR 50 Appendix R (Cont.)(Cont.)

• Each nuclear power plant must establish a fire protection program to create and implement a fire protection policy

• Must conduct Fire Hazards Analysis (FHA)• Considers both in situ and transient fire hazards• Transient fire analysis must be conducted for

• Normal operation• Maintenance• Repair• Modification

• Requires compliance with BTP APCSB 9.5-1

NUREG/CR 2258NUREG/CR 2258

• Provides conditional probabilities, used in most PRAs, for hot shorts caused by fire damage

• Empirical data taken from Brown’s Ferry fire was used to determine the probability and duration of a “hot short” during a fire• Hot shorts are conductor to conductor shorts that

induce spurious actuation

• Brown’s Ferry is one of the only majors fires whose report focused on the details of cable failures and resulting circuit faults

IAEA Safety Guidelines No. IAEA Safety Guidelines No. 9898

• “On-Site Habitability in the Event of an Accident at a Nuclear Facility”

• Recommendations from Brown’s Ferry Fire:• Open penetrations between

cable spreading room and control room should be avoided and if found should not be filled with flammable foam

• Firefighting equipment (CO2, Halides) should be considered a potential hazard for personal

The IAEA recommended changes be made in safety and risk analysis including considering firefighting equipment failures.

Defense in DepthDefense in Depth

• Objectives:1. Prevent fires from starting2. Promptly detect control and extinguish

fires that occur3. Protect structures, systems, and

components important to safety so that a fire that is not promptly extinguished will not prevent the safe shutdown of the plant

Seal InspectionsSeal Inspections

• BFNP Units 2 and 3 underwent 100% penetration seal inspection in 1975 and 1977 respectively following the accident

• Penetration seals are one element of fire protection defense in depth• Confines the fire to the area of origin• Protects plant systems and components within

an area from fire outside the area• NRC does not consider penetration seal

deficiencies to be a lack of adequate fire protection

Fire Protection ProgramsFire Protection Programs

• Consider Potential Fire Hazards (PFH)• Determine the effects of fires in the plant

on the ability to safely shutdown the reactor or on the ability to minimize and control the release of radioactivity to the environment

• Specified measures for:• Fire prevention • Fire detection• Fire containment • Automatic and manual fire suppression • Post-fire safe-shutdown capability