At 12:40 P.M., the evacuation alarm sounded in the spreading room, just as the ECCS alarm panel for Unit 1 began to light up with irrational indications of problems. The plant operator, seeing that everybody was out of the spreading room, pulled the handle to actuate the room’s carbon dioxide flooding system. Nothing happened. It had been de-energized because workers were in the room. He found where it had been shut off, turned it back on, and pulled the handle again. Whoosh. The room filled with misty carbon dioxide, but still the fire burned. Another employee grabbed the handle. “You didn’t do it right. Let me show you.” Another loud rush, and the room clouded up, but the fire did not care. It turned out that the ventilation system was still running, blowing fresh air into the room and assuming that men were still in there, working.
The alarm indicators in the Unit 1 control room were acting crazy, indicating problems that did not exist, and at 12:51 an operator pushed the scram button with his palm. Unit 1 dropped off the power grid as the turbine coasted down. Nine minutes later, the operating crew began to lose control of Unit 2 as the fire spread to its cable trays. All systems in Unit 2 began reverting to their fail-safe conditions, and the ECCS system came on by itself. At 1:03 P.M., the cables to the main steam isolation valves burned through, and remote control of the cooling systems failed.
An assistant shift engineer took command of the fire brigade, as they passed carbon dioxide and dry chemical extinguishers hand over hand into the highly congested maze of cable racks in the spreading room and discharged the flood system a third time. At 1:10 P.M., the assistant shift engineer decided to call the Athens Fire Department and beg assistance.
Twenty minutes later, the lights went out in the reactor building. The power feed had burned up.
At 1:45, the fire department arrived, took a quick evaluation of the fire, and suggested that the plant’s electrical wiring in the instrumentation and control systems be soaked with water as soon as we can get a hose in there. The recommendation was not immediately followed.
By 5:30 P.M. it was becoming clear that they had done everything possible with fire extinguishers and they would have to dump water on the wiring. It was always risky to put water on electrical circuits. Water conducts electricity, and the damage that could be caused by random short circuits in the complex instrumentation and control wiring was unpredictable. By this time, they were out of choices. Somewhere around 6:30 P.M., remote control of the pressure-relief valves in Unit 1 was lost. At 7:20 P.M., water was finally released into the cable trays, and ten minutes later, the fire was extinguished. It had burned for seven hours and ten minutes, and it had done a great deal of damage to the Browns Ferry plant and to the confidence level of nuclear engineering. A single candle flame had brought down two operating reactors and destroyed the electronic process-monitoring and control systems.
The reactor and steam systems were left in perfect order, but the control systems had been put out of action. Although flames in the cable spreading trays were considered unlikely, there was a large tank of carbon dioxide, the flooding system, installed with piping for the sole purpose of putting out a fire in the room, just in case. There was comfort in knowing that the interlocks that kept the fire from being smothered were there to keep workers from being smothered. No unusual radiation was released into the environment. It was a severe industrial accident, and pleasantly unbelievable that no one had been harmed.[227]
There were changes in nuclear power-plant codes and standards implemented after the Browns Ferry fire, from the use of silicon sealant instead of plastic foam to the rapid recharging of respirators. Unit 1 was down for a year while its wiring system was rebuilt, this time using non-flammable covers on the cables.[228]
In the fall of 1977, Cleveland Electric and Toledo Edison were proud owners of a new Babcock & Wilcox model 177FA pressurized-water-reactor power plant, built to generate 889 megawatts of electricity and located in Oak Harbor, Ohio.[229] The plant is named Davis-Besse, and a PWR is not a small machine. The reactor pressure vessel alone is 700 tons of steel with walls nine inches thick. It contains 100 tons of uranium fuel in 36,816 rods. It makes scalding hot water, which feeds two steam generators, each 73 feet high and weighing 400 tons. On September 24, the plant was six months old, and they were still testing it, running at low power just to see if something would break. The reactor was at nine percent power.
All was quiet and peaceful in the control room when the floor gave a shudder. There was a distant rumble, seeming to come from the turbine building, and the operating staff on duty assumed a collective “what-the-hell-was-that?” look. The long U-shaped console lighted up with trouble indicators, and alarms started going off. Six operators scanned the meters and alarm panels, seeking to quickly evaluate the status of the system. Shift Supervisor Mike Derivan, trained as an engine-room supervisor in the nuclear Navy, looked first at the level of water in the pressurizer. It was shooting up rapidly, shrinking the steam bubble at the top. He instinctively reached for the red scram button and pushed it. The control rods slammed into the reactor core and stopped the fission process.
The coolant pumps for the number two steam generator seemed to have stopped for some unknown reason, and that had caused the pressure to rise in the reactor and force water up into the pressurizer. With one steam generator out of commission, the reactor was suddenly making too much heat. That much made sense. The operations crew now watched, perplexed, as the pressure in the reactor dropped by several hundred pounds in less than a minute. It was not clear what was going on.
The reactor, noticing that no operator was moving to prevent a meltdown, then decided to fend for itself, automatically turning on the ECCS. This first component of the ECCS was the High Pressure Injection system (HPI), spraying cool water into the reactor vessel at an aggressive pressure of 1,900 pounds per square inch.
Derivan, still locked on the pressurizer water level, decided that there was no problem with the size of the steam bubble now, and he manually overrode the automatic system and shut down the ECCS. Inexplicably, the water level began again to rise in the pressurizer, indicating an increase in reactor vessel pressure, even though the reactor was shut down and cooled by the water injection. The pressure should have been dropping.
The staff was now completely confused, and somebody suggested that they cut off the other two coolant pumps. Coolant pumps, after all, generate some heat on their own, just by stirring the water, and perhaps that extra energy was causing the pressure to rise. Grasping at straws, they stopped the pumps.
The water level in the pressurizer shot up and off scale. More alarms started blaring, and by this time hundreds of trouble lights were blinking all over the console. Number two steam generator boiled dry, and a particularly insistent alarm indicated that the air pressure in the reactor containment building, which should be below atmospheric pressure, was now abnormally high. Was there a break in the pipes? Was steam escaping into the building? This was getting very serious.
Derivan ran behind the console to look at the containment building pressure gauge. It was at three pounds per square inch above normal and rising. Finally, he understood what was going on. The Pilot-Operated Relief Valve (PORV) atop the pressurizer had blown open and failed to reclose. It was designed to open automatically if the pressure in the primary coolant loop reached 2,200 pounds per square inch and allow the steam to blow off into a holding tank in the containment building. The containment building held the reactor vessel and the steam generators, or everything in the potentially radioactive primary cooling system, and was a secondary safety against radiation escape into the surrounding environment. The relief valve prevented damage to the plumbing in the primary cooling system when the pressure in the reactor spiked too high. The act of relieving the pressure would cause it to drop, and the PORV was supposed to close again when it fell below 1,800 pounds per square inch. If the valve failed to close, then the pressurized water reactor was no longer pressurized, with all its energy free to escape into the air in the building.
227
This was hardly the first or the only fire in nuclear-plant cable trays. There were two cable fires at San Onofre Unit 1 in 1968, one at Nine Mile Point Unit 1 during startup testing, and a cable tray fire at Indian Point Unit 2 that started in a wooden scaffolding. There were 11 cable-tray fires in nuclear plants before Browns Ferry in the United States alone, and foreign cable fires are numerous. On May 6, 1975, a fire very similar to the Browns Ferry incident occurred at the
228
There was some further bad luck at Browns Ferry. The operating license was pulled in March 1985 because of operational problems, and the entire plant was idled for over a year. It turns out that all nuclear plants do not have the iconic concrete, convection-driven cooling towers looming over the site. Browns Ferry instead has six smaller, forced-draft cooling towers, with water flowing over slats made of redwood. With the reactors down, there was no cooling water on the slats, and they dried out in the Alabama sun. On May 10, 1986, an attempt to start up the electrical fans ignited the dry wood in a tower, which was four stories tall, 30 yards wide, and 100 yards long, and the entire structure burned to the ground. It is the only case of a nuclear-plant cooling tower being destroyed by fire.
229
B&W reactors were named by the number of fuel assemblies (FA) in the core. In this case, it was 177. Each fuel assembly holds 208 fuel pins, which are zirconium tubes filled with cylindrical pellets of uranium oxide, each 12 feet long.