The Browns Ferry nuclear power plant in Alabama consists of three 1065- MW(e) boiling-water reactors. On March 22, 1975, a workman who was lying on his side used a lighted candle to test for leakage of air around cable pene­trations through a concrete wall at the Unit I plant. A hole was found, and the workmen stuffed some polyurethane sheet into it and tested again for leaks. The leak persisted, and the candle flame ignited the polyurethane sheet. The air rnshing into the hole spread the fire into the hole and away from the workmen, so that they could not extinguish it with fire extinguishers. The fire burned for 7 h before it was put out. Units I and 2 were both at full power when the fire started. (Unit 3 was under construction and was not affected by the accident.) The fire spread horizontally and vertically, affected about 2000 cables, and caused damage that cost about $10 million to repair. There was a reluctance to use water on the fire until both reactors were in a stable shutdown condition because of the possibility of short-circuiting. Once water was used, the fire was rapidly put out.

Both reactors were shut down. However, because of the fire, both the shut­down cooling system and the emergency core cooling system for Unit 1 were in­operable for several hours. The operators had to use alternative means of injecting water into the reactor, which included a pump used in connection with the control rod drive system and pumps used for returning condensate to the sys­tem. The use of these alternative water supplies required depressurization of the reactor, and during this maneuver, the water level over the core dropped to 1.2 m above the top of the fuel. However, sufficient cooling was provided throughout the incident to prevent the core from overheating. No significant problems were encountered with the cooling of Unit 2, and the high-pressure cooling system (HPIS) was successfully initiated. There was no release of radioactivity off-site, and no one on the site was seriously injured. Both units were, however, out of operation for over 1 year while the damage was repaired.

The main lesson from the Browns Feny incident was related to what is called common mode failure. All the cables related to the safety systems passed through a single duct and failed in a common mode (despite the diversity in­troduced as discussed in Chapter 4), and all the systems failed when there was a fire. The moral is that the designer should ensure that each of the indepen­dent systems is truly independent and that supplies and controls to the instm — mentation and actuation devices should not pass along common ductwork. The technical term for this is segregation, and after the Browns Feny incident the provisions for segregation were significantly improved. For example, 3-h fire-re­sistant physical barriers are now placed between components, and when this is not possible the cables are separated by significant distances (typically 7 m) and protected by active fire-fighting equipment so that the possibility of a fire spreading from one to another is remote.