It seems that springtime is a lousy season for
nuclear power plants. The worst accidents seem
to have happened in the spring. On a chilly March
day with two reactors operating at full power
delivered 2 ,200 megawatts of electricity to
the community, workers there set off a sequence
of events that would result in a near meltdown
of the Unit 1 and Unit 2 reactor cores. In the
bowels of the plant there was an electrical cable
room called a cable spreading room. It's designed
to separate the essential electrical cables for
the plant's reactors. Those cables provided electrical
lifeblood of the reactors and were key to controlling
them. That room was the heart and brain of the
reactors. On this March day, two construction
workers were trying to seal air leaks between
the reactor building and a turbine building.
These buildings had to be airtight. Otherwise,
radiation could escape from one to the other
and possibly out to the environment and the people.
They were using polyurethane foam material for
this purpose and a candle to determine whether
the leaks had been successfully plugged. Any
escaping air would move the flame on the candle
telling them that their work was not yet done.
All was going according to plan until one of
the workers placed the candle too close to the
foam rubber. The foam rubber quickly burst into
flames. The fire disabled critical systems, including
the entire emergency core cooling system of the
reactor unit one. Soon, it would be within an
hour of meltdown. Maybe you think I'm describing
the start of the Fukushima nuclear disaster in
Japan, but this series of events occurred a lot
closer to home. These things happened at the
Browns Ferry nuclear plant in Alabama in 1975.
35 years, 11 months, and 18 days before Fukushima.
The parallels between the two accidents are both
interesting and enlightening. To complete your
sense of the timeline, the Brown's Ferry disaster
occurred a little more than four years before
the Three Mile Island accident in March of 79,
and 11 years before the Chernobyl accident in
April of 86. See what I mean about springtime?
Years after the Browns Ferry fire, I went to
work at that plant and found myself among some
of the operators who had experienced the events
firsthand. I talk a little bit about my conversations
with them and what I learned from them in my
book, Station Blackout. But because the book
is primarily about the Fukushima disaster and
its aftermath, I touched upon the lessons and
parallels of Browns Ferry only briefly. And it
is a story that deserves fuller attention. I'm
very pleased to share it in more detail now.
along with my promise to dedicate future podcasts
to the stories of the heroic Fukushima operators,
whose actions saved their planet and probably
their country. Back to Brown's Ferry. The cable
spreading room where the fire began is located
just below the plant's control room. There's
a wall penetration, a hole basically, between
the turbine building, referred as the non -safety
side, and the reactor building, the safety side.
that houses the reactor and its safety systems.
The electrical cables for the safety systems
run through this hole, but it is critical that
there be no airflow between the two buildings.
As I said earlier, any leak could potentially
allow radioactive substance to flow from the
reactor building into the turbine building and
ultimately out to the environment, which is why
the sealing of any possible leaks is a critical
task. On that March day, working carefully as
he was trained to do, one of the workers tore
off two pieces of foam sheeting and jammed them
into the hole. Not fully effective as it turns
out, when he held the lit candle nearby to check
his work, the draft between the two buildings
quickly sucked the flame towards the flammable
foam. As the foam started to smolder and glow,
the other worker quickly handed the man a flashlight,
which he used to try to knock out the fire. No
luck. Next he tried to smother the fire by stuffing
rags into the hole. That didn't work either.
Increasingly desperate, the two workers pulled
out the rags and one of them grabbed a fire extinguisher,
quickly aiming a strong blast of CO2 right through
the hole into the reactor building. Surely this
would do the trick, right? Wrong. The fire continued
to spread. He then tried a dry chemical extinguisher
and then another. Neither put out the fire. which
was now galloping through the polyurethane foam.
In fact, the CO2 extinguisher had just pushed
the flames further into the hole, and the chemical
extinguisher had a blowtorch effect, causing
the fire to literally roar. Although the dry
chemicals did briefly douse the flames, they
simply reignited. The workers should have activated
a fire alarm even before attempting to douse
the flames themselves. Instead, they struggled
to put out the fire for about 15 minutes. to
no avail. Only then, in a panic, did they run
to a plant guard to tell him that the fire had
broken out. He in turn violated protocol by calling
the shift engineer's office rather than sounding
an alarm. The shift engineer called the reactor
operator in the control room and only then was
the fire alarm sounded. I shudder to think what
would have happened if the shift engineer had
been away from his office on the construction
side of the plant where he'd have no direct line.
of communications to the control room. Even after
the fire alarm sounded, the operators didn't
consider it necessary to shut down the plant,
and the reactors continued to operate. 45 minutes
after the fire alarm sounded, the Unit 1 reactor
operator discovered that all of his emergency
pumps had been activated automatically. This
would normally occur as a result of a change
in the reactor's water level, but the reactor
was operating normally. And the water level was
unchanged. What was going on, he thought. Lights
on the control panels began randomly glowing,
brightening, dimming, and then going out. Alarms
were sounding. At one point, smoke began pouring
from the control boards. On one emergency panel,
light bulb sockets began to pop, and the light
bulb shattered. Thinking this was just part of
some malfunction of the emergency system, the
operator tried to shut it down. But it simply
restarted on its own. reactivating the pumps
and offering up more flashing lights, buzzers,
and smoke. After 10 minutes, the reality began
to sink in. Maybe the reactor should be shut
down, he thought. But before the reactor operator
could initiate this action, the power in the
Unit 1 reactor began to drop precipitously, and
the reactor's cooling water pumps quit. At that
point, 55 minutes after the fire had started
in the cable spreading room, the operator shut
down the reactor. As a result of this chain of
events, all control power and electrical power
for the reactors was lost. All safety equipment
for Unit 1 was lost, along with all systems that
protected the core, except for one small pump.
And it was not enough to keep the core cold.
So that's what was happening in Unit 1. But what
about Unit 2? On the Unit 2 side of the control
room, warning lights were also going off. Panel
lights were flashing and changing color. Backup
electrical power to the emergency system had
failed. Soon, just as in Unit 1, reactor power
began inexplicably decreasing. And just as in
Unit 1, the operator didn't immediately shut
down the plant. Back in Unit 1, things were not
going well. One hour and 15 minutes into the
accident, all the nuclear instrumentation had
been lost. So the operator had no way of knowing
what was happening inside the reactor. How could
he cool the core with just that one small pump?
He had to figure out a way to get more water
into the core. He decided to open some valves
to depressurize the reactor. He hoped that this
action would allow for low pressure systems to
deliver water for the reactor. The question was,
were these low pressure systems available? By
the time the operator located one working low
pressure pump, that could deliver an adequate
supply of water to the reactor, the reactor water
level had dropped parallelously low, to just
48 inches above the core. For the moment, the
Unit 1 reactor was under control, but for how
long? Unit 2 avoided a meltdown by a similarly
thin margin. Key safety systems, nuclear instrumentation,
and communications failed. The operators for
Unit 2 were becoming blind without this information.
The room was filling with smoke. Alarms were
blaring in their ears. They were becoming blind
just as the operators were on Unit 1. The operators
were able to depressurize the reactor and use
low pressure systems to cool the core, thus narrowly
averting a meltdown. Back at the site of the
fire, the Plant Fire Brigade was assembled and
determined to get into the reactor building and
attack the fire from the other side of the hole.
But this was not easily done. The loss of electricity
had plunged the interior of the reactor building
into darkness, and it was filled with dense,
thick smoke. They needed breathing apparatus
to survive inside, and they were woefully under
-equipped in that department. And after several
heroic attempts to get in, the firefighters gave
up. In the turbine building, one firefighter
tried to turn on the CO2 fire suppression system
and flood the entire spreading room. Only to
find that the CO2 system had purposely been disabled
to prevent spraying construction workers with
CO2 while they worked. The spreader room was
crowded and difficult to navigate under the best
of circumstances. But when wearing an air pack
and mask and carrying a fire extinguisher, it
was nearly impossible for the firefighters. Firefighters
tried crawling under the cables, but their air
packs were too cumbersome. They took them off
and slid them along ahead of themselves. In the
process, the nozzle of one of the extinguishers
broke off, making a horrific noise and making
the extinguisher useless. Air packs were in short
supply and not all of them worked. Some included
face masks and some of them didn't, and others
were not fully charged. Of course, even when
charged, they could only be used for a limited
amount of time. One firefighter tried to use
a manual override to start the flow of CO2 It
discovered that a metal construction plate had
been installed over the handle. Unable to locate
a simple screwdriver to remove the plate, he
couldn't get this done. It would later be discovered
that nearly all manual CO2 controls in the plant
had been similarly obstructed. The firefighter
finally restored power to the CO2 system, but
when they deployed it, the result was simply
to drive heavy black smoke up into the control
room choking the operators. making it even more
difficult to control the reactors. The operators
and others in the control room began choking
and coughing up smoke. It was evident that they'd
soon have to evacuate unless they could get the
control room ventilated. Firefighters shut off
the CO2 system to stop the influx of smoke and
opened the control room doors, but the fire burnt
on. Two firefighters grabbed flashlights and
went up into the spreader room to try again to
extinguish the fire. but the flashlights couldn't
penetrate the thick black smoke. On their way
to the spreader room, they encountered some 12
workers in or near the room who'd been overcome
by the CO2 and were close to death. They would
need to be rescued immediately, and they were
by the already overburdened firefighters. By
this point, the rubber insulation around the
cable was burning, producing dense black smoke
and sickening fumes and causing those fighting
the fire to vomit repeatedly. Back in the reactor
building, operators put on breathing equipment
and made three attempts to open valves to cool
the reactors. But their air packs provided only
18 minutes of air. Not enough time to get the
job done and get back to safety. After their
third attempt, frustrated and unable to recharge
the air packs, they went back to the control
room. They'd need better equipment if they were
to succeed at their task. For another six hours,
electrical cables continued to burn. The Athens,
Alabama Fire Department had been on the scene
since about 1 .30 p .m., an hour and a half after
the fire began. But most of the firefighting
was still being carried out by the Plant Fire
Brigade. The local fire chief didn't believe
the fire was electrical in nature and wanted
to douse it with water rather than using the
CO2 or dry chemicals. In his view, the hot wires
needed to cool. and this could only be done with
water. But the Tennessee Valley Authority, the
organization that ran the plant, continued to
insist that the fire was in fact electrical.
And they had a policy of not putting water on
an electrical fire to avoid electrocution of
firefighters. The fire chief was frustrated.
Plant employees were using B and C types of fire
extinguishers to put out what he knew was a Type
A fire. Around 6 p .m., he again suggested the
use of water. and the plant superintendent finally
agreed. As a result, the Athens Fire Department
put out the fire in about 20 minutes, a fire
that had burnt for hours and nearly melted down
two reactors. Concerns about reactor pressure
increasing and stopping the low pressure water
flow to the reactor core suddenly appeared on
Unit 1. Under these conditions, with increasing
pressure and the loss of water, Meltdown could
begin in as little as a few hours. Reactor pressure
mounted higher and higher. How could they depressurize
the reactor? Then one of the shift engineers
remembered that the system had been installed
during construction that would allow for the
depressurization of the reactor by using nitrogen
in lieu of the failed air systems. The operators
plunged back into the smoke -filled reactor building
to find the nitrogen valves. and align them so
that the reactor could be depressurized. Finally,
at about 9 .50 p .m., the operators began to
depressurize the reactor. The normal shutdown
of the reactor was finally accomplished at 4
a .m. The tragedy of the Brown's Ferry fire was
over, with dozens treated for smoke inhalation,
but no loss of life. Other emergency system failures
plagued the plant in the wake of the disaster.
After nightfall, aircraft warning lights on the
600 -foot plant stack went out, leaving it vulnerable
to an aircraft collision. Someone tried to notify
the security officers of this situation by public
telephone, but couldn't reach them. They then
called the State Environment's Emergency Center
and explained the condition, only to be told
to contact the FAA so that aircraft might be
warned. That was a nonsensical action. The computer
printer recording the events ran out of tape
at 4 .30 p .m. and wasn't replaced until 2 p
.m. the following day. Because of that, much
of what happened moment to moment could only
be reconstructed anecdotally after the fact.
Similarly, the tape recorders used to record
phone calls were not fully functional and only
partial transcripts were taken. Some of the calls
that were recorded exposed that senior managers
were making light of the Nuclear Regulatory Commission's
decision to come and investigate the fire. Some
even made fun of the investigators themselves.
Plant leaders were recorded telling the public
affairs officer at the Nuclear Regulatory Commission
that the public news media would probably, quote,
drive you out of your mind, unquote. He had asked
if the NRC had issued a press release. They had
issued one at 430 p .m. that day, four and a
half hours after the fire. But the upshot of
the press release was that the situation could
have been a hell of a lot worse. Not a meaningful
press release. Emergency procedures for the reactors
were problematic as well. Even though there had
been previous fires at the plant, many employees
didn't know how to call in an alarm, nor had
they been trained in emergency procedures. When
the word of the fire had spread throughout the
plant, many of the employees had gone to the
control room, which added to the chaos of the
situation. in a room meant to hold six people,
suddenly there were 50 to 75, and few of them
were actually helping. After the fire, there
was much discussion about why flammable foam
had been used to fix the leaks in the first place.
The workers themselves knew that the foam was
flammable, and they'd been told as much by an
electrical engineer. Some senior managers admitted
that they knew the foam was flammable, but had
never dreamed anybody would use a candle to test
it. Others said they knew about the candles but
had no idea the foam was flammable. The real
irony of the Browns Ferry fire was that two days
earlier another engineer had put out a similar
fire. The night shift engineers and the assistant
engineers all met to discuss it. They had concluded
that the candle procedure should no longer be
used. However, no follow -up action was taken.
It's easy to conclude that it wasn't a matter
of whether there would be a significant fire
at Browns Ferry, but when. In order to learn
from a terrible circumstance such as the Brown's
Ferry fire, it's important to look not only at
the events themselves, but at the reaction to
the events. How was the emergency handled? Has
it unfolded? Were there proper safety protocols
in place? Were they understood and followed?
At Brown's Ferry on that day, the environmental
radiation monitors on Unit 1 were lost almost
immediately, and those on Unit 2 were not functioning
from 2 p .m. until 9 p .m. Had there been a release
of radiation, the operators would not have been
able to gauge the severity of the release. They
would not have been able to determine the proper
evacuation protocol for the public to keep people
safe from the radioactive exposure. Both the
NRC and the plant's operator, the federal government's
Tennessee Valley Authority, insisted that no
radiation release had occurred, but there were
continuing difficulties in getting air samples
to verify this. As the fire raged on, officials
tried to get samples from the meteorological
tower at the plant, but the smoke was too thick
to allow it. Effective sampling of air finally
began at 4 45 p .m. in Athens, 10 miles northeast
of the plant. No samples were available from
the area southeast of the plant, which was the
direction in which the wind was blowing at the
time of the fire. Had there been a radiation
release, it would have moved in that direction,
towards Decatur, Alabama. Had the accident resulted
in a court meltdown, much of the surrounding
population would have had to evacuate. Shockingly,
throughout the course of the event, no one ever
notified the Civil Defense Coordinator for Limestone
County. He didn't even hear about the fire until
March 24th, two days after it had been put out.
The Limestone County Sheriff wasn't notified
either, but even if he had been notified, he
wouldn't have known what to do. He had never
been given a copy of the emergency evacuation
plan. The sheriff of Morgan County didn't hear
about the fire until about four hours after it
started, but he was advised to keep quiet about
it to avoid public panic. No official notification
was made to the state of Alabama Highway Patrol
or Public Health Department. Other relevant state
agencies would say later that they didn't have
up -to -date copies of the emergency plan. In
the months that followed the Browns Ferry fire,
the NRC headquarters in Washington remained silent
about it. The press release said that the two
reactors had been safely shut down and cooled
during the fire, downplaying the event. NRC inspectors
themselves reported there had been a redundant
cooling system available during the cool down.
They said certain critical instrumentation, such
as that monitoring the reactor water levels,
temperature and pressure within the reactors
had continued to function, and both plants had
been safely shut down. They also said that on
Unit 1, emergency core cooling systems had been
activated and supplied water to the reactor.
Although a loss of cooling accident never occurred,
those systems, they insisted, had been shut off
to prevent overfilling of the reactor, none of
which factually represented the event. None of
it was accurate. I arrived at Brown's Ferry a
few years later as a plant operator. Many of
my colleagues, those who trained, supervised,
and managed me, had actually fought the fire.
They shared their stories of the fire with me,
and I learned many lessons from them. At one
point, I asked an operator who had been in the
control room that day, who was known in the official
report as Operator M, whose real name was Gary
McChristian, whether he'd been frightened during
the accident. Well, he said, you know, they're
operating with an air mask on, with light bulbs
popping out of their sockets. and heavy dense
smoke is coming in from the control board and
filling the room. Sure, there was a lot to deal
with and a lot of fear, but I didn't really get
concerned until they called and told me that
the spreader room ceiling was caving in. The
concrete was spalding. You have to understand,
that ceiling was the control room floor. At that
point, I got a little worried. Gary was a great
operator as well as a great friend and mentor.
On that day, concerned or not, He was a hero.
The operators at Brown's Ferry were every bit
as heroic as the ones I would later encounter
at Fukushima. On that note, let's skip ahead
35 -plus years for a moment. After reflecting
on these two accidents, my question is, in all
that time between Brown's Ferry and Fukushima
over 35 years, did we really learn anything?
The operators at Fukushima, too, faced a situation
where they had to devise alternate means to cool
the reactors. As I detail in the book, a man
named Yoshida, the site vice president, fortunately
he knew of an alternate fire protection connection
that would allow water into the reactor core,
much as the operators at Brown's Ferry had made
the nitrogen connection to reduce pressure. In
both situations, heroic actions under the most
challenging conditions saved the day. As we explore
Fukushima in future podcasts, the parallels between
the two accents will become clear and enlightening.
Thankfully, the American nuclear industry has
learned from both devastating situations. The
industry is exponentially safer today because
of what we learned from the heroes of Brown's
Ferry and Fukushima. These were operators who
did the best that they could with what they were
given. Neither gave in to fear or panic, and
neither gave up until they prevailed over the
nuclear disaster. My job as a nuclear safety
consultant is to help ensure that we never need
that kind of heroic action again. It may sound
strange, But I would be very happy to wake up
in a world without the need for nuclear heroes.