Station blackout at Browns Ferry Unit One - Oak Ridge National ...

uilding-secondary containment of the controlled leakage, elevated release
type.
Safety systems for each unit include a Reactor Protection System, a
Standby Liquid Control System for Poison injection, and the Emergency Core
Cooling Systems: High-Pressure Coolant Injection (HPCI), Automatic De
pressurization (ADS), Residual Heat Removal (RHR), and Core Spray (CS).
The Reactor Core Isolation Cooling (RCIC) system is also provided for the
removal of post-shutdown reactor decay heat as a consequence limiting sys
tem.
Several components and systems are shared by the three Browns Ferry
units. A complete description of these shared features is given in the
Final Safety Analysis Report;! the shared Safeguards systems and their
supporting auxiliary equipment are listed in Table 1.1. With the assumption
that the interfaces with the other two units do not interfere with the op
eration of any shared system as applied to the needs of the unit under
study, the existence of the shared systems does not significantly compli
cate the analysis of an accident sequence at any one unit.
The results of a study of the consequences at Unit 1 of a Station
Blackout (loss of all AC power) at the Browns Ferry Nuclear Plant are pre
sented in this report. Section 2 provides a description of the event and
discussion of the motivation for consideration of this event. The normal
recovery from a Station Blackout is described in Sect. 3, the computer
model used for the normal recovery analysis is discussed in Sect. 4, and
the instrumentation available to the operator is described in Sect. 5.
The actions which the operator should take to prolong the period of decay
heat removal are discussed in Sect. 6, and computer predictions of the be
havior of the thermal-hydraulics parameters during the period when a nor
mal recovery is possible are displayed in Sect. 7.
A Severe Accident by definition proceeds through core uncovery, core
meltdown, and the release of fission products to the surrounding atmo
sphere. The equipment failures which have the potential to extend a Sta
tion Blackout into a Severe Accident are discussed in Sect. 8, and the
Severe Accident sequences which would follow during a prolonged Station
Blackout are presented in Sect. 9. The consequences of each of these se
quences after the core is uncovered differ only in the timing of events;
the actions which might be taken by the operator to mitigate the conse
quences of the Severe Accident are discussed in Sect. 10. The instrumenta
tion available following the loss of injection capability during the pe
riod in which severe core damage occurs is described in Sect. 11.
The conclusions of this Station Blackout analysis and the implica
tions of the results are discussed in Sect. 12. This includes considera
tion of the available instrumentation, the level of operator training, the
existing emergency procedures, and the overall system design.
Appendix A contains a listing of the computer program developed to
model operator actions and the associated system response during the per
iod when normal recovery is possible. The MARCH code was used for analy
ses of the severe accident sequences; the modifications made to this code
are described in Appendix B and an input listing is provided in Appendix
C.
The pressure suppression pool is the key to the safe removal of decay
heat from an isolated Boiling Water Reactor, but no satisfactory method