PDF for download President's Message From the Executive Vice President From the Editor's Desk Outside the Lines In the Spotlight: The Use of Safety Cases in Certification and Regulation Safety Implications of Software in Safety-Critical Devices System Safety in Healthcare Swiss Cheese Model for Investigating the Causes of Adverse Events Announcements Gains from Losses: Facts, Fiction and Public Perception Book Review: Murder by Electrocution, by David MacCollum Unintended Consequences: TWA Flight 800 Accident Opinion (MacCollum) Upcoming Conferences/Calls for Papers Chapter News Mark Your Calendar About this Journal Advertising in eJSS Contact Us Puzzle







Vol. 47, No. 6 • November-December 2011
Gains from Losses: System Safety Commentary on Accidents and Other Events
Facts, Fiction and Public Perception

Pages 1 | 2

Since 1960, the National Aeronautics and Space Administration (NASA) has had a large impact on the Huntsville, Alabama area within the even larger presence of the Redstone Arsenal. However, the biggest "federal" impact to the area over the last 80 years has been the Tennessee Valley Authority (TVA).

The TVA Act in 1933 established the TVA as a special government agency that had certain characteristics of a private enterprise. Its mission has been to provide integrated resource management of the region's natural resources built around the development of hydroelectric power. As the 20th century progressed, so did TVA. In 1959, the agency's power program became self-financed with sufficient revenues to pay its own way. To meet the Valley's growing energy needs, TVA expanded its power production facilities, adding fossil fuel and nuclear energy plants in the 1950s, 1960s, and 1970s [Ref. 1].

TVA's first nuclear plant, Browns Ferry, is located on the Tennessee River near Athens, Alabama, about 40 miles from my home in Huntsville. The plant is named after a ferry that operated at the site until the middle of the 20th century. The plant's maximum capacity of 3,440 megawatts is about 10 percent of TVA's total generation capacity and enough electricity to meet the needs of about two million homes.

Browns Ferry made headlines in the past with a fire that almost resulted in the loss of control of one of its three nuclear reactors. In addition to the Nuclear Regulatory Commission (NRC), several anti-nuclear power groups continue to keep a close eye on its operation. When electric power suddenly went out over a wide area around the plant on April 27, 2011, the cause was not any failure inside the plant, but the power loss had an immediate effect on the plant's operation.

Southern States Tornado Outbreak April 2011

An EF-5 tornado, which passed within seven miles of the Browns Ferry Nuclear Plant, severely damaged transmission towers and lines in the area, cutting all of the lines to the plant except one. The plant went into a shutdown mode at 4:36 p.m. on April 27, which was reported to the NRC as an 'unusual event due to loss of offsite power.'
A series of tornadoes during a four-day period (April 25 to 28, 2011) killed 325 people in six southern states. Alabama was the hardest-hit state, with 63 officially identified tornadoes. The tornadoes cut paths all across the state, leaving 247 dead and millions of dollars of property damage. The outbreak included three EF-5 tornadoes (the strongest category, reserved for wind speeds exceeding 200 mph) on April 27, which tied the record for number of EF-5s in one state on one day (set in Indiana and Alabama in 1974).

Most of the news coverage focused on the terrible losses in Tuscaloosa, Alabama, which had 47 deaths and a wide path of destruction across the city of 83,000 people. While the number of deaths in the northern part of the state was much smaller than other areas of the state (except for DeKalb County, which had 35 deaths), there were still several paths of physical destruction across the Alabama section of the Tennessee River Valley [Ref. 2].

In addition to the damage to homes and businesses, the TVA power distribution system suffered major damage. More than 120 large metal transmission towers were destroyed or severely damaged. Initial reports by the TVA stated that 70 of its largest transmission lines — 500kv and 161kv — were out of service, mainly in North Alabama and Mississippi.

Two major sources of electrical energy were also impacted by the loss of transmission lines. The Widows Creek coal-fired plant and the Browns Ferry Nuclear Plant lost many of their connections to the TVA system power grid. The biggest impact was the consequence on the Browns Ferry plant.

An EF-5 tornado, which passed within seven miles of the Browns Ferry Nuclear Plant, severely damaged transmission towers and lines in the area, cutting all of the lines to the plant except one. The plant went into a shutdown mode at 4:36 p.m. on April 27, which was reported to the NRC as an "unusual event due to loss of offsite power." All three of the reactors at the plant were automatically scrammed ("A rapid emergency shutdown of a nuclear reactor1"). [Ref. 3] 1

In a statement released the next day, TVA stated that the three reactors at the plant had shut down safely. Unit 2 and Unit 3 had achieved cold shutdown (less than 212 degrees Fahrenheit) by late the next afternoon. Unit 1 was shut down and cooling to the desired temperature.

The result of the shutdown was a loss of TVA power for 641,000 customers in North Alabama and Mississippi. By May 5, only about 14,000 in the hardest-hit areas were still without power. TVA estimates of the system damage had grown to 107 of its major transmission lines and 350 structures supporting those lines. In a major feat of reconfiguring its network, TVA had managed to restore power to the local power distributors with only about 25 percent of its structures restored.

Browns Ferry remained offline because of the extent of damage to the transmission lines from the plant. For example, the Huntsville Utilities — with 300,000 customers — had eight connection points for power from TVA, but the "restored" system had only two — one from the east, with a repaired 500,000-volt line connecting Huntsville to Widows Creek and Guntersville Dam, and one from the west, with power being supplied by the Sequoyah Nuclear Plant in Tennessee and other sources [Ref. 4].

The last two 500-kilovolt lines and three 161-kilovolt lines in north Alabama were back in service by early July. The TVA reported that in a 74-day, around-the-clock effort, 108 transmission lines had been repaired. The 353 transmission structures and transmission lines that were replaced required 1.4 million pounds of steel and 275 miles of new wire.

"What they've accomplished is truly amazing," said Rob Manning, TVA executive vice president for power system operations. "TVA strives to be among the nation's leaders in customer reliability" [Ref. 5]. In the midst of the successful effort to restore the electrical power system, the TVA received a "red" safety finding on its handling of a hardware problem in the 2008-2010 timeframe.

Browns Ferry Safety

On May 9, 2011, the Nuclear Regulatory Commission announced that a valve that failed (stuck) during the past year at the Browns Ferry plant posed a safety threat that fell into the "red" level category, the most serious on its four-color scale. It was only the fifth time, since the establishment of the ratings scale in 2001, that the NRC had placed a finding in that category.

The valve was located in the reactor's residual heat removal system, which enables the reactor to cool after it has shut down. The failure was discovered when the reactor was shut down for a periodic re-fueling. The system is also an important part of the emergency safing systems used if an accident required the reactor to shut down quickly.

The valve consists of a flat metal disk inside the pipe, which is positioned by a rod. The rod had become disconnected from the disk, apparently weeks or months earlier. The residual heat removal system consists of two separate sets of pumps, valves and piping. One set would not have worked if the valve could not be operated. In certain accident scenarios, loss of the total residual heat removal system could lead to core damage. In response to the finding, the TVC told the NRC that the valve had a manufacturing defect but that it would still have opened if needed. The NRC disagreed.

Specifically, the NRC finding cited a violation of technical specifications involving the failure to implement an inspection program in accordance with the American Society of Mechanical Engineers (ASME) Code for Operation and Maintenance of Nuclear Power Plants. This failure precluded the timely identification that the RHR loop II subsystem was unable to fulfill its safety function due to a failure of the LPCI Outboard Injection Valve. The finding noted that TVA was not able to verify operability and functionality of valves susceptible to stem and disc separations as required by the ASME code. Because the subject valve was inoperable from March 13, 2009 to October 23, 2010, the specification limit for functional outage time (seven days) was exceeded [Ref. 6].

The NRC was unmoved by TVA's response to the finding, rejecting the TVA position that the "red" level finding was not justified. The Commission notified TVA that additional inspections would be made to provide the NRC with supplemental information on performance, as well as insights into the breadth and depth of safety, organizational and programmatic issues. The objective of the reviews was to aid the NRC in deciding whether additional regulatory actions would be necessary to assure public health and safety. The inspection would also include an assessment of the safety culture at the Browns Ferry Nuclear Plant. The review would center on the validation of TVA's third-party safety culture assessment and root cause evaluation program. The NRC did perform an "independent" review of the original findings and notified TVA in August, 2011 that the assessment by a branch of the NRC not involved in the original investigation confirmed the original finding.

next page »


1 Nuclear folklore attributes the term to Enrico Fermi, known for his nuclear "Pile" design, which obtained the first sustained nuclear chain reaction. Dr. Fermi had added two independent (manual) means of stopping the reaction in case of an emergency. One system was to have three "junior physicists" always ready to pour buckets of cadmium sulfate down through the pile if Fermi gave them a certain hand signal. The other system, which was the "primary" system, required a specialist (a logger skillful with an axe) to cut a heavy rope that restrained a poison cadmium rod freeing the weighted rod to fall into the pile. Since the logger needed to concentrate on the rope, Fermi was to holler "scram" as the signal to cut the rope. At the planning meeting, before the big event, the logger asked Fermi "just what does 'scram' mean? Fermi's reply was, "Safety Cut Rope Axe Man." Of course, it was also appropriate advice if both systems failed. See http://www.ornl.gov/info/reporter/no19/scram.htm (ORNL Reporter, September 2000).