Three Mile Island

Lise Fortin starts the accident case studies with a rule for Hana. "For each accident, we read the official investigation, not the summaries. Then we ask three questions: what happened, why it was possible, and what the industry changed because of it. Three Mile Island first, because it is the accident that reshaped American nuclear regulation and taught us that operators, instruments and procedures are part of the safety system." Marcel Thibodeau, who has trained operators on its lessons for years, joins them.

The plant

Three Mile Island Unit 2 was a pressurized water reactor of about 900 megawatts electric, designed by Babcock and Wilcox, on an island in the Susquehanna River near Middletown, Pennsylvania. It had entered commercial operation only three months before the accident. Like other Babcock and Wilcox plants, it used once-through steam generators that held relatively little water on the secondary side, so a loss of feedwater dried them out quickly and the primary system heated up fast. The reactor coolant system was kept at about 15 megapascals by a pressurizer, a tall vessel partly filled with water and partly with steam, fitted with a power-operated relief valve, the PORV, at the top.

The sequence of events

At 4 a.m. on 28 March 1979, the main feedwater pumps tripped during maintenance work on the condensate polishing system. The turbine tripped, and as the primary system heated and pressure rose, the PORV opened as designed and the reactor scrammed. The auxiliary feedwater pumps started, but their discharge valves had been left closed after testing two days earlier, so no water reached the steam generators for about eight minutes. This was a pre-initiator human error of the kind discussed earlier in the course, and it made the transient more severe, but it was not the decisive failure.

The decisive failure was that the PORV did not close when pressure fell. Its indicator in the control room showed only that the signal to the solenoid had been removed, not the actual position of the valve, so the operators believed it was closed. Reactor coolant continued to escape through the open valve into the drain tank, which eventually overfilled and ruptured its disc, releasing water onto the containment floor. The plant was undergoing a small break loss-of-coolant accident, with the break at the top of the pressurizer.

High-pressure injection started automatically as pressure fell. But the operators saw the pressurizer level rising, and their training emphasized that the pressurizer must never go solid, that is, completely full of water. The level was actually rising because steam was forming in the primary system and pushing water into the pressurizer through the open valve at its top, not because the system was full. Interpreting the rising level as too much water, the operators throttled high-pressure injection to a small fraction of its capacity. From then on, more water left the system than entered it.

# Toy mass balance for a stuck-open relief valve (in the spirit of TMI-2; illustrative).
# Coolant leaves through the open valve; injection adds water only if not throttled.
inventory = 220000.0      # kg of primary coolant
leak = 40.0               # kg/s out through the stuck-open valve
hpi_full = 35.0           # kg/s from high-pressure injection at full flow
for throttled, label in ((False, "injection left on"), (True, "injection throttled to 10 %")):
    m = inventory; t = 0
    inj = hpi_full * (0.1 if throttled else 1.0)
    while t < 3 * 3600 and m > 0.55 * inventory:
        m += (inj - leak) * 60; t += 60
    status = f"core starts to uncover after about {t/60:.0f} min" if m <= 0.55 * inventory else "inventory holds for 3 h"
    print(f"{label:30s}: {status}")

injection left on             : inventory holds for 3 h
injection throttled to 10 %   : core starts to uncover after about 46 min

The program illustrates the mechanism. With injection running at full capacity, inventory holds. With injection throttled, the inventory drains and the core begins to uncover within an hour or so. At TMI-2, the reactor coolant pumps kept circulating a mixture of steam and water for some time. When the operators stopped them, about 100 minutes into the accident, because of vibration and concerns about pump damage, the steam and water separated, and the upper part of the core uncovered and heated up. Cladding oxidized, hydrogen formed, and fuel began to melt.

About two hours and twenty minutes into the accident, an operator closed the block valve upstream of the PORV, stopping the leak, but by then the core was badly damaged. High-pressure injection was eventually restored and the core was recovered with water, but it took many more hours to establish stable cooling. Later examination showed that about half of the core had melted, and some molten material had relocated to the lower head of the reactor vessel, which held. A hydrogen burn occurred in the containment about ten hours into the accident, producing a brief pressure spike that containment withstood.

Consequences

The containment building remained intact and retained nearly all of the fission products released from the damaged fuel. Some radioactive gases, mainly noble gases, escaped through the auxiliary building because contaminated water had been transferred there, and small amounts of iodine were released. Investigations concluded that the average dose to people within about 16 kilometers of the plant was about 0.01 millisievert, a small fraction of the annual natural background, and later studies did not find a detectable increase in cancer.

The social consequences were much greater. Confusion about the state of the plant, the possibility of a hydrogen bubble exploding in the reactor vessel, and conflicting public statements led the Governor of Pennsylvania to advise pregnant women and preschool children within 8 kilometers to leave the area, and many more people left voluntarily. The cleanup of the unit took about fourteen years and the reactor never operated again. Unit 1, on the same site, continued to operate safely for decades. On the International Nuclear and Radiological Event Scale introduced later, the accident is rated level 5, an accident with wider consequences.

The Kemeny Commission and other investigations

President Carter appointed the President's Commission on the Accident at Three Mile Island, chaired by John Kemeny, which reported in October 1979. Its central finding was that the fundamental problems were people-related rather than equipment-related. It identified weaknesses in operator training, which had not prepared the crew for a small break in the steam space of the pressurizer; in procedures, which were confusing and event-based; in the control room, where more than a hundred alarms sounded in the first minutes and key indications were missing or misleading; and in the regulatory process, which had not acted on an earlier, similar valve event at another Babcock and Wilcox plant, Davis-Besse, in 1977. The NRC's own special inquiry, led by Mitchell Rogovin, reached similar conclusions.

What changed

Three Mile Island changed the nuclear industry more than any event before it. In the United States, the NRC issued the TMI Action Plan, NUREG-0660, and the clarified requirements of NUREG-0737, which required, among other things, shift technical advisors with engineering training on every shift, safety parameter display systems, direct indication of relief valve position, instruments for detecting inadequate core cooling, upgraded emergency procedures based on symptoms, and improved operator training and licensing. Requirements for emergency planning, including planning zones of about 16 kilometers around each plant, were greatly strengthened. The industry formed the Institute of Nuclear Power Operations in 1979 to set standards of excellence and to share operating experience.

For TVA, the accident had direct effects. Its plants under construction, including Sequoyah and Watts Bar, had to meet the new post-TMI requirements, and the ice condenser containments at those plants were fitted with hydrogen igniters after analysis showed that hydrogen from a degraded core could threaten them. Every licensed plant now has a shift technical advisor function, symptom-based emergency operating procedures developed by the owners' groups, and a plant-referenced simulator for training.

The accident also changed safety analysis. Before Three Mile Island, analysis concentrated on the large break loss-of-coolant accident as the limiting event. The accident showed that small breaks, transients with multiple failures and human errors could be more important, as the WASH-1400 study had suggested in 1975. Probabilistic safety assessment gained acceptance as a way to find such sequences, and severe accident research programs began in earnest.

The human side of the accident

It is easy, with hindsight, to judge the operators of TMI-2 harshly. The Kemeny Commission did not. The crew faced more than a hundred alarms in the first minutes, a control room in which important indications were on the back panels, and a situation their training had not covered. The indication they relied on for the relief valve told them it was closed. The level indication they were trained to watch most closely told them the system was filling. Their response was consistent with what they had been taught. The accident showed that operators make sense of a situation using the mental model their training gives them, and that a wrong model can lead skilled people to the wrong action.

The confusion extended beyond the control room. Information passed to the utility's management, the NRC and the state government was incomplete and sometimes contradictory. Over the following days, concern grew that a hydrogen bubble in the reactor vessel might explode. In fact, there was too little oxygen in the vessel for this to happen, but the uncertainty, and conflicting public statements, damaged public confidence more than the radiological release itself. The accident led to a clearer chain of command for emergencies, technical support centers at each plant, and requirements for accurate and timely public information.

Precursors and operating experience

The most uncomfortable finding of the investigations was that the accident had been foreshadowed. In September 1977, at the Davis-Besse plant, which also had a Babcock and Wilcox reactor, a relief valve had stuck open and operators had throttled injection in response to a rising pressurizer level. The plant was at low power, the valve was closed after about twenty minutes, and no damage occurred. An engineer at Babcock and Wilcox and an NRC reviewer both raised concerns that operators might respond the same way in a more serious situation, but their warnings did not result in changes to training or procedures at other plants. After TMI, the systematic collection and analysis of operating experience, by INPO and later by WANO and national programs, became one of the most important safety activities in the industry, and precursor analysis programs began to estimate how close each event came to core damage.

For engineers, the lasting lesson of Three Mile Island is that a safety system is only as good as the information the people operating it receive. The plant had the equipment it needed to prevent core damage; high-pressure injection, if left running, would have kept the core covered. What failed was the link between the plant and the people, through an indicator that showed a command rather than a position, a training program that taught a rule without its reasons, and an industry that had not shared the warning from Davis-Besse.