With the passing of the 30th anniversary of the incident that occurred at Three Mile Island happening last week, there has been plenty of discussion on DKos about the pros and cons of nuclear power. Many of the opponents of nuclear power use the Three Mile Island incident as a reason why we should not pursue nuclear power in the future. They bring all kinds of "facts" and information with their argument, much of which is fragmented and in some cases does not make any sense at all. I really don’t care if you are pro-nuclear or not. Objectivity and logical reasoning is what I am trying to promote with this information. This diary is presenting the factual record of what actually happened at TMI 30 years ago. Take from it what you will, but know that it really was the perfect storm of errors in design and operation, all coming together in 16 hours.
Unit 2 at 98% Power – still on its very first core
As usual many alarms are locked in. The Pressurizer PORV (power operated relief valve) discharge line shows elevated temperature because the PORV is leaking as it has been for months. Procedures require the PORV block valve to be shut in this condition, but that would put them in a Technical Specification (TS) Action Statement, so the block valve is kept open (Note: TS also required PORV to be operable).
2 Reactor Operators (RO), 1 Shift Supervisor (a Senior Reactor Operator (SRO)) on Control Room duty
The General Watch Foreman (SRO) & 2 Plant Operators are fluffing a condensate polisher bed with instrument/station compressed air and high pressure water in preparation for transfer of the resin after regeneration. This is a normal, routine evolution.
A check valve in the air line hangs open – water enters the instrument air system lines.
HH:MM:SS Occurrence
00:00:00 With water in the instrument air lines, ALL Condensate Polisher Beds immediately isolate, stopping all condensate flow. Condensate flow drops to zero, Condensate Booster Pumps Trip, Main Feedwater Pumps Trip, Main Turbine Trips, Integrated Control System starts reducing Reactor Power.
00:00:00 Auxiliary Feedwater (AFW) pumps start but do not feed. With Reactor Coolant Pumps (RCP) running they are designed to start feeding as soon as Steam Generator (S/G) level drops to 30 inches.
00:00:03 Reactor Coolant System (RCS) pressure reaches 2255, Pressurizer (Pzr) PORVs open to relieve pressure.
00:00:08 RCS pressure reaches 2355, Reactor auto trip (control rods inserted to stop fission)
00:00:12 Pzr level decreasing as S/G’s remove heat from reactor, - letdown (normal coolant discharge) isolates. Unable to start second Safety Injection/Centrifugal Charging Pump (SI/CCP) due to RO start error.
00:00:13 RCS pressure down to 2205, auto close signal gives Pzr PORV close green light (but the PORV does not close) This valve position indication was controlled by demand only, not by actual valve position. There are no other PORV position indicator devices, other than tail pipe & Pzr Relief Tank(PRT) temperature, & PRT level (the PRT info is in the back of the Control Room)
The Pressurizer PORV is dumping mass equivalent to 200 gpm into PRT.
00:00:28 S/G level reaches 30 inches, AFW Feed Regulating valves open but AFW Outside Containment Isolation Valves (OCIV) are closed.
This is a prohibited condition at power left over from an un-restored start up test alignment. S/G levels continue to decrease.
00:00:30 High Pzr PORV Outlet Temperature alarm received (just one more of many alarms already in )
00:00:40 S/G low level alarms received. (This is a normal & expected alarm after Rx trip from high power due to low water inventory in this S/G design). The S/Gs are still removing the decay heat from the core & RCS volume is decreasing.
00:00:41 With Pzr level down to 158 inches, the RO gets a good start on a second (of 3) SI/CCPs.
00:01:45 Both S/Gs boil dry, (the main core decay heat sink is now no longer functioning). The decay heat removal path is now feed & bleed through the Pzr PORV (this is not recognized & indicators for this are in the back of the control room)
00:02:02 With the stuck open PORV removing energy from the Pzr, primary system pressure decreases to 1640 where Auto Safety Injection (SI) on low RCS pressure occurs. The "C" SI/CCP starts & aligns to SI path, the "B" SI/CCP pump receives an auto stop signal per design. The combined SI/CCPs are capable of overpressurizing the RCS, so pump start combinations are designed to mitigate that.
00:03:13 With rising Pzr level the operators depress the ESF Actuation override/bypass button to allow throttling of SI flow in order to prevent going water solid. (as they were trained to do) Initial SI flow was 600gpm, throttled back to maintain Pzr level, flow reduced to as low as 25gpm. The hottest spot in the RCS was no longer the Pzr, it was now the reactor core, where saturation conditions now existed. The steam bubble in the core was pushing water into the pressurizer. Operators do not recognize that the rate of PZR level increase is greater than the 600 gpm SI/CCP flow capability.
00:03:26 Reactor Coolant Drain Tank (RCDT) high Temperature alarm received
00:04:00 Rapid steam bubble formation begins in the core, rapidly displacing water from the core into the Pzr. Recognition hampered by no Reactor Vessel Water Level System (did not exist at the time) and no subcooling/superheat indicators in the primary system (also did not exist). RCS Pressure continues to decrease. Procedure "Loss of Reactor Coolant/Reactor System Pressure" was NOT entered. Procedure would have required SI/CCP pumps & RCP flow to remain on until normal RCS pressure was returned.
00:05:00 RCS pressure continues to decrease, shows 1340 psig, with hot leg temperature of 582°F. Boiling starts to occur in the loops, displacing even more water through the stuck open PORV.
00:06:00 S/Gs are completely dry, operators do not notice, their attention is focused on actions to get condensers and condensate back in service so they can use steam dumps to cool the primary. PRT relief lifts at 155 psig dumping into Reactor Containment Building (RCB) sump (no PRT pressure indication easily available). RCB sump pump maintained aligned to pump to Aux Building Sump Tank (ABST). RCB tanks vented to leaking waste gas header in Aux building. ABST is nearly full, rupture disk is already failed (has work order against it), so ABST overflows into Aux Building Sump.
00:08:00 The AFW OCIVs are noticed to be closed (view had been blocked by work order tags) OCIVs are opened spraying max AFW flow onto hot dry SG tubes, water immediately flashes into steam. RCS temperature decreases, but even with max AFW flow, S/G level does not come back on scale until another 14 minutes have elapsed.
00:10:15 Pzr level lowers to be back on scale. Pzr level lowers rapidly as steam bubbles in core and loops are collapsed. Staff now believes Trip recovery is normal, Shift Supervisor swaps position with General Foreman, leaves to help with condensate system restoration (high priority). PRT relief can not pass all of PRT continuing pressure increase, rupture disc fails (195psig) dumping PRT water directly onto RCB floor.
00:19:00 Increasing radiation trend noted on RCB purge exhaust, (no alarms on this system). High influx of other Control Room Annunciators. Operators (Unit Supervisor & RO) believe they have a faulted or possible combined faulted ruptured S/G. AFW is throttled to maintain level in the indicating band in both S/Gs.
00:38:00 PO notices RCB sump pumps are staying on and RCB sump indicator is maxed out at 6 feet. Aux Building rad levels increasing (from sump & leaking waste gas system [fed by PRT water because PRT is water solid]). RO (with concurrence from SS who is in the Turbine building) orders RCB sump pumps secured. About 8,000 gallons had been pumped into Aux Building lower level. The RCPs are beginning to vibrate (indicated on VMS) - due to pumping two phase flow. Remember the Pzr function is not being performed, so pressure responds to the natural thermodynamic & hydraulic actions resulting from the decay heat source, and RCP & SI pump head. Steam & water mixture is being swept out of the core via the hot legs.
00:40:00 Ex-Core detectors (Reactor Power Detectors) indicate higher neutron flux than expected after shutdown, operators fear a loss of shutdown margin, impending Rx restart. The steam voids in the core area allowed a higher neutron leakage factor, thus the higher flux at shutdown was another unrecognized core voiding indication. RCB now at 170 °F and 2.5 psig.
01:00:00 Operators stop trying to regain main condenser function, elect to finish cooldown using S/G PORV’s.
01:11:00 STATUS REPORT -
Condensate System is inoperable, Pzr level is almost off scale high, it is only being kept on scale by very substantial throttling of SI flow, Primary system pressure is low at about 1100 psig, RCP vibration level is increasing, increasing probability of a dreaded seal failure loss of coolant accident (LOCA), RCB sump is at it’s maximum indicated level, RCB temperature and pressure are slowly rising, RCB radiation levels are increasing, Source range count rate is steadily increasing, Suspect ruptured S/G faulted inside containment, RCB emergency cooling is initiated.
01:14:00 RCP vibration continues increasing, RCP amperage decreasing on RCPs. Pumps with highest vibration (B loop) are stopped. This is also believed to be the loop with the ruptured/faulted S/G.
01:18:00 Chemistry analysis results received. RCS boron concentration is low due to Steam condensate dilution, and boron plate out.
01:27:00 The believed faulted/ruptured S/G "B" is isolated. Removing that portion of the Reactor heat sink, thus increasing the heat load on the "A" S/G.
01:37:00 Noted that "A" S/G level is off scale low. The S/G had been allowed to become dry, with all feedwater then being flashed to steam as soon as it contacted the tubes allowing RCS temperature to increase, increasing two phase RCS flow through the "A" loop RCPs, significantly increasing their vibration levels. Aux feedwater flow rate increased to "A" S/G, but recovery is not instant.
01:40:00 The Shift Supervisor returns to the Control Room
01:41:00 "A" loop RCPs secured due to high vibration. This action removes all forced cooling, core water is boiling off. Because with large steam voids now forming in the RCS loops Natural Circulation cooling not possible. Reflux cooling is the only cooling.
01:42:00 Neutron count rate goes up by a factor of 100 due to decreased shielding (lowering water level) of the Ex-Core detectors. This was not an actual reactivity increase. Emergency boration started to prevent re-start. They were not in a restart condition.
01:50:00 The water level drops below the top of the fuel in the core. Upper portions of fuel rods reached temperatures of about 1500 °F, weakening metal and increasing internal rod pressure. The upper portions of the rods balloon and then burst.
01:52:00 Although not observed or calculated, "A" loop hot leg temperature corresponds to 47 degrees superheat, will soon run out of range at a temperature corresponding to 109 degrees superheat. The incore thermocouples are maxed out at 700 °F. Operators believe everything is OK because cold leg temperature is off scale low & average coolant temperature indicates a constant 570 degrees. (570 is the average between off scale high & off scale low) They do not recognize that they have NO natural circulation flow.
02:00:00 The oncoming watch team comes in to relieve the watch.
02:14:00 RCB air sample monitor rises and goes off scale high. Other RCB & Aux Building rad monitors do the same. Steam/water slurry carried fuel fragments and fission product gasses are being dumped from the overflowing PRT into the water pond on the containment floor. Some PRT water is flowing to the leaking vent header piping in the Mechanical Auxiliary Building (MAB) also. Some fuel hot spots are now above 3,800°F.
02:18:00 New operators in the Control Room recognize that the Pzr PORV is open. PORV Block valve is closed. SI Injection flow now increased, but unable to start and keep RCPs running. Operators conclude steam voids exist in loops and core, SI flow is not entering the core.
02:30:00 Cold refueling water storage tank (RWST) water (highly borated water) hits the fuel. The zircaloy-steam exothermic reaction has now heated up portions of the fuel to above 4800 °F. Zircaloy and fuel are melting.
02:56:00 MAB evacuated. 2 R/hr general area dose. Letdown sample line is 600R on contact. Sample bottle is 400R at 1 foot, 1000R on contact.
03:00:00 The steam bubble is blocking SI from effectively cooling the core so a RCP is started for a brief run (19 min) That will sweep out the steam bubble and allow us to get cold water on the core. This causes any remaining embrittled fuel in the top of the core to shatter, creating a void.
03:20:00 SI flow with an open PORV is started at 200 minutes covering the fuel within 10 minutes. But the water causes a crust of solidified ceramic material to be formed surrounding the molten fuel and isolating it from receiving any cooling.
03:24:00 General Emergency Declared by Station Manager (highest alert declaration)
03:44:00 The ceramic crust fails, releasing the molten material through the bottom part of the core, melting through the support assembly into the vessel bottom where it is quenched by the water prior to melting through.
04:00:00 Containment Rad Monitor indicates 200 R/hr
04:22:00 Ops determines core is still covered
04:40:00 Containment Rad Monitor now 1000 R/hr
05:00:00 Containment Rad Monitor now 6000 R/hr
05:15:00 Decision made to re-pressurize the RCS to collapse the steam bubbles. Containment pressure reaches 4.4 psig
06:10:00 High Control Room airborne radioactivity levels, Non essential personnel evacuated
06:17:00 CONTROL ROOM personnel don respirators. Light Core debris and fission products were flushed into RCB and Aux Building through overflows & vents. Multiple auto venting of the VCT to the leaking waste gas header also increased Aux building contamination.
07:00:00 10 Rem/hr in MAB
07:30:00 Lowered RCS pressure to allow Accumulators to inject water into the reactor.
09:00:00 Series of phone calls starts coming in from State of Pennsylvania first requesting, then demanding that that they stop steaming the SG PORVs.
09:15:00 Company VP orders S/G PORVs closed, securing the Natural Circulation reactor core heat sink. This condition will last for 4.75 hours. Zirc water/steam reaction increases Hydrogen above the allowed accident values. Without installed Hydrogen re-combiners the procedures require containment to be vented, but the governor said NO.
09:50:00 RCB pressure spike to 28 psig (the hydrogen is now gone due to recombination)
10:28:00 With now working Pzr heaters, the Pzr reaches saturation, starts pushing water out of hot legs, at first CR personnel do not understand why.
11:10:00 CR operators remove respirators
11:34:00 North Gate at 30 mr/hr
12:45:00 Babcock &Wilcox (reactor designer) trying to get information/advice to Control Room so they will start to establish Subcooling
13:04:00 With subcooling established, RCB & RCDT pressures start long term trend down
14:00:00 Control Room allowed to reopen S/G PORVs
14:35:00 Direct link between Control Room and Babcock &Wilcox is established.
15:50:00 A RCP is successfully restarted & kept running, providing a heat removal path using the Steam Generators (with PORVs) as the decay heat sink
16:00:00 The plant is at last placed in a stable condition
Plant equipment and systems were operated in degraded conditions for extended periods without analysis of the effect these conditions would have in the event of a casualty.
Plant parameter indications, such as levels, temperatures, and other meter readings, were discounted and considered to be faulty without determining by independent verification that the indications were indeed incorrect. As a result, symptoms of existing plant conditions were misinterpreted, and proper corrective actions were not taken.
Event-based, emergency operating and related training procedures were inadequate for the task of analyzing and reconciling seemingly conflicting plant parameters. In addition, adherence to procedures was week. Failure to utilize proper procedures placed the plant in unanalyzed conditions.
Training and qualification of operators was inadequate. Fundamental misunderstandings of plant behavior, especially the thermodynamic properties of steam and water prevented the proper analysis of reactor coolant system conditions. In addition, major efforts were expended to restore non-vital plant equipment instead of focusing on the unexplained conditions in the reactor coolant system.
Finally, lessons learned from previous similar events were not effectively transmitted throughout the industry.
There was also an inadequacy of design to support safe operation during transients. Many mandated industry design changes resulted, such as:
– Valve Position Indication switches
– Qualified Data Processing System & related data indication systems to calculate subcooled and accident conditions in real-time
– Reactor Vessel Water Level systems were invented and implemented
– Hydrogen Recombiners were installed in all reactor compartments.
– Control Room design and manning requirements were changed.
– An emergency bypass valve is required for all condensate polisher systems.
– An automatic reactor trip on turbine load rejection greater than 50% is the norm.
– Safety Injection pumps are low enough pressure head such that they cannot overpressurize the system.
– Human Engineering requirements
A new, worldwide regulatory body called INPO (International Nuclear Power Organization), made up of peers from all over the world was created.
INPO evaluation teams travel to nuclear electric generating facilities to observe operations, analyze processes, shadow personnel, and ask a lot of questions.
With an intense focus on safety and reliability, the evaluation teams assess the:
• Knowledge and performance of plant personnel
• Condition of systems and equipment
• Quality of programs and procedures
• Effectiveness of plant management
Additionally, INPO conducts corporate evaluations that are also focused on safety and reliability.
Training and Accreditation
The National Academy for Nuclear Training provides training and support for nuclear power professionals.
Nuclear professionals from across the United States – and throughout the world – attend training at the INPO facility in Atlanta and take the various online courses offered by INPO.
In addition, they evaluate individual plant and utility training programs to identify strengths and weaknesses and recommend improvements. Selected operator and technical training programs are accredited through the independent National Nuclear Accrediting Board.
Events Analysis and Information Exchange
INPO assists in reviewing any significant events at nuclear electric generating plants.
Through INPO information exchange and publications, they communicate lessons learned and best practices throughout the nuclear power industry.
Assistance
At the request of individual nuclear electric generating facilities, INPO provides assistance with specific technical or management issues in areas related to plant operation and support.