Human error is to blame*

THE 28 MARCH 1979 THREE MILE ISLAND (TMI) MELTDOWN

BYK. W. SUTTON (C40)21 AUG 2015

*Time magazine 13 Aug 1979, quoting the NRC.

Objectives Respond to a lecture

request. Learn about the key event in

the history of America’s nuclear industry.

Extract and apply lessons learned.

Extract and apply key lessons.

Outline Setting Reactor Theory Power Plant

operations TMI accident Health News Coverage Assessment Consequences Application

Background and Accident Only.

Location 1/2

Southeast of Pennsylvania’s state capital.

Location 2/2

In densely populated area and on regional water source.

Susquehanna River

This is TMI!

The TMI site.

Aerial view of Three Mile Island.

Bucolic location.

TMI is within a community.

Y’all B*tches

Pay attention now!

Fission fundamentals Neutron strikes a

material which can fission (U-235).

U-235 atom blows apart, yielding radioactive particles, daughter atoms, and energy (heat).

Released neutrons cause more fissions.

Chain reaction ensues. Billions of small

explosions result in lots of energy!

Neutron

Split an atom, release energy.

Decay Heat Atoms formed after

fission emit particles. This results in heat,

thus power, generation. The power drops

quickly with time, but not to zero; about 6% one minute after shutdown.

Decay heat means a nuclear reactor is never really “off”. It always must be cooled.

Heat and Power generated after shutdown.

Power Plant Configuration

Do NOT Panic!

Power Plant Overview

Three closed loops: Primary, Secondary, Circulating.

The reactor heats water, called primary water. Pumps force primary water into the Steam Generators

(S/G). The primary water gives heat to the water in the S/Gs,

then returns to the reactor. The secondary water in the S/G flashes to steam. Steam exits the S/G, goes to the turbine to make

electricity. As the steam leaves the turbine, it condenses to water

and this water is pumped back to the S/G. Circulating water is what condenses the steam leaving

the turbine; it flows to the cooling tower, gives off heat to the atmosphere, and returns to the condenser.

The Pressurizer maintains primary plant pressure and is used to determine water volume. No vessel level indicator!

Power Plant Configuration

That was EASY!

TMI-2 Data Rated for 2700 Mega-Watts (thermal) / 852 Mega-

Watts (electrical), enough power for ~150,000 homes.

Normal pressure and temperature: 2155 psi / ~600 F.

Total primary water volume about 100,000 gallons. Reactor Vessel: 40 feet tall, 8 inch thick steel walls Reactor Vessel surrounded by concrete and steel

shields up to 9 feet thick. All enclosed with a 193 foot tall containment

building with concrete walls 4 feet thick.

Massive, heavy construction.

Call it like it is

Clear, Shared, and Understood terminology helps!

Fuel – Pellet, Rod, Cell, Core

~100 Tons Uranium clad with Zirconium.

Core also had:• 52 instrument tubes• 69 control rods

• Fuel pellets 1” tall, ½ inch wide. Uranium oxide in a metal cylinder made of Zirconium; this metal sheath is called “cladding”.

• 38,816 fuel rods, each 12 feet tall• 208 rods per assembly, 177 assemblies

Casualty Control Principles Shutdown (SCRAM) Maintain flow Remove decay heat Keep the core covered Prevent going “Solid” Contain radiation Trust Instrumentation Operators must Follow Procedures, Think,

and Act DeliberatelyC3 – Control, Cool, and Contain!

Failure limits At about 2,200 F the Zirconium/Water

reaction occurs: Zr + 2 H2O → ZrO2 + 2 H2

Note: Highly Exothermic (releases energy), produces combustible Hydrogen gas, and causes Zirconium cladding to fail. Zirconium cladding melts around 3,000 F. Uranium fuel melts at about 5,200 F.

At high temps, metal barrier (cladding) around fuel fails.

Hydrogen Gas

Hydrogen + Oxygen + Heat = BOOM!

Whew, the hard part is done!

The Accident

Sequence Of Events – 1/8 At ~0400 on 28 March 1979, with TMI-2 at 97% power, a loss of feed

water to the S/Gs occurs.• Cause never determined; most likely due to earlier maintenance on a

condensate “polisher” (filter and ion exchanger).• Issues with the “polisher” were a known problem, never fully understood or

solved. +2 seconds: Electrical Turbines trip.

• No steam being drawn from the S/Gs, the reactor quickly began to heat. Decay Heat initially ~6% of former power.

+5-6 seconds: Pilot Operated Relief Valve (PORV) lifts. (P = 2,255#) +8 seconds: Reactor SCRAM. +13 seconds: Pressure drops to 2,205#. PORV does not shut. PORV is

stuck open. Indicator light shows PORV shut – input from solenoid, not actual valve position. Loss of Coolant Accident (LOCA) begins, not noted.

Rapid occurrences! LOCA!

Beware: PORV status vital

As long as PORV is open, problems will mount.

PORV focus PORV relieved about 300 gallons/minute. A PORV sticking open had occurred at similar power plants. Downstream was a temperature sensor. When above 130 F,

procedure directed shutting a “blocking valve”. Not done. The PORV was known to leak, so the temperature alarm was

often on, thus operators ignored it, considering it “normal”. Valve position indicator light triggered by power to a solenoid,

so not actual valve position. The PORV relieved to a tank whose level and temperature

rapidly increased, also not noted. Ultimately the PORV would be open for 2 hours and 22 minutes

before it was isolated, venting about 35,000 gallons.

PORV stuck open. NO ONE notices. Primary mechanical cause of the TMI accident.

Stuck open PORV indicators:

Drain pipe temperature high and rising. Drain tank temperature and pressure rising. Drain tank radiation levels rising. Containment building sump level rising. Containment building sump level alarm. Containment building radiation and temperature rising. Auxiliary building water level rising. Increasing neutron level from the core.

Training on accidents inadequate.

Sequence Of Events - 2 +13-14 seconds: Operators use makeup system to slowly

add water to the reactor. +14 seconds: Operator notes emergency feed pumps

running but fails to note their outlet valves are shut, so no water flowing into the S/Gs – no heat being removed.

+48 seconds: Reactor pressure falling, pressurizer level rising (these are leak indications!).

+1 minute: About 100 alarms have actuated. +1 minute 45 seconds: S/Gs boil dry. Heat no longer

being removed from the reactor. + 2 minutes: High Pressure Injection (HPI) pumps

automatically start, adding water to the reactor at 1000 gpm per pump.

Unrecognized LOCA. Control room confusion.

Plant Status: +2 minutes Shut down (via a SCRAM) No heat being removed

via the S/Gs Core getting hotter! Relief valve (PORV) stuck

open! Actual casualty, a Loss of

Coolant Accident (LOCA) unrecognized.

Water being added by High Pressure Injection pumps.

LOCA not recognized.

Sequence Of Events - 3 +2 minutes +/- : With HPI pumps on, pressurizer level rises. +4 minutes +/- : Operators secure one HPI pump and reduce

the other’s flow to 100 gpm to avoid filling the pressurizer solid.• NOTE: With HPI on, falling pressure and constant temperature

indicates a LOCA. The operators fail to recognize the LOCA.• Reducing HPI to almost zero was the operator action which

ultimately caused the reactor to melt. +5 minutes: Steam bubbles form in the core, expelling water

into the pressurizer (level rises). Core temperature increasing. + 8 minutes: Operators note that S/Gs are not receiving feed

water, open the shut valves, and restore feed. Not a critical event for reactor safety, but increased control room confusion.

Steam forming in the core. HPI almost zero.

TMI-2 Control Room

Large; difficult to monitor and operate.

Sequence Of Events - 4 +11 minutes: High level alarm for containment building

sump -- a clear indication of a leak or break in the system. Significance not noted.

+15 minutes: Drain tank rupture disk bursts. More water to the containment sump. Water automatically pumped to the auxiliary building. Result is spread of radiation/contamination.

+20 minutes: Neutron levels rising -- a clear indication of steam in the core. Significance not noted.

~+20 -25 minutes: Pressure and temperature inside the containment building rising – another unrecognized indication of a leak from the primary system. Operators turn on ventilation. This spreads contamination.

LOCA unrecognized. Radiation and Contamination.

Plant Status: +25 minutes LOCA continues. Steam forming in

core. Operators taking

action which result in spreading of radiation and contamination.

LOCA not recognized. Steam in the core.

Sequence Of Events - 5 +39 minutes: Operators secure containment building sump

pump. 8,000 gallons of radioactive water have been pumped to the auxiliary building. Water source not identified.

+60 minutes: Reactor Coolant Pumps (RCPs) begin to vibrate due to low system pressure and steam in the system. This indication of steam in the core was unrecognized.

+74 minutes: Operators secure 2 of 4 RCPs. +101 minutes: Operators secure remaining two RCPs. No

core flow now. Significant core damage soon results. +120 minutes (two hours): First indications of fuel cladding

ruptures. Ruptures release radioactive gases which trigger high radiation alarms in the containment building.

LOCA unrecognized. Flow Stopped. Core damage begins.

Sequence Of Events - 6 + ~120 minutes (two hours): Zirconium/water

reaction begins. Fuel rods begin to fail. Hydrogen released to containment building. Hydrogen bubble begins to form in core.• Later analysis determined at +135 minutes, the top of

the core was uncovered and serious core damage began.• Once core is uncovered, significant fuel melting occurs.• Melted fuel releases fission products.• The highly radioactive fission products exit the reactor via

the stuck open PORV and thence into the containment building, auxiliary building, and possibly environment.

Core badly damaged. Releases Increasing.

Core Damage

Damaged TMI fuel rods.

Core Damage – Close up

50% of the core melted; nothing through the vessel.

I’m Melting!Ultimately: • 50% of the core melted.• Cladding failed on 90% of the fuel

rods.• About 20 tons of Uranium flowed to

the bottom of the pressure vessel.

Plant Status: +2 Hours LOCA continues. Core melting. Spreading

radiation and contamination.

LOCA not recognized. Core Melting. Releases.

Sequence Of Events - 7 +144 minutes (2 hours and 22 minutes): In

response to a query from new shift personnel, operators shut the PORV blocking valve. The LOCA is stopped.

+4 hours: Containment building automatically isolates itself (due to high pressure). Releases stopped.

+4.5 hours: Operators turn on HPI. Two hours later (1030 a.m.) the core is fully covered.

LOCA stopped. Isolation complete. Core covered.

Sequence Of Events – 8 / 8

Subsequent actions focused on:• Regaining control of the reactor.• Containing radiation and contamination.• Managing hydrogen (small explosion

occurred at 1350 in the containment building; fear about Hydrogen in the core.).

• Assuaging the public’s fears and health.• Messaging.

Days to regain control. Still (2015) cleaning up TMI.

Health Effects

Must separate fact from fiction, and fear!

Hoped for Radiation Effects

Releases

Layered containment effective.

Health Effects – NRC report Many groups exhaustively studied the radiological

effects of the TMI releases.• The approximately 2 million people around TMI-2

during the accident are estimated to have received an average radiation dose of only about 1 mrem above the usual background dose. (Chest X-ray is 6 mrem).

No adverse effects from radiation on human, animal, and plant life in the TMI area have been directly correlated to the accident.

“Comprehensive investigations and assessments by several well respected organizations . . . have concluded that in spite of serious damage to the reactor, the actual release had negligible effects on the physical health of individuals or the environment.”

No verifiable deleterious health effects.

News Coverage At 0825, local radio broke

the TMI story. Picked up at 0906 by the Associated Press.

Throughout the crisis, messaging was inept. Vague, erroneous, and/or contradictory reports caused a hostile relationship between the Utility/NRC and reporters with resultant loss of public confidence.

Poor information flow caused a hostile press.

News Coverage

Scared Public.

Some Headlines worse than others.

Cooling tower becomes image of nuclear power.

Public Concern.

Presidential interest

President Carter visited the site on 1 April 1979.

AssessmentPeople and Environment Radiological

Barriers and Control

Defense-in-Depth

7 Chernobyl, 1986 – Widespread health and environmental effects. External release of a significant fraction of reactor core.

6 Kyshtym, Russia, 1957 – Significant release of radioactive material to the environment from explosion of a high activity waste tank.

5 Windscale Pile, UK, 1957 – Release of radioactive material to the environment following a fire in a reactor core.

TMI, US, 1979 – Severe damage to the core.

4 Tokaimura, Japan, 1999 – Fatal overexposure of workers following a criticality event.

Saint Laurent des Eaux, France, 1980 – Melting of one channel of fuel in the reactor with no release outside the site.

3 No example available. Sellafield, UK, 2005 – Release of large quantity of radioactive material, contained with the installation.

Vandellos, Spain, 1989 – Near accident caused by fire resulting in loss of safety systems at the nuclear power station.

2 Atucha, Argentia, 2005 – Overexposure of a worker above annual limit.

Cadarache, France, 1993 – Spread of contamination to an area not expected by design

Forsmark, Sweden, 2006 – Degraded safety functions for common cause failure in the emergency power supply system at a nuclear plant.

1 Breach of operating limits at a nuclear facility.

ChernobylFukushima

Three Mile Island

Compare: Chernobyl, 1986

Steam explosion and fire.

Note: The arrow marks a 1,000 ton lid blown off the reactor vessel.

Compare: Fukushima, 2011

Damage from Hydrogen explosions.

Frame of Reference

Could have been much worse!

Casualty Control Principles: How did the TMI operators do?

Shutdown (SCRAM) -- YES* Maintain flow -- NO Remove decay heat -- NO Keep the core covered -- NO Prevent going “Solid” – YES** Contain radiation -- NO Trust Instrumentation – NO Follow Procedures, Think, and Act Deliberately --

NO

Human error ultimate cause of core damage.

*SCRAM was an automatic protective event; no operator action.

**Excess focus on not going solid caused operators to omit most other casualty control actions.

Consequences - 1

Nuclear industry lost public’s trust.

President’s report: “Personnel error, design deficiencies, and component failures caused the accident, which permanently changed the nuclear industry. Public fear and distrust increased.”

Consequences - 2

No new US nuclear plants since the 1990s.

Consequences - 3

Fearful and Distrusting Public.

Changes since TMI Upgrading and strengthening of plant design and equipment. Identifying the critical role of human performance in plant safety

led to revamping operator training and staffing requirements,. Enhancing emergency preparedness. Publishing NRC findings and conclusions on plant performance. NRC regularly analyzes and inspects plants for compliance. Expanding performance and safety inspections, and ORM. Creating a separate enforcement staff within the NRC. Establishing a group to provide a unified industry approach. Installing equipment to mitigate accidents and monitor plant

status. Enacting programs for early identification of safety problems. Expanding NRC's sharing in the US and internationally.Improved safety and reliability since TMI.

ApplicationFollow ProceduresHone Human/Machine interfaceFocus on what is importantTry not to start anything at 0400Foster effective information flowDo not rely on only one indicationDo not accept abnormalitiesThink, assess, and act deliberately

Discipline in Thought and Action

Never stop Learning!

Questions or Comments?