The Initiating Event
On March 27, 1979, Three Mile Island unit 2 was operating normally and under fully automatic control. As the overnight shift took over at 11 PM, the plant was on the grid and generating power at 97% of its rated 1,000 MegaWatt capacity. Operators Craig Faust and Ed Frederick, under the supervision of shift supervisor Bill Zewe, settled in for a long night in the control room. Faust and Frederick, like Zewe, were former Navy reactor operators who had decided to make nuclear power their careers in civilian life as well. All were licensed, experienced men, and all had scored well above average on the tests that culminated their training.
The remainder of Zewe's 16-man crew, who were trained but unlicensed "auxiliary" operators, dispersed to various locations throughout the plant to perform regular maintenance duties. These men do the hard work in a nuclear power plant -- maintaining valves, pumps, and other machinery on a hands-on level.
As the hour of 4:00 AM approached, two such men were becoming quite frustrated. In the bowels of the plant, the men were working on a feedwater polisher. Sometimes called ion-exchange tanks or demineralizers, these large tanks are filled with resin beads which remove contaminants from the feedwater. This tank, one of eight, had been isolated from the rest of the feedwater system so that its spent beads could be flushed out and replaced. Pains were taken to see that feedwater continued to flow through the other tanks unimpeded, and it was hoped that this operation could be completed quickly. However, as the technicians began to wash out the old beads, the beads formed a "clot", and became stuck. Several attempts to dislodge the beads with water, air, and steam had failed.
A tank clogged with beads was not an unusual occurrence at TMI. In fact, it happened so often that compressed air lines from the plant's general-purpose air system had been installed on each scrubber. The beads could be usually be dislodged with quick bursts of air from these lines, and this among other things is what the technicians were trying. The job was taking forever, and there was a schedule to keep; concerned about the delay, Zewe dispatched shift foreman Fred Scheimann to lend a hand.
In addition to the general-purpose air system, TMI-2 had another compressed air supply. This one, called the instrument air system, was used to control pneumatically operated valves and controls in the plant, and was critical to safety. Unknown to the operators on duty, sometime during the night, someone had connected a rubber air hose between this instrument air system and a water line. Perhaps he was trying to pressurize the water line, perhaps he was trying to connect the two air systems together. The instrument air, general purpose air, and plant water systems all used the same, familiar Chicago Pneumatic fittings, the area was nearly dark, and the fittings were not labeled well. The water line carried more pressure than the instrument air system, so the water began to work its way into the air lines.
At 3:57 AM, as Scheimann stood atop an 18" feedwater pipe peering through a sight glass at the beads in the tank, the leaking water finally reached the valve control piping. Swept along by air pressure, it raced through the air lines, finally entering valve controls.
Ironically, soon after the plant was put online, years ago, someone became concerned about what would happen if water got into the instrument air system. It would almost certainly cause valves to close. A plan was devised to modify the valve control system, so that the valves would fail "as is", in their current positions, should the air supply fail. No one knows why, but the wiring for this modification was never connected.
Instantly, nearly every valve in the feedwater system slammed shut. Water hammer occurred, precipitated by the sudden stoppage of the feedwater flow. Faust and Frederick felt the control room floor shudder as the violent shock tore out valve controls, ruptured the casing of a feedwater pump, and shattered pipes. Scheimann jumped clear just as the pipe on which he was standing heaved violently, lifting completely out of its mounts. Another operator, on his way to the control room, wisely chose a different route as another feedwater pipe jumped three feet into the air within inches of him. Within seconds, the entire auxiliary building was filled with water vapor, and awash in scalding water. Unit 2 had just gone out of business.
Turbine Trip, Reactor Trip
In the control room, the plant's automatic control systems began to function as designed. With the feedwater system blocked and the valve controls out of commission, no water could reach the steam generators. They would boil dry in seconds. This can never be allowed to happen, because the excessive thermal stress could cause the tubes to crack, releasing primary water into the secondary system.
To forestall this, automatic systems sprang into action. First, the turbine was tripped, or shut down. Generally, this sort of trip causes bypass valves to open, dumping steam from the steam generator directly to the condenser, bypassing the turbine.
TMI-2's condenser had a small design flaw. The steam line coming from the bypass valves was aimed in such a way that if a sudden burst of steam came through, it would blow water from the condenser into the condenser vacuum pump. This is exactly what happened, and the vacuum pump, choking on water, tripped off. When the condenser lost vacuum, it could no longer accept steam, so the bypass system tripped.
With the condenser out of action, tons of live steam still needed a place to go, so a set of outdoor nozzles called atmospheric dumps opened, sending the steam into the air with a deafening roar heard miles away. Residents of nearby Middletown and Royalton were awakened by this first outward sign of trouble on the island.
The loss of feedwater meant that the reactor's heat had nowhere to go, so temperature and pressure started to climb. Sensing this, the control system tripped the reactor; within a few seconds, all control rods were fully inserted. "Unit Two, Turbine trip, reactor trip," announced Zewe, making an announcement required by the emergency procedures, over a public address system heard throughout the plant.
A reactor core doesn't cool down instantly when the rods are driven in. In fact, the residual "decay heat" of a shut-down core can account for a few MegaWatts of thermal power. The OTSG's were still threatening to boil dry for lack of feedwater. So, three emergency feedwater pumps, two electric and one steam-operated for redundancy, were automatically started to provide feedwater to the rapidly emptying steam generators.
A week earlier, during a maintenance procedure, operators closed block valves (known as EFW-12 A and B) that blocked the flow of water from these emergency feedwater pumps. They were never re-opened, as they're required to be during plant operation, and none of the operators knew they were closed. An indicator light for one of the valves was covered by a yellow paper maintenance tag attached to a nearby switch, and operators simply didn't look at the others, never expecting them to be closed because they were always open during operation.
The result of this is that the pumps, running at full speed, could deliver no feedwater at all. As the operators began their checklist, the first item was "Verify emergency feed". Faust didn't see the valve indicator lights, and assumed the valves were open as they were required to be, and always had been before.
As heat built up within the primary system, pressure within the system began to rise. This is expected during a quick shutdown, and within seconds, an automatic relief valve on top of the pressurizer opened to relieve the pressure. Steam from the pressurizer was vented into the quench tank inside the containment building. The valve was designed to close after venting a certain amount of pressure, but was unreliable. In fact, the Electromatic Relief Valve manufactured by Dresser Industries had a history of failures to close. It was rated for a lifetime of only 40 actuations, and this was thought to be adequate because the valve rarely opened. (The same valve on TMI unit 1 had never opened, except during testing; the design flaw in unit 2's condenser caused this one to open on every turbine trip.) The valve didn't close this night, even though a poorly-designed indicator led operators to believe that it had. The light, which one operator described as perhaps the brightest light on the entire panel, indicated only what the valve had been commanded to do, not what it was actually doing. It remained dark, because the valve was commanded to close.
As the decay heat in the reactor began to fall off, the reactor coolant began to cool and shrink, and the pressurizer water level began to fall. This too was expected, and Faust and Frederick watched as the plant safety systems started two sets of pumps to add additional coolant to make up for the shrinkage. First the makeup system was started. Then, when the level continued to fall, the special pumps of the high-pressure injection system were started to pour even more coolant into the reactor vessel.
To everyone's relief, the water level began to level off. Then, to everyone's horror, it started upward again -- with a vengeance. Fearing that the system-cushioning effect of the pressurizer would soon be lost as it went "solid" (full), Faust shut down the high- pressure injection system. The level continued to rise. He shut down the makeup pumps. Still it rose. Frederick watched, sweated bullets, and called off the water level numbers as the water rose in the pressurizer until it nearly spilled out through the relief valve.
Faust, Frederick, and Zewe scratched their heads and tried valiantly to grasp the nature of their problems. Nothing made sense. Water levels continued to fall in the steam generators. In fact, one had boiled completely dry, an extremely dangerous condition because the steam generators were never designed to reach such temperatures. If a tube in the steam generator were to overheat and crack or rupture, radioactive primary coolant could mix with secondary coolant and leave the containment building, with disastrous results. There was still considerable confusion as to why the OTSG's were boiling dry to begin with, since as far as the operators knew, the emergency feedwater pumps were supplying plenty of water to these boilers. With the outlet valves closed, though, the pumps were useless.
The quantity of cooling water available in the primary loop was usually measured by checking the water level in the pressurizer. More water meant that the steam bubble would shrink and the water level would rise in the tank. However, because the stuck relief valve was venting steam constantly from the pressurizer steam bubble, the operators saw a rise in water level even though water was actually being lost extremely quickly. Although this water level indication was completely erroneous, the operators were fooled by it because they still weren't aware of the stuck relief valve. Operators are trained to trust their instruments, and these men trusted them and were led dangerously astray.
Primary loop temperature continued to soar despite the fact that the reactor had been tripped. This was a result of the lack of any supply of emergency feedwater to the steam generators to remove decay heat from the primary coolant.
Pressure, on the other hand, was dropping in the primary loop, as Zewe described it, "like a loose toolbox." Since temperature and pressure generally tend in the same direction in a closed system, the three were at a loss to explain this apparent paradox. Of course, had they known about the errantly open relief valve, they'd have known that they weren't dealing with a closed system at all.
One thing was certain. If pressure fell low enough, or temperature rose high enough, the water in the primary loop would begin to boil. If that happened, and if temperature rose high enough in the reactor core, steam would begin to form in the reactor vessel. If enough steam was produced, it would push the water level in the reactor vessel down below the level of the fuel pins, uncovering them. Steam doesn't cool as effectively as water does, and the fuel pins would be severely damaged by the heat buildup. They would soon burst. Prolonged exposure of the core would mean that the fuel could melt, catch fire, or possibly become arranged more compactly so as to produce even more heat. The result would be disastrous. The core must never be uncovered.
Too much water in the primary loop would also be a problem. If the pressurizer, the one steam bubble allowed in the primary system, should fill completely, any sudden shock or transient could rupture primary coolant pipes or damage the coolant pumps. This is to be avoided, for a ruptured primary coolant pipe is the reactor engineer's worst nightmare! Operators are told repeatedly to never, NEVER "take the system solid." Now, on the verge of that very action, the fear in the room was tangible.
Fooled by the incorrect water level indication, operators decided to open letdown valves and start pumps to remove water from the system. Now there were TWO ways for coolant to leave the reactor; the open relief valve, and the letdown system. Reacting to the loss of pressure, the low-pressure injection pumps automatically began pouring coolant into the primary loop. Operators, ignorant of the true situation, shut them down. As coolant poured out of the reactor through the stuck relief valve, they had just overridden the only systems capable of replenishing that lost coolant -- and were removing even more!
Finally, completely frustrated, Faust ran through the emergency feedwater checklist again. Checking each valve in the system this time, he finally moved the paper tag and saw the red lights, indicating that emergency feedwater valves 12A and 12B were closed, blocking the flow.
"THE TWELVES ARE CLOSED!", he screamed across the room to Zewe. Frederick said later that Faust nearly ripped the controls out of the panel as he yanked them open. Over containment building noise monitors, the twanging and snapping of tortured metal were heard as the cold water rushed into the superheated steam-generator tubes. At last, there was a sink for all of the heat being generated by the core. The water level in the pressurizer slowly leveled off, and the temperature rise slowed -- but didn't stop.
The stuck relief valve still went unnoticed. Although the water level in the primary system was now under control, pressure was dangerously low. Soon, the pressure and temperature conspired to cross the magic line on the engineer's steam table, and the coolant began to boil. Steam bubbles flowed through the loop and reached the main coolant pumps. The immense machines, as large as a cement truck and twenty times as powerful, began to vibrate dangerously, and their motors strained as they struggled to pump the frothy mixture of steam and water. Flowrate dropped, temperature increased, and things began to look very bad. Vibration like this could blow the seals on the pump rotors, spilling primary coolant and rendering the pumps unusable.
Knowing that he had no choice, Zewe ordered the pumps shut down before they destroyed themselves and the pipes to which they connected. Now only natural convective circulation remained to move water through the core. What the operators didn't know is that because of the boiling, parts of the primary loop were now blocked by steam, so that water could not circulate by convection alone. A huge steam bubble, or "void", developed in the upper part of the reactor vessel, and grew quickly. Soon, the upper part of the reactor core was uncovered and beginning to overheat.
A frustrating series of human errors followed, complicating the operators' attempts to diagnose the problems with the plant. Zewe, in a sudden burst of insight, suspected that the relief valve might actually be stuck open. He asked a technician for a temperature reading at the valve outlet. A high reading would indicate that the valve was venting steam, but the technician mistakenly read him the temperature of another valve outlet instead -- which was low and normal.
Meanwhile, steam flowing at over a thousand pounds per minute finally overflowed the quench tank to which it was routed, and ruptured the safety disk. Soon, the containment building was flooded with radioactive water, some of which made its way through floor drains to sumps elsewhere in the plant. Frederick thought of checking the tank level (on an instrument behind the main panels and out of sight), but only after the rupture, and by that time the tank had drained through its safety disk and its level was normal. Radiation alarms began to sound, and containment building pressure began to rise.
Fresh eyes can sometimes see things that others are looking too hard to see. Around 6:00 AM, the day shift staff started to arrive. The day shift engineer, a man named Ivan Porter, looked around, saw that primary pressure was low and containment pressure was high, and made the connection. He suggested closing a block valve in the steam line, immediately past the stuck PORV. As soon as the switch was thrown, RC pressure began to rise again.
Just as Ivan Porter arrived in the control room, water from the containment building, now contaminated with radioactive fission products, made its appearance in the plant's auxiliary building via the floor drains. Radiation monitors' needles pinned at the upper end of their scales, and Porter later said that when the entire radiation monitoring panel lit up simultaneously in alarm, it was the closest thing he could imagine to having a heart attack.
Workers hastily vacated the building and sealed it. Radiation alarms went off all over the plant. A site emergency was declared, and an evacuation of nearby areas of Pennsylvania began. Most thought it was just another drill.
The first thought on the minds of the operators and plant staff at this point was to determine the status of the core. It's impossible to see the inside of a reactor vessel, and no water level measuring instruments were provided because core exposure was thought to be an "incredible" scenario. It is doubtful that a water level instrument could survive the strong radiation and high temperatures in the reactor vessel anyway.
Knowing the temperature in the core might be useful, though. There were several computer-monitored temperature instruments in the core, but the computer had only been calibrated to read temperatures below 700 degrees. Above this, the computer would only print question marks. The software designers quite understandably never expected a temperature higher than this to ever develop.
To circumvent the computer, whose printer was hours behind by now anyway due to the thousands of alarms that had been registered, a plan was developed. A crew was dispatched to the cable fanout room beneath the control room, and Porter used a multimeter to read the thermocouples directly. The readings he saw corresponded to temperatures of some 10,000 degrees on several core thermocouples. The technicians simply could not believe their eyes. Porter himself nearly dismissed the readings as defective thermocouples, but then noticed a gradient -- temperatures near the center were higher than those at the edge. Drenched in sweat, Porter at that moment knew, as few others could, the gravity of the situation. The core was severely damaged.
One man braved the high radiation levels in the monitoring lab to obtain a primary cooling water sample. Wearing a heavily shielded suit and working with tongs, he drew a small sample of water from a tap connected to the primary loop, and jumped back in horror. The water was frothy, fizzing like a carbonated soda, and darkly colored with radioactive contaminants. He retreated, hastily. It was at this point that all concerned finally grasped the true gravity of their situation. This plant wasn't going back online in a week, or a year. It was going to be lucky to make it through the day!
Narrative Part 4: Hydrogen
The presence of hydrogen in reactor coolant is not unusual. A small amount of hydrogen, in fact, is added to the cooling water intentionally. This hydrogen causes no problems, and is there to combine with any excess oxygen that might form in the system, thus to inhibit oxidation of the metal components.
When Zirconium, the metal used in the fuel rod cladding, is exposed to high heat in the presence of steam, a chemical reaction known as hydration takes place. This reaction destroys the metal and releases hydrogen gas. For hours, this additional hydrogen had been collecting in the reactor vessel, mixed into the steam bubble lurking just under the vessel's head seals. The gas was also present in large quantities in the containment building atmosphere; it came fizzing out of solution as the primary water spilled onto the containment floor.
The first warning of the presence of hydrogen in the system was quite violent, but thanks to the heavily overengineered containment structure, it was almost anticlimactic save for its implications. A poorly shielded relay sparked, detonating the hydrogen in the containment. The instrument measuring containment pressure zoomed to a frightening 28 pounds per square inch before starting down again. Later analysis showed that this instrument's response was quite slow, and the real peak pressure was probably closer to 80 PSI! The force shook the control room floor noticeably, and energy released was thought to be equivalent to the explosion of several modern 1,000 pound bombs. Despite the violence of the explosion, permanently installed strain gauges in the containment structure showed that it caused no undue stress.
While there was no significant damage from this detonation, quaintly termed a "bump", it was an ominous sign. While a steam bubble could be collapsed with little more than changes in pressure or temperature, a hydrogen bubble was there to stay until it was either vented or removed chemically. Hydrogen, the least massive of all gases, had even less potential for cooling the core than the steam bubble itself. Operators, still confused, thought initially that the shock they felt was a ventilation damper closing, and only during later analysis did the true cause become known.
Of course, hydrogen can't burn without oxygen, and since it was fairly certain that only steam and hydrogen comprised the bubble, there was little concern about a hydrogen explosion inside the reactor vessel. No one even wanted to consider the possibility, in fact. The chances of the reactor vessel and primary loop piping surviving that kind of shock ranged from slim to none.
Ironically, it was an engineer-turned-bureaucrat named Joseph Hendrie who raised the issue. As chairman of the NRC, Hendrie was getting disturbing information from his man on-site, Harold Denton. Half the core uncovered. Large amounts of hydrogen, and an eight-second, 28 PSI pressure spike in the containment that sounded an awful lot like a hydrogen burn. Gamma and neutron flux higher than anything ever seen before except in nuclear weapons tests. Hendrie knew that sufficient amounts of radiation could cause a little-known phenomenon called radiolysis. This would break the chemical bonds that held water together, putting oxygen and even more hydrogen into the system -- and gas samples at the auxiliary building vent header indeed had begun to show higher and higher levels of oxygen.
Calculations seemed to indicate that a 5% partial pressure of oxygen in the hydrogen bubble would be the flammability threshold. At or above that level, any source of ignition inside the vessel would cause the mixture to explode. At 11% partial pressure, with the temperatures involved, the mixture would self-ignite, needing no additional source of ignition at all.
On March 30 (day three of the accident), Hendrie presented his case at a White House briefing, stressing the need for immediate action. Fortunately, he wasn't ignored. The NRC formed a special unit known as the "Bubble Squad", who managed to repair, reconfigure, and press into service one of the hydrogen recombiners in the auxiliary building. It took 150,000 pounds of lead brick, flown in for the purpose, just to satisfactorily shield the machine.
Meanwhile, efforts to re-cover the core with water and restore normal core cooling continued in earnest. Pressure was dumped in order to allow low-pressure pumps to deliver additional coolant, then the system was repressurized yet again. Results were mixed, but generally positive.
It was vitally important to get at least one of the huge main coolant pumps restarted, to aid cooling of the reactor core. Predictably, this wasn't going to be easy. An oil-lift pump used to lubricate the bearings of the gigantic motor ... wouldn't start. An operator was dispatched to repair it. Safety systems, noting the unusual conditions surrounding the steam bubble in the reactor vessel, refused to allow the pump to start. With some difficulty, these were bypassed. Finally, fifteen hours after the onset of the accident, the pump was cautiously tested, then started and allowed to run. The reactor was once again being cooled.
Over the next several days, the recombiner along with other chemical and physical processes were used to remove the steam and hydrogen from the reactor. The simplest and most dangerous method of removing this gas was to vent it into the atmosphere. Engineers knew this would be dangerous to the public. After all, there was no way to release the hydrogen without releasing other, radioactive gases with it. They were forced, however, to weigh this danger against the danger of a hydrogen explosion in the reactor vessel, which would most likely cause the release of radioactive water, steam, and deadly fission products on a much larger, and totally uncontrolled basis. Some gas was released, and carefully monitored.
When the bubble was finally collapsed and something resembling a normal coolant flow was restored, engineers took stock of the situation. Present-day thinking backs up their belief that the reactor vessel bubble contained at least 5% oxygen for at least 24 hours.
The story was far from over, however. Thousands of Curies of radioactive noble gases had been released into the air at various points during the accident, and these releases would have to be accounted for. Radioactive water had been released into the Susquehanna river to prevent the reactor building sumps from overflowing, and this too had to be tracked and monitored. Every single one of the 36,000 fuel rods in the reactor had ruptured, releasing radioactive gases and fission products into the coolant. More than seventy percent of the core had been out of the water for as much as two hours. The core was a mass of rubble, and parts of it had reached temperatures approaching 4,300 degrees. Uranium oxide fuel melts to a liquid state at 5,000 degrees.
The last major venting of noble gases from unit 2 occurred in 1981, and cleanup efforts have progressed well since then. All of the contaminated water has been cleaned up and evaporated, and all but a few kilograms of fuel has been removed. While radiation inside the containment is still above normal, manned entries have been made into the area, and radiation levels on the refueling floor were low enough to permit several hours of exposure without significant danger to personnel. The plant is in what is known as a "safe storage" condition, and will not be decommissioned completely until 2005, to allow the utility to decommission both units at once.
TMI Unit 1, which had just been refueled at the time of the accident and was preparing to go back online, had its license pulled a short time after the accident. The Nuclear Regulatory Commission was in a state of panic; TMI-1 had the best operating record in the industry at the time of the accident. Unit 1 stayed down for nearly 5 years. Part of this was due to modifications required by new NRC regulations, and part of it was politics. The plant has now resumed operation.