Turbine Trip, Reactor Trip

In the control room, the plant's automatic control systems began to function as designed. With the feedwater system blocked and the valve controls out of commission, no water could reach the steam generators. They would boil dry in seconds. This can never be allowed to happen, because the excessive thermal stress could cause the tubes to crack, releasing primary water into the secondary system.

To forestall this, automatic systems sprang into action. First, the turbine was tripped, or shut down. Generally, this sort of trip causes bypass valves to open, dumping steam from the steam generator directly to the condenser, bypassing the turbine.

TMI-2's condenser had a small design flaw. The steam line coming from the bypass valves was aimed in such a way that if a sudden burst of steam came through, it would blow water from the condenser into the condenser vacuum pump. This is exactly what happened, and the vacuum pump, choking on water, tripped off. When the condenser lost vacuum, it could no longer accept steam, so the bypass system tripped.

With the condenser out of action, tons of live steam still needed a place to go, so a set of outdoor nozzles called atmospheric dumps opened, sending the steam into the air with a deafening roar heard miles away. Residents of nearby Middletown and Royalton were awakened by this first outward sign of trouble on the island.

The loss of feedwater meant that the reactor's heat had nowhere to go, so temperature and pressure started to climb. Sensing this, the control system tripped the reactor; within a few seconds, all control rods were fully inserted. "Unit Two, Turbine trip, reactor trip," announced Zewe, making an announcement required by the emergency procedures, over a public address system heard throughout the plant.

A reactor core doesn't cool down instantly when the rods are driven in. In fact, the residual "decay heat" of a shut-down core can account for a few MegaWatts of thermal power. The OTSG's were still threatening to boil dry for lack of feedwater. So, three emergency feedwater pumps, two electric and one steam-operated for redundancy, were automatically started to provide feedwater to the rapidly emptying steam generators.

A week earlier, during a maintenance procedure, operators closed block valves (known as EFW-12 A and B) that blocked the flow of water from these emergency feedwater pumps. They were never re-opened, as they're required to be during plant operation, and none of the operators knew they were closed. An indicator light for one of the valves was covered by a yellow paper maintenance tag attached to a nearby switch, and operators simply didn't look at the others, never expecting them to be closed because they were always open during operation.

The result of this is that the pumps, running at full speed, could deliver no feedwater at all. As the operators began their checklist, the first item was "Verify emergency feed". Faust didn't see the valve indicator lights, and assumed the valves were open as they were required to be, and always had been before.

As heat built up within the primary system, pressure within the system began to rise. This is expected during a quick shutdown, and within seconds, an automatic relief valve on top of the pressurizer opened to relieve the pressure. Steam from the pressurizer was vented into the quench tank inside the containment building. The valve was designed to close after venting a certain amount of pressure, but was unreliable. In fact, the Electromatic Relief Valve manufactured by Dresser Industries had a history of failures to close. It was rated for a lifetime of only 40 actuations, and this was thought to be adequate because the valve rarely opened. (The same valve on TMI unit 1 had never opened, except during testing; the design flaw in unit 2's condenser caused this one to open on every turbine trip.) The valve didn't close this night, even though a poorly-designed indicator led operators to believe that it had. The light, which one operator described as perhaps the brightest light on the entire panel, indicated only what the valve had been commanded to do, not what it was actually doing. It remained dark, because the valve was commanded to close.

As the decay heat in the reactor began to fall off, the reactor coolant began to cool and shrink, and the pressurizer water level began to fall. This too was expected, and Faust and Frederick watched as the plant safety systems started two sets of pumps to add additional coolant to make up for the shrinkage. First the makeup system was started. Then, when the level continued to fall, the special pumps of the high-pressure injection system were started to pour even more coolant into the reactor vessel.

To everyone's relief, the water level began to level off. Then, to everyone's horror, it started upward again -- with a vengeance. Fearing that the system-cushioning effect of the pressurizer would soon be lost as it went "solid" (full), Faust shut down the high- pressure injection system. The level continued to rise. He shut down the makeup pumps. Still it rose. Frederick watched, sweated bullets, and called off the water level numbers as the water rose in the pressurizer until it nearly spilled out through the relief valve.

Faust, Frederick, and Zewe scratched their heads and tried valiantly to grasp the nature of their problems. Nothing made sense. Water levels continued to fall in the steam generators. In fact, one had boiled completely dry, an extremely dangerous condition because the steam generators were never designed to reach such temperatures. If a tube in the steam generator were to overheat and crack or rupture, radioactive primary coolant could mix with secondary coolant and leave the containment building, with disastrous results. There was still considerable confusion as to why the OTSG's were boiling dry to begin with, since as far as the operators knew, the emergency feedwater pumps were supplying plenty of water to these boilers. With the outlet valves closed, though, the pumps were useless.

The quantity of cooling water available in the primary loop was usually measured by checking the water level in the pressurizer. More water meant that the steam bubble would shrink and the water level would rise in the tank. However, because the stuck relief valve was venting steam constantly from the pressurizer steam bubble, the operators saw a rise in water level even though water was actually being lost extremely quickly. Although this water level indication was completely erroneous, the operators were fooled by it because they still weren't aware of the stuck relief valve. Operators are trained to trust their instruments, and these men trusted them and were led dangerously astray.

Primary loop temperature continued to soar despite the fact that the reactor had been tripped. This was a result of the lack of any supply of emergency feedwater to the steam generators to remove decay heat from the primary coolant.

Pressure, on the other hand, was dropping in the primary loop, as Zewe described it, "like a loose toolbox." Since temperature and pressure generally tend in the same direction in a closed system, the three were at a loss to explain this apparent paradox. Of course, had they known about the errantly open relief valve, they'd have known that they weren't dealing with a closed system at all.

One thing was certain. If pressure fell low enough, or temperature rose high enough, the water in the primary loop would begin to boil. If that happened, and if temperature rose high enough in the reactor core, steam would begin to form in the reactor vessel. If enough steam was produced, it would push the water level in the reactor vessel down below the level of the fuel pins, uncovering them. Steam doesn't cool as effectively as water does, and the fuel pins would be severely damaged by the heat buildup. They would soon burst. Prolonged exposure of the core would mean that the fuel could melt, catch fire, or possibly become arranged more compactly so as to produce even more heat. The result would be disastrous. The core must never be uncovered.

Too much water in the primary loop would also be a problem. If the pressurizer, the one steam bubble allowed in the primary system, should fill completely, any sudden shock or transient could rupture primary coolant pipes or damage the coolant pumps. This is to be avoided, for a ruptured primary coolant pipe is the reactor engineer's worst nightmare! Operators are told repeatedly to never, NEVER "take the system solid." Now, on the verge of that very action, the fear in the room was tangible.

Fooled by the incorrect water level indication, operators decided to open letdown valves and start pumps to remove water from the system. Now there were TWO ways for coolant to leave the reactor; the open relief valve, and the letdown system. Reacting to the loss of pressure, the low-pressure injection pumps automatically began pouring coolant into the primary loop. Operators, ignorant of the true situation, shut them down. As coolant poured out of the reactor through the stuck relief valve, they had just overridden the only systems capable of replenishing that lost coolant -- and were removing even more!

Finally, completely frustrated, Faust ran through the emergency feedwater checklist again. Checking each valve in the system this time, he finally moved the paper tag and saw the red lights, indicating that emergency feedwater valves 12A and 12B were closed, blocking the flow.

"THE TWELVES ARE CLOSED!", he screamed across the room to Zewe. Frederick said later that Faust nearly ripped the controls out of the panel as he yanked them open. Over containment building noise monitors, the twanging and snapping of tortured metal were heard as the cold water rushed into the superheated steam-generator tubes. At last, there was a sink for all of the heat being generated by the core. The water level in the pressurizer slowly leveled off, and the temperature rise slowed -- but didn't stop.