The worst accident in the United States happened in March 1979 at the No. 2 re­actor at the Three Mile Island nuclear plant near Harrisburg, Pennsylvania. The plant consists of two Babcock & Wilcox pressurized-water reactors, each having an electrical capacity of 961 MW(e).

At about 4 a. m. on March 28, 1979, a condensate pump moving water from the condensers in the turbine building stopped. This led to tripping of the main steam generator feedwater pumps (which would otheiwise have been starved of water), which in turn led to the turbine’s being tripped. As we saw in Chap­ter 4, this is a normal upset condition, and the incident should have proceeded benignly according to the design. To see why this did not happen, it is helpful to examine each phase of the accident in turn.

Phase 1. Turbine Trip (^-6 nun). This phase is illustrated in Figure 5.1. The valves that allow steam to be dumped to the condenser opened as de­signed and the auxiliary feedwater pumps started. The interaction of the flow of feedwater to the steam generators caused a reduction in heat removal from the primary system. The reactor coolant system responded to the turbine trip in the expected manner. The reactor coolant pumps continued to operate and to

Figure 5.1: TMI-2 phasel: turbine trip.

maintain coolant flow through the core. The reactor coolant system pressure started to rise because the heat generated by the core—which was still operat­ing—was not being removed from the system at the required rate by the steam generators. This rise in system pressure caused the power-operated relief valve (PORV) on top of the pressurizer (1 in Figure 5.1) to operate to relieve the pres­sure. However, the opening of this valve was insufficient to reduce the pressure immediately, and the pressure continued to increase. The operation of the valve occurred between 3 and 6 s after the turbine trip, and the pressurization con­tinued until 8 s after the start of the incident, when the primary circuit pressure reached 162 bars. At this point the control rods were automatically driven into the core as a result of a protection system signal’s detecting the overpressuriza­tion. This immediately stopped the fission reaction. At this early stage all the au­tomatic protection features had operated as designed, and the reactor had been shut down. However, as we explained in previous chapters (and as indicated in Table 2.2), the decay heat remains significant. Under normal circumstances this can be dealt with straightforwardly by the various coolant systems.

At 13 s the now-decreasing coolant pressure reached the set point for auto­matic closure of the PORV. The valve failed to close, and this first departure from the expected response changed the incident from an upset into an emergency event, as defined in Chapter 4. The sequence that started at this stage was very similar to the small-break accident described in Section 4.3.4. Coolant circuit water was being lost through the stuck-open PORV. In the secondary circuit, all three auxiliary feedwater pumps were running, yet the water level in the steam generators was continuing to fall and they were drying out. The reason for this was that no water was actually being injected into the steam generators because of closed valves between the auxiliary pumps and the steam generators. The valves had been closed some time before the incident (probably at least 42 h earlier) for routine testing and had apparently been inadvertently left in that po­sition. The warning lights indicating the valve closure had been obscured by tags on the control board.

Thus, during this first crucial period, the reactor coolant circuit was deprived of an effective means of heat removal and could only dispose of the energy by blowing off water and steam. As we saw in Chapter 4, this was an inadequate heat removal method. One minute after the incident, the difference in tempera­ture between the hot and cold legs of the primary circuit was rapidly reaching zero, indicating that the steam generators were drying out. The reactor circuit pressure was also dropping. At about this time the liquid level in the pressurizer began to rise rapidly. At 2 min 4s the reactor circuit pressure had dropped to 110 bars, and the emergency core cooling system (ECCS) triggered automati­cally, feeding cold borated water into the primary coolant system. The liquid level in the pressurizer was continuing to rise. Concern was expressed that the HPIS was increasing the water inventory in the primary circuit and that the steam above the water level in the pressurizer would be lost, preventing effi­cient pressure control. In effect, the system would then be full of water. Subse­quent analysis has shown that, initially, expansion of the water as it heated up and, later, boiling in parts of the circuit displaced water into the pressurizer, causing the increase in pressurizer level. Because of their concern about the pressurizer level and their belief that the HPIS system was filling it, the opera­tors tripped (shut ofO one of the HPIS pumps at 4 min 38 s; the other pumps continued to be operated in a partly closed condition.

Phase 2: Loss of Coolant (6-20 ^min). At 6 min the pressurizer was com­pletely filled with water. The reactor drain tank (item 7 in Figure 5.2) started to pressurize rapidly, and at 7 43 s the reactor building sump pump switched on

to transfer water from the sump to the various wastewater tanks located in the auxiliary building. Thus, slightly radioactive water was being transferred out of the containment into the auxiliary building.

Figure 5.2: TMI-2 phase 2: loss of coolant.

In the Babcock & Wilcox TMI design, the automatic closure of valves linking the containment to the auxiliary building was not initiated unless the reactor building pressure exceeded 270 millibars. In reactors supplied by other ven­dors, control systems close off these connecting lines automatically when the ECCS system is actuated.

After 8 min the operators found that the steam generators were dry. Checks showed that the auxiliary feed pumps were running but that the valves were shut. The operator opened the valves, allowing feedwater to pass into the steam generators, and the reactor circuit water temperature started to drop as a result. “Hammering” and “crackling” were heard from the steam generators, confirming that the auxiliary feed pumps were now delivering water to them. The closed valves in the auxiliary feedwater circuit received a great deal of pub­licity immediately after the accident. It now seems likely that the unavailability of the auxiliary feedwater for the first 8 min of the accident did not, in the event, significantly affect the future course of the accident, which was largely determined by the stuck-open PORV

At 10 min 24 s, a second HPIS pump (item 6, Figure 5.2) tripped out, was restarted, but tripped out again, to be eventually restarted at 11 min 24 s, but in a throttled condition. The balance between the flow of water into the reactor from the HPIS and the flow out of the reactor from the PORV was such riu:

there was a net outflow from the primary cooling system. At about 11 min, the pressurizer level indication was back on scale and the level was decreasing. At 15 min, the reactor coolant drain tank bursting disk (item 7, Figure 5.2) ruptured and hot water flashed into the containment building, giving a rise of pressure within that building. The coolant was now being discharged from the primary circuit, was emptying into the containment, and was passing from the containment sump, through the sump pump that continued to operate, into the auxiliary building.

At 18 min, there was a sharp increase in activity measured by the ventilation system monitors. This activity arose from the discharge of the slightly radioactive primary coolant into the containment and not from any fuel failures at this stage. At this point, the reactor circuit pressure was only about 83 bars and falling.

Up to this stage, the events at TMI-2 were veiy similar to a feedwater tran­sient experienced at the Davis-Besse plant at Oak Harbor, Ohio, in September 1977. At Oak Harbor, however, the operators recognized after 21 min that the PORV had stuck open, and they closed its associated block valve, thus ending the incident. The block valve is in series with the PORV and can be manually operated to seal this line.

Phase 3: Continued Depressurization (20 ^min-2 h). Between 20 min and 1 h, the system parameters were stabilized at the saturation condition, about 70 bars and 290°C. At 38 min the reactor building sump pumps were turned off after approximately 30 m3 of water had been pumped into the auxil­iary building. The amount of radioactivity transferred was relatively small, since the transfer was stopped before any significant failure of fuel occurred.

At 1 h 14 min, the main reactor coolant pumps in loop B (one of two loops in the reactor—each loop has two coolant pumps) were tripped because of in­dications of high vibration, low system pressure, and low coolant flow. The op­erators would normally be expected to take such action to prevent serious damage to the pumps and associated pipework. However, turning off the pumps in loop B allowed the steam and water phases in that circuit to separate, effectively preventing further circulation in that loop.

At 1 h 40 min, the reactor coolant pumps in loop A were tripped for the same reasons (see item 8 in Figure 5.3). One concern was that a pump seal fail­ure could occur. The operating staff expected natural circulation of the coolant, but because of the separated steam voids in both loops, this did not take place. Subsequent analysis showed that about two-thirds of the water inventory in the

Figure 5.3: TMI-2 phase 3: continued depressurization.

primary circuit had been discharged by this stage and that when the main coolant pumps were switched off, the water level in the reactor vessel settled out about 30 cm above the top of the core. The decay heat from the core rapidly evaporated the water and brought the level down inside the core, and the core began to heat up. This overheating was the precursor of core damage.

P^^ 4: The Heat-Up Transient (^2- h). At 2 h 18 min into the incident, the PORV block valve (item 9 in Figure 5.4) was closed by the operators. The indica­tions of the position of the PORV were ambiguous to the operators. The control panel light indicated the actuation of a solenoid that should have closed the valve; there was no direct indication of the valve stem position. However, it must be said that failure to recognize that there had been a massive loss of reactor coolant as a result of the stuck-open PORV was the significant feature of the acci­dent. Even at this point, however, a repressurization of the reactor coolant circuit using the HPIS would probably have successfully terminated the incident.

Following closure of the block valve, the reactor circuit pressure began to rise. At 2 h 55 min, a site emergency was declared after high radiation fields were measured in the line connecting the reactor coolant circuit to the purifica-

Figure 5.4: TMI-2 phase 4: the heat-up transient.

tion system. By this time a substantial fraction of the reactor core was uncov­ered and had sustained high temperatures. This condition resulted in fuel dam­age, release of volatile fission products, and generation of hydrogen as a result of the interaction between the Zircaloy fuel cans and steam at high temperature.

Attempts were made to start the main reactor coolant pumps around this time. One pump in loop B did operate for 19 min but tripped out due to cavi­tation and vibration. The peak fuel temperature (in excess of 2000°C) was reached shortly after 3 h into the incident. At 3 h 20 min, reactivation of the HPIS effectively terminated the initial heat-up transient, both quenching the fuel and recovering the core.

A general emergency was declared about 3 h 30 min after the start of the in­cident as a result of rapidly increasing radiation levels in the reactor building, the auxiliary building, and the fuel handling building. Detectors inside the con­tainment indicated very high levels of radiation.

Over the period from 4 h 30 min to 7 h into the incident, attempts were made to collapse the steam voids in the two loops by increasing the steam pres­sure and by sustained HPIS operation. These attempts to reestablish heat re­moval through the steam generators were unsuccessful and, moreover,

involved significant use of the PORV block valve. This course of action was therefore abandoned.

Subsequent calculations of the likely course of events in the reactor over the first 3 h of the incident are illustrated in Figure 5.5 Calculated peak fuel tem­peratures and calculated core liquid levels (and two-phase mixture levels) are shown. The events referred to in the above description are also indicated. Fig­ure 5.5 c shows the temperature calculated at several different levels in the core, level 1 being at the bottom of the core and level 5 near the top.

Phase 5: Extended Depressurization (6-11 h). Over the next 4 h the op­erators reduced the pressure in the reactor circuit in an attempt to activate the accumulators and the LPIS components of the ECCS system. This action was ini­tiated at 7 h 38 min by opening the PORV block valve (item 10 in Figure 5.6). At 8 h 41 min, the reactor circuit reached a pressure of 41 bars and the accu­mulators (item 11, Figure 5.6) were activated. However, only a small amount of water was injected into the vessel.

During the depressurization, a considerable volume of hydrogen was vented from the coolant circuit to the reactor building. At 9 h 50 min a pressure pulse was recorded in the reactor building, and in response the building spray pumps (item 12, Figure 5.6) came on within 6 s and were shut off after 6 min. This pressure pulse was due to ignition of a hydrogen-air mixture in part of the re­actor building.

The extended attempt at depressurization was unsuccessful in that the low­est pressure achieved was 30 bars. Nothing that was attempted could drive the pressure lower, and it obstinately remained above the maximum pressure at which the LPIS system of the ECCS could be brought into operation (28 bars).

With the operators unable to further depressurize the reactor circuit, the block valve to the PORV was closed at 11 h 8 min. Over the next 2-h period there was no effective mechanism for removing the decay heat. The block valve was kept closed during this time except for two short periods. Injection via the HPIS was at a low rate and was almost balanced by the outflow through the line to the water purification system; both steam generators were effectively isolated.

Phase 6: Repressurization and Ultimate Establishment of a Stable Cool­ing Mode (13-16 h). At 13 h 30 min into the incident, the PORV block valve (item 13 in Figure 57) was reclosed, and sustained high-pressure injection via the HPIS was initiated in order to repressurize the circuit and allow the circuit

Elapsed time ( min )

Figure 5.6: TMI-2 phase 5: extended depressurization.

pumps (item 14, Figure 5.7) to be restarted. At 15 h 51 min a circulating pump in loop A was restarted and flow through the steam generators was reestab­lished, giving a stable heat rejection mode by that means.

Phase 7: Removal of the Hydrogen Bubble (day ^day 8). As a result of the zirconium-steam reaction, nearly a ton (1000 kg) of hydrogen was pro­duced, and a great deal of this was trapped in the upper region of the reactor pressure vessel, above the core. This “hydrogen bubble” (item 16, Figure 5.8) was eliminated by two methods.

The first method employed the normal purification system used for the pri­mary system. The method worked as follows. The gas in the bubble was being absorbed in the water by the primary system, which was at approximately 70 bars. Some of this water was bled into a “letdown” tank kept at essentially at­mospheric pressure, where the absorbed hydrogen gas fizzed out as when a champagne bottle is opened. The gas was passed through a system that de­layed its release for 30 days. It was then passed through filters and vented out of the off-gas stack to the atmosphere.

In the second method, heaters in the pressurizer were turned on, forcing the dissolved gas out of the primary system water in the bottom of the pressurizer

and into the gas space at the top. The block valve at the top of the pressurizer (item 17 in Figure 5.8) was then opened to permit the gas to escape. The gas bubble was eliminated by these two methods, and on April 28, a month after the accident, cooling by natural circulation was achieved and the reactor coolant pumps were switched off. Switching these pumps off was helpful since the frictional heating of the water by the pumps was at that stage greater than the decay heat being emitted by the reactor core.

Postmortem. Analysis and examination of the damaged core and compo­nents have continued in the period since the accident. It is now possible to de­scribe with some confidence the sequence of events that occurred.

Over the first 100 or so minutes with at least some of the main reactor coolant pumps running—albeit circulating a two-phase coolant—the core was adequately cooled (Figure 5.5). Tripping the last coolant pump allowed the steam and water to separate, effectively preventing further circulation through the loops. Gradually, the water in the reactor vessel boiled off exposing fuel 10-15 minutes later (Figure 5.5). However, some decay heat was being re­moved by steam being released through the open PORV (Section 4.3.2, Figures 4.11 and 4.12). At around 140 minutes the operators closed the PORV block valve, effectively terminating this cooling. The core temperatures rose rapidly above 1800 K. As can be seen from Table 4.2, the cladding would first be oxi­dized and perforated and, as the temperature increased, a Zircaloy-steam reac­tion would lead to the formation of hydrogen. Ultimately all the Zircaloy in the affected region would react, and the support given to the fuel pellets would dis­appear. An estimate of the hydrogen inventory after the accident suggested that about one-third of all the Zircaloy had reacted and almost all the fuel had failed.

The exothermic chemical reaction between Zircaloy and steam increased temperatures still further, taking them above 2400 K. At this temperature Zircaloy is molten and begins to interact with the UO fuel (Figure 5.9a). At 174 minutes one of the reactor coolant pumps in loop B was started and operated briefly. The large quantity of water entering the reactor vessel caused the very hot cladding and fuel in the upper part of the core to fragment and collapse (Figure 5.9b), leaving an upper crust with a void below. This water achieved some temporary cooling, but the heat-up continued in the lower and central re­gions of the core. It may be that resolidified material formed a solid crust that acted as a crucible to hold the molten fuel (see Figure 6.1).

At 200 minutes the activation of the HPIS recovered the core and refilled the

(a) Hypothesized Core Damage

Configuration ( 175-180 Minutes)
(b) Hypothesized Core Damage Configuration (224 Minutes)

Sohtf. l.ed ZiOjWOj b«tw««n fu«l»OdS. і e. iuppoihng Ciu5l

(d) Hypothesized End-State

Condition of theTMI-2 Reactor Core

reactor vessel. However, quenching was slow because the water could not reach the seriously damaged areas of the core.

Around 224 minutes it is now known that a major redistribution and reconfig­uration of the fuel material took place. The upper crust, left following the forma­tion of the initial void at 174 minutes, now collapsed. Its weight caused molten fuel to be extruded out to one edge of the core where it flowed down over the core support assembly into the bottom head of the reactor vessel. It is estimated that some 20 tons of material ended up in this location (Figures 5.9c and 5.9d). Continued operation of the HPIS finally quenched the core. The slumping of the fuel material increased the resistance of flow through the core, and the flow re­sistance of the damaged core was estimated at between 200 and 400 times its nor­mal value. At least 70% of the fuel was damaged and 30—40% actually melted.

An international investigation (TMI-VIP) was mounted to examine the extent of the damage to the lower vessel structure and the margin to failure of the re­actor pressure vessel. As a result of this analysis it is clear that effective cooling had occurred by penetration of water through cracks in the debris and between the debris and the vessel wall. The molten fuel is also less aggressive to steel than previously feared.

The very high levels of radioactivity in the containment building after the acci­dent were mainly due to the presence of radioactive krypton and xenon. Apart from krypton-85 (which has a 10-year half-life), most of the radioactive isotopes of krypton and xenon are short-lived. With the exception of approximately 10,000 curies of krypton-85, which were vented from the containment about 1 year after the accident, all the radioactive gases escaped in the first few days after the acci­dent, and this led to a measurable increase in activity above the normal back­ground level in the area surrounding the plant. However, very little (only 16 curies) of the iodine released from the fuel escaped from the containment. Evac­uation of the area immediately surrounding the site 2 days after the accident in­volved about 50,000 households. However, exposure of the public to radio­activity was very small indeed, and the consequences in terms of additional can­cer deaths are calculated to be undetectable in the surrounding population. Using the estimated total collective dose of 33 man-Sv, it is calculated that there will be less than 1 additional cancer death due to the accident in a total of 325,000 such deaths in the surrounding population over the next 30 years.

A Presidential (Kemeny) Commission investigating the causes of the accident found that operator error was the direct cause. Contributing factors were oper­ator training, control room design, and the attitude toward safety within the U. S. nuclear industry. The Kemeny Commission was also very’ critical ol the Nude u

Regulatory Commission. The U. S. industry subsequently responded by setting up the Institute of Nuclear Power Operations (INPO) to improve the quality and operational safety of all U. S. nuclear power plants.

The recovery operations for TMI-2 took 10 years and cost about $1 billion. First it was necessary to decontaminate the auxiliary buildings and vent the con­tainment building to allow entry (July 1981). Then the large amounts of conta­minated water in the basement of the containment building had to be treated (complete by August 1984). Finally, the reactor vessel had to be opened and defueling undertaken—this took five years (complete by 1990). TMI-2 will be mothballed and dismantled along with TMI-1 around the year 2010.

In terms of the classification of operating states presented in Chapter 4 the in­cident began as a classical upset transient and then developed (because of the stuck-open PORV) into an emergency condition of the classical small-break type. This should have been easily contained by activation of the engineered safety fea­tures, but operator action specifically prevented this from happening. The situa­tion was therefore escalated into an accident beyond the limiting fault condition, that is, beyond the design basis. Nevertheless, the defense-in-depth philosophy of a reactor plant (i. e., the concept of multiple barriers) prevented any significant harm to the public or the operators. Many lessons learned from the TMI accident have been incorporated in newer nuclear plants, albeit at considerable extra cost.