"The most important man in a nuclear submarine? That would be the inconspicuous seaman who goes all around the sub and drips oil in the bearings. You lose one bearing in something like a valve-actuating motor somewhere, and you can lose the whole boat.”

—Paul "Spider Fuzz” Field, former submariner and Research Technician at Georgia Tech

One day I was in the E. I. Hatch Nuclear Power Plant near Baxley, Georgia, on a mission to install my life’s work in the former operator’s break room, which had been converted into an equipment bay. There was a list of new equipment mandated by the Nuclear Regulatory Commission after the Three Mile Island disaster, and my contribution was four ROLM MSE/14 minicomputers and associated hardware, taking up four racks for each of the two reactors. These machines would work hard, 24 hours a day, constantly updating a long list of data considered crucial to the safe operation of the two reactors at the plant and making it available to the operators on demand.

I was supremely confident that my MSE/14s would be the meanest, toughest pieces of hardware in the entire room. They were built to military specifications and were meant to run on the upper deck of a navy ship, pitching in the waves and taking fire in salt water spray and rocket exhaust.222 I was so, so wrong. In the adjacent rack was an unidentifiable piece of electronic gizmo bolted in with very heavy screws. The front face was half-inch steel armor — plate, and the thing looked like it weighed about 500 pounds. My mil-spec equipment looked delicate in comparison. I was concerned to notice that the meters on the gizmo’s face were smashed flat, and the extremely robust controls, built for use by a gorilla, had been crushed and sheared off.

I turned to my handler and asked nervously, “Uh, what happened to this thing?”

“Oh,” he responded. “That. Well, the installer complained that the pipefitters were in his way. My suggestion is, don’t upset the pipefitters.”

I had noticed all the plumbers with their bending machines strung out all over the yard, working slowly and carefully to install piping upgrades and new tubing runs all over the place, including in the ceiling of the new equipment bay. Quickly I learned working at the plant that the pipes, valves, and pumps had a much higher coefficient of importance than any electronic gadget in the facility. There were reasons for this hierarchy.

The great meltdown accident at the Three Mile Island Unit 2 in Pennsylvania would seem to have been the end of the Exuberance Period in atomic energy, but, of course, it was not. The excitement and mystique of nuclear power had pretty much faded out years before then, as the cold realities of loan interest and wavering public power demand put a lid on it. It was too bad, because the adolescence phase is interesting even for technology, and nuclear power technology had been declared mature while it was still wearing short pants. There remained unresolved problems, some of which were known and some of which would snap into clarity with a couple of hard jolts.

By the late seventies, a world standard for commercial nuclear power reactors had been loosely established by what utilities chose to buy. It was the light-water-moderated and — cooled reactor, mainly the pressurized-water-reactor concept that Admiral Rickover had developed with spectacular results for his nuclear submarine program. Liquid-metal-cooled breeders and all oddball reactor types, such as molten-salt, gas-cooled, and pebble-bed designs, were largely abandoned and suffered a lack of development funds. About 80 percent of the reactors being built or run in the United States were PWRs made by Westinghouse, Combustion Engineering (CE), or Babcock and Wilcox (B&W), with the remainder being the simpler boiling — water reactors built by General Electric (GE).

An unresolved technical detail was the Emergency Core Cooling System (ECCS), a collection of devices used to prevent a fuel meltdown in case of an accidental breakage of the primary cooling loop. In the spring of 1972, the AEC held a series of hearings to address concerns that insufficient attention had been paid to this unlikely but potentially disastrous type of accident. Interim ECCS designs were being sold to utilities, and these were extremely complicated add­ons, consisting of multiple auxiliary water-injection systems with a great deal of plumbing. These systems were reminiscent of “five-mile-per-hour bumpers,” clumsy-looking things added to cars because a small tap on the front of the vehicle could cause a lot of expensive damage. A single pipe break could bring down an entire generating plant, and the insurers were justifiably frightened. These auxiliary coolant systems required electricity to operate valves remotely, run pumps, and provide power for the control room, so backup generators had to be installed as well, ensuring that there would be power for the ECCS even if the turbine had stopped and there was no power available on the utility network. The ECCS, even in its possibly inadequate form, ran up the cost of a nuclear power plant. The AEC hearings ran for a year and a half, and a few improvements were mandated.

The technical questions about the use of an ECCS in an emergency are very simple: if a major pipe breaks open and the reactor core is denied water for cooling, the ECCS is supposed to make up the lost coolant by throwing water in from an alternate source. What is to keep the ECCS water from leaving the core through that same hole?

In a water-cooled reactor, the fuel is made of little uranium oxide pellets, lined up in thin metal tubes, and the tubes are kept upright and apart by light sheet-metal spacers, designed so as to add as little non-productive metal to the inside of the reactor core as possible. If the fuel were denied coolant long enough, perhaps minutes, this fragile metal structure would start to sag and bend, disrupting the normal down-up flow of water as it is added by the ECCS. With too much disruption, the metal would melt and collapse into a heap at the bottom of the reactor vessel. How does the auxiliary cooling water get to the hot fuel in the middle of the heap without spacers to keep flow-channels open? There was no concern about heaped fuel going critical, heating up by uncontrolled fission, and burning through the bottom of the nine-inch-thick steel vessel. Being denied coolant also meant denial of moderator, and the three-percent-enriched commercial reactor fuel was incapable of forming a critical mass without interstitial water. The heat from the recently fissioned fuel, however, was enough to cause an irreversible reactor wipeout, with the internal structure reduced to a chaotic mass of melted parts.

There were no power-reactor disasters back then to study and contemplate. The nearest thing we had to working data was from computer simulations of theoretical accidents and some experiments with the Semi-Scale simulation at the NRTS in Idaho. Neither source could possibly point out everything that could happen in a billion-watt power plant, but in the 1970s confidence in the inherent safety of the pressurized water reactor was high.

There were some dangerous problems with the system in general, and with Babcock & Wilcox reactors in particular. The primary fault was in the training of reactor operators. The Navy was supplying reactor operators to the nuclear-power business the same way the Air Force was supplying airline pilots to the air transportation industry. A young man who had been rigorously trained in Rickover’s Navy to run a submarine reactor with a few years under water could retire early and snag a fine job in a nuclear generating station. He was considered to be at the top of the game, having run the reactor on one of Rickover’s flawlessly performing boats with military discipline and polish. It saved the power company the cost of having to train an operator from scratch, and veterans from the submariner or nuclear aircraft carrier service were always welcomed.

It seemed a good policy, but there were fundamental problems. Those attack submarine reactors used in the first years of the nuclear navy were tiny, almost toy-like, producing only 12

megawatts to run a sub at full speed.223 Small reactors have small problems, and the mega­disaster capabilities of an extremely complex billion-watt power reactor were unknown to any submarine veteran. The submarine reactor was run by two men, sitting at a console about as complex as the dashboard of a twin-engine airplane. A power-plant console is completely different. It sits in a room the size of a basketball gymnasium, and it takes several men to run it, all standing up. There are 1,100 dials, gauges, and indicator lights, 600 alarm panels, as well as hundreds of recorders, switches, and circuit breakers. That is just the front of the main panel, towering over everything in a wrap-around, U-shaped configuration, as wide as the room and seven feet tall. In back of the main panel is the larger secondary panel, containing all the indicators and dials for which there was no room in front, and there is little reasoning in the positioning of anything. Finding the immediate status of some important subsystem in the plant can involve remembering where and on which panels the various bits of information may be located. The slightest problem is brought to the attention of the operating staff by an alarm sounding off and blinking a light behind a square plastic tile having the fault identifier printed on it. At any one time, there could be 50 alarm tiles lit up from minor problems and needing attention. Off to the side in a B&W plant in the 1970s was a small computer, keeping track of all the alarm conditions and printing them on a continuous roll of paper. As the automatic control system in the plant detected a fault, the computer identified it on the print-out with the time of day at which it occurred. The printer was a pin-matrix unit, running at a sedate 300 baud. Their training in the Navy had not prepared the operators for this level of available information sitting atop an enormous amount of raw power.

What the Navy had pounded into these men was an absolute need to “not let the pressurizer go solid.” But what exactly did that mean? Nuclear accident investigators started to notice this curious phrase coming up in most operator debriefings as soon as power reactors started having accidents. Its exact meaning would become important as the conditions that caused the problems at TMI gradually lined up and self-organized into a disaster.

In a PWR, the reactor coolant/moderator is liquid water, forced to circulate by electrical pumps in two continuous loops. Water is heated to several hundred degrees in the reactor core, and this energy is used to make steam by circulating it through two steam generators. A steam generator is a vertically mounted cylinder, about 75 feet tall, and it works like an old — fashioned steam boiler, using heated water rather than fire to boil water into vapor. The primary water, cooled by its trip through the steam generator, is pumped back into the reactor vessel to be reheated.

The reactor vessel is a thick, forged-carbon-steel pot, cylindrical and about 39 feet high, with a stainless steel liner to prevent corrosion. To maintain the water in the vessel in a liquid state, it must always be at very high pressure, else it would boil and turn to steam. The only way to maintain the fission process in a PWR reactor vessel, which is small compared to other designs, is to make sure that the moderator, the water, is constantly at maximum density, or liquid state.

This high-pressure condition is maintained by the pressurizer, which is basically a large, 42- foot electric water heater connected into the top of the reactor. The pressure in the reactor vessel is automatically monitored and kept at the correct level by either turning on the heater coil in the pressurizer to increase the pressure or spraying cool water into it to decrease it. The entire primary coolant system, including two steam generators, four main coolant pumps, the pressurizer, and all the pipes, is kept completely filled with water, with no bubbles or voids. There are no bubbles in the system except for the pressurizer, which always has a void sitting at the top of its water column. The pressurizer is constantly kept about 80 percent full.

The reason for this discrepancy involves a second role for the pressurizer. Not only does it keep the pressure high within the reactor, it also acts as a shock absorber. Any sudden jolt in the water running around in the primary cooling system, such as a valve slamming open or shut or a pump starting or stopping, causes a shock wave to travel through the incompressible coolant. The water cannot be broken by a shock, but the metal pipes and cylindrical structures in the system are not flexible, and a “water hammer” can take apart a cooling system instantly. This problem is solved by giving the system a section that can be compressed, the bubble of steam atop the water in the pressurizer. If it is kept big enough to absorb the hammer, then this void can prevent any harm to the precious plumbing by compressing and absorbing the transient pulse of the shock wave.

If you “let the pressurizer go solid,” it means that you have mismanaged the water level in it and allowed the shock-absorbing bubble to disappear—making the pressurizer become a “solid” block of water. This was the absolute worst thing that could happen in a cramped submarine power plant, and operators were trained to avoid it at any cost. It was not a bad lesson to bring to the power plant, but in the increased-power realm, worse things could happen. Much worse.

A remaining, nagging problem with nuclear reactors in general is the decay heat of fission.

Each fission event releases an enormous amount of energy, 210 MeV, but only 187 MeV is immediately available. The remaining 23 MeV is released gradually, as fission fragments

radioactively decay in a cascade of sub-events over the next few billion years.224 The rate of energy release is exponential, which is engineer parlance meaning that at first the rate falls like a lead brick on your foot, but then it slows to a dead crawl.

The issue with decay heat is that it is quite easy to instantly shut the fission process down and stop the reactor, but there is always a coast-down period in which the machine is still making power at a greatly reduced and falling percentage. If the power before shutdown is not too great, then there is no problem with the coast-down, even if all reactor cooling systems are not working. The fuel will still be hot, but reactors are built to withstand overheating. An S2W reactor on an attack submarine built in the 1960s made 12 megawatts when running at full speed. Immediately after an emergency shutdown, that reactor was still producing 6.5% of the 12 megawatts, or 780 kilowatts. That is not enough power to melt anything in the fuel matrix, which is made of high-temperature zirconium alloy and uranium oxide.

A typical PWR, on the other hand, can produce 1,216 megawatts of electricity. The efficiency of the steam-to-electricity power conversion process in a PWR plant is about 32%, which means that the reactor is producing 3,800 megawatts of heat to make that 1,216 megawatts of

electricity.225 Upon a sudden shutdown, a PWR is still making 247 megawatts of heat; and in the confines of a reactor vessel, that is enough power to melt solid rock. It is therefore important to keep the cooling system running after the reactor has been stopped cold. If the coolant pumps are shut down for some reason or the pipes are blocked, then the ECCS takes over, spraying cool water into the vessel to soak up the heat that is still being produced.

The temperature in the fuel falls rapidly as the fission products decay away, and after one hour the power has dropped to 57 megawatts, which the system is probably able to withstand without external systems taking away the heat, but that one hour after shutdown is extremely critical. The fuel melts at an extremely high temperature, over 5,000° Fahrenheit, and the zirconium fuel tubes and structures come apart at over 3,000° Fahrenheit, but this level of temperature is achievable in an uncooled reactor core running at a hundred megawatts. After a day of sitting in shutdown mode, the high-power PWR is still making 15.2 megawatts, or more than enough to run a submarine at flank speed. After a week, the reactor has cooled down to only 7.6 megawatts. The only way around this problem with nuclear fission is to ensure a shutdown cooling system, particularly in that first hour after shutdown, using redundant, multiple devices. If one auxiliary reactor cooling device fails, then there are still other ways of cooling the fuel held in reserve. This is the application for which the ECCS was designed and installed on all power reactors.

Given these minor systemic flaws, the nuclear establishment complex of manufacturers, customers, and regulatory bureaucracy was confident that installed power plants were safe against the worst possible accident, a catastrophic steam explosion throwing fission products into the atmosphere. The thought was, if we built power plants to withstand the worst accident, then the resulting physical strength and over-engineered systems will prevent any minor accident.

Everything in the nuclear power world seemed safe and running smoothly right up until March 22, 1975, when things began to unravel at the Browns Ferry Nuclear Power Plant on the

Tennessee River near Decatur, Alabama. At the time, Browns Ferry was the largest nuclear plant in the world, having three General Electric BWR reactors capable of generating 3.3 billion watts of electricity. It was owned and operated by the Tennessee Valley Authority, a government program created by congressional charter in 1933 under the Franklin D. Roosevelt administration.

It was 12:20 , and Units 1 and 2 were running at 100 percent power, while Unit 3 was in the

last phases of construction.226 As a rule, rooms in a nuclear plant are airtight so that a negative pressure can be maintained in the reactor building using a very large blower. This prevents any radiation leakage that could get into the air outside the plant and spread into the surrounding territory, and every room must be airtight to prevent leak points. This rule applied to the spreading room, a large chamber underneath the control room and adjacent to the reactor building, used simply as a space in which electrical signal and control cables can meet and crisscross in an orderly way. In this room thousands of cables were neatly arranged and labeled on trays and in open conduits. This room had been the last one sealed, because cables from Unit 3 were still being installed, and any instrumentation change in Units 1 and 2 required an unsealing of the room.

Temporary seals around cables entering one of the four walls around the room were accomplished using a self-foaming polyurethane compound in an aerosol can, occasionally referred to as “great stuff.” When workers had to hack away at the seals to install a new cable, it was easy to then spray in some great stuff and watch it expand, seal the opening, and harden. Unfortunately, the hardened foam, consisting of extremely thin plastic bubbles, has an enormous surface area, and it burns like gasoline.

A technician tested his latest sealing job using a proven method: he lit a candle and held it up to the new foam. The seal was imperfect, and the flame was sucked into a small hole by the negative pressure in the spreading room. The foam caught fire, of course. Efforts to extinguish the blaze by beating it with a flashlight were unsuccessful. As the situation quickly became desperate, two men tried to smother the flames using rags, but the flames were spreading into places where a rag could not reach.

Ten minutes later, at 12:30 P. M., someone had dragged up a carbon dioxide fire extinguisher, and they emptied it into the fire in the spreading room. It looked like it had gone out, but one minute later it flamed up again, and this time it had crossed the concrete wall through a small hole and was now in the reactor building. A worker ran up to the guard at his post in the entrance to the reactor building and asked to have his fire extinguisher, remarking that there was a fire below. Honestly, it would not seem as if there was anything to burn in a nuke plant. Everything is concrete and steel, and there is enough water on-site to fill a lake. What burns? Paint? Thousands of pages of operating and procedures manuals? Obviously, the plastic foam plus tons of plastic wiring insulation can make quite a bonfire. The Public Safety Officer sitting nearby picked up his phone and called the control room. “The building’s on fire,” he began. It was 12:35 P. M., and the fire alarm started going off as the announcement came over the public address system. The fire was spreading down the cable trays, about 20 feet off the floor, stopping just short of coming through the sealed penetrations in the ceiling and into the control room. Smoke was accumulating in the rooms below, making it hard to see or breathe. Both reactors were still running at 100 percent power, oblivious to the developing problem.

At 12:40 P. M., the evacuation alarm sounded in the spreading room, just as the ECCS alarm panel for Unit 1 began to light up with irrational indications of problems. The plant operator, seeing that everybody was out of the spreading room, pulled the handle to actuate the room’s carbon dioxide flooding system. Nothing happened. It had been de-energized because workers were in the room. He found where it had been shut off, turned it back on, and pulled the handle again. Whoosh. The room filled with misty carbon dioxide, but still the fire burned. Another employee grabbed the handle. “You didn’t do it right. Let me show you.” Another loud rush, and the room clouded up, but the fire did not care. It turned out that the ventilation system was still running, blowing fresh air into the room and assuming that men were still in there, working.

The alarm indicators in the Unit 1 control room were acting crazy, indicating problems that did not exist, and at 12:51 an operator pushed the scram button with his palm. Unit 1 dropped off the power grid as the turbine coasted down. Nine minutes later, the operating crew began to lose control of Unit 2 as the fire spread to its cable trays. All systems in Unit 2 began reverting to their fail-safe conditions, and the ECCS system came on by itself. At 1:03 the cables to the main steam isolation valves burned through, and remote control of the cooling systems failed.

An assistant shift engineer took command of the fire brigade, as they passed carbon dioxide and dry chemical extinguishers hand over hand into the highly congested maze of cable racks in the spreading room and discharged the flood system a third time. At 1:10 P. M., the assistant shift engineer decided to call the Athens Fire Department and beg assistance.

Twenty minutes later, the lights went out in the reactor building. The power feed had burned up.

At 1:45, the fire department arrived, took a quick evaluation of the fire, and suggested that the plant’s electrical wiring in the instrumentation and control systems be soaked with water as soon as we can get a hose in there. The recommendation was not immediately followed.

By 5:30 P. M. it was becoming clear that they had done everything possible with fire extinguishers and they would have to dump water on the wiring. It was always risky to put water on electrical circuits. Water conducts electricity, and the damage that could be caused by random short circuits in the complex instrumentation and control wiring was unpredictable. By this time, they were out of choices. Somewhere around 6:30 P. M., remote control of the pressure-relief valves in Unit 1 was lost. At 7:20 P. M., water was finally released into the cable trays, and ten minutes later, the fire was extinguished. It had burned for seven hours and ten minutes, and it had done a great deal of damage to the Browns Ferry plant and to the confidence level of nuclear engineering. A single candle flame had brought down two operating reactors and destroyed the electronic process-monitoring and control systems.

The reactor and steam systems were left in perfect order, but the control systems had been put out of action. Although flames in the cable spreading trays were considered unlikely, there was a large tank of carbon dioxide, the flooding system, installed with piping for the sole purpose of putting out a fire in the room, just in case. There was comfort in knowing that the interlocks that kept the fire from being smothered were there to keep workers from being smothered. No unusual radiation was released into the environment. It was a severe industrial

accident, and pleasantly unbelievable that no one had been harmed.227

There were changes in nuclear power-plant codes and standards implemented after the Browns Ferry fire, from the use of silicon sealant instead of plastic foam to the rapid recharging of respirators. Unit 1 was down for a year while its wiring system was rebuilt, this time using non-flammable covers on the cables.228

In the fall of 1977, Cleveland Electric and Toledo Edison were proud owners of a new Babcock & Wilcox model 177FA pressurized-water-reactor power plant, built to generate 889

megawatts of electricity and located in Oak Harbor, Ohio.229 The plant is named Davis-Besse, and a PWR is not a small machine. The reactor pressure vessel alone is 700 tons of steel with walls nine inches thick. It contains 100 tons of uranium fuel in 36,816 rods. It makes scalding hot water, which feeds two steam generators, each 73 feet high and weighing 400 tons. On September 24, the plant was six months old, and they were still testing it, running at low power just to see if something would break. The reactor was at nine percent power.

All was quiet and peaceful in the control room when the floor gave a shudder. There was a distant rumble, seeming to come from the turbine building, and the operating staff on duty assumed a collective “what-the-hell-was-that?” look. The long U-shaped console lighted up with trouble indicators, and alarms started going off. Six operators scanned the meters and alarm panels, seeking to quickly evaluate the status of the system. Shift Supervisor Mike Derivan, trained as an engine-room supervisor in the nuclear Navy, looked first at the level of water in the pressurizer. It was shooting up rapidly, shrinking the steam bubble at the top. He instinctively reached for the red scram button and pushed it. The control rods slammed into the reactor core and stopped the fission process.

The coolant pumps for the number two steam generator seemed to have stopped for some unknown reason, and that had caused the pressure to rise in the reactor and force water up into the pressurizer. With one steam generator out of commission, the reactor was suddenly making too much heat. That much made sense. The operations crew now watched, perplexed, as the pressure in the reactor dropped by several hundred pounds in less than a minute. It was not clear what was going on.

The reactor, noticing that no operator was moving to prevent a meltdown, then decided to fend for itself, automatically turning on the ECCS. This first component of the ECCS was the High Pressure Injection system (HPI), spraying cool water into the reactor vessel at an aggressive pressure of 1,900 pounds per square inch.

Derivan, still locked on the pressurizer water level, decided that there was no problem with the size of the steam bubble now, and he manually overrode the automatic system and shut down the ECCS. Inexplicably, the water level began again to rise in the pressurizer, indicating an increase in reactor vessel pressure, even though the reactor was shut down and cooled by the water injection. The pressure should have been dropping.

The staff was now completely confused, and somebody suggested that they cut off the other two coolant pumps. Coolant pumps, after all, generate some heat on their own, just by stirring the water, and perhaps that extra energy was causing the pressure to rise. Grasping at straws, they stopped the pumps.

The water level in the pressurizer shot up and off scale. More alarms started blaring, and by this time hundreds of trouble lights were blinking all over the console. Number two steam generator boiled dry, and a particularly insistent alarm indicated that the air pressure in the reactor containment building, which should be below atmospheric pressure, was now abnormally high. Was there a break in the pipes? Was steam escaping into the building? This was getting very serious.

Derivan ran behind the console to look at the containment building pressure gauge. It was at three pounds per square inch above normal and rising. Finally, he understood what was going on. The Pilot-Operated Relief Valve (PORV) atop the pressurizer had blown open and failed to reclose. It was designed to open automatically if the pressure in the primary coolant loop reached 2,200 pounds per square inch and allow the steam to blow off into a holding tank in the containment building. The containment building held the reactor vessel and the steam generators, or everything in the potentially radioactive primary cooling system, and was a secondary safety against radiation escape into the surrounding environment. The relief valve prevented damage to the plumbing in the primary cooling system when the pressure in the reactor spiked too high. The act of relieving the pressure would cause it to drop, and the PORV was supposed to close again when it fell below 1,800 pounds per square inch. If the valve failed to close, then the pressurized water reactor was no longer pressurized, with all its energy free to escape into the air in the building.

A normal steam relief valve is a simple affair, consisting of a steel spring holding down the cap on a hole in the highest point of a boiler system. In this case, the hole was a rather large four square inches, and it took 3.5 tons of force to keep it closed. That would be a very, very large steel spring, awkwardly heavy, and to mount that on top of the pressurizer would be asking for trouble from vibration effects. Instead, on a nuclear reactor of 1970s vintage, the force used to close the relief valve was supplied by the steam pressure underneath it. A “pilot tube” conducted the steam through a control box, wired electrically back to the control room, and fed

a cylinder and piston connected to the valve cap.230 The concept was elegant, very lightweight, appealing to engineers, mechanically complex, expensive, and notoriously subject to random failure.

“Shut the block valve!” Derivan yelled.

In case the PORV was stuck open, a second, simple valve, similar to the one used to turn on the water in a sink, could be operated remotely from the control room. It was named the block valve. An operator reached for the switch handle, gave it a quarter turn, the steam leakage stopped, and 20 minutes of hellish confusion ended. After 26 minutes of settling down, everything was back to normal.

The Nuclear Regulatory Commission and a number of top engineers from B&W were all over this incident. It was unnerving and very serious, because if the reactor had been running at a higher power, such as 50 percent, the entire core could have melted. With this level of operational chaos, a pure disaster was possible. The government and manufacturer representatives investigated in depth.

The problem was indeed the PORV, but it was not the fault of the PORV. A pen-chart recording showed that the valve had rapidly slammed open and then shut nine times, beating itself to pieces and leaving the steam line gaping open. The fault was back in the control room, in a rack of relays behind the control panels. An unnamed worker had found a bad relay in a circuit he was repairing. The same type of plug-in relay was used all over the system, and he needed one. He found a perfect replacement unit for his circuit in the PORV panel, so he unplugged it and used it. The PORV was used only for emergencies, and it would probably never be needed, he must have reasoned. The PORV, missing a logic element, went berserk

when called to action by the primary steam-pressure sensor.231

That explained the problem, but what explanation was there from the operating staff for having shut down the ECCS? The HPI pumps had been manually killed only four minutes into the incident, at least 16 minutes before they had any clue as to what was happening. The ECCS was designed to keep the reactor from overheating and melting out the reactor core. To turn it off looked like sabotage.

The answer to the question was both simple and disturbing: they shut off the HPI to keep the pressurizer from going solid. This glaring problem with operator training, to undo this component of the Navy training, was discussed at length, but not to the point where operating power plants were notified of this finding, and the analysis of the frightful Davis-Besse incident got lost in the bureaucratic tangles at the NRC and at B&W. None of the other seven owners of B&W reactors were told about the dangerous confusion that can result when the PORV sticks open.

At about the same time, in the fall of 1977, Carl Michelson, an engineer working for the TVA in Knoxville, Tennessee, was studying the reactor building layout of the B&W model 177FA, when he noticed something.

In the training diagrams, in nuclear engineering textbooks, and in any diagram of a PWR primary cooling system simplified to the point where you can tell what is going on, the pressurizer is shown on top of the reactor vessel, usually connected to one of the hot pipes coming out near the top of the vessel. That is where the heated water comes out of the reactor and is piped to one of at least two steam generators. The pressurizer is the highest point in the system, so the steam bubble that is allowed to exist is always trapped in the uppermost part of the pressurizer tank. Because it is the highest point in the system, the water level in the pressurizer is used to evaluate the water level in the reactor, which is vitally important. If the water level ever falls below the top of the reactor fuel, which is blazing hot even with the reactor shut down due to the delayed heat production, then the internal structure of the reactor is going to melt.

Instead of putting expensive instrumentation on the reactor vessel to monitor the water level, the operators are taught just to look at the water level in the pressurizer. If there is any water at all in the pressurizer, then the reactor vessel must be completely full, and there is nothing to worry about. Just worry about the water in the pressurizer, and everything will be all right.

But in the B&W layout, the pressurizer is 43 feet tall, or about 10 feet taller than the reactor. There is not enough room below the fueling floor in the containment building for the pressurizer to be on top of the reactor. If it were, it would stick up out of the floor, so they had to lower it. In its position next to the number two steam generator, its inlet pipe had to be looped underneath a coolant pump line. The loop of pipe looks just like a sink drain trap, used to keep sewer gas from backing up into the sink. Michelson realized that no matter what condition might prevail in the reactor vessel, the water level in the pressurizer would never go below the trapping loop. The pressurizer would always be 20 percent full, even if the reactor was boiled dry. The operating crew in a 177FA control room actually had no idea of the water level covering the hot reactor fuel, and this struck him as dangerous. His finding caused a lot of commotion in the TVA, the NRC, and at B&W, but it never escaped the tangle and was never passed down to the operators at the eight reactors that B&W had built. There was a disaster,

set up by a combination of policy and engineering, and it was waiting to happen.

On November 29, 60 days after the relief-valve fiasco, Davis-Besse experienced another emergency shutdown. The cause was traced to a wrongly wired patch panel in a control-room computer. In the middle of trying to figure out what was wrong and correct the problem, the operations staff, apparently acting on pure, ingrained instinct, again turned off the ECCS. The incident investigators found this action difficult to comprehend. Why did the operating staff at a nuclear power plant tend to disable the emergency core cooling system during an emergency?

These bits of information would have been useful at Three Mile Island, Pennsylvania, where a new B&W 177FA had been running “hot, straight, and normal” for almost three months. The first reactor unit built there, TMI-1, was down for refueling, and TMI-2, the new reactor, was running at 97 percent full power, putting 873 megawatts on the power grid for the owner, Metropolitan Edison of Pennsylvania. The two B&W reactors were built on a three-mile-long sandbar in the middle of the Susquehanna River, just south of Harrisburg, the state capital.

THE TMI-1 REACTOR SYSTEM WAS

TYPICAL OF PRESSURIZED-WATER REACTORS USED ALL OVER THE WORLD, but some oddities of the B&W design contributed to a disastrous breakdown. The complete lack of water-level instrumentation in the reactor vessel was a big problem that the Nuclear Regulatory Commission would make illegal alter the accident.

The TMI-2 reactor had been originally contracted for the Oyster Creek Nuclear Generating Station in New Jersey, supplementing a BWR brought online by General Electric back in 1969, but the Jersey craft-labor corruption was starting to get out of hand. Jim Neely, the negotiator for Jersey Central Power and Light, had been dealing with the mob ever since a worker made a point by dropping a wrench into the gearbox of the crane hoist while they were lifting the 700-
ton reactor vessel into place for Unit 1 at the plant. That was alarmingly close to a disaster. Now a mob representative wanted one percent of the construction budget for the new B&W unit to ensure peace among the workers. That would be $7 million for one individual, and he was only the first in line. It was just not worth it to build a nuclear plant in New Jersey anymore, and Neely gave up. He amended the license application, and gladly transferred the contract to Met Ed, Pennsylvania. Maybe they would have more luck with it. TMI-2 was constructed without incident and began delivering power on December 30, 1978.

On March 16, 1979, a movie, The China Syndrome, opened in theaters nationwide. It was a fanciful cautionary tale about a potential nuclear power accident that could spread deadly

radiation covering an area “the size of Pennsylvania.”232

It was March 28, 1979, heading toward 4:00 a. m., and the Shift Supervisor on duty was Bill Zewe. Zewe was 33 years old and had learned the nuclear business in the Navy. The previous shift had left him a problem. The steam that runs the turbine is turned back into water by the condenser beneath the turbine deck, dumping the excess heat to the twin, iconic cooling towers out back. The towers are each 30 stories tall, and they cool a million gallons of water per minute, making white, fluffy clouds rise into the air above.

The water out of the condenser must be “polished” before it returns to the delicate, expensive steam generators, removing anything that may have dissolved in it as it cycled through the pipes, valves, steam generator, pumps, and condenser. A bit of rust, for example, could have been picked up along the way, but the water is made sparkling pure as it is pumped through a line of eight 2,500-gallon tanks in the basement of the turbine building en route to the steam generators.

Each tank is filled with tiny balls of purifying resin, and they must be flushed out and replaced as they become contaminated or loaded with gunk out of the condensed water. Unfortunately, the resin beads tend to mash down and stick together, reminiscent of the problem that blew up on the Atomic Man back at Hanford, and the back-flushing system installed by B&W was underperforming. In Tank 7, the resin was stuck tight and was not moving. Zewe left two men working on the problem and climbed the eight flights of stairs to the control room. He asked Fred Schiemann, the foreman, a Navy man, to go down there and encourage them. As he left the control room, Schiemann gently reminded Zewe that the PORV was leaking, which was nothing new. In the 177FA design, B&W had replaced the troublesome Crosby PORV with a Dresser 31533VX30. In terms of reliability, it was proving no better than the Crosby. There was nothing particularly fatal about a little bit of leakage out the top of the pressurizer, but it was a pain, having to readjust everything as steam slowly escaped the primary coolant system and blew off into the containment building. It was just an irritant, and nothing more. It would be on the list of things to be corrected during the first refueling shutdown, which was not scheduled for two more years.

The men who had built this plant were an industrious, creative lot, and when they found that the resin beads could not be flushed using the factory-designed system, they added a compressed air line from the general-purpose compressed-air system in the plant. The air pipes were about the size of a garden hose. You could just open a valve, and the air bubbles would stir up the beads in the tanks and break them loose from sticking. There was not quite enough air in the system, so they cross-connected it to the instrument compressed-air system, which could then be used to open and close valves remotely, using switches in the control room. But ceasing to manually check those valves would be a problem, as somebody on the previous shift had air-flushed the tanks, but had forgotten to close the air valve. The one-way check valve in the air line was leaking, so for the past 10 hours, pressure from the 5,000 tons of water per hour running through the tanks had forced water up the instrument air line, almost to the point where it would cut off the air going to the valves on top of the eight tanks, which would slam them all shut at once and stop the flow through the steam system. There was an electrical backup system that would prevent such an improbable, almost impossible catastrophe, but it had not been wired up. The valves were supposed to be left open while the steam was running, but you could call up the control room and ask an operator to close the inlet valve on one of the eight tanks. Tanks could thus be cleaned out one at a time as the plant ran at full power.

Schiemann, down at the resin tanks, tried to assess the situation. They had not been able to dislodge the beads, and they had tried everything. A water flush, compressed air turned up all the way, and even steam had been unleashed on Tank 7. Schiemann climbed on top of the enormous water pipe so he could watch the sight glass and see the level of water in the tank. It was hard to see in the dim light. It was 3:58 a. m., and suddenly there was an awful quiet in the normally rumbling water pipe. Uh-oh. The water had backed up in the air pipe just enough to close all the valves atop the resin tanks.

He could feel it under his feet, a water hammer, caused by the sudden perturbation in the steam system, coming down the pipe, hot and fast, like a ballistic missile. He leaped free, just as the pipe jumped out of its mounts and ripped out the valve controls along the walls. Scalding hot water blew out into the room as the pump at the end of the pipe flew apart.

Back in the control room, every alarm tile on panel number 15 came lit up at once, and the warble-horns started going off. The turbine, sensing that it was not going to get any more steam, threw itself off line, and the reactor followed eight seconds later with an automatic scram, ramming all the neutron-absorbing controls deep into the core. The main safety valves in the secondary loop opened and blew the excess steam skyward. It sounded like the building was coming apart. The floor in the control room trembled, as the four main feed-water pumps shut down. Pressure in the reactor vessel, now denied its two primary cooling loops, rose sharply, and in three seconds the PORV opened automatically, blowing extremely hot water and steam into the drain tank on the containment building floor. On the control console a red light came on, indicating that the PORV had received an OPEN signal. Ten seconds later, a green light came on, indicating that the PORV had received the CLOSE signal. The sharp spike in the primary loop pressure had quickly dropped below 1,800 pounds per square inch, so there was no longer a need for an opening in the normally closed cooling system.

The senior men, Zewe, Faust, and the operator Ed Frederick, had seen this before, and knew it was a turbine trip. Regardless of the blinking lights and the pulsating horn blowing in their ears, it was nothing to get panicky about, and all the systems were acting correctly.

This feeling of tense calm lasted about two minutes, when the two high-pressure injection (HPI) pumps, a main part of the ECCS systems, switched on automatically. Now this was something new to Zewe, Faust, and Frederick. Why did the reactor think it needed emergency cooling? The temperature in the reactor was too high for this lockdown situation, and the pressure was too low. A minute later, Schiemann made it to the control room, gasping for breath after having sprinted up the staircase.

At 4.5 minutes after the turbine shutdown, Schiemann had been watching the water level rise in the pressurizer, and he ordered that one HPI pump be turned off, and throttle back the other one. The last thing he wanted was for the pressurizer to “go solid,” and with the pressure this low, the HPI was capable of filling it up. Still the water level rose, and meanwhile the two steam generators had boiled dry, making solidity in the pressurizer a very real possibility.

It had been eight minutes since the trip, and to the horror of the operating staff, the pressurizer was rapidly going solid. Frederick turned off the second HPI pump, thinking that the flow of water into the system was flooding the pressurizer. Still, the temperature in the system rose while the pressure kept falling. It made no sense. Everybody could see that something was wrong, but they did not know what.

Zewe had a hunch. He asked an operator to read him the temperature of the PORV outlet. If it was unnaturally high, it would mean that the green instrument light was wrong.233 If the PORV had not been closed, steam was escaping from the top of the pressurizer, and that would explain the low pressure. The operator shouted the value back to him: 228 degrees. That was not an unreasonable temperature. The valve had, after all, been leaking since January, and that was a little bit of steam getting past the valve cap. Unfortunately, the operator had read the wrong temperature readout. The outlet temperature of the PORV was actually 283 degrees, and the entire primary coolant inventory was draining out through it. The valve was jammed wide open, and the water was boiling out of the reactor core, forcing water up in the pressurizer and out the top. At that moment, when the temperature readout was off by 55 degrees, the TMI-2 power plant was lost, and a half-billion-dollar investment flushed down the drain. At the low pressure allowed by the open valve, the reactor could boil dry.

The critical time is that first hour, when the energy rate from the decaying fission products, freshly made in a core that was running at nearly full power, is falling rapidly from The fuel, the controls, and the oxidized zirconium structural elements247 megawatts down to 57 megawatts. If you can just keep water covering the fuel for that first hour, then everything else will work out fine. It does not have to be cool water or clean water, and it does not have to cover anything but the naked fuel pins, but if any fuel is left without water to conduct the heat away, it is going to start glowing cherry-red and melt down the supporting structures. It happens with merciless dispatch. With its gas-tight metal covering melted away, the uranium oxide and any soluble fission products embedded in it are free to dissolve in whatever water or steam is left in the reactor vessel, and this becomes a perfect vehicle for the highly radioactive, newly created elements to escape the normal confines of the tightly sealed PWR primary cooling system. It goes right out the jammed PORV, with the steam, into the drain tank. Fortunately, all of the fission products are solids, and even if the drain tank is opened they tend to stay inside the building, stuck to a wall or some expensive piece of equipment as the water evaporates.

All, that is, except the iodine-131 and xenon-133. They are gaseous. Iodine is not too bad, because it will corrode any metal in the building and bond to it, and there is a lot of metal in the building for it to cling to and thus not escape. Xenon-133, however, is guaranteed to escape into the outside world, as it will never bond with anything. It has a half-life of 5.24 days, undergoing beta-minus and gamma decay.

After 15 minutes of taking water from the PORV outlet, the drain tank was completely full, but there was still a lot of primary coolant left. The cover on top of the tank ruptured, as it was meant to in an overfill emergency, and the water cascaded down the sides of the tank, across the floor, and into the sump ditch at the lowest point in the building. After a while, the sump was full to the top, and the pumps came on automatically, designed to transfer the runoff into a big tank somewhere else in the building. The pumps, however, were connected wrong. They started pumping the coolant, which eventually would be made radioactive by having dissolved fission products out of the red-hot fuel, into the auxiliary building. It was shared by the two reactors, TMI-1 and TMI-2, and it was not a sealed structure.

After an hour, 32,000 gallons of water had left the cooling system. The main coolant pumps, now pushing steam around, started shaking violently. The operators could feel it through the floor. After 14 minutes, they could stand it no longer and shut off two of the four pumps. The two remaining pumps felt like they were going to explode, so after another 27 minutes, they shut them down. There was now no known cooling system operating in a reactor that had been running nearly full blast less than two hours ago, and the staff had no idea what was happening. The level of water in the pressurizer, which was solid, indicated that the reactor vessel was still completely full.

The fire alarm went off in the containment building. Frederick canceled the siren, and then it went off again. This time, it was the control room fire alarm. But they were in the control room, and a quick glance proved that there was no fire here. Zewe walked around to the back of the console to have a look at the less important gauges. Here he found that the pressure in the containment was going up. What was going on? What was making the air pressure in the reactor building climb? Was something amiss in the primary cooling system? The phone rang. It was Terry Dougherty, former nuclear submarine machinist’s mate, calling to say that the sump pumps in the containment had switched on. As he was talking, Dougherty noticed that the hand — frisker in the hallway, a Geiger counter that checked workers’ hands for radioactivity at the doorway, was sounding its radiation-limit alarm. Its meter read 5,000 counts per minute, which was entirely abnormal.

Brian Mehler, the Met Ed Shift Supervisor for Three Mile Island, having been roused out of bed at 5:00 a. m. by a problem at the plant, finally arrived and was appalled at the conditions indicated by the instruments. The operators were all clustered around the pressurizer instruments, fretting about the high water level. Mehler turned to Schiemann. “Shut the block valve on top of the pressurizer,” he said, thus effectively shutting the barn door after all the horses had escaped. It would have been, of course, the correct action, but it was too late, two hours and eighteen minutes after the shutdown. Now, shutting the blocking valve simply closed off the only outlet for heat that the reactor had, which was the evaporation of the coolant. With that last, noble gesture, the melting began in earnest. It took about eight minutes for the top of

the core to collapse.234

The radiation instruments monitoring the reactor core began to take off, as if it were trying to restart itself. Zewe called for a coolant analysis. If for some reason the boric acid concentration, normally high in a new uranium core, was brought down by dilution from the emergency water that had been injected, perhaps the reactor could go critical with all the control rods fully in? A power reactor was designed to have as much excess reactivity as was safe, to allow a long time between refuelings, and in a PWR some boron in the coolant was there to counteract the reactivity. As the fuel burned up, the excess reactivity would go away and the boron would be chemically removed from the coolant.

Before he was able to make any conclusions, there came another shrill call from Dougherty in the aux building. Something had filled up the sump in the building, and it was now overflowing and going down the floor drain. Just then, the radiation alarm went off in the aux building. There were now 50 people standing in the control room, simultaneously gripped by the sound of the radiation alarm in the containment building. Zewe picked up the intercom microphone and announced a Site Emergency, indicating a possibly uncontrolled release of radioactivity. TMI-2 was going down. If it had been a submarine, everyone would have drowned.

Thirty minutes later, Gary Miller, the TMI Station Manager, became aware of the situation and declared a General Emergency, and at 7:02 a. m. Zewe called the Pennsylvania Emergency Management Agency. Captain Dave, Traffic Reporter for a top-40 radio station in Harrisburg, WKBO, picked up an odd State Police conversation on the CB radio in his car. They were babbling about an emergency at the plant. He called it in to the news director, Mike Pintek, who rang up the Three Mile Island Nuclear Generating Station. The switchboard operator, not knowing what to do with someone wanting to know if the plant was going to explode, switched him to the TMI-2 control room. Pintek connected with the reactor operator who was closest to the phone and got a sense of frantic chaos. The story aired at 8:25 am., and the cat, so to

speak, was out of the bag.235

At this point, although it was not fully realized, the TMI-2 power plant was a total loss. There were several things tried to bring the reactor back to some normal shutdown condition, but all failed. An entirely new set of goals had to be set. The fission products must be kept inside the primary cooling loop and not be allowed to escape into the area surrounding the plant. The public must be informed of the problem and any developments on a timely basis, but not in overly technical terms, causing panic and a mass stampede to get out of Harrisburg. The state and federal emergency services must monitor the landscape for a possible radiation plume and be prepared to relocate anyone under threat of harmful radiation exposure.

By 9:00 am. the radiation counter in the ceiling of the containment building was reading 6,000 rads per hour, indicating that not only had the coolant escaped through the overfilled drain tank,

but that the fuel pins were no longer containing the fuel.236 Hot fuel had lost its zirconium cladding and had dissolved in the steam, sending fission products out of the primary loop. The sealed containment building, made of concrete and steel five feet thick, was a solid blockage

between the wet, steamy radioactive waste and the outside world.237 It held throughout the danger period of the accident, and still stands today.

The uranium-oxide fuel in the reactor, laid bare of any effective cooling, reached temperatures as high as 5,000 degrees Fahrenheit. Normal temperature with the reactor running at full power was 600 degrees Fahrenheit. Nothing approaching this had ever happened in a full-sized, billion-watt power reactor, and the core temperature was way outside the range of the control instrumentation.

The operating crew, supplemented now by a mass of experts from the factory and the NRC, could only guess what was happening. By the time the NRC showed up, at 10:30 am., radiation had started to leak into the control room, and everybody had to wear a respirator to keep from breathing radioactive dust.

At the elevated temperature, the zirconium alloy fuel pins and supporting structure not only melted, they reacted chemically with the steam left in the reactor vessel, making zirconium oxide. This chemical action stripped the oxygen out of the water, making hydrogen gas. At first, the hydrogen escaped with the steam and floated to the top of the containment structure, but when the block valve was closed, it was sealed tightly in the reactor vessel. There were things wrong with the B&W reactor, but vessel integrity was not one of them. With the block valve closed, nothing could escape the reactor. The hydrogen, imprisoned in the vessel, floated to the top, formed a bubble, and exerted gas pressure on the structure. The bubble grew to a highly compressed 1,000 cubic feet, and by Thursday, March 29, it was 20,000 cubic feet.

This situation caused a great deal of anxiety in the control room. There was fear that the hydrogen pressure could either break open the 9-inch-thick, stainless-steel-lined reactor vessel,

or it could explode, or both.238 Furthermore, the fuel, now molten and dripping into the bottom of the vessel, could melt through it. Either scenario would contaminate the area downwind, as far as 10 miles. On Friday evening, March 30, at 8:23 P. M., the Associated Press had gotten wind of the worries about hydrogen exploding in the reactor, and they issued an urgent advisory
to the public.239 Two thirds of the people around Harrisburg who heard this announcement interpreted it as a warning of an impending massive nuclear explosion, a “hydrogen bomb,” and 42,000 left town as quickly as was possible. The next day on the TV show Saturday Night Live, the venerable comedy team of Bob & Ray announced a contest to name a new capital of Pennsylvania. By Sunday, 135,000 people, or 20 percent of everybody who lived within 20 miles of the plant, had voluntarily evacuated.

At the same time, the various emergency holding tanks in the containment building and the auxiliary building were reaching maximum capacity. By Thursday night, March 29, the low-level waste-water tank, containing minimally contaminated water from the toilets, drains, showers, and laundry had reached its capacity of 40,000 gallons. The plant workers did what they always did under this condition. They opened a valve and let it drain slowly into the Susquehanna. There was nothing illegal or even unusual about dumping the water tank, except under these frantic conditions of alert and anxiety. When the Governor of Pennsylvania, Richard Thornburgh, got wind of this in Harrisburg, he hit the ceiling and forbade any further release of anything radioactive. That was unfortunate, because anything that could have been disposed of that had a small enough radiation load to be safe for disposal, would have to wind up on the floor of the auxiliary building, and this made things more complicated than they had to be.

There was no governor’s mandate that could stop the other radiation release, which was the gaseous fission products. The iodine-131 mainly bonded to the inside of the containment building, and although at the peak concentration there were 64 million curies of iodine in the reactor core, the amount that escaped was barely detectable. On the other hand, a great deal

of xenon escaped, and that was 13 million curies.240 That is a lot of radiation, and if it were any other fission product, there would have been long-term evacuation and contamination cleanup in an area ten miles long and a mile wide in an east-northeasterly direction from the plant, or in the direction that the wind was blowing. Xenon, however, is different. Its body burden is practically zero, because human metabolism has no use for a noble element that cannot chemically bond with anything, and so it is not able to bond to our biological bodies and cause us harm. It just floats in the atmosphere, decaying into non-radioactive cesium-133 over 52 days. One can breathe it in but will most likely breathe it back out without experiencing a radiation release in the lungs.

Although it is not generally known, all nuclear power stations make radioactive xenon nuclides while they are generating power, and it eventually goes up in the atmosphere by way of the otherwise inexplicable “smokestack” on site. Gaseous fission products find their way into the primary cooling loop, and they are drawn off in the water makeup system, located in the auxiliary building. Scavenged gases are compressed and stored in the “decay tank.” When the decay tank gets full, a worker turns on a valve, and up the stack it goes. This is routine. The instant it scrammed, TMI-2 stopped making radioactive xenon. The zirconium fuel pins try to keep any gas from getting away, and a lot of it decays in the fuel without escaping, but xenon is good at finding its way into the coolant. The only reason that TMI-2 released a big slug of xenon was that the fuel pins had disintegrated, so the normal hindrances were gone.

The decay tank was purged at 8:00 a. m. on Friday, March 30. A helicopter directly over the stack measured a 1.2-rem-per-hour dose rate at 130 feet over the plant, and the reading immediately tailed off as the gas dissipated. It eventually made a narrow but diluted plume, 16 miles long. All off-site radiation measurements, peaking at about 0.007 rem per hour, were probably due to the xenon gas. In general, nuclear workers are allowed to absorb 5 rem per year, and civilians are allowed 0.5 rem per year. A population group, such as the citizens of Harrisburg, is allowed a collective 0.170 rem per year. Standing at the fence around the Three Mile Island plant for a year, an individual would have received 0.005 rem.

On April 7, 1979, at 2:03 P. M., Three Mile Island Unit 2 achieved cold shutdown. TMI-2 would never again generate any electricity. In the history of the world, it had been the worst industrial disaster in which not one person was harmed. Over the next 20 years, there were certainly cancers among some people who were downwind of the plant, as happens in any group of people over time, but it was difficult to correlate these illnesses with any aspect of the reactor

meltdown at Three Mile Island.241 The most popular T-shirt slogan was “I survived Three Mile Island … I think.”

Many changes in nuclear power training, control-room instrumentation, and pressure-relief valves came down from the NRC in the following years. “PORV” now means “Power Operated Relief Valve,” and not “Pilot Operated Relief Valve.” Dresser Industries, maker of the PORV in TMI-2, put a full-page ad in the New York Times, with Dr. Edward Teller claiming that he was not afraid of nuclear power, but he was terrified of Jane Fonda.

The thorough cleanup operation, costing $1 billion, was completed in 1993. $18 million of the cost was contributed by the government of Japan, with the provision that we include Japanese workers to have experience in a nuclear power cleanup. The final report concluded that 35 to 40 percent of the fuel had melted, while 70 percent of the core structure had collapsed. A surprise to everyone was that there was never a chance of melted uranium oxide burning through the bottom of the reactor vessel. The melt-down had, in fact, formed an insulating layer of ceramic material, a durable mixture of zirconium and uranium oxides, at the bottom of the vessel, and it was impervious to extreme temperature.

TMI-1, the other reactor sitting next to TMI-2, has been quietly generating power and making money for its owner, the Exelon Corporation of Chicago, ever since 1985, when it was allowed to resume operation. Its operating license runs out in 2034. B&W never received another order for a full-sized civilian power reactor. They are now developing a small modular power reactor called mPower.

Could TMI-2 have been cleaned up, refurbished, and restarted? Economically, no. The entire inside of the containment building and every tank, pipe, valve, and piece of equipment inside was hosed down with radioactive fission products having a complex, ever-changing array of half-lives and radiation types, actively breaking down for thousands of years, and it had soaked into the fairly new concrete. It would have been cheaper to have bulldozed the plant into the ground and started from scratch, if only it had been legal to do so.

In the years afterward, there was an eerie quiet in the world of nuclear power. It was as though the worst had happened. Nature and probability seemed to have nothing else up their

sleeves, and all was still.242 Then, early in the morning of April 26, 1986, all hell broke loose in an ancient town in Ukraine named Chernobyl.

In 1986, Ukraine was a close member of the Russia-based Union of Soviet Socialist Republics (USSR), a large conglomeration of geographically connected countries making up Eastern Europe. The government, Communism, was a 20th-century invention being beta-tested, and there was a big ongoing contest with “the West,” which was basically Western Europe and the United States, to find which experimental government system, soviet communism or a democratic republic, could develop the stronger, more dominant economic system. The USSR was still in its pre-war mode, implemented by Communist Party Head Joseph Stalin, to win the competition by having the larger population percentage of engineers, technicians, and scientists, thus advancing more rapidly in a world where technology seemed important. The West was not quite as tightly organized but was giving the USSR a lot of heat. To meet its goal of economic domination and modernization, the USSR saw fit to construct big, powerful nuclear power plants as quickly as possible, while building a vast inventory of nuclear drop-weapons and warheads.

Both goals, electricity and bombs, are met simultaneously using the RBMK reactor concept, a design that was original to the Soviet Union and not, as were some other mechanical motifs, a

copy of Western machinery.243 The RBMK uses blocks of solid graphite as the neutron moderator and water as the coolant, boiling in metal tubes running vertically through the reactor core. It therefore suffers from the worst characteristic of two reactor concepts, the possibilities of a graphite fire plus a steam explosion in the same machine, and it thus wins the prize for the most dangerous method for making power using fission. The advantage of it is the fact that it can be used both for power production and for plutonium-239 conversion. The neutron-energy spectrum produced by the use of graphite plus the fact that it can use natural uranium as fuel made it optimum for plutonium production, and the fuel assemblies can be swapped out while

the plant is running at full power.244 Timely, selective removal of the fuel, as opposed to changing it out during a refueling shutdown, means that the disadvantageous production of plutonium-240 can be minimized. It was designed in the 1950s, when a commercial power reactor in the United States made 60 megawatts of electricity. An RBMK was designed to make a gigantic 1,500 megawatts of electricity, under the belief that overwhelming size would be a factor in winning the global economic contest.

There were some serious design flaws. The reactor core is big—a graphite cylinder 46 feet in diameter by 23 feet high. Each fuel assembly is 12 feet long, and the machine that automatically pulls one out and exchanges it for another requires a space 114 feet high over the top of the reactor. There was no practical way to construct a sealed containment building over this tall machine, so the world is protected from fission products in the reactor by a single barrier, a round, concrete lid, eight feet thick, held by gravity in the reactor room floor. A sheet — metal roof keeps rain off the equipment.

Western reactors use the “scram” system to rush all the controls into a reactor and shut it down as quickly as possible. It takes about three seconds to complete the scram on a General Electric BWR power reactor, from the instant of hitting the big red button to having the controls top out in the reactor core. The equivalent Soviet system is the AZ, or “Rapid Emergency Defense.” Push the big red AZ button, and it takes 20 seconds for the control rods to be

completely in.245 A lot can happen in 20 seconds, but that is not the worst characteristic of a Soviet-style scram.

The control rods are as long as the reactor is high, but the active region in the middle of a control rod is only 16.4 feet long. The rest is just hollow tubes, at the top and bottom of the boron neutron-absorber section. At the bottom of each control rod is a rounded tip made of pure graphite, designed to act as a lubricant that will ensure smooth running of the rod in its metal tube under conditions that would ruin ordinary grease. If a control rod is withdrawn all the way, then the first thing that enters the core during an emergency shutdown is a big chunk of graphite. Putting additional graphite into the core increases the activity instead of decreasing it, so scramming from a condition of all-out rods does the opposite of what is desired for a long five seconds. If the reactor is critical and a shutdown is needed, the reactor goes supercritical until the active section of the rod is able to overcome the positive reactivity introduced by the graphite tip. If the reactor is supercritical when the rod is inserted, then the power rise proceeds at increased speed. Push the rods in one at a time, and this is only an irritation. There are 211 control rods in an RBMK. Put all of them in at once, and the reactivity will increase explosively. Under any normal operating condition, all rods are never out all the way.

Another bad characteristic of the RBMK reactors is the positive void coefficient. The neutrons are moderated down to optimum fission speed by the graphite, which has a very low tendency to scavenge neutrons out of the process. The coolant is water, which does scavenge neutrons, and the water runs through metal tubes perforating the reactor core. There is enough graphite to overcome the negative effects of the water and maintain criticality. If water is lost out of a tube or if it boils dry into steam, then the overall reactivity of the core is improved. The reactor
goes supercritical, and the power level starts to rise exponentially. This is not good. In a PWR or a BWR, which use water for both coolant and moderator, if water is lost or turned to steam, the reactor shuts down instantly. In an RBMK, the power goes up with similar enthusiasm.

The first 3.23 feet of each control rod is a hollow metal tube, and it displaces the water out of

the guide pipe as it is pushed in.246 From an all-out position, the control rod would first introduce graphite to the core, and then empty the cooling water out of the guide.

The water inlet tubes for the reactor all come up from the bottom, which is the logical way to do it, but fear of leakage from these tubes caused the engineers to design a large gallery under the reactor, sealed tightly and filled with water. The tubes run through the water tank, and this will dilute any fission products that happen to escape the fuel, get into the cooling system, and leak out through cracks or failed welds. This seemed like a good idea, but if the core ever melts it will fall directly into the water underneath and flash it into steam. Being tightly sealed with no way out makes rapidly derived steam into a bomb, sitting right under the core. The force of such a blast would be directed upward, making short work of the thin walls and ceiling above the reactor and pushing the big traveling crane above the refueling machine skyward. The mechanical engineers who designed the plant were good at anticipating bad welds but gave insufficient thought to what happens when a reactor runs away.

Chernobyl is an ancient town in the Byelorussian-Ukrainian woodlands on the banks of the Pripyat River, where the land is a featureless steppe. It is at least 1,000 years old, and was most memorable for providing Prince Svyatoslav the First with a particularly spirited, almost feral bride around the year 963. In the 1970s, work began on a cluster of six RBMK-1000 reactors, built on a flat spot 11 miles northwest of the town. A new, modern village, Pripyat, rose up 1.9 miles west of the sprawling plant, just outside the safety zone. Its population grew quickly to 50,000 people. Most employment was at the power plants or in jobs supporting the families living in the area. There were schools, multi-story apartments, a park with a Ferris wheel, a bookstore, recreation center, library, and every trapping of civilization. Reactor No. 1 was completed and came online in 1977, followed by No. 2 in 1978, No. 3 in 1981, and No. 4 in 1983. No. 5 and 6 were still under construction in 1986. Central Planning back in Moscow was dreaming of a 20-reactor complex.

In April 1986, reactor No. 4 still had 75 percent of its original fuel load and was looking at a refueling in the near future, meaning that its core was saturated with a nearly full load of radioactive fission products in its 200 tons of uranium oxide. Nikolai Maksimovich Fomin was Chief Engineer at the station, Viktor Petrovich Bryukhanov was the Plant Director, Taras Grigoryevich Plokhy was Chief of the Turbine Unit, Anatoly Stepanovich Dyatlov was Deputy Chief Engineer in charge of operations for No. 3 and No. 4 reactors, and Leonid Toptunov was

the Senior Reactor Control Engineer.247 The foreman in charge of the reactor section of the plant was Valery Ivanovich Perevozchenko and Aleksandr Fyodorovich Akimov was the Shift Foreman. None of these men and nobody in the entire power plant had a clear understanding of the nuclear end of the power plant. They were experts in turbines, wiring, and mechanical engineering specialties, but had no training or experience that would lead to a comprehension of graphite reactor dynamics. Dyatlov, a physicist, was the most unusually slow-witted and argumentative of the lot, and as one who had an inkling of nuclear experience, he was in charge. He had worked briefly on very small experimental naval reactors, and this may have

given him a distorted view of how a power reactor should behave.

Reactor No. 4 was scheduled to run a safety experiment on April 25, 1986. The Nuclear Safety Committee had long been concerned that if an RBMK reactor were to shut down for emergency reasons while producing power, there would be a delay between having lost power from the generator and starting the diesel engines that ran the backup generators. In this time lapse, the coolant pumps would not be running, and this could cause damage to the plant from a sudden heat buildup. There were theories that one of the eight heavy turbine rotors would have enough momentum to keep its generator turning for a few minutes, supplying just enough power to keep the pumps running, but a previous test at Chernobyl No. 4 had been disappointing. The generator fields had been modified to reduce the drag, and now the committee wanted the test to be run again. The reactor and all the plant systems were to be shut down suddenly, as if a major breakdown had occurred, after which the performance of one turbo-generator would be observed over several minutes.

Gennady Petrovich Metlenko was in charge of the electrical aspects of the trial, and on April 11 he had a special control-panel switch installed, called the “MPA.” The letters in Russian stood for “Maximum Design-Basis Accident,” or the worst thing that could possibly happen. Actuate the MPA switch, and the worst happens instantly. It shuts off the turbine, disables the ECCS, turns off all the pumps, blocks the diesel generators from starting, and basically kills everything that keeps the reactor running smoothly, bypassing the automatic controls. This was a monumentally bad idea.

The experimental sequence started at 1:00 P. M. on April 25, right on time, when Dyatlov ordered the reactor power reduced. No. 4 had been running at maximum power. Five minutes later, the No. 7 turbine was kicked off the power grid and the station’s power needs were switched to turbine No. 8. The reactor was now running at a little over half power. At 2:00 P. M., the ECCS was disconnected. One thing they thought they did not want during the experiment was 12,360 cubic feet of cold water gushing into a red-hot reactor from the ECCS, thinking that it would warp something. Just then, a call came in from the electrical load dispatcher in Kiev, requesting that they delay the experiment a while longer. Demand for electricity in the area seemed to be peaking that afternoon.

At 11:10 P. M. they were able to resume the power-down. At midnight was the shift-change, and the Shift Foreman Yuri Tregub was replaced by Akimov. Toptunov replaced the Senior Reactor Control Engineer. The goal was to level out at 1,500 megawatts, but they had disabled the local automatic control system (LAL) for the test, and Toptunov was having trouble keeping the flux profile balanced as the power dropped. There were too many neutrons on one side of the reactor and too few on the other, and things were getting out of hand as the operators juggled the controls.

A graphite pile is a ponderous beast, and controlling it with no automatic assistance is like driving a concrete truck on the Monte Carlo racing circuit. All actions must be performed slowly, or it will turn over in a curve. The reactor power slid through 1,500 megawatts and kept going, down to 30 megawatts, very quickly. Toptunov had now steered Chernobyl No. 4 reactor into the dreaded “iodine valley,” from which there is no easy return.

What is an “iodine valley”? When a nuclear reactor produces power by fission, one of the many fission products is iodine-135. It is radioactive, and does a beta-minus decay into xenon — 135 with a half-life of 9.10 hours. This is perfectly natural. The energy-releasing beta decay of iodine-135 is a small component of the delayed energy from fission. The product of this decay, Xe-135, is unique in that it has a monstrous thermal neutron-absorption cross section of 2.6 million barns. That is a reaction killer. If the Xe-135 builds up from I-135 decay, then it will snatch so many neutrons out of the normal fission transactions, it will shut down the reactor. Fortunately, one Xe-135 atom can only capture one neutron, activating into Xe-136, which is stable with a very low, 0.26 barn, capture cross section. Xe-135 also undergoes a beta-minus decay, becoming stable cesium-135, also with a low tendency to capture neutrons. A reactor running at high power both makes Xe-135, indirectly, and destroys it by providing excess neutrons to be captured. The neutron population reaches an equilibrium of I-135 production and Xe-135 destruction, and the reactor is able to remain in a critical condition and produce power at a steady rate.

If the power is reduced, then the equilibrium is disturbed. At the lower power level, there are fewer fissions per second and fewer neutrons produced per second, but the level of Xe-135 from the previous, higher power level remains. Recall, the production of Xe-135 from an I-135 breakdown is slow. It takes 6.57 hours for half of it to turn into xenon, so the production rate of Xe-135 continues on at the previously established level. There is now more Xe-135 than the reactor can knock down with surplus neutrons, because its power level has been reduced. More neutrons are captured than are produced, and the power level plummets. If the reactor has enough reactivity in reserve, held in check by the control rods, then the power can be stabilized at the desired level, and the now-excessive level of Xe-135 presence can be “burned off.” After a few hours, the control rods are slowly returned to their previous positions, holding the excess reactivity in reserve. If there is insufficient reserve reactivity, then the power level drops to zero. The reactor is stuck in the iodine valley, and it will take about 45 hours for enough Xe-135 to have beta-decayed away to allow the reactor to be restarted.

Dyatlov was enraged. He paced up and down the control panel, berating the operators, cursing, spitting, threatening, and waving his arms. He demanded that the power be brought back up to 1,500 megawatts, where it was supposed to be for the test. The operators, Toptunov and Akimov, refused on grounds that it was against the rules to do so, even if they were not sure why.

Dyatlov turned on Toptunov. “You lying idiot! If you don’t increase power, Tregub will!”

Tregub, the Shift Foreman from the previous shift, was officially off the clock, but he had stayed around just to see the test. He tried to stay out of it.

Toptunov, in fear of losing his job, started pulling rods. By the time he had wrestled it back to 200 megawatts, 205 of the 211 control rods were all the way out. In this unusual condition, there was danger of an emergency shutdown causing prompt supercriticality and a resulting steam explosion. At 1:22:30 am., a read-out from the operations computer advised that the reserve reactivity was too low for controlling the reactor, and it should be shut down immediately. Dyatlov was not worried. “Another two or three minutes, and it will be all over. Get moving, boys!”

At 1:23:04 am., Igor Kershenbaum, the Senior Turbine Control Engineer, closed the throttle on the No. 8 turbine to begin the test, just as an operator pushed the MPA button in the control room. With the power demand from the turbine stopped, the water in the still-hot reactor began to boil with fury, and the power level shot up as the water left the cooling channels dry. The reactor was now supercritical. The operators watched in horror as the power level rose rapidly, out of control. After observing it for an agonizing 36 seconds, Akimov shouted, “I’m activating the emergency power reduction system!” and he punched the red button for AZ-5, throwing everything in at once.

The reactor was now prompt supercritical at 1:23:40 a. m. The controls jammed after moving only 6.5 feet, versus their usual range of 23 feet. The guide-pipes had twisted and warped as the reactor began to melt. In seven seconds, the reactor jumped to a power level of 30 billion

watts and started to disintegrate.248

At that moment, Valery Ivanovich Perevozchenko, foreman in charge of the reactor section, happened to be standing on a balcony looking down at the lid on the reactor, 45 feet below.

This lid was affectionately called the pyatachok, or the “five-kopek piece.”249 It was 49 feet in diameter, and on top of it were 2,000 fuel bundle covers. Each cover was a heavy cube, weighing 770 pounds. There was a deep rumble, and the entire building began to shake. The cubes started dancing and then leaping into the air. It looked and sounded like a popcorn popper heated with an oxyacetylene torch. The cracking and popping noises were so loud, Perevozchenko could not hear himself scream as he took the stairway down, burning the skin off his palms with friction on the handrails, taking four steps at a time, and descending with the equivalent speed of falling down a well 130 feet deep. He hit the ground at level “+10” and sprinted 229 feet down corridors and through the safety lock to the control room, where he burst through the door shouting the ultimate nuclear understatement, “There’s something

wrong!”250

A loud, percussive noise rocked the building, and the operators bounced off the walls. The

pressure-relief valves on the steam separators had all opened with a collective bang.251 A second later, they all broke free, blasted through the roof, and whistled away into the calm night air. All four separators, each weighing 130 tons, tore out of the floor at level +24 and followed the relief valves, trying desperately to get away. The steam lines into the reactor came loose, and the big tanks of water underneath the reactor instantly boiled to steam under the blast of neutrons radiating from the center of the reactor core. The white-hot zirconium fuel cladding quickly scavenged the oxygen out of every molecule of water it could find. Where there had been water a second ago, there was now superheated steam mixed with hydrogen gas.

The 500-ton cap on the reactor, the five-kopek piece, lifted off as the steam exploded and the middle of the reactor turned into a cloud of radioactive aerosol, taking out the 250-ton refueling machine, the 50-ton crane in the ceiling above it, and the roof of the building. Red-hot chunks of fuel from the periphery of the reactor core fell on the roof of the turbine hall, which was waterproofed with a generous coating of tar, and set it on fire. Endowed with a blast of fresh air through the top of the reactor building, the hydrogen went off with an earth-trembling roar, and the vaporized part of the power plant was lifted to 36,000 feet in the air, contaminating any commercial airliners within 100 miles. Spinning chunks of red-hot debris started falling on Chernobyl reactor No. 3, crashing into the roof and into the ventilator stack.

There had been 1,700 tons of graphite in the reactor back when it was working, but that had been reduced to a crater-shaped remnant of 800 tons. It started burning, first a dull red and then orange, lighting up the scene with an eerie glow. The reactor lid had risen, flipped like a pancake, and come back down into what was left of the core, cocked at a steep angle. The smoke was thick and black and rose vertically in what was charitably described as a “flower — shape.” Half of the 100 tons of uranium was gone. In perspective, the atomic bomb dropped on Hiroshima vaporized 139 pounds of uranium infused with two pounds of fission products collected in one second of extreme power production. The explosion at Chernobyl No. 4 evaporated a 50-ton mixture of uranium, oxygen, and about 800 pounds of fission products produced over the previous three years of power production.

Two men, Protosov, a maintenance worker, and Pustovoit, who was the “odd-job” man at the plant, were night-fishing on the bank of the coolant run-off pond, right where the plant outflow occurs, 1.25 miles from the plant. The fish really liked the warm water, and it was a clear, starry night. It seemed like the middle of summer, and the fish were cooperating.

They turned to look when they heard two rumbling explosions, seeming to come from inside the plant. Then a third explosion reduced the top of the building to flaming splinters, and they watched with mild interest as steel beams and large concrete chunks spun overhead. The turbine hall burst into flames and illumined the enormous column of black smoke. They turned back to their fishing rods. If they got excited every time something around here exploded or burned to the ground, they would never get any fishing done. “They’ll have that out in no time,” opined Pustovoit. Whenever a steam relief valve popped off, which seemed quite often, it sounded like a Tupolev Tu-95 strategic bomber had crashed into the side of a building, and fires consuming switch yards or fuel depots were not rare at the Chernobyl plant. The men sat there and fished until morning, noting that the fish were becoming sluggish. The fishermen each absorbed 400 roentgens of mixed radiation, and they started feeling extremely ill, right where

they were sitting.252

The nonstop vomiting was utterly exhausting. Their skins turned dark brown, as if they had been locked in a tanning bed for too long. They had no idea what had happened to them, but they staggered into the medical center and were quickly sent to Moscow for special treatment. Both survived, and Pustovoit became a celebrity of sorts in Europe, living proof that ignorance hurts.

Back in the control room, the earthquake-like shocks had crumbled the steel-reinforced concrete walls and floor, and light fixtures were hanging down by the remains of power wiring from the ceiling. The instruments and controls were all dead, and the only light was from some battery-powered emergency lights and the electrical arcs from broken power cables. All hand­held, battery-powered radiation detectors available were intended to find tiny contaminations around the plant on the micro-roentgen level. None seemed to be working, as their meters would crash against the stops at the highest indicated level and just hang there. There was no instrumentation available that could read the 30,000 roentgens per hour radiating out of the reactor hole or the 5,000 roentgens per hour streaming from every chunk of fuel or graphite that peppered the site. Akimov, Toptunov, and especially Dyatlov were absolutely certain that the reactor was intact, and all it needed was for water to be pumped into it to bring it down to a proper temperature and establish the cold shutdown condition. Dyatlov relayed word back to Moscow to this effect. There was nothing to worry about. There was a fire on the roof on the turbine building, and their erroneous conclusion was that a 29,000-gallon emergency water tank in the main reactor hall had exploded. They would have the plant back in operation in a few weeks.

Akimov believed this fantasy as well, but he was bothered by the fact that the control-rod locations, as indicated by the clock-like Selsyn dials on the wall, seemed stuck only partway in to the reactor. He summoned two young trainees, Aleksandr Kudryavtsev and Victor Proskuryakov, and told them to run up to the reactor hall and find out why the controls were stuck. “Jump up and down on them, if you have to.” After an arduous trip through a maze of twisted steel, an elevator blown from its shaft, and concrete chunks the size of automobiles that had once been part of the reactor support structure, the two finally made it to where there had once been a reactor. It was simply not there anymore. There were no controls to free up, just a gaping hole. They looked down into the glowing crater, amazed at the sight.

They were aware of strange sensations as they climbed their way back to the control room. The air seemed incredibly fresh, as if a spring rain had just ended, and they could feel the tingling way down in their insides. By the time they made it back, they were brown with “nuclear tans.” Akimov and Dyatlov ridiculed their finding, accusing them of being so clueless, they could not find a reactor the size of a grain elevator. They must have been on the wrong floor and

completely missed it.253

at chernobyl-4, the refueling floor at the plant was not recognizable. Hundreds of helicopter fly-overs had dumped sand into the building in an attempt to stop the graphite fire and shield the environment from the fission-product radiation.

Outside the plant building, the extent of the damage was more obvious. Flames on the turbine hall roof were shooting up above the vent stack, which was 600 feet high. The firemen had arrived within minutes, and they were aware of the gravity of a fire in the turbine hall. As is the case with all high-capacity generators, these were cooled by hydrogen gas pumped through the hollow copper field windings in the stators. There was a great deal of hydrogen gas stored in pressurized cylinders in the building, and with a fire raging they were likely to go off as bombs. It was hard to see how the condition of the plant could be much worse, but they were firemen and they were performing their jobs without contemplating the futility of it. The roof was collapsing onto the turbine floor, where broken pipes were spewing flaming oil over the linoleum, and a broken condensate pump was spewing water contaminated with fission products. Although in the stress of firefighting they could not feel it, the firemen on the roof were in a 30,000 roentgen-per-hour radiation field, and none of them would survive the radiation dosage.

Even as late as 1986, some governments would wish to keep the details and magnitudes of radioactive releases secret from the general, highly excitable local population and certainly from the external world. In this case, the Chernobyl reactor No. 4 was a military asset, and its loss of function was understood to be a state secret. At this early stage of the crisis, the Soviet Union leadership did not realize that the accident would eventually envelop the entire European continent, spreading radioactivity and bad feelings from Norway to Turkey, from Ireland to the Slavic Republic. At the time, the entire concept of the Union of Soviet Socialist Republics and its iron grip on Eastern Europe was in the midst of change, a softening and a relaxation, under a new and forward-looking General Secretary of the Communist Party, Mikhail Sergeyevich Gorbachev. As dawn broke on the morning of April 26, 1986, not even Gorbachev knew that half of the reactor core at No. 4 was airborne, and the question of whether or not anyone should be warned—let alone evacuated—had not come up.

The first inkling of a problem beyond the official border of the Soviet Union was picked up by a border patrol agent on the southeast border of Finland. Finland and the Soviet Union were in an unusual geopolitical relationship. One facet was a bilateral trade agreement, and Finland, coming up in the world, had also purchased a nuclear power plant from its new partner. It was a pair of new VVER-440 reactors, the Soviet version of the Westinghouse PWR, and not an RBMK. Part of the deal was that Finland had to return all the spent fuel to Russia for plutonium extraction.

Upon receiving the new power plant, the Finlanders were distressed by the poorly designed process-monitoring and control equipment in the plant, and so they redesigned and built their own replacement with some Western help. They realized that if all the Soviet reactors were built this way, eventually there would be a problem. Quietly, the government of Finland

constructed a sophisticated radiation-indicator net covering the entire country.254

Early in the morning of April 26, the border agent noticed that the radiation instrument on his wall suddenly jumped to the red side. He picked up the phone and dialed the state department emergency number. His alarm made its way up to the highest floor, slowed by a government employees’ strike, but finally informing the Prime Minister, Kalevi Sorsa. Being a man of unusual intelligence, he decided that no news medium was to be informed, as it would irritate the Soviet

Union and only cause trouble.255 The long radioactive cloud passed overhead in Finland, stalling and depositing dust in the northern territory. Entire herds of reindeer had to be buried, and people were advised not to pick mushrooms and berries. So began the dusting of western Europe, not just with some xenon and iodine, but with examples of every fission product across

a wide spectrum of potential danger, human body burden, and half-lives.256

Meanwhile, in the light of the new day, the damage at reactor No. 4 was painfully obvious. The brave firefighters had to admit that the old rumors about graphite fires were true. Pouring water on a serious graphite conflagration only makes it worse. The Soviet government, now fully briefed and on board, sent legions of heavy-lift helicopters to Chernobyl carrying 4,000 tons of sand, clay, lead, and boric acid, everything they could think of that would quench the still-raging fire, stop the rising column of radioactive smoke, and discourage further criticality in a semi-reactor now devoid of neutron controls. The effort eventually worked at putting out the fire, but it also put an insulating blanket over a source of heat. Before long, the heat buildup melted everything below the covering. Concrete, steel, graphite remnants, and remaining fuel melted into a flowing lava, dripping and spilling into the underground basement of the power plant. The helicopters and the men who flew them were heavily contaminated from the smoke after several trips over the crater. The helicopters had to be abandoned at a landing site, and the men had to go to Moscow for radiation-poisoning treatment. The accident was still a state secret, and no alerts were issued to anyone who was not in the immediate area.

The entire town of Pripyat had to be evacuated, population 50,000. Buses lined up for as far as the eye could see, and residents were told to bring just a toothbrush and a change of clothes. “It will only be for a few days,” they lied, “so don’t pack up your belongings.” Everyone had to be relocated, never to see Pripyat again. In all, 135,000 people were evacuated from the area, and it had to be fenced off.

The next morning, early on April 27, nuclear engineer Cliff Robinson was walking down the hallway to his office at the Forsmark Nuclear Power Station, a triple BWR plant near Uppsala, Sweden. He had eaten breakfast in the break room and was now reporting to work. There were radiation detectors all over the plant, used to make certain that no worker would accidentally walk out of the building with any radioactive contamination on his clothes. They were pre-set to low count-rate levels, just above the background level of radiation. One went off just as Robinson passed it in the hall. Startled, he stopped, lifted a foot, and scanned the bottom of it with a hand-held “hockey-puck” probe. The counter went wild.

His first thought was that World War III had broken out and someone had dropped an atomic bomb nearby. His second thought was that something had broken loose in the plant. He called his boss, who picked up the phone to alert the Swedish reactor safety authorities, who demanded that the source of the radiation leak be found immediately. A thorough search found that it was not coming from anywhere in the plant. It had come in on Robinson’s shoes. By 12:00 Universal Coordinated Time, they had determined that the source was a nuclear reactor, somewhere in western Russia. Finland agreed.

At that moment, the world became officially aware of the disaster at Chernobyl, and the Soviet Union started the long slide to oblivion. This accident was so large in scope, so nerve — rattling for everyone downwind, there was no hiding it or denying that anything had happened. Of all the firemen, emergency response workers, and power-plant personnel at Chernobyl, 127 people suffered from acute radiation poisoning, and in the first three months, 31 died. Eventually 54 deaths would be directly attributed to radiation exposure due to the destruction of the reactor, but the even larger tragedy was the spread of the pulverized contents of the reactor core. The uranium fuel was not the problem. Having 50 tons of uranium distributed over most of Europe would not noticeably change the background radiation danger or even the uranium content of the landscape. Most minerals in the ground contain trace amounts of uranium, and it tends to be evenly distributed in the Earth’s crust. Most of the exposed uranium has been washed into the ocean long ago. The transuranic nuclides, such as plutonium-239, are unnatural and dangerous, but they are a small percentage of the fuel mass.

The long-lived fission products are not the huge problem that one might expect. Much is made of the fact that fission products will be around for hundreds of thousands of years, and having them sprinkled over Europe seems disastrous. But a long half-life means low reactivity. Molybdenum-100 is a fission product that lasts a long time, but with a half-life of seven million- trillion years, it is barely alive from a radiological perspective and is hardly a threat to living things.

Nor are the short half-life fission products a problem. They are vigorously radioactive, but only for a short time. The big scare is from iodine-131, which decays with beta-minus/gamma radiation, and it is sought by the human body for use in the thyroid gland. However, with a half­life of only 8.023 days, its concentration in the environment decreases rapidly, and it is essentially gone after 80 days.

The big problem is in the middle ground, between the long-lived and the short-lived radioactive species. Strontium-90, for example, is chemically similar to calcium, and the human body seeks it for bone replacement. It has a half-life of 28.8 years, making it active enough to be very dangerous with a lifetime of several generations. The same is true of cesium-137, with a half­life of 30.07 years.

The total human impact of the Chernobyl disaster on human lives in the next 100 years will be difficult to measure. As many as 4,000 cancer cases due to fission-product uptake are predicted.

Even though the power-plant complex was badly damaged and littered with debris from reactor No. 4, the electrical needs of Ukraine were such that reactors No. 1, 2, and 3 were kept running. No. 3 was the last to be shut down permanently, on December 15, 2000. A sarcophagus made of concrete 660 feet thick was poured to cover up the remains of reactor No. 4. The radiation exclusion zone around the complex is a nature preserve, now populated with animals that had lived there before mankind cleared the land and built structures on it. In the deepest recesses of the destroyed reactor in a field of heavy mixed radiation, a new form of black fungus has found it a nice place to live. It seems to love the lack of competition for the space.

It seems unfortunate, but nothing was learned from the Chernobyl disaster. It did not, for example, lead to a better understanding of reactor accidents or an improvement in reactor design. At the time of the catastrophe, the graphite boiling-water reactor design was already history in the West, and its obvious mechanical flaws and lack of operational knowledge were two trains heading to collide on a common track, and the isolation that the Soviet engineers operated within was in large part to blame for this fundamental flaw in the plant’s design.

The causes of the Chernobyl-4 disaster were complex, reaching deep into the social, political, and economic structure of the Soviet Union, and it was most likely a component of the complete collapse of this government four years later. It could theoretically have been avoided, but that would have required a complete rebuild of Soviet attitudes toward building the future, fiercely competing with the rest of the world, and placing value on the individual citizen. Such changes would begin to come about, but not before the Chernobyl reactor’s self-destruction had deeply wounded the industrial fabric of the Union of Soviet Socialist Republics and embarrassed it to the rest of the European continent and beyond.

From what the Western nuclear engineering community could tell, the big Soviet graphite reactors were of questionable design and likely to give trouble. The Soviets had their own way of accomplishing engineering goals, and they were not necessarily open to contemplate negative Western opinions. Conversely, we were not interested in their opinions of our nuclear power systems.

The next disaster, though, would involve American engineering, and there would be no excuse for it. Events started tumbling toward disaster at 2:46 on a Friday afternoon, off the northeast coast of Japan.

222 The MSE/14 was the mil-spec equivalent of the Data General Eclipse S/140, a 16-bit industrial control computer. The military designation was AN/UYK-64(V) (“yuck sixty-four”) or 1666B. They were used in the Ground-Launched Cruise Missile and Sea-Launched Cruise Missile (“glick’em— slick’em”) military programs as the launch-sequencers, but the GLCM (BGM-109C Gryphon) went away with the INF Treaty in 1988. SLCMs (BGM-109 Tomahawks) were last used on March 22, 2011, against targets in Libya.

223 The reactor used in most pre-ballistic missile subs was the S2W, built by Westinghouse, and all operators were trained on the S1W at the NRTS, running at about 5 megawatts. The first nuclear aircraft carrier, the USS Enterprise, which was basically a floating air-base, used a great deal more power than a streamlined attack submarine, but it did not use a scaled-up power plant. It used eight little reactors instead of one big one. This design was brilliant, and it solved many potential problems.

224 Only 200 MeV are eventually recoverable. Of the 210 MeV released by fission, 10 MeV is in the form of escaping neutrinos from beta decay of fission products. Neutrinos have such a minuscule interaction cross section with matter, they can go clean through the Earth and out the other side without disturbing anything.

225 Much argument is made by anti-nuclear factions concerning the power conversion efficiency of only 32%. No great effort is made to efficiently run the steam turbines in a nuclear plant, and 68% of the power is lost in the cooling towers. The thermal pollution into the environment is therefore unusually large. A coal-fired power plant is typically 40% efficient, but to achieve this, a great deal of effort is required using a lot of fancy expensive, and crash­worthy plumbing. This difference is because of the expense of mining coal and transporting it to the power-plant site, and the environmental damage done by burning it. The amount of coal used must be minimized at any cost. Fuel cost and its transportation are no problem at a nuclear plant, and the steam system is made as simple as possible for the sake of reliability.

226 Unit 3 came online on August 18, 1976, and is licensed to operate until July 2, 2036. While under license to operate, it has achieved an impressive capacity factor of 99 percent.

227 This was hardly the first or the only fire in nuclear-plant cable trays. There were two cable fires at San Onofre Unit 1 in 1968, one at Nine Mile Point Unit 1 during startup testing, and a cable tray fire at Indian Point Unit 2 that started in a wooden scaffolding. There were 11 cable-tray fires in nuclear plants before Browns Ferry in the United States alone, and foreign cable fires are numerous. On May 6, 1975, a fire very similar to the Browns Ferry incident occurred at the Deutsches Electronen Synchrotron (DESY) near Hamburg, Germany.

228 There was some further bad luck at Browns Ferry The operating license was pulled in March 1985 because of operational problems, and the entire plant was idled for over a year. It turns out that all nuclear plants do not have the iconic concrete, convection-driven cooling towers looming over the site. Browns Ferry instead has six smaller, forced-draft cooling towers, with water flowing over slats made of redwood. With the reactors down, there was no cooling water on the slats, and they dried out in the Alabama sun. On May 10, 1986, an attempt to start up the electrical fans ignited the dry wood in a tower, which was four stories tall, 30 yards wide, and 100 yards long, and the entire structure burned to the ground. It is the only case of a nuclear-plant cooling tower being destroyed by fire.

229 B&W reactors were named by the number of fuel assemblies (FA) in the core. In this case, it was 177. Each fuel assembly holds 208 fuel pins, which are zirconium tubes filled with cylindrical pellets of uranium oxide, each 12 feet long.

230 The PORV was able to keep enough force on the valve to keep it closed without using a spring even though the same steam pressure that was trying to open the valve was used to keep it closed. This was possible using a hydraulic trick. The surface area of the piston used to hold down the valve cap was larger than the opening of the pipe that the valve was closing. This ensured that the force from the piston was always bigger than the force opposing it from the steam pipe. This was a fine concept, but unfortunately the mechanical precision required was more than could be supported in the rough-and-tumble world on top of a power reactor.

231 The PORV used in the Davis-Besse reactor was a Crosby model HPV-SN. It was repaired and put back into service, but it failed again on 5/15/78 (broken valve stem) and 10/26/79 (pilot valve and main disk leaking). The Crosby valve was not used in subsequent B&W installations of 177FA reactors. The missing unit in the rack was specifically the “seal-in relay.”

232 The film starred Jane Fonda as a television reporter, Michael Douglas as her camera operator, and Jack Lemmon as the shift supervisor at a fictitious nuclear power plant in California. It was inspired by the Browns Ferry fire, which had occurred two years earlier, and it was a fair assessment of the growing public angst over nuclear power. Although there was a great deal of built-up worry and end-of-the-world dread in the movie, nothing melted, there was no radiation escape, and the reactor safety systems basically acted as they were supposed to. The only harm to come to any of the characters in the movie was by sniper rifle and motor vehicle. It was thus a parody of a typical commercial nuclear plant accident.

233 The green light was correct. The PORV had been signaled to close. But that did not mean that the valve had closed, only that the request had been made. In this way the instrumentation in the B&W control room was not adequate. There should have been another set of red/green lights to show the physical state of the valve, opened or closed.

234 Unfortunately at this moment the confusion factor in the control room was at its peak. George Kunder, the plant engineer, was on the phone in the back of the room with Leland Rogers, the B&W rep on site. He was familiar with the Davis-Besse incident and was an expert on the 177FA reactor systems. He listened to the symptoms and then asked Kunder, “Is the block valve closed at the top of the pressurizer?” Kunder replied yes. It had been closed moments before. Unfortunately, Rogers did not ask “How long has it been closed?” If only he had known that the pressurizer drain line had been open for over two hours, he would have instantly known what the problem was, and he would have told them to re-open it until they could get enough water into the system to re-start the coolant pumps. With his partial information, he did not realize that 250,000 pounds of coolant had blown out of the system, and all subsequent diagnoses were wrong.

235 After his short conversation with a reactor operator, Pintek called Blain Fabian, Communications Director at Med Ed, and eventually got a prepared statement for his radio announcement: “The nuclear reactor at Three Mile Island Unit Two was shut down as prescribed when a malfunction related to a feed-water pump occurred about 4:00 am. Wednesday [March 28]. The entire unit was systematically shut down and will be out of service for about a week while equipment is checked and repairs made.” The announcement proved to be wildly optimistic.

236 The radiation dose rate was correctly measured in rads and not rem, because there was not a human being in the containment building. A rad is simply the radiation dose that causes 0.01 joule of energy to be absorbed per kilogram of matter. To be expressed in rem or sieverts, the dose must be multiplied by a factor that depends upon the type of radiation and its effect on an average-sized man.

237 Commercial PWR power stations at the time were built with containment structures that could withstand a direct hit from a jet airliner, which was the worst accident that an engineer could think of. This was long before the 9-11-2001 terrorist attack in New York City in which two airliners were used to take down two skyscrapers.

238 The level of concern about the strength of the reactor vessel and a hypothetical hydrogen explosion shows the extent of technical hysteria in the control room. To explode, hydrogen must have a similar volume of free oxygen, and there was zero oxygen in the vessel. If there had been, then the hot zirconium would have scavenged it away Moreover, every water-cooled power reactor has passive hydrogen recombiners built into the primary cooling loop. A catalyst, usually platinum, is used to recombine hydrogen and oxygen back into water after it has been broken down in the severe radiation environment of controlled fission. The reactor vessel for the B&W 177FA was designed to handle 2,500 pounds per square inch of internal pressure, and the hydrogen pressure never approached this value.

239 There was a hydrogen explosion at TMI-2, but nobody knew about it until much later, when data recordings were analyzed. Hydrogen entrapped at the concave ceiling of the containment building was set off by a spark and combined explosively with the air in the building. In the control room it was felt as a big thump, but nobody was certain what it meant. The containment building, which is quite robust, was not affected. I have mixed feelings about AP’s announcement. I am all for telling the public what is going on, as this very book attests, but to let them leap to the conclusion that it would be a thermonuclear explosion was criminal.

240 For the sake of simplicity, I have limited this account to Xe-133. Actually, fission makes 18 xenon nuclides, from Xe-129 to Xe-146. Most have half-lives of seconds, and they never make it out of the fuel. Xe-135 is sometimes measured in reactor off-gas, but it has a half-life of only 9.1 hours. Three of these nuclides are not even radioactive. Xe-133 is probably the culprit in all radiation measurements outside the TMI power plant.

241 Immediately after the incident was declared over, hundreds of people in the area reported a metallic taste in the mouth, nausea, skin rashes, and hair loss, the symptoms of having stood atop a reactor as its power spiked way above design limits. There were rumors of cancer, sudden infant deaths, and stillbirths. These reports did not correlate with any measured radioactivity. The only thing that was able to escape the containment building was some radioactive gas, and it was gone within hours. Radiation-induced cancer has a latent period of about 20 years. The TMI-2 accident did cause illness, but it was most likely psychological and not radiological.

242 It was relatively still, at least. In September 1982, the No. 1 RBMK reactor at the Chernobyl Nuclear Power Plant experienced a partial core meltdown. Such minor incidents were not brought to the attention of the greater world of nuclear power, as the Soviet government was very careful not to release any information unless they had no other choice.

243 RBMK (Реактор Большой Мощности Канальный) means “high-power channel-type reactor.” Although it was considered obsolete even in Russia by the 1970s, there were RBMK power plants under construction as late as 1993. There were 26 RBMK reactors planned, eight were cancelled in the middle of construction, and 12 are still operating.

244 Natural uranium fuel was a goal, but very low, two-percent enriched fuel was usually used in RBMK power plants. This was still cheaper than the higher enrichment used in the PWR and BWR reactors which were so popular in the West. After the Chernobyl disaster, the RBMK fuel enrichment was increased to 2.4 percent to compensate for revisions in the control-rod design.

245 There is not one AZ button for an RBMK; there are five. By choosing a low-numbered AZ button, an operator can gently shut down the reactor with a minimum amount of inserted negative reactivity without shocking the system too badly Hitting button AZ-5 throws everything in at once, giving a rapid, absolute shutdown. Unlike most Western reactors, the control rods are not hastened into the core using hydraulic cylinders, but are driven in by the electric servo motors that are normally used to position them, running at maximum speed.

246 This is no longer the case. After the smoke had cleared from the Chernobyl disaster, the control rods in all RBMK reactors were ripped out and replaced with an improved design.

247 Fomin rose rapidly through the leadership posts and was Deputy Chief Engineer for Assembly and Operations when he knocked Plokhy out of the position as Chief Engineer. Although the Ministry of Energy did not support the decision to promote Fomin to this post, he had the solid endorsement of the Central Committee of the Communist Party, Nuclear Division, and that was all that was needed.

248 Four nuclear power plants were not the only high-tech equipment headquartered near Chernobyl. There was also the Chernobyl-2 over-the-horizon radar station, code-named DUGAR-3 and known to ham radio operators in the West as “the Russian Woodpecker.” It was a 10-megawatt radio transmitter feeding the world’s largest directional high-frequency antenna, and its signals, which sounded like a woodpecker hammering on a tree, disrupted amateur radio communications on the 20-meter band beginning in 1976. The antenna was 150 meters tall and 500 meters wide, and this masterpiece of mechanical engineering weighs about 14,000 tons. The NATO code name was “Steelyard.” It was looking for intercontinental ballistic missiles fired at Russia from the United States. Suddenly at 1:23:40 am. local time, the woodpecker went silent and never jammed the 20-meter band again. When reactor No. 4 went wild, it disturbed the power feed to the transmitter, and the woodpecker went dark. The antenna is now in the radiation exclusion zone, and the station cannot be manned. See it on Google Earth by searching on the name “Russian Woodpecker.”

249 In the Old Days of Tsarist Russia, the five-kopek was a comically huge brass coin, made large so that one could use it to buy bread from a street vendor without removing a mitten. One kopek was 1/100 of a ruble, roughly the equivalent of a U. S. penny.

250 Level +10 is ten meters above ground. The turbine hall sump is at level -5.2 and the reactor building floor is at level +35.5.

251 The steam-relief valve was invented by the French physicist Denis Papin in 1679, making possible the subsequent invention of the pressure cooker, or “Papin’s digester.” The old valves used weights or steel springs to hold back the steam pressure, and these units would open gradually with a groaning or wailing noise. By the time nuclear-powered steam plants were being built, the steam-relief valve had evolved into a mechanism that would open with digital precision amounting to a controlled explosion. There was something to be said for the old ways.

252 The Soviets did not bother to put their radiation dose estimates into human terms using rem instead of R units or to use the metric SI system. The degree of radiation exposure, however, is starkly evident. One can survive a 400 R exposure, but it really stings. Firemen on the roof of the turbine hall were getting 20,000 R/hr, which in an hour will kill an adult male 20 times over.

253 Kudryavtsev and Proskuryakov were immediately sent to the infirmary at reactor No. 3, and from there to Moscow for special treatment of extreme radiation sickness. They, and almost everyone else at reactor No. 4 who had survived the explosions, died in agony in a few weeks.

254 Countries that have nuclear power plants are by now equipped with networks of fixed radiation detectors feeding into central monitoring stations using Internet connectivity. The radiation-monitoring network in the United States, named RadNet, is operated by the Environmental Protection Agency If you have been on top of a building lately you may have noticed an innocuous metal box standing on a short pedestal. That is the radiation detector and data transmitter. In Japan, the similar system is named SPEEDI.

255 Is this account of the first radiation fall from Chernobyl believable? Maybe. It was given to me by a very reliable source, but the monitoring station was about 760 miles away from the No. 4 reactor. The vanguard of the radioactive dust release would have to have traveled at 100 miles per hour to get there early on April 26. It is not impossible, as the radiation cloud very quickly reached 36,000 feet, which would put it at jet-stream altitude, where the wind blows at 100 miles per hour. The jet stream usually blows east to west, and Finland is north-northwest of Chernobyl, but the jet stream is capable of north-south looping. Officially, Finland discovered a radioactive dust-drop at exactly the same time it was noticed in Sweden, thus absolving Finland of any independent whistle-blowing. Later, the stream turned east-west and laid down a swath of radioactive dust nearly 1,000 miles long across the southern Soviet Union.

256 As of 2009, radioactivity in Finland mushrooms was still being detected.

Chapter 10