The Three Mile Island Disaster

1
The Three Mile Island Disaster

• The Three Mile Island Nuclear Power Plant was
  split into 2 Units. TMI 1 and 2, each with its
  own reactor and power generating equipment.
• The incident occurred on March 27, 1979 in TMI-2.
• The reactor was operating normally and at 97 of
  its 1000 Megawatt capacity.

2
The TMI-2 Reactor

• Like any nuclear power plant, the TMI system was
  split into 3. This is to keep the radioactive
  reactor coolant contained.
• The Primary Loop, which includes the reactor and
  the coolant.
• The Secondary Loop, which deals with the actual
  power generation.
• And the Tertiary Loop, which cool the plant and
  contains the large cooling towers.
• For this incident we are only concerned with the
  Primary and Secondary loops.
• Each loop relies on the other working correctly.

3
The Primary Loop

• The Reactor core heats up the surrounding coolant
  water.
• This water then passes through the steam
  generator, which is essentially a heat exchanger.
• The cool water then carries on through the
  primary loop and back to the reactor core.

• The pressuriser maintains the correct water
  pressure in the loop by creating a controlled
  steam bubble.

4
The Secondary Loop

• The steam comes from the steam generator and
  passes through the safety valves into the
  turbine, which produces the electricity.
• The steam then passes into the condenser.
• The now cool feedwater returns to the steam
  generator.

5
Feedwater Shutdown

• A high pressure water line connected in error to
  the feedwater valve control air line.
• Water forces its way into the valve control
  system.
• Water reaches the valve controls
• Almost every valve in the feedwater system slams
  shut, starving the Once Through Steam Generators
  (OTSGs) of feedwater.

6
Emergency Feedwater Pumps Started

• These pump fresh feedwater into the OTSGs to
  take the residual heat out of the reactor.
• However, the feedwater had been blocked from
  these pumps during routine maintenance and never
  restored.
• The indicator showing this was covered by a tag,
  and operators didnt check it.

7
Turbine Trip

• The plants safety systems trip the turbine, to
  try and stop the steam generators from boiling
  dry.
• This diverts the steam straight into the
  condenser.
• Due to a design flaw, the condenser tripped,
  which meant that steam was vented into the
  atmosphere and feedwater is lost.

8
Reactor Trip

• Due to the loss of feedwater, the OTSGs were not
  taking heat from the primary loop coolant.
• This caused the pressure and temperature in the
  reactor vessel to rise.
• The control system detected this and tripped the
  reactor.

9
Automatic Pressure Relief Valve Opens

• As the heat in the Primary system increased, so
  too did the pressure, so the automatic relief
  valve was opened.
• This vented steam into a quench tank.
• However, the valve was faulty, and did not close
  as it should of done.
• The indicator on the control board showed
  otherwise, as it showed what the valve had been
  instructed to do, rather its actual status.

10
Extra Coolant Pumps Started

• As the reactor coolant cooled and shrank the
  water level in the primary loop dropped.
• To make up for this extra coolant was pumped into
  the reactor vessel.
• The water level steadied then began to rise
  quickly.
• A very dangerous situation was developing the
  primary loop should never be full of water.

11
Steam Generator Boils Dry

• As the emergency feedwater valves were still
  closed no water was getting into the OTSGs.
• This meant that no heat was being taken out of
  the steam generators. This in turn led to a
  temperature rise in the primary loop.
• The staff didnt realise why, as they didnt know
  that the valves were closed.

12
Primary Loop Temperature Rises

• Because there was no feedwater going to the
  OTSGs the temperature was not being taken from
  the reactor coolant.
• Due to the open relief valve pressure, however,
  was dropping.
• This confused the operators as generally if
  temperature rises, so does the pressure.

13
Disaster Approaches

• If the primary loop pressure fell low enough or
  the temperature rose enough then the coolant
  would boil.
• This could lead to the fuel rods being uncovered
  and cooled only by steam.
• This would lead to the fuel rods overheating,
  which could in turn lead to a meltdown.

14
Further Relief Valves Opened

• Too much coolant could be disastrous, as if the
  primary loop was full then any shock could be
  enough to damage coolant pipes or pumps, leaking
  yet more coolant.
• To try and stop this the operators opened release
  valves to try and combat the rising coolant water
  level.
• As the pressure dropped even more, automatic
  systems started pumping coolant back into the
  reactor vessel.
• The operators, not knowing the relief valve was
  open shut them down.

15
The Twelve's are Closed!

• Finally, one of the operators stopped eating his
  doughnuts and decided to check the feedwater
  system.
• He moved the paper tag and noticed that the
  emergency feedwater valves (12A and 12B) were
  closed.
• He opened them and feedwater at last entered the
  OTSGs and began to take some heat from the
  reactor.
• The temperature rise slowed, but didnt stop.

16
Main Coolant Pumps Shut Down

• As the relief valve was still venting pressure,
  and the temperature was high the coolant began to
  boil.
• Steam bubbles moved through the system until they
  got to the main coolant pumps.
• These began to vibrate as they strained to move
  the steam.
• The operators had to shut them down before they
  got damaged and caused a coolant leak.

17
Reactor Core Uncovered

• As there was now no movement in the coolant,
  steam bubbles began to form.
• One such bubble formed in the top of the reactor
  vessel.
• This pushed the water level below the top of the
  core, which began to overheat as it became
  uncovered.

18
Human Errors

• One of the operators suspected that the relief
  valve may be stuck, so he asked a technician for
  a temperature reading. A high reading would
  indicate that it was open.
• The technician read the wrong reading, instead
  giving the temperature of another, normal valve.

19
Human Errors

• The steam that was venting from the relief valve
  was routed to a quench tank. This tank
  eventually filled and broke a safety disk.
• This caused the radioactive water to flood the
  containment building.
• One of the operators decided to check the level
  in the quench tank, but only after the safety
  disk had broken and the level was normal.

20
Fresh Eyes

• As the new shift began to arrive one of the
  engineers spotted the link between low pressure
  and high temperature.
• He closed another valve, between the stuck relief
  valve and the quench tank.
• As he did this the coolant pressure began to
  rise.
• This was around 2 hours into the emergency.

21
Evacuation

• The water that had leaked into the containment
  building found its way into the plants auxiliary
  building, via the drains.
• This caused the radiation alarms to sound, and
  the building was evacuated.
• A site emergency was then declared, and nearby
  towns began to be evacuated.

22
Core Status

• At this point the operators had no idea of the
  status of the core, or the water level inside the
  reactor vessel.
• No water level sensors were installed as they
  were not deemed necessary.
• The temperature was not known either, as the
  software was only calibrated up to 700 degrees.
• A team was sent directly to the cables from the
  reactor core to read the thermocouple directly.
• They found the temperature was around 10,000
  degrees!

23
Hydrogen

• When the material that was used in the fuel rod
  cladding is exposed to steam and high
  temperature, a chemical reaction occurs.
• The cladding is destroyed and hydrogen released.
• This hydrogen collected in both the reactor
  vessel and the containment building atmosphere.

24
Explosion

• The hydrogen in the containment building was
  ignited by a spark from a relay.
• The resulting explosion was as powerful as
  several thousand pounds of explosive, and created
  around 80psi of strain on the containment
  building.
• Luckily, this was easily absorbed by the over
  engineered structure and no damage was caused.

25
Hydrogen In The Core

• The hydrogen in the core was bad news, as
  hydrogen is even worse a coolant than steam.
• Also, while the steam bubble could be relatively
  easily dispersed, hydrogen is much harder to
  remove.
• There was a risk that because of the radiation,
  water could break down and release oxygen into
  the core.
• Calculations indicated that 5 oxygen would be
  enough for an explosion and with 11 oxygen the
  oxygen/hydrogen mixture would self-ignite.

26
Getting The Reactor Cooled

• At first pressure was dumped to allow a
  low-pressure pump to get some coolant into the
  primary loop. But the main coolant pumps needed
  to be restarted.
• The automatic safety systems would not allow it
  to start because of the abnormal reactor
  conditions.
• Eventually, these systems were overridden and the
  pump started.
• 15 hours after the onset of the incident, the
  reactor was being cooled again.

27
Removing The Steam Bubble

• Over the next few days the steam and hydrogen
  bubble had to be removed from the reactor vessel.
• Although some of this was done chemically, they
  had to vent some radioactive gas into the
  atmosphere. There was still a fear of a hydrogen
  explosion.
• It is believed that the reactor vessel contained
  at least the 5 oxygen required for combustion
  for at least 24 hours.

28
The Aftermath

• Every one of the 36,000 fuel rods in the core had
  ruptured, contaminating the primary coolant with
  radioactive gases.
• For 2 hours, over 70 of the core had been out of
  water.
• The core itself was little more than rubble.
• Parts of the core had reached over 4000 degrees,
  only a few hundred below the fuel rods melting
  point.

29
The Aftermath

• Thousands of curies of radioactive gases had been
  released into the atmosphere.
• Radioactive water had been dumped into the
  Susquehanna river.
• The last venting of gas occurred in 1981.
• All of the contaminated water has now been
  evaporated.
• Most of the fuel has been removed and radiation
  levels are relatively low.
• The unit will be completely decommissioned in
  2005, at the same time as TMI Unit 1.

30
RTS Issues

• Why were the water and air lines compatible?
• Why was the plant allowed to function when the
  emergency feedwater was blocked?
• Why were the indicators on the control panel
  covered?

31
RTS Issues

• The plant warning system was clearly inefficient
  the warnings were being printed, but the
  printer was 2 hours behind due to the number of
  warnings.
• Message Prioritisation?
• There was no warning at all of the stuck release
  valve? The system only showed what the valve had
  been commanded to do, rather than its actual
  status.

32
RTS Issues

• Why was there no indicator of the status of the
  quench tank safety system?
• One of the technicians gave a reading from the
  wrong valve user incompetence or bad design?
• The system had to be over-ridden before the
  coolant pumps could be restarted. Again, bad
  systems design?