The Three Mile Island nuclear power plant is located on the Susquehanna River in Pennsylvania, USA, 16 km from the state capital, Harrisburg, a city of 90 000. It has two 900 MW(e) units with pressurized water reactors designed by Babcock and Wilcox. The second unit of the site started commercial operation on December 30, 1978.

1. Cash Study
of
Three Mile Island of Nuclear Melt Down
By:
1. Anil Berad ( U10CH006 )
2. Kashish Gupat ( U10CH007 )
3. Rohit Meena ( U10CH008 )
4. Kavaiya Ashish Rajeshkumar ( U10CH010 )
5. Avneesh Kumar Maddheshiya ( U10CH011 )
Submitted :
Mrs. Smita Gupta
1Chemical Engineering Department,
Sardar Vallabhbhai National Institute of Technology,
Surat-395007

2. The Three Mile Island nuclear power plant is located on the Susquehanna
River in Pennsylvania, USA, 16 km from the state capital, Harrisburg, a city of
90 000.
It has two 900 MW(e) units with pressurized water reactors designed by
Babcock and Wilcox.
The second unit of the site started commercial operation on December 30,
1978.
The Babcock and Wilcox 900 PWR design uses 2 steam generators of the
once through type.
2

3. These steam generators are long,
about 28 meters, which induces a
specific layout : the bottom of the
steam generators is lower then the
core inlets (Fig.). Then the transition
to natural convection cooling on the
primary side can be difficult in some
conditions. Furthermore, they only
contain a small amount of secondary
cooling water, making the installation
rather sensitive during certain kinds
of transient.
In the case of a loss of normal SG
feed water there is an increase in
temperature, hence in pressure, in
the primary cooling system,
systematically leading to opening of
the pressurize relief valve, during a
few seconds.
3

5. The accident starts at 4:00 a.m. on Wednesday March 28, 1979 with the loss of normal water
supply to the steam generators. The primary transient causes emergency shutdown, which
gradually lowers pressure in the primary cooling system. After 12 seconds the relief valve
receives as normal the command to close but this valve remains jammed open. The primary
cooling system continues to discharge into the pressurizer relief tank, located in the
containment, at a flow-rate of 60 metric tons per hour (there are approximately 200 metric tons
of primary coolant).
The steam generator auxiliary feedwater system pumps start up normally after 30 seconds, but
the connecting valves between the pumps and the steam generators are closed instead of open,
due to a maintenance error. The generators dry out in 2 to 3 minutes, stopping all cooling of the
primary system. Although the position indicator for these valves located in the control room
signal this fault, eight minutes pass before the operators identify the fault and give the command
manually to open the valves. Twenty-five minutes pass before the situation of the secondary
cooling system stabilises, after numerous operations, no doubt commanding all the attention of
the operating team.
During this time, discharge through the pressurizer relief valve continues. After two minutes,
pressure in the primary cooling system has decreased to approximately 110 bar. The emergency
core cooling system starts up automatically and sends cold water into the primary system. The
operators check the indicator of the relief valve and see “valve closed”, which in fact is not true.
The indicator transmits the command received by the valve, and not its actual position, to the
control room. 5

6.  Finally, the operator concentrates on the water level in the pressurizer. The water level in
the pressurizer, after lowering at first when the valve was opened, then started to rise
rapidly, between the first and approximately the sixth minute. This rise is perfectly normal
when there is an opening in the upper part of the pressurizer, but the operators in this plant
ignored this fact and had not been trained for this type of situation. In any case, faced with
this rapid rise in the pressurizer water level, the operators, believing the relief valve to be
closed, are afraid to inject too much water into the system, and therefore stop emergency
core cooling manually after less than five minutes. The operators’ mental image of the
situation was false, but the actions they decided to perform were obviously based on this
image. As of this moment, the water draining from the primary system is not replaced.
There is a break in the primary coolant system and the emergency core cooling system is
shut down completely.
 The primary system continues to drain. After 6 minutes, boiling starts. The primary coolant
circulating pumps continue to work, circulating a mixture of water and steam comprising
more and more steam; however, they manage a certain amount of cooling thanks to the
steam generators supplied by the secondary system. The rest of the energy is removed
through the primary system break. After fifteen minutes, the pressurizer relief tank rupture
disk gives way. The escaping primary coolant now goes directly into the containment. The
pressurizer is filled with a mixture of water and steam. Its level indication is meaningless.
The proportion of steam in the primary coolant increases. The primary pumps have more
and more trouble, and start to cavitate and vibrate. These vibrations become excessive. The
operators stop one pump after 1 hour 13 minutes, and the other 27 minutes later, hoping
that natural circulation will set up in the primary system.
6

7. In fact, water and steam separate, with steam accumulating in the top and water in the bottom.
There is no longer any circulation of primary fluid and therefore no heat exchange takes place
between the reactor core giving off residual heat of a few tens of MW and the steam generators.
The heat from the core continues to bring the cooling water to the boil. No more water is being
supplied, and the level in the core drops: the core is uncovered. Cooling of the fuel becomes
less effective; cladding temperature rapidly increases to 850 C, then past 1300 C. At these
temperatures, zirconium reacts chemically with steam to form zirconium oxide and hydrogen.
This reaction produces heat, increasing temperatures yet more. Fuel cladding melting point is
reached, and there is significant release of fuel fission products to the primary coolant and from
there to the containment.
After 2 hours 14 minutes, a radioactivity alarm goes off in the containment. The operators are
forced to realise the gravity of the situation. Realising that they may well have transferred
radioactivity through the relief valve, which had a high leak rate before the accident, they close
the line-isolating valve and thereby stop discharge. This also stops all heat removal. The core
continues to heat, and primary system pressure increases. The operators start up one of the
primary pumps, which sends water cooled in the steam generator onto the extremely hot fuel,
which disperses those parts of the fuel above the water level within the reactor vessel.
7

8. After 3 hours 12 minutes, vaporisation of water on the fuel has caused primary
system pressure to rise to a dangerous point. The operators re-open the relief line-
isolating valve, drainage starts up again, letting out coolant which is even more
radioactive. More radioactivity alarms go off, some of which are outside the reactor
building. The water that is spilling into the containment is taken up by automatic sump
pumps, which send the contaminated water to storage tanks located in an auxiliary
building that is not hermetic. These tanks then overflow and create a source of
radioactive steam that can escape outside the plant.
A state of emergency is finally declared. The containment is isolated, stopping
transfer from the sump to the auxiliary building. It is now three hours and twenty
minutes since the accident began. The operators start the emergency core cooling
system again at a low flowrate, causing a new shock between the cold water and the hot
fuel, then at nominal flow-rate. The core cools, four hours after the first event. It will
take another twelve hours to discharge from the primary cooling system most of the
hydrogen and fission gases that prevent it from being filled. This is done by alternately
opening and closing the pressurizer relief line and starting up safety injection and
primary pumps. A localised explosion of about 320 kg of hydrogen in the containment,
after 9 hours 50 minutes, induces a 2 bar pressure spike in the reactor building, without
causing any particular damage.
8

9. At 8:00 p.m. on Wednesday, March 28,
1979, the accident itself is over.
However, it will take several days more
to calm fears of a possible hydrogen
explosion in the reactor vessel. The
damage to the fuel elements far exceeds
that provided for in the worst possible
design basis accident. Six years later, in
1985, when it was possible to pass a
television camera between the lower
internal core structures and the vessel, it
was found that 45% of the fuel had
melted, along with elements of the
cladding and the structures totalling 62
metric tons and forming what is called
corium. About 20 metric tons of this
corium, formed from the upper part of the
fuel, had forced its way through an outer
ring fuel assembly and the reactor core
external baffles to reach the vessel
bottom head itself, but fortunately did not
melt through it (see Fig. ).
9

10. In spite of this catastrophic fuel situation and the significant transfer of
radioactivity to the containment, the immediate radiological consequences in the
surrounding area were minimal. Indeed, the containment fulfilled its role almost
perfectly. Only the sump transfer pumps were responsible for radioactive release
for a limited period. This release, estimated at 13 million curies of xenon and about
10 curies of iodine (i.e. 5.105 and 0.4 TBq), had only very limited consequences. It
is estimated that an individual downwind at the edge of the site throughout the
accident would have received a dose of less than 1 mSv (100 mrem), equivalent
to the annual dose of natural radiation. The operating personnel received a slightly
higher, but still quite limited dose during the accident, and had to wear masks for a
few hours Three technicians received doses between 30 and 40 mSv (3–4 rems)
during primary coolant sample-taking operations. The collective dose received by
the plant workers from the onset of the accident to the end of fuel removal in 1989
is estimated at 60 man-Sv.
10

11. 1. Direct causes and Root causes
The first event of this scenario is the failure of the normal steam enerators feed water
system due to an human error during a minor maintenance activity. This demonstrates
the absolute need to reduce the occurrence of any type of abnormal event but the direct
causes of the core meltdown are to be searched a step forward and then two direct
causes appear:
The pressurize relief valve stuck open;
The emergency core cooling system was stopped by the operators.
Instead of focusing on these direct causes, the prevention of the reoccurrence of
equivalent events needs to identify and treat the actual root causes. A list of the major
findings is presented.
Accident analysis :
11

12. 2. Design deficiencies
The loss of normal feedwater which is an anticipated operating occurrence leads to the
opening of the pressurizer relief valve which is an other anticipated operating
occurrence;
A break in the steam phase of the pressurizer is not considered. There is no procedure
to identify and manage this event and the operating staff is not trained for it;
The actuation of the emergency core cooling system does not actuate a complete
containment building isolation.
3.Man-machine interfaces
Global control board weakness with, in particular indications of order instead of
position without specific warning, no alarm only at nominal power leading to a lot of
alarms in any shutdown condition and without any possibility to identify the initiating
difficulties, insufficient pressure and temperature indicators range;
Existing emergency operating procedures difficult to use. 12

13. 4. Multiple latent deficiencies (organization, maintenance, quality, ... )
The pressurizer relief valve had been known to be leaking for a while but the repair work
was postponed so increasing the probability of a jammed open valve and depriving the
operators of a way to identify the valve situation: the temperature of the pressurizer relief line;
The closed connecting valves of the steam generators auxiliary feedwater system added a
complete loss of feed water system to the complete loss of emergency core cooling system and
focused the attention of the operating team;
An effluent tank was leaking;
The iodine filters in the auxiliary building had poor efficiency.
13

14. 5. Global and collective excessive confidence (complacency)
This general attitude towards nuclear activities is not specific to this type of design or to this
operating organization but can be considered as widely spread world-wide at that period. This
can be seen by different signs:
An accident more severe than a LOCA is not considered. No on-site accident management is
needed as well as any off-site emergency preparedness.
Even design basis accidents are just considered as conventional. Then the emergency
operating procedures are difficult to use and relate only to the short term (mainly automatic
actions).
Limited use of operating experience (precursor event at Davis Besse). Incidents without
actual consequences are considered as trivial and the practice of information exchange on
operation difficulties is not established.
14

15. Lessons learned
The first three lessons were the following, leading to a very large evolution of the
safety approach and significant improvement of the safety of a majority of plants.
Beyond design core conditions can occur resulting from multiple equipment or
human deficiencies.
A resistant and leak tight containment resulting from the implementation of the
defence in depth concept (3 levels) can be efficient to mitigate the radiological
consequences even in the case of most beyond design accidents.
Man is an essential element of safety.
15

16. Corrective actions
 Initiation of large cooperation programmes of research and development to improve the
knowledge available in core melt conditions and related conditions.
 Development of severe accident management related to severe cooling conditions including
containment isolation and surveillance, hydrogen explosion, containment venting, basemat
melt through.
 Large adaptation of the control-room tools in general ergonomic (position sensors, enlarged
indicators scales, primary coolant boiling monitor, ...), Alarm ranking, safety parameter
display system.
 Improvement of containment isolation.
 Consideration of the complete loss of redundant systems in safety analysis.
 Development of provisions for management of large quantities of radioactive effluents.
 Development of operating experience feedback structure within the operating company, at
national level and with the regulatory bodies; Exchange of information at international level.
 Development and implementation of quality assurance programmes at NPPs.
 Improvement of operators training.
16

17. 17
Thank
You