Human error led to a meltdown at the Three Mile Island nuclear power plant on March 28, 1979. A stuck open valve in the plant drained cooling water from the reactor core. Operators did not recognize that this was a loss of coolant accident. As the core heated up with no cooling, steam began forming within it. Operators further reduced the flow of water to the core, allowing damage to begin. Within two hours, the zirconium cladding around the fuel rods began to fail, releasing radioactive gases and indicating the start of core damage.

1. Human error is
to blame*
THE 28 MARCH 1979 THREE MILE ISLAND (TMI) MELTDOWN
BY
K. W. SUTTON (C40)
21 AUG 2015
*Time magazine 13 Aug 1979,
quoting the NRC.

2. Objectives
 Respond to a lecture request.
 Learn about the key event in
the history of America’s
nuclear industry.
 Extract and apply lessons
learned.
Extract and apply key lessons.

3. Outline
 Setting
 Reactor Theory
 Power Plant
operations
 TMI accident
 Health
 News Coverage
 Assessment
 Consequences
 Application
Background and Accident Only.

4. Location 1/2
Southeast of Pennsylvania’s state capital.

5. Location 2/2
In densely populated area and on regional water source.

6. The TMI site.

7. Aerial view of Three Mile Island.

8. Bucolic location.

9. TMI is within a community.

11. Fission fundamentals
 Neutron strikes a material
which can fission (U-235).
 U-235 atom blows apart,
yielding radioactive
particles, daughter atoms,
and energy (heat).
 Released neutrons cause
more fissions.
 Chain reaction ensues.
 Billions of small explosions
result in lots of energy!
Neutron
Split an atom, release energy.

12. Decay Heat
 Atoms formed after
fission emit particles.
 This results in heat, thus
power, generation.
 The power drops quickly
with time, but not to
zero; about 6% one
minute after shutdown.
 Decay heat means a
nuclear reactor is never
really “off”. It always
must be cooled.
Heat and Power generated after shutdown.

13. Power Plant Configuration
Do NOT Panic!

14. Power Plant Overview
Three closed loops: Primary, Secondary, Circulating.
 The reactor heats water, called primary water.
 Pumps force primary water into the Steam Generators (S/G).
 The primary water gives heat to the water in the S/Gs, then
returns to the reactor.
 The secondary water in the S/G flashes to steam.
 Steam exits the S/G, goes to the turbine to make electricity.
 As the steam leaves the turbine, it condenses to water and
this water is pumped back to the S/G.
 Circulating water is what condenses the steam leaving the
turbine; it flows to the cooling tower, gives off heat to the
atmosphere, and returns to the condenser.
 The Pressurizer maintains primary plant pressure and is used
to determine water volume. No vessel level indicator!

15. Power Plant Configuration
That was EASY!

16. TMI-2 Data
 Rated for 2700 Mega-Watts (thermal) / 852 Mega-
Watts (electrical), enough power for ~150,000 homes.
 Normal pressure and temperature: 2155 psi / ~600 F.
 Total primary water volume about 100,000 gallons.
 Reactor Vessel: 40 feet tall, 8 inch thick steel walls
 Reactor Vessel surrounded by concrete and steel
shields up to 9 feet thick.
 All enclosed with a 193 foot tall containment building
with concrete walls 4 feet thick.
Massive, heavy construction.

17. Call it like it is
Clear, Shared, and Understood terminology helps!

18. Fuel – Pellet, Rod, Cell, Core
~100 Tons Uranium clad with Zirconium.
Core also had:
• 52 instrument tubes
• 69 control rods
• Fuel pellets 1” tall, ½ inch wide. Uranium oxide
in a metal cylinder made of Zirconium; this
metal sheath is called “cladding”.
• 38,816 fuel rods, each 12 feet tall
• 208 rods per assembly, 177 assemblies

19. Casualty Control Principles
 Shutdown (SCRAM)
 Maintain flow
 Remove decay heat
 Keep the core covered
 Prevent going “Solid”
 Contain radiation
 Trust Instrumentation
 Operators must Follow Procedures, Think,
and Act Deliberately
C3 – Control, Cool, and Contain!

20. Failure limits
 At about 2,200 F the Zirconium/Water reaction
occurs:
Zr + 2 H2O → ZrO2 + 2 H2
Note: Highly Exothermic (releases energy),
produces combustible Hydrogen gas, and
causes Zirconium cladding to fail.
 Zirconium cladding melts around 3,000 F.
 Uranium fuel melts at about 5,200 F.
At high temps, metal barrier (cladding) around fuel fails.

21. Hydrogen Gas
Hydrogen + Oxygen + Heat = BOOM!

23. The Accident

24. Sequence Of Events – 1/8
 At ~0400 on 28 March 1979, with TMI-2 at 97% power, a loss of feed
water to the S/Gs occurs.
• Cause never determined; most likely due to earlier maintenance on a
condensate “polisher” (filter and ion exchanger).
• Issues with the “polisher” were a known problem, never fully
understood or solved.
 +2 seconds: Electrical Turbines trip.
• No steam being drawn from the S/Gs, the reactor quickly began to
heat. Decay Heat initially ~6% of former power.
 +5-6 seconds: Pilot Operated Relief Valve (PORV) lifts. (P = 2,255#)
 +8 seconds: Reactor SCRAM.
 +13 seconds: Pressure drops to 2,205#. PORV does not shut. PORV
is stuck open. Indicator light shows PORV shut – input from
solenoid, not actual valve position. Loss of Coolant Accident
(LOCA) begins, not noted.
Rapid occurrences! LOCA!

25. Beware: PORV status vital
As long as PORV is open, problems will mount.

26. PORV focus
 PORV relieved about 300 gallons/minute.
 A PORV sticking open had occurred at similar power plants.
 Downstream was a temperature sensor. When above 130 F,
procedure directed shutting a “blocking valve”. Not done.
 The PORV was known to leak, so the temperature alarm was
often on, thus operators ignored it, considering it “normal”.
 Valve position indicator light triggered by power to a solenoid, so
not actual valve position.
 The PORV relieved to a tank whose level and temperature rapidly
increased, also not noted.
 Ultimately the PORV would be open for 2 hours and 22 minutes
before it was isolated, venting about 35,000 gallons.
PORV stuck open. NO ONE notices. Primary mechanical
cause of the TMI accident.

27. Stuck open PORV indicators:
 Drain pipe temperature high and rising.
 Drain tank temperature and pressure rising.
 Drain tank radiation levels rising.
 Containment building sump level rising.
 Containment building sump level alarm.
 Containment building radiation and temperature rising.
 Auxiliary building water level rising.
 Increasing neutron level from the core.
Training on accidents inadequate.

28. Sequence Of Events - 2
 +13-14 seconds: Operators use makeup system to slowly add
water to the reactor.
 +14 seconds: Operator notes emergency feed pumps running
but fails to note their outlet valves are shut, so no water flowing
into the S/Gs – no heat being removed.
 +48 seconds: Reactor pressure falling, pressurizer level rising
(these are leak indications!).
 +1 minute: About 100 alarms have actuated.
 +1 minute 45 seconds: S/Gs boil dry. Heat no longer being
removed from the reactor.
 + 2 minutes: High Pressure Injection (HPI) pumps automatically
start, adding water to the reactor at 1000 gpm per pump.
Unrecognized LOCA. Control room confusion.

29. Plant Status: +2 minutes
 Shut down (via a SCRAM)
 No heat being removed
via the S/Gs
 Core getting hotter!
 Relief valve (PORV) stuck
open!
 Actual casualty, a Loss of
Coolant Accident (LOCA)
unrecognized.
 Water being added by
High Pressure Injection
pumps.
LOCA not recognized.

30. Sequence Of Events - 3
 +2 minutes +/- : With HPI pumps on, pressurizer level rises.
 +4 minutes +/- : Operators secure one HPI pump and reduce
the other’s flow to 100 gpm to avoid filling the pressurizer solid.
• NOTE: With HPI on, falling pressure and constant temperature
indicates a LOCA. The operators fail to recognize the LOCA.
• Reducing HPI to almost zero was the operator action which
ultimately caused the reactor to melt.
 +5 minutes: Steam bubbles form in the core, expelling water
into the pressurizer (level rises). Core temperature increasing.
 + 8 minutes: Operators note that S/Gs are not receiving feed
water, open the shut valves, and restore feed. Not a critical
event for reactor safety, but increased control room confusion.
Steam forming in the core. HPI almost zero.

31. TMI-2 Control Room
Large; difficult to monitor and operate.

32. Sequence Of Events - 4
 +11 minutes: High level alarm for containment building sump --
a clear indication of a leak or break in the system. Significance
not noted.
 +15 minutes: Drain tank rupture disk bursts. More water to the
containment sump. Water automatically pumped to the
auxiliary building. Result is spread of radiation/contamination.
 +20 minutes: Neutron levels rising -- a clear indication of steam
in the core. Significance not noted.
 ~+20 -25 minutes: Pressure and temperature inside the
containment building rising – another unrecognized indication
of a leak from the primary system. Operators turn on ventilation.
This spreads contamination.
LOCA unrecognized. Radiation and Contamination.

33. Plant Status: +25 minutes
 LOCA continues.
 Steam forming in
core.
 Operators taking
action which result in
spreading of radiation
and contamination.
LOCA not recognized. Steam in the core.

34. Sequence Of Events - 5
 +39 minutes: Operators secure containment building sump
pump. 8,000 gallons of radioactive water have been pumped
to the auxiliary building. Water source not identified.
 +60 minutes: Reactor Coolant Pumps (RCPs) begin to vibrate
due to low system pressure and steam in the system. This
indication of steam in the core was unrecognized.
 +74 minutes: Operators secure 2 of 4 RCPs.
 +101 minutes: Operators secure remaining two RCPs. No core
flow now. Significant core damage soon results.
 +120 minutes (two hours): First indications of fuel cladding
ruptures. Ruptures release radioactive gases which trigger high
radiation alarms in the containment building.
LOCA unrecognized. Flow Stopped. Core damage begins.

35. Sequence Of Events - 6
 + ~120 minutes (two hours): Zirconium/water
reaction begins. Fuel rods begin to fail. Hydrogen
released to containment building. Hydrogen bubble
begins to form in core.
• Later analysis determined at +135 minutes, the top of the
core was uncovered and serious core damage began.
• Once core is uncovered, significant fuel melting occurs.
• Melted fuel releases fission products.
• The highly radioactive fission products exit the reactor via the
stuck open PORV and thence into the containment building,
auxiliary building, and possibly environment.
Core badly damaged. Releases Increasing.

36. Core Damage
Damaged TMI fuel rods.

37. Core Damage – Close up
50% of the core melted; nothing through the vessel.
Ultimately:
• 50% of the core melted.
• Cladding failed on 90% of the fuel rods.
• About 20 tons of Uranium flowed to the
bottom of the pressure vessel.

38. Plant Status: +2 Hours
 LOCA continues.
 Core melting.
 Spreading
radiation and
contamination.
LOCA not recognized. Core Melting. Releases.

39. Sequence Of Events - 7
 +144 minutes (2 hours and 22 minutes): In response to a
query from new shift personnel, operators shut the PORV
blocking valve. The LOCA is stopped.
 +4 hours: Containment building automatically isolates
itself (due to high pressure). Releases stopped.
 +4.5 hours: Operators turn on HPI. Two hours later (1030
a.m.) the core is fully covered.
LOCA stopped. Isolation complete. Core covered.

40. Sequence Of Events – 8 / 8
 Subsequent actions focused on:
• Regaining control of the reactor.
• Containing radiation and contamination.
• Managing hydrogen (small explosion
occurred at 1350 in the containment
building; fear about Hydrogen in the core.).
• Assuaging the public’s fears and health.
• Messaging.
Days to regain control. Still (2015) cleaning up TMI.

41. Health Effects
Must separate fact from fiction, and fear!

42. Hoped for Radiation Effects

43. Releases
Layered containment effective.

44. Health Effects – NRC report
 Many groups exhaustively studied the radiological
effects of the TMI releases.
• The approximately 2 million people around TMI-2 during
the accident are estimated to have received an
average radiation dose of only about 1 mrem above the
usual background dose. (Chest X-ray is 6 mrem).
 No adverse effects from radiation on human, animal,
and plant life in the TMI area have been directly
correlated to the accident.
 “Comprehensive investigations and assessments by
several well respected organizations . . . have
concluded that in spite of serious damage to the
reactor, the actual release had negligible effects on
the physical health of individuals or the environment.”
No verifiable deleterious health effects.

45. News Coverage
 At 0825, local radio broke the
TMI story. Picked up at 0906
by the Associated Press.
 Throughout the crisis,
messaging was inept.
Vague, erroneous, and/or
contradictory reports caused
a hostile relationship between
the Utility/NRC and reporters
with resultant loss of public
confidence.
Poor information flow caused a hostile press.

46. News Coverage
Scared Public.

47. Some Headlines worse than others.

48. Cooling tower becomes image of nuclear power.

49. Public Concern.

50. Presidential interest
President Carter visited the site on 1 April 1979.

51. Assessment
People and Environment Radiological Barriers
and Control
Defense-in-Depth
7 Chernobyl, 1986 – Widespread health and
environmental effects. External release of a
significant fraction of reactor core.
6 Kyshtym, Russia, 1957 – Significant release of
radioactive material to the environment
from explosion of a high activity waste tank.
5 Windscale Pile, UK, 1957 – Release of
radioactive material to the environment
following a fire in a reactor core.
TMI, US, 1979 – Severe damage to
the core.
4 Tokaimura, Japan, 1999 – Fatal
overexposure of workers following a
criticality event.
Saint Laurent des Eaux, France,
1980 – Melting of one channel of
fuel in the reactor with no release
outside the site.
3 No example available. Sellafield, UK, 2005 – Release of
large quantity of radioactive
material, contained with the
installation.
Vandellos, Spain, 1989 – Near
accident caused by fire
resulting in loss of safety
systems at the nuclear power
station.
2 Atucha, Argentia, 2005 – Overexposure of a
worker above annual limit.
Cadarache, France, 1993 –
Spread of contamination to an
area not expected by design
Forsmark, Sweden, 2006 –
Degraded safety functions for
common cause failure in the
emergency power supply
system at a nuclear plant.
1 Breach of operating limits at a
nuclear facility.
Chernobyl
Fukushima
Three Mile Island

52. Compare: Chernobyl, 1986
Steam explosion and fire.
Note: The
arrow marks a
1,000 ton lid
blown off the
reactor vessel.

53. Compare: Fukushima, 2011
Damage from Hydrogen explosions.

54. Frame of Reference
Could have been much worse!

55. Casualty Control Principles: How
did the TMI operators do?
 Shutdown (SCRAM) -- YES*
 Maintain flow -- NO
 Remove decay heat -- NO
 Keep the core covered -- NO
 Prevent going “Solid” – YES**
 Contain radiation -- NO
 Trust Instrumentation – NO
 Follow Procedures, Think, and Act Deliberately -- NO
Human error ultimate cause of core damage.
*SCRAM was an automatic protective
event; no operator action.
**Excess focus on not going solid caused operators to
omit most other casualty control actions.

56. Consequences - 1
Nuclear industry lost public’s trust.
President’s report:
“Personnel error,
design
deficiencies, and
component failures
caused the
accident, which
permanently
changed the
nuclear industry.
Public fear and
distrust increased.”

57. Consequences - 2
No new US nuclear plants since the 1990s.

58. Consequences - 3
Fearful and Distrusting Public.

59. Changes since TMI
 Upgrading and strengthening of plant design and equipment.
 Identifying the critical role of human performance in plant safety
led to revamping operator training and staffing requirements,.
 Enhancing emergency preparedness.
 Publishing NRC findings and conclusions on plant performance.
 NRC regularly analyzes and inspects plants for compliance.
 Expanding performance and safety inspections, and ORM.
 Creating a separate enforcement staff within the NRC.
 Establishing a group to provide a unified industry approach.
 Installing equipment to mitigate accidents and monitor plant status.
 Enacting programs for early identification of safety problems.
 Expanding NRC's sharing in the US and internationally.
Improved safety and reliability since TMI.

60. Application
 Follow Procedures
 Hone Human/Machine interface
 Focus on what is important
 Try not to start anything at 0400
 Foster effective information flow
 Do not rely on only one indication
 Do not accept abnormalities
 Think, assess, and act deliberately
Discipline in Thought and Action

61. Never stop Learning!

62. Questions or Comments?