Insights from the Three Mile Island accident—Part 1: The accident

April 29, 2022, 3:59PMNuclear NewsWilliam E. Burchill

The accident at Unit 2 of the Three Mile Island nuclear power plant on March 28, 1979, was an extremely complex event. It was produced by numerous preexisting plant conditions, many systemic issues in the industry and the Nuclear Regulatory Commission, unanticipated operator actions, previously unrecognized thermal-­hydraulic phenomena in the reactor coolant system (RCS), and the unprecedented challenge of managing a severely degraded core.

This article, part one of two, presents insights from the accident and addresses several issues raised by a previous Nuclear News article[1] on the subject. It concludes with responses to specific statements made in that article. Part two will discuss improvements that have been made by both the industry and the NRC over the past 40 years. The intent of this two-­part piece is to present on this 40th anniversary of the accident a more complete and accurate description of its causes, lessons learned from it, and improvements that have been made since.

Post-­TMI studies

The TMI-­2 accident is described in numerous reports and publications[2,3,4,5,6,7,8]. Immediate responses from licensees of other nuclear power plants were required by NRC Bulletins requesting information and requiring specified actions[9,10,11]. The NRC summarized near-­term lessons learned[12] and developed new and proposed regulations for licensees and license applicants[13,14]. Brief descriptions of the accident, including graphical illustrations of the core damage and discussion of improvements because of it, are also provided in recently published textbooks[15,16].

The TMI-­2 accident

The TMI-­2 accident was a “beyond design-­basis accident.” This section discusses the first four hours. At that time, about half the core had melted and relocated. The accident was unlike any event considered in the plant’s final safety analysis report (FSAR), although certain of its features were similar to those of specific safety analysis events. The TMI-­2 accident was most similar to scenarios described in the Reactor Safety Study (RSS)[17], which had been prepared for the NRC by a team at the Massachusetts Institute of Technology in 1973–1975.

The very early stages of the accident had three precursors at other nuclear power plants and at least two at TMI-­2. The accident involved numerous preexisting plant conditions that aggravated the accident progression, was dominated by unanticipated human actions, produced thermal-­hydraulic phenomena in the RCS that were previously unknown to most people in the nuclear power community, and produced many instrumentation readings that were misinterpreted.

Precursors

On August 20, 1974, at the NOK-­1 nuclear plant in Beznau, Switzerland, the RCS pressure rise following a turbine trip from 100 percent power opened two ­PORVs (The acronym “PORV” is used generically herein to refer to the electromatic relief valve on the TMI-­2 pressurizer and power-­ or pilot-operated relief valves in other nuclear power plants). One stuck open. The indicated water level in the pressurizer then rose to off-­scale high. Within two to three minutes, a reactor operator realized that the ­PORV was open and shut the ­PORV isolation (block) valve. The pressurizer water level then fell rapidly. High-­pressure injection (HPI) was initiated about 12 minutes into the incident. Westinghouse, the plant’s designer, concluded that the protection systems and the operators had performed properly. This was based in part on a Westinghouse 1971 analysis of a small loss-­of-­coolant accident (LOCA) from the steam space in a pressurizer. However, Westinghouse guidance to utilities prior to the TMI-­2 accident did not provide specific warnings that pressurizer water level might rise during such an event. A report of the Beznau event was not submitted to the Atomic Energy Commission (AEC, the NRC’s predecessor). The NRC became aware of the event only after the TMI-­2 accident. It then sent a Generic Letter about it to all power reactor licensees[18].

On June 13, 1975, Oconee-­3 (a Babcock & Wilcox reactor) had a loss of feedwater from 15 percent power. RCS pressure increased, a ­PORV opened as expected, the ­PORV stuck open, and the pressurizer water level rose. A valve position light in the control room indicated that the valve was closed. Following reactor trip, RCS pressure decreased, and HPI initiated. Coolant continued to flow out of the stuck-­open ­PORV into the reactor coolant drain tank (RCDT), eventually bursting the tank’s rupture disk and spilling about 1,500 gallons of coolant into the containment. The operators diagnosed the leak and closed the ­PORV block valve before the RCS coolant boiled. The NRC reviewed this event and reported it routinely in its monthly report, known as the “Gray Book”[19], but did not determine any generic safety significance and did not further notify other licensees.

On September 24, 1977, Davis-­Besse-­1 (a B&W reactor) had a loss of feedwater from 9 percent power. RCS pressure increased, and a ­PORV opened as expected. Within the next 40 seconds, the ­PORV opened and closed nine times before sticking open. RCS pressure dropped, and HPI initiated. However, pressurizer water level rose, and the operators responded by turning off HPI after about four minutes. Similar to the event at Oconee-­3, the ­RCDT’s rupture disk burst, and about 11,000 gallons of coolant discharged into the containment. The operators finally diagnosed the situation, particularly using indication of high pressure in the containment, and closed the ­PORV block valve at about 21 minutes. The utility, B&W, and the NRC all analyzed the event, focusing primarily on the problems with the ­PORV. The operator action to terminate HPI was identified as having potential safety significance. However, no action was taken except to report the event in the NRC’s “Gray Book.” Neither the NRC nor B&W notified other utilities.

In 1977, a Tennessee Valley Authority engineer, Carlyle Michelson, analyzed hypothetical small-­break LOCAs in B&W plants. His September 1977 draft report and his January 1978 final report explain how RCS coolant would respond to a very small-­break LOCA. He concluded, “A full pressurizer is not considered a reliable indication for prescribing certain operator actions such as HPI pump trip,” because it would not necessarily represent the water level in the reactor vessel. His report received limited circulation and attention at TVA, B&W, the NRC, and the Advisory Committee on Reactor Safeguards, for which he was a consultant. However, no generic safety problem for operating plants was identified by the NRC, and B&W did not inform its plant owners of Michelson’s concern prior to the TMI-­2 accident.

In 1977, during a TMI-­2 hot functional test, steam accumulated in the RCS hotlegs, causing pressurizer water level to increase as RCS pressure decreased. The operators on duty during the TMI-­2 accident were unaware of this earlier event. One year before the TMI-­2 accident, on March 29, 1978, the ­PORV opened inadvertently due to an electrical failure in the control system and stayed open undetected for two hours during pre-­operational testing. There was no indicator of the ­PORV’s position in the control room. Subsequently, an indicator was installed in the control room to show whether there was an electrical signal to the valve, but it did not actually indicate the valve’s position.

Preexisting plant conditions

Many preexisting plant conditions aggravated the TMI-­2 accident progression. An extraordinary number of components and systems were “tagged out” for maintenance. Most of this equipment played no role directly in the accident. However, the tags indicating the maintenance littered the control room panels, obscured critical indicators, and contributed to the operators’ confusion.

Long-­term problems in the condensate polishing system directly triggered the loss of feedwater that initiated the TMI-­2 accident. During startup testing on October 19, 1977, an almost identical problem had occurred, and the problem persisted without being corrected.

Continuous leakage through the ­PORV was well known and in violation of the plant’s Technical Specifications. In fact, immediately prior to the accident’s initiation, an operator was increasing RCS boron level concentration, which was low due to ­PORV leakage. The most significant impact of the leakage was to produce continuous high-­temperature readings in the drain pipe from the ­PORV to the RCDT. The operators misinterpreted this principal indicator of a LOCA due to the stuck-­open ­PORV for two-­and-­a-­third hours. During this time, an estimated 46 percent to 54 percent of the initial RCS coolant inventory was discharged.

A recent maintenance error had left the emergency feedwater isolation valves closed. The closed valves did not contribute to the initiation of the accident. However, they caused the once-­through steam generators (OTSG) to boil dry in a little less than two minutes. The dry-­out was recognized by the operators. The boiled-­dry OTSGs ceased removing heat from the RCS. Thus, the reactor coolant expanded, causing the pressurizer water level to rise. The operators concluded that the RCS was overfilling with water. This led them to throttle the HPI pumps to minimum flow.

After the emergency feedwater valves were opened at eight minutes, the operators speculated that the persistently falling RCS pressure was caused by a primary-­to-­secondary leak due to thermal shock from the sudden introduction of emergency feedwater into the OTSGs after they had been dried out for six minutes. The operators also speculated that rising temperature and pressure in the containment (called the “reactor building” at TMI-­2) might be due to the thermal shock causing an OTSG shell-­side leak. The OTSGs distracted the operators’ attention from indications of degrading conditions in the RCS and reactor core for several hours.

About one-­and-­a-­half hours into the accident, plant staff found that the containment HP-­R-­227 radiation monitor’s charcoal filter was water-­logged, likely due to water in the sampling lines, thus disabling the monitor’s function. An NRC post-­accident review also concluded that the monitor may have been miscalibrated. This radiation monitor was cited in the LOCA emergency procedures as providing a “unique” symptom of a LOCA. It was intended to be used to distinguish a LOCA from a steam line break or a steam generator tube rupture, whose emergency procedures did not include HP-­R-­227 readings as symptoms. The operators consulted the HP-­R-­227 readout frequently during the accident and used the absence of any elevated readings as their principal basis for concluding that a LOCA was not happening.

Significant Actions

During the first three-and-a-half hours of the accident, the most significant actions relative to the RCS coolant inventory and core cooling were as follows:

00:00:12Letdown flow was stopped.
00:00:13Attempts were made to start makeup pump 1A and to open an HPI isolation valve.
00:00:41Makeup pump 1A was started and makeup valve 16B was opened to increase injection.
00:02:01An automatic emergency safety features actuation signal (ESFAS) initiated full HPI from makeup pumps 1A and 1C.
00:03:13The HPI portion of engineered safety features was manually bypassed.
00:04:00Makeup valves were throttled.
00:04:38Makeup pump 1C was stopped, and the HPI valves were throttled to minimum flow (about 25 gpm per pump for the protection of the pumps). Uninterrupted full injection by only one HPI pump would have avoided core damage even with the PORV stuck open.§
00:04:58Letdown flow was maximized (letdown flow was adjusted frequently thereafter).
00:09:23Letdown flow isolation valve was opened.
00:10:24Makeup pump 1A tripped and was restarted twice (flow remained throttled).
00:11:43Makeup pump 1A was restarted (still throttled).
01:13:29Reactor coolant pump (RCP) 2B was stopped.(per instructions on pump operating limits)
01:13:42RCP 1B was stopped.
01:40:37RCP 2A was stopped.
01:40:45RCP 1A was stopped.
02:22:00PORV block valve was closed (thus terminating the LOCA).
02:34:23Makeup pump 1C was started (with throttled flow).
02:44:23Makeup pump 1C was stopped.
02:46:23Attempt was made to start RCP 1A, which did not start.
02:51:57Attempt was made to start RCP 2A, which did not start.
02:54:09RCP 2B was started.
03:12:28PORV block valve was opened (thus reinitiating the LOCA).
03:12:53RCP 2B was stopped.
03:17:00PORV block valve was closed again (thus again terminating the LOCA).
03:19:45A manual ESFAS started full injection by makeup pumps 1A and 1C (2 HPI pumps).

†  Timestamps follow the sequence of events in NSAC-1[4]

‡ TMI-­2 had three high pressure pumps to provide makeup (charging) during normal operation and HPI under emergency conditions. Each pump had a rated capacity of 400 gpm against 1,600 psig.

§ One HPI pump would have injected 474,000 lbs of coolant at rated conditions before the PORV block valve was closed at two-­and-­a-­third hours, compared to an estimated 231,500–272,200 lbs of coolant lost[4].

Human actions

Human actions dominated the progression of the TMI-­2 accident and its outcome as had been predicted by the RSS[17] for a beyond design-­basis severe accident. None of the actions listed above were anticipated in the TMI-­2 FSAR, which took no credit for human actions to mitigate transients and accidents for the first 30 minutes. However, the FSAR also did not include incorrect human actions. This was a major difference between the TMI-­2 FSAR (and those of all other nuclear power plants) and the RSS, which explicitly included erroneous human actions and their associated probabilities of occurrence.

While the pace of actions listed may not look overwhelmingly intense, at the same time, more than 100 alarms were flashing and sounding, many instruments were giving unexpected readings, and many actions were being taken on secondary-­side systems. The Stello Report[2] provides a very detailed sequence of events, operators’ reasoning, and operators’ actions based on several sources, including interviews of the operators and others who were in the control room and elsewhere on site. The Rogovin Report[4] provides a uniquely descriptive narrative of the impact on human senses that the chaos in the control room produced. The Hart Report[6] provides a detailed record of human actions and the reasoning on which they were based.

Thermal-­hydraulic phenomena

Coolant conditions in the RCS were not recognized by the plant operators or many engineering and management personnel who arrived in the control room before and after core damage. The earliest symptom of significantly abnormal conditions (besides the pressurizer water level discussed below) began five-­and-­a-­half minutes into the accident when the hotleg coolant temperature and pressure reached saturation conditions, i.e., bulk boiling. The pressure was 1,340 psig, which is 260 psid below the HPI initiation setpoint of 1,600 psig. The coolant temperature and pressure were subsequently noted many times by the plant operators using control room instrumentation and readouts from the plant computer. Saturation conditions continued for the next two-­and-­a-­third hours until the ­PORV block valve was closed. The RCS pressure was determined by the RCS coolant temperature (at the saturation point), which was determined by heat removal by the OTSGs. The only event in the FSAR that produces this condition is a small-­break LOCA.

Because this definitive indicator was unrecognized, the NRC required in each of the Bulletins[9,10] it issued to pressurized water reactor owners immediately after the accident that they review their operating procedures relative to “recognition of the possibility of forming voids in the primary coolant system large enough to compromise the core cooling capability.” Subsequently, in its TMI action plan[13,14], the NRC required the installation of primary coolant saturation meters in PWRs by January 1, 1980.

The TMI-­2 pressurizer water level was interpreted to represent the inventory of coolant in the RCS and was the basis for the operators’ throttling the emergency core cooling system (ECCS) HPI. This was based on not only their training at TMI, but also, for most of them, on their U.S. Nuclear Navy training. In the first minute, the pressurizer water level trended as the operators expected (based on the FSAR, their training, and their experience) following a loss of feedwater/turbine trip/reactor trip. It reached a minimum level of 158 inches (on a 0 to 400-­inch scale, with normal operation at about 225 inches) at 48 seconds. (They recognized this was higher than the less than 80 inches experienced in previous trips of the same nature.) It then nearly monotonically trended upward for the next five minutes until it went off-­scale high just before six minutes. It came back on-­scale a little after 10 minutes but remained much higher (around 375 inches) than expected for the next two-­and-­a-­half hours.

The initial pressurizer water level transient was produced by a combination of venting of steam through the stuck-­open ­PORV, coolant additions/subtractions by the makeup and letdown systems, contraction of coolant following the reactor trip, and expansion of coolant following the dry-­out of the OTSGs. However, the persistently high water level was due to a hydraulic phenomenon totally unknown to the plant operators and to most of the nuclear power community. It was “countercurrent flooding”[20] at the inlet to the pressurizer from the surge line. This phenomenon involves the upward flow of a gas (steam), which prevents the downward flow of a liquid (water) and “suspends” the liquid[21].

Countercurrent flooding in the RCS had been recognized in only two situations prior to the TMI-­2 accident. The first was “accumulator bypass,” raised in the AEC’s ECCS rulemaking hearings[7], based on Semiscale Test 845[22]. Countercurrent flooding was posited to cause emergency coolant from a PWR’s high-­pressure accumulators (safety injection or core flood tanks [CFT]) to bypass the reactor core during the blowdown phase of a large-­break LOCA due to the upward flow of steam in the reactor vessel annulus suspending emergency coolant trying to flow downward. Combustion Engineering was contracted by the AEC to examine this phenomenon by experiments in one-­fifth-­scale and one-­third-­scale reactor vessel models[23]. The second was General Electric’s experimental determination that emergency coolant delivered by its High Pressure Core Spray System in later-­model boiling water reactors (through a sparger ring with nozzles above the core) could not penetrate the top of the core against the upward flow of steam venting from the core[24] during a LOCA.

During the TMI-­2 accident, before the RCPs were stopped, the quality (steam fraction) of the RCS coolant increased steadily, and the coolant volumetric flow rate decreased about 35 percent in Loop B and 50 percent in Loop A. These conditions produced three indicators: (1) motor current on all four RCPs continuously decreased, (2) RCP vibration alarms first occurred about 15 minutes into the accident and continued frequently thereafter, and (3) the ex-­core neutron detector count rate increased unexpectedly.

Fig. 1: TMI-­2 Source Range Detector Signal (modified from Ref. 5)

Fig. 2: TMI-­2 Coolant Distribution after RCPs Tripped (modified from Ref. 8)

The ex-­core source range neutron monitor (SRM) count rate is shown in Fig. 1. It follows the normal post-­reactor-­trip decay curve for the first 20 minutes. Thereafter, the count rate deviates dramatically, rising for about the next 80 minutes. The reactor operators, engineers, and management interpreted this rise as a potential return to criticality. However, it was a measure of the steam fraction of reactor coolant in the reactor vessel downcomer due to reduced attenuation of the neutron flux produced by decreasing coolant density. No one present had any training or procedures to tell them that this was the situation.

When the last RCP was stopped, the water and steam phases separated, as shown in Fig. 2. This increased the density of coolant in the downcomer, which caused the SRM count rate to drop (Fig. 1). As boiling in the core continued, the water level in the downcomer decreased, thus lowering the neutron attenuation and causing the count rate to rise again. There was nothing in the training or procedures of anyone in the control room that would have allowed them to interpret these indications.

Boiling in the core continued as the operators tried to establish natural circulation cooling using the OTSGs (still believing that they had a full RCS). The SRM count rate increase slowed significantly after two hours due to the small makeup injection adding cold water to the downcomer, increasing its coolant density and neutron attenuation (Fig. 1). Significant RCS pressurization after the ­PORV block valve was closed at two-­and-­a-­third hours further increased the density of coolant in the downcomer and, hence, its neutron attenuation, which produced a decreasing SRM count rate. At just before three hours, RCP 2B was restarted, which pushed a “slug” of water into the downcomer, causing an immediate increase in the downcomer’s coolant density and neutron attenuation, thus causing the SRM count rate to drop sharply. With decreasing downcomer water level due to boiling in the core, the SRM count rate rose again until RCP 2B was stopped 19 minutes later. Finally, at three-­and-­a-­third hours, a manual EFSAS started two HPI pumps at full injection. This filled the downcomer with water, which increased neutron attenuation, again causing the SRM count rate to drop sharply and to continue decreasing. The sharp increase of SRM count rate shown in Fig. 1 just before four hours is generally interpreted to be due to relocation of the upper part of the core, “core slumped,” which concentrated the neutron source. No one in the control room had any idea how to interpret this sequence.

Instrumentation reading misinterpretations

Instrumentation reading misinterpretations during the accident are tabulated below.

Instrumentation Reading
Misinterpretation
High temperature in PORV drain pipe to reactor coolant drain tank (RCDT)Accepted due to six-­months prior leakage
Electrical signal sent to close PORVConfirmed PORV had closed after initial opening
Pressurizer water levelIndicated RCS coolant inventory
Pressurized water level minimum > normalUnprecedented trend noted but not questioned
Continued high pressurizer water levelHPI valves might be leaking
RCS pressure at ES setpoint, starts ECCS HPIsRCS pressure fell due to emergency feedwater
RCS pressure/temperature combinationNot recognized to be saturation conditions
Lower-­than-­normal RCS pressureIndicated a primary-­to-­secondary leak
Persistently lower-­than-­normal RCS pressureAccepted because it was relatively steady
Persistently low but “stabilized" RCS pressureInterpreted to show there was no LOCA
Delay between RCS pressure fall and containment pressure riseInterpreted to show there was no LOCA
High containment pressure and temperatureIndicated OTSG secondary side leak
High secondary-­side radiation readingsIndicated a primary-­to-­secondary leak
Decreasing RCS boron concentrationIndicated a primary-­to-­secondary leak
Difference in pressure between two OTSGsIndicated an OTSG secondary side leak
RCDT rupture disk burstThought to be expected after turbine/reactor trip
RCDT low pressure after rupture disk burstInstruments damaged by PORV initial discharge
RCDT low pressure after rupture disk burstIndicated PORV was closed
Containment sump water levelIndicated an OTSG secondary side leak
Containment fire alarmIndicated high temperature due to OTSG leak
Containment pressure decrease after “B" OTSG isolatedIndicated secondary side leak in “B" OTSG
Auxiliary building high radiation readingsTransferred containment sump water from OTSG leak
Incore thermocouple readings off-­scale highInterpretation unresolved
Intermediate letdown cooler radiation alarmTripped by proximity to the containment sump
Decreasing RCS coolant flow rateInterpreted only relative to RCP protection limits
RCP motor vibrationsInterpreted only relative to RCP protection limits
Unexpected SRM count rateInterpreted to be consistent with low boron in RCS
Widely diverging RCS hot and cold leg temperaturesInterpretation unresolved
Core exit thermocouple readings off-­scale highInterpretation unresolved
Lack of HP-­R-­227 monitor radiation readingsConfirmed there was no LOCA

Post-­TMI studies[2,3,4,5,6,7] identified many deficiencies in the TMI-­2 control room design relative to the lack of “user friendliness” in the “man-­machine interface.” (The TMI-­2 control room was typical of those at other nuclear power plants.) A large number of the post-­TMI actions required by the NRC[13,14] involved control room design reviews, immediate installation of supplementary instrumentation, and longer-­term plant monitoring improvements.

PORVs and ­PORV block valves

PORVs and ­PORV block valves were a subject in the Bulletins issued by the NRC[9,10] and in NRC post-­TMI requirements[13,14]. Generic Issue 70, “PORV and Block Valve Reliability,” was defined in 1983[25]. The NRC sponsored a comprehensive reliability study of ­PORVs and ­PORV block valves by Oak Ridge National Laboratory (ORNL)[26]. It issued technical findings and regulatory analysis in 1989[27] and issued new requirements to all light-­water reactor licensees in 1990[28].

PWR pressurizer designs include ­PORVs and block valves for plant operational flexibility and for limiting the number of challenges to the pressurizer safety valves during anticipated operational occurrences (AOO). The design includes a block valve upstream of the ­PORV for mitigation if the ­PORV leaks or sticks open. Inadvertent opening of a ­PORV (or safety valve) is required to be included in the safety analysis as an AOO. All pressurizers have safety relief valves for overpressure protection of the reactor coolant pressure boundary (RCPB), so the operation of ­PORVs is not required to provide this safety function. Because the pressure-­retaining components of ­PORVs and block valves are part of the RCPB, their design and construction are required to meet the same applicable codes and standards as other RCPB components, i.e., they are safety related. However, the valve operators and electrical control systems of ­PORVs in most PWRs, particularly those licensed prior to 1979, were designed to non-­safety-­related codes and standards.

ORNL gathered reliability data on ­PORVs and block valves by reviewing event reports from 1971 to mid-­1986 on 230 valves (198 ­PORVs and 32 block valves). The ­PORV mechanical failure data involved 101 events, with only seven being “failure to close.” The ­PORV controls failure data involved 91 events, with only two being “failure to close.” ORNL concluded that “the reliability of existing ­PORVs and block valves would be enhanced by improved surveillance testing.”

The NRC decided that a stuck-­open ­PORV did not introduce a new, previously unrecognized safety issue, because analysis of a small-­break LOCA produced by a stuck-­open ­PORV shows acceptable consequences. The LOCA is mitigated by the operation of the ECCS HPI. Even with only one HPI pump in operation, the rate of coolant injection far exceeds the rate of coolant loss through the ­PORV until the block valve can be closed.

During the TMI-­2 accident, the ECCS HPI was throttled to a minimum. Thus, the coolant loss through the ­PORV was not mitigated. Steam was discharged for about the first six minutes. Thereafter, for about two hours and 15 minutes, the ­PORV and block valve discharged a two-­phase mixture at the critical flow rate. Even after this operation, well beyond the design limits of either component, the block valve was able to be closed and was manually cycled several times over the next several days.

The NRC technical evaluation of Generic Issue 70 determined that ­PORVs can be called on to perform one or more of the following design basis safety-­related functions: (1) mitigation of a steam generator tube rupture accident, (2) low-­temperature overpressure protection of the reactor vessel during startup and shutdown, and (3) plant cooldown in compliance with Branch Technical Position RSB 5-­1 (concerns monitoring of secondary-­side water chemistry in PWR steam generators).

The evaluation also determined that ­PORVs can provide safety-­related functions for events beyond the design basis, such as RCS venting of noncondensable gases, feed and bleed cooling, and anticipated transients without scram mitigation. It did not determine ­PORV closure after being stuck open to be a safety-­related function.

The NRC concluded that “it is appropriate to reconsider the safety classification of ­PORVs and the associated block valves,” and that “for future PWR plants, when ­PORVs and the associated block valves are used for any of the safety-­related functions discussed above, these components should be classified as safety related and a minimum of two ­PORVs and block valves installed.” For operating plants and construction permit holders, the NRC determined that “it is not cost-­effective to upgrade (backfit) existing non-­safety-­grade ­PORVs and block valves (and associated control systems) to full safety-­grade qualification status [even] when they have been determined to perform any of the safety-­related functions discussed above or to perform any other safety-­related function that may be identified in the future.” (Some plants still under construction voluntarily met the new requirements for future plants.)

The NRC issued the following new requirements for operating plants and construction permit holders:

Include ­PORVs and associated block valves in the scope of an operational quality assurance program under 10 CFR 50, Appendix B.

Include ­PORVs and associated block valves in the scope of an in-­service testing program under Section XI of the ASME Boiler and Pressure Vessel Code.

Modify the plant’s Technical Specifications to specify limiting conditions for operation for ­PORVs and block valves such that (1) if the plant runs with the block valve(s) closed (e.g., due to leaking ­PORVs), maintain electrical power to the block valves so they can be readily opened from the control room upon demand, and (2) limit operation in Modes 1, 2, and 3 with ­PORVs and block valves inoperable for reasons other than seat leakage to 72 hours.

When replacing a ­PORV or a block valve, “use, to the extent possible, more reliable ­PORV and block valve designs that are resistant to failure.”

The first three of these new requirements for operating plants do not involve replacing hardware. However, they may improve the reliability of the components if issues identified by the QA or in-­service testing programs are promptly corrected.

Safety analysis

A nuclear power plant’s safety analysis must meet the regulatory requirements specified in 10 CFR 50.34[29]. The NRC (and, previously, the AEC) gave detailed guidance for meeting 10 CFR 50.34 in Regulatory Guide 1.70[30]. The TMI-­2 FSAR was prepared following RG 1.70, Revision 1, and was submitted to the AEC on February 15, 1974. In RG 1.70, Revision 1, Table 15-­1, “Representative Types of Events to be Analyzed in Chapter 15.0 of the SAR,” lists “Loss of coolant accidents resulting from the spectrum of postulated piping breaks within the reactor coolant pressure boundary and relief and safety valve blowdowns.”

TMI-­2 FSAR Section 6.3.3.3, “Small Break Analysis,” defines small breaks to be RCS ruptures with leak areas of 0.5 ft2 or less. Breaks considered are (1) 0.44 ft2 in the CFT line, (2) 0.5 ft2 at an RCP discharge, and (3) 0.04 ft2 at an RCP suction, which was the most limiting. The description of the analysis computer code states, “Control volumes in and around the [reactor] vessel . . . [model] the occurrence of countercurrent flow,” and phase separation is represented. The analysis results show “that the core is always covered by a two-­phase mixture.”

TMI-­2 FSAR Section 15.1.14, “Loss-­of-­Coolant Accident,” presents LOCA analysis results for a spectrum of RCS break sizes, which demonstrate that the consequences of all LOCAs are in compliance with regulatory acceptance criteria. It does not include analysis of a ­PORV inadvertent opening or a stuck-­open ­PORV, because the consequences of these LOCAs are bounded by the results that are presented. This can be demonstrated by comparing the rate of mass discharge through the ­PORV with the rate of coolant injection provided by the ECCS HPI.

The TMI-­2 FSAR shows the ­PORV discharge rate for saturated steam at the ­PORV’s opening pressure setpoint to be 112,000 pounds mass per hour in Table 5.1-­2 and 118,909 lbm/hr on page 5.5-­11. At that pressure, one HPI pump is rated at 300 gpm, which is 150,210 lbm/hr, significantly greater than the ­PORV discharge rate. During the TMI-­2 accident, from about six minutes until the ­PORV block valve was closed, the discharge was two-­phase flow, not saturated steam. The ­PORV’s average discharge rate during this period has been calculated to have been 132,000 lbm/hr[31]. The RCS pressure during this time was always below the ESFAS setpoint pressure of 1,600 psig. At this pressure, one HPI pump is rated at 400 gpm, which is 200,280 lbm/hr. This is significantly greater than the ­PORV discharge rate. The TMI-­2 FSAR takes credit for two ECCS HPI pumps operating (assuming the single failure of one of the three HPI pumps). Thus, the ECCS HPI rates credited in the TMI-­2 FSAR were two-­and-­a-­half to three times the ­PORV discharge rate during the TMI-­2 accident.

Responses to “Root Causes…”

Zoltan Rosztoczy’s “Root Causes of the Three Mile Island Accident” in the March 2019 issue of Nuclear News presents an overly simplified, incomplete, single-­issue-­focused explanation of the accident. The article concludes that the root causes of the TMI-­2 accident are (1) the PORV and ­PORV block valve were not classified as safety related, and (2) a stuck-­open ­PORV transient was not included in the plant’s safety analysis. As the article notes, neither of these was cited in any of the many studies of the TMI-­2 accident as a root cause of the event.

Specific statements in the Rosztoczy article (in italics), and my responses to them, follow:

The two omissions—not recognizing the safety function of the ­PORV and the block valve, and the failure to analyze the stuck-­open ­PORV event—were the root causes of the TMI-­2 accident.

Why did the ­PORV fail to close? . . . During abnormal events, as in the TMI-­2 case, the ­PORV could be discharging two-­phase flow or water. The valve must be designed to perform its safety function—namely, to close following a two-­phase flow or water discharge.

Failure to incorporate the safety function of the ­PORV and the block valve in the design of the plant created the conditions for the TMI accident.

The ­PORV was designed to close; however, it did not have a safety function to close after either an inadvertent opening or after being stuck open. This is because it was protected by both the availability of the ­PORV block valve and the design safety function of the ECCS. The ­PORV failed to close 12 seconds into the accident, when the RCS pressure dropped below the valve’s closure setpoint. At that time, and for several more minutes, the valve was discharging only steam, not a two-­phase mixture or water. Thus, it failed to close against a discharge for which it was designed, not against LOCA discharge conditions. The valve’s failure to close contributed to the severity of the accident only because of the many other failures discussed above, particularly throttling the ECCS HPI. The NRC’s detailed studies of industry operating experience of the ­PORV and the block valve did not determine that they should be designated as safety related to protect against inadvertent ­PORV opening or a stuck-­open ­PORV.

As determined by all post-­TMI studies, many causes contributed to the accident. If one root cause must be assigned, it would be categorically “human performance.” This turned what would have been merely a complicated event, terminated without core damage anytime within the first 90 minutes by simply reinitiating ECCS HPI, into the TMI-­2 accident.

Inadvertent opening of the ­PORV or a stuck-­open ­PORV was not explicitly included in the TMI-­2 FSAR because their consequences were bounded by other events that were included.

The design process for the plant and the designer’s responsibilities, including the plant’s safety analysis, were not addressed [by the President’s Commission or the NRC’s Special Inquiry Group]. . . . None [of the post-­TMI studies] . . . have addressed the design process or the safety analysis of the plant.

The Kemeny Report’s[3] “Findings” stated, relative to the responsibilities of the designers, that they “failed to acquire enough information about safety problems, failed to analyze adequately what information they did acquire, or failed to act on that information.” It cited all of the precursors described above, noting B&W’s lack of notifying utilities. The Kemeny Report findings did not explicitly address the safety analysis prepared by B&W.

The Kemeny Report’s “Recommendations” for the industry, which affected designers, included (1) to “set and police its own standards of excellence,” (2) to “establish a program that specifies appropriate safety standards . . . and conducts independent evaluations,” (3) “systematic gathering, review, and analysis of operating experience at all nuclear power plants,” and (4) “management of both utilities and suppliers must insist on the early diagnosis and resolution of safety questions that arise in plant operations.”

The Rogovin Report[4] focused primarily on the role of the NRC. However, Section 8 of its “Conclusions and Recommendations” addressed numerous characteristics of the designer’s safety analysis, including “the design basis accident concept,” the “single failure criterion,” and designating systems and components as either “safety related” or “nonsafety related.” As previously noted, it recommended increased use of quantitative risk assessment techniques (citing methods and conclusions of the Reactor Safety Study[17], including the impact of human error.

The closed valves [emergency feedwater block valves] could have played a role in causing the accident. This possibility is not addressed in the [post-­TMI studies] literature.

The impact of this precursor condition is discussed above. The Kemeny Report[3] states, “The eight-­minute delay in restoring emergency [feedwater] flow did not directly affect the outcome of the accident—though it did serve to divert the attention of the operators.” The Rogovin Report[4] states, “The loss of emergency feedwater for eight minutes had no significant effect on the outcome of the accident. But it did add to the confusion that distracted the operators as they sought to understand the cause of their primary problem [their anomalous interpretations of various instrument readings].”

[The designer did not] conduct a complete and detailed safety analysis of the plant.

The problem was that some of the regulations were not followed.

The TMI-­2 FSAR met all regulatory requirements.

The plant’s response to the ­PORV failure was totally unexpected.

Not having addressed ­PORV failure in the plant safety analysis, the designers, as well as the training and operating staff, were unfamiliar with the plant’s response to this type of accident.

The author presumably is referring to the rising and persistently high water level in the pressurizer. This was unexpected by all plant personnel, even though it had happened in several precursor events, including at TMI-­2, and had been predicted in specific analyses. That information was not adequately communicated prior to the accident.

Despite the total lack of training for a stuck-­open ­PORV event, could the operators have realized what was going on and taken appropriate action? The answer is yes.

This is a conclusion of considerably subjective speculation. Following the accident, many drew the same conclusion. However, the operators and other plant staff presented their opposing reasoning in many lengthy interviews.

Both the plant designer and operator lacked the knowledge of how the plant would respond to a stuck-­open ­PORV.

Both the plant designer and the utility had knowledge of several precursor events elsewhere and at TMI-­2.

The other U.S. PWR designers, Westinghouse and Combustion Engineering, made the same omissions. How could three independent sets of engineers make the same mistake?

All U.S. PWR designers included “loss of coolant accidents resulting from . . . relief and safety valve blowdowns” in safety analyses as specified by regulatory requirements. If the results were not explicitly displayed in the safety analysis, it was because the consequences were bounded by other LOCAs.

The NRC had the distinct advantage of reviewing SARs from three independent designers. . . . The NRC, however, failed to recognize [these omissions].

There were no omissions.

The designers of these new systems can learn from the TMI experience.

There are many lessons to be learned from the TMI-­2 accident.

Personal notes

Zoltan Rosztoczy and I both worked for Combustion Engineering (C-­E) in the early 1970s. I joined the Safety Analysis Department in December 1971, shortly after Dr. Rosztoczy left as manager of the department to be C-­E’s principal representative at the AEC’s ECCS rulemaking hearings. We communicated frequently during the hearings, as I provided input to his testimony.

In the days following the TMI-­2 accident, I was deeply involved in studying the accident, particularly the pressurizer water level that misled the operators. I received a continuous stream of information from the TMI-­2 site, where several C-­E engineers were providing assistance. One week after the accident, another C-­E safety analysis engineer, Chuck Kling, and I completed our “tabletop” analysis of the progression of thermal-­hydraulic conditions of the reactor coolant during the accident. We immediately presented it to the vice president of the C-­E Nuclear Division Engineering, Frank Bevilacqua. The next day we confirmed it with data from the TMI-­2 ex-­core neutron detectors brought from the TMI-­2 site by another C-­E executive, Harold Lichtenberger. That weekend (10 days after the accident) at my kitchen table, I turned the analysis results into a series of “cartoons” of the coolant conditions in the TMI-­2 RCS. Copies of these were brought the next week by another C-­E engineer, Fred Sears, to EPRI’s newly formed Nuclear Safety Analysis Center and became part of the TH Appendix of NSAC-­1[5]. (I still have the originals.) I went on to lead C-­E’s response to NRC inquiries based on the TMI-­2 accident, to be involved in forming the C-­E Owners Group, and to manage it for its first four years until mid-­1983.


William E. Burchill’s career focused on nuclear safety. He was with Combustion Engineering for 25 years, where his last position was Director, Operations Services and Field Engineering. He was Director of Risk Management at Commonwealth Edison/Exelon. He retired from being Head of the Nuclear Engineering Department at Texas A&M University in 2007. In 2008–2009, he served as ANS president.

Part 2 was published in the June 2019 issue of Nuclear News and will be republished shortly on ANS Nuclear Newswire.

References

1. Z.R. Rosztoczy, “Root Causes of the Three Mile Island Accident,” Nuclear News (Mar. 2019).

2. NUREG-­0600, Investigation into the March 28, 1979, Three Mile Island Accident by Office of Inspection and Enforcement, V. Stello Jr., director of the NRC’s Office of Inspection and Enforcement (Aug. 1979).

3. NUREG/CR-­1250, Report of the President’s Commission on the Accident at Three Mile Island, J.G. Kemeny, chairman (Oct. 30, 1979).

4. Three Mile Island: A Report to the Commissioners and to the Public, M. Rogovin, director of Special Inquiry Group, U.S. Nuclear Regulatory Commission (Jan. 1980).

5. Analysis of Three Mile Island–Unit 2 Accident, Nuclear Safety Analysis Center, Electric Power Research Institute, NSAC-­80-­1, NSAC-­1 revised (Mar. 1980).

6. Nuclear Accident and Recovery at Three Mile Island, a report to the U.S. Senate prepared by the Subcommittee on Nuclear Regulation for the Committee on Environment and Public Works, G. Hart, chairman (June 1980).

7. J.S. Walker, Three Mile Island: A Nuclear Crisis in Historical Perspective, University of California Press (2004).

8. R.E. Henry, TMI-­2: An Event in Accident Management for Light-­Water-­Moderated Reactors, American Nuclear Society (2011).

9. NRC Bulletin 79-­05, Nuclear Incident at Three Mile Island (Apr. 1, 1979); Rev. S1 (Apr. 5, 1979); Rev. S2 (Apr. 21, 1979); and Rev. S3 (July 26, 1979).

10. NRC Bulletin 79-­06, Review of Operational Errors and System Misalignments Identified During the Three Mile Island Incident (Apr. 11, 1979: 79-­06a (Apr. 14, 1979); 79-­06a Rev. 1 (Apr. 14, 1979); 79-­06b (Apr. 14, 1979); and 79-­06c (July 26, 1979).

11. NRC Bulletin 79-­08, Events Relevant to Boiling Water Reactors Identified During the Three Mile Island Incident, U.S. Nuclear Regulatory Commission (Apr. 14, 1979).

12. NUREG-­0585, TMI-­2 Lessons Learned Task Force Final Report, U.S. Nuclear Regulatory Commission (Oct. 1979).

13. NUREG-­0660, NRC Action Plan Developed as a Result of the TMI-­2 Accident, U.S. Nuclear Regulatory Commission (May 1980).

14. NUREG-­0737, Clarification of TMI Action Plan Requirements, U.S. Nuclear Regulatory Commission (Nov. 1980).

15. R. A. Knief, Nuclear Engineering: Theory and Technology of Commercial Nuclear Power, 2nd Edition, American Nuclear Society (2008).

16. B.R. Sehgal, editor, Nuclear Safety in Light Water Reactors: Severe Accident Phenomenology, Elsevier/Academic Press (2012).

17. WASH-­1400 (NUREG-­75/014), Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants (the Rasmussen Report), U.S. Nuclear Regulatory Commission (1975).

18. NRC Generic Letter 79-­45, “Transmittal of Reports Regarding Foreign Reactor Operating Experiences” (Sept. 25, 1979).

19. NUREG-­0020, Licensed Operating Reactors: Status Summary Report (the Gray Book), discontinued after the December 1995 report.

20. G.B. Wallis, One-­dimensional Two-­phase Flow, McGraw-­Hill (1969).

21. W.E. Burchill, “Physical Phenomena of a Small-­Break Loss-­of-­Coolant Accident in a PWR,” Nuclear Safety 23 (5), pp. 525–536 (1982).

22. Semiscale Blowdown and Emergency Core Cooling (ECC) Project Test Report: Test 845 (ECC Injection), U.S. Atomic Energy Commission (1972).

23. W.E. Burchill and P.A. Lowe, “Experimental Evaluation of Post-­LOCA Steam Relief,” Transactions of the American Nuclear Society, Vol. 15, No. 2, pp. 830–831 (1972).

24. P.B. Abramson, editor, Guidebook to Light Water Reactor Safety Analysis, Hemisphere Publishing (1985).

25. NRC internal memorandum, “Proposed Generic Issue ‘PORV and Block Valve Reliability,’” W. Minners to D. DiIanni, June 6, 1983.

26. NUREG/CR-­4692, Operating Experience Review of Failures of Power Operated Relief Valves and Block Valves in Nuclear Power Plants, Oak Ridge National Laboratory (Oct. 1987).

27. NUREG-­1316, Technical Findings and Regulatory Analysis Related to Generic Issue 70, Evaluation of Power-­Operated Relief Valve and Block Valve Reliability in PWR Nuclear Power Plants, U.S. Nuclear Regulatory Commission (Dec. 1989).

28. NRC Generic Letter 90-­06, “Resolution of Generic Issue 70, ‘Power-­Operated Relief Valve and Block Valve Reliability,’ and Generic Issue 94, ‘Additional Low-­Temperature Over Pressure Protection for Light-­Water Reactors,’ Pursuant to 10 CFR 50.54(f)” (June 25, 1990).

29. 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, Section 34, “Contents of Applications; Technical Information” (Dec. 17, 1968).

30. Regulatory Guide 1.70, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, U.S. Nuclear Regulatory Commission (formerly U.S. AEC) (Feb. 1972); Rev. 1 (Oct. 1972); Rev. 2 (Sept. 1975); and Rev. 3 (Nov. 1978). This was preceded by the following guidance issued by the AEC: A Guide for the Organization and Contents of Safety Analysis Reports (June 30, 1966).

31. EGG-­TMI-­7703, Electromatic Relief Valve Flow and Primary System Hydrogen Storage During the TMI-­2 Accident, Idaho National Engineering Laboratory (May 1987).


Related Articles

Maintaining RIPB in commercial LWRs

ANS Standards Committee publishes new standard for light water reactor risk-informed, performance-based design

September 29, 2022, 3:22PMNuclear NewsKent B. Welter

The new standard ANSI/ANS-30.3-2022, Light Water Reactor Risk-Informed, Performance-Based Design, has just been issued by the American Nuclear Society. Approved by the American National...

ANS Grand Challenge: Expedite licensing

September 22, 2022, 9:30AMNuclear NewsNicholas R. Brown

As the largest ultra-low-carbon electricity source in the United States, nuclear energy is a vital pillar of the effort to mitigate climate change. Deployment of advanced nuclear reactor and...

Advanced reactor licensing and the path to cost certainty

How Kairos Power is applying rapid iterative development to the licensing process as part of its strategy to deliver on cost

September 20, 2022, 3:13PMNuclear NewsMike Laufer

Developing a first-­of-­a-­kind reactor is a daunting endeavor. To be successful, advanced reactor designers need to achieve cost certainty by delivering a safe and affordable product at...

The “gold standard” of regulation

September 12, 2022, 3:04PMNuclear News

Much has been written about regulation over the years, including whether or not the nuclear industry is overregulated or whether the regulator is in the industry’s “pocket.” Having a...