Lably
Skip to content

Three Mile Island accident

1979 nuclear accident in Pennsylvania

  • 32 min read
  • 8 chapters
Color photograph of the Three Mile Island nuclear generating station, which suffered a partial meltdown in 1979. The reactors are in the smaller domes with rounded tops (the large smokestacks are just
United States Department of Energy · Public domain

Related on Lably

Through Radioactive decay, Statistical significance and Causality

The accident began with failures in the non-nuclear secondary system, followed by a stuck-open pilot-operated relief valve (PORV) in the primary system, which allowed large amounts of water to escape from the pressurized isolated coolant loop. The mechanical failures were compounded by the initial failure of plant operators to recognize the situation as a loss-of-coolant accident (LOCA). TMI training and operating procedures left operators and management ill-prepared for the deteriorating situation caused by the LOCA. During the accident, those inadequacies were compounded by design flaws, such as poor control design, the use of multiple similar alarms, and a failure of the equipment to indicate either the coolant-inventory level or the position of the stuck-open PORV.

The accident heightened nuclear safety concerns among the general public and led to new regulations for the nuclear industry. It accelerated the decline of efforts to build new reactors. Anti-nuclear movement activists expressed worries about regional health effects from the accident. Some epidemiological studies analyzing the rate of cancer in and around the area since the accident did determine that there was a statistically significant increase in the rate of cancer, while other studies did not. Due to the nature of such studies, a causal connection linking the accident with cancer is difficult to prove. Cleanup at TMI-2 started in August 1979 and officially ended in December 1993, with a total cost of about $1 billion (equivalent to $2 billion in 2025). TMI-1 was restarted in 1985, then retired in 2019 due to operating losses. It is expected to return to service in either 2027 or 2028 as part of a deal to power Microsoft data centers.

Accident

Background

In the night hours before the incident, the TMI-2 reactor was running at 97% power while the companion TMI-1 reactor was shut down for refueling. The main chain of events leading to the partial core meltdown on Wednesday, March 28, 1979, began at 4:00:36 a.m. EST in TMI-2's secondary loop, one of the three main water/steam loops in a pressurized water reactor.

The initial cause of the accident happened 11 hours earlier, during an attempt by operators to fix a blockage in one of the eight condensate polishers, the sophisticated filters cleaning the secondary loop water. These filters are designed to stop minerals and other impurities in the water from accumulating in the steam generators and to decrease corrosion rates on the secondary side.

Blockages are common with these resin filters and are usually fixed easily, but in this case, the usual method of forcing the stuck resin out with compressed air did not succeed. The operators decided to blow compressed air into the water and let the force of the water clear the resin. When they forced the resin out, a small amount of water forced its way past a stuck-open check valve and found its way into an instrument air line. This would eventually cause the feedwater pumps, condensate booster pumps, and condensate pumps to turn off around 4:00 a.m., which would, in turn, cause a turbine trip.

Reactor overheating and malfunction of relief valve

Given that the steam generators were no longer receiving feedwater, heat transfer from the reactor coolant system (RCS) was greatly reduced, and RCS temperature rose. The rapidly heating coolant expanded and surged into the pressurizer, compressing the steam bubble at the top. When RCS pressure rose to 2,255 psi (155.5 bar), the pilot-operated relief valve (PORV) opened, relieving steam through piping to the reactor coolant drain tank in the containment building basement. RCS pressure continued to rise, reaching the reactor protection system high-pressure trip setpoint of 2,355 psi (162.4 bar) eight seconds after the turbine trip. The reactor automatically tripped, its control rods falling into the core under gravity, halting the nuclear chain reaction and stopping the heat generated by fission. However, the reactor continued to generate decay heat, initially equivalent to approximately 6% of the pre-trip power level. Because steam was no longer being used by the turbine and feed was not being supplied to the steam generators, heat removal from the reactor's primary water loop was limited to steaming the small amount of water remaining in the secondary side of the steam generators to the condenser using turbine bypass valves.

When the feedwater pumps tripped, three emergency feedwater pumps started automatically. An operator noted that the pumps were running but did not notice that a block valve was closed in each of the two emergency feedwater lines, blocking emergency feed flow to both steam generators. The valve position lights for one block valve were covered by a yellow maintenance tag. The reason why the operator missed the lights for the second valve is not known, although one theory is that his own large belly hid it from his view. The valves may have been left closed during a surveillance test two days earlier. With the block valves closed, the system was unable to pump water. The closure of these valves was a violation of a key Nuclear Regulatory Commission (NRC) rule, according to which the reactor must be shut down if all auxiliary feed pumps are closed for maintenance. This was later singled out by NRC officials as a key failure.

After the reactor tripped, secondary system steam valves operated to reduce steam generator temperature and pressure, cooling the RCS and lowering RCS temperature, as designed, resulting in a contraction of the primary coolant. With the coolant contraction and loss of coolant through the open PORV, RCS pressure dropped as did pressurizer level after peaking 15 seconds after the turbine trip. Also, 15 seconds after the turbine trip, coolant pressure had dropped to 2,205 psi (152.0 bar), the reset setpoint for the PORV. Electric power to the PORV's solenoid was automatically cut, but the relief valve was stuck open with coolant water continuing to be released.

In post-accident investigations, the indication for the PORV was one of many design flaws identified in the operators' controls, instruments and alarms. There was no direct indication of the valve's actual position. A light on a control panel, installed after the PORV had stuck open during startup testing, came on when the PORV opened. When that light - labeled Light on - RC-RV2 open - went out, the operators believed that the valve was closed. In fact, the light when on only indicated that the PORV pilot valve's solenoid was powered, not the actual status of the PORV. While the main relief valve was stuck open, the operators believed the unlit lamp meant the valve was shut. As a result, they did not correctly diagnose the problem for several hours.

The operators had not been trained to understand the ambiguous nature of the PORV indicator and to look for alternative confirmation that the main relief valve was closed. A downstream temperature indicator, the sensor for which was located in the tail pipe between the pilot-operated relief valve and the pressurizer relief tank, could have hinted at a stuck valve had operators noticed its higher-than-normal reading. It was not, however, part of the "safety grade" suite of indicators designed to be used after an incident, and personnel had not been trained to use it. Its location behind the seven-foot-high instrument panel also meant that it was effectively out of sight.

Depressurization of primary reactor cooling system

Less than a minute after the beginning of the event, the water level in the pressurizer began to rise, even though RCS pressure was falling. With the PORV stuck open, coolant was being lost from the RCS, a loss-of-coolant accident (LOCA). Expected symptoms for a LOCA were drops in both RCS pressure and pressurizer level. The operators' training and plant procedures did not cover a situation where the two parameters went in opposite directions. The water level in the pressurizer was rising because the steam in the space at the top of the pressurizer was being vented through the stuck-open PORV, lowering the pressure in the pressurizer because of the lost inventory. The lowering of pressure in the pressurizer made water from the coolant loop surge in and created a steam bubble in the reactor pressure vessel head, aided by the decay heat from the fuel.

This steam bubble was invisible for the operators, and this mechanism had not been trained. Indications of high water levels in the pressurizer contributed to confusion, as operators were concerned about the primary loop "going solid", (i.e., no steam pocket buffer existing in the pressurizer) which in training they had been instructed to never allow. This confusion was a key contributor to the initial failure to recognize the accident as a LOCA and led operators to turn off the emergency core cooling pumps, which had automatically started after the PORV stuck and core coolant loss began, due to fears the system was being overfilled.

With the PORV still open, the pressurizer relief tank that collected the discharge from the PORV overfilled, causing the containment building sump to fill and sound an alarm at 4:11 a.m. This alarm, along with higher than normal temperatures on the PORV discharge line and unusually high containment building temperatures and pressures, were clear indications that there was an ongoing LOCA, but these indications were initially ignored by operators. At 4:15 a.m., the relief diaphragm of the pressurizer relief tank ruptured, and radioactive coolant began to leak into the general containment building. This radioactive coolant was pumped from the containment building sump to an auxiliary building, outside the main containment, until the sump pumps were stopped at 4:39 a.m.

Partial meltdown and further release of radioactive substances

At about 5:20 a.m., after almost 80 minutes with a growing steam bubble in the reactor pressure vessel head, the primary loop's four main reactor coolant pumps began to cavitate as a steam bubble/water mixture, rather than water, passed through them. The pumps were shut down, and it was believed that natural circulation would continue the water movement. Steam in the system prevented flow through the core, and as the water stopped circulating it was converted to steam in increasing amounts. Soon after 6:00 a.m., the top of the reactor core was exposed, and the intense heat caused a reaction to occur between the steam forming in the reactor core and the zircaloy nuclear fuel rod cladding, yielding zirconium dioxide, hydrogen, and additional heat. This reaction melted the nuclear fuel rod cladding and damaged the fuel pellets, which released radioactive isotopes to the reactor coolant and produced hydrogen gas that is believed to have caused a small explosion in the containment building later that afternoon.

At 6:00 a.m. there was a shift change in the control room. A new arrival noticed that the temperatures in the PORV tail pipe and the holding tanks were excessive, and used a backup—called a block valve—to shut off the coolant venting via the PORV, but around 32,000 US gal (120,000 L) of coolant had already leaked from the primary loop. It was not until 6:45 a.m., 165 minutes after the start of the problem, that radiation alarms activated when the contaminated water reached detectors; by that time, the radiation levels in the primary coolant water were around 300 times expected levels, and the general containment building was seriously contaminated with radiation levels of 800 rem/h.

Sign in to keep reading

7 more chapters are free with a Lably account.

More in Environment