1. The accident at
Three Mile Island (TMI) occurred as a result of a series of human,
institutional, and mechanical failures.
2. Equipment failures
initiated the events of March 28 and contributed to the failure of
operating personnel (operators, engineers, and supervisors) to recognize
the actual conditions of the plant. Their training was deficient and
left them unprepared for the events that took place. (See finding F.)
These operating personnel made some improper decisions, took some
improper actions, and failed to take some correct actions, causing what
should have been a minor incident to develop into the TMI-2 accident.
3. The pilot-operated
relief valve (PORV) at the top of the pressurizer opened as expected
when pressure rose but failed to close when pressure decreased, thereby
creating an opening in the primary coolant system -- a small-break
loss-of-coolant accident (LOCA). The PORV indicator
light in the control room showed only
that the signal had been sent to close the PORV rather than
the fact that the PORV remained open. The operators, relying on the
indicator light and believing that the PORV had closed, did not heed
other indications and were unaware of the PORV failure; the LOCA
continued for over 2 hours. The TMI-2 emergency procedure for a
stuck-open PORV did not state that unless the PORV block valve was
closed, a LOCA would exist. Prior to TMI, the NRC had paid insufficient
attention to LOCAs of this size and the probability of their occurrence
in licensing reviews. Instead, the NRC focused most of its attention on
large-break LOCAs.
4. The high pressure injection system (HPI) -- a major design
safety system -- came on automatically. However, the operators were
conditioned to maintain the specified water level in the pressurizer and
were concerned that the plant was "going solid," that is, filled with
water. Therefore, they cut back HPI from 1,000 gallons per minute to less
than 100 gallons per minute. For extended periods on March 28, HPI was
either not operating or operating at an insufficient rate. This led to
much of the core being uncovered for extended periods on March 28 and
resulted in severe damage to the core. If the HPI had not been throttled,
core damage would have been prevented in spite of a stuck-open PORV.
5. TMI management and engineering personnel also had
difficulty in analyzing events. Even after supervisory personnel took
charge, significant delays occurred before core damage was fully
recognized, and stable cooling of the core was achieved.
6. Some of the key TMI-2 operating and emergency procedures
in use on March 28 were inadequate, including the procedures for a LOCA
and for pressurizer operation. Deficiencies in these procedures could
cause operator confusion or incorrect action.
7. Several earlier warnings that operators needed clear
instructions for dealing with events like those during the TMI accident
had been disregarded by Babcock & Wilcox (B&W) and the Nuclear Regulatory
Commission (NRC).
a. In September 1977, an incident occurred at the Davis-Besse
plant, also equipped with a B&W reactor. During that incident, a PORV
stuck open and pressurizer level increased, while pressure fell.
Although there were no serious consequences of that incident, operators
had improperly interfered with the HPI, apparently relying on rising
pressurizer level. The Davis-Besse plant had been operating at only 9
percent power and the PORV block valve was closed approximately 20
minutes after the PORV stuck open. That incident was investigated by
both B&W and the NRC, but no information calling attention to the
correct operator actions was provided to utilities prior to the TMI
accident. A B&W engineer had stated in an internal B&W memorandum
written more than a year before the TMI accident that if the Davis-Besse
event had occurred in a reactor operating at full power, "it is quite
possible, perhaps probable, that core uncovery and possible fuel damage
would have occurred."
b. An NRC official in January 1978 pointed out the
likelihood for erroneous operator action in a TMI-type incident. The NRC
did not notify utilities prior to the accident.
c. A Tennessee Valley Authority (TVA) engineer analyzed the
problem of rising pressurizer level and falling pressure more than a
year before the accident. His analysis was provided to B&W, NRC, and the
Advisory Committee on Reactor Safeguards. Again no notification was
given to utilities prior to the accident.
8. The control room was not adequately designed with the
management of an accident in mind. (See also finding G.8.e.) For example:
a. Burns and Roe, the TMI-2 architect-engineer, had never
systematically evaluated control room design in the context of a serious
accident to see how well it would serve in emergency conditions.
b. The information was presented in a manner which could
confuse operators:
(i) Over 100 alarms went off in the early stages of the
accident with no way of suppressing the unimportant ones and
identifying the important ones. The danger of having too many alarms
was recognized by Burns and Roe during the design stage, but the
problem was never resolved.
(ii) The arrangement of controls and indicators was not
well thought out. Some key indicators relevant to the accident were on
the back of the control panel.
(iii) Several instruments went off-scale during the course
of the accidentr, depriving the operators of highly significant
diagnostic information. These instruments were not designed to follow
the course of an accident.
(iv) The computer printer registering alarms was running
more than 1-\ hours behind the events and at one point jammed, thereby
losing valuable information.
c. After an April 1978 incident, a TMI-2 control room
operator complained to his superiors about problems with the control
room. No corrective action was taken by the utility.
9. In addition to the normal instrumentation present in the
control room at the time of the accident, TMI-2 was equipped with a
special data recorder that B&W had temporarily installed during the plant
start-up and never removed. This data recorder, called a reactimeter,
preserved a large amount of information useful in post-accident analysis.
This type of data recorder was not required as standard equipment by the
NRC.
10. Those managing the accident were unprepared for the
significant amount of hydrogen generated during the accident. Indeed,
during the TMI-2 licensing process which concentrated on large-break LOCAs,
the utility represented and the NRC agreed that in the event of a
large-break LOCA, the hydrogen concentration in containment would not be
significant for a period of weeks. In the first 10 hours of the TMI
accident (a small-break LOCA), enough hydrogen was produced in the core by
a reaction between steam and the zirconium cladding and then released to
containment to produce a burn or an explosion that caused pressure to
increase by 28 pounds per square inch in the containment building. Thus,
TMI illustrated a situation where NRC emphasis on large breaks did not
cover the effects observed in a smaller accident.
11. Iodine filters in the auxiliary and fuel handling
buildings did not perform as designed because the charcoal filtering
capacity was apparently partially expended due to improper use before the
accident. Required testing of filter effectiveness for the fuel handling
building had been waived by the NRC. There were no testing requirements to
verify auxiliary building filter effectiveness.
12. The nature and extent of damage to the core is not likely
to be known with assurance until the core materials are recovered and
carefully examined. However:
a. We estimate that there were failures in the cladding
around 90 percent of the fuel rods. The interaction of the very hot
cladding with water generated somewhere between 1,000 and 1,300 pounds
of hydrogen gas and converted 44 to 63 percent of the zirconium to
relatively weak zirconium oxide. As a result of oxidation and
embrittlement of the fuel rod cladding, several feet of the upper part
of the core fell into the gaps between the fuel rods, causing partial
blocking of the flow of steam or water that could remove heat from the
damaged fuel.
b. Fuel temperatures may have exceeded 4,000°F in the upper
30 to 40 percent of the core (approximately 30 to 40 tons of fuel).
Temperatures in parts of the damaged fuel that were not effectively
cooled by steam may have reached the melting point of the uranium oxide
fuel, about 5,200°F.
c. An NRC study suggests that some of the fuel may have
become liquid at temperatures above 3,500°F by dissolving in a
zirconium-zirconium oxide mixture. The study estimates that the amount
of fuel that may have melted by this process is from zero to a few tons.
An independent analysis by Argonne National Laboratory suggests that the
formation of such a mixture was unlikely.
d. Substantial fractions of the material in the reactor
control rods melted.
e. There is no indication that any core material made
contact with the steel pressure vessel at a temperature above the
melting point of steel (2,800°F).
13. The total release of radioactivity to the environment
from March 28 through April 27 has been established as 13 to 17 curies of
iodine and 2.4 million to 13 million curies of noble gases. (The health
effects of the radiation released are described in finding B.)
a. Five hundred thousand times as much radioactive iodine
(7.5 million curies) was retained in the primary loop. On April 1, 10.6
million curies of iodine were retained in the containment building's
water and about 36_^000 curies in the containment atmosphere. Four
million curies were in the auxiliary building tanks. Almost all of the
radioactive iodine released from the fuel was retained in the primary
system, containment, and the auxiliary building. Since the accident,
most of the short-lived radioactive iodine has decayed and is no longer
a danger.
b. No detectable amounts of the long-lived radioactive
cesium and strontium escaped to the environment, although considerable
quantities of each escaped from the fuel to the water of the primary
system, the containment building, and the auxiliary building tanks.
c. Most radioactivity escaping to the environment was in the
form of fission gases transported through the coolant let-down/ make-up
system into the auxiliary building and through the building filters and
the vent header to the outside atmosphere.
d. The major release of radioactivity on the morning of
March 30 was caused by the controlled, planned venting of the make-up
tank into the vent header. The header was known to have a leak.
14. The process of recovery, cleanup, and waste disposal will
be lengthy, costly, and presents its own health dangers. Cleanup of the
reactor and auxiliary buildings and disposal of approximately one million
gallons of radioactive water, a substantial amount of radioactive gases,
and the solid radioactive debris within the reactor vessel remain to be
done.
15. The cost of the accident, including this cleanup and a
portion of the waste disposal, will be between $1 billion and $1.86
billion, if the plant can be refurbished. If it cannot be refurbished, the
total cost will be significantly higher. An independent study prepared for
the Commission estimates these costs as follows:
