Atomic Accidents, page 45
“Shut the block valve!” Derivan yelled.
In case the PORV was stuck open, a second, simple valve, similar to the one used to turn on the water in a sink, could be operated remotely from the control room. It was named the block valve. An operator reached for the switch handle, gave it a quarter turn, the steam leakage stopped, and 20 minutes of hellish confusion ended. After 26 minutes of settling down, everything was back to normal.
The Nuclear Regulatory Commission and a number of top engineers from B&W were all over this incident. It was unnerving and very serious, because if the reactor had been running at a higher power, such as 50 percent, the entire core could have melted. With this level of operational chaos, a pure disaster was possible. The government and manufacturer representatives investigated in depth.
The problem was indeed the PORV, but it was not the fault of the PORV. A pen-chart recording showed that the valve had rapidly slammed open and then shut nine times, beating itself to pieces and leaving the steam line gaping open. The fault was back in the control room, in a rack of relays behind the control panels. An unnamed worker had found a bad relay in a circuit he was repairing. The same type of plug-in relay was used all over the system, and he needed one. He found a perfect replacement unit for his circuit in the PORV panel, so he unplugged it and used it. The PORV was used only for emergencies, and it would probably never be needed, he must have reasoned. The PORV, missing a logic element, went berserk when called to action by the primary steam-pressure sensor.231
That explained the problem, but what explanation was there from the operating staff for having shut down the ECCS? The HPI pumps had been manually killed only four minutes into the incident, at least 16 minutes before they had any clue as to what was happening. The ECCS was designed to keep the reactor from overheating and melting out the reactor core. To turn it off looked like sabotage.
The answer to the question was both simple and disturbing: they shut off the HPI to keep the pressurizer from going solid. This glaring problem with operator training, to undo this component of the Navy training, was discussed at length, but not to the point where operating power plants were notified of this finding, and the analysis of the frightful Davis-Besse incident got lost in the bureaucratic tangles at the NRC and at B&W. None of the other seven owners of B&W reactors were told about the dangerous confusion that can result when the PORV sticks open.
At about the same time, in the fall of 1977, Carl Michelson, an engineer working for the TVA in Knoxville, Tennessee, was studying the reactor building layout of the B&W model 177FA, when he noticed something.
In the training diagrams, in nuclear engineering textbooks, and in any diagram of a PWR primary cooling system simplified to the point where you can tell what is going on, the pressurizer is shown on top of the reactor vessel, usually connected to one of the hot pipes coming out near the top of the vessel. That is where the heated water comes out of the reactor and is piped to one of at least two steam generators. The pressurizer is the highest point in the system, so the steam bubble that is allowed to exist is always trapped in the uppermost part of the pressurizer tank. Because it is the highest point in the system, the water level in the pressurizer is used to evaluate the water level in the reactor, which is vitally important. If the water level ever falls below the top of the reactor fuel, which is blazing hot even with the reactor shut down due to the delayed heat production, then the internal structure of the reactor is going to melt.
Instead of putting expensive instrumentation on the reactor vessel to monitor the water level, the operators are taught just to look at the water level in the pressurizer. If there is any water at all in the pressurizer, then the reactor vessel must be completely full, and there is nothing to worry about. Just worry about the water in the pressurizer, and everything will be all right.
But in the B&W layout, the pressurizer is 43 feet tall, or about 10 feet taller than the reactor. There is not enough room below the fueling floor in the containment building for the pressurizer to be on top of the reactor. If it were, it would stick up out of the floor, so they had to lower it. In its position next to the number two steam generator, its inlet pipe had to be looped underneath a coolant pump line. The loop of pipe looks just like a sink drain trap, used to keep sewer gas from backing up into the sink. Michelson realized that no matter what condition might prevail in the reactor vessel, the water level in the pressurizer would never go below the trapping loop. The pressurizer would always be 20 percent full, even if the reactor was boiled dry. The operating crew in a 177FA control room actually had no idea of the water level covering the hot reactor fuel, and this struck him as dangerous. His finding caused a lot of commotion in the TVA, the NRC, and at B&W, but it never escaped the tangle and was never passed down to the operators at the eight reactors that B&W had built. There was a disaster, set up by a combination of policy and engineering, and it was waiting to happen.
On November 29, 60 days after the relief-valve fiasco, Davis-Besse experienced another emergency shutdown. The cause was traced to a wrongly wired patch panel in a control-room computer. In the middle of trying to figure out what was wrong and correct the problem, the operations staff, apparently acting on pure, ingrained instinct, again turned off the ECCS. The incident investigators found this action difficult to comprehend. Why did the operating staff at a nuclear power plant tend to disable the emergency core cooling system during an emergency?
These bits of information would have been useful at Three Mile Island, Pennsylvania, where a new B&W 177FA had been running “hot, straight, and normal” for almost three months. The first reactor unit built there, TMI-1, was down for refueling, and TMI-2, the new reactor, was running at 97 percent full power, putting 873 megawatts on the power grid for the owner, Metropolitan Edison of Pennsylvania. The two B&W reactors were built on a three-mile-long sandbar in the middle of the Susquehanna River, just south of Harrisburg, the state capital.
THE TMI-1 REACTOR SYSTEM WAS TYPICAL OF PRESSURIZED-WATER REACTORS USED ALL OVER THE WORLD, but some oddities of the B&W design contributed to a disastrous breakdown. The complete lack of water-level instrumentation in the reactor vessel was a big problem that the Nuclear Regulatory Commission would make illegal after the accident.
The TMI-2 reactor had been originally contracted for the Oyster Creek Nuclear Generating Station in New Jersey, supplementing a BWR brought online by General Electric back in 1969, but the Jersey craft-labor corruption was starting to get out of hand. Jim Neely, the negotiator for Jersey Central Power and Light, had been dealing with the mob ever since a worker made a point by dropping a wrench into the gearbox of the crane hoist while they were lifting the 700-ton reactor vessel into place for Unit 1 at the plant. That was alarmingly close to a disaster. Now a mob representative wanted one percent of the construction budget for the new B&W unit to ensure peace among the workers. That would be $7 million for one individual, and he was only the first in line. It was just not worth it to build a nuclear plant in New Jersey anymore, and Neely gave up. He amended the license application, and gladly transferred the contract to Met Ed, Pennsylvania. Maybe they would have more luck with it. TMI-2 was constructed without incident and began delivering power on December 30, 1978.
On March 16, 1979, a movie, The China Syndrome, opened in theaters nationwide. It was a fanciful cautionary tale about a potential nuclear power accident that could spread deadly radiation covering an area “the size of Pennsylvania.”232
It was March 28, 1979, heading toward 4:00 a.m., and the Shift Supervisor on duty was Bill Zewe. Zewe was 33 years old and had learned the nuclear business in the Navy. The previous shift had left him a problem. The steam that runs the turbine is turned back into water by the condenser beneath the turbine deck, dumping the excess heat to the twin, iconic cooling towers out back. The towers are each 30 stories tall, and they cool a million gallons of water per minute, making white, fluffy clouds rise into the air above.
The water out of the condenser must be “polished” before it returns to the delicate, expensive steam generators, removing anything that may have dissolved in it as it cycled through the pipes, valves, steam generator, pumps, and condenser. A bit of rust, for example, could have been picked up along the way, but the water is made sparkling pure as it is pumped through a line of eight 2,500-gallon tanks in the basement of the turbine building en route to the steam generators.
Each tank is filled with tiny balls of purifying resin, and they must be flushed out and replaced as they become contaminated or loaded with gunk out of the condensed water. Unfortunately, the resin beads tend to mash down and stick together, reminiscent of the problem that blew up on the Atomic Man back at Hanford, and the back-flushing system installed by B&W was underperforming. In Tank 7, the resin was stuck tight and was not moving. Zewe left two men working on the problem and climbed the eight flights of stairs to the control room. He asked Fred Schiemann, the foreman, a Navy man, to go down there and encourage them. As he left the control room, Schiemann gently reminded Zewe that the PORV was leaking, which was nothing new. In the 177FA design, B&W had replaced the troublesome Crosby PORV with a Dresser 31533VX30. In terms of reliability, it was proving no better than the Crosby. There was nothing particularly fatal about a little bit of leakage out the top of the pressurizer, but it was a pain, having to readjust everything as steam slowly escaped the primary coolant system and blew off into the containment building. It was just an irritant, and nothing more. It would be on the list of things to be corrected during the first refueling shutdown, which was not scheduled for two more years.
The men who had built this plant were an industrious, creative lot, and when they found that the resin beads could not be flushed using the factory-designed system, they added a compressed air line from the general-purpose compressed-air system in the plant. The air pipes were about the size of a garden hose. You could just open a valve, and the air bubbles would stir up the beads in the tanks and break them loose from sticking. There was not quite enough air in the system, so they cross-connected it to the instrument compressed-air system, which could then be used to open and close valves remotely, using switches in the control room. But ceasing to manually check those valves would be a problem, as somebody on the previous shift had air-flushed the tanks, but had forgotten to close the air valve. The one-way check valve in the air line was leaking, so for the past 10 hours, pressure from the 5,000 tons of water per hour running through the tanks had forced water up the instrument air line, almost to the point where it would cut off the air going to the valves on top of the eight tanks, which would slam them all shut at once and stop the flow through the steam system. There was an electrical backup system that would prevent such an improbable, almost impossible catastrophe, but it had not been wired up. The valves were supposed to be left open while the steam was running, but you could call up the control room and ask an operator to close the inlet valve on one of the eight tanks. Tanks could thus be cleaned out one at a time as the plant ran at full power.
Schiemann, down at the resin tanks, tried to assess the situation. They had not been able to dislodge the beads, and they had tried everything. A water flush, compressed air turned up all the way, and even steam had been unleashed on Tank 7. Schiemann climbed on top of the enormous water pipe so he could watch the sight glass and see the level of water in the tank. It was hard to see in the dim light. It was 3:58 a.m., and suddenly there was an awful quiet in the normally rumbling water pipe. Uh-oh. The water had backed up in the air pipe just enough to close all the valves atop the resin tanks.
He could feel it under his feet, a water hammer, caused by the sudden perturbation in the steam system, coming down the pipe, hot and fast, like a ballistic missile. He leaped free, just as the pipe jumped out of its mounts and ripped out the valve controls along the walls. Scalding hot water blew out into the room as the pump at the end of the pipe flew apart.
Back in the control room, every alarm tile on panel number 15 came lit up at once, and the warble-horns started going off. The turbine, sensing that it was not going to get any more steam, threw itself off line, and the reactor followed eight seconds later with an automatic scram, ramming all the neutron-absorbing controls deep into the core. The main safety valves in the secondary loop opened and blew the excess steam skyward. It sounded like the building was coming apart. The floor in the control room trembled, as the four main feed-water pumps shut down. Pressure in the reactor vessel, now denied its two primary cooling loops, rose sharply, and in three seconds the PORV opened automatically, blowing extremely hot water and steam into the drain tank on the containment building floor. On the control console a red light came on, indicating that the PORV had received an OPEN signal. Ten seconds later, a green light came on, indicating that the PORV had received the CLOSE signal. The sharp spike in the primary loop pressure had quickly dropped below 1,800 pounds per square inch, so there was no longer a need for an opening in the normally closed cooling system.
The senior men, Zewe, Faust, and the operator Ed Frederick, had seen this before, and knew it was a turbine trip. Regardless of the blinking lights and the pulsating horn blowing in their ears, it was nothing to get panicky about, and all the systems were acting correctly.
This feeling of tense calm lasted about two minutes, when the two high-pressure injection (HPI) pumps, a main part of the ECCS systems, switched on automatically. Now this was something new to Zewe, Faust, and Frederick. Why did the reactor think it needed emergency cooling? The temperature in the reactor was too high for this lockdown situation, and the pressure was too low. A minute later, Schiemann made it to the control room, gasping for breath after having sprinted up the staircase.
At 4.5 minutes after the turbine shutdown, Schiemann had been watching the water level rise in the pressurizer, and he ordered that one HPI pump be turned off, and throttle back the other one. The last thing he wanted was for the pressurizer to “go solid,” and with the pressure this low, the HPI was capable of filling it up. Still the water level rose, and meanwhile the two steam generators had boiled dry, making solidity in the pressurizer a very real possibility.
It had been eight minutes since the trip, and to the horror of the operating staff, the pressurizer was rapidly going solid. Frederick turned off the second HPI pump, thinking that the flow of water into the system was flooding the pressurizer. Still, the temperature in the system rose while the pressure kept falling. It made no sense. Everybody could see that something was wrong, but they did not know what.
Zewe had a hunch. He asked an operator to read him the temperature of the PORV outlet. If it was unnaturally high, it would mean that the green instrument light was wrong.233 If the PORV had not been closed, steam was escaping from the top of the pressurizer, and that would explain the low pressure. The operator shouted the value back to him: 228 degrees. That was not an unreasonable temperature. The valve had, after all, been leaking since January, and that was a little bit of steam getting past the valve cap. Unfortunately, the operator had read the wrong temperature readout. The outlet temperature of the PORV was actually 283 degrees, and the entire primary coolant inventory was draining out through it. The valve was jammed wide open, and the water was boiling out of the reactor core, forcing water up in the pressurizer and out the top. At that moment, when the temperature readout was off by 55 degrees, the TMI-2 power plant was lost, and a half-billion-dollar investment flushed down the drain. At the low pressure allowed by the open valve, the reactor could boil dry.
The critical time is that first hour, when the energy rate from the decaying fission products, freshly made in a core that was running at nearly full power, is falling rapidly from The fuel, the controls, and the oxidized zirconium structural elements247 megawatts down to 57 megawatts. If you can just keep water covering the fuel for that first hour, then everything else will work out fine. It does not have to be cool water or clean water, and it does not have to cover anything but the naked fuel pins, but if any fuel is left without water to conduct the heat away, it is going to start glowing cherry-red and melt down the supporting structures. It happens with merciless dispatch. With its gas-tight metal covering melted away, the uranium oxide and any soluble fission products embedded in it are free to dissolve in whatever water or steam is left in the reactor vessel, and this becomes a perfect vehicle for the highly radioactive, newly created elements to escape the normal confines of the tightly sealed PWR primary cooling system. It goes right out the jammed PORV, with the steam, into the drain tank. Fortunately, all of the fission products are solids, and even if the drain tank is opened they tend to stay inside the building, stuck to a wall or some expensive piece of equipment as the water evaporates.
All, that is, except the iodine-131 and xenon-133. They are gaseous. Iodine is not too bad, because it will corrode any metal in the building and bond to it, and there is a lot of metal in the building for it to cling to and thus not escape. Xenon-133, however, is guaranteed to escape into the outside world, as it will never bond with anything. It has a half-life of 5.24 days, undergoing beta-minus and gamma decay.
