Three Mile Island Meltdown
-
Upload
kvnsutton75 -
Category
Technology
-
view
1.033 -
download
0
Transcript of Three Mile Island Meltdown
Human error is to blame*
THE 28 MARCH 1979 THREE MILE ISLAND (TMI) MELTDOWN
BYK. W. SUTTON (C40)21 AUG 2015
*Time magazine 13 Aug 1979, quoting the NRC.
Objectives Respond to a lecture
request. Learn about the key event in
the history of America’s nuclear industry.
Extract and apply lessons learned.
Extract and apply key lessons.
Outline Setting Reactor Theory Power Plant
operations TMI accident Health News Coverage Assessment Consequences Application
Background and Accident Only.
Location 1/2
Southeast of Pennsylvania’s state capital.
Location 2/2
In densely populated area and on regional water source.
Susquehanna River
This is TMI!
The TMI site.
Aerial view of Three Mile Island.
Bucolic location.
TMI is within a community.
Y’all B*tches
Pay attention now!
Fission fundamentals Neutron strikes a
material which can fission (U-235).
U-235 atom blows apart, yielding radioactive particles, daughter atoms, and energy (heat).
Released neutrons cause more fissions.
Chain reaction ensues. Billions of small
explosions result in lots of energy!
Neutron
Split an atom, release energy.
Decay Heat Atoms formed after
fission emit particles. This results in heat,
thus power, generation. The power drops
quickly with time, but not to zero; about 6% one minute after shutdown.
Decay heat means a nuclear reactor is never really “off”. It always must be cooled.
Heat and Power generated after shutdown.
Power Plant Configuration
Do NOT Panic!
Power Plant Overview
Three closed loops: Primary, Secondary, Circulating.
The reactor heats water, called primary water. Pumps force primary water into the Steam Generators
(S/G). The primary water gives heat to the water in the S/Gs,
then returns to the reactor. The secondary water in the S/G flashes to steam. Steam exits the S/G, goes to the turbine to make
electricity. As the steam leaves the turbine, it condenses to water
and this water is pumped back to the S/G. Circulating water is what condenses the steam leaving
the turbine; it flows to the cooling tower, gives off heat to the atmosphere, and returns to the condenser.
The Pressurizer maintains primary plant pressure and is used to determine water volume. No vessel level indicator!
Power Plant Configuration
That was EASY!
TMI-2 Data Rated for 2700 Mega-Watts (thermal) / 852 Mega-
Watts (electrical), enough power for ~150,000 homes.
Normal pressure and temperature: 2155 psi / ~600 F.
Total primary water volume about 100,000 gallons. Reactor Vessel: 40 feet tall, 8 inch thick steel walls Reactor Vessel surrounded by concrete and steel
shields up to 9 feet thick. All enclosed with a 193 foot tall containment
building with concrete walls 4 feet thick.
Massive, heavy construction.
Call it like it is
Clear, Shared, and Understood terminology helps!
Fuel – Pellet, Rod, Cell, Core
~100 Tons Uranium clad with Zirconium.
Core also had:• 52 instrument tubes• 69 control rods
• Fuel pellets 1” tall, ½ inch wide. Uranium oxide in a metal cylinder made of Zirconium; this metal sheath is called “cladding”.
• 38,816 fuel rods, each 12 feet tall• 208 rods per assembly, 177 assemblies
Casualty Control Principles Shutdown (SCRAM) Maintain flow Remove decay heat Keep the core covered Prevent going “Solid” Contain radiation Trust Instrumentation Operators must Follow Procedures, Think,
and Act DeliberatelyC3 – Control, Cool, and Contain!
Failure limits At about 2,200 F the Zirconium/Water
reaction occurs: Zr + 2 H2O → ZrO2 + 2 H2
Note: Highly Exothermic (releases energy), produces combustible Hydrogen gas, and causes Zirconium cladding to fail. Zirconium cladding melts around 3,000 F. Uranium fuel melts at about 5,200 F.
At high temps, metal barrier (cladding) around fuel fails.
Hydrogen Gas
Hydrogen + Oxygen + Heat = BOOM!
Whew, the hard part is done!
The Accident
Sequence Of Events – 1/8 At ~0400 on 28 March 1979, with TMI-2 at 97% power, a loss of feed
water to the S/Gs occurs.• Cause never determined; most likely due to earlier maintenance on a
condensate “polisher” (filter and ion exchanger).• Issues with the “polisher” were a known problem, never fully understood or
solved. +2 seconds: Electrical Turbines trip.
• No steam being drawn from the S/Gs, the reactor quickly began to heat. Decay Heat initially ~6% of former power.
+5-6 seconds: Pilot Operated Relief Valve (PORV) lifts. (P = 2,255#) +8 seconds: Reactor SCRAM. +13 seconds: Pressure drops to 2,205#. PORV does not shut. PORV is
stuck open. Indicator light shows PORV shut – input from solenoid, not actual valve position. Loss of Coolant Accident (LOCA) begins, not noted.
Rapid occurrences! LOCA!
Beware: PORV status vital
As long as PORV is open, problems will mount.
PORV focus PORV relieved about 300 gallons/minute. A PORV sticking open had occurred at similar power plants. Downstream was a temperature sensor. When above 130 F,
procedure directed shutting a “blocking valve”. Not done. The PORV was known to leak, so the temperature alarm was
often on, thus operators ignored it, considering it “normal”. Valve position indicator light triggered by power to a solenoid,
so not actual valve position. The PORV relieved to a tank whose level and temperature
rapidly increased, also not noted. Ultimately the PORV would be open for 2 hours and 22 minutes
before it was isolated, venting about 35,000 gallons.
PORV stuck open. NO ONE notices. Primary mechanical cause of the TMI accident.
Stuck open PORV indicators:
Drain pipe temperature high and rising. Drain tank temperature and pressure rising. Drain tank radiation levels rising. Containment building sump level rising. Containment building sump level alarm. Containment building radiation and temperature rising. Auxiliary building water level rising. Increasing neutron level from the core.
Training on accidents inadequate.
Sequence Of Events - 2 +13-14 seconds: Operators use makeup system to slowly
add water to the reactor. +14 seconds: Operator notes emergency feed pumps
running but fails to note their outlet valves are shut, so no water flowing into the S/Gs – no heat being removed.
+48 seconds: Reactor pressure falling, pressurizer level rising (these are leak indications!).
+1 minute: About 100 alarms have actuated. +1 minute 45 seconds: S/Gs boil dry. Heat no longer
being removed from the reactor. + 2 minutes: High Pressure Injection (HPI) pumps
automatically start, adding water to the reactor at 1000 gpm per pump.
Unrecognized LOCA. Control room confusion.
Plant Status: +2 minutes Shut down (via a SCRAM) No heat being removed
via the S/Gs Core getting hotter! Relief valve (PORV) stuck
open! Actual casualty, a Loss of
Coolant Accident (LOCA) unrecognized.
Water being added by High Pressure Injection pumps.
LOCA not recognized.
Sequence Of Events - 3 +2 minutes +/- : With HPI pumps on, pressurizer level rises. +4 minutes +/- : Operators secure one HPI pump and reduce
the other’s flow to 100 gpm to avoid filling the pressurizer solid.• NOTE: With HPI on, falling pressure and constant temperature
indicates a LOCA. The operators fail to recognize the LOCA.• Reducing HPI to almost zero was the operator action which
ultimately caused the reactor to melt. +5 minutes: Steam bubbles form in the core, expelling water
into the pressurizer (level rises). Core temperature increasing. + 8 minutes: Operators note that S/Gs are not receiving feed
water, open the shut valves, and restore feed. Not a critical event for reactor safety, but increased control room confusion.
Steam forming in the core. HPI almost zero.
TMI-2 Control Room
Large; difficult to monitor and operate.
Sequence Of Events - 4 +11 minutes: High level alarm for containment building
sump -- a clear indication of a leak or break in the system. Significance not noted.
+15 minutes: Drain tank rupture disk bursts. More water to the containment sump. Water automatically pumped to the auxiliary building. Result is spread of radiation/contamination.
+20 minutes: Neutron levels rising -- a clear indication of steam in the core. Significance not noted.
~+20 -25 minutes: Pressure and temperature inside the containment building rising – another unrecognized indication of a leak from the primary system. Operators turn on ventilation. This spreads contamination.
LOCA unrecognized. Radiation and Contamination.
Plant Status: +25 minutes LOCA continues. Steam forming in
core. Operators taking
action which result in spreading of radiation and contamination.
LOCA not recognized. Steam in the core.
Sequence Of Events - 5 +39 minutes: Operators secure containment building sump
pump. 8,000 gallons of radioactive water have been pumped to the auxiliary building. Water source not identified.
+60 minutes: Reactor Coolant Pumps (RCPs) begin to vibrate due to low system pressure and steam in the system. This indication of steam in the core was unrecognized.
+74 minutes: Operators secure 2 of 4 RCPs. +101 minutes: Operators secure remaining two RCPs. No
core flow now. Significant core damage soon results. +120 minutes (two hours): First indications of fuel cladding
ruptures. Ruptures release radioactive gases which trigger high radiation alarms in the containment building.
LOCA unrecognized. Flow Stopped. Core damage begins.
Sequence Of Events - 6 + ~120 minutes (two hours): Zirconium/water
reaction begins. Fuel rods begin to fail. Hydrogen released to containment building. Hydrogen bubble begins to form in core.• Later analysis determined at +135 minutes, the top of
the core was uncovered and serious core damage began.• Once core is uncovered, significant fuel melting occurs.• Melted fuel releases fission products.• The highly radioactive fission products exit the reactor via
the stuck open PORV and thence into the containment building, auxiliary building, and possibly environment.
Core badly damaged. Releases Increasing.
Core Damage
Damaged TMI fuel rods.
Core Damage – Close up
50% of the core melted; nothing through the vessel.
I’m Melting!Ultimately: • 50% of the core melted.• Cladding failed on 90% of the fuel
rods.• About 20 tons of Uranium flowed to
the bottom of the pressure vessel.
Plant Status: +2 Hours LOCA continues. Core melting. Spreading
radiation and contamination.
LOCA not recognized. Core Melting. Releases.
Sequence Of Events - 7 +144 minutes (2 hours and 22 minutes): In
response to a query from new shift personnel, operators shut the PORV blocking valve. The LOCA is stopped.
+4 hours: Containment building automatically isolates itself (due to high pressure). Releases stopped.
+4.5 hours: Operators turn on HPI. Two hours later (1030 a.m.) the core is fully covered.
LOCA stopped. Isolation complete. Core covered.
Sequence Of Events – 8 / 8
Subsequent actions focused on:• Regaining control of the reactor.• Containing radiation and contamination.• Managing hydrogen (small explosion
occurred at 1350 in the containment building; fear about Hydrogen in the core.).
• Assuaging the public’s fears and health.• Messaging.
Days to regain control. Still (2015) cleaning up TMI.
Health Effects
Must separate fact from fiction, and fear!
Hoped for Radiation Effects
Releases
Layered containment effective.
Health Effects – NRC report Many groups exhaustively studied the radiological
effects of the TMI releases.• The approximately 2 million people around TMI-2
during the accident are estimated to have received an average radiation dose of only about 1 mrem above the usual background dose. (Chest X-ray is 6 mrem).
No adverse effects from radiation on human, animal, and plant life in the TMI area have been directly correlated to the accident.
“Comprehensive investigations and assessments by several well respected organizations . . . have concluded that in spite of serious damage to the reactor, the actual release had negligible effects on the physical health of individuals or the environment.”
No verifiable deleterious health effects.
News Coverage At 0825, local radio broke
the TMI story. Picked up at 0906 by the Associated Press.
Throughout the crisis, messaging was inept. Vague, erroneous, and/or contradictory reports caused a hostile relationship between the Utility/NRC and reporters with resultant loss of public confidence.
Poor information flow caused a hostile press.
News Coverage
Scared Public.
Some Headlines worse than others.
Cooling tower becomes image of nuclear power.
Public Concern.
Presidential interest
President Carter visited the site on 1 April 1979.
AssessmentPeople and Environment Radiological
Barriers and Control
Defense-in-Depth
7 Chernobyl, 1986 – Widespread health and environmental effects. External release of a significant fraction of reactor core.
6 Kyshtym, Russia, 1957 – Significant release of radioactive material to the environment from explosion of a high activity waste tank.
5 Windscale Pile, UK, 1957 – Release of radioactive material to the environment following a fire in a reactor core.
TMI, US, 1979 – Severe damage to the core.
4 Tokaimura, Japan, 1999 – Fatal overexposure of workers following a criticality event.
Saint Laurent des Eaux, France, 1980 – Melting of one channel of fuel in the reactor with no release outside the site.
3 No example available. Sellafield, UK, 2005 – Release of large quantity of radioactive material, contained with the installation.
Vandellos, Spain, 1989 – Near accident caused by fire resulting in loss of safety systems at the nuclear power station.
2 Atucha, Argentia, 2005 – Overexposure of a worker above annual limit.
Cadarache, France, 1993 – Spread of contamination to an area not expected by design
Forsmark, Sweden, 2006 – Degraded safety functions for common cause failure in the emergency power supply system at a nuclear plant.
1 Breach of operating limits at a nuclear facility.
ChernobylFukushima
Three Mile Island
Compare: Chernobyl, 1986
Steam explosion and fire.
Note: The arrow marks a 1,000 ton lid blown off the reactor vessel.
Compare: Fukushima, 2011
Damage from Hydrogen explosions.
Frame of Reference
Could have been much worse!
Casualty Control Principles: How did the TMI operators do?
Shutdown (SCRAM) -- YES* Maintain flow -- NO Remove decay heat -- NO Keep the core covered -- NO Prevent going “Solid” – YES** Contain radiation -- NO Trust Instrumentation – NO Follow Procedures, Think, and Act Deliberately --
NO
Human error ultimate cause of core damage.
*SCRAM was an automatic protective event; no operator action.
**Excess focus on not going solid caused operators to omit most other casualty control actions.
Consequences - 1
Nuclear industry lost public’s trust.
President’s report: “Personnel error, design deficiencies, and component failures caused the accident, which permanently changed the nuclear industry. Public fear and distrust increased.”
Consequences - 2
No new US nuclear plants since the 1990s.
Consequences - 3
Fearful and Distrusting Public.
Changes since TMI Upgrading and strengthening of plant design and equipment. Identifying the critical role of human performance in plant safety
led to revamping operator training and staffing requirements,. Enhancing emergency preparedness. Publishing NRC findings and conclusions on plant performance. NRC regularly analyzes and inspects plants for compliance. Expanding performance and safety inspections, and ORM. Creating a separate enforcement staff within the NRC. Establishing a group to provide a unified industry approach. Installing equipment to mitigate accidents and monitor plant
status. Enacting programs for early identification of safety problems. Expanding NRC's sharing in the US and internationally.Improved safety and reliability since TMI.
ApplicationFollow ProceduresHone Human/Machine interfaceFocus on what is importantTry not to start anything at 0400Foster effective information flowDo not rely on only one indicationDo not accept abnormalitiesThink, assess, and act deliberately
Discipline in Thought and Action
Never stop Learning!
Questions or Comments?