At 4.5 minutes after the turbine shutdown, Schiemann had been watching the water level rise in the pressurizer, and he ordered that one HPI pump be turned off, and throttle back the other one. The last thing he wanted was for the pressurizer to “go solid,” and with the pressure this low, the HPI was capable of filling it up. Still the water level rose, and meanwhile the two steam generators had boiled dry, making solidity in the pressurizer a very real possibility.
It had been eight minutes since the trip, and to the horror of the operating staff, the pressurizer was rapidly going solid. Frederick turned off the second HPI pump, thinking that the flow of water into the system was flooding the pressurizer. Still, the temperature in the system rose while the pressure kept falling. It made no sense. Everybody could see that something was wrong, but they did not know what.
Zewe had a hunch. He asked an operator to read him the temperature of the PORV outlet. If it was unnaturally high, it would mean that the green instrument light was wrong.[233] If the PORV had not been closed, steam was escaping from the top of the pressurizer, and that would explain the low pressure. The operator shouted the value back to him: 228 degrees. That was not an unreasonable temperature. The valve had, after all, been leaking since January, and that was a little bit of steam getting past the valve cap. Unfortunately, the operator had read the wrong temperature readout. The outlet temperature of the PORV was actually 283 degrees, and the entire primary coolant inventory was draining out through it. The valve was jammed wide open, and the water was boiling out of the reactor core, forcing water up in the pressurizer and out the top. At that moment, when the temperature readout was off by 55 degrees, the TMI-2 power plant was lost, and a half-billion-dollar investment flushed down the drain. At the low pressure allowed by the open valve, the reactor could boil dry.
The critical time is that first hour, when the energy rate from the decaying fission products, freshly made in a core that was running at nearly full power, is falling rapidly from The fuel, the controls, and the oxidized zirconium structural elements247 megawatts down to 57 megawatts. If you can just keep water covering the fuel for that first hour, then everything else will work out fine. It does not have to be cool water or clean water, and it does not have to cover anything but the naked fuel pins, but if any fuel is left without water to conduct the heat away, it is going to start glowing cherry-red and melt down the supporting structures. It happens with merciless dispatch. With its gas-tight metal covering melted away, the uranium oxide and any soluble fission products embedded in it are free to dissolve in whatever water or steam is left in the reactor vessel, and this becomes a perfect vehicle for the highly radioactive, newly created elements to escape the normal confines of the tightly sealed PWR primary cooling system. It goes right out the jammed PORV, with the steam, into the drain tank. Fortunately, all of the fission products are solids, and even if the drain tank is opened they tend to stay inside the building, stuck to a wall or some expensive piece of equipment as the water evaporates.
All, that is, except the iodine-131 and xenon-133. They are gaseous. Iodine is not too bad, because it will corrode any metal in the building and bond to it, and there is a lot of metal in the building for it to cling to and thus not escape. Xenon-133, however, is guaranteed to escape into the outside world, as it will never bond with anything. It has a half-life of 5.24 days, undergoing beta-minus and gamma decay.
After 15 minutes of taking water from the PORV outlet, the drain tank was completely full, but there was still a lot of primary coolant left. The cover on top of the tank ruptured, as it was meant to in an overfill emergency, and the water cascaded down the sides of the tank, across the floor, and into the sump ditch at the lowest point in the building. After a while, the sump was full to the top, and the pumps came on automatically, designed to transfer the runoff into a big tank somewhere else in the building. The pumps, however, were connected wrong. They started pumping the coolant, which eventually would be made radioactive by having dissolved fission products out of the red-hot fuel, into the auxiliary building. It was shared by the two reactors, TMI-1 and TMI-2, and it was not a sealed structure.
After an hour, 32,000 gallons of water had left the cooling system. The main coolant pumps, now pushing steam around, started shaking violently. The operators could feel it through the floor. After 14 minutes, they could stand it no longer and shut off two of the four pumps. The two remaining pumps felt like they were going to explode, so after another 27 minutes, they shut them down. There was now no known cooling system operating in a reactor that had been running nearly full blast less than two hours ago, and the staff had no idea what was happening. The level of water in the pressurizer, which was solid, indicated that the reactor vessel was still completely full.
The fire alarm went off in the containment building. Frederick canceled the siren, and then it went off again. This time, it was the control room fire alarm. But they were in the control room, and a quick glance proved that there was no fire here. Zewe walked around to the back of the console to have a look at the less important gauges. Here he found that the pressure in the containment was going up. What was going on? What was making the air pressure in the reactor building climb? Was something amiss in the primary cooling system? The phone rang. It was Terry Dougherty, former nuclear submarine machinist’s mate, calling to say that the sump pumps in the containment had switched on. As he was talking, Dougherty noticed that the hand-frisker in the hallway, a Geiger counter that checked workers’ hands for radioactivity at the doorway, was sounding its radiation-limit alarm. Its meter read 5,000 counts per minute, which was entirely abnormal.
Brian Mehler, the Met Ed Shift Supervisor for Three Mile Island, having been roused out of bed at 5:00 a.m. by a problem at the plant, finally arrived and was appalled at the conditions indicated by the instruments. The operators were all clustered around the pressurizer instruments, fretting about the high water level. Mehler turned to Schiemann. “Shut the block valve on top of the pressurizer,” he said, thus effectively shutting the barn door after all the horses had escaped. It would have been, of course, the correct action, but it was too late, two hours and eighteen minutes after the shutdown. Now, shutting the blocking valve simply closed off the only outlet for heat that the reactor had, which was the evaporation of the coolant. With that last, noble gesture, the melting began in earnest. It took about eight minutes for the top of the core to collapse.[234]
The radiation instruments monitoring the reactor core began to take off, as if it were trying to restart itself. Zewe called for a coolant analysis. If for some reason the boric acid concentration, normally high in a new uranium core, was brought down by dilution from the emergency water that had been injected, perhaps the reactor could go critical with all the control rods fully in? A power reactor was designed to have as much excess reactivity as was safe, to allow a long time between refuelings, and in a PWR some boron in the coolant was there to counteract the reactivity. As the fuel burned up, the excess reactivity would go away and the boron would be chemically removed from the coolant.
Before he was able to make any conclusions, there came another shrill call from Dougherty in the aux building. Something had filled up the sump in the building, and it was now overflowing and going down the floor drain. Just then, the radiation alarm went off in the aux building. There were now 50 people standing in the control room, simultaneously gripped by the sound of the radiation alarm in the containment building. Zewe picked up the intercom microphone and announced a Site Emergency, indicating a possibly uncontrolled release of radioactivity. TMI-2 was going down. If it had been a submarine, everyone would have drowned.
233
The green light was correct. The PORV had been signaled to close. But that did not mean that the valve had closed, only that the request had been made. In this way, the instrumentation in the B&W control room was not adequate. There should have been another set of red/green lights to show the physical state of the valve, opened or closed.
234
Unfortunately, at this moment the confusion factor in the control room was at its peak. George Kunder, the plant engineer, was on the phone in the back of the room with Leland Rogers, the B&W rep on site. He was familiar with the Davis-Besse incident and was an expert on the 177FA reactor systems. He listened to the symptoms and then asked Kunder, “Is the block valve closed at the top of the pressurizer?” Kunder replied yes. It had been closed moments before. Unfortunately, Rogers did not ask “How long has it been closed?” If only he had known that the pressurizer drain line had been open for over two hours, he would have instantly known what the problem was, and he would have told them to re-open it until they could get enough water into the system to re-start the coolant pumps. With his partial information, he did not realize that 250,000 pounds of coolant had blown out of the system, and all subsequent diagnoses were wrong.